@sphereon/oid4vci-client 0.19.0 → 0.19.1-feature.SSISDK.13.18

package/dist/index.cjs

@@ -26,18 +26,22 @@ __export(index_exports, {
   CredentialOfferClient: () => CredentialOfferClient,
   CredentialOfferClientV1_0_11: () => CredentialOfferClientV1_0_11,
   CredentialOfferClientV1_0_13: () => CredentialOfferClientV1_0_13,
+  CredentialOfferClientV1_0_15: () => CredentialOfferClientV1_0_15,
   CredentialRequestClient: () => CredentialRequestClient,
   CredentialRequestClientBuilder: () => CredentialRequestClientBuilder,
   CredentialRequestClientBuilderV1_0_11: () => CredentialRequestClientBuilderV1_0_11,
   CredentialRequestClientBuilderV1_0_13: () => CredentialRequestClientBuilderV1_0_13,
+  CredentialRequestClientBuilderV1_0_15: () => CredentialRequestClientBuilderV1_0_15,
   CredentialRequestClientV1_0_11: () => CredentialRequestClientV1_0_11,
   LOG: () => LOG2,
   MetadataClient: () => MetadataClient,
   MetadataClientV1_0_11: () => MetadataClientV1_0_11,
   MetadataClientV1_0_13: () => MetadataClientV1_0_13,
+  MetadataClientV1_0_15: () => MetadataClientV1_0_15,
   OpenID4VCIClient: () => OpenID4VCIClient,
   OpenID4VCIClientV1_0_11: () => OpenID4VCIClientV1_0_11,
   OpenID4VCIClientV1_0_13: () => OpenID4VCIClientV1_0_13,
+  OpenID4VCIClientV1_0_15: () => OpenID4VCIClientV1_0_15,
   ProofOfPossessionBuilder: () => ProofOfPossessionBuilder,
   acquireAuthorizationChallengeAuthCode: () => acquireAuthorizationChallengeAuthCode,
   acquireAuthorizationChallengeAuthCodeUsingRequest: () => acquireAuthorizationChallengeAuthCodeUsingRequest,
@@ -56,7 +60,7 @@ __export(index_exports, {
   sendNotification: () => sendNotification
 });
 module.exports = __toCommonJS(index_exports);
-var import_oid4vci_common26 = require("@sphereon/oid4vci-common");
+var import_oid4vci_common30 = require("@sphereon/oid4vci-common");
 
 // lib/AccessTokenClient.ts
 var import_oid4vc_common3 = require("@sphereon/oid4vc-common");
@@ -373,10 +377,10 @@ async function handleCredentialOfferUri(uri) {
   const decodedUri = isUriEncoded(credentialOfferUri) ? decodeURIComponent(credentialOfferUri) : credentialOfferUri;
   const response = await (0, import_cross_fetch.fetch)(decodedUri);
   if (!(response && response.status >= 200 && response.status < 400)) {
-    return Promise.reject(`the credential offer URI endpoint call was not successful. http code ${response.status} - reason ${response.statusText}`);
+    return Promise.reject(Error(`the credential offer URI endpoint call was not successful. http code ${response.status} - reason ${response.statusText}`));
   }
   if (response.headers.get("Content-Type")?.startsWith("application/json") === false) {
-    return Promise.reject("the credential offer URI endpoint did not return content type application/json");
+    return Promise.reject(Error("the credential offer URI endpoint did not return content type application/json"));
   }
   return {
     credential_offer: (0, import_oid4vci_common7.decodeJsonProperties)(await response.json())
@@ -1500,8 +1504,8 @@ var createAuthorizationRequestUrl = /* @__PURE__ */ __name(async ({ pkce, endpoi
     if ("credentials" in credentialOffer.credential_offer) {
       throw new Error("CredentialOffer format is wrong.");
     }
-    const ver = version ?? (0, import_oid4vci_common13.determineSpecVersionFromOffer)(credentialOffer.credential_offer) ?? import_oid4vci_common13.OpenId4VCIVersion.VER_1_0_13;
-    const creds = ver === import_oid4vci_common13.OpenId4VCIVersion.VER_1_0_13 ? filterSupportedCredentials(credentialOffer.credential_offer, credentialConfigurationSupported) : [];
+    const ver = version ?? (0, import_oid4vci_common13.determineSpecVersionFromOffer)(credentialOffer.credential_offer) ?? import_oid4vci_common13.OpenId4VCIVersion.VER_1_0_15;
+    const creds = ver === import_oid4vci_common13.OpenId4VCIVersion.VER_1_0_15 ? filterSupportedCredentials(credentialOffer.credential_offer, credentialConfigurationSupported) : [];
     authorizationDetails = creds.flatMap((cred) => {
       const locations = [
         credentialOffer?.credential_offer.credential_issuer ?? endpointMetadata.issuer
@@ -1511,7 +1515,7 @@ var createAuthorizationRequestUrl = /* @__PURE__ */ __name(async ({ pkce, endpoi
       if (!credential_configuration_id && !cred.format) {
         throw Error("format is required in authorization details");
       }
-      const vct = cred.format === "vc+sd-jwt" ? cred.vct : void 0;
+      const vct = cred.format === "dc+sd-jwt" ? cred.vct : void 0;
       const doctype = cred.format === "mso_mdoc" ? cred.doctype : void 0;
       let credential_definition = void 0;
       if ((0, import_oid4vci_common13.isW3cCredentialSupported)(cred)) {
@@ -1608,7 +1612,7 @@ var createAuthorizationRequestUrl = /* @__PURE__ */ __name(async ({ pkce, endpoi
   }
   await createSignedAuthRequestWhenNeeded(queryObj, {
     ...requestObjectOpts,
-    aud: endpointMetadata.authorization_server
+    aud: endpointMetadata.authorization_server ?? endpointMetadata.authorizationServerMetadata?.issuer
   });
   logger6.debug(`Object that will become query params: ` + JSON.stringify(queryObj, null, 2));
   const url = (0, import_oid4vci_common13.convertJsonToURI)(queryObj, {
@@ -1884,6 +1888,27 @@ async function buildProof(proofInput, opts) {
   return await proofInput.build();
 }
 __name(buildProof, "buildProof");
+function isOpenIdCredentialDetail(ad) {
+  return typeof ad === "object" && ad !== null && ad.type === "openid_credential";
+}
+__name(isOpenIdCredentialDetail, "isOpenIdCredentialDetail");
+function findAuthorizationDetail(authorizationDetails, preferredConfigId) {
+  if (!authorizationDetails) {
+    return void 0;
+  }
+  const openIdCredentialDetails = authorizationDetails.filter(isOpenIdCredentialDetail);
+  if (openIdCredentialDetails.length === 0) {
+    return void 0;
+  }
+  if (preferredConfigId) {
+    const match = openIdCredentialDetails.find((detail) => typeof detail === "object" && detail !== null && detail.credential_configuration_id === preferredConfigId);
+    if (match) {
+      return match;
+    }
+  }
+  return openIdCredentialDetails[0];
+}
+__name(findAuthorizationDetail, "findAuthorizationDetail");
 var CredentialRequestClient = class {
   static {
     __name(this, "CredentialRequestClient");
@@ -1923,7 +1948,10 @@ var CredentialRequestClient = class {
       credentialIdentifier,
       subjectIssuance
     });
-    return await this.acquireCredentialsUsingRequestWithoutProof(request, opts.createDPoPOpts);
+    if (!import_oid4vci_common15.supportedOID4VCICredentialFormat.includes(format)) {
+      return Promise.reject(Error(`Unsupported credential format: ${format}`));
+    }
+    return await this.acquireCredentialsUsingRequestWithoutProof(request, format, opts.createDPoPOpts);
   }
   async acquireCredentialsUsingProof(opts) {
     const { credentialIdentifier, credentialTypes, proofInput, format, context, subjectIssuance } = opts;
@@ -1936,19 +1964,22 @@ var CredentialRequestClient = class {
       credentialIdentifier,
       subjectIssuance
     });
-    return await this.acquireCredentialsUsingRequest(request, opts.createDPoPOpts);
+    if (this.version() <= import_oid4vci_common15.OpenId4VCIVersion.VER_1_0_13 && !import_oid4vci_common15.supportedOID4VCICredentialFormat.includes(format)) {
+      return Promise.reject(Error(`Unsupported credential format: ${format}`));
+    }
+    return await this.acquireCredentialsUsingRequest(request, format, opts.createDPoPOpts);
   }
-  async acquireCredentialsUsingRequestWithoutProof(uniformRequest, createDPoPOpts) {
-    return await this.acquireCredentialsUsingRequestImpl(uniformRequest, createDPoPOpts);
+  async acquireCredentialsUsingRequestWithoutProof(uniformRequest, format, createDPoPOpts) {
+    return await this.acquireCredentialsUsingRequestImpl(uniformRequest, format, createDPoPOpts);
   }
-  async acquireCredentialsUsingRequest(uniformRequest, createDPoPOpts) {
-    return await this.acquireCredentialsUsingRequestImpl(uniformRequest, createDPoPOpts);
+  async acquireCredentialsUsingRequest(uniformRequest, format, createDPoPOpts) {
+    return await this.acquireCredentialsUsingRequestImpl(uniformRequest, format, createDPoPOpts);
   }
-  async acquireCredentialsUsingRequestImpl(uniformRequest, createDPoPOpts) {
+  async acquireCredentialsUsingRequestImpl(uniformRequest, format, createDPoPOpts) {
     if (this.version() < import_oid4vci_common15.OpenId4VCIVersion.VER_1_0_13) {
       throw new Error("Versions below v1.0.13 (draft 13) are not supported by the V13 credential request client.");
     }
-    const request = (0, import_oid4vci_common15.getCredentialRequestForVersion)(uniformRequest, this.version());
+    const request = (0, import_oid4vci_common15.getCredentialRequestForVersion)(uniformRequest, format, this.version());
     const credentialEndpoint = this.credentialRequestOpts.credentialEndpoint;
     if (!(0, import_oid4vci_common15.isValidURL)(credentialEndpoint)) {
       logger8.debug(`Invalid credential endpoint: ${credentialEndpoint}`);
@@ -2036,27 +2067,64 @@ ${JSON.stringify(response, null, 2)}`);
     return await this.createCredentialRequestImpl(opts);
   }
   async createCredentialRequestImpl(opts) {
-    const { proofInput, credentialIdentifier: credential_identifier } = opts;
+    const { proofInput, credentialIdentifier, credentialConfigurationId } = opts;
     let proof = void 0;
     if (proofInput) {
       proof = await buildProof(proofInput, opts);
     }
-    if (credential_identifier) {
-      if (opts.format || opts.credentialTypes || opts.context) {
-        throw Error(`You cannot mix credential_identifier with format, credential types and/or context`);
-      }
-      return {
-        credential_identifier,
+    if (this.version() >= import_oid4vci_common15.OpenId4VCIVersion.VER_1_0_15) {
+      const authDetail = findAuthorizationDetail(this.credentialRequestOpts.authorizationDetails, credentialConfigurationId ?? credentialIdentifier);
+      const issuer_state2 = this.credentialRequestOpts.issuerState;
+      const commonBody = {
+        ...issuer_state2 && {
+          issuer_state: issuer_state2
+        },
         ...proof && {
           proof
-        }
+        },
+        ...opts.subjectIssuance
+      };
+      const authDetailObj = authDetail && typeof authDetail === "object" ? authDetail : null;
+      if (authDetailObj?.credential_identifier) {
+        return {
+          credential_identifier: authDetailObj.credential_identifier,
+          ...commonBody
+        };
+      }
+      if (authDetailObj?.credential_identifiers && authDetailObj.credential_identifiers.length > 0) {
+        return {
+          credential_identifier: authDetailObj.credential_identifiers[0],
+          ...commonBody
+        };
+      }
+      const configId = credentialConfigurationId ?? authDetailObj?.credential_configuration_id ?? this._credentialRequestOpts.credentialConfigurationId;
+      if (configId) {
+        return {
+          credential_configuration_id: configId,
+          ...commonBody
+        };
+      }
+      if (credentialIdentifier) {
+        return {
+          credential_identifier: credentialIdentifier,
+          ...commonBody
+        };
+      }
+      return Promise.reject(Error("No credential_identifier or credential_configuration_id available for v1.0-15 request"));
+    }
+    if (credentialIdentifier) {
+      const proof_obj = proof ? {
+        proof
+      } : {};
+      return {
+        credential_identifier: credentialIdentifier,
+        ...proof_obj
       };
     }
     const formatSelection = opts.format ?? this.credentialRequestOpts.format;
     if (!formatSelection) {
       throw Error(`Format of credential to be issued is missing`);
     }
-    const format = (0, import_oid4vci_common15.getUniformFormat)(formatSelection);
     const typesSelection = opts?.credentialTypes && (typeof opts.credentialTypes === "string" || opts.credentialTypes.length > 0) ? opts.credentialTypes : this.credentialRequestOpts.credentialTypes;
     if (!typesSelection) {
       throw Error(`Credential type(s) need to be provided`);
@@ -2068,70 +2136,25 @@ ${JSON.stringify(response, null, 2)}`);
       throw Error(`Credential type(s) need to be provided`);
     }
     const issuer_state = this.credentialRequestOpts.issuerState;
-    if (format === "jwt_vc_json" || format === "jwt_vc") {
-      return {
-        credential_definition: {
-          type: types
-        },
-        format,
-        ...issuer_state && {
-          issuer_state
-        },
-        ...proof && {
-          proof
-        },
-        ...opts.subjectIssuance
-      };
-    } else if (format === "jwt_vc_json-ld" || format === "ldp_vc") {
-      if (this.version() >= import_oid4vci_common15.OpenId4VCIVersion.VER_1_0_12 && !opts.context) {
-        throw Error("No @context value present, but it is required");
-      }
+    if (formatSelection === "jwt_vc_json" || formatSelection === "ldp_vc") {
       return {
-        format,
-        ...issuer_state && {
-          issuer_state
-        },
-        ...proof && {
-          proof
-        },
-        ...opts.subjectIssuance,
+        format: formatSelection,
         credential_definition: {
           type: types,
-          "@context": opts.context
-        }
-      };
-    } else if (format === "vc+sd-jwt") {
-      if (types.length > 1) {
-        throw Error(`Only a single credential type is supported for ${format}`);
-      }
-      return {
-        format,
-        ...issuer_state && {
-          issuer_state
-        },
-        ...proof && {
-          proof
+          ...opts.context && {
+            "@context": opts.context
+          }
         },
-        vct: types[0],
-        ...opts.subjectIssuance
-      };
-    } else if (format === "mso_mdoc") {
-      if (types.length > 1) {
-        throw Error(`Only a single credential type is supported for ${format}`);
-      }
-      return {
-        format,
         ...issuer_state && {
           issuer_state
         },
         ...proof && {
           proof
         },
-        doctype: types[0],
         ...opts.subjectIssuance
       };
     }
-    throw new Error(`Unsupported credential format: ${format}`);
+    return Promise.reject(Error(`Format ${formatSelection} is not supported in this protocol version`));
   }
   version() {
     return this.credentialRequestOpts?.version ?? import_oid4vci_common15.OpenId4VCIVersion.VER_1_0_13;
@@ -2445,11 +2468,101 @@ var CredentialOfferClientV1_0_13 = class {
   }
 };
 
-// lib/CredentialRequestClientV1_0_11.ts
-var import_oid4vc_common6 = require("@sphereon/oid4vc-common");
+// lib/CredentialOfferClientV1_0_15.ts
 var import_oid4vci_common19 = require("@sphereon/oid4vci-common");
 var import_ssi_types13 = require("@sphereon/ssi-types");
-var logger11 = import_ssi_types13.Loggers.DEFAULT.get("sphereon:oid4vci:credential");
+var logger11 = import_ssi_types13.Loggers.DEFAULT.get("sphereon:oid4vci:offer");
+var CredentialOfferClientV1_0_15 = class {
+  static {
+    __name(this, "CredentialOfferClientV1_0_15");
+  }
+  static async fromURI(uri, opts) {
+    logger11.debug(`Credential Offer URI: ${uri}`);
+    if (!uri.includes("?") || !uri.includes("://")) {
+      logger11.debug(`Invalid Credential Offer URI: ${uri}`);
+      return Promise.reject(Error(`Invalid Credential Offer Request`));
+    }
+    const scheme = uri.split("://")[0];
+    const baseUrl = uri.split("?")[0];
+    const version = (0, import_oid4vci_common19.determineSpecVersionFromURI)(uri);
+    let credentialOffer;
+    if (uri.includes("credential_offer_uri")) {
+      credentialOffer = await handleCredentialOfferUri(uri);
+    } else {
+      credentialOffer = (0, import_oid4vci_common19.convertURIToJsonObject)(uri, {
+        // It must have the '=' sign after credential_offer otherwise the uri will get split at openid_credential_offer
+        arrayTypeProperties: uri.includes("credential_offer_uri=") ? [
+          "credential_configuration_ids",
+          "credential_offer_uri="
+        ] : [
+          "credential_configuration_ids",
+          "credential_offer="
+        ],
+        requiredProperties: uri.includes("credential_offer_uri=") ? [
+          "credential_offer_uri="
+        ] : [
+          "credential_offer="
+        ]
+      });
+    }
+    if (credentialOffer?.credential_offer_uri === void 0 && !credentialOffer?.credential_offer) {
+      return Promise.reject(Error("Either a credential_offer or credential_offer_uri should be present in " + uri));
+    }
+    const request = await (0, import_oid4vci_common19.toUniformCredentialOfferRequest)(credentialOffer, {
+      ...opts,
+      version
+    });
+    return {
+      ...constructBaseResponse(request, scheme, baseUrl),
+      userPinRequired: !!(request.credential_offer?.grants?.[import_oid4vci_common19.PRE_AUTH_GRANT_LITERAL]?.tx_code ?? false)
+    };
+  }
+  static toURI(requestWithBaseUrl, opts) {
+    logger11.debug(`Credential Offer Request with base URL: ${JSON.stringify(requestWithBaseUrl)}`);
+    const version = opts?.version ?? requestWithBaseUrl.version;
+    let baseUrl = requestWithBaseUrl.baseUrl.includes(requestWithBaseUrl.scheme) ? requestWithBaseUrl.baseUrl : `${requestWithBaseUrl.scheme.replace("://", "")}://${requestWithBaseUrl.baseUrl}`;
+    let param;
+    const isUri = requestWithBaseUrl.credential_offer_uri !== void 0;
+    if (version.valueOf() >= import_oid4vci_common19.OpenId4VCIVersion.VER_1_0_11.valueOf()) {
+      if (!baseUrl.includes("?")) {
+        param = isUri ? "credential_offer_uri" : "credential_offer";
+      } else {
+        const split = baseUrl.split("?");
+        if (split.length > 1 && split[1] !== "") {
+          if (baseUrl.endsWith("&")) {
+            param = isUri ? "credential_offer_uri" : "credential_offer";
+          } else if (!baseUrl.endsWith("=")) {
+            baseUrl += `&`;
+            param = isUri ? "credential_offer_uri" : "credential_offer";
+          }
+        }
+      }
+    }
+    return (0, import_oid4vci_common19.convertJsonToURI)(requestWithBaseUrl.credential_offer_uri ?? requestWithBaseUrl.original_credential_offer, {
+      baseUrl,
+      arrayTypeProperties: isUri ? [] : [
+        "credential_configuration_ids"
+      ],
+      uriTypeProperties: isUri ? [
+        "credential_offer_uri"
+      ] : version >= import_oid4vci_common19.OpenId4VCIVersion.VER_1_0_15 ? [
+        "credential_issuer",
+        "credential_configuration_ids"
+      ] : [
+        "issuer",
+        "credential_type"
+      ],
+      param,
+      version
+    });
+  }
+};
+
+// lib/CredentialRequestClientV1_0_11.ts
+var import_oid4vc_common6 = require("@sphereon/oid4vc-common");
+var import_oid4vci_common20 = require("@sphereon/oid4vci-common");
+var import_ssi_types14 = require("@sphereon/ssi-types");
+var logger12 = import_ssi_types14.Loggers.DEFAULT.get("sphereon:oid4vci:credential");
 var CredentialRequestClientV1_0_11 = class {
   static {
     __name(this, "CredentialRequestClientV1_0_11");
@@ -2485,20 +2598,24 @@ var CredentialRequestClientV1_0_11 = class {
     return await this.acquireCredentialsUsingRequest(request, opts.createDPoPOpts);
   }
   async acquireCredentialsUsingRequest(uniformRequest, createDPoPOpts) {
-    const request = (0, import_oid4vci_common19.getCredentialRequestForVersion)(uniformRequest, this.version());
+    const uniformRequestV11 = uniformRequest;
+    if (!uniformRequestV11.format) {
+      return Promise.reject(Error("format is missing from the (legacy v11) credential request"));
+    }
+    const request = (0, import_oid4vci_common20.getCredentialRequestForVersion)(uniformRequest, uniformRequestV11.format, this.version());
     const credentialEndpoint = this.credentialRequestOpts.credentialEndpoint;
-    if (!(0, import_oid4vci_common19.isValidURL)(credentialEndpoint)) {
-      logger11.debug(`Invalid credential endpoint: ${credentialEndpoint}`);
-      throw new Error(import_oid4vci_common19.URL_NOT_VALID);
+    if (!(0, import_oid4vci_common20.isValidURL)(credentialEndpoint)) {
+      logger12.debug(`Invalid credential endpoint: ${credentialEndpoint}`);
+      throw new Error(import_oid4vci_common20.URL_NOT_VALID);
     }
-    logger11.debug(`Acquiring credential(s) from: ${credentialEndpoint}`);
-    logger11.debug(`request
+    logger12.debug(`Acquiring credential(s) from: ${credentialEndpoint}`);
+    logger12.debug(`request
 : ${JSON.stringify(request, null, 2)}`);
     const requestToken = this.credentialRequestOpts.token;
     let dPoP = createDPoPOpts ? await (0, import_oid4vc_common6.createDPoP)((0, import_oid4vc_common6.getCreateDPoPOptions)(createDPoPOpts, credentialEndpoint, {
       accessToken: requestToken
     })) : void 0;
-    let response = await (0, import_oid4vci_common19.post)(credentialEndpoint, JSON.stringify(request), {
+    let response = await (0, import_oid4vci_common20.post)(credentialEndpoint, JSON.stringify(request), {
       bearerToken: requestToken,
       customHeaders: {
         ...createDPoPOpts && {
@@ -2513,7 +2630,7 @@ var CredentialRequestClientV1_0_11 = class {
       dPoP = await (0, import_oid4vc_common6.createDPoP)((0, import_oid4vc_common6.getCreateDPoPOptions)(createDPoPOpts, credentialEndpoint, {
         accessToken: requestToken
       }));
-      response = await (0, import_oid4vci_common19.post)(credentialEndpoint, JSON.stringify(request), {
+      response = await (0, import_oid4vci_common20.post)(credentialEndpoint, JSON.stringify(request), {
         bearerToken: requestToken,
         customHeaders: {
           ...createDPoPOpts && {
@@ -2524,14 +2641,14 @@ var CredentialRequestClientV1_0_11 = class {
       const successDPoPNonce = response.origResponse.headers.get("DPoP-Nonce");
       nextDPoPNonce = successDPoPNonce ?? retryWithNonce.dpopNonce;
     }
-    this._isDeferred = (0, import_oid4vci_common19.isDeferredCredentialResponse)(response);
+    this._isDeferred = (0, import_oid4vci_common20.isDeferredCredentialResponse)(response);
     if (this.isDeferred() && this.credentialRequestOpts.deferredCredentialAwait && response.successBody) {
       response = await this.acquireDeferredCredential(response.successBody, {
         bearerToken: this.credentialRequestOpts.token
       });
     }
     response.access_token = requestToken;
-    logger11.debug(`Credential endpoint ${credentialEndpoint} response:\r
+    logger12.debug(`Credential endpoint ${credentialEndpoint} response:\r
 ${JSON.stringify(response, null, 2)}`);
     return {
       ...response,
@@ -2553,7 +2670,7 @@ ${JSON.stringify(response, null, 2)}`);
     } else if (!bearerToken) {
       throw Error(`No bearer token present and refresh for defered endpoint not supported yet`);
     }
-    return await (0, import_oid4vci_common19.acquireDeferredCredential)({
+    return await (0, import_oid4vci_common20.acquireDeferredCredential)({
       bearerToken,
       transactionId,
       deferredCredentialEndpoint,
@@ -2567,7 +2684,7 @@ ${JSON.stringify(response, null, 2)}`);
     if (!formatSelection) {
       throw Error(`Format of credential to be issued is missing`);
     }
-    const format = (0, import_oid4vci_common19.getUniformFormat)(formatSelection);
+    const format = (0, import_oid4vci_common20.getUniformFormat)(formatSelection);
     const typesSelection = opts?.credentialTypes && (typeof opts.credentialTypes === "string" || opts.credentialTypes.length > 0) ? opts.credentialTypes : this.credentialRequestOpts.credentialTypes;
     const types = Array.isArray(typesSelection) ? typesSelection : [
       typesSelection
@@ -2585,7 +2702,7 @@ ${JSON.stringify(response, null, 2)}`);
         proof
       };
     } else if (format === "jwt_vc_json-ld" || format === "ldp_vc") {
-      if (this.version() >= import_oid4vci_common19.OpenId4VCIVersion.VER_1_0_12 && !opts.context) {
+      if (this.version() >= import_oid4vci_common20.OpenId4VCIVersion.VER_1_0_12 && !opts.context) {
         throw Error("No @context value present, but it is required");
       }
       return {
@@ -2623,18 +2740,18 @@ ${JSON.stringify(response, null, 2)}`);
     throw new Error(`Unsupported format: ${format}`);
   }
   version() {
-    return this.credentialRequestOpts?.version ?? import_oid4vci_common19.OpenId4VCIVersion.VER_1_0_11;
+    return this.credentialRequestOpts?.version ?? import_oid4vci_common20.OpenId4VCIVersion.VER_1_0_11;
   }
   isV11OrHigher() {
-    return this.version() >= import_oid4vci_common19.OpenId4VCIVersion.VER_1_0_11;
+    return this.version() >= import_oid4vci_common20.OpenId4VCIVersion.VER_1_0_11;
   }
 };
 
 // lib/CredentialRequestClientBuilder.ts
-var import_oid4vci_common22 = require("@sphereon/oid4vci-common");
+var import_oid4vci_common24 = require("@sphereon/oid4vci-common");
 
 // lib/CredentialRequestClientBuilderV1_0_11.ts
-var import_oid4vci_common20 = require("@sphereon/oid4vci-common");
+var import_oid4vci_common21 = require("@sphereon/oid4vci-common");
 var CredentialRequestClientBuilderV1_0_11 = class _CredentialRequestClientBuilderV1_0_11 {
   static {
     __name(this, "CredentialRequestClientBuilderV1_0_11");
@@ -2652,7 +2769,7 @@ var CredentialRequestClientBuilderV1_0_11 = class _CredentialRequestClientBuilde
   static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialTypes }) {
     const issuer = credentialIssuer;
     const builder = new _CredentialRequestClientBuilderV1_0_11();
-    builder.withVersion(version ?? import_oid4vci_common20.OpenId4VCIVersion.VER_1_0_11);
+    builder.withVersion(version ?? import_oid4vci_common21.OpenId4VCIVersion.VER_1_0_11);
     builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
     if (metadata?.deferred_credential_endpoint) {
       builder.withDeferredCredentialEndpoint(metadata.deferred_credential_endpoint);
@@ -2671,18 +2788,18 @@ var CredentialRequestClientBuilderV1_0_11 = class _CredentialRequestClientBuilde
   }
   static fromCredentialOfferRequest(opts) {
     const { request, metadata } = opts;
-    const version = opts.version ?? request.version ?? (0, import_oid4vci_common20.determineSpecVersionFromOffer)(request.original_credential_offer);
+    const version = opts.version ?? request.version ?? (0, import_oid4vci_common21.determineSpecVersionFromOffer)(request.original_credential_offer);
     const builder = new _CredentialRequestClientBuilderV1_0_11();
-    const issuer = (0, import_oid4vci_common20.getIssuerFromCredentialOfferPayload)(request.credential_offer) ?? metadata?.issuer;
+    const issuer = (0, import_oid4vci_common21.getIssuerFromCredentialOfferPayload)(request.credential_offer) ?? metadata?.issuer;
     builder.withVersion(version);
     builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
     if (metadata?.deferred_credential_endpoint) {
       builder.withDeferredCredentialEndpoint(metadata.deferred_credential_endpoint);
     }
-    if (version <= import_oid4vci_common20.OpenId4VCIVersion.VER_1_0_08) {
+    if (version <= import_oid4vci_common21.OpenId4VCIVersion.VER_1_0_08) {
       builder.withCredentialType(request.original_credential_offer.credential_type);
-    } else if (version <= import_oid4vci_common20.OpenId4VCIVersion.VER_1_0_11) {
-      builder.withCredentialType((0, import_oid4vci_common20.getTypesFromOfferV1_0_11)(request.credential_offer));
+    } else if (version <= import_oid4vci_common21.OpenId4VCIVersion.VER_1_0_11) {
+      builder.withCredentialType((0, import_oid4vci_common21.getTypesFromOfferV1_0_11)(request.credential_offer));
     }
     return builder;
   }
@@ -2746,14 +2863,14 @@ var CredentialRequestClientBuilderV1_0_11 = class _CredentialRequestClientBuilde
   }
   build() {
     if (!this.version) {
-      this.withVersion(import_oid4vci_common20.OpenId4VCIVersion.VER_1_0_11);
+      this.withVersion(import_oid4vci_common21.OpenId4VCIVersion.VER_1_0_11);
     }
     return new CredentialRequestClientV1_0_11(this);
   }
 };
 
 // lib/CredentialRequestClientBuilderV1_0_13.ts
-var import_oid4vci_common21 = require("@sphereon/oid4vci-common");
+var import_oid4vci_common22 = require("@sphereon/oid4vci-common");
 var CredentialRequestClientBuilderV1_0_13 = class _CredentialRequestClientBuilderV1_0_13 {
   static {
     __name(this, "CredentialRequestClientBuilderV1_0_13");
@@ -2772,7 +2889,7 @@ var CredentialRequestClientBuilderV1_0_13 = class _CredentialRequestClientBuilde
   static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialIdentifier, credentialTypes }) {
     const issuer = credentialIssuer;
     const builder = new _CredentialRequestClientBuilderV1_0_13();
-    builder.withVersion(version ?? import_oid4vci_common21.OpenId4VCIVersion.VER_1_0_13);
+    builder.withVersion(version ?? import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_13);
     builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
     if (metadata?.deferred_credential_endpoint) {
       builder.withDeferredCredentialEndpoint(metadata.deferred_credential_endpoint);
@@ -2796,12 +2913,12 @@ var CredentialRequestClientBuilderV1_0_13 = class _CredentialRequestClientBuilde
   }
   static fromCredentialOfferRequest(opts) {
     const { request, metadata } = opts;
-    const version = opts.version ?? request.version ?? (0, import_oid4vci_common21.determineSpecVersionFromOffer)(request.original_credential_offer);
-    if (version < import_oid4vci_common21.OpenId4VCIVersion.VER_1_0_13) {
+    const version = opts.version ?? request.version ?? (0, import_oid4vci_common22.determineSpecVersionFromOffer)(request.original_credential_offer);
+    if (version < import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_13) {
       throw new Error("Versions below v1.0.13 (draft 13) are not supported.");
     }
     const builder = new _CredentialRequestClientBuilderV1_0_13();
-    const issuer = (0, import_oid4vci_common21.getIssuerFromCredentialOfferPayload)(request.credential_offer) ?? metadata?.issuer;
+    const issuer = (0, import_oid4vci_common22.getIssuerFromCredentialOfferPayload)(request.credential_offer) ?? metadata?.issuer;
     builder.withVersion(version);
     builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
     if (metadata?.deferred_credential_endpoint) {
@@ -2878,52 +2995,56 @@ var CredentialRequestClientBuilderV1_0_13 = class _CredentialRequestClientBuilde
   }
   build() {
     if (!this.version) {
-      this.withVersion(import_oid4vci_common21.OpenId4VCIVersion.VER_1_0_11);
+      this.withVersion(import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_11);
     }
     return new CredentialRequestClient(this);
   }
 };
 
-// lib/CredentialRequestClientBuilder.ts
-function isV1_0_13(builder) {
-  return builder.withCredentialIdentifier !== void 0;
-}
-__name(isV1_0_13, "isV1_0_13");
-var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
+// lib/CredentialRequestClientBuilderV1_0_15.ts
+var import_oid4vci_common23 = require("@sphereon/oid4vci-common");
+var CredentialRequestClientBuilderV1_0_15 = class _CredentialRequestClientBuilderV1_0_15 {
   static {
-    __name(this, "CredentialRequestClientBuilder");
-  }
-  _builder;
-  constructor(builder) {
-    this._builder = builder;
+    __name(this, "CredentialRequestClientBuilderV1_0_15");
   }
-  static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialIdentifier, credentialTypes }) {
-    const specVersion = version ?? import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_13;
-    let builder;
-    if (specVersion >= import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_13) {
-      builder = CredentialRequestClientBuilderV1_0_13.fromCredentialIssuer({
-        credentialIssuer,
-        metadata,
-        version,
-        credentialIdentifier,
-        credentialTypes
-      });
-    } else {
-      if (!credentialTypes || credentialTypes.length === 0) {
-        throw new Error("CredentialTypes must be provided for v1_0_11");
-      }
-      builder = CredentialRequestClientBuilderV1_0_11.fromCredentialIssuer({
-        credentialIssuer,
-        metadata,
-        version,
-        credentialTypes
-      });
+  credentialEndpoint;
+  deferredCredentialEndpoint;
+  nonceEndpoint;
+  deferredCredentialAwait = false;
+  deferredCredentialIntervalInMS = 5e3;
+  credentialIdentifier;
+  credentialConfigurationId;
+  credentialTypes = [];
+  token;
+  version;
+  subjectIssuance;
+  issuerState;
+  // Note: format removed from v15 - credential requests no longer include format parameter
+  static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialIdentifier, credentialConfigurationId, credentialTypes }) {
+    const issuer = credentialIssuer;
+    const builder = new _CredentialRequestClientBuilderV1_0_15();
+    builder.withVersion(version ?? import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_15);
+    builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
+    if (metadata?.deferred_credential_endpoint) {
+      builder.withDeferredCredentialEndpoint(metadata.deferred_credential_endpoint);
     }
-    return new _CredentialRequestClientBuilder(builder);
+    if (metadata?.nonce_endpoint) {
+      builder.withNonceEndpoint(metadata.nonce_endpoint);
+    }
+    if (credentialIdentifier) {
+      builder.withCredentialIdentifier(credentialIdentifier);
+    }
+    if (credentialConfigurationId) {
+      builder.withCredentialConfigurationId(credentialConfigurationId);
+    }
+    if (credentialTypes) {
+      builder.withCredentialType(credentialTypes);
+    }
+    return builder;
   }
   static async fromURI({ uri, metadata }) {
     const offer = await CredentialOfferClient.fromURI(uri);
-    return _CredentialRequestClientBuilder.fromCredentialOfferRequest({
+    return _CredentialRequestClientBuilderV1_0_15.fromCredentialOfferRequest({
       request: offer,
       ...offer,
       metadata,
@@ -2931,27 +3052,191 @@ var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
     });
   }
   static fromCredentialOfferRequest(opts) {
-    const { request } = opts;
-    const version = opts.version ?? request.version ?? (0, import_oid4vci_common22.determineSpecVersionFromOffer)(request.original_credential_offer);
-    let builder;
-    if (version < import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_13) {
-      builder = CredentialRequestClientBuilderV1_0_11.fromCredentialOfferRequest(opts);
-    } else {
-      builder = CredentialRequestClientBuilderV1_0_13.fromCredentialOfferRequest(opts);
+    const { request, metadata } = opts;
+    const version = opts.version ?? request.version ?? (0, import_oid4vci_common23.determineSpecVersionFromOffer)(request.original_credential_offer);
+    if (version < import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_15) {
+      throw new Error("Versions below v1.0.15 (draft 15) are not supported.");
     }
-    return new _CredentialRequestClientBuilder(builder);
+    const builder = new _CredentialRequestClientBuilderV1_0_15();
+    const issuer = (0, import_oid4vci_common23.getIssuerFromCredentialOfferPayload)(request.credential_offer) ?? metadata?.issuer;
+    builder.withVersion(version);
+    builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
+    if (metadata?.deferred_credential_endpoint) {
+      builder.withDeferredCredentialEndpoint(metadata.deferred_credential_endpoint);
+    }
+    if (metadata?.nonce_endpoint) {
+      builder.withNonceEndpoint(metadata.nonce_endpoint);
+    }
+    const ids = request.credential_offer.credential_configuration_ids;
+    if (ids.length && ids.length === 1) {
+      builder.withCredentialConfigurationId(ids[0]);
+    }
+    return builder;
   }
   static fromCredentialOffer({ credentialOffer, metadata }) {
-    const version = (0, import_oid4vci_common22.determineSpecVersionFromOffer)(credentialOffer.credential_offer);
-    let builder;
-    if (version < import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_13) {
-      builder = CredentialRequestClientBuilderV1_0_11.fromCredentialOffer({
-        credentialOffer,
-        metadata
-      });
-    } else {
-      builder = CredentialRequestClientBuilderV1_0_13.fromCredentialOffer({
-        credentialOffer,
+    const builder = _CredentialRequestClientBuilderV1_0_15.fromCredentialOfferRequest({
+      request: credentialOffer,
+      metadata,
+      version: credentialOffer.version
+    });
+    return builder;
+  }
+  withCredentialEndpointFromMetadata(metadata) {
+    this.credentialEndpoint = metadata.credential_endpoint;
+    return this;
+  }
+  withCredentialEndpoint(credentialEndpoint) {
+    this.credentialEndpoint = credentialEndpoint;
+    return this;
+  }
+  withIssuerState(issuerState) {
+    this.issuerState = issuerState;
+    return this;
+  }
+  withDeferredCredentialEndpointFromMetadata(metadata) {
+    this.deferredCredentialEndpoint = metadata.deferred_credential_endpoint;
+    return this;
+  }
+  withDeferredCredentialEndpoint(deferredCredentialEndpoint) {
+    this.deferredCredentialEndpoint = deferredCredentialEndpoint;
+    return this;
+  }
+  // New in v15: Support for nonce endpoint
+  withNonceEndpointFromMetadata(metadata) {
+    this.nonceEndpoint = metadata.nonce_endpoint;
+    return this;
+  }
+  withNonceEndpoint(nonceEndpoint) {
+    this.nonceEndpoint = nonceEndpoint;
+    return this;
+  }
+  withDeferredCredentialAwait(deferredCredentialAwait, deferredCredentialIntervalInMS) {
+    this.deferredCredentialAwait = deferredCredentialAwait;
+    this.deferredCredentialIntervalInMS = deferredCredentialIntervalInMS ?? 5e3;
+    return this;
+  }
+  // New in v15: Support for credential_identifier (used when authorization_details with credential_identifiers was used)
+  withCredentialIdentifier(credentialIdentifier) {
+    this.credentialIdentifier = credentialIdentifier;
+    return this;
+  }
+  // New in v15: Support for credential_configuration_id (used when scope was used and no credential_identifiers returned)
+  withCredentialConfigurationId(credentialConfigurationId) {
+    this.credentialConfigurationId = credentialConfigurationId;
+    return this;
+  }
+  // Legacy support for credential types (may be used internally to map to configuration IDs)
+  withCredentialType(credentialTypes) {
+    this.credentialTypes = Array.isArray(credentialTypes) ? credentialTypes : [
+      credentialTypes
+    ];
+    return this;
+  }
+  // Note: withFormat() method removed in v15 - format is no longer part of credential requests
+  withSubjectIssuance(subjectIssuance) {
+    this.subjectIssuance = subjectIssuance;
+    return this;
+  }
+  withToken(accessToken) {
+    this.token = accessToken;
+    return this;
+  }
+  withTokenFromResponse(response) {
+    this.token = response.access_token;
+    return this;
+  }
+  withVersion(version) {
+    this.version = version;
+    return this;
+  }
+  build() {
+    if (!this.version) {
+      this.withVersion(import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_15);
+    }
+    return new CredentialRequestClient(this);
+  }
+};
+
+// lib/CredentialRequestClientBuilder.ts
+function isV1_0_13(builder) {
+  return builder.withCredentialIdentifier !== void 0;
+}
+__name(isV1_0_13, "isV1_0_13");
+function isV1_0_15(builder) {
+  return builder.withCredentialIdentifier !== void 0;
+}
+__name(isV1_0_15, "isV1_0_15");
+var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
+  static {
+    __name(this, "CredentialRequestClientBuilder");
+  }
+  _builder;
+  constructor(builder) {
+    this._builder = builder;
+  }
+  static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialIdentifier, credentialTypes }) {
+    const specVersion = version ?? import_oid4vci_common24.OpenId4VCIVersion.VER_1_0_15;
+    let builder;
+    if (specVersion >= import_oid4vci_common24.OpenId4VCIVersion.VER_1_0_15) {
+      builder = CredentialRequestClientBuilderV1_0_15.fromCredentialIssuer({
+        credentialIssuer,
+        metadata,
+        version,
+        credentialIdentifier,
+        credentialTypes
+      });
+    } else if (specVersion >= import_oid4vci_common24.OpenId4VCIVersion.VER_1_0_13) {
+      builder = CredentialRequestClientBuilderV1_0_13.fromCredentialIssuer({
+        credentialIssuer,
+        metadata,
+        version,
+        credentialIdentifier,
+        credentialTypes
+      });
+    } else {
+      if (!credentialTypes || credentialTypes.length === 0) {
+        throw new Error("CredentialTypes must be provided for v1_0_11");
+      }
+      builder = CredentialRequestClientBuilderV1_0_11.fromCredentialIssuer({
+        credentialIssuer,
+        metadata,
+        version,
+        credentialTypes
+      });
+    }
+    return new _CredentialRequestClientBuilder(builder);
+  }
+  static async fromURI({ uri, metadata }) {
+    const offer = await CredentialOfferClient.fromURI(uri);
+    return _CredentialRequestClientBuilder.fromCredentialOfferRequest({
+      request: offer,
+      ...offer,
+      metadata,
+      version: offer.version
+    });
+  }
+  static fromCredentialOfferRequest(opts) {
+    const { request } = opts;
+    const version = opts.version ?? request.version ?? (0, import_oid4vci_common24.determineSpecVersionFromOffer)(request.original_credential_offer);
+    let builder;
+    if (version < import_oid4vci_common24.OpenId4VCIVersion.VER_1_0_13) {
+      builder = CredentialRequestClientBuilderV1_0_11.fromCredentialOfferRequest(opts);
+    } else {
+      builder = CredentialRequestClientBuilderV1_0_13.fromCredentialOfferRequest(opts);
+    }
+    return new _CredentialRequestClientBuilder(builder);
+  }
+  static fromCredentialOffer({ credentialOffer, metadata }) {
+    const version = (0, import_oid4vci_common24.determineSpecVersionFromOffer)(credentialOffer.credential_offer);
+    let builder;
+    if (version < import_oid4vci_common24.OpenId4VCIVersion.VER_1_0_13) {
+      builder = CredentialRequestClientBuilderV1_0_11.fromCredentialOffer({
+        credentialOffer,
+        metadata
+      });
+    } else {
+      builder = CredentialRequestClientBuilderV1_0_13.fromCredentialOffer({
+        credentialOffer,
         metadata
       });
     }
@@ -2961,7 +3246,9 @@ var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
     return this._builder.version;
   }
   withCredentialEndpointFromMetadata(metadata) {
-    if (isV1_0_13(this._builder)) {
+    if (isV1_0_15(this._builder)) {
+      this._builder.withCredentialEndpointFromMetadata(metadata);
+    } else if (isV1_0_13(this._builder)) {
       this._builder.withCredentialEndpointFromMetadata(metadata);
     } else {
       this._builder.withCredentialEndpointFromMetadata(metadata);
@@ -2973,7 +3260,9 @@ var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
     return this;
   }
   withDeferredCredentialEndpointFromMetadata(metadata) {
-    if (isV1_0_13(this._builder)) {
+    if (isV1_0_15(this._builder)) {
+      this._builder.withDeferredCredentialEndpointFromMetadata(metadata);
+    } else if (isV1_0_13(this._builder)) {
       this._builder.withDeferredCredentialEndpointFromMetadata(metadata);
     } else {
       this._builder.withDeferredCredentialEndpointFromMetadata(metadata);
@@ -2989,57 +3278,789 @@ var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
     return this;
   }
   withCredentialIdentifier(credentialIdentifier) {
-    if (this._builder.version === void 0 || this._builder.version < import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_13) {
+    if (this._builder.version === void 0 || this._builder.version < import_oid4vci_common24.OpenId4VCIVersion.VER_1_0_13) {
       throw new Error("Version of spec should be equal or higher than v1_0_13");
     }
     ;
     this._builder.withCredentialIdentifier(credentialIdentifier);
     return this;
   }
-  withIssuerState(issuerState) {
-    this._builder.withIssuerState(issuerState);
-    return this;
+  withIssuerState(issuerState) {
+    this._builder.withIssuerState(issuerState);
+    return this;
+  }
+  withCredentialType(credentialTypes) {
+    this._builder.withCredentialType(credentialTypes);
+    return this;
+  }
+  withFormat(format) {
+    if ("withFormat" in this._builder) {
+      this._builder.withFormat(format);
+    }
+    return this;
+  }
+  withSubjectIssuance(subjectIssuance) {
+    this._builder.withSubjectIssuance(subjectIssuance);
+    return this;
+  }
+  withToken(accessToken) {
+    this._builder.withToken(accessToken);
+    return this;
+  }
+  withTokenFromResponse(response) {
+    this._builder.withTokenFromResponse(response);
+    return this;
+  }
+  withVersion(version) {
+    this._builder.withVersion(version);
+    return this;
+  }
+  build() {
+    return this._builder.build();
+  }
+};
+
+// lib/MetadataClientV1_0_15.ts
+var import_oid4vci_common25 = require("@sphereon/oid4vci-common");
+var import_ssi_types15 = require("@sphereon/ssi-types");
+var logger13 = import_ssi_types15.Loggers.DEFAULT.get("sphereon:oid4vci:metadata");
+var MetadataClientV1_0_15 = class _MetadataClientV1_0_15 {
+  static {
+    __name(this, "MetadataClientV1_0_15");
+  }
+  /**
+  * Retrieve metadata using the Initiation obtained from a previous step
+  *
+  * @param credentialOffer
+  */
+  static async retrieveAllMetadataFromCredentialOffer(credentialOffer) {
+    return _MetadataClientV1_0_15.retrieveAllMetadataFromCredentialOfferRequest(credentialOffer.credential_offer);
+  }
+  /**
+  * Retrieve the metada using the initiation request obtained from a previous step
+  * @param request
+  */
+  static async retrieveAllMetadataFromCredentialOfferRequest(request) {
+    const issuer = (0, import_oid4vci_common25.getIssuerFromCredentialOfferPayload)(request);
+    if (issuer) {
+      return _MetadataClientV1_0_15.retrieveAllMetadata(issuer);
+    }
+    throw new Error("can't retrieve metadata from CredentialOfferRequest. No issuer field is present");
+  }
+  /**
+  * Retrieve all metadata from an issuer
+  * @param issuer The issuer URL
+  * @param opts
+  */
+  static async retrieveAllMetadata(issuer, opts) {
+    let token_endpoint;
+    let credential_endpoint;
+    let nonce_endpoint;
+    let deferred_credential_endpoint;
+    let authorization_endpoint;
+    let authorization_challenge_endpoint;
+    let authorizationServerType = "OID4VCI";
+    let authorization_servers = [
+      issuer
+    ];
+    const oid4vciResponse = await _MetadataClientV1_0_15.retrieveOpenID4VCIServerMetadata(issuer, {
+      errorOnNotFound: false
+    });
+    let credentialIssuerMetadata = oid4vciResponse?.successBody;
+    if (credentialIssuerMetadata) {
+      logger13.debug(`Issuer ${issuer} OID4VCI well-known server metadata\r
+${JSON.stringify(credentialIssuerMetadata)}`);
+      credential_endpoint = credentialIssuerMetadata.credential_endpoint;
+      nonce_endpoint = credentialIssuerMetadata.nonce_endpoint;
+      deferred_credential_endpoint = credentialIssuerMetadata.deferred_credential_endpoint;
+      if (credentialIssuerMetadata.token_endpoint) {
+        token_endpoint = credentialIssuerMetadata.token_endpoint;
+      }
+      authorization_challenge_endpoint = credentialIssuerMetadata.authorization_challenge_endpoint;
+      if (credentialIssuerMetadata.authorization_servers) {
+        authorization_servers = credentialIssuerMetadata.authorization_servers;
+      }
+    }
+    let response = await retrieveWellknown(authorization_servers[0], import_oid4vci_common25.WellKnownEndpoints.OPENID_CONFIGURATION, {
+      errorOnNotFound: false
+    });
+    let authMetadata = response.successBody;
+    if (authMetadata) {
+      logger13.debug(`Issuer ${issuer} has OpenID Connect Server metadata in well-known location`);
+      authorizationServerType = "OIDC";
+    } else {
+      response = await retrieveWellknown(authorization_servers[0], import_oid4vci_common25.WellKnownEndpoints.OAUTH_AS, {
+        errorOnNotFound: false
+      });
+      authMetadata = response.successBody;
+    }
+    if (!authMetadata) {
+      if (!authorization_servers.includes(issuer)) {
+        throw Error(`Issuer ${issuer} provided a separate authorization server ${authorization_servers}, but that server did not provide metadata`);
+      }
+    } else {
+      if (!authorizationServerType) {
+        authorizationServerType = "OAuth 2.0";
+      }
+      logger13.debug(`Issuer ${issuer} has ${authorizationServerType} Server metadata in well-known location`);
+      if (!authMetadata.authorization_endpoint) {
+        console.warn(`Issuer ${issuer} of type ${authorizationServerType} has no authorization_endpoint! Will use ${authorization_endpoint}. This only works for pre-authorized flows`);
+      } else if (authorization_endpoint && authMetadata.authorization_endpoint !== authorization_endpoint) {
+        throw Error(`Credential issuer has a different authorization_endpoint (${authorization_endpoint}) from the Authorization Server (${authMetadata.authorization_endpoint})`);
+      }
+      authorization_endpoint = authMetadata.authorization_endpoint;
+      if (authorization_challenge_endpoint && authMetadata.authorization_challenge_endpoint !== authorization_challenge_endpoint) {
+        throw Error(`Credential issuer has a different authorization_challenge_endpoint (${authorization_challenge_endpoint}) from the Authorization Server (${authMetadata.authorization_challenge_endpoint})`);
+      }
+      authorization_challenge_endpoint = authMetadata.authorization_challenge_endpoint;
+      if (!authMetadata.token_endpoint) {
+        throw Error(`Authorization Server ${authorization_servers} did not provide a token_endpoint`);
+      } else if (token_endpoint && authMetadata.token_endpoint !== token_endpoint) {
+        throw Error(`Credential issuer has a different token_endpoint (${token_endpoint}) from the Authorization Server (${authMetadata.token_endpoint})`);
+      }
+      token_endpoint = authMetadata.token_endpoint;
+      if (authMetadata.credential_endpoint) {
+        if (credential_endpoint && authMetadata.credential_endpoint !== credential_endpoint) {
+          logger13.debug(`Credential issuer has a different credential_endpoint (${credential_endpoint}) from the Authorization Server (${authMetadata.credential_endpoint}). Will use the issuer value`);
+        } else {
+          credential_endpoint = authMetadata.credential_endpoint;
+        }
+      }
+      if (authMetadata.deferred_credential_endpoint) {
+        if (deferred_credential_endpoint && authMetadata.deferred_credential_endpoint !== deferred_credential_endpoint) {
+          logger13.debug(`Credential issuer has a different deferred_credential_endpoint (${deferred_credential_endpoint}) from the Authorization Server (${authMetadata.deferred_credential_endpoint}). Will use the issuer value`);
+        } else {
+          deferred_credential_endpoint = authMetadata.deferred_credential_endpoint;
+        }
+      }
+    }
+    if (!authorization_endpoint) {
+      logger13.debug(`Issuer ${issuer} does not expose authorization_endpoint, so only pre-auth will be supported`);
+    }
+    if (!token_endpoint) {
+      logger13.debug(`Issuer ${issuer} does not have a token_endpoint listed in well-known locations!`);
+      if (opts?.errorOnNotFound) {
+        throw Error(`Could not deduce the token_endpoint for ${issuer}`);
+      } else {
+        token_endpoint = `${issuer}${issuer.endsWith("/") ? "token" : "/token"}`;
+      }
+    }
+    if (!credential_endpoint) {
+      logger13.debug(`Issuer ${issuer} does not have a credential_endpoint listed in well-known locations!`);
+      if (opts?.errorOnNotFound) {
+        throw Error(`Could not deduce the credential endpoint for ${issuer}`);
+      } else {
+        credential_endpoint = `${issuer}${issuer.endsWith("/") ? "credential" : "/credential"}`;
+      }
+    }
+    if (!credentialIssuerMetadata && authMetadata) {
+      credentialIssuerMetadata = authMetadata;
+    }
+    const ci = credentialIssuerMetadata ?? {};
+    const ciAuthorizationServers = Array.isArray(ci.authorization_servers) && ci.authorization_servers.length > 0 ? ci.authorization_servers : authorization_servers;
+    const v15CredentialIssuerMetadata = {
+      credential_issuer: ci.credential_issuer ?? issuer,
+      credential_endpoint,
+      authorization_servers: ciAuthorizationServers,
+      credential_configurations_supported: ci.credential_configurations_supported ?? {},
+      display: ci.display ?? [],
+      ...nonce_endpoint && {
+        nonce_endpoint
+      },
+      ...deferred_credential_endpoint && {
+        deferred_credential_endpoint
+      }
+    };
+    logger13.debug(`Issuer ${issuer} token endpoint ${token_endpoint}, credential endpoint ${credential_endpoint}`);
+    return {
+      issuer,
+      token_endpoint,
+      credential_endpoint,
+      authorization_challenge_endpoint,
+      authorizationServerType,
+      credentialIssuerMetadata: v15CredentialIssuerMetadata,
+      authorizationServerMetadata: authMetadata
+    };
+  }
+  /**
+  * Retrieve only the OID4VCI metadata for the issuer. So no OIDC/OAuth2 metadata
+  *
+  * @param issuerHost The issuer hostname
+  * @param opts
+  */
+  static async retrieveOpenID4VCIServerMetadata(issuerHost, opts) {
+    return retrieveWellknown(issuerHost, import_oid4vci_common25.WellKnownEndpoints.OPENID4VCI_ISSUER, {
+      errorOnNotFound: opts?.errorOnNotFound === void 0 ? true : opts.errorOnNotFound
+    });
+  }
+};
+
+// lib/OpenID4VCIClient.ts
+var import_oid4vci_common26 = require("@sphereon/oid4vci-common");
+var import_ssi_types16 = require("@sphereon/ssi-types");
+var logger14 = import_ssi_types16.Loggers.DEFAULT.get("sphereon:oid4vci");
+var OpenID4VCIClient = class _OpenID4VCIClient {
+  static {
+    __name(this, "OpenID4VCIClient");
+  }
+  _state;
+  constructor({ credentialOffer, clientId, kid, alg, credentialIssuer, pkce, authorizationRequest, accessToken, jwk, endpointMetadata, accessTokenResponse, authorizationRequestOpts, authorizationCodeResponse, authorizationURL }) {
+    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common26.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
+    if (!issuer) {
+      throw Error("No credential issuer supplied or deduced from offer");
+    }
+    this._state = {
+      credentialOffer,
+      credentialIssuer: issuer,
+      kid,
+      alg,
+      // TODO: We need to refactor this and always explicitly call createAuthorizationRequestUrl, so we can have a credential selection first and use the kid as a default for the client id
+      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common26.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
+      pkce: {
+        disabled: false,
+        codeChallengeMethod: import_oid4vci_common26.CodeChallengeMethod.S256,
+        ...pkce
+      },
+      authorizationRequestOpts,
+      authorizationCodeResponse,
+      accessToken,
+      jwk,
+      endpointMetadata: endpointMetadata?.credentialIssuerMetadata?.authorization_server ? endpointMetadata : endpointMetadata,
+      accessTokenResponse,
+      authorizationURL
+    };
+    if (!this._state.authorizationRequestOpts) {
+      this._state.authorizationRequestOpts = this.syncAuthorizationRequestOpts(authorizationRequest);
+    }
+    logger14.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
+  }
+  static async fromCredentialIssuer({ kid, alg, retrieveServerMetadata, clientId, credentialIssuer, pkce, authorizationRequest, createAuthorizationRequestURL, endpointMetadata }) {
+    const client = new _OpenID4VCIClient({
+      kid,
+      alg,
+      clientId: clientId ?? authorizationRequest?.clientId,
+      credentialIssuer,
+      pkce,
+      authorizationRequest,
+      endpointMetadata
+    });
+    if (retrieveServerMetadata === void 0 || retrieveServerMetadata) {
+      await client.retrieveServerMetadata();
+    }
+    if (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL) {
+      await client.createAuthorizationRequestUrl({
+        authorizationRequest,
+        pkce
+      });
+    }
+    return client;
+  }
+  static async fromState({ state }) {
+    const clientState = typeof state === "string" ? JSON.parse(state) : state;
+    return new _OpenID4VCIClient(clientState);
+  }
+  static async fromURI({ uri, kid, alg, retrieveServerMetadata, clientId, pkce, createAuthorizationRequestURL, authorizationRequest, resolveOfferUri, endpointMetadata }) {
+    const credentialOfferClient = await CredentialOfferClient.fromURI(uri, {
+      resolve: resolveOfferUri
+    });
+    const client = new _OpenID4VCIClient({
+      credentialOffer: credentialOfferClient,
+      kid,
+      alg,
+      clientId: clientId ?? authorizationRequest?.clientId ?? credentialOfferClient.clientId,
+      pkce,
+      authorizationRequest,
+      endpointMetadata
+    });
+    if (retrieveServerMetadata === void 0 || retrieveServerMetadata) {
+      await client.retrieveServerMetadata();
+    }
+    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common26.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL)) {
+      await client.createAuthorizationRequestUrl({
+        authorizationRequest,
+        pkce
+      });
+      logger14.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
+    }
+    return client;
+  }
+  /**
+  * Allows you to create an Authorization Request URL when using an Authorization Code flow. This URL needs to be accessed using the front channel (browser)
+  *
+  * The Identity provider would present a login screen typically; after you authenticated, it would redirect to the provided redirectUri; which can be same device or cross-device
+  * @param opts
+  */
+  async createAuthorizationRequestUrl(opts) {
+    if (!this._state.authorizationURL) {
+      this.calculatePKCEOpts(opts?.pkce);
+      this._state.authorizationRequestOpts = this.syncAuthorizationRequestOpts(opts?.authorizationRequest);
+      if (!this._state.authorizationRequestOpts) {
+        throw Error(`No Authorization Request options present or provided in this call`);
+      }
+      if (this._state.endpointMetadata?.credentialIssuerMetadata && "authorization_endpoint" in this._state.endpointMetadata.credentialIssuerMetadata) {
+        this._state.endpointMetadata.authorization_endpoint = this._state.endpointMetadata.credentialIssuerMetadata.authorization_endpoint;
+      }
+      if (this.version() <= import_oid4vci_common26.OpenId4VCIVersion.VER_1_0_11) {
+        this._state.authorizationURL = await createAuthorizationRequestUrlV1_0_11({
+          pkce: this._state.pkce,
+          endpointMetadata: this.endpointMetadata,
+          authorizationRequest: this._state.authorizationRequestOpts,
+          credentialOffer: this.credentialOffer,
+          credentialsSupported: Object.values(this.getCredentialsSupported(true))
+        });
+      } else {
+        this._state.authorizationURL = await createAuthorizationRequestUrl({
+          pkce: this._state.pkce,
+          endpointMetadata: this.endpointMetadata,
+          authorizationRequest: this._state.authorizationRequestOpts,
+          credentialOffer: this.credentialOffer,
+          credentialConfigurationSupported: this.getCredentialsSupported(false)
+        });
+      }
+    }
+    return this._state.authorizationURL;
+  }
+  async retrieveServerMetadata() {
+    this.assertIssuerData();
+    if (!this._state.endpointMetadata) {
+      if (this.credentialOffer) {
+        this._state.endpointMetadata = await MetadataClient.retrieveAllMetadataFromCredentialOffer(this.credentialOffer);
+      } else if (this._state.credentialIssuer) {
+        this._state.endpointMetadata = await MetadataClient.retrieveAllMetadata(this._state.credentialIssuer);
+      } else {
+        throw Error(`Cannot retrieve issuer metadata without either a credential offer, or issuer value`);
+      }
+    }
+    return this.endpointMetadata;
+  }
+  calculatePKCEOpts(pkce) {
+    this._state.pkce = generateMissingPKCEOpts({
+      ...this._state.pkce,
+      ...pkce
+    });
+  }
+  async acquireAuthorizationChallengeCode(opts) {
+    const response = await acquireAuthorizationChallengeAuthCode({
+      metadata: this.endpointMetadata,
+      credentialIssuer: this.getIssuer(),
+      clientId: this._state.clientId ?? this._state.authorizationRequestOpts?.clientId,
+      ...opts
+    });
+    if (response.errorBody) {
+      logger14.debug(`Authorization code error:\r
+${JSON.stringify(response.errorBody)}`);
+      const error = response.errorBody;
+      return Promise.reject(error);
+    } else if (!response.successBody) {
+      logger14.debug(`Authorization code error. No success body`);
+      return Promise.reject(Error(`Retrieving an authorization code token from ${this._state.endpointMetadata?.authorization_challenge_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
+    }
+    return {
+      ...response.successBody
+    };
+  }
+  async acquireAccessToken(opts) {
+    const { pin, clientId = this._state.clientId ?? this._state.authorizationRequestOpts?.clientId } = opts ?? {};
+    let { redirectUri } = opts ?? {};
+    const code = this.getAuthorizationCode(opts?.authorizationResponse, opts?.code);
+    if (opts?.codeVerifier) {
+      this._state.pkce.codeVerifier = opts.codeVerifier;
+    }
+    this.assertIssuerData();
+    const asOpts = {
+      ...opts?.asOpts
+    };
+    const kid = asOpts.clientOpts?.kid ?? this._state.kid ?? this._state.authorizationRequestOpts?.requestObjectOpts?.kid;
+    const clientAssertionType = asOpts.clientOpts?.clientAssertionType ?? (kid && clientId && typeof asOpts.clientOpts?.signCallbacks?.signCallback === "function" ? "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" : void 0);
+    if (this.isEBSI() || clientId && kid) {
+      if (!clientId) {
+        throw Error(`Client id expected for EBSI`);
+      }
+      asOpts.clientOpts = {
+        ...asOpts.clientOpts,
+        clientId,
+        ...kid && {
+          kid
+        },
+        ...clientAssertionType && {
+          clientAssertionType
+        },
+        signCallbacks: asOpts.clientOpts?.signCallbacks ?? this._state.authorizationRequestOpts?.requestObjectOpts?.signCallbacks
+      };
+    }
+    if (clientId) {
+      this._state.clientId = clientId;
+      if (!asOpts.clientOpts) {
+        asOpts.clientOpts = {
+          clientId
+        };
+      }
+      asOpts.clientOpts.clientId = clientId;
+    }
+    if (!this._state.accessTokenResponse) {
+      const accessTokenClient = this.version() <= import_oid4vci_common26.OpenId4VCIVersion.VER_1_0_12 ? new AccessTokenClientV1_0_11() : new AccessTokenClient();
+      if (redirectUri && redirectUri !== this._state.authorizationRequestOpts?.redirectUri) {
+        console.log(`Redirect URI mismatch between access-token (${redirectUri}) and authorization request (${this._state.authorizationRequestOpts?.redirectUri}). According to the specification that is not allowed.`);
+      }
+      if (this._state.authorizationRequestOpts?.redirectUri && !redirectUri) {
+        redirectUri = this._state.authorizationRequestOpts.redirectUri;
+      }
+      const response = await accessTokenClient.acquireAccessToken({
+        credentialOffer: this.credentialOffer,
+        metadata: this.endpointMetadata,
+        credentialIssuer: this.getIssuer(),
+        pin,
+        ...!this._state.pkce.disabled && {
+          codeVerifier: this._state.pkce.codeVerifier
+        },
+        code,
+        redirectUri,
+        asOpts,
+        ...opts?.createDPoPOpts && {
+          createDPoPOpts: opts.createDPoPOpts
+        },
+        ...opts?.additionalRequestParams && {
+          additionalParams: opts.additionalRequestParams
+        }
+      });
+      if (response.errorBody) {
+        logger14.debug(`Access token error:\r
+${JSON.stringify(response.errorBody)}`);
+        throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
+      } else if (!response.successBody) {
+        logger14.debug(`Access token error. No success body`);
+        throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
+      }
+      this._state.accessTokenResponse = response.successBody;
+      this._state.dpopResponseParams = response.params;
+      this._state.accessToken = response.successBody.access_token;
+    }
+    return {
+      ...this.accessTokenResponse,
+      ...this.dpopResponseParams && {
+        params: this.dpopResponseParams
+      }
+    };
+  }
+  async acquireCredentials({ credentialTypes, context, proofCallbacks, format, kid, jwk, alg, jti, deferredCredentialAwait, deferredCredentialIntervalInMS, createDPoPOpts }) {
+    if ([
+      jwk,
+      kid
+    ].filter((v) => v !== void 0).length > 1) {
+      throw new Error(import_oid4vci_common26.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
+    }
+    if (alg) this._state.alg = alg;
+    if (jwk) this._state.jwk = jwk;
+    if (kid) this._state.kid = kid;
+    let requestBuilder;
+    if (this.version() < import_oid4vci_common26.OpenId4VCIVersion.VER_1_0_13) {
+      requestBuilder = this.credentialOffer ? CredentialRequestClientBuilderV1_0_11.fromCredentialOffer({
+        credentialOffer: this.credentialOffer,
+        metadata: this.endpointMetadata
+      }) : CredentialRequestClientBuilderV1_0_11.fromCredentialIssuer({
+        credentialIssuer: this.getIssuer(),
+        credentialTypes,
+        metadata: this.endpointMetadata,
+        version: this.version()
+      });
+    } else {
+      requestBuilder = this.credentialOffer ? CredentialRequestClientBuilderV1_0_15.fromCredentialOffer({
+        credentialOffer: this.credentialOffer,
+        metadata: this.endpointMetadata
+      }) : CredentialRequestClientBuilderV1_0_15.fromCredentialIssuer({
+        credentialIssuer: this.getIssuer(),
+        credentialTypes,
+        metadata: this.endpointMetadata,
+        version: this.version()
+      });
+    }
+    const issuerState = this.issuerSupportedFlowTypes().includes(import_oid4vci_common26.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this.accessTokenResponse?.c_nonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
+    requestBuilder.withIssuerState(issuerState);
+    requestBuilder.withTokenFromResponse(this.accessTokenResponse);
+    requestBuilder.withDeferredCredentialAwait(deferredCredentialAwait ?? false, deferredCredentialIntervalInMS);
+    let subjectIssuance;
+    if (this.endpointMetadata?.credentialIssuerMetadata) {
+      const metadata = this.endpointMetadata.credentialIssuerMetadata;
+      const types = Array.isArray(credentialTypes) ? credentialTypes : [
+        credentialTypes
+      ];
+      if (metadata.credentials_supported && Array.isArray(metadata.credentials_supported)) {
+        let typeSupported = false;
+        metadata.credentials_supported.forEach((supportedCredential) => {
+          const subTypes = (0, import_oid4vci_common26.getTypesFromCredentialSupported)(supportedCredential);
+          if (subTypes.every((t, i) => types[i] === t) || types.length === 1 && (types[0] === supportedCredential.id || subTypes.includes(types[0]))) {
+            typeSupported = true;
+            if (supportedCredential.credential_subject_issuance) {
+              subjectIssuance = {
+                credential_subject_issuance: supportedCredential.credential_subject_issuance
+              };
+            }
+          }
+        });
+        if (!typeSupported) {
+          console.log(`Not all credential types ${JSON.stringify(credentialTypes)} are present in metadata for ${this.getIssuer()}`);
+        }
+      } else if (metadata.credentials_supported && !Array.isArray(metadata.credentials_supported)) {
+        const credentialsSupported = metadata.credentials_supported;
+        if (types.some((type) => !metadata.credentials_supported || !credentialsSupported[type])) {
+          throw Error(`Not all credential types ${JSON.stringify(credentialTypes)} are supported by issuer ${this.getIssuer()}`);
+        }
+      }
+    }
+    if (subjectIssuance) {
+      requestBuilder.withSubjectIssuance(subjectIssuance);
+    }
+    const credentialRequestClient = requestBuilder.build();
+    const proofBuilder = ProofOfPossessionBuilder.fromAccessTokenResponse({
+      accessTokenResponse: this.accessTokenResponse,
+      callbacks: proofCallbacks,
+      version: this.version()
+    }).withIssuer(this.getIssuer()).withAlg(this.alg);
+    if (this._state.jwk) {
+      proofBuilder.withJWK(this._state.jwk);
+    }
+    if (this._state.kid) {
+      proofBuilder.withKid(this._state.kid);
+    }
+    if (this.clientId) {
+      proofBuilder.withClientId(this.clientId);
+    }
+    if (jti) {
+      proofBuilder.withJti(jti);
+    }
+    const response = await credentialRequestClient.acquireCredentialsUsingProof({
+      proofInput: proofBuilder,
+      credentialTypes,
+      context,
+      format,
+      subjectIssuance,
+      createDPoPOpts
+    });
+    this._state.dpopResponseParams = response.params;
+    if (response.errorBody) {
+      logger14.debug(`Credential request error:\r
+${JSON.stringify(response.errorBody)}`);
+      throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
+    } else if (!response.successBody) {
+      logger14.debug(`Credential request error. No success body`);
+      throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
+    }
+    return {
+      ...response.successBody,
+      ...this.dpopResponseParams && {
+        params: this.dpopResponseParams
+      },
+      access_token: response.access_token
+    };
+  }
+  async exportState() {
+    return JSON.stringify(this._state);
+  }
+  getCredentialsSupported(restrictToInitiationTypes, format) {
+    return (0, import_oid4vci_common26.getSupportedCredentials)({
+      issuerMetadata: this.endpointMetadata.credentialIssuerMetadata,
+      version: this.version(),
+      format,
+      types: restrictToInitiationTypes ? this.getCredentialOfferTypes() : void 0
+    });
+  }
+  async sendNotification(credentialRequestOpts, request, accessToken) {
+    return sendNotification(credentialRequestOpts, request, accessToken ?? this._state.accessToken ?? this._state.accessTokenResponse?.access_token);
+  }
+  getCredentialOfferTypes() {
+    if (!this.credentialOffer) {
+      return [];
+    } else if (this.version() < import_oid4vci_common26.OpenId4VCIVersion.VER_1_0_11) {
+      const orig = this.credentialOffer.original_credential_offer;
+      const types = typeof orig.credential_type === "string" ? [
+        orig.credential_type
+      ] : orig.credential_type;
+      const result = [];
+      result[0] = types;
+      return result;
+    } else if (this.version() < import_oid4vci_common26.OpenId4VCIVersion.VER_1_0_13) {
+      return this.credentialOffer.credential_offer.credentials.map((c) => (0, import_oid4vci_common26.getTypesFromObject)(c) ?? []);
+    }
+    return void 0;
+  }
+  issuerSupportedFlowTypes() {
+    return this.credentialOffer?.supportedFlows ?? (this._state.endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint ?? this._state.endpointMetadata?.authorization_server ? [
+      import_oid4vci_common26.AuthzFlowType.AUTHORIZATION_CODE_FLOW
+    ] : []);
+  }
+  isFlowTypeSupported(flowType) {
+    return this.issuerSupportedFlowTypes().includes(flowType);
+  }
+  get authorizationURL() {
+    return this._state.authorizationURL;
+  }
+  hasAuthorizationURL() {
+    return !!this.authorizationURL;
+  }
+  get credentialOffer() {
+    return this._state.credentialOffer;
+  }
+  version() {
+    if (this.credentialOffer?.version && this.credentialOffer.version !== import_oid4vci_common26.OpenId4VCIVersion.VER_UNKNOWN) {
+      return this.credentialOffer.version;
+    }
+    const metadata = this._state.endpointMetadata;
+    if (metadata?.credentialIssuerMetadata) {
+      const versions = (0, import_oid4vci_common26.determineVersionsFromIssuerMetadata)(metadata.credentialIssuerMetadata);
+      if (versions.length > 0 && !versions.includes(import_oid4vci_common26.OpenId4VCIVersion.VER_UNKNOWN)) {
+        return versions[0];
+      }
+    }
+    return import_oid4vci_common26.OpenId4VCIVersion.VER_1_0_15;
+  }
+  get endpointMetadata() {
+    this.assertServerMetadata();
+    return this._state.endpointMetadata;
+  }
+  get kid() {
+    this.assertIssuerData();
+    if (!this._state.kid) {
+      throw new Error("No value for kid is supplied");
+    }
+    return this._state.kid;
+  }
+  get alg() {
+    this.assertIssuerData();
+    if (!this._state.alg) {
+      throw new Error("No value for alg is supplied");
+    }
+    return this._state.alg;
+  }
+  set clientId(value) {
+    this._state.clientId = value;
+  }
+  get clientId() {
+    return this._state.clientId;
+  }
+  hasAccessTokenResponse() {
+    return !!this._state.accessTokenResponse;
+  }
+  get accessTokenResponse() {
+    this.assertAccessToken();
+    return this._state.accessTokenResponse;
+  }
+  get dpopResponseParams() {
+    return this._state.dpopResponseParams;
+  }
+  getIssuer() {
+    this.assertIssuerData();
+    return this._state.credentialIssuer;
+  }
+  getAccessTokenEndpoint() {
+    this.assertIssuerData();
+    if (this.endpointMetadata) {
+      return this.endpointMetadata.token_endpoint;
+    }
+    return this.version() <= import_oid4vci_common26.OpenId4VCIVersion.VER_1_0_12 ? AccessTokenClientV1_0_11.determineTokenURL({
+      issuerOpts: {
+        issuer: this.getIssuer()
+      }
+    }) : AccessTokenClient.determineTokenURL({
+      issuerOpts: {
+        issuer: this.getIssuer()
+      }
+    });
+  }
+  getCredentialEndpoint() {
+    this.assertIssuerData();
+    return this.endpointMetadata ? this.endpointMetadata.credential_endpoint : `${this.getIssuer()}/credential`;
+  }
+  getAuthorizationChallengeEndpoint() {
+    this.assertIssuerData();
+    return this.endpointMetadata?.authorization_challenge_endpoint;
   }
-  withCredentialType(credentialTypes) {
-    this._builder.withCredentialType(credentialTypes);
-    return this;
+  hasAuthorizationChallengeEndpoint() {
+    return !!this.getAuthorizationChallengeEndpoint();
   }
-  withFormat(format) {
-    this._builder.withFormat(format);
-    return this;
+  hasDeferredCredentialEndpoint() {
+    return !!this.getAccessTokenEndpoint();
   }
-  withSubjectIssuance(subjectIssuance) {
-    this._builder.withSubjectIssuance(subjectIssuance);
-    return this;
+  getDeferredCredentialEndpoint() {
+    this.assertIssuerData();
+    return this.endpointMetadata ? this.endpointMetadata.credential_endpoint : `${this.getIssuer()}/credential`;
   }
-  withToken(accessToken) {
-    this._builder.withToken(accessToken);
-    return this;
+  /**
+  * Too bad we need a method like this, but EBSI is not exposing metadata
+  */
+  isEBSI() {
+    if (this.credentialOffer && this.credentialOffer?.credential_offer?.credentials?.find((cred) => (
+      // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+      // @ts-ignore
+      typeof cred !== "string" && "trust_framework" in cred && "name" in cred.trust_framework && cred.trust_framework.name.includes("ebsi")
+    ))) {
+      return true;
+    }
+    return this.clientId?.includes("ebsi") || this._state.kid?.includes("did:ebsi:") || this.getIssuer().includes("ebsi") || this.endpointMetadata.credentialIssuerMetadata?.authorization_endpoint?.includes("ebsi.eu") || this.endpointMetadata.credentialIssuerMetadata?.authorization_server?.includes("ebsi.eu");
   }
-  withTokenFromResponse(response) {
-    this._builder.withTokenFromResponse(response);
-    return this;
+  assertIssuerData() {
+    if (!this._state.credentialIssuer) {
+      throw Error(`No credential issuer value present`);
+    } else if (!this._state.credentialOffer && this._state.endpointMetadata && this.issuerSupportedFlowTypes().length === 0) {
+      throw Error(`No issuance initiation or credential offer present`);
+    }
   }
-  withVersion(version) {
-    this._builder.withVersion(version);
-    return this;
+  assertServerMetadata() {
+    if (!this._state.endpointMetadata) {
+      throw Error("No server metadata");
+    }
   }
-  build() {
-    return this._builder.build();
+  assertAccessToken() {
+    if (!this._state.accessTokenResponse) {
+      throw Error(`No access token present`);
+    }
+  }
+  syncAuthorizationRequestOpts(opts) {
+    const requestObjectOpts = {
+      ...this._state?.authorizationRequestOpts?.requestObjectOpts,
+      ...opts?.requestObjectOpts
+    };
+    let authorizationRequestOpts = {
+      ...this._state?.authorizationRequestOpts,
+      ...opts,
+      ...requestObjectOpts && {
+        requestObjectOpts
+      }
+    };
+    if (!authorizationRequestOpts) {
+      authorizationRequestOpts = {
+        redirectUri: `${import_oid4vci_common26.DefaultURISchemes.CREDENTIAL_OFFER}://`
+      };
+    }
+    const clientId = authorizationRequestOpts.clientId ?? this._state.clientId;
+    this._state.clientId = clientId;
+    authorizationRequestOpts.clientId = clientId;
+    return authorizationRequestOpts;
   }
+  getAuthorizationCode = /* @__PURE__ */ __name((authorizationResponse, code) => {
+    if (authorizationResponse) {
+      this._state.authorizationCodeResponse = {
+        ...(0, import_oid4vci_common26.toAuthorizationResponsePayload)(authorizationResponse)
+      };
+    } else if (code) {
+      this._state.authorizationCodeResponse = {
+        code
+      };
+    }
+    return this._state.authorizationCodeResponse?.code ?? this._state.authorizationCodeResponse?.authorization_code;
+  }, "getAuthorizationCode");
 };
 
-// lib/OpenID4VCIClient.ts
-var import_oid4vci_common23 = require("@sphereon/oid4vci-common");
-var import_ssi_types14 = require("@sphereon/ssi-types");
-var logger12 = import_ssi_types14.Loggers.DEFAULT.get("sphereon:oid4vci");
-var OpenID4VCIClient = class _OpenID4VCIClient {
+// lib/OpenID4VCIClientV1_0_15.ts
+var import_oid4vci_common27 = require("@sphereon/oid4vci-common");
+var import_ssi_types17 = require("@sphereon/ssi-types");
+var logger15 = import_ssi_types17.Loggers.DEFAULT.get("sphereon:oid4vci:v15");
+var OpenID4VCIClientV1_0_15 = class _OpenID4VCIClientV1_0_15 {
   static {
-    __name(this, "OpenID4VCIClient");
+    __name(this, "OpenID4VCIClientV1_0_15");
   }
   _state;
-  constructor({ credentialOffer, clientId, kid, alg, credentialIssuer, pkce, authorizationRequest, accessToken, jwk, endpointMetadata, accessTokenResponse, authorizationRequestOpts, authorizationCodeResponse, authorizationURL }) {
-    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common23.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
+  constructor({ credentialOffer, clientId, kid, alg, credentialIssuer, pkce, authorizationRequest, jwk, endpointMetadata, accessTokenResponse, authorizationRequestOpts, authorizationCodeResponse, authorizationURL, keyAttestation }) {
+    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common27.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
     if (!issuer) {
       throw Error("No credential issuer supplied or deduced from offer");
     }
@@ -3048,40 +4069,39 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
       credentialIssuer: issuer,
       kid,
       alg,
-      // TODO: We need to refactor this and always explicitly call createAuthorizationRequestUrl, so we can have a credential selection first and use the kid as a default for the client id
-      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common23.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
+      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common27.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
       pkce: {
         disabled: false,
-        codeChallengeMethod: import_oid4vci_common23.CodeChallengeMethod.S256,
+        codeChallengeMethod: import_oid4vci_common27.CodeChallengeMethod.S256,
         ...pkce
       },
       authorizationRequestOpts,
       authorizationCodeResponse,
-      accessToken,
       jwk,
-      endpointMetadata: endpointMetadata?.credentialIssuerMetadata?.authorization_server ? endpointMetadata : endpointMetadata,
+      endpointMetadata,
       accessTokenResponse,
-      authorizationURL
+      authorizationURL,
+      keyAttestation
     };
     if (!this._state.authorizationRequestOpts) {
       this._state.authorizationRequestOpts = this.syncAuthorizationRequestOpts(authorizationRequest);
     }
-    logger12.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
+    logger15.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
   }
-  static async fromCredentialIssuer({ kid, alg, retrieveServerMetadata, clientId, credentialIssuer, pkce, authorizationRequest, createAuthorizationRequestURL, endpointMetadata }) {
-    const client = new _OpenID4VCIClient({
+  static async fromCredentialIssuer({ kid, alg, retrieveServerMetadata, clientId, credentialIssuer, pkce, authorizationRequest, createAuthorizationRequestURL, keyAttestation }) {
+    const client = new _OpenID4VCIClientV1_0_15({
       kid,
       alg,
       clientId: clientId ?? authorizationRequest?.clientId,
       credentialIssuer,
       pkce,
       authorizationRequest,
-      endpointMetadata
+      keyAttestation
     });
-    if (retrieveServerMetadata === void 0 || retrieveServerMetadata) {
+    if (retrieveServerMetadata !== false) {
       await client.retrieveServerMetadata();
     }
-    if (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL) {
+    if (createAuthorizationRequestURL !== false) {
       await client.createAuthorizationRequestUrl({
         authorizationRequest,
         pkce
@@ -3091,39 +4111,33 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
   }
   static async fromState({ state }) {
     const clientState = typeof state === "string" ? JSON.parse(state) : state;
-    return new _OpenID4VCIClient(clientState);
+    return new _OpenID4VCIClientV1_0_15(clientState);
   }
-  static async fromURI({ uri, kid, alg, retrieveServerMetadata, clientId, pkce, createAuthorizationRequestURL, authorizationRequest, resolveOfferUri, endpointMetadata }) {
-    const credentialOfferClient = await CredentialOfferClient.fromURI(uri, {
+  static async fromURI({ uri, kid, alg, retrieveServerMetadata, clientId, pkce, createAuthorizationRequestURL, authorizationRequest, resolveOfferUri, keyAttestation }) {
+    const credentialOfferClient = await CredentialOfferClientV1_0_15.fromURI(uri, {
       resolve: resolveOfferUri
     });
-    const client = new _OpenID4VCIClient({
+    const client = new _OpenID4VCIClientV1_0_15({
       credentialOffer: credentialOfferClient,
       kid,
       alg,
       clientId: clientId ?? authorizationRequest?.clientId ?? credentialOfferClient.clientId,
       pkce,
       authorizationRequest,
-      endpointMetadata
+      keyAttestation
     });
-    if (retrieveServerMetadata === void 0 || retrieveServerMetadata) {
+    if (retrieveServerMetadata !== false) {
       await client.retrieveServerMetadata();
     }
-    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common23.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL)) {
+    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common27.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && createAuthorizationRequestURL !== false) {
       await client.createAuthorizationRequestUrl({
         authorizationRequest,
         pkce
       });
-      logger12.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
+      logger15.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
     }
     return client;
   }
-  /**
-  * Allows you to create an Authorization Request URL when using an Authorization Code flow. This URL needs to be accessed using the front channel (browser)
-  *
-  * The Identity provider would present a login screen typically; after you authenticated, it would redirect to the provided redirectUri; which can be same device or cross-device
-  * @param opts
-  */
   async createAuthorizationRequestUrl(opts) {
     if (!this._state.authorizationURL) {
       this.calculatePKCEOpts(opts?.pkce);
@@ -3134,23 +4148,13 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
       if (this._state.endpointMetadata?.credentialIssuerMetadata && "authorization_endpoint" in this._state.endpointMetadata.credentialIssuerMetadata) {
         this._state.endpointMetadata.authorization_endpoint = this._state.endpointMetadata.credentialIssuerMetadata.authorization_endpoint;
       }
-      if (this.version() <= import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_11) {
-        this._state.authorizationURL = await createAuthorizationRequestUrlV1_0_11({
-          pkce: this._state.pkce,
-          endpointMetadata: this.endpointMetadata,
-          authorizationRequest: this._state.authorizationRequestOpts,
-          credentialOffer: this.credentialOffer,
-          credentialsSupported: Object.values(this.getCredentialsSupported(true))
-        });
-      } else {
-        this._state.authorizationURL = await createAuthorizationRequestUrl({
-          pkce: this._state.pkce,
-          endpointMetadata: this.endpointMetadata,
-          authorizationRequest: this._state.authorizationRequestOpts,
-          credentialOffer: this.credentialOffer,
-          credentialConfigurationSupported: this.getCredentialsSupported(false)
-        });
-      }
+      this._state.authorizationURL = await createAuthorizationRequestUrl({
+        pkce: this._state.pkce,
+        endpointMetadata: this.endpointMetadata,
+        authorizationRequest: this._state.authorizationRequestOpts,
+        credentialOffer: this.credentialOffer,
+        credentialConfigurationSupported: this.getCredentialsSupported(false)
+      });
     }
     return this._state.authorizationURL;
   }
@@ -3158,15 +4162,34 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
     this.assertIssuerData();
     if (!this._state.endpointMetadata) {
       if (this.credentialOffer) {
-        this._state.endpointMetadata = await MetadataClient.retrieveAllMetadataFromCredentialOffer(this.credentialOffer);
+        this._state.endpointMetadata = await MetadataClientV1_0_15.retrieveAllMetadataFromCredentialOffer(this.credentialOffer);
       } else if (this._state.credentialIssuer) {
-        this._state.endpointMetadata = await MetadataClient.retrieveAllMetadata(this._state.credentialIssuer);
+        this._state.endpointMetadata = await MetadataClientV1_0_15.retrieveAllMetadata(this._state.credentialIssuer);
       } else {
         throw Error(`Cannot retrieve issuer metadata without either a credential offer, or issuer value`);
       }
     }
     return this.endpointMetadata;
   }
+  // New in v15: Nonce endpoint support
+  async acquireNonce() {
+    if (!this.endpointMetadata?.nonce_endpoint) {
+      throw Error("Nonce endpoint not available");
+    }
+    const response = await fetch(this.endpointMetadata.nonce_endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({})
+    });
+    if (!response.ok) {
+      throw Error(`Failed to acquire nonce: ${response.status}`);
+    }
+    const nonceResponse = await response.json();
+    this._state.cachedCNonce = nonceResponse.c_nonce;
+    return nonceResponse.c_nonce;
+  }
   calculatePKCEOpts(pkce) {
     this._state.pkce = generateMissingPKCEOpts({
       ...this._state.pkce,
@@ -3181,12 +4204,12 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
       ...opts
     });
     if (response.errorBody) {
-      logger12.debug(`Authorization code error:\r
+      logger15.debug(`Authorization code error:\r
 ${JSON.stringify(response.errorBody)}`);
       const error = response.errorBody;
       return Promise.reject(error);
     } else if (!response.successBody) {
-      logger12.debug(`Authorization code error. No success body`);
+      logger15.debug(`Authorization code error. No success body`);
       return Promise.reject(Error(`Retrieving an authorization code token from ${this._state.endpointMetadata?.authorization_challenge_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
     }
     return {
@@ -3232,7 +4255,7 @@ ${JSON.stringify(response.errorBody)}`);
       asOpts.clientOpts.clientId = clientId;
     }
     if (!this._state.accessTokenResponse) {
-      const accessTokenClient = this.version() <= import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_12 ? new AccessTokenClientV1_0_11() : new AccessTokenClient();
+      const accessTokenClient = new AccessTokenClient();
       if (redirectUri && redirectUri !== this._state.authorizationRequestOpts?.redirectUri) {
         console.log(`Redirect URI mismatch between access-token (${redirectUri}) and authorization request (${this._state.authorizationRequestOpts?.redirectUri}). According to the specification that is not allowed.`);
       }
@@ -3258,11 +4281,11 @@ ${JSON.stringify(response.errorBody)}`);
         }
       });
       if (response.errorBody) {
-        logger12.debug(`Access token error:\r
+        logger15.debug(`Access token error:\r
 ${JSON.stringify(response.errorBody)}`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
       } else if (!response.successBody) {
-        logger12.debug(`Access token error. No success body`);
+        logger15.debug(`Access token error. No success body`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
       }
       this._state.accessTokenResponse = response.successBody;
@@ -3276,68 +4299,54 @@ ${JSON.stringify(response.errorBody)}`);
       }
     };
   }
-  async acquireCredentials({ credentialTypes, context, proofCallbacks, format, kid, jwk, alg, jti, deferredCredentialAwait, deferredCredentialIntervalInMS, createDPoPOpts }) {
+  async acquireCredentials({ credentialIdentifier, credentialConfigurationId, credentialTypes, context, proofCallbacks, format, kid, jwk, alg, jti, deferredCredentialAwait, deferredCredentialIntervalInMS, createDPoPOpts }) {
     if ([
       jwk,
       kid
     ].filter((v) => v !== void 0).length > 1) {
-      throw new Error(import_oid4vci_common23.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
+      throw new Error(import_oid4vci_common27.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
     }
     if (alg) this._state.alg = alg;
     if (jwk) this._state.jwk = jwk;
     if (kid) this._state.kid = kid;
-    let requestBuilder;
-    if (this.version() < import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_13) {
-      requestBuilder = this.credentialOffer ? CredentialRequestClientBuilderV1_0_11.fromCredentialOffer({
-        credentialOffer: this.credentialOffer,
-        metadata: this.endpointMetadata
-      }) : CredentialRequestClientBuilderV1_0_11.fromCredentialIssuer({
-        credentialIssuer: this.getIssuer(),
-        credentialTypes,
-        metadata: this.endpointMetadata,
-        version: this.version()
-      });
-    } else {
-      requestBuilder = this.credentialOffer ? CredentialRequestClientBuilderV1_0_13.fromCredentialOffer({
-        credentialOffer: this.credentialOffer,
-        metadata: this.endpointMetadata
-      }) : CredentialRequestClientBuilderV1_0_13.fromCredentialIssuer({
-        credentialIssuer: this.getIssuer(),
-        credentialTypes,
-        metadata: this.endpointMetadata,
-        version: this.version()
-      });
+    const requestBuilder = this.credentialOffer ? CredentialRequestClientBuilderV1_0_15.fromCredentialOffer({
+      credentialOffer: this.credentialOffer,
+      metadata: this.endpointMetadata
+    }) : CredentialRequestClientBuilderV1_0_15.fromCredentialIssuer({
+      credentialIssuer: this.getIssuer(),
+      credentialTypes,
+      credentialIdentifier,
+      credentialConfigurationId,
+      metadata: this.endpointMetadata,
+      version: this.version()
+    });
+    if (credentialIdentifier) {
+      requestBuilder.withCredentialIdentifier(credentialIdentifier);
+    } else if (credentialConfigurationId) {
+      requestBuilder.withCredentialConfigurationId(credentialConfigurationId);
     }
-    const issuerState = this.issuerSupportedFlowTypes().includes(import_oid4vci_common23.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this.accessTokenResponse?.c_nonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
+    const issuerState = this.issuerSupportedFlowTypes().includes(import_oid4vci_common27.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this._state.cachedCNonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
     requestBuilder.withIssuerState(issuerState);
     requestBuilder.withTokenFromResponse(this.accessTokenResponse);
     requestBuilder.withDeferredCredentialAwait(deferredCredentialAwait ?? false, deferredCredentialIntervalInMS);
     let subjectIssuance;
     if (this.endpointMetadata?.credentialIssuerMetadata) {
       const metadata = this.endpointMetadata.credentialIssuerMetadata;
-      const types = Array.isArray(credentialTypes) ? credentialTypes : [
-        credentialTypes
-      ];
-      if (metadata.credentials_supported && Array.isArray(metadata.credentials_supported)) {
-        let typeSupported = false;
-        metadata.credentials_supported.forEach((supportedCredential) => {
-          const subTypes = (0, import_oid4vci_common23.getTypesFromCredentialSupported)(supportedCredential);
-          if (subTypes.every((t, i) => types[i] === t) || types.length === 1 && (types[0] === supportedCredential.id || subTypes.includes(types[0]))) {
-            typeSupported = true;
-            if (supportedCredential.credential_subject_issuance) {
+      if (metadata.credential_configurations_supported) {
+        const configId = credentialConfigurationId ?? credentialIdentifier;
+        if (configId && metadata.credential_configurations_supported[configId]) {
+          const config = metadata.credential_configurations_supported[configId];
+          if (config.credential_subject_issuance) {
+            const subjIssuance = config.credential_subject_issuance;
+            if (subjIssuance.subject_proof_mode && subjIssuance.notification_events_supported) {
               subjectIssuance = {
-                credential_subject_issuance: supportedCredential.credential_subject_issuance
+                credential_subject_issuance: {
+                  subject_proof_mode: subjIssuance.subject_proof_mode,
+                  notification_events_supported: subjIssuance.notification_events_supported
+                }
               };
             }
           }
-        });
-        if (!typeSupported) {
-          console.log(`Not all credential types ${JSON.stringify(credentialTypes)} are present in metadata for ${this.getIssuer()}`);
-        }
-      } else if (metadata.credentials_supported && !Array.isArray(metadata.credentials_supported)) {
-        const credentialsSupported = metadata.credentials_supported;
-        if (types.some((type) => !metadata.credentials_supported || !credentialsSupported[type])) {
-          throw Error(`Not all credential types ${JSON.stringify(credentialTypes)} are supported by issuer ${this.getIssuer()}`);
         }
       }
     }
@@ -3345,8 +4354,14 @@ ${JSON.stringify(response.errorBody)}`);
       requestBuilder.withSubjectIssuance(subjectIssuance);
     }
     const credentialRequestClient = requestBuilder.build();
+    if (!this._state.cachedCNonce) {
+      await this.acquireNonce();
+    }
     const proofBuilder = ProofOfPossessionBuilder.fromAccessTokenResponse({
-      accessTokenResponse: this.accessTokenResponse,
+      accessTokenResponse: {
+        ...this.accessTokenResponse,
+        c_nonce: this._state.cachedCNonce
+      },
       callbacks: proofCallbacks,
       version: this.version()
     }).withIssuer(this.getIssuer()).withAlg(this.alg);
@@ -3364,6 +4379,7 @@ ${JSON.stringify(response.errorBody)}`);
     }
     const response = await credentialRequestClient.acquireCredentialsUsingProof({
       proofInput: proofBuilder,
+      credentialIdentifier,
       credentialTypes,
       context,
       format,
@@ -3372,11 +4388,11 @@ ${JSON.stringify(response.errorBody)}`);
     });
     this._state.dpopResponseParams = response.params;
     if (response.errorBody) {
-      logger12.debug(`Credential request error:\r
+      logger15.debug(`Credential request error:\r
 ${JSON.stringify(response.errorBody)}`);
       throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
     } else if (!response.successBody) {
-      logger12.debug(`Credential request error. No success body`);
+      logger15.debug(`Credential request error. No success body`);
       throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
     }
     return {
@@ -3391,35 +4407,27 @@ ${JSON.stringify(response.errorBody)}`);
     return JSON.stringify(this._state);
   }
   getCredentialsSupported(restrictToInitiationTypes, format) {
-    return (0, import_oid4vci_common23.getSupportedCredentials)({
+    return (0, import_oid4vci_common27.getSupportedCredentials)({
       issuerMetadata: this.endpointMetadata.credentialIssuerMetadata,
       version: this.version(),
       format,
-      types: restrictToInitiationTypes ? this.getCredentialOfferTypes() : void 0
+      types: restrictToInitiationTypes ? [
+        this.getCredentialOfferConfigurationIds()
+      ] : void 0
     });
   }
   async sendNotification(credentialRequestOpts, request, accessToken) {
     return sendNotification(credentialRequestOpts, request, accessToken ?? this._state.accessToken ?? this._state.accessTokenResponse?.access_token);
   }
-  getCredentialOfferTypes() {
+  getCredentialOfferConfigurationIds() {
     if (!this.credentialOffer) {
       return [];
-    } else if (this.version() < import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_11) {
-      const orig = this.credentialOffer.original_credential_offer;
-      const types = typeof orig.credential_type === "string" ? [
-        orig.credential_type
-      ] : orig.credential_type;
-      const result = [];
-      result[0] = types;
-      return result;
-    } else if (this.version() < import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_13) {
-      return this.credentialOffer.credential_offer.credentials.map((c) => (0, import_oid4vci_common23.getTypesFromObject)(c) ?? []);
     }
-    return void 0;
+    return this.credentialOffer.credential_offer?.credential_configuration_ids ?? [];
   }
   issuerSupportedFlowTypes() {
     return this.credentialOffer?.supportedFlows ?? (this._state.endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint ?? this._state.endpointMetadata?.authorization_server ? [
-      import_oid4vci_common23.AuthzFlowType.AUTHORIZATION_CODE_FLOW
+      import_oid4vci_common27.AuthzFlowType.AUTHORIZATION_CODE_FLOW
     ] : []);
   }
   isFlowTypeSupported(flowType) {
@@ -3435,17 +4443,7 @@ ${JSON.stringify(response.errorBody)}`);
     return this._state.credentialOffer;
   }
   version() {
-    if (this.credentialOffer?.version && this.credentialOffer.version !== import_oid4vci_common23.OpenId4VCIVersion.VER_UNKNOWN) {
-      return this.credentialOffer.version;
-    }
-    const metadata = this._state.endpointMetadata;
-    if (metadata?.credentialIssuerMetadata) {
-      const versions = (0, import_oid4vci_common23.determineVersionsFromIssuerMetadata)(metadata.credentialIssuerMetadata);
-      if (versions.length > 0 && !versions.includes(import_oid4vci_common23.OpenId4VCIVersion.VER_UNKNOWN)) {
-        return versions[0];
-      }
-    }
-    return import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_13;
+    return import_oid4vci_common27.OpenId4VCIVersion.VER_1_0_15;
   }
   get endpointMetadata() {
     this.assertServerMetadata();
@@ -3481,20 +4479,16 @@ ${JSON.stringify(response.errorBody)}`);
   get dpopResponseParams() {
     return this._state.dpopResponseParams;
   }
+  get state() {
+    return this._state;
+  }
   getIssuer() {
     this.assertIssuerData();
     return this._state.credentialIssuer;
   }
   getAccessTokenEndpoint() {
     this.assertIssuerData();
-    if (this.endpointMetadata) {
-      return this.endpointMetadata.token_endpoint;
-    }
-    return this.version() <= import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_12 ? AccessTokenClientV1_0_11.determineTokenURL({
-      issuerOpts: {
-        issuer: this.getIssuer()
-      }
-    }) : AccessTokenClient.determineTokenURL({
+    return this.endpointMetadata?.token_endpoint ?? AccessTokenClient.determineTokenURL({
       issuerOpts: {
         issuer: this.getIssuer()
       }
@@ -3502,7 +4496,13 @@ ${JSON.stringify(response.errorBody)}`);
   }
   getCredentialEndpoint() {
     this.assertIssuerData();
-    return this.endpointMetadata ? this.endpointMetadata.credential_endpoint : `${this.getIssuer()}/credential`;
+    return this.endpointMetadata?.credential_endpoint ?? `${this.getIssuer()}/credential`;
+  }
+  getNonceEndpoint() {
+    return this.endpointMetadata?.nonce_endpoint;
+  }
+  hasNonceEndpoint() {
+    return !!this.getNonceEndpoint();
   }
   getAuthorizationChallengeEndpoint() {
     this.assertIssuerData();
@@ -3512,24 +4512,14 @@ ${JSON.stringify(response.errorBody)}`);
     return !!this.getAuthorizationChallengeEndpoint();
   }
   hasDeferredCredentialEndpoint() {
-    return !!this.getAccessTokenEndpoint();
+    return !!this.endpointMetadata?.deferred_credential_endpoint;
   }
   getDeferredCredentialEndpoint() {
     this.assertIssuerData();
-    return this.endpointMetadata ? this.endpointMetadata.credential_endpoint : `${this.getIssuer()}/credential`;
+    return this.endpointMetadata?.deferred_credential_endpoint;
   }
-  /**
-  * Too bad we need a method like this, but EBSI is not exposing metadata
-  */
   isEBSI() {
-    if (this.credentialOffer && this.credentialOffer?.credential_offer?.credentials?.find((cred) => (
-      // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-      // @ts-ignore
-      typeof cred !== "string" && "trust_framework" in cred && "name" in cred.trust_framework && cred.trust_framework.name.includes("ebsi")
-    ))) {
-      return true;
-    }
-    return this.clientId?.includes("ebsi") || this._state.kid?.includes("did:ebsi:") || this.getIssuer().includes("ebsi") || this.endpointMetadata.credentialIssuerMetadata?.authorization_endpoint?.includes("ebsi.eu") || this.endpointMetadata.credentialIssuerMetadata?.authorization_server?.includes("ebsi.eu");
+    return this.clientId?.includes("ebsi") || this._state.kid?.includes("did:ebsi:") || this.getIssuer().includes("ebsi") || this.endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint?.includes("ebsi.eu") || this.endpointMetadata?.credentialIssuerMetadata?.authorization_server?.includes("ebsi.eu");
   }
   assertIssuerData() {
     if (!this._state.credentialIssuer) {
@@ -3562,7 +4552,7 @@ ${JSON.stringify(response.errorBody)}`);
     };
     if (!authorizationRequestOpts) {
       authorizationRequestOpts = {
-        redirectUri: `${import_oid4vci_common23.DefaultURISchemes.CREDENTIAL_OFFER}://`
+        redirectUri: `${import_oid4vci_common27.DefaultURISchemes.CREDENTIAL_OFFER}://`
       };
     }
     const clientId = authorizationRequestOpts.clientId ?? this._state.clientId;
@@ -3573,7 +4563,7 @@ ${JSON.stringify(response.errorBody)}`);
   getAuthorizationCode = /* @__PURE__ */ __name((authorizationResponse, code) => {
     if (authorizationResponse) {
       this._state.authorizationCodeResponse = {
-        ...(0, import_oid4vci_common23.toAuthorizationResponsePayload)(authorizationResponse)
+        ...(0, import_oid4vci_common27.toAuthorizationResponsePayload)(authorizationResponse)
       };
     } else if (code) {
       this._state.authorizationCodeResponse = {
@@ -3585,16 +4575,16 @@ ${JSON.stringify(response.errorBody)}`);
 };
 
 // lib/OpenID4VCIClientV1_0_13.ts
-var import_oid4vci_common24 = require("@sphereon/oid4vci-common");
-var import_ssi_types15 = require("@sphereon/ssi-types");
-var logger13 = import_ssi_types15.Loggers.DEFAULT.get("sphereon:oid4vci");
+var import_oid4vci_common28 = require("@sphereon/oid4vci-common");
+var import_ssi_types18 = require("@sphereon/ssi-types");
+var logger16 = import_ssi_types18.Loggers.DEFAULT.get("sphereon:oid4vci");
 var OpenID4VCIClientV1_0_13 = class _OpenID4VCIClientV1_0_13 {
   static {
     __name(this, "OpenID4VCIClientV1_0_13");
   }
   _state;
   constructor({ credentialOffer, clientId, kid, alg, credentialIssuer, pkce, authorizationRequest, accessToken, jwk, endpointMetadata, accessTokenResponse, authorizationRequestOpts, authorizationCodeResponse, authorizationURL }) {
-    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common24.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
+    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common28.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
     if (!issuer) {
       throw Error("No credential issuer supplied or deduced from offer");
     }
@@ -3604,10 +4594,10 @@ var OpenID4VCIClientV1_0_13 = class _OpenID4VCIClientV1_0_13 {
       kid,
       alg,
       // TODO: We need to refactor this and always explicitly call createAuthorizationRequestUrl, so we can have a credential selection first and use the kid as a default for the client id
-      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common24.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
+      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common28.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
       pkce: {
         disabled: false,
-        codeChallengeMethod: import_oid4vci_common24.CodeChallengeMethod.S256,
+        codeChallengeMethod: import_oid4vci_common28.CodeChallengeMethod.S256,
         ...pkce
       },
       authorizationRequestOpts,
@@ -3621,7 +4611,7 @@ var OpenID4VCIClientV1_0_13 = class _OpenID4VCIClientV1_0_13 {
     if (!this._state.authorizationRequestOpts) {
       this._state.authorizationRequestOpts = this.syncAuthorizationRequestOpts(authorizationRequest);
     }
-    logger13.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
+    logger16.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
   }
   static async fromCredentialIssuer({ kid, alg, retrieveServerMetadata, clientId, credentialIssuer, pkce, authorizationRequest, createAuthorizationRequestURL }) {
     const client = new _OpenID4VCIClientV1_0_13({
@@ -3662,12 +4652,12 @@ var OpenID4VCIClientV1_0_13 = class _OpenID4VCIClientV1_0_13 {
     if (retrieveServerMetadata === void 0 || retrieveServerMetadata) {
       await client.retrieveServerMetadata();
     }
-    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common24.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL)) {
+    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common28.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL)) {
       await client.createAuthorizationRequestUrl({
         authorizationRequest,
         pkce
       });
-      logger13.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
+      logger16.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
     }
     return client;
   }
@@ -3725,12 +4715,12 @@ var OpenID4VCIClientV1_0_13 = class _OpenID4VCIClientV1_0_13 {
       ...opts
     });
     if (response.errorBody) {
-      logger13.debug(`Authorization code error:\r
+      logger16.debug(`Authorization code error:\r
 ${JSON.stringify(response.errorBody)}`);
       const error = response.errorBody;
       return Promise.reject(error);
     } else if (!response.successBody) {
-      logger13.debug(`Authorization code error. No success body`);
+      logger16.debug(`Authorization code error. No success body`);
       return Promise.reject(Error(`Retrieving an authorization code token from ${this._state.endpointMetadata?.authorization_challenge_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
     }
     return {
@@ -3802,11 +4792,11 @@ ${JSON.stringify(response.errorBody)}`);
         }
       });
       if (response.errorBody) {
-        logger13.debug(`Access token error:\r
+        logger16.debug(`Access token error:\r
 ${JSON.stringify(response.errorBody)}`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
       } else if (!response.successBody) {
-        logger13.debug(`Access token error. No success body`);
+        logger16.debug(`Access token error. No success body`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
       }
       this._state.accessTokenResponse = response.successBody;
@@ -3831,7 +4821,7 @@ ${JSON.stringify(response.errorBody)}`);
       jwk,
       kid
     ].filter((v) => v !== void 0).length > 1) {
-      throw new Error(import_oid4vci_common24.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
+      throw new Error(import_oid4vci_common28.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
     }
     if (alg) this._state.alg = alg;
     if (jwk) this._state.jwk = jwk;
@@ -3845,7 +4835,7 @@ ${JSON.stringify(response.errorBody)}`);
       metadata: this.endpointMetadata,
       version: this.version()
     });
-    const issuerState = this.issuerSupportedFlowTypes().includes(import_oid4vci_common24.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this.accessTokenResponse?.c_nonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
+    const issuerState = this.issuerSupportedFlowTypes().includes(import_oid4vci_common28.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this.accessTokenResponse?.c_nonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
     requestBuilder.withIssuerState(issuerState);
     requestBuilder.withTokenFromResponse(this.accessTokenResponse);
     requestBuilder.withDeferredCredentialAwait(deferredCredentialAwait ?? false, deferredCredentialIntervalInMS);
@@ -3868,7 +4858,7 @@ ${JSON.stringify(response.errorBody)}`);
       } else if (metadata.credentials_supported && Array.isArray(metadata.credentials_supported)) {
         let typeSupported = false;
         metadata.credentials_supported.forEach((supportedCredential) => {
-          const subTypes = (0, import_oid4vci_common24.getTypesFromCredentialSupported)(supportedCredential);
+          const subTypes = (0, import_oid4vci_common28.getTypesFromCredentialSupported)(supportedCredential);
           if (subTypes.every((t, i) => types[i] === t) || types.length === 1 && (types[0] === supportedCredential.id || subTypes.includes(types[0]))) {
             typeSupported = true;
             if (supportedCredential.credential_subject_issuance) {
@@ -3884,7 +4874,7 @@ ${JSON.stringify(response.errorBody)}`);
       } else if (metadata.credential_configurations_supported && typeof metadata.credential_configurations_supported === "object") {
         let typeSupported = false;
         Object.values(metadata.credential_configurations_supported).forEach((supportedCredential) => {
-          const subTypes = (0, import_oid4vci_common24.getTypesFromCredentialSupported)(supportedCredential);
+          const subTypes = (0, import_oid4vci_common28.getTypesFromCredentialSupported)(supportedCredential);
           if (subTypes.every((t, i) => types[i] === t) || types.length === 1 && (types[0] === supportedCredential.id || subTypes.includes(types[0]))) {
             typeSupported = true;
           }
@@ -3934,14 +4924,17 @@ ${JSON.stringify(response.errorBody)}`);
       credentialIdentifier,
       subjectIssuance
     });
-    const response = await credentialRequestClient.acquireCredentialsUsingRequest(request, createDPoPOpts);
+    if (!import_oid4vci_common28.supportedOID4VCICredentialFormat.includes(format)) {
+      return Promise.reject(Error(`Unsupported credential format: ${format}`));
+    }
+    const response = await credentialRequestClient.acquireCredentialsUsingRequest(request, format, createDPoPOpts);
     this._state.dpopResponseParams = response.params;
     if (response.errorBody) {
-      logger13.debug(`Credential request error:\r
+      logger16.debug(`Credential request error:\r
 ${JSON.stringify(response.errorBody)}`);
       throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
     } else if (!response.successBody) {
-      logger13.debug(`Credential request error. No success body`);
+      logger16.debug(`Credential request error. No success body`);
       throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
     }
     return {
@@ -3956,7 +4949,7 @@ ${JSON.stringify(response.errorBody)}`);
     return JSON.stringify(this._state);
   }
   getCredentialsSupported(format) {
-    return (0, import_oid4vci_common24.getSupportedCredentials)({
+    return (0, import_oid4vci_common28.getSupportedCredentials)({
       issuerMetadata: this.endpointMetadata.credentialIssuerMetadata,
       version: this.version(),
       format,
@@ -3991,7 +4984,7 @@ ${JSON.stringify(response.errorBody)}`);
   }*/
   issuerSupportedFlowTypes() {
     return this.credentialOffer?.supportedFlows ?? (this._state.endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint ? [
-      import_oid4vci_common24.AuthzFlowType.AUTHORIZATION_CODE_FLOW
+      import_oid4vci_common28.AuthzFlowType.AUTHORIZATION_CODE_FLOW
     ] : []);
   }
   isFlowTypeSupported(flowType) {
@@ -4007,7 +5000,7 @@ ${JSON.stringify(response.errorBody)}`);
     return this._state.credentialOffer;
   }
   version() {
-    return this.credentialOffer?.version ?? import_oid4vci_common24.OpenId4VCIVersion.VER_1_0_13;
+    return this.credentialOffer?.version ?? import_oid4vci_common28.OpenId4VCIVersion.VER_1_0_13;
   }
   get endpointMetadata() {
     this.assertServerMetadata();
@@ -4110,7 +5103,7 @@ ${JSON.stringify(response.errorBody)}`);
     };
     if (!authorizationRequestOpts) {
       authorizationRequestOpts = {
-        redirectUri: `${import_oid4vci_common24.DefaultURISchemes.CREDENTIAL_OFFER}://`
+        redirectUri: `${import_oid4vci_common28.DefaultURISchemes.CREDENTIAL_OFFER}://`
       };
     }
     const clientId = authorizationRequestOpts.clientId ?? this._state.clientId;
@@ -4121,7 +5114,7 @@ ${JSON.stringify(response.errorBody)}`);
   getAuthorizationCode = /* @__PURE__ */ __name((authorizationResponse, code) => {
     if (authorizationResponse) {
       this._state.authorizationCodeResponse = {
-        ...(0, import_oid4vci_common24.toAuthorizationResponsePayload)(authorizationResponse)
+        ...(0, import_oid4vci_common28.toAuthorizationResponsePayload)(authorizationResponse)
       };
     } else if (code) {
       this._state.authorizationCodeResponse = {
@@ -4133,16 +5126,16 @@ ${JSON.stringify(response.errorBody)}`);
 };
 
 // lib/OpenID4VCIClientV1_0_11.ts
-var import_oid4vci_common25 = require("@sphereon/oid4vci-common");
-var import_ssi_types16 = require("@sphereon/ssi-types");
-var logger14 = import_ssi_types16.Loggers.DEFAULT.get("sphereon:oid4vci");
+var import_oid4vci_common29 = require("@sphereon/oid4vci-common");
+var import_ssi_types19 = require("@sphereon/ssi-types");
+var logger17 = import_ssi_types19.Loggers.DEFAULT.get("sphereon:oid4vci");
 var OpenID4VCIClientV1_0_11 = class _OpenID4VCIClientV1_0_11 {
   static {
     __name(this, "OpenID4VCIClientV1_0_11");
   }
   _state;
   constructor({ credentialOffer, clientId, kid, alg, credentialIssuer, pkce, authorizationRequest, jwk, endpointMetadata, accessTokenResponse, authorizationRequestOpts, authorizationCodeResponse, authorizationURL }) {
-    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common25.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
+    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common29.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
     if (!issuer) {
       throw Error("No credential issuer supplied or deduced from offer");
     }
@@ -4152,10 +5145,10 @@ var OpenID4VCIClientV1_0_11 = class _OpenID4VCIClientV1_0_11 {
       kid,
       alg,
       // TODO: We need to refactor this and always explicitly call createAuthorizationRequestUrl, so we can have a credential selection first and use the kid as a default for the client id
-      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common25.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
+      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common29.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
       pkce: {
         disabled: false,
-        codeChallengeMethod: import_oid4vci_common25.CodeChallengeMethod.S256,
+        codeChallengeMethod: import_oid4vci_common29.CodeChallengeMethod.S256,
         ...pkce
       },
       authorizationRequestOpts,
@@ -4168,7 +5161,7 @@ var OpenID4VCIClientV1_0_11 = class _OpenID4VCIClientV1_0_11 {
     if (!this._state.authorizationRequestOpts) {
       this._state.authorizationRequestOpts = this.syncAuthorizationRequestOpts(authorizationRequest);
     }
-    logger14.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
+    logger17.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
   }
   static async fromCredentialIssuer({ kid, alg, retrieveServerMetadata, clientId, credentialIssuer, pkce, authorizationRequest, createAuthorizationRequestURL }) {
     const client = new _OpenID4VCIClientV1_0_11({
@@ -4209,12 +5202,12 @@ var OpenID4VCIClientV1_0_11 = class _OpenID4VCIClientV1_0_11 {
     if (retrieveServerMetadata === void 0 || retrieveServerMetadata) {
       await client.retrieveServerMetadata();
     }
-    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common25.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL)) {
+    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common29.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL)) {
       await client.createAuthorizationRequestUrl({
         authorizationRequest,
         pkce
       });
-      logger14.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
+      logger17.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
     }
     return client;
   }
@@ -4271,12 +5264,12 @@ var OpenID4VCIClientV1_0_11 = class _OpenID4VCIClientV1_0_11 {
       ...opts
     });
     if (response.errorBody) {
-      logger14.debug(`Authorization code error:\r
+      logger17.debug(`Authorization code error:\r
 ${JSON.stringify(response.errorBody)}`);
       const error = response.errorBody;
       return Promise.reject(error);
     } else if (!response.successBody) {
-      logger14.debug(`Authorization code error. No success body`);
+      logger17.debug(`Authorization code error. No success body`);
       return Promise.reject(Error(`Retrieving an authorization code token from ${this._state.endpointMetadata?.authorization_challenge_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
     }
     return {
@@ -4348,11 +5341,11 @@ ${JSON.stringify(response.errorBody)}`);
         }
       });
       if (response.errorBody) {
-        logger14.debug(`Access token error:\r
+        logger17.debug(`Access token error:\r
 ${JSON.stringify(response.errorBody)}`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
       } else if (!response.successBody) {
-        logger14.debug(`Access token error. No success body`);
+        logger17.debug(`Access token error. No success body`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
       }
       this._state.accessTokenResponse = response.successBody;
@@ -4371,7 +5364,7 @@ ${JSON.stringify(response.errorBody)}`);
       jwk,
       kid
     ].filter((v) => v !== void 0).length > 1) {
-      throw new Error(import_oid4vci_common25.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
+      throw new Error(import_oid4vci_common29.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
     }
     if (alg) this._state.alg = alg;
     if (jwk) this._state.jwk = jwk;
@@ -4395,7 +5388,7 @@ ${JSON.stringify(response.errorBody)}`);
       if (metadata.credentials_supported && Array.isArray(metadata.credentials_supported)) {
         let typeSupported = false;
         metadata.credentials_supported.forEach((supportedCredential) => {
-          const subTypes = (0, import_oid4vci_common25.getTypesFromCredentialSupported)(supportedCredential);
+          const subTypes = (0, import_oid4vci_common29.getTypesFromCredentialSupported)(supportedCredential);
           if (subTypes.every((t, i) => types[i] === t) || types.length === 1 && (types[0] === supportedCredential.id || subTypes.includes(types[0]))) {
             typeSupported = true;
           }
@@ -4437,11 +5430,11 @@ ${JSON.stringify(response.errorBody)}`);
     });
     this._state.dpopResponseParams = response.params;
     if (response.errorBody) {
-      logger14.debug(`Credential request error:\r
+      logger17.debug(`Credential request error:\r
 ${JSON.stringify(response.errorBody)}`);
       throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
     } else if (!response.successBody) {
-      logger14.debug(`Credential request error. No success body`);
+      logger17.debug(`Credential request error. No success body`);
       throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
     }
     return {
@@ -4459,7 +5452,7 @@ ${JSON.stringify(response.errorBody)}`);
   // When < v11 convert into a v12 object. When v12 object retain it.
   // Then match the object array on server metadata
   getCredentialsSupportedV11(restrictToInitiationTypes, format) {
-    return (0, import_oid4vci_common25.getSupportedCredentials)({
+    return (0, import_oid4vci_common29.getSupportedCredentials)({
       issuerMetadata: this.endpointMetadata.credentialIssuerMetadata,
       version: this.version(),
       format,
@@ -4467,7 +5460,7 @@ ${JSON.stringify(response.errorBody)}`);
     });
   }
   getCredentialsSupported(format) {
-    return (0, import_oid4vci_common25.getSupportedCredentials)({
+    return (0, import_oid4vci_common29.getSupportedCredentials)({
       issuerMetadata: this.endpointMetadata.credentialIssuerMetadata,
       version: this.version(),
       format,
@@ -4477,7 +5470,7 @@ ${JSON.stringify(response.errorBody)}`);
   getCredentialOfferTypes() {
     if (!this.credentialOffer) {
       return [];
-    } else if (this.credentialOffer.version < import_oid4vci_common25.OpenId4VCIVersion.VER_1_0_11) {
+    } else if (this.credentialOffer.version < import_oid4vci_common29.OpenId4VCIVersion.VER_1_0_11) {
       const orig = this.credentialOffer.original_credential_offer;
       const types = typeof orig.credential_type === "string" ? [
         orig.credential_type
@@ -4485,14 +5478,14 @@ ${JSON.stringify(response.errorBody)}`);
       const result = [];
       result[0] = types;
       return result;
-    } else if (this.credentialOffer.version < import_oid4vci_common25.OpenId4VCIVersion.VER_1_0_13) {
-      return this.credentialOffer.credential_offer.credentials.map((c) => (0, import_oid4vci_common25.getTypesFromObject)(c) ?? []);
+    } else if (this.credentialOffer.version < import_oid4vci_common29.OpenId4VCIVersion.VER_1_0_13) {
+      return this.credentialOffer.credential_offer.credentials.map((c) => (0, import_oid4vci_common29.getTypesFromObject)(c) ?? []);
     }
     throw Error(`This class only supports version 11 and lower! Version: ${this.version()}`);
   }
   issuerSupportedFlowTypes() {
     return this.credentialOffer?.supportedFlows ?? (this._state.endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint ? [
-      import_oid4vci_common25.AuthzFlowType.AUTHORIZATION_CODE_FLOW
+      import_oid4vci_common29.AuthzFlowType.AUTHORIZATION_CODE_FLOW
     ] : []);
   }
   isFlowTypeSupported(flowType) {
@@ -4508,7 +5501,7 @@ ${JSON.stringify(response.errorBody)}`);
     return this._state.credentialOffer;
   }
   version() {
-    return this.credentialOffer?.version ?? import_oid4vci_common25.OpenId4VCIVersion.VER_1_0_11;
+    return this.credentialOffer?.version ?? import_oid4vci_common29.OpenId4VCIVersion.VER_1_0_11;
   }
   get endpointMetadata() {
     this.assertServerMetadata();
@@ -4604,7 +5597,7 @@ ${JSON.stringify(response.errorBody)}`);
     };
     if (!authorizationRequestOpts) {
       authorizationRequestOpts = {
-        redirectUri: `${import_oid4vci_common25.DefaultURISchemes.CREDENTIAL_OFFER}://`
+        redirectUri: `${import_oid4vci_common29.DefaultURISchemes.CREDENTIAL_OFFER}://`
       };
     }
     const clientId = authorizationRequestOpts.clientId ?? this._state.clientId;
@@ -4615,7 +5608,7 @@ ${JSON.stringify(response.errorBody)}`);
   getAuthorizationCode = /* @__PURE__ */ __name((authorizationResponse, code) => {
     if (authorizationResponse) {
       this._state.authorizationCodeResponse = {
-        ...(0, import_oid4vci_common25.toAuthorizationResponsePayload)(authorizationResponse)
+        ...(0, import_oid4vci_common29.toAuthorizationResponsePayload)(authorizationResponse)
       };
     } else if (code) {
       this._state.authorizationCodeResponse = {
@@ -4627,5 +5620,5 @@ ${JSON.stringify(response.errorBody)}`);
 };
 
 // lib/index.ts
-var LOG2 = import_oid4vci_common26.VCI_LOGGERS.get("sphereon:oid4vci:client");
+var LOG2 = import_oid4vci_common30.VCI_LOGGERS.get("sphereon:oid4vci:client");
 //# sourceMappingURL=index.cjs.map