@sphereon/oid4vci-client 0.19.1-feature.DIIPv4.2 → 0.19.1-feature.DIIPv4.62

package/dist/index.cjs

@@ -26,18 +26,22 @@ __export(index_exports, {
   CredentialOfferClient: () => CredentialOfferClient,
   CredentialOfferClientV1_0_11: () => CredentialOfferClientV1_0_11,
   CredentialOfferClientV1_0_13: () => CredentialOfferClientV1_0_13,
+  CredentialOfferClientV1_0_15: () => CredentialOfferClientV1_0_15,
   CredentialRequestClient: () => CredentialRequestClient,
   CredentialRequestClientBuilder: () => CredentialRequestClientBuilder,
   CredentialRequestClientBuilderV1_0_11: () => CredentialRequestClientBuilderV1_0_11,
   CredentialRequestClientBuilderV1_0_13: () => CredentialRequestClientBuilderV1_0_13,
+  CredentialRequestClientBuilderV1_0_15: () => CredentialRequestClientBuilderV1_0_15,
   CredentialRequestClientV1_0_11: () => CredentialRequestClientV1_0_11,
   LOG: () => LOG2,
   MetadataClient: () => MetadataClient,
   MetadataClientV1_0_11: () => MetadataClientV1_0_11,
   MetadataClientV1_0_13: () => MetadataClientV1_0_13,
+  MetadataClientV1_0_15: () => MetadataClientV1_0_15,
   OpenID4VCIClient: () => OpenID4VCIClient,
   OpenID4VCIClientV1_0_11: () => OpenID4VCIClientV1_0_11,
   OpenID4VCIClientV1_0_13: () => OpenID4VCIClientV1_0_13,
+  OpenID4VCIClientV1_0_15: () => OpenID4VCIClientV1_0_15,
   ProofOfPossessionBuilder: () => ProofOfPossessionBuilder,
   acquireAuthorizationChallengeAuthCode: () => acquireAuthorizationChallengeAuthCode,
   acquireAuthorizationChallengeAuthCodeUsingRequest: () => acquireAuthorizationChallengeAuthCodeUsingRequest,
@@ -56,7 +60,7 @@ __export(index_exports, {
   sendNotification: () => sendNotification
 });
 module.exports = __toCommonJS(index_exports);
-var import_oid4vci_common26 = require("@sphereon/oid4vci-common");
+var import_oid4vci_common31 = require("@sphereon/oid4vci-common");
 
 // lib/AccessTokenClient.ts
 var import_oid4vc_common3 = require("@sphereon/oid4vc-common");
@@ -1060,12 +1064,12 @@ var AccessTokenClientV1_0_11 = class _AccessTokenClientV1_0_11 {
 };
 
 // lib/AuthorizationCodeClient.ts
-var import_oid4vci_common13 = require("@sphereon/oid4vci-common");
-var import_ssi_types8 = require("@sphereon/ssi-types");
+var import_oid4vci_common14 = require("@sphereon/oid4vci-common");
+var import_ssi_types9 = require("@sphereon/ssi-types");
 
 // lib/MetadataClient.ts
-var import_oid4vci_common12 = require("@sphereon/oid4vci-common");
-var import_ssi_types7 = require("@sphereon/ssi-types");
+var import_oid4vci_common13 = require("@sphereon/oid4vci-common");
+var import_ssi_types8 = require("@sphereon/ssi-types");
 
 // lib/MetadataClientV1_0_11.ts
 var import_oid4vci_common11 = require("@sphereon/oid4vci-common");
@@ -1228,8 +1232,180 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
   }
 };
 
-// lib/MetadataClient.ts
+// lib/MetadataClientV1_0_15.ts
+var import_oid4vci_common12 = require("@sphereon/oid4vci-common");
+var import_ssi_types7 = require("@sphereon/ssi-types");
 var logger5 = import_ssi_types7.Loggers.DEFAULT.get("sphereon:oid4vci:metadata");
+var MetadataClientV1_0_15 = class _MetadataClientV1_0_15 {
+  static {
+    __name(this, "MetadataClientV1_0_15");
+  }
+  /**
+  * Retrieve metadata using the Initiation obtained from a previous step
+  *
+  * @param credentialOffer
+  */
+  static async retrieveAllMetadataFromCredentialOffer(credentialOffer) {
+    return _MetadataClientV1_0_15.retrieveAllMetadataFromCredentialOfferRequest(credentialOffer.credential_offer);
+  }
+  /**
+  * Retrieve the metada using the initiation request obtained from a previous step
+  * @param request
+  */
+  static async retrieveAllMetadataFromCredentialOfferRequest(request) {
+    const issuer = (0, import_oid4vci_common12.getIssuerFromCredentialOfferPayload)(request);
+    if (issuer) {
+      return _MetadataClientV1_0_15.retrieveAllMetadata(issuer);
+    }
+    throw new Error("can't retrieve metadata from CredentialOfferRequest. No issuer field is present");
+  }
+  /**
+  * Retrieve all metadata from an issuer
+  * @param issuer The issuer URL
+  * @param opts
+  */
+  static async retrieveAllMetadata(issuer, opts) {
+    let token_endpoint;
+    let credential_endpoint;
+    let nonce_endpoint;
+    let deferred_credential_endpoint;
+    let authorization_endpoint;
+    let authorization_challenge_endpoint;
+    let authorizationServerType = "OID4VCI";
+    let authorization_servers = [
+      issuer
+    ];
+    const oid4vciResponse = await _MetadataClientV1_0_15.retrieveOpenID4VCIServerMetadata(issuer, {
+      errorOnNotFound: false
+    });
+    let credentialIssuerMetadata = oid4vciResponse?.successBody;
+    if (credentialIssuerMetadata) {
+      logger5.debug(`Issuer ${issuer} OID4VCI well-known server metadata\r
+${JSON.stringify(credentialIssuerMetadata)}`);
+      credential_endpoint = credentialIssuerMetadata.credential_endpoint;
+      nonce_endpoint = credentialIssuerMetadata.nonce_endpoint;
+      deferred_credential_endpoint = credentialIssuerMetadata.deferred_credential_endpoint;
+      if (credentialIssuerMetadata.token_endpoint) {
+        token_endpoint = credentialIssuerMetadata.token_endpoint;
+      }
+      authorization_challenge_endpoint = credentialIssuerMetadata.authorization_challenge_endpoint;
+      if (credentialIssuerMetadata.authorization_servers) {
+        authorization_servers = credentialIssuerMetadata.authorization_servers;
+      }
+    }
+    let response = await retrieveWellknown(authorization_servers[0], import_oid4vci_common12.WellKnownEndpoints.OPENID_CONFIGURATION, {
+      errorOnNotFound: false
+    });
+    let authMetadata = response.successBody;
+    if (authMetadata) {
+      logger5.debug(`Issuer ${issuer} has OpenID Connect Server metadata in well-known location`);
+      authorizationServerType = "OIDC";
+    } else {
+      response = await retrieveWellknown(authorization_servers[0], import_oid4vci_common12.WellKnownEndpoints.OAUTH_AS, {
+        errorOnNotFound: false
+      });
+      authMetadata = response.successBody;
+    }
+    if (!authMetadata) {
+      if (!authorization_servers.includes(issuer)) {
+        throw Error(`Issuer ${issuer} provided a separate authorization server ${authorization_servers}, but that server did not provide metadata`);
+      }
+    } else {
+      logger5.debug(`Issuer ${issuer} has ${authorizationServerType} Server metadata in well-known location`);
+      if (!authMetadata.authorization_endpoint) {
+        console.warn(`Issuer ${issuer} of type ${authorizationServerType} has no authorization_endpoint! Will use ${authorization_endpoint}. This only works for pre-authorized flows`);
+      } else if (authorization_endpoint && authMetadata.authorization_endpoint !== authorization_endpoint) {
+        throw Error(`Credential issuer has a different authorization_endpoint (${authorization_endpoint}) from the Authorization Server (${authMetadata.authorization_endpoint})`);
+      }
+      authorization_endpoint = authMetadata.authorization_endpoint;
+      if (authorization_challenge_endpoint && authMetadata.authorization_challenge_endpoint !== authorization_challenge_endpoint) {
+        throw Error(`Credential issuer has a different authorization_challenge_endpoint (${authorization_challenge_endpoint}) from the Authorization Server (${authMetadata.authorization_challenge_endpoint})`);
+      }
+      authorization_challenge_endpoint = authMetadata.authorization_challenge_endpoint;
+      if (!authMetadata.token_endpoint) {
+        throw Error(`Authorization Server ${authorization_servers} did not provide a token_endpoint`);
+      } else if (token_endpoint && authMetadata.token_endpoint !== token_endpoint) {
+        throw Error(`Credential issuer has a different token_endpoint (${token_endpoint}) from the Authorization Server (${authMetadata.token_endpoint})`);
+      }
+      token_endpoint = authMetadata.token_endpoint;
+      if (authMetadata.credential_endpoint) {
+        if (credential_endpoint && authMetadata.credential_endpoint !== credential_endpoint) {
+          logger5.debug(`Credential issuer has a different credential_endpoint (${credential_endpoint}) from the Authorization Server (${authMetadata.credential_endpoint}). Will use the issuer value`);
+        } else {
+          credential_endpoint = authMetadata.credential_endpoint;
+        }
+      }
+      if (authMetadata.deferred_credential_endpoint) {
+        if (deferred_credential_endpoint && authMetadata.deferred_credential_endpoint !== deferred_credential_endpoint) {
+          logger5.debug(`Credential issuer has a different deferred_credential_endpoint (${deferred_credential_endpoint}) from the Authorization Server (${authMetadata.deferred_credential_endpoint}). Will use the issuer value`);
+        } else {
+          deferred_credential_endpoint = authMetadata.deferred_credential_endpoint;
+        }
+      }
+    }
+    if (!authorization_endpoint) {
+      logger5.debug(`Issuer ${issuer} does not expose authorization_endpoint, so only pre-auth will be supported`);
+    }
+    if (!token_endpoint) {
+      logger5.debug(`Issuer ${issuer} does not have a token_endpoint listed in well-known locations!`);
+      if (opts?.errorOnNotFound) {
+        throw Error(`Could not deduce the token_endpoint for ${issuer}`);
+      } else {
+        token_endpoint = `${issuer}${issuer.endsWith("/") ? "token" : "/token"}`;
+      }
+    }
+    if (!credential_endpoint) {
+      logger5.debug(`Issuer ${issuer} does not have a credential_endpoint listed in well-known locations!`);
+      if (opts?.errorOnNotFound) {
+        throw Error(`Could not deduce the credential endpoint for ${issuer}`);
+      } else {
+        credential_endpoint = `${issuer}${issuer.endsWith("/") ? "credential" : "/credential"}`;
+      }
+    }
+    if (!credentialIssuerMetadata && authMetadata) {
+      credentialIssuerMetadata = authMetadata;
+    }
+    const ci = credentialIssuerMetadata ?? {};
+    const ciAuthorizationServers = Array.isArray(ci.authorization_servers) && ci.authorization_servers.length > 0 ? ci.authorization_servers : authorization_servers;
+    const v15CredentialIssuerMetadata = {
+      credential_issuer: ci.credential_issuer ?? issuer,
+      credential_endpoint,
+      authorization_servers: ciAuthorizationServers,
+      credential_configurations_supported: ci.credential_configurations_supported ?? {},
+      display: ci.display ?? [],
+      ...nonce_endpoint && {
+        nonce_endpoint
+      },
+      ...deferred_credential_endpoint && {
+        deferred_credential_endpoint
+      }
+    };
+    logger5.debug(`Issuer ${issuer} token endpoint ${token_endpoint}, credential endpoint ${credential_endpoint}`);
+    return {
+      issuer,
+      token_endpoint,
+      credential_endpoint,
+      authorization_challenge_endpoint,
+      authorizationServerType,
+      credentialIssuerMetadata: v15CredentialIssuerMetadata,
+      authorizationServerMetadata: authMetadata
+    };
+  }
+  /**
+  * Retrieve only the OID4VCI metadata for the issuer. So no OIDC/OAuth2 metadata
+  *
+  * @param issuerHost The issuer hostname
+  * @param opts
+  */
+  static async retrieveOpenID4VCIServerMetadata(issuerHost, opts) {
+    return retrieveWellknown(issuerHost, import_oid4vci_common12.WellKnownEndpoints.OPENID4VCI_ISSUER, {
+      errorOnNotFound: opts?.errorOnNotFound === void 0 ? true : opts.errorOnNotFound
+    });
+  }
+};
+
+// lib/MetadataClient.ts
+var logger6 = import_ssi_types8.Loggers.DEFAULT.get("sphereon:oid4vci:metadata");
 var MetadataClient = class _MetadataClient {
   static {
     __name(this, "MetadataClient");
@@ -1240,7 +1416,9 @@ var MetadataClient = class _MetadataClient {
   * @param credentialOffer
   */
   static async retrieveAllMetadataFromCredentialOffer(credentialOffer) {
-    if ((0, import_oid4vci_common12.determineSpecVersionFromOffer)(credentialOffer.credential_offer) >= import_oid4vci_common12.OpenId4VCIVersion.VER_1_0_13) {
+    if ((0, import_oid4vci_common13.determineSpecVersionFromOffer)(credentialOffer.credential_offer) >= import_oid4vci_common13.OpenId4VCIVersion.VER_1_0_15) {
+      return await MetadataClientV1_0_15.retrieveAllMetadataFromCredentialOffer(credentialOffer);
+    } else if ((0, import_oid4vci_common13.determineSpecVersionFromOffer)(credentialOffer.credential_offer) >= import_oid4vci_common13.OpenId4VCIVersion.VER_1_0_13) {
       return await MetadataClientV1_0_13.retrieveAllMetadataFromCredentialOffer(credentialOffer);
     } else {
       return await MetadataClientV1_0_11.retrieveAllMetadataFromCredentialOffer(credentialOffer);
@@ -1251,9 +1429,11 @@ var MetadataClient = class _MetadataClient {
   * @param request
   */
   static async retrieveAllMetadataFromCredentialOfferRequest(request) {
-    const issuer = (0, import_oid4vci_common12.getIssuerFromCredentialOfferPayload)(request);
+    const issuer = (0, import_oid4vci_common13.getIssuerFromCredentialOfferPayload)(request);
     if (issuer) {
-      if ((0, import_oid4vci_common12.determineSpecVersionFromOffer)(request) >= import_oid4vci_common12.OpenId4VCIVersion.VER_1_0_13) {
+      if ((0, import_oid4vci_common13.determineSpecVersionFromOffer)(request) >= import_oid4vci_common13.OpenId4VCIVersion.VER_1_0_15) {
+        return MetadataClientV1_0_15.retrieveAllMetadataFromCredentialOfferRequest(request);
+      } else if ((0, import_oid4vci_common13.determineSpecVersionFromOffer)(request) >= import_oid4vci_common13.OpenId4VCIVersion.VER_1_0_13) {
         return MetadataClientV1_0_13.retrieveAllMetadataFromCredentialOfferRequest(request);
       } else {
         return MetadataClientV1_0_11.retrieveAllMetadataFromCredentialOfferRequest(request);
@@ -1282,7 +1462,7 @@ var MetadataClient = class _MetadataClient {
     });
     let credentialIssuerMetadata = oid4vciResponse?.successBody;
     if (credentialIssuerMetadata) {
-      logger5.debug(`Issuer ${issuer} OID4VCI well-known server metadata\r
+      logger6.debug(`Issuer ${issuer} OID4VCI well-known server metadata\r
 ${JSON.stringify(credentialIssuerMetadata)}`);
       credential_endpoint = credentialIssuerMetadata.credential_endpoint;
       deferred_credential_endpoint = credentialIssuerMetadata.deferred_credential_endpoint ? credentialIssuerMetadata.deferred_credential_endpoint : void 0;
@@ -1299,15 +1479,15 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
         ];
       }
     }
-    let response = await retrieveWellknown(authorization_servers[0], import_oid4vci_common12.WellKnownEndpoints.OPENID_CONFIGURATION, {
+    let response = await retrieveWellknown(authorization_servers[0], import_oid4vci_common13.WellKnownEndpoints.OPENID_CONFIGURATION, {
       errorOnNotFound: false
     });
     let authMetadata = response.successBody;
     if (authMetadata) {
-      logger5.debug(`Issuer ${issuer} has OpenID Connect Server metadata in well-known location`);
+      logger6.debug(`Issuer ${issuer} has OpenID Connect Server metadata in well-known location`);
       authorizationServerType = "OIDC";
     } else {
-      response = await retrieveWellknown(authorization_servers[0], import_oid4vci_common12.WellKnownEndpoints.OAUTH_AS, {
+      response = await retrieveWellknown(authorization_servers[0], import_oid4vci_common13.WellKnownEndpoints.OAUTH_AS, {
         errorOnNotFound: false
       });
       authMetadata = response.successBody;
@@ -1320,7 +1500,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
       if (!authorizationServerType) {
         authorizationServerType = "OAuth 2.0";
       }
-      logger5.debug(`Issuer ${issuer} has ${authorizationServerType} Server metadata in well-known location`);
+      logger6.debug(`Issuer ${issuer} has ${authorizationServerType} Server metadata in well-known location`);
       if (!authMetadata.authorization_endpoint) {
         console.warn(`Issuer ${issuer} of type ${authorizationServerType} has no authorization_endpoint! Will use ${authorization_endpoint}. This only works for pre-authorized flows`);
       } else if (authorization_endpoint && authMetadata.authorization_endpoint !== authorization_endpoint) {
@@ -1339,24 +1519,24 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
       token_endpoint = authMetadata.token_endpoint;
       if (authMetadata.credential_endpoint) {
         if (credential_endpoint && authMetadata.credential_endpoint !== credential_endpoint) {
-          logger5.debug(`Credential issuer has a different credential_endpoint (${credential_endpoint}) from the Authorization Server (${authMetadata.credential_endpoint}). Will use the issuer value`);
+          logger6.debug(`Credential issuer has a different credential_endpoint (${credential_endpoint}) from the Authorization Server (${authMetadata.credential_endpoint}). Will use the issuer value`);
         } else {
           credential_endpoint = authMetadata.credential_endpoint;
         }
       }
       if (authMetadata.deferred_credential_endpoint) {
         if (deferred_credential_endpoint && authMetadata.deferred_credential_endpoint !== deferred_credential_endpoint) {
-          logger5.debug(`Credential issuer has a different deferred_credential_endpoint (${deferred_credential_endpoint}) from the Authorization Server (${authMetadata.deferred_credential_endpoint}). Will use the issuer value`);
+          logger6.debug(`Credential issuer has a different deferred_credential_endpoint (${deferred_credential_endpoint}) from the Authorization Server (${authMetadata.deferred_credential_endpoint}). Will use the issuer value`);
         } else {
           deferred_credential_endpoint = authMetadata.deferred_credential_endpoint;
         }
       }
     }
     if (!authorization_endpoint) {
-      logger5.debug(`Issuer ${issuer} does not expose authorization_endpoint, so only pre-auth will be supported`);
+      logger6.debug(`Issuer ${issuer} does not expose authorization_endpoint, so only pre-auth will be supported`);
     }
     if (!token_endpoint) {
-      logger5.debug(`Issuer ${issuer} does not have a token_endpoint listed in well-known locations!`);
+      logger6.debug(`Issuer ${issuer} does not have a token_endpoint listed in well-known locations!`);
       if (opts?.errorOnNotFound) {
         throw Error(`Could not deduce the token_endpoint for ${issuer}`);
       } else {
@@ -1364,7 +1544,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
       }
     }
     if (!credential_endpoint) {
-      logger5.debug(`Issuer ${issuer} does not have a credential_endpoint listed in well-known locations!`);
+      logger6.debug(`Issuer ${issuer} does not have a credential_endpoint listed in well-known locations!`);
       if (opts?.errorOnNotFound) {
         throw Error(`Could not deduce the credential endpoint for ${issuer}`);
       } else {
@@ -1374,7 +1554,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
     if (!credentialIssuerMetadata && authMetadata) {
       credentialIssuerMetadata = authorization_server ? authMetadata : authMetadata;
     }
-    logger5.debug(`Issuer ${issuer} token endpoint ${token_endpoint}, credential endpoint ${credential_endpoint}`);
+    logger6.debug(`Issuer ${issuer} token endpoint ${token_endpoint}, credential endpoint ${credential_endpoint}`);
     return {
       issuer,
       token_endpoint,
@@ -1399,18 +1579,18 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
   * @param opts
   */
   static async retrieveOpenID4VCIServerMetadata(issuerHost, opts) {
-    return retrieveWellknown(issuerHost, import_oid4vci_common12.WellKnownEndpoints.OPENID4VCI_ISSUER, {
+    return retrieveWellknown(issuerHost, import_oid4vci_common13.WellKnownEndpoints.OPENID4VCI_ISSUER, {
       errorOnNotFound: opts?.errorOnNotFound === void 0 ? true : opts.errorOnNotFound
     });
   }
 };
 
 // lib/AuthorizationCodeClient.ts
-var logger6 = import_ssi_types8.Loggers.DEFAULT.get("sphereon:oid4vci");
+var logger7 = import_ssi_types9.Loggers.DEFAULT.get("sphereon:oid4vci");
 async function createSignedAuthRequestWhenNeeded(requestObject, opts) {
-  if (opts.requestObjectMode === import_oid4vci_common13.CreateRequestObjectMode.REQUEST_URI) {
+  if (opts.requestObjectMode === import_oid4vci_common14.CreateRequestObjectMode.REQUEST_URI) {
     throw Error(`Request Object Mode ${opts.requestObjectMode} is not supported yet`);
-  } else if (opts.requestObjectMode === import_oid4vci_common13.CreateRequestObjectMode.REQUEST_OBJECT) {
+  } else if (opts.requestObjectMode === import_oid4vci_common14.CreateRequestObjectMode.REQUEST_OBJECT) {
     if (typeof opts.signCallbacks?.signCallback !== "function") {
       throw Error(`No request object sign callback found, whilst request object mode was set to ${opts.requestObjectMode}`);
     } else if (!opts.kid) {
@@ -1449,7 +1629,7 @@ async function createSignedAuthRequestWhenNeeded(requestObject, opts) {
     const pop = await ProofOfPossessionBuilder.fromJwt({
       jwt,
       callbacks: opts.signCallbacks,
-      version: import_oid4vci_common13.OpenId4VCIVersion.VER_1_0_11,
+      version: import_oid4vci_common14.OpenId4VCIVersion.VER_1_0_11,
       mode: "JWT"
     }).build();
     requestObject["request"] = pop.jwt;
@@ -1487,12 +1667,12 @@ var createAuthorizationRequestUrl = /* @__PURE__ */ __name(async ({ pkce, endpoi
   }
   __name(removeDisplayAndValueTypes, "removeDisplayAndValueTypes");
   const { redirectUri, requestObjectOpts = {
-    requestObjectMode: import_oid4vci_common13.CreateRequestObjectMode.NONE
+    requestObjectMode: import_oid4vci_common14.CreateRequestObjectMode.NONE
   } } = authorizationRequest;
   const client_id = clientId ?? authorizationRequest.clientId;
   const authorizationMetadata = endpointMetadata.authorizationServerMetadata ?? endpointMetadata.credentialIssuerMetadata;
   let { authorizationDetails } = authorizationRequest;
-  const parMode = authorizationMetadata?.require_pushed_authorization_requests ? import_oid4vci_common13.PARMode.REQUIRE : authorizationRequest.parMode ?? (client_id ? import_oid4vci_common13.PARMode.AUTO : import_oid4vci_common13.PARMode.NEVER);
+  const parMode = authorizationMetadata?.require_pushed_authorization_requests ? import_oid4vci_common14.PARMode.REQUIRE : authorizationRequest.parMode ?? (client_id ? import_oid4vci_common14.PARMode.AUTO : import_oid4vci_common14.PARMode.NEVER);
   if (!authorizationRequest.scope && !authorizationDetails) {
     if (!credentialOffer) {
       throw Error("Please provide a scope or authorization_details if no credential offer is present");
@@ -1500,8 +1680,8 @@ var createAuthorizationRequestUrl = /* @__PURE__ */ __name(async ({ pkce, endpoi
     if ("credentials" in credentialOffer.credential_offer) {
       throw new Error("CredentialOffer format is wrong.");
     }
-    const ver = version ?? (0, import_oid4vci_common13.determineSpecVersionFromOffer)(credentialOffer.credential_offer) ?? import_oid4vci_common13.OpenId4VCIVersion.VER_1_0_13;
-    const creds = ver === import_oid4vci_common13.OpenId4VCIVersion.VER_1_0_13 ? filterSupportedCredentials(credentialOffer.credential_offer, credentialConfigurationSupported) : [];
+    const ver = version ?? (0, import_oid4vci_common14.determineSpecVersionFromOffer)(credentialOffer.credential_offer) ?? import_oid4vci_common14.OpenId4VCIVersion.VER_1_0_15;
+    const creds = ver === import_oid4vci_common14.OpenId4VCIVersion.VER_1_0_15 ? filterSupportedCredentials(credentialOffer.credential_offer, credentialConfigurationSupported) : [];
     authorizationDetails = creds.flatMap((cred) => {
       const locations = [
         credentialOffer?.credential_offer.credential_issuer ?? endpointMetadata.issuer
@@ -1511,10 +1691,10 @@ var createAuthorizationRequestUrl = /* @__PURE__ */ __name(async ({ pkce, endpoi
       if (!credential_configuration_id && !cred.format) {
         throw Error("format is required in authorization details");
       }
-      const vct = cred.format === "vc+sd-jwt" ? cred.vct : void 0;
+      const vct = cred.format === "dc+sd-jwt" ? cred.vct : void 0;
       const doctype = cred.format === "mso_mdoc" ? cred.doctype : void 0;
       let credential_definition = void 0;
-      if ((0, import_oid4vci_common13.isW3cCredentialSupported)(cred)) {
+      if ((0, import_oid4vci_common14.isW3cCredentialSupported)(cred) && hasCredentialDefinition(cred)) {
         credential_definition = {
           ...cred.credential_definition,
           // type: OPTIONAL. Array as defined in Appendix A.1.1.2. This claim contains the type values the Wallet requests authorization for at the Credential Issuer. It MUST be present if the claim format is present in the root of the authorization details object. It MUST not be present otherwise.
@@ -1549,14 +1729,15 @@ var createAuthorizationRequestUrl = /* @__PURE__ */ __name(async ({ pkce, endpoi
       throw Error(`Could not create authorization details from credential offer. Please pass in explicit details`);
     }
   }
-  if (!endpointMetadata?.authorization_endpoint) {
+  const authorizationEndpoint = endpointMetadata.authorization_endpoint ?? endpointMetadata.authorizationServerMetadata?.authorization_endpoint ?? endpointMetadata.credentialIssuerMetadata?.authorization_endpoint;
+  if (!authorizationEndpoint) {
     throw Error("Server metadata does not contain authorization endpoint");
   }
   const parEndpoint = authorizationMetadata?.pushed_authorization_request_endpoint;
   let queryObj = {
-    response_type: import_oid4vci_common13.ResponseType.AUTH_CODE,
+    response_type: import_oid4vci_common14.ResponseType.AUTH_CODE,
     ...!pkce.disabled && {
-      code_challenge_method: pkce.codeChallengeMethod ?? import_oid4vci_common13.CodeChallengeMethod.S256,
+      code_challenge_method: pkce.codeChallengeMethod ?? import_oid4vci_common14.CodeChallengeMethod.S256,
       code_challenge: pkce.codeChallenge
     },
     authorization_details: JSON.stringify(handleAuthorizationDetails(endpointMetadata, authorizationDetails)),
@@ -1574,12 +1755,12 @@ var createAuthorizationRequestUrl = /* @__PURE__ */ __name(async ({ pkce, endpoi
   if (credentialOffer?.issuerState) {
     queryObj.state = credentialOffer?.issuerState;
   }
-  if (!parEndpoint && parMode === import_oid4vci_common13.PARMode.REQUIRE) {
+  if (!parEndpoint && parMode === import_oid4vci_common14.PARMode.REQUIRE) {
     throw Error(`PAR mode is set to required by Authorization Server does not support PAR!`);
-  } else if (parEndpoint && parMode !== import_oid4vci_common13.PARMode.NEVER) {
-    logger6.debug(`USING PAR with endpoint ${parEndpoint}`);
-    const parResponse = await (0, import_oid4vci_common13.formPost)(parEndpoint, (0, import_oid4vci_common13.convertJsonToURI)(queryObj, {
-      mode: import_oid4vci_common13.JsonURIMode.X_FORM_WWW_URLENCODED,
+  } else if (parEndpoint && parMode !== import_oid4vci_common14.PARMode.NEVER) {
+    logger7.debug(`USING PAR with endpoint ${parEndpoint}`);
+    const parResponse = await (0, import_oid4vci_common14.formPost)(parEndpoint, (0, import_oid4vci_common14.convertJsonToURI)(queryObj, {
+      mode: import_oid4vci_common14.JsonURIMode.X_FORM_WWW_URLENCODED,
       uriTypeProperties: [
         "client_id",
         "request_uri",
@@ -1594,12 +1775,12 @@ var createAuthorizationRequestUrl = /* @__PURE__ */ __name(async ({ pkce, endpoi
       accept: "application/json"
     });
     if (parResponse.errorBody || !parResponse.successBody) {
-      if (parMode === import_oid4vci_common13.PARMode.REQUIRE) {
+      if (parMode === import_oid4vci_common14.PARMode.REQUIRE) {
         throw Error(`PAR error: ${parResponse.origResponse.statusText}`);
       }
-      logger6.debug("Falling back to regular request URI, since PAR failed", JSON.stringify(parResponse.errorBody));
+      logger7.debug("Falling back to regular request URI, since PAR failed", JSON.stringify(parResponse.errorBody));
     } else {
-      logger6.debug(`PAR response: ${JSON.stringify(parResponse.successBody, null, 2)}`);
+      logger7.debug(`PAR response: ${JSON.stringify(parResponse.successBody, null, 2)}`);
       queryObj = {
         client_id,
         request_uri: parResponse.successBody.request_uri
@@ -1608,11 +1789,11 @@ var createAuthorizationRequestUrl = /* @__PURE__ */ __name(async ({ pkce, endpoi
   }
   await createSignedAuthRequestWhenNeeded(queryObj, {
     ...requestObjectOpts,
-    aud: endpointMetadata.authorization_server
+    aud: endpointMetadata.authorization_server ?? endpointMetadata.authorizationServerMetadata?.issuer
   });
-  logger6.debug(`Object that will become query params: ` + JSON.stringify(queryObj, null, 2));
-  const url = (0, import_oid4vci_common13.convertJsonToURI)(queryObj, {
-    baseUrl: endpointMetadata.authorization_endpoint,
+  logger7.debug(`Object that will become query params: ` + JSON.stringify(queryObj, null, 2));
+  const url = (0, import_oid4vci_common14.convertJsonToURI)(queryObj, {
+    baseUrl: authorizationEndpoint,
     uriTypeProperties: [
       "client_id",
       "request_uri",
@@ -1623,11 +1804,12 @@ var createAuthorizationRequestUrl = /* @__PURE__ */ __name(async ({ pkce, endpoi
       "state"
     ],
     // arrayTypeProperties: ['authorization_details'],
-    mode: import_oid4vci_common13.JsonURIMode.X_FORM_WWW_URLENCODED
+    mode: import_oid4vci_common14.JsonURIMode.X_FORM_WWW_URLENCODED
   });
-  logger6.debug(`Authorization Request URL: ${url}`);
+  logger7.debug(`Authorization Request URL: ${url}`);
   return url;
 }, "createAuthorizationRequestUrl");
+var hasCredentialDefinition = /* @__PURE__ */ __name((cred) => "credential_definition" in cred && cred.credential_definition && typeof cred.credential_definition === "object" && cred.credential_definition !== null && "type" in cred.credential_definition && Array.isArray(cred.credential_definition.type), "hasCredentialDefinition");
 var handleAuthorizationDetails = /* @__PURE__ */ __name((endpointMetadata, authorizationDetails) => {
   if (authorizationDetails) {
     if (typeof authorizationDetails === "string") {
@@ -1649,7 +1831,10 @@ var handleLocations = /* @__PURE__ */ __name((endpointMetadata, authorizationDet
   if (typeof authorizationDetails === "string") {
     return authorizationDetails;
   }
-  if (authorizationDetails && (endpointMetadata.credentialIssuerMetadata?.authorization_server || endpointMetadata.authorization_endpoint)) {
+  const ciMeta = endpointMetadata.credentialIssuerMetadata;
+  const hasAuthorizationServers = Array.isArray(ciMeta?.authorization_servers) && ciMeta.authorization_servers.length > 0;
+  const legacyHasAuthzEndpoint = Boolean(endpointMetadata.authorization_endpoint);
+  if (hasAuthorizationServers || legacyHasAuthzEndpoint) {
     if (authorizationDetails.locations) {
       if (Array.isArray(authorizationDetails.locations)) {
         authorizationDetails.locations.push(endpointMetadata.issuer);
@@ -1708,23 +1893,23 @@ var createAuthorizationChallengeRequest = /* @__PURE__ */ __name(async (opts) =>
   return request;
 }, "createAuthorizationChallengeRequest");
 var sendAuthorizationChallengeRequest = /* @__PURE__ */ __name(async (authorizationChallengeCodeUrl, authorizationChallengeRequest, opts) => {
-  return await (0, import_oid4vci_common13.formPost)(authorizationChallengeCodeUrl, (0, import_oid4vci_common13.convertJsonToURI)(authorizationChallengeRequest, {
-    mode: import_oid4vci_common13.JsonURIMode.X_FORM_WWW_URLENCODED
+  return await (0, import_oid4vci_common14.formPost)(authorizationChallengeCodeUrl, (0, import_oid4vci_common14.convertJsonToURI)(authorizationChallengeRequest, {
+    mode: import_oid4vci_common14.JsonURIMode.X_FORM_WWW_URLENCODED
   }), {
     customHeaders: opts?.headers ? opts.headers : void 0
   });
 }, "sendAuthorizationChallengeRequest");
 
 // lib/AuthorizationCodeClientV1_0_11.ts
-var import_oid4vci_common14 = require("@sphereon/oid4vci-common");
-var import_ssi_types9 = require("@sphereon/ssi-types");
-var logger7 = import_ssi_types9.Loggers.DEFAULT.get("sphereon:oid4vci");
+var import_oid4vci_common15 = require("@sphereon/oid4vci-common");
+var import_ssi_types10 = require("@sphereon/ssi-types");
+var logger8 = import_ssi_types10.Loggers.DEFAULT.get("sphereon:oid4vci");
 var createAuthorizationRequestUrlV1_0_11 = /* @__PURE__ */ __name(async ({ pkce, endpointMetadata, authorizationRequest, credentialOffer, credentialsSupported }) => {
   const { redirectUri, clientId, requestObjectOpts = {
-    requestObjectMode: import_oid4vci_common14.CreateRequestObjectMode.NONE
+    requestObjectMode: import_oid4vci_common15.CreateRequestObjectMode.NONE
   } } = authorizationRequest;
   let { scope, authorizationDetails } = authorizationRequest;
-  const parMode = endpointMetadata?.credentialIssuerMetadata?.require_pushed_authorization_requests ? import_oid4vci_common14.PARMode.REQUIRE : authorizationRequest.parMode ?? import_oid4vci_common14.PARMode.AUTO;
+  const parMode = endpointMetadata?.credentialIssuerMetadata?.require_pushed_authorization_requests ? import_oid4vci_common15.PARMode.REQUIRE : authorizationRequest.parMode ?? import_oid4vci_common15.PARMode.AUTO;
   if (!scope && !authorizationDetails) {
     if (!credentialOffer) {
       throw Error("Please provide a scope or authorization_details if no credential offer is present");
@@ -1757,9 +1942,9 @@ var createAuthorizationRequestUrlV1_0_11 = /* @__PURE__ */ __name(async ({ pkce,
     ].filter((s) => !!s).join(" ");
   }
   let queryObj = {
-    response_type: import_oid4vci_common14.ResponseType.AUTH_CODE,
+    response_type: import_oid4vci_common15.ResponseType.AUTH_CODE,
     ...!pkce.disabled && {
-      code_challenge_method: pkce.codeChallengeMethod ?? import_oid4vci_common14.CodeChallengeMethod.S256,
+      code_challenge_method: pkce.codeChallengeMethod ?? import_oid4vci_common15.CodeChallengeMethod.S256,
       code_challenge: pkce.codeChallenge
     },
     authorization_details: JSON.stringify(handleAuthorizationDetailsV1_0_11(endpointMetadata, authorizationDetails)),
@@ -1774,12 +1959,12 @@ var createAuthorizationRequestUrlV1_0_11 = /* @__PURE__ */ __name(async ({ pkce,
     },
     scope
   };
-  if (!parEndpoint && parMode === import_oid4vci_common14.PARMode.REQUIRE) {
+  if (!parEndpoint && parMode === import_oid4vci_common15.PARMode.REQUIRE) {
     throw Error(`PAR mode is set to required by Authorization Server does not support PAR!`);
-  } else if (parEndpoint && parMode !== import_oid4vci_common14.PARMode.NEVER) {
-    logger7.debug(`USING PAR with endpoint ${parEndpoint}`);
-    const parResponse = await (0, import_oid4vci_common14.formPost)(parEndpoint, (0, import_oid4vci_common14.convertJsonToURI)(queryObj, {
-      mode: import_oid4vci_common14.JsonURIMode.X_FORM_WWW_URLENCODED,
+  } else if (parEndpoint && parMode !== import_oid4vci_common15.PARMode.NEVER) {
+    logger8.debug(`USING PAR with endpoint ${parEndpoint}`);
+    const parResponse = await (0, import_oid4vci_common15.formPost)(parEndpoint, (0, import_oid4vci_common15.convertJsonToURI)(queryObj, {
+      mode: import_oid4vci_common15.JsonURIMode.X_FORM_WWW_URLENCODED,
       uriTypeProperties: [
         "client_id",
         "request_uri",
@@ -1795,11 +1980,11 @@ var createAuthorizationRequestUrlV1_0_11 = /* @__PURE__ */ __name(async ({ pkce,
     if (parResponse.errorBody || !parResponse.successBody) {
       console.log(JSON.stringify(parResponse.errorBody));
       console.log("Falling back to regular request URI, since PAR failed");
-      if (parMode === import_oid4vci_common14.PARMode.REQUIRE) {
+      if (parMode === import_oid4vci_common15.PARMode.REQUIRE) {
         throw Error(`PAR error: ${parResponse.origResponse.statusText}`);
       }
     } else {
-      logger7.debug(`PAR response: ${JSON.stringify(parResponse.successBody, null, 2)}`);
+      logger8.debug(`PAR response: ${JSON.stringify(parResponse.successBody, null, 2)}`);
       queryObj = {
         request_uri: parResponse.successBody.request_uri
       };
@@ -1809,8 +1994,8 @@ var createAuthorizationRequestUrlV1_0_11 = /* @__PURE__ */ __name(async ({ pkce,
     ...requestObjectOpts,
     aud: endpointMetadata.authorization_server
   });
-  logger7.debug(`Object that will become query params: ` + JSON.stringify(queryObj, null, 2));
-  const url = (0, import_oid4vci_common14.convertJsonToURI)(queryObj, {
+  logger8.debug(`Object that will become query params: ` + JSON.stringify(queryObj, null, 2));
+  const url = (0, import_oid4vci_common15.convertJsonToURI)(queryObj, {
     baseUrl: endpointMetadata.authorization_endpoint,
     uriTypeProperties: [
       "client_id",
@@ -1821,9 +2006,9 @@ var createAuthorizationRequestUrlV1_0_11 = /* @__PURE__ */ __name(async ({ pkce,
       "issuer_state"
     ],
     // arrayTypeProperties: ['authorization_details'],
-    mode: import_oid4vci_common14.JsonURIMode.X_FORM_WWW_URLENCODED
+    mode: import_oid4vci_common15.JsonURIMode.X_FORM_WWW_URLENCODED
   });
-  logger7.debug(`Authorization Request URL: ${url}`);
+  logger8.debug(`Authorization Request URL: ${url}`);
   return url;
 }, "createAuthorizationRequestUrlV1_0_11");
 var handleAuthorizationDetailsV1_0_11 = /* @__PURE__ */ __name((endpointMetadata, authorizationDetails) => {
@@ -1868,9 +2053,9 @@ var handleLocations2 = /* @__PURE__ */ __name((endpointMetadata, authorizationDe
 
 // lib/CredentialRequestClient.ts
 var import_oid4vc_common5 = require("@sphereon/oid4vc-common");
-var import_oid4vci_common15 = require("@sphereon/oid4vci-common");
-var import_ssi_types10 = require("@sphereon/ssi-types");
-var logger8 = import_ssi_types10.Loggers.DEFAULT.get("sphereon:oid4vci:credential");
+var import_oid4vci_common16 = require("@sphereon/oid4vci-common");
+var import_ssi_types11 = require("@sphereon/ssi-types");
+var logger9 = import_ssi_types11.Loggers.DEFAULT.get("sphereon:oid4vci:credential");
 async function buildProof(proofInput, opts) {
   if ("proof_type" in proofInput) {
     if (opts.cNonce) {
@@ -1884,6 +2069,27 @@ async function buildProof(proofInput, opts) {
   return await proofInput.build();
 }
 __name(buildProof, "buildProof");
+function isOpenIdCredentialDetail(ad) {
+  return typeof ad === "object" && ad !== null && ad.type === "openid_credential";
+}
+__name(isOpenIdCredentialDetail, "isOpenIdCredentialDetail");
+function findAuthorizationDetail(authorizationDetails, preferredConfigId) {
+  if (!authorizationDetails) {
+    return void 0;
+  }
+  const openIdCredentialDetails = authorizationDetails.filter(isOpenIdCredentialDetail);
+  if (openIdCredentialDetails.length === 0) {
+    return void 0;
+  }
+  if (preferredConfigId) {
+    const match = openIdCredentialDetails.find((detail) => typeof detail === "object" && detail !== null && detail.credential_configuration_id === preferredConfigId);
+    if (match) {
+      return match;
+    }
+  }
+  return openIdCredentialDetails[0];
+}
+__name(findAuthorizationDetail, "findAuthorizationDetail");
 var CredentialRequestClient = class {
   static {
     __name(this, "CredentialRequestClient");
@@ -1923,7 +2129,10 @@ var CredentialRequestClient = class {
       credentialIdentifier,
       subjectIssuance
     });
-    return await this.acquireCredentialsUsingRequestWithoutProof(request, opts.createDPoPOpts);
+    if (!import_oid4vci_common16.supportedOID4VCICredentialFormat.includes(format)) {
+      return Promise.reject(Error(`Unsupported credential format: ${format}`));
+    }
+    return await this.acquireCredentialsUsingRequestWithoutProof(request, format, opts.createDPoPOpts);
   }
   async acquireCredentialsUsingProof(opts) {
     const { credentialIdentifier, credentialTypes, proofInput, format, context, subjectIssuance } = opts;
@@ -1936,32 +2145,35 @@ var CredentialRequestClient = class {
       credentialIdentifier,
       subjectIssuance
     });
-    return await this.acquireCredentialsUsingRequest(request, opts.createDPoPOpts);
+    if (this.version() <= import_oid4vci_common16.OpenId4VCIVersion.VER_1_0_13 && !import_oid4vci_common16.supportedOID4VCICredentialFormat.includes(format)) {
+      return Promise.reject(Error(`Unsupported credential format: ${format}`));
+    }
+    return await this.acquireCredentialsUsingRequest(request, format, opts.createDPoPOpts);
   }
-  async acquireCredentialsUsingRequestWithoutProof(uniformRequest, createDPoPOpts) {
-    return await this.acquireCredentialsUsingRequestImpl(uniformRequest, createDPoPOpts);
+  async acquireCredentialsUsingRequestWithoutProof(uniformRequest, format, createDPoPOpts) {
+    return await this.acquireCredentialsUsingRequestImpl(uniformRequest, format, createDPoPOpts);
   }
-  async acquireCredentialsUsingRequest(uniformRequest, createDPoPOpts) {
-    return await this.acquireCredentialsUsingRequestImpl(uniformRequest, createDPoPOpts);
+  async acquireCredentialsUsingRequest(uniformRequest, format, createDPoPOpts) {
+    return await this.acquireCredentialsUsingRequestImpl(uniformRequest, format, createDPoPOpts);
   }
-  async acquireCredentialsUsingRequestImpl(uniformRequest, createDPoPOpts) {
-    if (this.version() < import_oid4vci_common15.OpenId4VCIVersion.VER_1_0_13) {
+  async acquireCredentialsUsingRequestImpl(uniformRequest, format, createDPoPOpts) {
+    if (this.version() < import_oid4vci_common16.OpenId4VCIVersion.VER_1_0_13) {
       throw new Error("Versions below v1.0.13 (draft 13) are not supported by the V13 credential request client.");
     }
-    const request = (0, import_oid4vci_common15.getCredentialRequestForVersion)(uniformRequest, this.version());
+    const request = (0, import_oid4vci_common16.getCredentialRequestForVersion)(uniformRequest, format, this.version());
     const credentialEndpoint = this.credentialRequestOpts.credentialEndpoint;
-    if (!(0, import_oid4vci_common15.isValidURL)(credentialEndpoint)) {
-      logger8.debug(`Invalid credential endpoint: ${credentialEndpoint}`);
-      throw new Error(import_oid4vci_common15.URL_NOT_VALID);
+    if (!(0, import_oid4vci_common16.isValidURL)(credentialEndpoint)) {
+      logger9.debug(`Invalid credential endpoint: ${credentialEndpoint}`);
+      throw new Error(import_oid4vci_common16.URL_NOT_VALID);
     }
-    logger8.debug(`Acquiring credential(s) from: ${credentialEndpoint}`);
-    logger8.debug(`request
+    logger9.debug(`Acquiring credential(s) from: ${credentialEndpoint}`);
+    logger9.debug(`request
 : ${JSON.stringify(request, null, 2)}`);
     const requestToken = this.credentialRequestOpts.token;
     let dPoP = createDPoPOpts ? await (0, import_oid4vc_common5.createDPoP)((0, import_oid4vc_common5.getCreateDPoPOptions)(createDPoPOpts, credentialEndpoint, {
       accessToken: requestToken
     })) : void 0;
-    let response = await (0, import_oid4vci_common15.post)(credentialEndpoint, JSON.stringify(request), {
+    let response = await (0, import_oid4vci_common16.post)(credentialEndpoint, JSON.stringify(request), {
       bearerToken: requestToken,
       ...dPoP && {
         customHeaders: {
@@ -1976,7 +2188,7 @@ var CredentialRequestClient = class {
       dPoP = await (0, import_oid4vc_common5.createDPoP)((0, import_oid4vc_common5.getCreateDPoPOptions)(createDPoPOpts, credentialEndpoint, {
         accessToken: requestToken
       }));
-      response = await (0, import_oid4vci_common15.post)(credentialEndpoint, JSON.stringify(request), {
+      response = await (0, import_oid4vci_common16.post)(credentialEndpoint, JSON.stringify(request), {
         bearerToken: requestToken,
         ...createDPoPOpts && {
           customHeaders: {
@@ -1987,7 +2199,7 @@ var CredentialRequestClient = class {
       const successDPoPNonce = response.origResponse.headers.get("DPoP-Nonce");
       nextDPoPNonce = successDPoPNonce ?? retryWithNonce.dpopNonce;
     }
-    this._isDeferred = (0, import_oid4vci_common15.isDeferredCredentialResponse)(response);
+    this._isDeferred = (0, import_oid4vci_common16.isDeferredCredentialResponse)(response);
     if (this.isDeferred() && this.credentialRequestOpts.deferredCredentialAwait && response.successBody) {
       response = await this.acquireDeferredCredential(response.successBody, {
         bearerToken: this.credentialRequestOpts.token
@@ -1999,7 +2211,7 @@ var CredentialRequestClient = class {
         throw Error("Subject signing was requested, but issuer did not provide the options in its response");
       }
     }
-    logger8.debug(`Credential endpoint ${credentialEndpoint} response:\r
+    logger9.debug(`Credential endpoint ${credentialEndpoint} response:\r
 ${JSON.stringify(response, null, 2)}`);
     return {
       ...response,
@@ -2021,7 +2233,7 @@ ${JSON.stringify(response, null, 2)}`);
     } else if (!bearerToken) {
       throw Error(`No bearer token present and refresh for defered endpoint not supported yet`);
     }
-    return await (0, import_oid4vci_common15.acquireDeferredCredential)({
+    return await (0, import_oid4vci_common16.acquireDeferredCredential)({
       bearerToken,
       transactionId,
       deferredCredentialEndpoint,
@@ -2036,27 +2248,64 @@ ${JSON.stringify(response, null, 2)}`);
     return await this.createCredentialRequestImpl(opts);
   }
   async createCredentialRequestImpl(opts) {
-    const { proofInput, credentialIdentifier: credential_identifier } = opts;
+    const { proofInput, credentialIdentifier, credentialConfigurationId } = opts;
     let proof = void 0;
     if (proofInput) {
       proof = await buildProof(proofInput, opts);
     }
-    if (credential_identifier) {
-      if (opts.format || opts.credentialTypes || opts.context) {
-        throw Error(`You cannot mix credential_identifier with format, credential types and/or context`);
-      }
-      return {
-        credential_identifier,
+    if (this.version() >= import_oid4vci_common16.OpenId4VCIVersion.VER_1_0_15) {
+      const authDetail = findAuthorizationDetail(this.credentialRequestOpts.authorizationDetails, credentialConfigurationId ?? credentialIdentifier);
+      const issuer_state2 = this.credentialRequestOpts.issuerState;
+      const commonBody = {
+        ...issuer_state2 && {
+          issuer_state: issuer_state2
+        },
         ...proof && {
           proof
-        }
+        },
+        ...opts.subjectIssuance
+      };
+      const authDetailObj = authDetail && typeof authDetail === "object" ? authDetail : null;
+      if (authDetailObj?.credential_identifier) {
+        return {
+          credential_identifier: authDetailObj.credential_identifier,
+          ...commonBody
+        };
+      }
+      if (authDetailObj?.credential_identifiers && authDetailObj.credential_identifiers.length > 0) {
+        return {
+          credential_identifier: authDetailObj.credential_identifiers[0],
+          ...commonBody
+        };
+      }
+      const configId = credentialConfigurationId ?? authDetailObj?.credential_configuration_id ?? this._credentialRequestOpts.credentialConfigurationId;
+      if (configId) {
+        return {
+          credential_configuration_id: configId,
+          ...commonBody
+        };
+      }
+      if (credentialIdentifier) {
+        return {
+          credential_identifier: credentialIdentifier,
+          ...commonBody
+        };
+      }
+      return Promise.reject(Error("No credential_identifier or credential_configuration_id available for v1.0-15 request"));
+    }
+    if (credentialIdentifier) {
+      const proof_obj = proof ? {
+        proof
+      } : {};
+      return {
+        credential_identifier: credentialIdentifier,
+        ...proof_obj
       };
     }
     const formatSelection = opts.format ?? this.credentialRequestOpts.format;
     if (!formatSelection) {
       throw Error(`Format of credential to be issued is missing`);
     }
-    const format = (0, import_oid4vci_common15.getUniformFormat)(formatSelection);
     const typesSelection = opts?.credentialTypes && (typeof opts.credentialTypes === "string" || opts.credentialTypes.length > 0) ? opts.credentialTypes : this.credentialRequestOpts.credentialTypes;
     if (!typesSelection) {
       throw Error(`Credential type(s) need to be provided`);
@@ -2068,12 +2317,15 @@ ${JSON.stringify(response, null, 2)}`);
       throw Error(`Credential type(s) need to be provided`);
     }
     const issuer_state = this.credentialRequestOpts.issuerState;
-    if (format === "jwt_vc_json" || format === "jwt_vc") {
+    if (formatSelection === "jwt_vc_json" || formatSelection === "ldp_vc") {
       return {
+        format: formatSelection,
         credential_definition: {
-          type: types
+          type: types,
+          ...opts.context && {
+            "@context": opts.context
+          }
         },
-        format,
         ...issuer_state && {
           issuer_state
         },
@@ -2082,64 +2334,16 @@ ${JSON.stringify(response, null, 2)}`);
         },
         ...opts.subjectIssuance
       };
-    } else if (format === "jwt_vc_json-ld" || format === "ldp_vc") {
-      if (this.version() >= import_oid4vci_common15.OpenId4VCIVersion.VER_1_0_12 && !opts.context) {
-        throw Error("No @context value present, but it is required");
-      }
-      return {
-        format,
-        ...issuer_state && {
-          issuer_state
-        },
-        ...proof && {
-          proof
-        },
-        ...opts.subjectIssuance,
-        credential_definition: {
-          type: types,
-          "@context": opts.context
-        }
-      };
-    } else if (format === "vc+sd-jwt") {
-      if (types.length > 1) {
-        throw Error(`Only a single credential type is supported for ${format}`);
-      }
-      return {
-        format,
-        ...issuer_state && {
-          issuer_state
-        },
-        ...proof && {
-          proof
-        },
-        vct: types[0],
-        ...opts.subjectIssuance
-      };
-    } else if (format === "mso_mdoc") {
-      if (types.length > 1) {
-        throw Error(`Only a single credential type is supported for ${format}`);
-      }
-      return {
-        format,
-        ...issuer_state && {
-          issuer_state
-        },
-        ...proof && {
-          proof
-        },
-        doctype: types[0],
-        ...opts.subjectIssuance
-      };
     }
-    throw new Error(`Unsupported credential format: ${format}`);
+    return Promise.reject(Error(`Format ${formatSelection} is not supported in this protocol version`));
   }
   version() {
-    return this.credentialRequestOpts?.version ?? import_oid4vci_common15.OpenId4VCIVersion.VER_1_0_13;
+    return this.credentialRequestOpts?.version ?? import_oid4vci_common16.OpenId4VCIVersion.VER_1_0_13;
   }
 };
 
 // lib/CredentialOfferClient.ts
-var import_oid4vci_common16 = require("@sphereon/oid4vci-common");
+var import_oid4vci_common17 = require("@sphereon/oid4vci-common");
 var CredentialOfferClient = class {
   static {
     __name(this, "CredentialOfferClient");
@@ -2152,12 +2356,12 @@ var CredentialOfferClient = class {
     }
     const scheme = uri.split("://")[0];
     const baseUrl = uri.split("?")[0];
-    const version = (0, import_oid4vci_common16.determineSpecVersionFromURI)(uri);
+    const version = (0, import_oid4vci_common17.determineSpecVersionFromURI)(uri);
     LOG.log(`Offer URL determined to be of version ${version}`);
     let credentialOffer;
     let credentialOfferPayload;
-    if (version < import_oid4vci_common16.OpenId4VCIVersion.VER_1_0_11) {
-      credentialOfferPayload = (0, import_oid4vci_common16.convertURIToJsonObject)(uri, {
+    if (version < import_oid4vci_common17.OpenId4VCIVersion.VER_1_0_11) {
+      credentialOfferPayload = (0, import_oid4vci_common17.convertURIToJsonObject)(uri, {
         arrayTypeProperties: [
           "credential_type"
         ],
@@ -2175,7 +2379,7 @@ var CredentialOfferClient = class {
       if (uri.includes("credential_offer_uri")) {
         credentialOffer = await handleCredentialOfferUri(uri);
       } else {
-        credentialOffer = (0, import_oid4vci_common16.convertURIToJsonObject)(uri, {
+        credentialOffer = (0, import_oid4vci_common17.convertURIToJsonObject)(uri, {
           // It must have the '=' sign after credential_offer otherwise the uri will get split at openid_credential_offer
           arrayTypeProperties: uri.includes("credential_offer_uri=") ? [
             "credential_offer_uri="
@@ -2193,13 +2397,13 @@ var CredentialOfferClient = class {
         throw Error("Either a credential_offer or credential_offer_uri should be present in " + uri);
       }
     }
-    const request = await (0, import_oid4vci_common16.toUniformCredentialOfferRequest)(credentialOffer, {
+    const request = await (0, import_oid4vci_common17.toUniformCredentialOfferRequest)(credentialOffer, {
       ...opts,
       version
     });
     return {
       ...constructBaseResponse(request, scheme, baseUrl),
-      userPinRequired: request.credential_offer?.grants?.[import_oid4vci_common16.PRE_AUTH_GRANT_LITERAL]?.user_pin_required ?? !!request.credential_offer?.grants?.[import_oid4vci_common16.PRE_AUTH_GRANT_LITERAL]?.tx_code ?? false
+      userPinRequired: request.credential_offer?.grants?.[import_oid4vci_common17.PRE_AUTH_GRANT_LITERAL]?.user_pin_required ?? !!request.credential_offer?.grants?.[import_oid4vci_common17.PRE_AUTH_GRANT_LITERAL]?.tx_code ?? false
     };
   }
   static toURI(requestWithBaseUrl, opts) {
@@ -2208,7 +2412,7 @@ var CredentialOfferClient = class {
     let baseUrl = requestWithBaseUrl.baseUrl.includes(requestWithBaseUrl.scheme) ? requestWithBaseUrl.baseUrl : `${requestWithBaseUrl.scheme.replace("://", "")}://${requestWithBaseUrl.baseUrl}`;
     let param;
     const isUri = requestWithBaseUrl.credential_offer_uri !== void 0;
-    if (version.valueOf() >= import_oid4vci_common16.OpenId4VCIVersion.VER_1_0_11.valueOf()) {
+    if (version.valueOf() >= import_oid4vci_common17.OpenId4VCIVersion.VER_1_0_11.valueOf()) {
       if (!baseUrl.includes("?")) {
         param = isUri ? "credential_offer_uri" : "credential_offer";
       } else {
@@ -2223,14 +2427,14 @@ var CredentialOfferClient = class {
         }
       }
     }
-    return (0, import_oid4vci_common16.convertJsonToURI)(requestWithBaseUrl.credential_offer_uri ?? requestWithBaseUrl.original_credential_offer, {
+    return (0, import_oid4vci_common17.convertJsonToURI)(requestWithBaseUrl.credential_offer_uri ?? requestWithBaseUrl.original_credential_offer, {
       baseUrl,
       arrayTypeProperties: isUri ? [] : [
         "credential_type"
       ],
       uriTypeProperties: isUri ? [
         "credential_offer_uri"
-      ] : version >= import_oid4vci_common16.OpenId4VCIVersion.VER_1_0_13 ? [
+      ] : version >= import_oid4vci_common17.OpenId4VCIVersion.VER_1_0_13 ? [
         "credential_issuer",
         "credential_type"
       ] : [
@@ -2244,26 +2448,26 @@ var CredentialOfferClient = class {
 };
 
 // lib/CredentialOfferClientV1_0_11.ts
-var import_oid4vci_common17 = require("@sphereon/oid4vci-common");
-var import_ssi_types11 = require("@sphereon/ssi-types");
-var logger9 = import_ssi_types11.Loggers.DEFAULT.get("sphereon:oid4vci:offer");
+var import_oid4vci_common18 = require("@sphereon/oid4vci-common");
+var import_ssi_types12 = require("@sphereon/ssi-types");
+var logger10 = import_ssi_types12.Loggers.DEFAULT.get("sphereon:oid4vci:offer");
 var CredentialOfferClientV1_0_11 = class {
   static {
     __name(this, "CredentialOfferClientV1_0_11");
   }
   static async fromURI(uri, opts) {
-    logger9.debug(`Credential Offer URI: ${uri}`);
+    logger10.debug(`Credential Offer URI: ${uri}`);
     if (!uri.includes("?") || !uri.includes("://")) {
-      logger9.debug(`Invalid Credential Offer URI: ${uri}`);
+      logger10.debug(`Invalid Credential Offer URI: ${uri}`);
       throw Error(`Invalid Credential Offer Request`);
     }
     const scheme = uri.split("://")[0];
     const baseUrl = uri.split("?")[0];
-    const version = (0, import_oid4vci_common17.determineSpecVersionFromURI)(uri);
+    const version = (0, import_oid4vci_common18.determineSpecVersionFromURI)(uri);
     let credentialOffer;
     let credentialOfferPayload;
-    if (version < import_oid4vci_common17.OpenId4VCIVersion.VER_1_0_11) {
-      credentialOfferPayload = (0, import_oid4vci_common17.convertURIToJsonObject)(uri, {
+    if (version < import_oid4vci_common18.OpenId4VCIVersion.VER_1_0_11) {
+      credentialOfferPayload = (0, import_oid4vci_common18.convertURIToJsonObject)(uri, {
         arrayTypeProperties: [
           "credential_type"
         ],
@@ -2278,7 +2482,7 @@ var CredentialOfferClientV1_0_11 = class {
         credential_offer: credentialOfferPayload
       };
     } else {
-      credentialOffer = (0, import_oid4vci_common17.convertURIToJsonObject)(uri, {
+      credentialOffer = (0, import_oid4vci_common18.convertURIToJsonObject)(uri, {
         arrayTypeProperties: [
           "credentials"
         ],
@@ -2292,11 +2496,11 @@ var CredentialOfferClientV1_0_11 = class {
         throw Error("Either a credential_offer or credential_offer_uri should be present in " + uri);
       }
     }
-    const request = await (0, import_oid4vci_common17.toUniformCredentialOfferRequest)(credentialOffer, {
+    const request = await (0, import_oid4vci_common18.toUniformCredentialOfferRequest)(credentialOffer, {
       ...opts,
       version
     });
-    const clientId = (0, import_oid4vci_common17.getClientIdFromCredentialOfferPayload)(request.credential_offer);
+    const clientId = (0, import_oid4vci_common18.getClientIdFromCredentialOfferPayload)(request.credential_offer);
     const grants = request.credential_offer?.grants;
     return {
       scheme,
@@ -2308,19 +2512,19 @@ var CredentialOfferClientV1_0_11 = class {
       ...grants?.authorization_code?.issuer_state && {
         issuerState: grants.authorization_code.issuer_state
       },
-      ...grants?.[import_oid4vci_common17.PRE_AUTH_GRANT_LITERAL]?.[import_oid4vci_common17.PRE_AUTH_CODE_LITERAL] && {
-        preAuthorizedCode: grants[import_oid4vci_common17.PRE_AUTH_GRANT_LITERAL][import_oid4vci_common17.PRE_AUTH_CODE_LITERAL]
+      ...grants?.[import_oid4vci_common18.PRE_AUTH_GRANT_LITERAL]?.[import_oid4vci_common18.PRE_AUTH_CODE_LITERAL] && {
+        preAuthorizedCode: grants[import_oid4vci_common18.PRE_AUTH_GRANT_LITERAL][import_oid4vci_common18.PRE_AUTH_CODE_LITERAL]
       },
-      userPinRequired: !!(request.credential_offer?.grants?.[import_oid4vci_common17.PRE_AUTH_GRANT_LITERAL]?.user_pin_required ?? false)
+      userPinRequired: !!(request.credential_offer?.grants?.[import_oid4vci_common18.PRE_AUTH_GRANT_LITERAL]?.user_pin_required ?? false)
     };
   }
   static toURI(requestWithBaseUrl, opts) {
-    logger9.debug(`Credential Offer Request with base URL: ${JSON.stringify(requestWithBaseUrl)}`);
+    logger10.debug(`Credential Offer Request with base URL: ${JSON.stringify(requestWithBaseUrl)}`);
     const version = opts?.version ?? requestWithBaseUrl.version;
     let baseUrl = requestWithBaseUrl.baseUrl.includes(requestWithBaseUrl.scheme) ? requestWithBaseUrl.baseUrl : `${requestWithBaseUrl.scheme.replace("://", "")}://${requestWithBaseUrl.baseUrl}`;
     let param;
     const isUri = requestWithBaseUrl.credential_offer_uri !== void 0;
-    if (version.valueOf() >= import_oid4vci_common17.OpenId4VCIVersion.VER_1_0_11.valueOf()) {
+    if (version.valueOf() >= import_oid4vci_common18.OpenId4VCIVersion.VER_1_0_11.valueOf()) {
       if (!baseUrl.includes("?")) {
         param = isUri ? "credential_offer_uri" : "credential_offer";
       } else {
@@ -2335,14 +2539,14 @@ var CredentialOfferClientV1_0_11 = class {
         }
       }
     }
-    return (0, import_oid4vci_common17.convertJsonToURI)(requestWithBaseUrl.credential_offer_uri ?? requestWithBaseUrl.original_credential_offer, {
+    return (0, import_oid4vci_common18.convertJsonToURI)(requestWithBaseUrl.credential_offer_uri ?? requestWithBaseUrl.original_credential_offer, {
       baseUrl,
       arrayTypeProperties: isUri ? [] : [
         "credential_type"
       ],
       uriTypeProperties: isUri ? [
         "credential_offer_uri"
-      ] : version >= import_oid4vci_common17.OpenId4VCIVersion.VER_1_0_11 ? [
+      ] : version >= import_oid4vci_common18.OpenId4VCIVersion.VER_1_0_11 ? [
         "credential_issuer",
         "credential_type"
       ] : [
@@ -2356,27 +2560,27 @@ var CredentialOfferClientV1_0_11 = class {
 };
 
 // lib/CredentialOfferClientV1_0_13.ts
-var import_oid4vci_common18 = require("@sphereon/oid4vci-common");
-var import_ssi_types12 = require("@sphereon/ssi-types");
-var logger10 = import_ssi_types12.Loggers.DEFAULT.get("sphereon:oid4vci:offer");
+var import_oid4vci_common19 = require("@sphereon/oid4vci-common");
+var import_ssi_types13 = require("@sphereon/ssi-types");
+var logger11 = import_ssi_types13.Loggers.DEFAULT.get("sphereon:oid4vci:offer");
 var CredentialOfferClientV1_0_13 = class {
   static {
     __name(this, "CredentialOfferClientV1_0_13");
   }
   static async fromURI(uri, opts) {
-    logger10.debug(`Credential Offer URI: ${uri}`);
+    logger11.debug(`Credential Offer URI: ${uri}`);
     if (!uri.includes("?") || !uri.includes("://")) {
-      logger10.debug(`Invalid Credential Offer URI: ${uri}`);
+      logger11.debug(`Invalid Credential Offer URI: ${uri}`);
       throw Error(`Invalid Credential Offer Request`);
     }
     const scheme = uri.split("://")[0];
     const baseUrl = uri.split("?")[0];
-    const version = (0, import_oid4vci_common18.determineSpecVersionFromURI)(uri);
+    const version = (0, import_oid4vci_common19.determineSpecVersionFromURI)(uri);
     let credentialOffer;
     if (uri.includes("credential_offer_uri")) {
       credentialOffer = await handleCredentialOfferUri(uri);
     } else {
-      credentialOffer = (0, import_oid4vci_common18.convertURIToJsonObject)(uri, {
+      credentialOffer = (0, import_oid4vci_common19.convertURIToJsonObject)(uri, {
         // It must have the '=' sign after credential_offer otherwise the uri will get split at openid_credential_offer
         arrayTypeProperties: uri.includes("credential_offer_uri=") ? [
           "credential_configuration_ids",
@@ -2395,22 +2599,22 @@ var CredentialOfferClientV1_0_13 = class {
     if (credentialOffer?.credential_offer_uri === void 0 && !credentialOffer?.credential_offer) {
       throw Error("Either a credential_offer or credential_offer_uri should be present in " + uri);
     }
-    const request = await (0, import_oid4vci_common18.toUniformCredentialOfferRequest)(credentialOffer, {
+    const request = await (0, import_oid4vci_common19.toUniformCredentialOfferRequest)(credentialOffer, {
       ...opts,
       version
     });
     return {
       ...constructBaseResponse(request, scheme, baseUrl),
-      userPinRequired: !!(request.credential_offer?.grants?.[import_oid4vci_common18.PRE_AUTH_GRANT_LITERAL]?.tx_code ?? false)
+      userPinRequired: !!(request.credential_offer?.grants?.[import_oid4vci_common19.PRE_AUTH_GRANT_LITERAL]?.tx_code ?? false)
     };
   }
   static toURI(requestWithBaseUrl, opts) {
-    logger10.debug(`Credential Offer Request with base URL: ${JSON.stringify(requestWithBaseUrl)}`);
+    logger11.debug(`Credential Offer Request with base URL: ${JSON.stringify(requestWithBaseUrl)}`);
     const version = opts?.version ?? requestWithBaseUrl.version;
     let baseUrl = requestWithBaseUrl.baseUrl.includes(requestWithBaseUrl.scheme) ? requestWithBaseUrl.baseUrl : `${requestWithBaseUrl.scheme.replace("://", "")}://${requestWithBaseUrl.baseUrl}`;
     let param;
     const isUri = requestWithBaseUrl.credential_offer_uri !== void 0;
-    if (version.valueOf() >= import_oid4vci_common18.OpenId4VCIVersion.VER_1_0_11.valueOf()) {
+    if (version.valueOf() >= import_oid4vci_common19.OpenId4VCIVersion.VER_1_0_11.valueOf()) {
       if (!baseUrl.includes("?")) {
         param = isUri ? "credential_offer_uri" : "credential_offer";
       } else {
@@ -2425,14 +2629,14 @@ var CredentialOfferClientV1_0_13 = class {
         }
       }
     }
-    return (0, import_oid4vci_common18.convertJsonToURI)(requestWithBaseUrl.credential_offer_uri ?? requestWithBaseUrl.original_credential_offer, {
+    return (0, import_oid4vci_common19.convertJsonToURI)(requestWithBaseUrl.credential_offer_uri ?? requestWithBaseUrl.original_credential_offer, {
       baseUrl,
       arrayTypeProperties: isUri ? [] : [
         "credential_type"
       ],
       uriTypeProperties: isUri ? [
         "credential_offer_uri"
-      ] : version >= import_oid4vci_common18.OpenId4VCIVersion.VER_1_0_13 ? [
+      ] : version >= import_oid4vci_common19.OpenId4VCIVersion.VER_1_0_13 ? [
         "credential_issuer",
         "credential_type"
       ] : [
@@ -2445,11 +2649,101 @@ var CredentialOfferClientV1_0_13 = class {
   }
 };
 
+// lib/CredentialOfferClientV1_0_15.ts
+var import_oid4vci_common20 = require("@sphereon/oid4vci-common");
+var import_ssi_types14 = require("@sphereon/ssi-types");
+var logger12 = import_ssi_types14.Loggers.DEFAULT.get("sphereon:oid4vci:offer");
+var CredentialOfferClientV1_0_15 = class {
+  static {
+    __name(this, "CredentialOfferClientV1_0_15");
+  }
+  static async fromURI(uri, opts) {
+    logger12.debug(`Credential Offer URI: ${uri}`);
+    if (!uri.includes("?") || !uri.includes("://")) {
+      logger12.debug(`Invalid Credential Offer URI: ${uri}`);
+      return Promise.reject(Error(`Invalid Credential Offer Request`));
+    }
+    const scheme = uri.split("://")[0];
+    const baseUrl = uri.split("?")[0];
+    const version = (0, import_oid4vci_common20.determineSpecVersionFromURI)(uri);
+    let credentialOffer;
+    if (uri.includes("credential_offer_uri")) {
+      credentialOffer = await handleCredentialOfferUri(uri);
+    } else {
+      credentialOffer = (0, import_oid4vci_common20.convertURIToJsonObject)(uri, {
+        // It must have the '=' sign after credential_offer otherwise the uri will get split at openid_credential_offer
+        arrayTypeProperties: uri.includes("credential_offer_uri=") ? [
+          "credential_configuration_ids",
+          "credential_offer_uri="
+        ] : [
+          "credential_configuration_ids",
+          "credential_offer="
+        ],
+        requiredProperties: uri.includes("credential_offer_uri=") ? [
+          "credential_offer_uri="
+        ] : [
+          "credential_offer="
+        ]
+      });
+    }
+    if (credentialOffer?.credential_offer_uri === void 0 && !credentialOffer?.credential_offer) {
+      return Promise.reject(Error("Either a credential_offer or credential_offer_uri should be present in " + uri));
+    }
+    const request = await (0, import_oid4vci_common20.toUniformCredentialOfferRequest)(credentialOffer, {
+      ...opts,
+      version
+    });
+    return {
+      ...constructBaseResponse(request, scheme, baseUrl),
+      userPinRequired: !!(request.credential_offer?.grants?.[import_oid4vci_common20.PRE_AUTH_GRANT_LITERAL]?.tx_code ?? false)
+    };
+  }
+  static toURI(requestWithBaseUrl, opts) {
+    logger12.debug(`Credential Offer Request with base URL: ${JSON.stringify(requestWithBaseUrl)}`);
+    const version = opts?.version ?? requestWithBaseUrl.version;
+    let baseUrl = requestWithBaseUrl.baseUrl.includes(requestWithBaseUrl.scheme) ? requestWithBaseUrl.baseUrl : `${requestWithBaseUrl.scheme.replace("://", "")}://${requestWithBaseUrl.baseUrl}`;
+    let param;
+    const isUri = requestWithBaseUrl.credential_offer_uri !== void 0;
+    if (version.valueOf() >= import_oid4vci_common20.OpenId4VCIVersion.VER_1_0_11.valueOf()) {
+      if (!baseUrl.includes("?")) {
+        param = isUri ? "credential_offer_uri" : "credential_offer";
+      } else {
+        const split = baseUrl.split("?");
+        if (split.length > 1 && split[1] !== "") {
+          if (baseUrl.endsWith("&")) {
+            param = isUri ? "credential_offer_uri" : "credential_offer";
+          } else if (!baseUrl.endsWith("=")) {
+            baseUrl += `&`;
+            param = isUri ? "credential_offer_uri" : "credential_offer";
+          }
+        }
+      }
+    }
+    return (0, import_oid4vci_common20.convertJsonToURI)(requestWithBaseUrl.credential_offer_uri ?? requestWithBaseUrl.original_credential_offer, {
+      baseUrl,
+      arrayTypeProperties: isUri ? [] : [
+        "credential_configuration_ids"
+      ],
+      uriTypeProperties: isUri ? [
+        "credential_offer_uri"
+      ] : version >= import_oid4vci_common20.OpenId4VCIVersion.VER_1_0_15 ? [
+        "credential_issuer",
+        "credential_configuration_ids"
+      ] : [
+        "issuer",
+        "credential_type"
+      ],
+      param,
+      version
+    });
+  }
+};
+
 // lib/CredentialRequestClientV1_0_11.ts
 var import_oid4vc_common6 = require("@sphereon/oid4vc-common");
-var import_oid4vci_common19 = require("@sphereon/oid4vci-common");
-var import_ssi_types13 = require("@sphereon/ssi-types");
-var logger11 = import_ssi_types13.Loggers.DEFAULT.get("sphereon:oid4vci:credential");
+var import_oid4vci_common21 = require("@sphereon/oid4vci-common");
+var import_ssi_types15 = require("@sphereon/ssi-types");
+var logger13 = import_ssi_types15.Loggers.DEFAULT.get("sphereon:oid4vci:credential");
 var CredentialRequestClientV1_0_11 = class {
   static {
     __name(this, "CredentialRequestClientV1_0_11");
@@ -2485,20 +2779,24 @@ var CredentialRequestClientV1_0_11 = class {
     return await this.acquireCredentialsUsingRequest(request, opts.createDPoPOpts);
   }
   async acquireCredentialsUsingRequest(uniformRequest, createDPoPOpts) {
-    const request = (0, import_oid4vci_common19.getCredentialRequestForVersion)(uniformRequest, this.version());
+    const uniformRequestV11 = uniformRequest;
+    if (!uniformRequestV11.format) {
+      return Promise.reject(Error("format is missing from the (legacy v11) credential request"));
+    }
+    const request = (0, import_oid4vci_common21.getCredentialRequestForVersion)(uniformRequest, uniformRequestV11.format, this.version());
     const credentialEndpoint = this.credentialRequestOpts.credentialEndpoint;
-    if (!(0, import_oid4vci_common19.isValidURL)(credentialEndpoint)) {
-      logger11.debug(`Invalid credential endpoint: ${credentialEndpoint}`);
-      throw new Error(import_oid4vci_common19.URL_NOT_VALID);
+    if (!(0, import_oid4vci_common21.isValidURL)(credentialEndpoint)) {
+      logger13.debug(`Invalid credential endpoint: ${credentialEndpoint}`);
+      throw new Error(import_oid4vci_common21.URL_NOT_VALID);
     }
-    logger11.debug(`Acquiring credential(s) from: ${credentialEndpoint}`);
-    logger11.debug(`request
+    logger13.debug(`Acquiring credential(s) from: ${credentialEndpoint}`);
+    logger13.debug(`request
 : ${JSON.stringify(request, null, 2)}`);
     const requestToken = this.credentialRequestOpts.token;
     let dPoP = createDPoPOpts ? await (0, import_oid4vc_common6.createDPoP)((0, import_oid4vc_common6.getCreateDPoPOptions)(createDPoPOpts, credentialEndpoint, {
       accessToken: requestToken
     })) : void 0;
-    let response = await (0, import_oid4vci_common19.post)(credentialEndpoint, JSON.stringify(request), {
+    let response = await (0, import_oid4vci_common21.post)(credentialEndpoint, JSON.stringify(request), {
       bearerToken: requestToken,
       customHeaders: {
         ...createDPoPOpts && {
@@ -2513,7 +2811,7 @@ var CredentialRequestClientV1_0_11 = class {
       dPoP = await (0, import_oid4vc_common6.createDPoP)((0, import_oid4vc_common6.getCreateDPoPOptions)(createDPoPOpts, credentialEndpoint, {
         accessToken: requestToken
       }));
-      response = await (0, import_oid4vci_common19.post)(credentialEndpoint, JSON.stringify(request), {
+      response = await (0, import_oid4vci_common21.post)(credentialEndpoint, JSON.stringify(request), {
         bearerToken: requestToken,
         customHeaders: {
           ...createDPoPOpts && {
@@ -2524,14 +2822,14 @@ var CredentialRequestClientV1_0_11 = class {
       const successDPoPNonce = response.origResponse.headers.get("DPoP-Nonce");
       nextDPoPNonce = successDPoPNonce ?? retryWithNonce.dpopNonce;
     }
-    this._isDeferred = (0, import_oid4vci_common19.isDeferredCredentialResponse)(response);
+    this._isDeferred = (0, import_oid4vci_common21.isDeferredCredentialResponse)(response);
     if (this.isDeferred() && this.credentialRequestOpts.deferredCredentialAwait && response.successBody) {
       response = await this.acquireDeferredCredential(response.successBody, {
         bearerToken: this.credentialRequestOpts.token
       });
     }
     response.access_token = requestToken;
-    logger11.debug(`Credential endpoint ${credentialEndpoint} response:\r
+    logger13.debug(`Credential endpoint ${credentialEndpoint} response:\r
 ${JSON.stringify(response, null, 2)}`);
     return {
       ...response,
@@ -2553,7 +2851,7 @@ ${JSON.stringify(response, null, 2)}`);
     } else if (!bearerToken) {
       throw Error(`No bearer token present and refresh for defered endpoint not supported yet`);
     }
-    return await (0, import_oid4vci_common19.acquireDeferredCredential)({
+    return await (0, import_oid4vci_common21.acquireDeferredCredential)({
       bearerToken,
       transactionId,
       deferredCredentialEndpoint,
@@ -2567,7 +2865,7 @@ ${JSON.stringify(response, null, 2)}`);
     if (!formatSelection) {
       throw Error(`Format of credential to be issued is missing`);
     }
-    const format = (0, import_oid4vci_common19.getUniformFormat)(formatSelection);
+    const format = (0, import_oid4vci_common21.getUniformFormat)(formatSelection);
     const typesSelection = opts?.credentialTypes && (typeof opts.credentialTypes === "string" || opts.credentialTypes.length > 0) ? opts.credentialTypes : this.credentialRequestOpts.credentialTypes;
     const types = Array.isArray(typesSelection) ? typesSelection : [
       typesSelection
@@ -2585,7 +2883,7 @@ ${JSON.stringify(response, null, 2)}`);
         proof
       };
     } else if (format === "jwt_vc_json-ld" || format === "ldp_vc") {
-      if (this.version() >= import_oid4vci_common19.OpenId4VCIVersion.VER_1_0_12 && !opts.context) {
+      if (this.version() >= import_oid4vci_common21.OpenId4VCIVersion.VER_1_0_12 && !opts.context) {
         throw Error("No @context value present, but it is required");
       }
       return {
@@ -2623,18 +2921,18 @@ ${JSON.stringify(response, null, 2)}`);
     throw new Error(`Unsupported format: ${format}`);
   }
   version() {
-    return this.credentialRequestOpts?.version ?? import_oid4vci_common19.OpenId4VCIVersion.VER_1_0_11;
+    return this.credentialRequestOpts?.version ?? import_oid4vci_common21.OpenId4VCIVersion.VER_1_0_11;
   }
   isV11OrHigher() {
-    return this.version() >= import_oid4vci_common19.OpenId4VCIVersion.VER_1_0_11;
+    return this.version() >= import_oid4vci_common21.OpenId4VCIVersion.VER_1_0_11;
   }
 };
 
 // lib/CredentialRequestClientBuilder.ts
-var import_oid4vci_common22 = require("@sphereon/oid4vci-common");
+var import_oid4vci_common25 = require("@sphereon/oid4vci-common");
 
 // lib/CredentialRequestClientBuilderV1_0_11.ts
-var import_oid4vci_common20 = require("@sphereon/oid4vci-common");
+var import_oid4vci_common22 = require("@sphereon/oid4vci-common");
 var CredentialRequestClientBuilderV1_0_11 = class _CredentialRequestClientBuilderV1_0_11 {
   static {
     __name(this, "CredentialRequestClientBuilderV1_0_11");
@@ -2652,7 +2950,7 @@ var CredentialRequestClientBuilderV1_0_11 = class _CredentialRequestClientBuilde
   static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialTypes }) {
     const issuer = credentialIssuer;
     const builder = new _CredentialRequestClientBuilderV1_0_11();
-    builder.withVersion(version ?? import_oid4vci_common20.OpenId4VCIVersion.VER_1_0_11);
+    builder.withVersion(version ?? import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_11);
     builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
     if (metadata?.deferred_credential_endpoint) {
       builder.withDeferredCredentialEndpoint(metadata.deferred_credential_endpoint);
@@ -2671,18 +2969,18 @@ var CredentialRequestClientBuilderV1_0_11 = class _CredentialRequestClientBuilde
   }
   static fromCredentialOfferRequest(opts) {
     const { request, metadata } = opts;
-    const version = opts.version ?? request.version ?? (0, import_oid4vci_common20.determineSpecVersionFromOffer)(request.original_credential_offer);
+    const version = opts.version ?? request.version ?? (0, import_oid4vci_common22.determineSpecVersionFromOffer)(request.original_credential_offer);
     const builder = new _CredentialRequestClientBuilderV1_0_11();
-    const issuer = (0, import_oid4vci_common20.getIssuerFromCredentialOfferPayload)(request.credential_offer) ?? metadata?.issuer;
+    const issuer = (0, import_oid4vci_common22.getIssuerFromCredentialOfferPayload)(request.credential_offer) ?? metadata?.issuer;
     builder.withVersion(version);
     builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
     if (metadata?.deferred_credential_endpoint) {
       builder.withDeferredCredentialEndpoint(metadata.deferred_credential_endpoint);
     }
-    if (version <= import_oid4vci_common20.OpenId4VCIVersion.VER_1_0_08) {
+    if (version <= import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_08) {
       builder.withCredentialType(request.original_credential_offer.credential_type);
-    } else if (version <= import_oid4vci_common20.OpenId4VCIVersion.VER_1_0_11) {
-      builder.withCredentialType((0, import_oid4vci_common20.getTypesFromOfferV1_0_11)(request.credential_offer));
+    } else if (version <= import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_11) {
+      builder.withCredentialType((0, import_oid4vci_common22.getTypesFromOfferV1_0_11)(request.credential_offer));
     }
     return builder;
   }
@@ -2746,14 +3044,14 @@ var CredentialRequestClientBuilderV1_0_11 = class _CredentialRequestClientBuilde
   }
   build() {
     if (!this.version) {
-      this.withVersion(import_oid4vci_common20.OpenId4VCIVersion.VER_1_0_11);
+      this.withVersion(import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_11);
     }
     return new CredentialRequestClientV1_0_11(this);
   }
 };
 
 // lib/CredentialRequestClientBuilderV1_0_13.ts
-var import_oid4vci_common21 = require("@sphereon/oid4vci-common");
+var import_oid4vci_common23 = require("@sphereon/oid4vci-common");
 var CredentialRequestClientBuilderV1_0_13 = class _CredentialRequestClientBuilderV1_0_13 {
   static {
     __name(this, "CredentialRequestClientBuilderV1_0_13");
@@ -2772,7 +3070,7 @@ var CredentialRequestClientBuilderV1_0_13 = class _CredentialRequestClientBuilde
   static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialIdentifier, credentialTypes }) {
     const issuer = credentialIssuer;
     const builder = new _CredentialRequestClientBuilderV1_0_13();
-    builder.withVersion(version ?? import_oid4vci_common21.OpenId4VCIVersion.VER_1_0_13);
+    builder.withVersion(version ?? import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_13);
     builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
     if (metadata?.deferred_credential_endpoint) {
       builder.withDeferredCredentialEndpoint(metadata.deferred_credential_endpoint);
@@ -2796,12 +3094,12 @@ var CredentialRequestClientBuilderV1_0_13 = class _CredentialRequestClientBuilde
   }
   static fromCredentialOfferRequest(opts) {
     const { request, metadata } = opts;
-    const version = opts.version ?? request.version ?? (0, import_oid4vci_common21.determineSpecVersionFromOffer)(request.original_credential_offer);
-    if (version < import_oid4vci_common21.OpenId4VCIVersion.VER_1_0_13) {
+    const version = opts.version ?? request.version ?? (0, import_oid4vci_common23.determineSpecVersionFromOffer)(request.original_credential_offer);
+    if (version < import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_13) {
       throw new Error("Versions below v1.0.13 (draft 13) are not supported.");
     }
     const builder = new _CredentialRequestClientBuilderV1_0_13();
-    const issuer = (0, import_oid4vci_common21.getIssuerFromCredentialOfferPayload)(request.credential_offer) ?? metadata?.issuer;
+    const issuer = (0, import_oid4vci_common23.getIssuerFromCredentialOfferPayload)(request.credential_offer) ?? metadata?.issuer;
     builder.withVersion(version);
     builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
     if (metadata?.deferred_credential_endpoint) {
@@ -2878,52 +3176,56 @@ var CredentialRequestClientBuilderV1_0_13 = class _CredentialRequestClientBuilde
   }
   build() {
     if (!this.version) {
-      this.withVersion(import_oid4vci_common21.OpenId4VCIVersion.VER_1_0_11);
+      this.withVersion(import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_11);
     }
     return new CredentialRequestClient(this);
   }
 };
 
-// lib/CredentialRequestClientBuilder.ts
-function isV1_0_13(builder) {
-  return builder.withCredentialIdentifier !== void 0;
-}
-__name(isV1_0_13, "isV1_0_13");
-var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
+// lib/CredentialRequestClientBuilderV1_0_15.ts
+var import_oid4vci_common24 = require("@sphereon/oid4vci-common");
+var CredentialRequestClientBuilderV1_0_15 = class _CredentialRequestClientBuilderV1_0_15 {
   static {
-    __name(this, "CredentialRequestClientBuilder");
-  }
-  _builder;
-  constructor(builder) {
-    this._builder = builder;
+    __name(this, "CredentialRequestClientBuilderV1_0_15");
   }
-  static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialIdentifier, credentialTypes }) {
-    const specVersion = version ?? import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_13;
-    let builder;
-    if (specVersion >= import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_13) {
-      builder = CredentialRequestClientBuilderV1_0_13.fromCredentialIssuer({
-        credentialIssuer,
-        metadata,
-        version,
-        credentialIdentifier,
-        credentialTypes
-      });
-    } else {
-      if (!credentialTypes || credentialTypes.length === 0) {
-        throw new Error("CredentialTypes must be provided for v1_0_11");
-      }
-      builder = CredentialRequestClientBuilderV1_0_11.fromCredentialIssuer({
-        credentialIssuer,
-        metadata,
-        version,
-        credentialTypes
-      });
+  credentialEndpoint;
+  deferredCredentialEndpoint;
+  nonceEndpoint;
+  deferredCredentialAwait = false;
+  deferredCredentialIntervalInMS = 5e3;
+  credentialIdentifier;
+  credentialConfigurationId;
+  credentialTypes = [];
+  token;
+  version;
+  subjectIssuance;
+  issuerState;
+  // Note: format removed from v15 - credential requests no longer include format parameter
+  static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialIdentifier, credentialConfigurationId, credentialTypes }) {
+    const issuer = credentialIssuer;
+    const builder = new _CredentialRequestClientBuilderV1_0_15();
+    builder.withVersion(version ?? import_oid4vci_common24.OpenId4VCIVersion.VER_1_0_15);
+    builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
+    if (metadata?.deferred_credential_endpoint) {
+      builder.withDeferredCredentialEndpoint(metadata.deferred_credential_endpoint);
     }
-    return new _CredentialRequestClientBuilder(builder);
+    if (metadata?.credentialIssuerMetadata?.nonce_endpoint) {
+      builder.withNonceEndpoint(metadata.credentialIssuerMetadata?.nonce_endpoint);
+    }
+    if (credentialIdentifier) {
+      builder.withCredentialIdentifier(credentialIdentifier);
+    }
+    if (credentialConfigurationId) {
+      builder.withCredentialConfigurationId(credentialConfigurationId);
+    }
+    if (credentialTypes) {
+      builder.withCredentialType(credentialTypes);
+    }
+    return builder;
   }
   static async fromURI({ uri, metadata }) {
     const offer = await CredentialOfferClient.fromURI(uri);
-    return _CredentialRequestClientBuilder.fromCredentialOfferRequest({
+    return _CredentialRequestClientBuilderV1_0_15.fromCredentialOfferRequest({
       request: offer,
       ...offer,
       metadata,
@@ -2931,115 +3233,840 @@ var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
     });
   }
   static fromCredentialOfferRequest(opts) {
-    const { request } = opts;
-    const version = opts.version ?? request.version ?? (0, import_oid4vci_common22.determineSpecVersionFromOffer)(request.original_credential_offer);
-    let builder;
-    if (version < import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_13) {
-      builder = CredentialRequestClientBuilderV1_0_11.fromCredentialOfferRequest(opts);
-    } else {
-      builder = CredentialRequestClientBuilderV1_0_13.fromCredentialOfferRequest(opts);
+    const { request, metadata } = opts;
+    const version = opts.version ?? request.version ?? (0, import_oid4vci_common24.determineSpecVersionFromOffer)(request.original_credential_offer);
+    if (version < import_oid4vci_common24.OpenId4VCIVersion.VER_1_0_15) {
+      throw new Error("Versions below v1.0.15 (draft 15) are not supported.");
+    }
+    const builder = new _CredentialRequestClientBuilderV1_0_15();
+    const issuer = (0, import_oid4vci_common24.getIssuerFromCredentialOfferPayload)(request.credential_offer) ?? (metadata ? metadata.issuer : void 0);
+    if (!issuer && !metadata?.credential_endpoint) {
+      throw Error(`Issuer could not be determined`);
+    }
+    builder.withVersion(version);
+    builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
+    if (metadata?.deferred_credential_endpoint) {
+      builder.withDeferredCredentialEndpoint(metadata.deferred_credential_endpoint);
+    }
+    if (metadata?.credentialIssuerMetadata?.nonce_endpoint) {
+      builder.withNonceEndpoint(metadata.credentialIssuerMetadata.nonce_endpoint);
+    }
+    const ids = request.credential_offer.credential_configuration_ids;
+    if (ids.length && ids.length === 1) {
+      builder.withCredentialConfigurationId(ids[0]);
+    }
+    return builder;
+  }
+  static fromCredentialOffer({ credentialOffer, metadata }) {
+    const builder = _CredentialRequestClientBuilderV1_0_15.fromCredentialOfferRequest({
+      request: credentialOffer,
+      metadata,
+      version: credentialOffer.version
+    });
+    return builder;
+  }
+  withCredentialEndpointFromMetadata(metadata) {
+    this.credentialEndpoint = metadata.credential_endpoint;
+    return this;
+  }
+  withCredentialEndpoint(credentialEndpoint) {
+    this.credentialEndpoint = credentialEndpoint;
+    return this;
+  }
+  withIssuerState(issuerState) {
+    this.issuerState = issuerState;
+    return this;
+  }
+  withDeferredCredentialEndpointFromMetadata(metadata) {
+    this.deferredCredentialEndpoint = metadata.deferred_credential_endpoint;
+    return this;
+  }
+  withDeferredCredentialEndpoint(deferredCredentialEndpoint) {
+    this.deferredCredentialEndpoint = deferredCredentialEndpoint;
+    return this;
+  }
+  // New in v15: Support for nonce endpoint
+  withNonceEndpointFromMetadata(metadata) {
+    this.nonceEndpoint = metadata.nonce_endpoint;
+    return this;
+  }
+  withNonceEndpoint(nonceEndpoint) {
+    this.nonceEndpoint = nonceEndpoint;
+    return this;
+  }
+  withDeferredCredentialAwait(deferredCredentialAwait, deferredCredentialIntervalInMS) {
+    this.deferredCredentialAwait = deferredCredentialAwait;
+    this.deferredCredentialIntervalInMS = deferredCredentialIntervalInMS ?? 5e3;
+    return this;
+  }
+  // New in v15: Support for credential_identifier (used when authorization_details with credential_identifiers was used)
+  withCredentialIdentifier(credentialIdentifier) {
+    this.credentialIdentifier = credentialIdentifier;
+    return this;
+  }
+  // New in v15: Support for credential_configuration_id (used when scope was used and no credential_identifiers returned)
+  withCredentialConfigurationId(credentialConfigurationId) {
+    this.credentialConfigurationId = credentialConfigurationId;
+    return this;
+  }
+  // Legacy support for credential types (may be used internally to map to configuration IDs)
+  withCredentialType(credentialTypes) {
+    this.credentialTypes = Array.isArray(credentialTypes) ? credentialTypes : [
+      credentialTypes
+    ];
+    return this;
+  }
+  // Note: withFormat() method removed in v15 - format is no longer part of credential requests
+  withSubjectIssuance(subjectIssuance) {
+    this.subjectIssuance = subjectIssuance;
+    return this;
+  }
+  withToken(accessToken) {
+    this.token = accessToken;
+    return this;
+  }
+  withTokenFromResponse(response) {
+    this.token = response.access_token;
+    return this;
+  }
+  withVersion(version) {
+    this.version = version;
+    return this;
+  }
+  build() {
+    if (!this.version) {
+      this.withVersion(import_oid4vci_common24.OpenId4VCIVersion.VER_1_0_15);
+    }
+    return new CredentialRequestClient(this);
+  }
+};
+
+// lib/CredentialRequestClientBuilder.ts
+function isV1_0_13(builder) {
+  return builder.withCredentialIdentifier !== void 0;
+}
+__name(isV1_0_13, "isV1_0_13");
+function isV1_0_15(builder) {
+  return builder.withCredentialIdentifier !== void 0;
+}
+__name(isV1_0_15, "isV1_0_15");
+var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
+  static {
+    __name(this, "CredentialRequestClientBuilder");
+  }
+  _builder;
+  constructor(builder) {
+    this._builder = builder;
+  }
+  static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialIdentifier, credentialTypes }) {
+    const specVersion = version ?? import_oid4vci_common25.OpenId4VCIVersion.VER_1_0_15;
+    let builder;
+    const metadataV15 = metadata;
+    if (specVersion >= import_oid4vci_common25.OpenId4VCIVersion.VER_1_0_15) {
+      builder = CredentialRequestClientBuilderV1_0_15.fromCredentialIssuer({
+        credentialIssuer,
+        metadata: metadataV15,
+        version,
+        credentialIdentifier,
+        credentialTypes
+      });
+    } else if (specVersion >= import_oid4vci_common25.OpenId4VCIVersion.VER_1_0_13) {
+      builder = CredentialRequestClientBuilderV1_0_13.fromCredentialIssuer({
+        credentialIssuer,
+        metadata,
+        version,
+        credentialIdentifier,
+        credentialTypes
+      });
+    } else {
+      if (!credentialTypes || credentialTypes.length === 0) {
+        throw new Error("CredentialTypes must be provided for v1_0_11");
+      }
+      builder = CredentialRequestClientBuilderV1_0_11.fromCredentialIssuer({
+        credentialIssuer,
+        metadata,
+        version,
+        credentialTypes
+      });
+    }
+    return new _CredentialRequestClientBuilder(builder);
+  }
+  static async fromURI({ uri, metadata }) {
+    const offer = await CredentialOfferClient.fromURI(uri);
+    return _CredentialRequestClientBuilder.fromCredentialOfferRequest({
+      request: offer,
+      ...offer,
+      metadata,
+      version: offer.version
+    });
+  }
+  static fromCredentialOfferRequest(opts) {
+    const { request } = opts;
+    const version = opts.version ?? request.version ?? (0, import_oid4vci_common25.determineSpecVersionFromOffer)(request.original_credential_offer);
+    let builder;
+    if (version < import_oid4vci_common25.OpenId4VCIVersion.VER_1_0_13) {
+      builder = CredentialRequestClientBuilderV1_0_11.fromCredentialOfferRequest(opts);
+    } else {
+      builder = CredentialRequestClientBuilderV1_0_13.fromCredentialOfferRequest(opts);
+    }
+    return new _CredentialRequestClientBuilder(builder);
+  }
+  static fromCredentialOffer({ credentialOffer, metadata }) {
+    const version = (0, import_oid4vci_common25.determineSpecVersionFromOffer)(credentialOffer.credential_offer);
+    let builder;
+    if (version < import_oid4vci_common25.OpenId4VCIVersion.VER_1_0_13) {
+      builder = CredentialRequestClientBuilderV1_0_11.fromCredentialOffer({
+        credentialOffer,
+        metadata
+      });
+    } else {
+      builder = CredentialRequestClientBuilderV1_0_13.fromCredentialOffer({
+        credentialOffer,
+        metadata
+      });
+    }
+    return new _CredentialRequestClientBuilder(builder);
+  }
+  getVersion() {
+    return this._builder.version;
+  }
+  withCredentialEndpointFromMetadata(metadata) {
+    if (isV1_0_15(this._builder)) {
+      this._builder.withCredentialEndpointFromMetadata(metadata);
+    } else if (isV1_0_13(this._builder)) {
+      this._builder.withCredentialEndpointFromMetadata(metadata);
+    } else {
+      this._builder.withCredentialEndpointFromMetadata(metadata);
+    }
+    return this;
+  }
+  withCredentialEndpoint(credentialEndpoint) {
+    this._builder.withCredentialEndpoint(credentialEndpoint);
+    return this;
+  }
+  withDeferredCredentialEndpointFromMetadata(metadata) {
+    if (isV1_0_15(this._builder)) {
+      this._builder.withDeferredCredentialEndpointFromMetadata(metadata);
+    } else if (isV1_0_13(this._builder)) {
+      this._builder.withDeferredCredentialEndpointFromMetadata(metadata);
+    } else {
+      this._builder.withDeferredCredentialEndpointFromMetadata(metadata);
+    }
+    return this;
+  }
+  withDeferredCredentialEndpoint(deferredCredentialEndpoint) {
+    this._builder.withDeferredCredentialEndpoint(deferredCredentialEndpoint);
+    return this;
+  }
+  withDeferredCredentialAwait(deferredCredentialAwait, deferredCredentialIntervalInMS) {
+    this._builder.withDeferredCredentialAwait(deferredCredentialAwait, deferredCredentialIntervalInMS);
+    return this;
+  }
+  withCredentialIdentifier(credentialIdentifier) {
+    if (this._builder.version === void 0 || this._builder.version < import_oid4vci_common25.OpenId4VCIVersion.VER_1_0_13) {
+      throw new Error("Version of spec should be equal or higher than v1_0_13");
+    }
+    ;
+    this._builder.withCredentialIdentifier(credentialIdentifier);
+    return this;
+  }
+  withIssuerState(issuerState) {
+    this._builder.withIssuerState(issuerState);
+    return this;
+  }
+  withCredentialType(credentialTypes) {
+    this._builder.withCredentialType(credentialTypes);
+    return this;
+  }
+  withFormat(format) {
+    if ("withFormat" in this._builder) {
+      this._builder.withFormat(format);
+    }
+    return this;
+  }
+  withSubjectIssuance(subjectIssuance) {
+    this._builder.withSubjectIssuance(subjectIssuance);
+    return this;
+  }
+  withToken(accessToken) {
+    this._builder.withToken(accessToken);
+    return this;
+  }
+  withTokenFromResponse(response) {
+    this._builder.withTokenFromResponse(response);
+    return this;
+  }
+  withVersion(version) {
+    this._builder.withVersion(version);
+    return this;
+  }
+  build() {
+    return this._builder.build();
+  }
+};
+
+// lib/OpenID4VCIClient.ts
+var import_oid4vci_common28 = require("@sphereon/oid4vci-common");
+var import_ssi_types17 = require("@sphereon/ssi-types");
+
+// lib/OpenID4VCIClientV1_0_15.ts
+var import_oid4vci_common27 = require("@sphereon/oid4vci-common");
+var import_ssi_types16 = require("@sphereon/ssi-types");
+
+// lib/NonceClient.ts
+var import_oid4vci_common26 = require("@sphereon/oid4vci-common");
+var sendNonceRequest = /* @__PURE__ */ __name(async (nonceEndpointUrl, opts) => {
+  return await (0, import_oid4vci_common26.formPost)(nonceEndpointUrl, new URLSearchParams(), {
+    customHeaders: opts?.headers
+  });
+}, "sendNonceRequest");
+var acquireNonceFromAuthorizationServer = /* @__PURE__ */ __name(async (opts) => {
+  const metadata = opts?.metadata ? opts.metadata : opts?.issuerOpts?.fetchMetadata ? await MetadataClient.retrieveAllMetadata(opts.issuerOpts.issuer, {
+    errorOnNotFound: false
+  }) : void 0;
+  const nonceEndpointUrl = metadata?.credentialIssuerMetadata?.nonce_endpoint;
+  if (!nonceEndpointUrl) {
+    return Promise.reject(Error("Cannot determine nonce endpoint URL"));
+  }
+  return await sendNonceRequest(nonceEndpointUrl, {
+    headers: opts?.headers
+  });
+}, "acquireNonceFromAuthorizationServer");
+
+// lib/OpenID4VCIClientV1_0_15.ts
+var logger14 = import_ssi_types16.Loggers.DEFAULT.get("sphereon:oid4vci:v15");
+var OpenID4VCIClientV1_0_15 = class _OpenID4VCIClientV1_0_15 {
+  static {
+    __name(this, "OpenID4VCIClientV1_0_15");
+  }
+  _state;
+  constructor({ credentialOffer, clientId, kid, alg, credentialIssuer, pkce, authorizationRequest, jwk, endpointMetadata, accessTokenResponse, authorizationRequestOpts, authorizationCodeResponse, authorizationURL, keyAttestation }) {
+    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common27.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
+    if (!issuer) {
+      throw Error("No credential issuer supplied or deduced from offer");
+    }
+    this._state = {
+      credentialOffer,
+      credentialIssuer: issuer,
+      kid,
+      alg,
+      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common27.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
+      pkce: {
+        disabled: false,
+        codeChallengeMethod: import_oid4vci_common27.CodeChallengeMethod.S256,
+        ...pkce
+      },
+      authorizationRequestOpts,
+      authorizationCodeResponse,
+      jwk,
+      endpointMetadata,
+      accessTokenResponse,
+      authorizationURL,
+      keyAttestation
+    };
+    if (!this._state.authorizationRequestOpts) {
+      this._state.authorizationRequestOpts = this.syncAuthorizationRequestOpts(authorizationRequest);
+    }
+    logger14.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
+  }
+  static async fromCredentialIssuer({ kid, alg, retrieveServerMetadata, clientId, credentialIssuer, pkce, authorizationRequest, createAuthorizationRequestURL, keyAttestation }) {
+    const client = new _OpenID4VCIClientV1_0_15({
+      kid,
+      alg,
+      clientId: clientId ?? authorizationRequest?.clientId,
+      credentialIssuer,
+      pkce,
+      authorizationRequest,
+      keyAttestation
+    });
+    if (retrieveServerMetadata !== false) {
+      await client.retrieveServerMetadata();
+    }
+    if (createAuthorizationRequestURL !== false) {
+      await client.createAuthorizationRequestUrl({
+        authorizationRequest,
+        pkce
+      });
+    }
+    return client;
+  }
+  static async fromState({ state }) {
+    const clientState = typeof state === "string" ? JSON.parse(state) : state;
+    return new _OpenID4VCIClientV1_0_15(clientState);
+  }
+  static async fromURI({ uri, kid, alg, retrieveServerMetadata, clientId, pkce, createAuthorizationRequestURL, authorizationRequest, resolveOfferUri, keyAttestation }) {
+    const credentialOfferClient = await CredentialOfferClientV1_0_15.fromURI(uri, {
+      resolve: resolveOfferUri
+    });
+    const client = new _OpenID4VCIClientV1_0_15({
+      credentialOffer: credentialOfferClient,
+      kid,
+      alg,
+      clientId: clientId ?? authorizationRequest?.clientId ?? credentialOfferClient.clientId,
+      pkce,
+      authorizationRequest,
+      keyAttestation
+    });
+    if (retrieveServerMetadata !== false) {
+      await client.retrieveServerMetadata();
+    }
+    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common27.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && createAuthorizationRequestURL !== false) {
+      await client.createAuthorizationRequestUrl({
+        authorizationRequest,
+        pkce
+      });
+      logger14.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
+    }
+    return client;
+  }
+  async createAuthorizationRequestUrl(opts) {
+    if (!this._state.authorizationURL) {
+      this.calculatePKCEOpts(opts?.pkce);
+      this._state.authorizationRequestOpts = this.syncAuthorizationRequestOpts(opts?.authorizationRequest);
+      if (!this._state.authorizationRequestOpts) {
+        throw Error(`No Authorization Request options present or provided in this call`);
+      }
+      if (this._state.endpointMetadata?.credentialIssuerMetadata && "authorization_endpoint" in this._state.endpointMetadata.credentialIssuerMetadata) {
+        this._state.endpointMetadata.authorization_endpoint = this._state.endpointMetadata.credentialIssuerMetadata.authorization_endpoint;
+      }
+      this._state.authorizationURL = await createAuthorizationRequestUrl({
+        pkce: this._state.pkce,
+        endpointMetadata: this.endpointMetadata,
+        authorizationRequest: this._state.authorizationRequestOpts,
+        credentialOffer: this.credentialOffer,
+        credentialConfigurationSupported: this.getCredentialsSupported(false)
+      });
+    }
+    return this._state.authorizationURL;
+  }
+  async retrieveServerMetadata() {
+    this.assertIssuerData();
+    if (!this._state.endpointMetadata) {
+      if (this.credentialOffer) {
+        this._state.endpointMetadata = await MetadataClientV1_0_15.retrieveAllMetadataFromCredentialOffer(this.credentialOffer);
+      } else if (this._state.credentialIssuer) {
+        this._state.endpointMetadata = await MetadataClientV1_0_15.retrieveAllMetadata(this._state.credentialIssuer);
+      } else {
+        throw Error(`Cannot retrieve issuer metadata without either a credential offer, or issuer value`);
+      }
+    }
+    return this.endpointMetadata;
+  }
+  async acquireNonce() {
+    const response = await acquireNonceFromAuthorizationServer({
+      metadata: this.endpointMetadata,
+      issuerOpts: {
+        issuer: this.getIssuer(),
+        fetchMetadata: false
+      }
+    });
+    if (response.errorBody) {
+      logger14.debug(`Nonce request error:\r
+${JSON.stringify(response.errorBody)}`);
+      return Promise.reject(Error(`Retrieving a nonce from ${this._state.endpointMetadata?.credentialIssuerMetadata?.nonce_endpoint} for issuer ${this.getIssuer()} failed with error: ${response.errorBody.error}${response.errorBody.error_description ? ` - ${response.errorBody.error_description}` : ""}`));
+    } else if (!response.successBody) {
+      logger14.debug(`Nonce request error. No success body`);
+      return Promise.reject(Error(`Retrieving a nonce from ${this._state.endpointMetadata?.credentialIssuerMetadata?.nonce_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
+    }
+    this._state.cachedCNonce = response.successBody.c_nonce;
+    return response.successBody.c_nonce;
+  }
+  calculatePKCEOpts(pkce) {
+    this._state.pkce = generateMissingPKCEOpts({
+      ...this._state.pkce,
+      ...pkce
+    });
+  }
+  async acquireAuthorizationChallengeCode(opts) {
+    const response = await acquireAuthorizationChallengeAuthCode({
+      metadata: this.endpointMetadata,
+      credentialIssuer: this.getIssuer(),
+      clientId: this._state.clientId ?? this._state.authorizationRequestOpts?.clientId,
+      ...opts
+    });
+    if (response.errorBody) {
+      logger14.debug(`Authorization code error:\r
+${JSON.stringify(response.errorBody)}`);
+      const error = response.errorBody;
+      return Promise.reject(error);
+    } else if (!response.successBody) {
+      logger14.debug(`Authorization code error. No success body`);
+      return Promise.reject(Error(`Retrieving an authorization code token from ${this._state.endpointMetadata?.authorization_challenge_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
+    }
+    return {
+      ...response.successBody
+    };
+  }
+  async acquireAccessToken(opts) {
+    const { pin, clientId = this._state.clientId ?? this._state.authorizationRequestOpts?.clientId } = opts ?? {};
+    let { redirectUri } = opts ?? {};
+    const code = this.getAuthorizationCode(opts?.authorizationResponse, opts?.code);
+    if (opts?.codeVerifier) {
+      this._state.pkce.codeVerifier = opts.codeVerifier;
+    }
+    this.assertIssuerData();
+    const asOpts = {
+      ...opts?.asOpts
+    };
+    const kid = asOpts.clientOpts?.kid ?? this._state.kid ?? this._state.authorizationRequestOpts?.requestObjectOpts?.kid;
+    const clientAssertionType = asOpts.clientOpts?.clientAssertionType ?? (kid && clientId && typeof asOpts.clientOpts?.signCallbacks?.signCallback === "function" ? "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" : void 0);
+    if (this.isEBSI() || clientId && kid) {
+      if (!clientId) {
+        throw Error(`Client id expected for EBSI`);
+      }
+      asOpts.clientOpts = {
+        ...asOpts.clientOpts,
+        clientId,
+        ...kid && {
+          kid
+        },
+        ...clientAssertionType && {
+          clientAssertionType
+        },
+        signCallbacks: asOpts.clientOpts?.signCallbacks ?? this._state.authorizationRequestOpts?.requestObjectOpts?.signCallbacks
+      };
+    }
+    if (clientId) {
+      this._state.clientId = clientId;
+      if (!asOpts.clientOpts) {
+        asOpts.clientOpts = {
+          clientId
+        };
+      }
+      asOpts.clientOpts.clientId = clientId;
+    }
+    if (!this._state.accessTokenResponse) {
+      const accessTokenClient = new AccessTokenClient();
+      if (redirectUri && redirectUri !== this._state.authorizationRequestOpts?.redirectUri) {
+        console.log(`Redirect URI mismatch between access-token (${redirectUri}) and authorization request (${this._state.authorizationRequestOpts?.redirectUri}). According to the specification that is not allowed.`);
+      }
+      if (this._state.authorizationRequestOpts?.redirectUri && !redirectUri) {
+        redirectUri = this._state.authorizationRequestOpts.redirectUri;
+      }
+      const response = await accessTokenClient.acquireAccessToken({
+        credentialOffer: this.credentialOffer,
+        metadata: this.endpointMetadata,
+        credentialIssuer: this.getIssuer(),
+        pin,
+        ...!this._state.pkce.disabled && {
+          codeVerifier: this._state.pkce.codeVerifier
+        },
+        code,
+        redirectUri,
+        asOpts,
+        ...opts?.createDPoPOpts && {
+          createDPoPOpts: opts.createDPoPOpts
+        },
+        ...opts?.additionalRequestParams && {
+          additionalParams: opts.additionalRequestParams
+        }
+      });
+      if (response.errorBody) {
+        logger14.debug(`Access token error:\r
+${JSON.stringify(response.errorBody)}`);
+        throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
+      } else if (!response.successBody) {
+        logger14.debug(`Access token error. No success body`);
+        throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
+      }
+      this._state.accessTokenResponse = response.successBody;
+      this._state.dpopResponseParams = response.params;
+      this._state.accessToken = response.successBody.access_token;
+    }
+    return {
+      ...this.accessTokenResponse,
+      ...this.dpopResponseParams && {
+        params: this.dpopResponseParams
+      }
+    };
+  }
+  async acquireCredentials({ credentialIdentifier, credentialConfigurationId, credentialTypes, context, proofCallbacks, format, kid, jwk, alg, jti, deferredCredentialAwait, deferredCredentialIntervalInMS, createDPoPOpts }) {
+    if ([
+      jwk,
+      kid
+    ].filter((v) => v !== void 0).length > 1) {
+      throw new Error(import_oid4vci_common27.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
+    }
+    if (alg) this._state.alg = alg;
+    if (jwk) this._state.jwk = jwk;
+    if (kid) this._state.kid = kid;
+    const requestBuilder = this.credentialOffer ? CredentialRequestClientBuilderV1_0_15.fromCredentialOffer({
+      credentialOffer: this.credentialOffer,
+      metadata: this.endpointMetadata
+    }) : CredentialRequestClientBuilderV1_0_15.fromCredentialIssuer({
+      credentialIssuer: this.getIssuer(),
+      credentialTypes,
+      credentialIdentifier,
+      credentialConfigurationId,
+      metadata: this.endpointMetadata,
+      version: this.version()
+    });
+    if (credentialIdentifier) {
+      requestBuilder.withCredentialIdentifier(credentialIdentifier);
+    } else if (credentialConfigurationId) {
+      requestBuilder.withCredentialConfigurationId(credentialConfigurationId);
+    }
+    const issuerState = this.issuerSupportedFlowTypes().includes(import_oid4vci_common27.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this._state.cachedCNonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
+    requestBuilder.withIssuerState(issuerState);
+    requestBuilder.withTokenFromResponse(this.accessTokenResponse);
+    requestBuilder.withDeferredCredentialAwait(deferredCredentialAwait ?? false, deferredCredentialIntervalInMS);
+    let subjectIssuance;
+    if (this.endpointMetadata?.credentialIssuerMetadata) {
+      const metadata = this.endpointMetadata.credentialIssuerMetadata;
+      if (metadata.credential_configurations_supported) {
+        const configId = credentialConfigurationId ?? credentialIdentifier;
+        if (configId && metadata.credential_configurations_supported[configId]) {
+          const config = metadata.credential_configurations_supported[configId];
+          if (config.credential_subject_issuance) {
+            const subjIssuance = config.credential_subject_issuance;
+            if (subjIssuance.subject_proof_mode && subjIssuance.notification_events_supported) {
+              subjectIssuance = {
+                credential_subject_issuance: {
+                  subject_proof_mode: subjIssuance.subject_proof_mode,
+                  notification_events_supported: subjIssuance.notification_events_supported
+                }
+              };
+            }
+          }
+        }
+      }
+    }
+    if (subjectIssuance) {
+      requestBuilder.withSubjectIssuance(subjectIssuance);
+    }
+    const credentialRequestClient = requestBuilder.build();
+    if (!this._state.cachedCNonce) {
+      await this.acquireNonce();
+    }
+    const proofBuilder = ProofOfPossessionBuilder.fromAccessTokenResponse({
+      accessTokenResponse: {
+        ...this.accessTokenResponse,
+        c_nonce: this._state.cachedCNonce
+      },
+      callbacks: proofCallbacks,
+      version: this.version()
+    }).withIssuer(this.getIssuer()).withAlg(this.alg);
+    if (this._state.jwk) {
+      proofBuilder.withJWK(this._state.jwk);
+    }
+    if (this._state.kid) {
+      proofBuilder.withKid(this._state.kid);
+    }
+    if (this.clientId && (!this.credentialOffer || this.credentialOffer.supportedFlows.includes(import_oid4vci_common27.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && !this.credentialOffer.preAuthorizedCode)) {
+      proofBuilder.withClientId(this.clientId);
+    }
+    if (jti) {
+      proofBuilder.withJti(jti);
+    }
+    if (this._state.cachedCNonce) {
+      proofBuilder.withAccessTokenNonce(this._state.cachedCNonce);
+    }
+    const response = await credentialRequestClient.acquireCredentialsUsingProof({
+      proofInput: proofBuilder,
+      credentialIdentifier,
+      credentialTypes,
+      context,
+      format,
+      subjectIssuance,
+      createDPoPOpts
+    });
+    this._state.dpopResponseParams = response.params;
+    if (response.errorBody) {
+      logger14.debug(`Credential request error:\r
+${JSON.stringify(response.errorBody)}`);
+      throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
+    } else if (!response.successBody) {
+      logger14.debug(`Credential request error. No success body`);
+      throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
+    }
+    return {
+      ...response.successBody,
+      ...this.dpopResponseParams && {
+        params: this.dpopResponseParams
+      },
+      access_token: response.access_token
+    };
+  }
+  async exportState() {
+    return JSON.stringify(this._state);
+  }
+  getCredentialsSupported(restrictToInitiationTypes, format) {
+    return (0, import_oid4vci_common27.getSupportedCredentials)({
+      issuerMetadata: this.endpointMetadata.credentialIssuerMetadata,
+      version: this.version(),
+      format,
+      types: restrictToInitiationTypes ? [
+        this.getCredentialOfferConfigurationIds()
+      ] : void 0
+    });
+  }
+  async sendNotification(credentialRequestOpts, request, accessToken) {
+    return sendNotification(credentialRequestOpts, request, accessToken ?? this._state.accessToken ?? this._state.accessTokenResponse?.access_token);
+  }
+  getCredentialOfferConfigurationIds() {
+    if (!this.credentialOffer) {
+      return [];
+    }
+    return this.credentialOffer.credential_offer?.credential_configuration_ids ?? [];
+  }
+  issuerSupportedFlowTypes() {
+    return this.credentialOffer?.supportedFlows ?? (this._state.endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint ?? this._state.endpointMetadata?.authorization_server ? [
+      import_oid4vci_common27.AuthzFlowType.AUTHORIZATION_CODE_FLOW
+    ] : []);
+  }
+  isFlowTypeSupported(flowType) {
+    return this.issuerSupportedFlowTypes().includes(flowType);
+  }
+  get authorizationURL() {
+    return this._state.authorizationURL;
+  }
+  hasAuthorizationURL() {
+    return !!this.authorizationURL;
+  }
+  get credentialOffer() {
+    return this._state.credentialOffer;
+  }
+  version() {
+    return import_oid4vci_common27.OpenId4VCIVersion.VER_1_0_15;
+  }
+  get endpointMetadata() {
+    this.assertServerMetadata();
+    return this._state.endpointMetadata;
+  }
+  get kid() {
+    this.assertIssuerData();
+    if (!this._state.kid) {
+      throw new Error("No value for kid is supplied");
+    }
+    return this._state.kid;
+  }
+  get alg() {
+    this.assertIssuerData();
+    if (!this._state.alg) {
+      throw new Error("No value for alg is supplied");
     }
-    return new _CredentialRequestClientBuilder(builder);
+    return this._state.alg;
   }
-  static fromCredentialOffer({ credentialOffer, metadata }) {
-    const version = (0, import_oid4vci_common22.determineSpecVersionFromOffer)(credentialOffer.credential_offer);
-    let builder;
-    if (version < import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_13) {
-      builder = CredentialRequestClientBuilderV1_0_11.fromCredentialOffer({
-        credentialOffer,
-        metadata
-      });
-    } else {
-      builder = CredentialRequestClientBuilderV1_0_13.fromCredentialOffer({
-        credentialOffer,
-        metadata
-      });
-    }
-    return new _CredentialRequestClientBuilder(builder);
+  set clientId(value) {
+    this._state.clientId = value;
   }
-  getVersion() {
-    return this._builder.version;
+  get clientId() {
+    return this._state.clientId;
   }
-  withCredentialEndpointFromMetadata(metadata) {
-    if (isV1_0_13(this._builder)) {
-      this._builder.withCredentialEndpointFromMetadata(metadata);
-    } else {
-      this._builder.withCredentialEndpointFromMetadata(metadata);
-    }
-    return this;
+  hasAccessTokenResponse() {
+    return !!this._state.accessTokenResponse;
   }
-  withCredentialEndpoint(credentialEndpoint) {
-    this._builder.withCredentialEndpoint(credentialEndpoint);
-    return this;
+  get accessTokenResponse() {
+    this.assertAccessToken();
+    return this._state.accessTokenResponse;
   }
-  withDeferredCredentialEndpointFromMetadata(metadata) {
-    if (isV1_0_13(this._builder)) {
-      this._builder.withDeferredCredentialEndpointFromMetadata(metadata);
-    } else {
-      this._builder.withDeferredCredentialEndpointFromMetadata(metadata);
-    }
-    return this;
+  get dpopResponseParams() {
+    return this._state.dpopResponseParams;
   }
-  withDeferredCredentialEndpoint(deferredCredentialEndpoint) {
-    this._builder.withDeferredCredentialEndpoint(deferredCredentialEndpoint);
-    return this;
+  get state() {
+    return this._state;
   }
-  withDeferredCredentialAwait(deferredCredentialAwait, deferredCredentialIntervalInMS) {
-    this._builder.withDeferredCredentialAwait(deferredCredentialAwait, deferredCredentialIntervalInMS);
-    return this;
+  getIssuer() {
+    this.assertIssuerData();
+    return this._state.credentialIssuer;
   }
-  withCredentialIdentifier(credentialIdentifier) {
-    if (this._builder.version === void 0 || this._builder.version < import_oid4vci_common22.OpenId4VCIVersion.VER_1_0_13) {
-      throw new Error("Version of spec should be equal or higher than v1_0_13");
-    }
-    ;
-    this._builder.withCredentialIdentifier(credentialIdentifier);
-    return this;
+  getAccessTokenEndpoint() {
+    this.assertIssuerData();
+    return this.endpointMetadata?.token_endpoint ?? AccessTokenClient.determineTokenURL({
+      issuerOpts: {
+        issuer: this.getIssuer()
+      }
+    });
   }
-  withIssuerState(issuerState) {
-    this._builder.withIssuerState(issuerState);
-    return this;
+  getCredentialEndpoint() {
+    this.assertIssuerData();
+    return this.endpointMetadata?.credential_endpoint ?? `${this.getIssuer()}/credential`;
   }
-  withCredentialType(credentialTypes) {
-    this._builder.withCredentialType(credentialTypes);
-    return this;
+  getNonceEndpoint() {
+    return this.endpointMetadata?.credentialIssuerMetadata?.nonce_endpoint;
   }
-  withFormat(format) {
-    this._builder.withFormat(format);
-    return this;
+  hasNonceEndpoint() {
+    return !!this.getNonceEndpoint();
   }
-  withSubjectIssuance(subjectIssuance) {
-    this._builder.withSubjectIssuance(subjectIssuance);
-    return this;
+  getAuthorizationChallengeEndpoint() {
+    this.assertIssuerData();
+    return this.endpointMetadata?.authorization_challenge_endpoint;
   }
-  withToken(accessToken) {
-    this._builder.withToken(accessToken);
-    return this;
+  hasAuthorizationChallengeEndpoint() {
+    return !!this.getAuthorizationChallengeEndpoint();
   }
-  withTokenFromResponse(response) {
-    this._builder.withTokenFromResponse(response);
-    return this;
+  hasDeferredCredentialEndpoint() {
+    return !!this.endpointMetadata?.deferred_credential_endpoint;
   }
-  withVersion(version) {
-    this._builder.withVersion(version);
-    return this;
+  getDeferredCredentialEndpoint() {
+    this.assertIssuerData();
+    return this.endpointMetadata?.deferred_credential_endpoint;
   }
-  build() {
-    return this._builder.build();
+  isEBSI() {
+    return this.clientId?.includes("ebsi") || this._state.kid?.includes("did:ebsi:") || this.getIssuer().includes("ebsi") || this.endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint?.includes("ebsi.eu") || this.endpointMetadata?.credentialIssuerMetadata?.authorization_server?.includes("ebsi.eu");
+  }
+  assertIssuerData() {
+    if (!this._state.credentialIssuer) {
+      throw Error(`No credential issuer value present`);
+    } else if (!this._state.credentialOffer && this._state.endpointMetadata && this.issuerSupportedFlowTypes().length === 0) {
+      throw Error(`No issuance initiation or credential offer present`);
+    }
+  }
+  assertServerMetadata() {
+    if (!this._state.endpointMetadata) {
+      throw Error("No server metadata");
+    }
+  }
+  assertAccessToken() {
+    if (!this._state.accessTokenResponse) {
+      throw Error(`No access token present`);
+    }
+  }
+  syncAuthorizationRequestOpts(opts) {
+    const requestObjectOpts = {
+      ...this._state?.authorizationRequestOpts?.requestObjectOpts,
+      ...opts?.requestObjectOpts
+    };
+    let authorizationRequestOpts = {
+      ...this._state?.authorizationRequestOpts,
+      ...opts,
+      ...requestObjectOpts && {
+        requestObjectOpts
+      }
+    };
+    if (!authorizationRequestOpts) {
+      authorizationRequestOpts = {
+        redirectUri: `${import_oid4vci_common27.DefaultURISchemes.CREDENTIAL_OFFER}://`
+      };
+    }
+    const clientId = authorizationRequestOpts.clientId ?? this._state.clientId;
+    this._state.clientId = clientId;
+    authorizationRequestOpts.clientId = clientId;
+    return authorizationRequestOpts;
   }
+  getAuthorizationCode = /* @__PURE__ */ __name((authorizationResponse, code) => {
+    if (authorizationResponse) {
+      this._state.authorizationCodeResponse = {
+        ...(0, import_oid4vci_common27.toAuthorizationResponsePayload)(authorizationResponse)
+      };
+    } else if (code) {
+      this._state.authorizationCodeResponse = {
+        code
+      };
+    }
+    return this._state.authorizationCodeResponse?.code ?? this._state.authorizationCodeResponse?.authorization_code;
+  }, "getAuthorizationCode");
 };
 
 // lib/OpenID4VCIClient.ts
-var import_oid4vci_common23 = require("@sphereon/oid4vci-common");
-var import_ssi_types14 = require("@sphereon/ssi-types");
-var logger12 = import_ssi_types14.Loggers.DEFAULT.get("sphereon:oid4vci");
+var logger15 = import_ssi_types17.Loggers.DEFAULT.get("sphereon:oid4vci");
 var OpenID4VCIClient = class _OpenID4VCIClient {
   static {
     __name(this, "OpenID4VCIClient");
   }
   _state;
   constructor({ credentialOffer, clientId, kid, alg, credentialIssuer, pkce, authorizationRequest, accessToken, jwk, endpointMetadata, accessTokenResponse, authorizationRequestOpts, authorizationCodeResponse, authorizationURL }) {
-    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common23.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
+    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common28.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
     if (!issuer) {
       throw Error("No credential issuer supplied or deduced from offer");
     }
@@ -3049,10 +4076,10 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
       kid,
       alg,
       // TODO: We need to refactor this and always explicitly call createAuthorizationRequestUrl, so we can have a credential selection first and use the kid as a default for the client id
-      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common23.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
+      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common28.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
       pkce: {
         disabled: false,
-        codeChallengeMethod: import_oid4vci_common23.CodeChallengeMethod.S256,
+        codeChallengeMethod: import_oid4vci_common28.CodeChallengeMethod.S256,
         ...pkce
       },
       authorizationRequestOpts,
@@ -3066,7 +4093,7 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
     if (!this._state.authorizationRequestOpts) {
       this._state.authorizationRequestOpts = this.syncAuthorizationRequestOpts(authorizationRequest);
     }
-    logger12.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
+    logger15.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
   }
   static async fromCredentialIssuer({ kid, alg, retrieveServerMetadata, clientId, credentialIssuer, pkce, authorizationRequest, createAuthorizationRequestURL, endpointMetadata }) {
     const client = new _OpenID4VCIClient({
@@ -3109,12 +4136,12 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
     if (retrieveServerMetadata === void 0 || retrieveServerMetadata) {
       await client.retrieveServerMetadata();
     }
-    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common23.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL)) {
+    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common28.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL)) {
       await client.createAuthorizationRequestUrl({
         authorizationRequest,
         pkce
       });
-      logger12.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
+      logger15.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
     }
     return client;
   }
@@ -3134,7 +4161,7 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
       if (this._state.endpointMetadata?.credentialIssuerMetadata && "authorization_endpoint" in this._state.endpointMetadata.credentialIssuerMetadata) {
         this._state.endpointMetadata.authorization_endpoint = this._state.endpointMetadata.credentialIssuerMetadata.authorization_endpoint;
       }
-      if (this.version() <= import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_11) {
+      if (this.version() <= import_oid4vci_common28.OpenId4VCIVersion.VER_1_0_11) {
         this._state.authorizationURL = await createAuthorizationRequestUrlV1_0_11({
           pkce: this._state.pkce,
           endpointMetadata: this.endpointMetadata,
@@ -3181,12 +4208,12 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
       ...opts
     });
     if (response.errorBody) {
-      logger12.debug(`Authorization code error:\r
+      logger15.debug(`Authorization code error:\r
 ${JSON.stringify(response.errorBody)}`);
       const error = response.errorBody;
       return Promise.reject(error);
     } else if (!response.successBody) {
-      logger12.debug(`Authorization code error. No success body`);
+      logger15.debug(`Authorization code error. No success body`);
       return Promise.reject(Error(`Retrieving an authorization code token from ${this._state.endpointMetadata?.authorization_challenge_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
     }
     return {
@@ -3232,7 +4259,7 @@ ${JSON.stringify(response.errorBody)}`);
       asOpts.clientOpts.clientId = clientId;
     }
     if (!this._state.accessTokenResponse) {
-      const accessTokenClient = this.version() <= import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_12 ? new AccessTokenClientV1_0_11() : new AccessTokenClient();
+      const accessTokenClient = this.version() <= import_oid4vci_common28.OpenId4VCIVersion.VER_1_0_12 ? new AccessTokenClientV1_0_11() : new AccessTokenClient();
       if (redirectUri && redirectUri !== this._state.authorizationRequestOpts?.redirectUri) {
         console.log(`Redirect URI mismatch between access-token (${redirectUri}) and authorization request (${this._state.authorizationRequestOpts?.redirectUri}). According to the specification that is not allowed.`);
       }
@@ -3258,11 +4285,11 @@ ${JSON.stringify(response.errorBody)}`);
         }
       });
       if (response.errorBody) {
-        logger12.debug(`Access token error:\r
+        logger15.debug(`Access token error:\r
 ${JSON.stringify(response.errorBody)}`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
       } else if (!response.successBody) {
-        logger12.debug(`Access token error. No success body`);
+        logger15.debug(`Access token error. No success body`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
       }
       this._state.accessTokenResponse = response.successBody;
@@ -3281,13 +4308,22 @@ ${JSON.stringify(response.errorBody)}`);
       jwk,
       kid
     ].filter((v) => v !== void 0).length > 1) {
-      throw new Error(import_oid4vci_common23.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
+      throw new Error(import_oid4vci_common28.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
     }
     if (alg) this._state.alg = alg;
     if (jwk) this._state.jwk = jwk;
     if (kid) this._state.kid = kid;
+    if (this.version() === import_oid4vci_common28.OpenId4VCIVersion.VER_1_0_15 && this.hasNonceEndpoint()) {
+      if (!this._state.cachedCNonce) {
+        try {
+          await this.acquireNonceViaV15Delegate();
+        } catch (e) {
+          return Promise.reject(Error(`failed to acquire nonce: ${String(e)}`));
+        }
+      }
+    }
     let requestBuilder;
-    if (this.version() < import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_13) {
+    if (this.version() < import_oid4vci_common28.OpenId4VCIVersion.VER_1_0_13) {
       requestBuilder = this.credentialOffer ? CredentialRequestClientBuilderV1_0_11.fromCredentialOffer({
         credentialOffer: this.credentialOffer,
         metadata: this.endpointMetadata
@@ -3298,17 +4334,17 @@ ${JSON.stringify(response.errorBody)}`);
         version: this.version()
       });
     } else {
-      requestBuilder = this.credentialOffer ? CredentialRequestClientBuilderV1_0_13.fromCredentialOffer({
+      requestBuilder = this.credentialOffer ? CredentialRequestClientBuilderV1_0_15.fromCredentialOffer({
         credentialOffer: this.credentialOffer,
         metadata: this.endpointMetadata
-      }) : CredentialRequestClientBuilderV1_0_13.fromCredentialIssuer({
+      }) : CredentialRequestClientBuilderV1_0_15.fromCredentialIssuer({
         credentialIssuer: this.getIssuer(),
         credentialTypes,
         metadata: this.endpointMetadata,
         version: this.version()
       });
     }
-    const issuerState = this.issuerSupportedFlowTypes().includes(import_oid4vci_common23.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this.accessTokenResponse?.c_nonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
+    const issuerState = this.issuerSupportedFlowTypes().includes(import_oid4vci_common28.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this.accessTokenResponse?.c_nonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
     requestBuilder.withIssuerState(issuerState);
     requestBuilder.withTokenFromResponse(this.accessTokenResponse);
     requestBuilder.withDeferredCredentialAwait(deferredCredentialAwait ?? false, deferredCredentialIntervalInMS);
@@ -3321,7 +4357,7 @@ ${JSON.stringify(response.errorBody)}`);
       if (metadata.credentials_supported && Array.isArray(metadata.credentials_supported)) {
         let typeSupported = false;
         metadata.credentials_supported.forEach((supportedCredential) => {
-          const subTypes = (0, import_oid4vci_common23.getTypesFromCredentialSupported)(supportedCredential);
+          const subTypes = (0, import_oid4vci_common28.getTypesFromCredentialSupported)(supportedCredential);
           if (subTypes.every((t, i) => types[i] === t) || types.length === 1 && (types[0] === supportedCredential.id || subTypes.includes(types[0]))) {
             typeSupported = true;
             if (supportedCredential.credential_subject_issuance) {
@@ -3345,53 +4381,109 @@ ${JSON.stringify(response.errorBody)}`);
       requestBuilder.withSubjectIssuance(subjectIssuance);
     }
     const credentialRequestClient = requestBuilder.build();
-    const proofBuilder = ProofOfPossessionBuilder.fromAccessTokenResponse({
-      accessTokenResponse: this.accessTokenResponse,
-      callbacks: proofCallbacks,
-      version: this.version()
-    }).withIssuer(this.getIssuer()).withAlg(this.alg);
-    if (this._state.jwk) {
-      proofBuilder.withJWK(this._state.jwk);
-    }
-    if (this._state.kid) {
-      proofBuilder.withKid(this._state.kid);
-    }
-    if (this.clientId) {
-      proofBuilder.withClientId(this.clientId);
-    }
-    if (jti) {
-      proofBuilder.withJti(jti);
-    }
-    const response = await credentialRequestClient.acquireCredentialsUsingProof({
-      proofInput: proofBuilder,
-      credentialTypes,
-      context,
-      format,
-      subjectIssuance,
-      createDPoPOpts
-    });
-    this._state.dpopResponseParams = response.params;
-    if (response.errorBody) {
-      logger12.debug(`Credential request error:\r
+    try {
+      const proofBuilder = ProofOfPossessionBuilder.fromAccessTokenResponse({
+        accessTokenResponse: this.accessTokenResponse,
+        callbacks: proofCallbacks,
+        version: this.version()
+      }).withIssuer(this.getIssuer()).withAlg(this.alg);
+      if (this._state.jwk) {
+        proofBuilder.withJWK(this._state.jwk);
+      }
+      if (this._state.kid) {
+        proofBuilder.withKid(this._state.kid);
+      }
+      if (this.clientId && (!this.credentialOffer || this.credentialOffer.supportedFlows.includes(import_oid4vci_common28.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && !this.credentialOffer.preAuthorizedCode)) {
+        proofBuilder.withClientId(this.clientId);
+      }
+      if (jti) {
+        proofBuilder.withJti(jti);
+      }
+      if ("cachedCNonce" in this._state && this._state.cachedCNonce) {
+        proofBuilder.withAccessTokenNonce(this._state.cachedCNonce);
+      }
+      const response = await credentialRequestClient.acquireCredentialsUsingProof({
+        proofInput: proofBuilder,
+        credentialTypes,
+        context,
+        format,
+        subjectIssuance,
+        createDPoPOpts
+      });
+      this._state.dpopResponseParams = response.params;
+      if (response.errorBody) {
+        logger15.debug(`Credential request error:\r
 ${JSON.stringify(response.errorBody)}`);
-      throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
-    } else if (!response.successBody) {
-      logger12.debug(`Credential request error. No success body`);
-      throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
+        throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
+      } else if (!response.successBody) {
+        logger15.debug(`Credential request error. No success body`);
+        throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
+      }
+      return {
+        ...response.successBody,
+        ...this.dpopResponseParams && {
+          params: this.dpopResponseParams
+        },
+        access_token: response.access_token
+      };
+    } catch (e) {
+      if (!this.shouldRetryWithFreshNonce(e)) {
+        return Promise.reject(e instanceof Error ? e : Error(String(e)));
+      }
+      this._state.cachedCNonce = void 0;
+      try {
+        await this.acquireNonceViaV15Delegate();
+      } catch (e2) {
+        return Promise.reject(Error(`retry nonce fetch failed: ${String(e2)}`));
+      }
+      const proofBuilder2 = ProofOfPossessionBuilder.fromAccessTokenResponse({
+        accessTokenResponse: this.accessTokenResponse,
+        callbacks: proofCallbacks,
+        version: this.version()
+      }).withIssuer(this.getIssuer()).withAlg(this.alg);
+      if (this._state.jwk) {
+        proofBuilder2.withJWK(this._state.jwk);
+      }
+      if (this._state.kid) {
+        proofBuilder2.withKid(this._state.kid);
+      }
+      if (this.clientId) {
+        proofBuilder2.withClientId(this.clientId);
+      }
+      if (jti) {
+        proofBuilder2.withJti(jti);
+      }
+      const response2 = await credentialRequestClient.acquireCredentialsUsingProof({
+        proofInput: proofBuilder2,
+        credentialTypes,
+        context,
+        format,
+        subjectIssuance,
+        createDPoPOpts
+      });
+      this._state.dpopResponseParams = response2.params;
+      if (response2.errorBody) {
+        logger15.debug(`Credential request error (after retry):\r
+${JSON.stringify(response2.errorBody)}`);
+        return Promise.reject(Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed after retry with status: ${response2.origResponse.status}`));
+      } else if (!response2.successBody) {
+        logger15.debug(`Credential request error after retry. No success body`);
+        return Promise.reject(Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed after retry as there was no success response body`));
+      }
+      return {
+        ...response2.successBody,
+        ...this.dpopResponseParams && {
+          params: this.dpopResponseParams
+        },
+        access_token: response2.access_token
+      };
     }
-    return {
-      ...response.successBody,
-      ...this.dpopResponseParams && {
-        params: this.dpopResponseParams
-      },
-      access_token: response.access_token
-    };
   }
   async exportState() {
     return JSON.stringify(this._state);
   }
   getCredentialsSupported(restrictToInitiationTypes, format) {
-    return (0, import_oid4vci_common23.getSupportedCredentials)({
+    return (0, import_oid4vci_common28.getSupportedCredentials)({
       issuerMetadata: this.endpointMetadata.credentialIssuerMetadata,
       version: this.version(),
       format,
@@ -3404,7 +4496,7 @@ ${JSON.stringify(response.errorBody)}`);
   getCredentialOfferTypes() {
     if (!this.credentialOffer) {
       return [];
-    } else if (this.version() < import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_11) {
+    } else if (this.version() < import_oid4vci_common28.OpenId4VCIVersion.VER_1_0_11) {
       const orig = this.credentialOffer.original_credential_offer;
       const types = typeof orig.credential_type === "string" ? [
         orig.credential_type
@@ -3412,14 +4504,14 @@ ${JSON.stringify(response.errorBody)}`);
       const result = [];
       result[0] = types;
       return result;
-    } else if (this.version() < import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_13) {
-      return this.credentialOffer.credential_offer.credentials.map((c) => (0, import_oid4vci_common23.getTypesFromObject)(c) ?? []);
+    } else if (this.version() < import_oid4vci_common28.OpenId4VCIVersion.VER_1_0_13) {
+      return this.credentialOffer.credential_offer.credentials.map((c) => (0, import_oid4vci_common28.getTypesFromObject)(c) ?? []);
     }
     return void 0;
   }
   issuerSupportedFlowTypes() {
     return this.credentialOffer?.supportedFlows ?? (this._state.endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint ?? this._state.endpointMetadata?.authorization_server ? [
-      import_oid4vci_common23.AuthzFlowType.AUTHORIZATION_CODE_FLOW
+      import_oid4vci_common28.AuthzFlowType.AUTHORIZATION_CODE_FLOW
     ] : []);
   }
   isFlowTypeSupported(flowType) {
@@ -3435,17 +4527,17 @@ ${JSON.stringify(response.errorBody)}`);
     return this._state.credentialOffer;
   }
   version() {
-    if (this.credentialOffer?.version && this.credentialOffer.version !== import_oid4vci_common23.OpenId4VCIVersion.VER_UNKNOWN) {
+    if (this.credentialOffer?.version && this.credentialOffer.version !== import_oid4vci_common28.OpenId4VCIVersion.VER_UNKNOWN) {
       return this.credentialOffer.version;
     }
     const metadata = this._state.endpointMetadata;
     if (metadata?.credentialIssuerMetadata) {
-      const versions = (0, import_oid4vci_common23.determineVersionsFromIssuerMetadata)(metadata.credentialIssuerMetadata);
-      if (versions.length > 0 && !versions.includes(import_oid4vci_common23.OpenId4VCIVersion.VER_UNKNOWN)) {
+      const versions = (0, import_oid4vci_common28.determineVersionsFromIssuerMetadata)(metadata.credentialIssuerMetadata);
+      if (versions.length > 0 && !versions.includes(import_oid4vci_common28.OpenId4VCIVersion.VER_UNKNOWN)) {
         return versions[0];
       }
     }
-    return import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_13;
+    return import_oid4vci_common28.OpenId4VCIVersion.VER_1_0_15;
   }
   get endpointMetadata() {
     this.assertServerMetadata();
@@ -3490,7 +4582,7 @@ ${JSON.stringify(response.errorBody)}`);
     if (this.endpointMetadata) {
       return this.endpointMetadata.token_endpoint;
     }
-    return this.version() <= import_oid4vci_common23.OpenId4VCIVersion.VER_1_0_12 ? AccessTokenClientV1_0_11.determineTokenURL({
+    return this.version() <= import_oid4vci_common28.OpenId4VCIVersion.VER_1_0_12 ? AccessTokenClientV1_0_11.determineTokenURL({
       issuerOpts: {
         issuer: this.getIssuer()
       }
@@ -3562,7 +4654,7 @@ ${JSON.stringify(response.errorBody)}`);
     };
     if (!authorizationRequestOpts) {
       authorizationRequestOpts = {
-        redirectUri: `${import_oid4vci_common23.DefaultURISchemes.CREDENTIAL_OFFER}://`
+        redirectUri: `${import_oid4vci_common28.DefaultURISchemes.CREDENTIAL_OFFER}://`
       };
     }
     const clientId = authorizationRequestOpts.clientId ?? this._state.clientId;
@@ -3573,7 +4665,7 @@ ${JSON.stringify(response.errorBody)}`);
   getAuthorizationCode = /* @__PURE__ */ __name((authorizationResponse, code) => {
     if (authorizationResponse) {
       this._state.authorizationCodeResponse = {
-        ...(0, import_oid4vci_common23.toAuthorizationResponsePayload)(authorizationResponse)
+        ...(0, import_oid4vci_common28.toAuthorizationResponsePayload)(authorizationResponse)
       };
     } else if (code) {
       this._state.authorizationCodeResponse = {
@@ -3582,19 +4674,65 @@ ${JSON.stringify(response.errorBody)}`);
     }
     return this._state.authorizationCodeResponse?.code ?? this._state.authorizationCodeResponse?.authorization_code;
   }, "getAuthorizationCode");
+  hasNonceEndpoint() {
+    const endpoint = this._state.endpointMetadata?.credentialIssuerMetadata?.nonce_endpoint;
+    return typeof endpoint === "string" && endpoint.length > 0;
+  }
+  async acquireNonceViaV15Delegate() {
+    const state = this._state;
+    let v15Client;
+    try {
+      v15Client = await OpenID4VCIClientV1_0_15.fromState({
+        state
+      });
+    } catch (e) {
+      return Promise.reject(Error(`failed to init v15 delegate for nonce: ${String(e)}`));
+    }
+    try {
+      await v15Client.acquireNonce();
+    } catch (e) {
+      return Promise.reject(Error(`nonce request failed: ${String(e)}`));
+    }
+    state.cachedCNonce = v15Client.state.cachedCNonce;
+  }
+  shouldRetryWithFreshNonce(err) {
+    if (!this.hasNonceEndpoint() && this.version() !== import_oid4vci_common28.OpenId4VCIVersion.VER_1_0_15) {
+      return false;
+    }
+    const status = err?.response?.status ?? err?.status;
+    const body = err?.response?.data ?? err?.data ?? void 0;
+    const error = typeof body?.error === "string" ? body.error : void 0;
+    const desc = typeof body?.error_description === "string" ? body.error_description : void 0;
+    const text = [
+      error,
+      desc
+    ].filter(Boolean).join(" ").toLowerCase();
+    if (status === 400 || status === 401 || status === 403) {
+      if (text.includes("nonce") || text.includes("c_nonce")) {
+        return true;
+      }
+      if (text.includes("proof") && (text.includes("invalid") || text.includes("expired"))) {
+        return true;
+      }
+      if (error === "invalid_proof" || error === "invalid_request") {
+        return true;
+      }
+    }
+    return false;
+  }
 };
 
 // lib/OpenID4VCIClientV1_0_13.ts
-var import_oid4vci_common24 = require("@sphereon/oid4vci-common");
-var import_ssi_types15 = require("@sphereon/ssi-types");
-var logger13 = import_ssi_types15.Loggers.DEFAULT.get("sphereon:oid4vci");
+var import_oid4vci_common29 = require("@sphereon/oid4vci-common");
+var import_ssi_types18 = require("@sphereon/ssi-types");
+var logger16 = import_ssi_types18.Loggers.DEFAULT.get("sphereon:oid4vci");
 var OpenID4VCIClientV1_0_13 = class _OpenID4VCIClientV1_0_13 {
   static {
     __name(this, "OpenID4VCIClientV1_0_13");
   }
   _state;
   constructor({ credentialOffer, clientId, kid, alg, credentialIssuer, pkce, authorizationRequest, accessToken, jwk, endpointMetadata, accessTokenResponse, authorizationRequestOpts, authorizationCodeResponse, authorizationURL }) {
-    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common24.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
+    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common29.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
     if (!issuer) {
       throw Error("No credential issuer supplied or deduced from offer");
     }
@@ -3604,10 +4742,10 @@ var OpenID4VCIClientV1_0_13 = class _OpenID4VCIClientV1_0_13 {
       kid,
       alg,
       // TODO: We need to refactor this and always explicitly call createAuthorizationRequestUrl, so we can have a credential selection first and use the kid as a default for the client id
-      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common24.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
+      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common29.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
       pkce: {
         disabled: false,
-        codeChallengeMethod: import_oid4vci_common24.CodeChallengeMethod.S256,
+        codeChallengeMethod: import_oid4vci_common29.CodeChallengeMethod.S256,
         ...pkce
       },
       authorizationRequestOpts,
@@ -3621,7 +4759,7 @@ var OpenID4VCIClientV1_0_13 = class _OpenID4VCIClientV1_0_13 {
     if (!this._state.authorizationRequestOpts) {
       this._state.authorizationRequestOpts = this.syncAuthorizationRequestOpts(authorizationRequest);
     }
-    logger13.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
+    logger16.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
   }
   static async fromCredentialIssuer({ kid, alg, retrieveServerMetadata, clientId, credentialIssuer, pkce, authorizationRequest, createAuthorizationRequestURL }) {
     const client = new _OpenID4VCIClientV1_0_13({
@@ -3662,12 +4800,12 @@ var OpenID4VCIClientV1_0_13 = class _OpenID4VCIClientV1_0_13 {
     if (retrieveServerMetadata === void 0 || retrieveServerMetadata) {
       await client.retrieveServerMetadata();
     }
-    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common24.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL)) {
+    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common29.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL)) {
       await client.createAuthorizationRequestUrl({
         authorizationRequest,
         pkce
       });
-      logger13.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
+      logger16.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
     }
     return client;
   }
@@ -3725,12 +4863,12 @@ var OpenID4VCIClientV1_0_13 = class _OpenID4VCIClientV1_0_13 {
       ...opts
     });
     if (response.errorBody) {
-      logger13.debug(`Authorization code error:\r
+      logger16.debug(`Authorization code error:\r
 ${JSON.stringify(response.errorBody)}`);
       const error = response.errorBody;
       return Promise.reject(error);
     } else if (!response.successBody) {
-      logger13.debug(`Authorization code error. No success body`);
+      logger16.debug(`Authorization code error. No success body`);
       return Promise.reject(Error(`Retrieving an authorization code token from ${this._state.endpointMetadata?.authorization_challenge_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
     }
     return {
@@ -3802,11 +4940,11 @@ ${JSON.stringify(response.errorBody)}`);
         }
       });
       if (response.errorBody) {
-        logger13.debug(`Access token error:\r
+        logger16.debug(`Access token error:\r
 ${JSON.stringify(response.errorBody)}`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
       } else if (!response.successBody) {
-        logger13.debug(`Access token error. No success body`);
+        logger16.debug(`Access token error. No success body`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
       }
       this._state.accessTokenResponse = response.successBody;
@@ -3831,7 +4969,7 @@ ${JSON.stringify(response.errorBody)}`);
       jwk,
       kid
     ].filter((v) => v !== void 0).length > 1) {
-      throw new Error(import_oid4vci_common24.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
+      throw new Error(import_oid4vci_common29.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
     }
     if (alg) this._state.alg = alg;
     if (jwk) this._state.jwk = jwk;
@@ -3845,7 +4983,7 @@ ${JSON.stringify(response.errorBody)}`);
       metadata: this.endpointMetadata,
       version: this.version()
     });
-    const issuerState = this.issuerSupportedFlowTypes().includes(import_oid4vci_common24.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this.accessTokenResponse?.c_nonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
+    const issuerState = this.issuerSupportedFlowTypes().includes(import_oid4vci_common29.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this.accessTokenResponse?.c_nonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
     requestBuilder.withIssuerState(issuerState);
     requestBuilder.withTokenFromResponse(this.accessTokenResponse);
     requestBuilder.withDeferredCredentialAwait(deferredCredentialAwait ?? false, deferredCredentialIntervalInMS);
@@ -3868,7 +5006,7 @@ ${JSON.stringify(response.errorBody)}`);
       } else if (metadata.credentials_supported && Array.isArray(metadata.credentials_supported)) {
         let typeSupported = false;
         metadata.credentials_supported.forEach((supportedCredential) => {
-          const subTypes = (0, import_oid4vci_common24.getTypesFromCredentialSupported)(supportedCredential);
+          const subTypes = (0, import_oid4vci_common29.getTypesFromCredentialSupported)(supportedCredential);
           if (subTypes.every((t, i) => types[i] === t) || types.length === 1 && (types[0] === supportedCredential.id || subTypes.includes(types[0]))) {
             typeSupported = true;
             if (supportedCredential.credential_subject_issuance) {
@@ -3884,7 +5022,7 @@ ${JSON.stringify(response.errorBody)}`);
       } else if (metadata.credential_configurations_supported && typeof metadata.credential_configurations_supported === "object") {
         let typeSupported = false;
         Object.values(metadata.credential_configurations_supported).forEach((supportedCredential) => {
-          const subTypes = (0, import_oid4vci_common24.getTypesFromCredentialSupported)(supportedCredential);
+          const subTypes = (0, import_oid4vci_common29.getTypesFromCredentialSupported)(supportedCredential);
           if (subTypes.every((t, i) => types[i] === t) || types.length === 1 && (types[0] === supportedCredential.id || subTypes.includes(types[0]))) {
             typeSupported = true;
           }
@@ -3934,14 +5072,17 @@ ${JSON.stringify(response.errorBody)}`);
       credentialIdentifier,
       subjectIssuance
     });
-    const response = await credentialRequestClient.acquireCredentialsUsingRequest(request, createDPoPOpts);
+    if (!import_oid4vci_common29.supportedOID4VCICredentialFormat.includes(format)) {
+      return Promise.reject(Error(`Unsupported credential format: ${format}`));
+    }
+    const response = await credentialRequestClient.acquireCredentialsUsingRequest(request, format, createDPoPOpts);
     this._state.dpopResponseParams = response.params;
     if (response.errorBody) {
-      logger13.debug(`Credential request error:\r
+      logger16.debug(`Credential request error:\r
 ${JSON.stringify(response.errorBody)}`);
       throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
     } else if (!response.successBody) {
-      logger13.debug(`Credential request error. No success body`);
+      logger16.debug(`Credential request error. No success body`);
       throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
     }
     return {
@@ -3956,7 +5097,7 @@ ${JSON.stringify(response.errorBody)}`);
     return JSON.stringify(this._state);
   }
   getCredentialsSupported(format) {
-    return (0, import_oid4vci_common24.getSupportedCredentials)({
+    return (0, import_oid4vci_common29.getSupportedCredentials)({
       issuerMetadata: this.endpointMetadata.credentialIssuerMetadata,
       version: this.version(),
       format,
@@ -3991,7 +5132,7 @@ ${JSON.stringify(response.errorBody)}`);
   }*/
   issuerSupportedFlowTypes() {
     return this.credentialOffer?.supportedFlows ?? (this._state.endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint ? [
-      import_oid4vci_common24.AuthzFlowType.AUTHORIZATION_CODE_FLOW
+      import_oid4vci_common29.AuthzFlowType.AUTHORIZATION_CODE_FLOW
     ] : []);
   }
   isFlowTypeSupported(flowType) {
@@ -4007,7 +5148,7 @@ ${JSON.stringify(response.errorBody)}`);
     return this._state.credentialOffer;
   }
   version() {
-    return this.credentialOffer?.version ?? import_oid4vci_common24.OpenId4VCIVersion.VER_1_0_13;
+    return this.credentialOffer?.version ?? import_oid4vci_common29.OpenId4VCIVersion.VER_1_0_13;
   }
   get endpointMetadata() {
     this.assertServerMetadata();
@@ -4110,7 +5251,7 @@ ${JSON.stringify(response.errorBody)}`);
     };
     if (!authorizationRequestOpts) {
       authorizationRequestOpts = {
-        redirectUri: `${import_oid4vci_common24.DefaultURISchemes.CREDENTIAL_OFFER}://`
+        redirectUri: `${import_oid4vci_common29.DefaultURISchemes.CREDENTIAL_OFFER}://`
       };
     }
     const clientId = authorizationRequestOpts.clientId ?? this._state.clientId;
@@ -4121,7 +5262,7 @@ ${JSON.stringify(response.errorBody)}`);
   getAuthorizationCode = /* @__PURE__ */ __name((authorizationResponse, code) => {
     if (authorizationResponse) {
       this._state.authorizationCodeResponse = {
-        ...(0, import_oid4vci_common24.toAuthorizationResponsePayload)(authorizationResponse)
+        ...(0, import_oid4vci_common29.toAuthorizationResponsePayload)(authorizationResponse)
       };
     } else if (code) {
       this._state.authorizationCodeResponse = {
@@ -4133,16 +5274,16 @@ ${JSON.stringify(response.errorBody)}`);
 };
 
 // lib/OpenID4VCIClientV1_0_11.ts
-var import_oid4vci_common25 = require("@sphereon/oid4vci-common");
-var import_ssi_types16 = require("@sphereon/ssi-types");
-var logger14 = import_ssi_types16.Loggers.DEFAULT.get("sphereon:oid4vci");
+var import_oid4vci_common30 = require("@sphereon/oid4vci-common");
+var import_ssi_types19 = require("@sphereon/ssi-types");
+var logger17 = import_ssi_types19.Loggers.DEFAULT.get("sphereon:oid4vci");
 var OpenID4VCIClientV1_0_11 = class _OpenID4VCIClientV1_0_11 {
   static {
     __name(this, "OpenID4VCIClientV1_0_11");
   }
   _state;
   constructor({ credentialOffer, clientId, kid, alg, credentialIssuer, pkce, authorizationRequest, jwk, endpointMetadata, accessTokenResponse, authorizationRequestOpts, authorizationCodeResponse, authorizationURL }) {
-    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common25.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
+    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common30.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
     if (!issuer) {
       throw Error("No credential issuer supplied or deduced from offer");
     }
@@ -4152,10 +5293,10 @@ var OpenID4VCIClientV1_0_11 = class _OpenID4VCIClientV1_0_11 {
       kid,
       alg,
       // TODO: We need to refactor this and always explicitly call createAuthorizationRequestUrl, so we can have a credential selection first and use the kid as a default for the client id
-      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common25.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
+      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common30.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
       pkce: {
         disabled: false,
-        codeChallengeMethod: import_oid4vci_common25.CodeChallengeMethod.S256,
+        codeChallengeMethod: import_oid4vci_common30.CodeChallengeMethod.S256,
         ...pkce
       },
       authorizationRequestOpts,
@@ -4168,7 +5309,7 @@ var OpenID4VCIClientV1_0_11 = class _OpenID4VCIClientV1_0_11 {
     if (!this._state.authorizationRequestOpts) {
       this._state.authorizationRequestOpts = this.syncAuthorizationRequestOpts(authorizationRequest);
     }
-    logger14.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
+    logger17.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
   }
   static async fromCredentialIssuer({ kid, alg, retrieveServerMetadata, clientId, credentialIssuer, pkce, authorizationRequest, createAuthorizationRequestURL }) {
     const client = new _OpenID4VCIClientV1_0_11({
@@ -4209,12 +5350,12 @@ var OpenID4VCIClientV1_0_11 = class _OpenID4VCIClientV1_0_11 {
     if (retrieveServerMetadata === void 0 || retrieveServerMetadata) {
       await client.retrieveServerMetadata();
     }
-    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common25.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL)) {
+    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common30.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL)) {
       await client.createAuthorizationRequestUrl({
         authorizationRequest,
         pkce
       });
-      logger14.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
+      logger17.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
     }
     return client;
   }
@@ -4271,12 +5412,12 @@ var OpenID4VCIClientV1_0_11 = class _OpenID4VCIClientV1_0_11 {
       ...opts
     });
     if (response.errorBody) {
-      logger14.debug(`Authorization code error:\r
+      logger17.debug(`Authorization code error:\r
 ${JSON.stringify(response.errorBody)}`);
       const error = response.errorBody;
       return Promise.reject(error);
     } else if (!response.successBody) {
-      logger14.debug(`Authorization code error. No success body`);
+      logger17.debug(`Authorization code error. No success body`);
       return Promise.reject(Error(`Retrieving an authorization code token from ${this._state.endpointMetadata?.authorization_challenge_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
     }
     return {
@@ -4348,11 +5489,11 @@ ${JSON.stringify(response.errorBody)}`);
         }
       });
       if (response.errorBody) {
-        logger14.debug(`Access token error:\r
+        logger17.debug(`Access token error:\r
 ${JSON.stringify(response.errorBody)}`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
       } else if (!response.successBody) {
-        logger14.debug(`Access token error. No success body`);
+        logger17.debug(`Access token error. No success body`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
       }
       this._state.accessTokenResponse = response.successBody;
@@ -4371,7 +5512,7 @@ ${JSON.stringify(response.errorBody)}`);
       jwk,
       kid
     ].filter((v) => v !== void 0).length > 1) {
-      throw new Error(import_oid4vci_common25.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
+      throw new Error(import_oid4vci_common30.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
     }
     if (alg) this._state.alg = alg;
     if (jwk) this._state.jwk = jwk;
@@ -4395,7 +5536,7 @@ ${JSON.stringify(response.errorBody)}`);
       if (metadata.credentials_supported && Array.isArray(metadata.credentials_supported)) {
         let typeSupported = false;
         metadata.credentials_supported.forEach((supportedCredential) => {
-          const subTypes = (0, import_oid4vci_common25.getTypesFromCredentialSupported)(supportedCredential);
+          const subTypes = (0, import_oid4vci_common30.getTypesFromCredentialSupported)(supportedCredential);
           if (subTypes.every((t, i) => types[i] === t) || types.length === 1 && (types[0] === supportedCredential.id || subTypes.includes(types[0]))) {
             typeSupported = true;
           }
@@ -4437,11 +5578,11 @@ ${JSON.stringify(response.errorBody)}`);
     });
     this._state.dpopResponseParams = response.params;
     if (response.errorBody) {
-      logger14.debug(`Credential request error:\r
+      logger17.debug(`Credential request error:\r
 ${JSON.stringify(response.errorBody)}`);
       throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
     } else if (!response.successBody) {
-      logger14.debug(`Credential request error. No success body`);
+      logger17.debug(`Credential request error. No success body`);
       throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
     }
     return {
@@ -4459,7 +5600,7 @@ ${JSON.stringify(response.errorBody)}`);
   // When < v11 convert into a v12 object. When v12 object retain it.
   // Then match the object array on server metadata
   getCredentialsSupportedV11(restrictToInitiationTypes, format) {
-    return (0, import_oid4vci_common25.getSupportedCredentials)({
+    return (0, import_oid4vci_common30.getSupportedCredentials)({
       issuerMetadata: this.endpointMetadata.credentialIssuerMetadata,
       version: this.version(),
       format,
@@ -4467,7 +5608,7 @@ ${JSON.stringify(response.errorBody)}`);
     });
   }
   getCredentialsSupported(format) {
-    return (0, import_oid4vci_common25.getSupportedCredentials)({
+    return (0, import_oid4vci_common30.getSupportedCredentials)({
       issuerMetadata: this.endpointMetadata.credentialIssuerMetadata,
       version: this.version(),
       format,
@@ -4477,7 +5618,7 @@ ${JSON.stringify(response.errorBody)}`);
   getCredentialOfferTypes() {
     if (!this.credentialOffer) {
       return [];
-    } else if (this.credentialOffer.version < import_oid4vci_common25.OpenId4VCIVersion.VER_1_0_11) {
+    } else if (this.credentialOffer.version < import_oid4vci_common30.OpenId4VCIVersion.VER_1_0_11) {
       const orig = this.credentialOffer.original_credential_offer;
       const types = typeof orig.credential_type === "string" ? [
         orig.credential_type
@@ -4485,14 +5626,14 @@ ${JSON.stringify(response.errorBody)}`);
       const result = [];
       result[0] = types;
       return result;
-    } else if (this.credentialOffer.version < import_oid4vci_common25.OpenId4VCIVersion.VER_1_0_13) {
-      return this.credentialOffer.credential_offer.credentials.map((c) => (0, import_oid4vci_common25.getTypesFromObject)(c) ?? []);
+    } else if (this.credentialOffer.version < import_oid4vci_common30.OpenId4VCIVersion.VER_1_0_13) {
+      return this.credentialOffer.credential_offer.credentials.map((c) => (0, import_oid4vci_common30.getTypesFromObject)(c) ?? []);
     }
     throw Error(`This class only supports version 11 and lower! Version: ${this.version()}`);
   }
   issuerSupportedFlowTypes() {
     return this.credentialOffer?.supportedFlows ?? (this._state.endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint ? [
-      import_oid4vci_common25.AuthzFlowType.AUTHORIZATION_CODE_FLOW
+      import_oid4vci_common30.AuthzFlowType.AUTHORIZATION_CODE_FLOW
     ] : []);
   }
   isFlowTypeSupported(flowType) {
@@ -4508,7 +5649,7 @@ ${JSON.stringify(response.errorBody)}`);
     return this._state.credentialOffer;
   }
   version() {
-    return this.credentialOffer?.version ?? import_oid4vci_common25.OpenId4VCIVersion.VER_1_0_11;
+    return this.credentialOffer?.version ?? import_oid4vci_common30.OpenId4VCIVersion.VER_1_0_11;
   }
   get endpointMetadata() {
     this.assertServerMetadata();
@@ -4604,7 +5745,7 @@ ${JSON.stringify(response.errorBody)}`);
     };
     if (!authorizationRequestOpts) {
       authorizationRequestOpts = {
-        redirectUri: `${import_oid4vci_common25.DefaultURISchemes.CREDENTIAL_OFFER}://`
+        redirectUri: `${import_oid4vci_common30.DefaultURISchemes.CREDENTIAL_OFFER}://`
       };
     }
     const clientId = authorizationRequestOpts.clientId ?? this._state.clientId;
@@ -4615,7 +5756,7 @@ ${JSON.stringify(response.errorBody)}`);
   getAuthorizationCode = /* @__PURE__ */ __name((authorizationResponse, code) => {
     if (authorizationResponse) {
       this._state.authorizationCodeResponse = {
-        ...(0, import_oid4vci_common25.toAuthorizationResponsePayload)(authorizationResponse)
+        ...(0, import_oid4vci_common30.toAuthorizationResponsePayload)(authorizationResponse)
       };
     } else if (code) {
       this._state.authorizationCodeResponse = {
@@ -4627,5 +5768,5 @@ ${JSON.stringify(response.errorBody)}`);
 };
 
 // lib/index.ts
-var LOG2 = import_oid4vci_common26.VCI_LOGGERS.get("sphereon:oid4vci:client");
+var LOG2 = import_oid4vci_common31.VCI_LOGGERS.get("sphereon:oid4vci:client");
 //# sourceMappingURL=index.cjs.map