@sphereon/oid4vci-client 0.20.2-next.2 → 0.21.0

package/dist/index.cjs

@@ -36,9 +36,11 @@ __export(index_exports, {
   CredentialOfferClientV1_0_15: () => CredentialOfferClientV1_0_15,
   CredentialRequestClient: () => CredentialRequestClient,
   CredentialRequestClientBuilder: () => CredentialRequestClientBuilder,
+  CredentialRequestClientBuilderV1_0: () => CredentialRequestClientBuilderV1_0,
   CredentialRequestClientBuilderV1_0_15: () => CredentialRequestClientBuilderV1_0_15,
   LOG: () => LOG2,
   MetadataClient: () => MetadataClient,
+  MetadataClientV1_0: () => MetadataClientV1_0,
   MetadataClientV1_0_15: () => MetadataClientV1_0_15,
   OpenID4VCIClient: () => OpenID4VCIClient,
   OpenID4VCIClientV1_0_15: () => OpenID4VCIClientV1_0_15,
@@ -59,7 +61,7 @@ __export(index_exports, {
   sendNotification: () => sendNotification
 });
 module.exports = __toCommonJS(index_exports);
-var import_oid4vci_common20 = require("@sphereon/oid4vci-common");
+var import_oid4vci_common22 = require("@sphereon/oid4vci-common");
 
 // lib/AccessTokenClient.ts
 var import_oid4vc_common3 = require("@sphereon/oid4vc-common");
@@ -162,6 +164,8 @@ var ProofOfPossessionBuilder = class _ProofOfPossessionBuilder {
   jti;
   cNonce;
   typ;
+  proofType = "jwt";
+  coseKey;
   constructor({ proof, callbacks, jwt, accessTokenResponse, version, mode = "pop" }) {
     this.mode = mode;
     this.proof = proof;
@@ -246,6 +250,14 @@ var ProofOfPossessionBuilder = class _ProofOfPossessionBuilder {
     this.typ = typ;
     return this;
   }
+  withProofType(proofType) {
+    this.proofType = proofType;
+    return this;
+  }
+  withCoseKey(coseKey) {
+    this.coseKey = coseKey;
+    return this;
+  }
   withAccessTokenNonce(cNonce) {
     this.cNonce = cNonce;
     return this;
@@ -295,6 +307,17 @@ var ProofOfPossessionBuilder = class _ProofOfPossessionBuilder {
     if (this.proof) {
       return Promise.resolve(this.proof);
     } else if (this.callbacks) {
+      if (this.proofType === "cwt" && this.callbacks.cwtSignCallback) {
+        return await (0, import_oid4vci_common5.createCwtProofOfPossession)(this.callbacks, {
+          iss: this.clientId ?? this.issuer,
+          aud: Array.isArray(this.aud) ? this.aud[0] : this.aud ?? this.issuer ?? "",
+          nonce: this.cNonce,
+          alg: this.alg,
+          jwk: this.jwk,
+          kid: this.kid,
+          coseKey: this.coseKey
+        });
+      }
       return await (0, import_oid4vci_common5.createProofOfPossession)(this.mode, this.callbacks, {
         typ: this.typ ?? (this.mode === "JWT" ? "JWT" : "openid4vci-proof+jwt"),
         kid: this.kid,
@@ -315,7 +338,7 @@ var ProofOfPossessionBuilder = class _ProofOfPossessionBuilder {
 
 // lib/functions/AccessTokenUtil.ts
 var createJwtBearerClientAssertion = /* @__PURE__ */ __name(async (request, opts) => {
-  const { asOpts, credentialIssuer } = opts;
+  const { asOpts, credentialIssuer, metadata } = opts;
   if (asOpts?.clientOpts?.clientAssertionType === "urn:ietf:params:oauth:client-assertion-type:jwt-bearer") {
     const { clientId = request.client_id, signCallbacks, alg } = asOpts.clientOpts;
     let { kid } = asOpts.clientOpts;
@@ -331,6 +354,7 @@ var createJwtBearerClientAssertion = /* @__PURE__ */ __name(async (request, opts
     if (clientId.startsWith("http") && kid.includes("#")) {
       kid = kid.split("#")[1];
     }
+    const aud = metadata?.token_endpoint ?? asOpts?.tokenEndpoint ?? credentialIssuer;
     const jwt = {
       header: {
         typ: "JWT",
@@ -340,16 +364,16 @@ var createJwtBearerClientAssertion = /* @__PURE__ */ __name(async (request, opts
       payload: {
         iss: clientId,
         sub: clientId,
-        aud: credentialIssuer,
+        aud,
         jti: (0, import_oid4vc_common.uuidv4)(),
-        exp: Math.floor(Date.now()) / 1e3 + 60,
-        iat: Math.floor(Date.now()) / 1e3 - 60
+        exp: Math.floor(Date.now() / 1e3) + 60,
+        iat: Math.floor(Date.now() / 1e3) - 60
       }
     };
     const pop = await ProofOfPossessionBuilder.fromJwt({
       jwt,
       callbacks: signCallbacks,
-      version: opts.version ?? import_oid4vci_common6.OpenId4VCIVersion.VER_1_0_15,
+      version: opts.version ?? import_oid4vci_common6.OpenId4VCIVersion.VER_1_0,
       mode: "JWT"
     }).build();
     request.client_assertion_type = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
@@ -603,9 +627,17 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
       },
       ...notification_endpoint && {
         notification_endpoint
+      },
+      ...ci.signed_metadata && {
+        signed_metadata: ci.signed_metadata
       }
     };
     logger2.debug(`Issuer ${issuer} token endpoint ${token_endpoint}, credential endpoint ${credential_endpoint}`);
+    const processedMetadata = await (0, import_oid4vci_common8.processSignedMetadata)({
+      metadata: v15CredentialIssuerMetadata,
+      issuer,
+      signedMetadataVerifyCallback: opts?.signedMetadataVerifyCallback
+    });
     return {
       issuer,
       token_endpoint,
@@ -613,7 +645,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
       authorization_challenge_endpoint,
       notification_endpoint,
       authorizationServerType,
-      credentialIssuerMetadata: v15CredentialIssuerMetadata,
+      credentialIssuerMetadata: processedMetadata,
       authorizationServerMetadata: authMetadata
     };
   }
@@ -723,6 +755,9 @@ var AccessTokenClient = class _AccessTokenClient {
       ...opts,
       credentialIssuer
     });
+    if (request.client_assertion) {
+      delete request.client_id;
+    }
     if (!credentialOfferRequest || credentialOfferRequest.supportedFlows.includes(import_oid4vci_common9.AuthzFlowType.AUTHORIZATION_CODE_FLOW)) {
       request.grant_type = import_oid4vci_common9.GrantTypes.AUTHORIZATION_CODE;
       request.code = code;
@@ -734,8 +769,11 @@ var AccessTokenClient = class _AccessTokenClient {
     }
     if (credentialOfferRequest?.supportedFlows.includes(import_oid4vci_common9.AuthzFlowType.PRE_AUTHORIZED_CODE_FLOW)) {
       this.assertAlphanumericPin(opts.pinMetadata, pin);
-      request.user_pin = pin;
-      request.tx_code = pin;
+      if (opts.pinMetadata?.txCode) {
+        request.tx_code = pin;
+      } else {
+        request.user_pin = pin;
+      }
       request.grant_type = import_oid4vci_common9.GrantTypes.PRE_AUTHORIZED_CODE;
       request[import_oid4vci_common9.PRE_AUTH_CODE_LITERAL] = credentialOfferRequest?.credential_offer.grants?.[import_oid4vci_common9.PRE_AUTH_GRANT_LITERAL]?.[import_oid4vci_common9.PRE_AUTH_CODE_LITERAL];
       return request;
@@ -818,9 +856,11 @@ var AccessTokenClient = class _AccessTokenClient {
     }
   }
   async sendAuthCode(requestTokenURL, accessTokenRequest, opts) {
-    return await (0, import_oid4vci_common9.formPost)(requestTokenURL, (0, import_oid4vci_common9.convertJsonToURI)(accessTokenRequest, {
+    const body = (0, import_oid4vci_common9.convertJsonToURI)(accessTokenRequest, {
       mode: import_oid4vci_common9.JsonURIMode.X_FORM_WWW_URLENCODED
-    }), {
+    });
+    LOG.info(`Token request to ${requestTokenURL}: ${body}`);
+    return await (0, import_oid4vci_common9.formPost)(requestTokenURL, body, {
       customHeaders: opts?.headers ? opts.headers : void 0
     });
   }
@@ -878,6 +918,10 @@ var MetadataClient = class _MetadataClient {
   * @param credentialOffer
   */
   static async retrieveAllMetadataFromCredentialOffer(credentialOffer) {
+    const issuer = (0, import_oid4vci_common10.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer);
+    if (issuer) {
+      return _MetadataClient.retrieveAllMetadata(issuer);
+    }
     const openId4VCIVersion = (0, import_oid4vci_common10.determineSpecVersionFromOffer)(credentialOffer.credential_offer);
     if (openId4VCIVersion >= import_oid4vci_common10.OpenId4VCIVersion.VER_1_0_15) {
       return await MetadataClientV1_0_15.retrieveAllMetadataFromCredentialOffer(credentialOffer);
@@ -891,12 +935,7 @@ var MetadataClient = class _MetadataClient {
   static async retrieveAllMetadataFromCredentialOfferRequest(request) {
     const issuer = (0, import_oid4vci_common10.getIssuerFromCredentialOfferPayload)(request);
     if (issuer) {
-      const openId4VCIVersion = (0, import_oid4vci_common10.determineSpecVersionFromOffer)(request);
-      if (openId4VCIVersion >= import_oid4vci_common10.OpenId4VCIVersion.VER_1_0_15) {
-        return MetadataClientV1_0_15.retrieveAllMetadataFromCredentialOfferRequest(request);
-      } else {
-        return Promise.reject(Error(`OpenId4VCIVersion ${openId4VCIVersion} is not supported in retrieveAllMetadataFromCredentialOfferRequest`));
-      }
+      return _MetadataClient.retrieveAllMetadata(issuer);
     }
     throw new Error("can't retrieve metadata from CredentialOfferRequest. No issuer field is present");
   }
@@ -1016,12 +1055,20 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
       return Promise.reject(Error(`No /.well-known/openid-credential-issuer at ${issuer}.`));
     }
     logger3.debug(`Issuer ${issuer} token endpoint ${token_endpoint}, credential endpoint ${credential_endpoint}`);
+    const versions = credentialIssuerMetadata ? (0, import_oid4vci_common10.determineVersionsFromIssuerMetadata)(credentialIssuerMetadata) : [];
+    const detectedVersion = versions.length > 0 ? versions[0] : import_oid4vci_common10.OpenId4VCIVersion.VER_1_0;
+    logger3.debug(`Detected OID4VCI version ${detectedVersion} for issuer ${issuer}`);
+    const processedMetadata = await (0, import_oid4vci_common10.processSignedMetadata)({
+      metadata: credentialIssuerMetadata,
+      issuer,
+      signedMetadataVerifyCallback: opts?.signedMetadataVerifyCallback
+    });
     return {
       issuer,
       token_endpoint,
       credential_endpoint,
       deferred_credential_endpoint,
-      nonce_endpoint: credentialIssuerMetadata.nonce_endpoint,
+      nonce_endpoint: credentialIssuerMetadata?.nonce_endpoint,
       authorization_servers: authorization_server ? [
         authorization_server
       ] : authorization_servers ?? [
@@ -1030,7 +1077,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
       authorization_endpoint,
       authorization_challenge_endpoint,
       authorizationServerType,
-      credentialIssuerMetadata,
+      credentialIssuerMetadata: processedMetadata,
       authorizationServerMetadata: authMetadata
     };
   }
@@ -1091,7 +1138,7 @@ async function createSignedAuthRequestWhenNeeded(requestObject, opts) {
     const pop = await ProofOfPossessionBuilder.fromJwt({
       jwt,
       callbacks: opts.signCallbacks,
-      version: import_oid4vci_common11.OpenId4VCIVersion.VER_1_0_15,
+      version: import_oid4vci_common11.OpenId4VCIVersion.VER_1_0,
       mode: "JWT"
     }).build();
     requestObject["request"] = pop.jwt;
@@ -1148,8 +1195,8 @@ var createAuthorizationRequestUrl = /* @__PURE__ */ __name(async ({ pkce, endpoi
     if ("credentials" in credentialOffer.credential_offer) {
       throw new Error("CredentialOffer format is wrong.");
     }
-    const ver = version ?? (0, import_oid4vci_common11.determineSpecVersionFromOffer)(credentialOffer.credential_offer) ?? import_oid4vci_common11.OpenId4VCIVersion.VER_1_0_15;
-    const creds = ver === import_oid4vci_common11.OpenId4VCIVersion.VER_1_0_15 ? filterSupportedCredentials(credentialOffer.credential_offer, credentialConfigurationSupported) : [];
+    const ver = version ?? (0, import_oid4vci_common11.determineSpecVersionFromOffer)(credentialOffer.credential_offer) ?? import_oid4vci_common11.OpenId4VCIVersion.VER_1_0;
+    const creds = ver >= import_oid4vci_common11.OpenId4VCIVersion.VER_1_0_15 ? filterSupportedCredentials(credentialOffer.credential_offer, credentialConfigurationSupported) : [];
     authorizationDetails = creds.flatMap((cred) => {
       const locations = [
         credentialOffer?.credential_offer.credential_issuer ?? endpointMetadata.issuer
@@ -1580,18 +1627,61 @@ ${JSON.stringify(response, null, 2)}`);
     if (proofInput) {
       proof = await buildProof(proofInput, opts);
     }
-    if (this.version() >= import_oid4vci_common12.OpenId4VCIVersion.VER_1_0_15) {
+    const issuer_state = this.credentialRequestOpts.issuerState;
+    const commonBody = {
+      ...issuer_state && {
+        issuer_state
+      },
+      ...proof && {
+        proof
+      },
+      ...opts.subjectIssuance
+    };
+    if (this.version() >= import_oid4vci_common12.OpenId4VCIVersion.VER_1_0) {
       const authDetail = findAuthorizationDetail(this.credentialRequestOpts.authorizationDetails, credentialConfigurationId ?? credentialIdentifier);
-      const issuer_state = this.credentialRequestOpts.issuerState;
-      const commonBody = {
+      const authDetailObj = authDetail && typeof authDetail === "object" ? authDetail : null;
+      const configId = credentialConfigurationId ?? authDetailObj?.credential_configuration_id ?? this._credentialRequestOpts.credentialConfigurationId;
+      if (!configId) {
+        return Promise.reject(Error("credential_configuration_id is required for 1.0 final credential request"));
+      }
+      const identifiers = this._credentialRequestOpts.credentialIdentifiers ?? (authDetailObj?.credential_identifiers && authDetailObj.credential_identifiers.length > 0 ? authDetailObj.credential_identifiers : credentialIdentifier ? [
+        credentialIdentifier
+      ] : void 0);
+      let proofsBody = {};
+      if (proof) {
+        if (proof.proof_type === "cwt" && "cwt" in proof) {
+          proofsBody = {
+            proofs: {
+              cwt: [
+                proof.cwt
+              ]
+            }
+          };
+        } else if ("jwt" in proof) {
+          proofsBody = {
+            proofs: {
+              jwt: [
+                proof.jwt
+              ]
+            }
+          };
+        }
+      }
+      const request = {
+        credential_configuration_id: configId,
+        ...identifiers && identifiers.length > 0 && {
+          credential_identifiers: identifiers
+        },
         ...issuer_state && {
           issuer_state
         },
-        ...proof && {
-          proof
-        },
+        ...proofsBody,
         ...opts.subjectIssuance
       };
+      return request;
+    }
+    if (this.version() >= import_oid4vci_common12.OpenId4VCIVersion.VER_1_0_15) {
+      const authDetail = findAuthorizationDetail(this.credentialRequestOpts.authorizationDetails, credentialConfigurationId ?? credentialIdentifier);
       const authDetailObj = authDetail && typeof authDetail === "object" ? authDetail : null;
       if (authDetailObj?.credential_identifier) {
         return {
@@ -1623,7 +1713,7 @@ ${JSON.stringify(response, null, 2)}`);
     throw new Error(`Unsupported version: ${this.version()}`);
   }
   version() {
-    return this.credentialRequestOpts?.version ?? import_oid4vci_common12.OpenId4VCIVersion.VER_1_0_15;
+    return this.credentialRequestOpts?.version ?? import_oid4vci_common12.OpenId4VCIVersion.VER_1_0;
   }
 };
 
@@ -1791,7 +1881,7 @@ var CredentialOfferClientV1_0_15 = class {
 };
 
 // lib/CredentialRequestClientBuilder.ts
-var import_oid4vci_common16 = require("@sphereon/oid4vci-common");
+var import_oid4vci_common17 = require("@sphereon/oid4vci-common");
 
 // lib/CredentialRequestClientBuilderV1_0_15.ts
 var import_oid4vci_common15 = require("@sphereon/oid4vci-common");
@@ -1952,11 +2042,166 @@ var CredentialRequestClientBuilderV1_0_15 = class _CredentialRequestClientBuilde
   }
 };
 
+// lib/CredentialRequestClientBuilderV1_0.ts
+var import_oid4vci_common16 = require("@sphereon/oid4vci-common");
+var CredentialRequestClientBuilderV1_0 = class _CredentialRequestClientBuilderV1_0 {
+  static {
+    __name(this, "CredentialRequestClientBuilderV1_0");
+  }
+  credentialEndpoint;
+  deferredCredentialEndpoint;
+  nonceEndpoint;
+  deferredCredentialAwait = false;
+  deferredCredentialIntervalInMS = 5e3;
+  credentialIdentifiers;
+  credentialConfigurationId;
+  credentialTypes = [];
+  token;
+  version;
+  subjectIssuance;
+  issuerState;
+  static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialIdentifiers, credentialConfigurationId, credentialTypes }) {
+    const issuer = credentialIssuer;
+    const builder = new _CredentialRequestClientBuilderV1_0();
+    builder.withVersion(version ?? import_oid4vci_common16.OpenId4VCIVersion.VER_1_0);
+    builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
+    if (metadata?.deferred_credential_endpoint) {
+      builder.withDeferredCredentialEndpoint(metadata.deferred_credential_endpoint);
+    }
+    if (metadata?.credentialIssuerMetadata?.nonce_endpoint) {
+      builder.withNonceEndpoint(metadata.credentialIssuerMetadata?.nonce_endpoint);
+    }
+    if (credentialIdentifiers) {
+      builder.withCredentialIdentifiers(credentialIdentifiers);
+    }
+    if (credentialConfigurationId) {
+      builder.withCredentialConfigurationId(credentialConfigurationId);
+    }
+    if (credentialTypes) {
+      builder.withCredentialType(credentialTypes);
+    }
+    return builder;
+  }
+  static async fromURI({ uri, metadata }) {
+    const offer = await CredentialOfferClient.fromURI(uri);
+    return _CredentialRequestClientBuilderV1_0.fromCredentialOfferRequest({
+      request: offer,
+      ...offer,
+      metadata,
+      version: offer.version
+    });
+  }
+  static fromCredentialOfferRequest(opts) {
+    const { request, metadata } = opts;
+    const version = opts.version ?? request.version ?? (0, import_oid4vci_common16.determineSpecVersionFromOffer)(request.original_credential_offer);
+    const builder = new _CredentialRequestClientBuilderV1_0();
+    const issuer = (0, import_oid4vci_common16.getIssuerFromCredentialOfferPayload)(request.credential_offer) ?? (metadata ? metadata.issuer : void 0);
+    if (!issuer && !metadata?.credential_endpoint) {
+      throw Error(`Issuer could not be determined`);
+    }
+    builder.withVersion(version >= import_oid4vci_common16.OpenId4VCIVersion.VER_1_0 ? version : import_oid4vci_common16.OpenId4VCIVersion.VER_1_0);
+    builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
+    if (metadata?.deferred_credential_endpoint) {
+      builder.withDeferredCredentialEndpoint(metadata.deferred_credential_endpoint);
+    }
+    if (metadata?.credentialIssuerMetadata?.nonce_endpoint) {
+      builder.withNonceEndpoint(metadata.credentialIssuerMetadata.nonce_endpoint);
+    }
+    const ids = request.credential_offer.credential_configuration_ids;
+    if (ids.length && ids.length === 1) {
+      builder.withCredentialConfigurationId(ids[0]);
+    }
+    return builder;
+  }
+  static fromCredentialOffer({ credentialOffer, metadata }) {
+    return _CredentialRequestClientBuilderV1_0.fromCredentialOfferRequest({
+      request: credentialOffer,
+      metadata,
+      version: credentialOffer.version
+    });
+  }
+  withCredentialEndpointFromMetadata(metadata) {
+    this.credentialEndpoint = metadata.credential_endpoint;
+    return this;
+  }
+  withCredentialEndpoint(credentialEndpoint) {
+    this.credentialEndpoint = credentialEndpoint;
+    return this;
+  }
+  withIssuerState(issuerState) {
+    this.issuerState = issuerState;
+    return this;
+  }
+  withDeferredCredentialEndpointFromMetadata(metadata) {
+    this.deferredCredentialEndpoint = metadata.deferred_credential_endpoint;
+    return this;
+  }
+  withDeferredCredentialEndpoint(deferredCredentialEndpoint) {
+    this.deferredCredentialEndpoint = deferredCredentialEndpoint;
+    return this;
+  }
+  withNonceEndpointFromMetadata(metadata) {
+    this.nonceEndpoint = metadata.nonce_endpoint;
+    return this;
+  }
+  withNonceEndpoint(nonceEndpoint) {
+    this.nonceEndpoint = nonceEndpoint;
+    return this;
+  }
+  withDeferredCredentialAwait(deferredCredentialAwait, deferredCredentialIntervalInMS) {
+    this.deferredCredentialAwait = deferredCredentialAwait;
+    this.deferredCredentialIntervalInMS = deferredCredentialIntervalInMS ?? 5e3;
+    return this;
+  }
+  // 1.0 final: credential_identifiers is an OPTIONAL array
+  withCredentialIdentifiers(credentialIdentifiers) {
+    this.credentialIdentifiers = credentialIdentifiers;
+    return this;
+  }
+  // 1.0 final: credential_configuration_id is REQUIRED
+  withCredentialConfigurationId(credentialConfigurationId) {
+    this.credentialConfigurationId = credentialConfigurationId;
+    return this;
+  }
+  withCredentialType(credentialTypes) {
+    this.credentialTypes = Array.isArray(credentialTypes) ? credentialTypes : [
+      credentialTypes
+    ];
+    return this;
+  }
+  withSubjectIssuance(subjectIssuance) {
+    this.subjectIssuance = subjectIssuance;
+    return this;
+  }
+  withToken(accessToken) {
+    this.token = accessToken;
+    return this;
+  }
+  withTokenFromResponse(response) {
+    this.token = response.access_token;
+    return this;
+  }
+  withVersion(version) {
+    this.version = version;
+    return this;
+  }
+  build() {
+    if (!this.version) {
+      this.withVersion(import_oid4vci_common16.OpenId4VCIVersion.VER_1_0);
+    }
+    return new CredentialRequestClient(this);
+  }
+};
+
 // lib/CredentialRequestClientBuilder.ts
 function isV1_0_15(builder) {
   return builder.withCredentialIdentifier !== void 0;
 }
 __name(isV1_0_15, "isV1_0_15");
+function isV1_0(builder) {
+  return builder.withCredentialIdentifiers !== void 0;
+}
+__name(isV1_0, "isV1_0");
 var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
   static {
     __name(this, "CredentialRequestClientBuilder");
@@ -1965,16 +2210,28 @@ var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
   constructor(builder) {
     this._builder = builder;
   }
-  static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialIdentifier, credentialTypes }) {
+  static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialIdentifier, credentialIdentifiers, credentialTypes }) {
+    const specVersion = version ?? import_oid4vci_common17.OpenId4VCIVersion.VER_1_0;
     let builder;
-    const metadataV15 = metadata;
-    builder = CredentialRequestClientBuilderV1_0_15.fromCredentialIssuer({
-      credentialIssuer,
-      metadata: metadataV15,
-      version,
-      credentialIdentifier,
-      credentialTypes
-    });
+    if (specVersion >= import_oid4vci_common17.OpenId4VCIVersion.VER_1_0) {
+      builder = CredentialRequestClientBuilderV1_0.fromCredentialIssuer({
+        credentialIssuer,
+        metadata,
+        version: specVersion,
+        credentialIdentifiers: credentialIdentifiers ?? (credentialIdentifier ? [
+          credentialIdentifier
+        ] : void 0),
+        credentialTypes
+      });
+    } else {
+      builder = CredentialRequestClientBuilderV1_0_15.fromCredentialIssuer({
+        credentialIssuer,
+        metadata,
+        version: specVersion,
+        credentialIdentifier,
+        credentialTypes
+      });
+    }
     return new _CredentialRequestClientBuilder(builder);
   }
   static async fromURI({ uri, metadata }) {
@@ -2025,11 +2282,24 @@ var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
     return this;
   }
   withCredentialIdentifier(credentialIdentifier) {
-    if (this._builder.version === void 0 || this._builder.version < import_oid4vci_common16.OpenId4VCIVersion.VER_1_0_15) {
+    if (this._builder.version === void 0 || this._builder.version < import_oid4vci_common17.OpenId4VCIVersion.VER_1_0_15) {
       throw new Error("Version of spec should be equal or higher than v1_0_15");
     }
-    ;
-    this._builder.withCredentialIdentifier(credentialIdentifier);
+    if (isV1_0(this._builder)) {
+      this._builder.withCredentialIdentifiers([
+        credentialIdentifier
+      ]);
+    } else if (isV1_0_15(this._builder)) {
+      this._builder.withCredentialIdentifier(credentialIdentifier);
+    }
+    return this;
+  }
+  withCredentialIdentifiers(credentialIdentifiers) {
+    if (isV1_0(this._builder)) {
+      this._builder.withCredentialIdentifiers(credentialIdentifiers);
+    } else if (isV1_0_15(this._builder) && credentialIdentifiers.length > 0) {
+      this._builder.withCredentialIdentifier(credentialIdentifiers[0]);
+    }
     return this;
   }
   withIssuerState(issuerState) {
@@ -2061,18 +2331,197 @@ var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
   }
 };
 
+// lib/MetadataClientV1_0.ts
+var import_oid4vci_common18 = require("@sphereon/oid4vci-common");
+var import_ssi_types9 = require("@sphereon/ssi-types");
+var logger7 = import_ssi_types9.Loggers.DEFAULT.get("sphereon:oid4vci:metadata");
+var MetadataClientV1_0 = class _MetadataClientV1_0 {
+  static {
+    __name(this, "MetadataClientV1_0");
+  }
+  static async retrieveAllMetadataFromCredentialOffer(credentialOffer) {
+    return _MetadataClientV1_0.retrieveAllMetadataFromCredentialOfferRequest(credentialOffer.credential_offer);
+  }
+  static async retrieveAllMetadataFromCredentialOfferRequest(request) {
+    const issuer = (0, import_oid4vci_common18.getIssuerFromCredentialOfferPayload)(request);
+    if (issuer) {
+      return _MetadataClientV1_0.retrieveAllMetadata(issuer);
+    }
+    throw new Error("can't retrieve metadata from CredentialOfferRequest. No issuer field is present");
+  }
+  static async retrieveAllMetadata(issuer, opts) {
+    let token_endpoint;
+    let credential_endpoint;
+    let nonce_endpoint;
+    let deferred_credential_endpoint;
+    let notification_endpoint;
+    let authorization_endpoint;
+    let authorization_challenge_endpoint;
+    let authorizationServerType = "OID4VCI";
+    let authorization_servers = [
+      issuer
+    ];
+    const oid4vciResponse = await _MetadataClientV1_0.retrieveOpenID4VCIServerMetadata(issuer, {
+      errorOnNotFound: false
+    });
+    let credentialIssuerMetadata = oid4vciResponse?.successBody;
+    if (credentialIssuerMetadata) {
+      logger7.debug(`Issuer ${issuer} OID4VCI well-known server metadata\r
+${JSON.stringify(credentialIssuerMetadata)}`);
+      credential_endpoint = credentialIssuerMetadata.credential_endpoint;
+      nonce_endpoint = credentialIssuerMetadata.nonce_endpoint;
+      deferred_credential_endpoint = credentialIssuerMetadata.deferred_credential_endpoint;
+      notification_endpoint = credentialIssuerMetadata.notification_endpoint;
+      if (credentialIssuerMetadata.token_endpoint) {
+        token_endpoint = credentialIssuerMetadata.token_endpoint;
+      }
+      authorization_challenge_endpoint = credentialIssuerMetadata.authorization_challenge_endpoint;
+      if (credentialIssuerMetadata.authorization_servers) {
+        authorization_servers = credentialIssuerMetadata.authorization_servers;
+      }
+    }
+    let response = await retrieveWellknown(authorization_servers[0], import_oid4vci_common18.WellKnownEndpoints.OPENID_CONFIGURATION, {
+      errorOnNotFound: false
+    });
+    let authMetadata = response.successBody;
+    if (authMetadata) {
+      logger7.debug(`Issuer ${issuer} has OpenID Connect Server metadata in well-known location`);
+      authorizationServerType = "OIDC";
+    } else {
+      response = await retrieveWellknown(authorization_servers[0], import_oid4vci_common18.WellKnownEndpoints.OAUTH_AS, {
+        errorOnNotFound: false
+      });
+      authMetadata = response.successBody;
+    }
+    if (!authMetadata) {
+      if (!authorization_servers.includes(issuer)) {
+        throw Error(`Issuer ${issuer} provided a separate authorization server ${authorization_servers}, but that server did not provide metadata`);
+      }
+    } else {
+      logger7.debug(`Issuer ${issuer} has ${authorizationServerType} Server metadata in well-known location`);
+      if (!authMetadata.authorization_endpoint) {
+        console.warn(`Issuer ${issuer} of type ${authorizationServerType} has no authorization_endpoint! Will use ${authorization_endpoint}. This only works for pre-authorized flows`);
+      } else if (authorization_endpoint && authMetadata.authorization_endpoint !== authorization_endpoint) {
+        throw Error(`Credential issuer has a different authorization_endpoint (${authorization_endpoint}) from the Authorization Server (${authMetadata.authorization_endpoint})`);
+      }
+      authorization_endpoint = authMetadata.authorization_endpoint;
+      if (authorization_challenge_endpoint && authMetadata.authorization_challenge_endpoint !== authorization_challenge_endpoint) {
+        throw Error(`Credential issuer has a different authorization_challenge_endpoint (${authorization_challenge_endpoint}) from the Authorization Server (${authMetadata.authorization_challenge_endpoint})`);
+      }
+      authorization_challenge_endpoint = authMetadata.authorization_challenge_endpoint;
+      if (!authMetadata.token_endpoint) {
+        throw Error(`Authorization Server ${authorization_servers} did not provide a token_endpoint`);
+      } else if (token_endpoint && authMetadata.token_endpoint !== token_endpoint) {
+        throw Error(`Credential issuer has a different token_endpoint (${token_endpoint}) from the Authorization Server (${authMetadata.token_endpoint})`);
+      }
+      token_endpoint = authMetadata.token_endpoint;
+      if (authMetadata.credential_endpoint) {
+        if (credential_endpoint && authMetadata.credential_endpoint !== credential_endpoint) {
+          logger7.debug(`Credential issuer has a different credential_endpoint (${credential_endpoint}) from the Authorization Server (${authMetadata.credential_endpoint}). Will use the issuer value`);
+        } else {
+          credential_endpoint = authMetadata.credential_endpoint;
+        }
+      }
+      if (authMetadata.deferred_credential_endpoint) {
+        if (deferred_credential_endpoint && authMetadata.deferred_credential_endpoint !== deferred_credential_endpoint) {
+          logger7.debug(`Credential issuer has a different deferred_credential_endpoint (${deferred_credential_endpoint}) from the Authorization Server (${authMetadata.deferred_credential_endpoint}). Will use the issuer value`);
+        } else {
+          deferred_credential_endpoint = authMetadata.deferred_credential_endpoint;
+        }
+      }
+      if (authMetadata.notification_endpoint) {
+        if (notification_endpoint && authMetadata.notification_endpoint !== notification_endpoint) {
+          logger7.debug(`Credential issuer has a different notification_endpoint (${notification_endpoint}) from the Authorization Server (${authMetadata.notification_endpoint}). Will use the issuer value`);
+        } else {
+          notification_endpoint = authMetadata.notification_endpoint;
+        }
+      }
+    }
+    if (!authorization_endpoint) {
+      logger7.debug(`Issuer ${issuer} does not expose authorization_endpoint, so only pre-auth will be supported`);
+    }
+    if (!token_endpoint) {
+      logger7.debug(`Issuer ${issuer} does not have a token_endpoint listed in well-known locations!`);
+      if (opts?.errorOnNotFound) {
+        throw Error(`Could not deduce the token_endpoint for ${issuer}`);
+      } else {
+        token_endpoint = `${issuer}${issuer.endsWith("/") ? "token" : "/token"}`;
+      }
+    }
+    if (!credential_endpoint) {
+      logger7.debug(`Issuer ${issuer} does not have a credential_endpoint listed in well-known locations!`);
+      if (opts?.errorOnNotFound) {
+        throw Error(`Could not deduce the credential endpoint for ${issuer}`);
+      } else {
+        credential_endpoint = `${issuer}${issuer.endsWith("/") ? "credential" : "/credential"}`;
+      }
+    }
+    if (!credentialIssuerMetadata && authMetadata) {
+      credentialIssuerMetadata = authMetadata;
+    }
+    const ci = credentialIssuerMetadata ?? {};
+    const ciAuthorizationServers = Array.isArray(ci.authorization_servers) && ci.authorization_servers.length > 0 ? ci.authorization_servers : authorization_servers;
+    const v1_0CredentialIssuerMetadata = {
+      credential_issuer: ci.credential_issuer ?? issuer,
+      credential_endpoint,
+      authorization_servers: ciAuthorizationServers,
+      credential_configurations_supported: ci.credential_configurations_supported ?? {},
+      display: ci.display ?? [],
+      ...nonce_endpoint && {
+        nonce_endpoint
+      },
+      ...deferred_credential_endpoint && {
+        deferred_credential_endpoint
+      },
+      ...notification_endpoint && {
+        notification_endpoint
+      },
+      ...ci.batch_credential_issuance_supported !== void 0 && {
+        batch_credential_issuance_supported: ci.batch_credential_issuance_supported
+      },
+      ...ci.credential_issuer_public_key && {
+        credential_issuer_public_key: ci.credential_issuer_public_key
+      },
+      ...ci.signed_metadata && {
+        signed_metadata: ci.signed_metadata
+      }
+    };
+    logger7.debug(`Issuer ${issuer} token endpoint ${token_endpoint}, credential endpoint ${credential_endpoint}`);
+    const processedMetadata = await (0, import_oid4vci_common18.processSignedMetadata)({
+      metadata: v1_0CredentialIssuerMetadata,
+      issuer,
+      signedMetadataVerifyCallback: opts?.signedMetadataVerifyCallback
+    });
+    return {
+      issuer,
+      token_endpoint,
+      credential_endpoint,
+      authorization_challenge_endpoint,
+      notification_endpoint,
+      authorizationServerType,
+      credentialIssuerMetadata: processedMetadata,
+      authorizationServerMetadata: authMetadata
+    };
+  }
+  static async retrieveOpenID4VCIServerMetadata(issuerHost, opts) {
+    return retrieveWellknown(issuerHost, import_oid4vci_common18.WellKnownEndpoints.OPENID4VCI_ISSUER, {
+      errorOnNotFound: opts?.errorOnNotFound === void 0 ? true : opts.errorOnNotFound
+    });
+  }
+};
+
 // lib/OpenID4VCIClient.ts
-var import_oid4vci_common19 = require("@sphereon/oid4vci-common");
-var import_ssi_types10 = require("@sphereon/ssi-types");
+var import_oid4vci_common21 = require("@sphereon/oid4vci-common");
+var import_ssi_types11 = require("@sphereon/ssi-types");
 
 // lib/OpenID4VCIClientV1_0_15.ts
-var import_oid4vci_common18 = require("@sphereon/oid4vci-common");
-var import_ssi_types9 = require("@sphereon/ssi-types");
+var import_oid4vci_common20 = require("@sphereon/oid4vci-common");
+var import_ssi_types10 = require("@sphereon/ssi-types");
 
 // lib/NonceClient.ts
-var import_oid4vci_common17 = require("@sphereon/oid4vci-common");
+var import_oid4vci_common19 = require("@sphereon/oid4vci-common");
 var sendNonceRequest = /* @__PURE__ */ __name(async (nonceEndpointUrl, opts) => {
-  return await (0, import_oid4vci_common17.formPost)(nonceEndpointUrl, new URLSearchParams(), {
+  return await (0, import_oid4vci_common19.formPost)(nonceEndpointUrl, new URLSearchParams(), {
     customHeaders: opts?.headers
   });
 }, "sendNonceRequest");
@@ -2090,14 +2539,14 @@ var acquireNonceFromAuthorizationServer = /* @__PURE__ */ __name(async (opts) =>
 }, "acquireNonceFromAuthorizationServer");
 
 // lib/OpenID4VCIClientV1_0_15.ts
-var logger7 = import_ssi_types9.Loggers.DEFAULT.get("sphereon:oid4vci:v15");
+var logger8 = import_ssi_types10.Loggers.DEFAULT.get("sphereon:oid4vci:v15");
 var OpenID4VCIClientV1_0_15 = class _OpenID4VCIClientV1_0_15 {
   static {
     __name(this, "OpenID4VCIClientV1_0_15");
   }
   _state;
   constructor({ credentialOffer, clientId, kid, alg, credentialIssuer, pkce, authorizationRequest, jwk, endpointMetadata, accessTokenResponse, authorizationRequestOpts, authorizationCodeResponse, authorizationURL, keyAttestation }) {
-    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common18.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
+    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common20.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
     if (!issuer) {
       throw Error("No credential issuer supplied or deduced from offer");
     }
@@ -2106,10 +2555,10 @@ var OpenID4VCIClientV1_0_15 = class _OpenID4VCIClientV1_0_15 {
       credentialIssuer: issuer,
       kid,
       alg,
-      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common18.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
+      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common20.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
       pkce: {
         disabled: false,
-        codeChallengeMethod: import_oid4vci_common18.CodeChallengeMethod.S256,
+        codeChallengeMethod: import_oid4vci_common20.CodeChallengeMethod.S256,
         ...pkce
       },
       authorizationRequestOpts,
@@ -2123,7 +2572,7 @@ var OpenID4VCIClientV1_0_15 = class _OpenID4VCIClientV1_0_15 {
     if (!this._state.authorizationRequestOpts) {
       this._state.authorizationRequestOpts = this.syncAuthorizationRequestOpts(authorizationRequest);
     }
-    logger7.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
+    logger8.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
   }
   static async fromCredentialIssuer({ kid, alg, retrieveServerMetadata, clientId, credentialIssuer, pkce, authorizationRequest, createAuthorizationRequestURL, keyAttestation }) {
     const client = new _OpenID4VCIClientV1_0_15({
@@ -2166,12 +2615,12 @@ var OpenID4VCIClientV1_0_15 = class _OpenID4VCIClientV1_0_15 {
     if (retrieveServerMetadata !== false) {
       await client.retrieveServerMetadata();
     }
-    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common18.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && createAuthorizationRequestURL !== false) {
+    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common20.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && createAuthorizationRequestURL !== false) {
       await client.createAuthorizationRequestUrl({
         authorizationRequest,
         pkce
       });
-      logger7.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
+      logger8.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
     }
     return client;
   }
@@ -2217,11 +2666,11 @@ var OpenID4VCIClientV1_0_15 = class _OpenID4VCIClientV1_0_15 {
       }
     });
     if (response.errorBody) {
-      logger7.debug(`Nonce request error:\r
+      logger8.debug(`Nonce request error:\r
 ${JSON.stringify(response.errorBody)}`);
       return Promise.reject(Error(`Retrieving a nonce from ${this._state.endpointMetadata?.credentialIssuerMetadata?.nonce_endpoint} for issuer ${this.getIssuer()} failed with error: ${response.errorBody.error}${response.errorBody.error_description ? ` - ${response.errorBody.error_description}` : ""}`));
     } else if (!response.successBody) {
-      logger7.debug(`Nonce request error. No success body`);
+      logger8.debug(`Nonce request error. No success body`);
       return Promise.reject(Error(`Retrieving a nonce from ${this._state.endpointMetadata?.credentialIssuerMetadata?.nonce_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
     }
     this._state.cachedCNonce = response.successBody.c_nonce;
@@ -2241,12 +2690,12 @@ ${JSON.stringify(response.errorBody)}`);
       ...opts
     });
     if (response.errorBody) {
-      logger7.debug(`Authorization code error:\r
+      logger8.debug(`Authorization code error:\r
 ${JSON.stringify(response.errorBody)}`);
       const error = response.errorBody;
       return Promise.reject(error);
     } else if (!response.successBody) {
-      logger7.debug(`Authorization code error. No success body`);
+      logger8.debug(`Authorization code error. No success body`);
       return Promise.reject(Error(`Retrieving an authorization code token from ${this._state.endpointMetadata?.authorization_challenge_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
     }
     return {
@@ -2318,11 +2767,11 @@ ${JSON.stringify(response.errorBody)}`);
         }
       });
       if (response.errorBody) {
-        logger7.debug(`Access token error:\r
+        logger8.debug(`Access token error:\r
 ${JSON.stringify(response.errorBody)}`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
       } else if (!response.successBody) {
-        logger7.debug(`Access token error. No success body`);
+        logger8.debug(`Access token error. No success body`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
       }
       this._state.accessTokenResponse = response.successBody;
@@ -2344,7 +2793,7 @@ ${JSON.stringify(response.errorBody)}`);
       jwk,
       kid
     ].filter((v) => v !== void 0).length > 1) {
-      throw new Error(import_oid4vci_common18.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
+      throw new Error(import_oid4vci_common20.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
     }
     if (alg) this._state.alg = alg;
     if (jwk) this._state.jwk = jwk;
@@ -2365,7 +2814,7 @@ ${JSON.stringify(response.errorBody)}`);
     } else if (credentialConfigurationId) {
       requestBuilder.withCredentialConfigurationId(credentialConfigurationId);
     }
-    const issuerState = this.issuerSupportedFlowTypes().includes(import_oid4vci_common18.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this._state.cachedCNonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
+    const issuerState = this.issuerSupportedFlowTypes().includes(import_oid4vci_common20.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this._state.cachedCNonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
     requestBuilder.withIssuerState(issuerState);
     requestBuilder.withTokenFromResponse(this.accessTokenResponse);
     requestBuilder.withDeferredCredentialAwait(deferredCredentialAwait ?? false, deferredCredentialIntervalInMS);
@@ -2411,7 +2860,7 @@ ${JSON.stringify(response.errorBody)}`);
     if (this._state.kid) {
       proofBuilder.withKid(this._state.kid);
     }
-    if (this.clientId && (!this.credentialOffer || this.credentialOffer.supportedFlows.includes(import_oid4vci_common18.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && !this.credentialOffer.preAuthorizedCode)) {
+    if (this.clientId && (!this.credentialOffer || this.credentialOffer.supportedFlows.includes(import_oid4vci_common20.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && !this.credentialOffer.preAuthorizedCode)) {
       proofBuilder.withClientId(this.clientId);
     }
     if (jti) {
@@ -2431,11 +2880,11 @@ ${JSON.stringify(response.errorBody)}`);
     });
     this._state.dpopResponseParams = response.params;
     if (response.errorBody) {
-      logger7.debug(`Credential request error:\r
+      logger8.debug(`Credential request error:\r
 ${JSON.stringify(response.errorBody)}`);
       throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
     } else if (!response.successBody) {
-      logger7.debug(`Credential request error. No success body`);
+      logger8.debug(`Credential request error. No success body`);
       throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
     }
     return {
@@ -2450,7 +2899,7 @@ ${JSON.stringify(response.errorBody)}`);
     return JSON.stringify(this._state);
   }
   getCredentialsSupported(restrictToInitiationTypes, format) {
-    return (0, import_oid4vci_common18.getSupportedCredentials)({
+    return (0, import_oid4vci_common20.getSupportedCredentials)({
       issuerMetadata: this.endpointMetadata.credentialIssuerMetadata,
       version: this.version(),
       format,
@@ -2470,7 +2919,7 @@ ${JSON.stringify(response.errorBody)}`);
   }
   issuerSupportedFlowTypes() {
     return this.credentialOffer?.supportedFlows ?? (this._state.endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint ?? this._state.endpointMetadata?.authorization_server ? [
-      import_oid4vci_common18.AuthzFlowType.AUTHORIZATION_CODE_FLOW
+      import_oid4vci_common20.AuthzFlowType.AUTHORIZATION_CODE_FLOW
     ] : []);
   }
   isFlowTypeSupported(flowType) {
@@ -2486,7 +2935,7 @@ ${JSON.stringify(response.errorBody)}`);
     return this._state.credentialOffer;
   }
   version() {
-    return import_oid4vci_common18.OpenId4VCIVersion.VER_1_0_15;
+    return import_oid4vci_common20.OpenId4VCIVersion.VER_1_0_15;
   }
   get endpointMetadata() {
     this.assertServerMetadata();
@@ -2595,7 +3044,7 @@ ${JSON.stringify(response.errorBody)}`);
     };
     if (!authorizationRequestOpts) {
       authorizationRequestOpts = {
-        redirectUri: `${import_oid4vci_common18.DefaultURISchemes.CREDENTIAL_OFFER}://`
+        redirectUri: `${import_oid4vci_common20.DefaultURISchemes.CREDENTIAL_OFFER}://`
       };
     }
     const clientId = authorizationRequestOpts.clientId ?? this._state.clientId;
@@ -2606,7 +3055,7 @@ ${JSON.stringify(response.errorBody)}`);
   getAuthorizationCode = /* @__PURE__ */ __name((authorizationResponse, code) => {
     if (authorizationResponse) {
       this._state.authorizationCodeResponse = {
-        ...(0, import_oid4vci_common18.toAuthorizationResponsePayload)(authorizationResponse)
+        ...(0, import_oid4vci_common20.toAuthorizationResponsePayload)(authorizationResponse)
       };
     } else if (code) {
       this._state.authorizationCodeResponse = {
@@ -2618,14 +3067,14 @@ ${JSON.stringify(response.errorBody)}`);
 };
 
 // lib/OpenID4VCIClient.ts
-var logger8 = import_ssi_types10.Loggers.DEFAULT.get("sphereon:oid4vci");
+var logger9 = import_ssi_types11.Loggers.DEFAULT.get("sphereon:oid4vci");
 var OpenID4VCIClient = class _OpenID4VCIClient {
   static {
     __name(this, "OpenID4VCIClient");
   }
   _state;
   constructor({ credentialOffer, clientId, kid, alg, credentialIssuer, pkce, authorizationRequest, accessToken, jwk, endpointMetadata, accessTokenResponse, authorizationRequestOpts, authorizationCodeResponse, authorizationURL }) {
-    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common19.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
+    const issuer = credentialIssuer ?? (credentialOffer ? (0, import_oid4vci_common21.getIssuerFromCredentialOfferPayload)(credentialOffer.credential_offer) : void 0);
     if (!issuer) {
       throw Error("No credential issuer supplied or deduced from offer");
     }
@@ -2635,10 +3084,10 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
       kid,
       alg,
       // TODO: We need to refactor this and always explicitly call createAuthorizationRequestUrl, so we can have a credential selection first and use the kid as a default for the client id
-      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common19.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
+      clientId: clientId ?? (credentialOffer && (0, import_oid4vci_common21.getClientIdFromCredentialOfferPayload)(credentialOffer.credential_offer)) ?? kid?.split("#")[0],
       pkce: {
         disabled: false,
-        codeChallengeMethod: import_oid4vci_common19.CodeChallengeMethod.S256,
+        codeChallengeMethod: import_oid4vci_common21.CodeChallengeMethod.S256,
         ...pkce
       },
       authorizationRequestOpts,
@@ -2652,7 +3101,7 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
     if (!this._state.authorizationRequestOpts) {
       this._state.authorizationRequestOpts = this.syncAuthorizationRequestOpts(authorizationRequest);
     }
-    logger8.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
+    logger9.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
   }
   static async fromCredentialIssuer({ kid, alg, retrieveServerMetadata, clientId, credentialIssuer, pkce, authorizationRequest, createAuthorizationRequestURL, endpointMetadata }) {
     const client = new _OpenID4VCIClient({
@@ -2695,12 +3144,12 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
     if (retrieveServerMetadata === void 0 || retrieveServerMetadata) {
       await client.retrieveServerMetadata();
     }
-    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common19.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL)) {
+    if (credentialOfferClient.supportedFlows.includes(import_oid4vci_common21.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && (createAuthorizationRequestURL === void 0 || createAuthorizationRequestURL)) {
       await client.createAuthorizationRequestUrl({
         authorizationRequest,
         pkce
       });
-      logger8.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
+      logger9.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
     }
     return client;
   }
@@ -2757,12 +3206,12 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
       ...opts
     });
     if (response.errorBody) {
-      logger8.debug(`Authorization code error:\r
+      logger9.debug(`Authorization code error:\r
 ${JSON.stringify(response.errorBody)}`);
       const error = response.errorBody;
       return Promise.reject(error);
     } else if (!response.successBody) {
-      logger8.debug(`Authorization code error. No success body`);
+      logger9.debug(`Authorization code error. No success body`);
       return Promise.reject(Error(`Retrieving an authorization code token from ${this._state.endpointMetadata?.authorization_challenge_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
     }
     return {
@@ -2834,11 +3283,12 @@ ${JSON.stringify(response.errorBody)}`);
         }
       });
       if (response.errorBody) {
-        logger8.debug(`Access token error:\r
-${JSON.stringify(response.errorBody)}`);
-        throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
+        const errorDetail = typeof response.errorBody === "object" ? JSON.stringify(response.errorBody) : String(response.errorBody);
+        logger9.error(`Access token error response (status ${response.origResponse.status}):\r
+${errorDetail}`);
+        throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}. Response: ${errorDetail}`);
       } else if (!response.successBody) {
-        logger8.debug(`Access token error. No success body`);
+        logger9.debug(`Access token error. No success body`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
       }
       this._state.accessTokenResponse = response.successBody;
@@ -2855,23 +3305,21 @@ ${JSON.stringify(response.errorBody)}`);
       }
     };
   }
-  async acquireCredentials({ credentialTypes, context, proofCallbacks, format, kid, jwk, alg, jti, deferredCredentialAwait, deferredCredentialIntervalInMS, createDPoPOpts }) {
+  async acquireCredentials({ credentialIdentifier, credentialConfigurationId, credentialTypes, context, proofCallbacks, format, kid, jwk, alg, jti, deferredCredentialAwait, deferredCredentialIntervalInMS, createDPoPOpts }) {
     if ([
       jwk,
       kid
     ].filter((v) => v !== void 0).length > 1) {
-      throw new Error(import_oid4vci_common19.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
+      throw new Error(import_oid4vci_common21.KID_JWK_X5C_ERROR + `. jwk: ${jwk !== void 0}, kid: ${kid !== void 0}`);
     }
     if (alg) this._state.alg = alg;
     if (jwk) this._state.jwk = jwk;
     if (kid) this._state.kid = kid;
-    if (this.version() === import_oid4vci_common19.OpenId4VCIVersion.VER_1_0_15 && this.hasNonceEndpoint()) {
-      if (!this._state.cachedCNonce) {
-        try {
-          await this.acquireNonceViaV15Delegate();
-        } catch (e) {
-          return Promise.reject(Error(`failed to acquire nonce: ${String(e)}`));
-        }
+    if (!this._state.cachedCNonce && this.hasNonceEndpoint()) {
+      try {
+        await this.acquireNonceViaV15Delegate();
+      } catch (e) {
+        return Promise.reject(Error(`failed to acquire nonce: ${String(e)}`));
       }
     }
     let requestBuilder = this.credentialOffer ? CredentialRequestClientBuilderV1_0_15.fromCredentialOffer({
@@ -2880,15 +3328,22 @@ ${JSON.stringify(response.errorBody)}`);
     }) : CredentialRequestClientBuilderV1_0_15.fromCredentialIssuer({
       credentialIssuer: this.getIssuer(),
       credentialTypes,
+      credentialIdentifier,
+      credentialConfigurationId,
       metadata: this.endpointMetadata,
       version: this.version()
     });
-    const issuerState = this.issuerSupportedFlowTypes().includes(import_oid4vci_common19.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this.accessTokenResponse?.c_nonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
+    if (credentialIdentifier) {
+      requestBuilder.withCredentialIdentifier(credentialIdentifier);
+    } else if (credentialConfigurationId) {
+      requestBuilder.withCredentialConfigurationId(credentialConfigurationId);
+    }
+    const issuerState = this.issuerSupportedFlowTypes().includes(import_oid4vci_common21.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this.accessTokenResponse?.c_nonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
     requestBuilder.withIssuerState(issuerState);
     requestBuilder.withTokenFromResponse(this.accessTokenResponse);
     requestBuilder.withDeferredCredentialAwait(deferredCredentialAwait ?? false, deferredCredentialIntervalInMS);
     let subjectIssuance;
-    if (this.endpointMetadata?.credentialIssuerMetadata) {
+    if (this.endpointMetadata?.credentialIssuerMetadata && credentialTypes) {
       const metadata = this.endpointMetadata.credentialIssuerMetadata;
       const types = Array.isArray(credentialTypes) ? credentialTypes : [
         credentialTypes
@@ -2896,7 +3351,7 @@ ${JSON.stringify(response.errorBody)}`);
       if (metadata.credentials_supported && Array.isArray(metadata.credentials_supported)) {
         let typeSupported = false;
         metadata.credentials_supported.forEach((supportedCredential) => {
-          const subTypes = (0, import_oid4vci_common19.getTypesFromCredentialSupported)(supportedCredential);
+          const subTypes = (0, import_oid4vci_common21.getTypesFromCredentialSupported)(supportedCredential);
           if (subTypes.every((t, i) => types[i] === t) || types.length === 1 && (types[0] === supportedCredential.id || subTypes.includes(types[0]))) {
             typeSupported = true;
             if (supportedCredential.credential_subject_issuance) {
@@ -2932,7 +3387,7 @@ ${JSON.stringify(response.errorBody)}`);
       if (this._state.kid) {
         proofBuilder.withKid(this._state.kid);
       }
-      if (this.clientId && (!this.credentialOffer || this.credentialOffer.supportedFlows.includes(import_oid4vci_common19.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && !this.credentialOffer.preAuthorizedCode)) {
+      if (this.clientId && (!this.credentialOffer || this.credentialOffer.supportedFlows.includes(import_oid4vci_common21.AuthzFlowType.AUTHORIZATION_CODE_FLOW) && !this.credentialOffer.preAuthorizedCode)) {
         proofBuilder.withClientId(this.clientId);
       }
       if (jti) {
@@ -2943,7 +3398,7 @@ ${JSON.stringify(response.errorBody)}`);
       }
       const response = await credentialRequestClient.acquireCredentialsUsingProof({
         proofInput: proofBuilder,
-        credentialTypes,
+        credentialTypes: credentialTypes ?? credentialIdentifier ?? credentialConfigurationId,
         context,
         format,
         subjectIssuance,
@@ -2951,11 +3406,12 @@ ${JSON.stringify(response.errorBody)}`);
       });
       this._state.dpopResponseParams = response.params;
       if (response.errorBody) {
-        logger8.debug(`Credential request error:\r
+        logger9.debug(`Credential request error:\r
 ${JSON.stringify(response.errorBody)}`);
-        throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
+        const errDesc = response.errorBody.error_description ? `: ${response.errorBody.error_description}` : response.errorBody.error ? `: ${response.errorBody.error}` : "";
+        throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}${errDesc}`);
       } else if (!response.successBody) {
-        logger8.debug(`Credential request error. No success body`);
+        logger9.debug(`Credential request error. No success body`);
         throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
       }
       return {
@@ -3003,11 +3459,12 @@ ${JSON.stringify(response.errorBody)}`);
       });
       this._state.dpopResponseParams = response2.params;
       if (response2.errorBody) {
-        logger8.debug(`Credential request error (after retry):\r
+        logger9.debug(`Credential request error (after retry):\r
 ${JSON.stringify(response2.errorBody)}`);
-        return Promise.reject(Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed after retry with status: ${response2.origResponse.status}`));
+        const errDesc2 = response2.errorBody.error_description ? `: ${response2.errorBody.error_description}` : response2.errorBody.error ? `: ${response2.errorBody.error}` : "";
+        return Promise.reject(Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed after retry with status: ${response2.origResponse.status}${errDesc2}`));
       } else if (!response2.successBody) {
-        logger8.debug(`Credential request error after retry. No success body`);
+        logger9.debug(`Credential request error after retry. No success body`);
         return Promise.reject(Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed after retry as there was no success response body`));
       }
       return {
@@ -3023,7 +3480,7 @@ ${JSON.stringify(response2.errorBody)}`);
     return JSON.stringify(this._state);
   }
   getCredentialsSupported(format) {
-    return (0, import_oid4vci_common19.getSupportedCredentials)({
+    return (0, import_oid4vci_common21.getSupportedCredentials)({
       issuerMetadata: this.endpointMetadata.credentialIssuerMetadata,
       version: this.version(),
       format
@@ -3034,7 +3491,7 @@ ${JSON.stringify(response2.errorBody)}`);
   }
   issuerSupportedFlowTypes() {
     return this.credentialOffer?.supportedFlows ?? (this._state.endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint ?? this._state.endpointMetadata?.authorization_server ? [
-      import_oid4vci_common19.AuthzFlowType.AUTHORIZATION_CODE_FLOW
+      import_oid4vci_common21.AuthzFlowType.AUTHORIZATION_CODE_FLOW
     ] : []);
   }
   isFlowTypeSupported(flowType) {
@@ -3050,17 +3507,17 @@ ${JSON.stringify(response2.errorBody)}`);
     return this._state.credentialOffer;
   }
   version() {
-    if (this.credentialOffer?.version && this.credentialOffer.version !== import_oid4vci_common19.OpenId4VCIVersion.VER_UNKNOWN) {
-      return this.credentialOffer.version;
-    }
     const metadata = this._state.endpointMetadata;
     if (metadata?.credentialIssuerMetadata) {
-      const versions = (0, import_oid4vci_common19.determineVersionsFromIssuerMetadata)(metadata.credentialIssuerMetadata);
-      if (versions.length > 0 && !versions.includes(import_oid4vci_common19.OpenId4VCIVersion.VER_UNKNOWN)) {
+      const versions = (0, import_oid4vci_common21.determineVersionsFromIssuerMetadata)(metadata.credentialIssuerMetadata);
+      if (versions.length > 0 && !versions.includes(import_oid4vci_common21.OpenId4VCIVersion.VER_UNKNOWN)) {
         return versions[0];
       }
     }
-    return import_oid4vci_common19.OpenId4VCIVersion.VER_1_0_15;
+    if (this.credentialOffer?.version && this.credentialOffer.version !== import_oid4vci_common21.OpenId4VCIVersion.VER_UNKNOWN) {
+      return this.credentialOffer.version;
+    }
+    return import_oid4vci_common21.OpenId4VCIVersion.VER_1_0;
   }
   get endpointMetadata() {
     this.assertServerMetadata();
@@ -3166,7 +3623,7 @@ ${JSON.stringify(response2.errorBody)}`);
     };
     if (!authorizationRequestOpts) {
       authorizationRequestOpts = {
-        redirectUri: `${import_oid4vci_common19.DefaultURISchemes.CREDENTIAL_OFFER}://`
+        redirectUri: `${import_oid4vci_common21.DefaultURISchemes.CREDENTIAL_OFFER}://`
       };
     }
     const clientId = authorizationRequestOpts.clientId ?? this._state.clientId;
@@ -3177,7 +3634,7 @@ ${JSON.stringify(response2.errorBody)}`);
   getAuthorizationCode = /* @__PURE__ */ __name((authorizationResponse, code) => {
     if (authorizationResponse) {
       this._state.authorizationCodeResponse = {
-        ...(0, import_oid4vci_common19.toAuthorizationResponsePayload)(authorizationResponse)
+        ...(0, import_oid4vci_common21.toAuthorizationResponsePayload)(authorizationResponse)
       };
     } else if (code) {
       this._state.authorizationCodeResponse = {
@@ -3208,7 +3665,8 @@ ${JSON.stringify(response2.errorBody)}`);
     state.cachedCNonce = v15Client.state.cachedCNonce;
   }
   shouldRetryWithFreshNonce(err) {
-    if (!this.hasNonceEndpoint() && this.version() !== import_oid4vci_common19.OpenId4VCIVersion.VER_1_0_15) {
+    const canRetry = this.hasNonceEndpoint() || this.version() >= import_oid4vci_common21.OpenId4VCIVersion.VER_1_0;
+    if (!canRetry) {
       return false;
     }
     const status = err?.response?.status ?? err?.status;
@@ -3235,5 +3693,5 @@ ${JSON.stringify(response2.errorBody)}`);
 };
 
 // lib/index.ts
-var LOG2 = import_oid4vci_common20.VCI_LOGGERS.get("sphereon:oid4vci:client");
+var LOG2 = import_oid4vci_common22.VCI_LOGGERS.get("sphereon:oid4vci:client");
 //# sourceMappingURL=index.cjs.map