@sphereon/oid4vci-client 0.20.2-next.2 → 0.21.0

package/dist/index.js

@@ -86,7 +86,7 @@ import { uuidv4 } from "@sphereon/oid4vc-common";
 import { OpenId4VCIVersion } from "@sphereon/oid4vci-common";
 
 // lib/ProofOfPossessionBuilder.ts
-import { createProofOfPossession, NO_JWT_PROVIDED, PROOF_CANT_BE_CONSTRUCTED } from "@sphereon/oid4vci-common";
+import { createCwtProofOfPossession, createProofOfPossession, NO_JWT_PROVIDED, PROOF_CANT_BE_CONSTRUCTED } from "@sphereon/oid4vci-common";
 var ProofOfPossessionBuilder = class _ProofOfPossessionBuilder {
   static {
     __name(this, "ProofOfPossessionBuilder");
@@ -105,6 +105,8 @@ var ProofOfPossessionBuilder = class _ProofOfPossessionBuilder {
   jti;
   cNonce;
   typ;
+  proofType = "jwt";
+  coseKey;
   constructor({ proof, callbacks, jwt, accessTokenResponse, version, mode = "pop" }) {
     this.mode = mode;
     this.proof = proof;
@@ -189,6 +191,14 @@ var ProofOfPossessionBuilder = class _ProofOfPossessionBuilder {
     this.typ = typ;
     return this;
   }
+  withProofType(proofType) {
+    this.proofType = proofType;
+    return this;
+  }
+  withCoseKey(coseKey) {
+    this.coseKey = coseKey;
+    return this;
+  }
   withAccessTokenNonce(cNonce) {
     this.cNonce = cNonce;
     return this;
@@ -238,6 +248,17 @@ var ProofOfPossessionBuilder = class _ProofOfPossessionBuilder {
     if (this.proof) {
       return Promise.resolve(this.proof);
     } else if (this.callbacks) {
+      if (this.proofType === "cwt" && this.callbacks.cwtSignCallback) {
+        return await createCwtProofOfPossession(this.callbacks, {
+          iss: this.clientId ?? this.issuer,
+          aud: Array.isArray(this.aud) ? this.aud[0] : this.aud ?? this.issuer ?? "",
+          nonce: this.cNonce,
+          alg: this.alg,
+          jwk: this.jwk,
+          kid: this.kid,
+          coseKey: this.coseKey
+        });
+      }
       return await createProofOfPossession(this.mode, this.callbacks, {
         typ: this.typ ?? (this.mode === "JWT" ? "JWT" : "openid4vci-proof+jwt"),
         kid: this.kid,
@@ -258,7 +279,7 @@ var ProofOfPossessionBuilder = class _ProofOfPossessionBuilder {
 
 // lib/functions/AccessTokenUtil.ts
 var createJwtBearerClientAssertion = /* @__PURE__ */ __name(async (request, opts) => {
-  const { asOpts, credentialIssuer } = opts;
+  const { asOpts, credentialIssuer, metadata } = opts;
   if (asOpts?.clientOpts?.clientAssertionType === "urn:ietf:params:oauth:client-assertion-type:jwt-bearer") {
     const { clientId = request.client_id, signCallbacks, alg } = asOpts.clientOpts;
     let { kid } = asOpts.clientOpts;
@@ -274,6 +295,7 @@ var createJwtBearerClientAssertion = /* @__PURE__ */ __name(async (request, opts
     if (clientId.startsWith("http") && kid.includes("#")) {
       kid = kid.split("#")[1];
     }
+    const aud = metadata?.token_endpoint ?? asOpts?.tokenEndpoint ?? credentialIssuer;
     const jwt = {
       header: {
         typ: "JWT",
@@ -283,16 +305,16 @@ var createJwtBearerClientAssertion = /* @__PURE__ */ __name(async (request, opts
       payload: {
         iss: clientId,
         sub: clientId,
-        aud: credentialIssuer,
+        aud,
         jti: uuidv4(),
-        exp: Math.floor(Date.now()) / 1e3 + 60,
-        iat: Math.floor(Date.now()) / 1e3 - 60
+        exp: Math.floor(Date.now() / 1e3) + 60,
+        iat: Math.floor(Date.now() / 1e3) - 60
       }
     };
     const pop = await ProofOfPossessionBuilder.fromJwt({
       jwt,
       callbacks: signCallbacks,
-      version: opts.version ?? OpenId4VCIVersion.VER_1_0_15,
+      version: opts.version ?? OpenId4VCIVersion.VER_1_0,
       mode: "JWT"
     }).build();
     request.client_assertion_type = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
@@ -389,7 +411,7 @@ function shouldRetryResourceRequestWithDPoPNonce(response) {
 __name(shouldRetryResourceRequestWithDPoPNonce, "shouldRetryResourceRequestWithDPoPNonce");
 
 // lib/MetadataClientV1_0_15.ts
-import { getIssuerFromCredentialOfferPayload, WellKnownEndpoints } from "@sphereon/oid4vci-common";
+import { getIssuerFromCredentialOfferPayload, processSignedMetadata, WellKnownEndpoints } from "@sphereon/oid4vci-common";
 import { Loggers as Loggers2 } from "@sphereon/ssi-types";
 var logger2 = Loggers2.DEFAULT.get("sphereon:oid4vci:metadata");
 var MetadataClientV1_0_15 = class _MetadataClientV1_0_15 {
@@ -546,9 +568,17 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
       },
       ...notification_endpoint && {
         notification_endpoint
+      },
+      ...ci.signed_metadata && {
+        signed_metadata: ci.signed_metadata
       }
     };
     logger2.debug(`Issuer ${issuer} token endpoint ${token_endpoint}, credential endpoint ${credential_endpoint}`);
+    const processedMetadata = await processSignedMetadata({
+      metadata: v15CredentialIssuerMetadata,
+      issuer,
+      signedMetadataVerifyCallback: opts?.signedMetadataVerifyCallback
+    });
     return {
       issuer,
       token_endpoint,
@@ -556,7 +586,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
       authorization_challenge_endpoint,
       notification_endpoint,
       authorizationServerType,
-      credentialIssuerMetadata: v15CredentialIssuerMetadata,
+      credentialIssuerMetadata: processedMetadata,
       authorizationServerMetadata: authMetadata
     };
   }
@@ -666,6 +696,9 @@ var AccessTokenClient = class _AccessTokenClient {
       ...opts,
       credentialIssuer
     });
+    if (request.client_assertion) {
+      delete request.client_id;
+    }
     if (!credentialOfferRequest || credentialOfferRequest.supportedFlows.includes(AuthzFlowType.AUTHORIZATION_CODE_FLOW)) {
       request.grant_type = GrantTypes.AUTHORIZATION_CODE;
       request.code = code;
@@ -677,8 +710,11 @@ var AccessTokenClient = class _AccessTokenClient {
     }
     if (credentialOfferRequest?.supportedFlows.includes(AuthzFlowType.PRE_AUTHORIZED_CODE_FLOW)) {
       this.assertAlphanumericPin(opts.pinMetadata, pin);
-      request.user_pin = pin;
-      request.tx_code = pin;
+      if (opts.pinMetadata?.txCode) {
+        request.tx_code = pin;
+      } else {
+        request.user_pin = pin;
+      }
       request.grant_type = GrantTypes.PRE_AUTHORIZED_CODE;
       request[PRE_AUTH_CODE_LITERAL2] = credentialOfferRequest?.credential_offer.grants?.[PRE_AUTH_GRANT_LITERAL2]?.[PRE_AUTH_CODE_LITERAL2];
       return request;
@@ -761,9 +797,11 @@ var AccessTokenClient = class _AccessTokenClient {
     }
   }
   async sendAuthCode(requestTokenURL, accessTokenRequest, opts) {
-    return await formPost(requestTokenURL, convertJsonToURI(accessTokenRequest, {
+    const body = convertJsonToURI(accessTokenRequest, {
       mode: JsonURIMode.X_FORM_WWW_URLENCODED
-    }), {
+    });
+    LOG.info(`Token request to ${requestTokenURL}: ${body}`);
+    return await formPost(requestTokenURL, body, {
       customHeaders: opts?.headers ? opts.headers : void 0
     });
   }
@@ -808,7 +846,7 @@ import { CodeChallengeMethod as CodeChallengeMethod2, convertJsonToURI as conver
 import { Loggers as Loggers4 } from "@sphereon/ssi-types";
 
 // lib/MetadataClient.ts
-import { determineSpecVersionFromOffer, getIssuerFromCredentialOfferPayload as getIssuerFromCredentialOfferPayload3, OpenId4VCIVersion as OpenId4VCIVersion2, WellKnownEndpoints as WellKnownEndpoints2 } from "@sphereon/oid4vci-common";
+import { determineSpecVersionFromOffer, determineVersionsFromIssuerMetadata, getIssuerFromCredentialOfferPayload as getIssuerFromCredentialOfferPayload3, OpenId4VCIVersion as OpenId4VCIVersion2, processSignedMetadata as processSignedMetadata2, WellKnownEndpoints as WellKnownEndpoints2 } from "@sphereon/oid4vci-common";
 import { Loggers as Loggers3 } from "@sphereon/ssi-types";
 var logger3 = Loggers3.DEFAULT.get("sphereon:oid4vci:metadata");
 var MetadataClient = class _MetadataClient {
@@ -821,6 +859,10 @@ var MetadataClient = class _MetadataClient {
   * @param credentialOffer
   */
   static async retrieveAllMetadataFromCredentialOffer(credentialOffer) {
+    const issuer = getIssuerFromCredentialOfferPayload3(credentialOffer.credential_offer);
+    if (issuer) {
+      return _MetadataClient.retrieveAllMetadata(issuer);
+    }
     const openId4VCIVersion = determineSpecVersionFromOffer(credentialOffer.credential_offer);
     if (openId4VCIVersion >= OpenId4VCIVersion2.VER_1_0_15) {
       return await MetadataClientV1_0_15.retrieveAllMetadataFromCredentialOffer(credentialOffer);
@@ -834,12 +876,7 @@ var MetadataClient = class _MetadataClient {
   static async retrieveAllMetadataFromCredentialOfferRequest(request) {
     const issuer = getIssuerFromCredentialOfferPayload3(request);
     if (issuer) {
-      const openId4VCIVersion = determineSpecVersionFromOffer(request);
-      if (openId4VCIVersion >= OpenId4VCIVersion2.VER_1_0_15) {
-        return MetadataClientV1_0_15.retrieveAllMetadataFromCredentialOfferRequest(request);
-      } else {
-        return Promise.reject(Error(`OpenId4VCIVersion ${openId4VCIVersion} is not supported in retrieveAllMetadataFromCredentialOfferRequest`));
-      }
+      return _MetadataClient.retrieveAllMetadata(issuer);
     }
     throw new Error("can't retrieve metadata from CredentialOfferRequest. No issuer field is present");
   }
@@ -959,12 +996,20 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
       return Promise.reject(Error(`No /.well-known/openid-credential-issuer at ${issuer}.`));
     }
     logger3.debug(`Issuer ${issuer} token endpoint ${token_endpoint}, credential endpoint ${credential_endpoint}`);
+    const versions = credentialIssuerMetadata ? determineVersionsFromIssuerMetadata(credentialIssuerMetadata) : [];
+    const detectedVersion = versions.length > 0 ? versions[0] : OpenId4VCIVersion2.VER_1_0;
+    logger3.debug(`Detected OID4VCI version ${detectedVersion} for issuer ${issuer}`);
+    const processedMetadata = await processSignedMetadata2({
+      metadata: credentialIssuerMetadata,
+      issuer,
+      signedMetadataVerifyCallback: opts?.signedMetadataVerifyCallback
+    });
     return {
       issuer,
       token_endpoint,
       credential_endpoint,
       deferred_credential_endpoint,
-      nonce_endpoint: credentialIssuerMetadata.nonce_endpoint,
+      nonce_endpoint: credentialIssuerMetadata?.nonce_endpoint,
       authorization_servers: authorization_server ? [
         authorization_server
       ] : authorization_servers ?? [
@@ -973,7 +1018,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
       authorization_endpoint,
       authorization_challenge_endpoint,
       authorizationServerType,
-      credentialIssuerMetadata,
+      credentialIssuerMetadata: processedMetadata,
       authorizationServerMetadata: authMetadata
     };
   }
@@ -1034,7 +1079,7 @@ async function createSignedAuthRequestWhenNeeded(requestObject, opts) {
     const pop = await ProofOfPossessionBuilder.fromJwt({
       jwt,
       callbacks: opts.signCallbacks,
-      version: OpenId4VCIVersion3.VER_1_0_15,
+      version: OpenId4VCIVersion3.VER_1_0,
       mode: "JWT"
     }).build();
     requestObject["request"] = pop.jwt;
@@ -1091,8 +1136,8 @@ var createAuthorizationRequestUrl = /* @__PURE__ */ __name(async ({ pkce, endpoi
     if ("credentials" in credentialOffer.credential_offer) {
       throw new Error("CredentialOffer format is wrong.");
     }
-    const ver = version ?? determineSpecVersionFromOffer2(credentialOffer.credential_offer) ?? OpenId4VCIVersion3.VER_1_0_15;
-    const creds = ver === OpenId4VCIVersion3.VER_1_0_15 ? filterSupportedCredentials(credentialOffer.credential_offer, credentialConfigurationSupported) : [];
+    const ver = version ?? determineSpecVersionFromOffer2(credentialOffer.credential_offer) ?? OpenId4VCIVersion3.VER_1_0;
+    const creds = ver >= OpenId4VCIVersion3.VER_1_0_15 ? filterSupportedCredentials(credentialOffer.credential_offer, credentialConfigurationSupported) : [];
     authorizationDetails = creds.flatMap((cred) => {
       const locations = [
         credentialOffer?.credential_offer.credential_issuer ?? endpointMetadata.issuer
@@ -1523,18 +1568,61 @@ ${JSON.stringify(response, null, 2)}`);
     if (proofInput) {
       proof = await buildProof(proofInput, opts);
     }
-    if (this.version() >= OpenId4VCIVersion4.VER_1_0_15) {
+    const issuer_state = this.credentialRequestOpts.issuerState;
+    const commonBody = {
+      ...issuer_state && {
+        issuer_state
+      },
+      ...proof && {
+        proof
+      },
+      ...opts.subjectIssuance
+    };
+    if (this.version() >= OpenId4VCIVersion4.VER_1_0) {
       const authDetail = findAuthorizationDetail(this.credentialRequestOpts.authorizationDetails, credentialConfigurationId ?? credentialIdentifier);
-      const issuer_state = this.credentialRequestOpts.issuerState;
-      const commonBody = {
+      const authDetailObj = authDetail && typeof authDetail === "object" ? authDetail : null;
+      const configId = credentialConfigurationId ?? authDetailObj?.credential_configuration_id ?? this._credentialRequestOpts.credentialConfigurationId;
+      if (!configId) {
+        return Promise.reject(Error("credential_configuration_id is required for 1.0 final credential request"));
+      }
+      const identifiers = this._credentialRequestOpts.credentialIdentifiers ?? (authDetailObj?.credential_identifiers && authDetailObj.credential_identifiers.length > 0 ? authDetailObj.credential_identifiers : credentialIdentifier ? [
+        credentialIdentifier
+      ] : void 0);
+      let proofsBody = {};
+      if (proof) {
+        if (proof.proof_type === "cwt" && "cwt" in proof) {
+          proofsBody = {
+            proofs: {
+              cwt: [
+                proof.cwt
+              ]
+            }
+          };
+        } else if ("jwt" in proof) {
+          proofsBody = {
+            proofs: {
+              jwt: [
+                proof.jwt
+              ]
+            }
+          };
+        }
+      }
+      const request = {
+        credential_configuration_id: configId,
+        ...identifiers && identifiers.length > 0 && {
+          credential_identifiers: identifiers
+        },
         ...issuer_state && {
           issuer_state
         },
-        ...proof && {
-          proof
-        },
+        ...proofsBody,
         ...opts.subjectIssuance
       };
+      return request;
+    }
+    if (this.version() >= OpenId4VCIVersion4.VER_1_0_15) {
+      const authDetail = findAuthorizationDetail(this.credentialRequestOpts.authorizationDetails, credentialConfigurationId ?? credentialIdentifier);
       const authDetailObj = authDetail && typeof authDetail === "object" ? authDetail : null;
       if (authDetailObj?.credential_identifier) {
         return {
@@ -1566,7 +1654,7 @@ ${JSON.stringify(response, null, 2)}`);
     throw new Error(`Unsupported version: ${this.version()}`);
   }
   version() {
-    return this.credentialRequestOpts?.version ?? OpenId4VCIVersion4.VER_1_0_15;
+    return this.credentialRequestOpts?.version ?? OpenId4VCIVersion4.VER_1_0;
   }
 };
 
@@ -1734,7 +1822,7 @@ var CredentialOfferClientV1_0_15 = class {
 };
 
 // lib/CredentialRequestClientBuilder.ts
-import { OpenId4VCIVersion as OpenId4VCIVersion7 } from "@sphereon/oid4vci-common";
+import { OpenId4VCIVersion as OpenId4VCIVersion8 } from "@sphereon/oid4vci-common";
 
 // lib/CredentialRequestClientBuilderV1_0_15.ts
 import { determineSpecVersionFromOffer as determineSpecVersionFromOffer3, getIssuerFromCredentialOfferPayload as getIssuerFromCredentialOfferPayload4, OpenId4VCIVersion as OpenId4VCIVersion6 } from "@sphereon/oid4vci-common";
@@ -1895,11 +1983,166 @@ var CredentialRequestClientBuilderV1_0_15 = class _CredentialRequestClientBuilde
   }
 };
 
+// lib/CredentialRequestClientBuilderV1_0.ts
+import { determineSpecVersionFromOffer as determineSpecVersionFromOffer4, getIssuerFromCredentialOfferPayload as getIssuerFromCredentialOfferPayload5, OpenId4VCIVersion as OpenId4VCIVersion7 } from "@sphereon/oid4vci-common";
+var CredentialRequestClientBuilderV1_0 = class _CredentialRequestClientBuilderV1_0 {
+  static {
+    __name(this, "CredentialRequestClientBuilderV1_0");
+  }
+  credentialEndpoint;
+  deferredCredentialEndpoint;
+  nonceEndpoint;
+  deferredCredentialAwait = false;
+  deferredCredentialIntervalInMS = 5e3;
+  credentialIdentifiers;
+  credentialConfigurationId;
+  credentialTypes = [];
+  token;
+  version;
+  subjectIssuance;
+  issuerState;
+  static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialIdentifiers, credentialConfigurationId, credentialTypes }) {
+    const issuer = credentialIssuer;
+    const builder = new _CredentialRequestClientBuilderV1_0();
+    builder.withVersion(version ?? OpenId4VCIVersion7.VER_1_0);
+    builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
+    if (metadata?.deferred_credential_endpoint) {
+      builder.withDeferredCredentialEndpoint(metadata.deferred_credential_endpoint);
+    }
+    if (metadata?.credentialIssuerMetadata?.nonce_endpoint) {
+      builder.withNonceEndpoint(metadata.credentialIssuerMetadata?.nonce_endpoint);
+    }
+    if (credentialIdentifiers) {
+      builder.withCredentialIdentifiers(credentialIdentifiers);
+    }
+    if (credentialConfigurationId) {
+      builder.withCredentialConfigurationId(credentialConfigurationId);
+    }
+    if (credentialTypes) {
+      builder.withCredentialType(credentialTypes);
+    }
+    return builder;
+  }
+  static async fromURI({ uri, metadata }) {
+    const offer = await CredentialOfferClient.fromURI(uri);
+    return _CredentialRequestClientBuilderV1_0.fromCredentialOfferRequest({
+      request: offer,
+      ...offer,
+      metadata,
+      version: offer.version
+    });
+  }
+  static fromCredentialOfferRequest(opts) {
+    const { request, metadata } = opts;
+    const version = opts.version ?? request.version ?? determineSpecVersionFromOffer4(request.original_credential_offer);
+    const builder = new _CredentialRequestClientBuilderV1_0();
+    const issuer = getIssuerFromCredentialOfferPayload5(request.credential_offer) ?? (metadata ? metadata.issuer : void 0);
+    if (!issuer && !metadata?.credential_endpoint) {
+      throw Error(`Issuer could not be determined`);
+    }
+    builder.withVersion(version >= OpenId4VCIVersion7.VER_1_0 ? version : OpenId4VCIVersion7.VER_1_0);
+    builder.withCredentialEndpoint(metadata?.credential_endpoint ?? (issuer.endsWith("/") ? `${issuer}credential` : `${issuer}/credential`));
+    if (metadata?.deferred_credential_endpoint) {
+      builder.withDeferredCredentialEndpoint(metadata.deferred_credential_endpoint);
+    }
+    if (metadata?.credentialIssuerMetadata?.nonce_endpoint) {
+      builder.withNonceEndpoint(metadata.credentialIssuerMetadata.nonce_endpoint);
+    }
+    const ids = request.credential_offer.credential_configuration_ids;
+    if (ids.length && ids.length === 1) {
+      builder.withCredentialConfigurationId(ids[0]);
+    }
+    return builder;
+  }
+  static fromCredentialOffer({ credentialOffer, metadata }) {
+    return _CredentialRequestClientBuilderV1_0.fromCredentialOfferRequest({
+      request: credentialOffer,
+      metadata,
+      version: credentialOffer.version
+    });
+  }
+  withCredentialEndpointFromMetadata(metadata) {
+    this.credentialEndpoint = metadata.credential_endpoint;
+    return this;
+  }
+  withCredentialEndpoint(credentialEndpoint) {
+    this.credentialEndpoint = credentialEndpoint;
+    return this;
+  }
+  withIssuerState(issuerState) {
+    this.issuerState = issuerState;
+    return this;
+  }
+  withDeferredCredentialEndpointFromMetadata(metadata) {
+    this.deferredCredentialEndpoint = metadata.deferred_credential_endpoint;
+    return this;
+  }
+  withDeferredCredentialEndpoint(deferredCredentialEndpoint) {
+    this.deferredCredentialEndpoint = deferredCredentialEndpoint;
+    return this;
+  }
+  withNonceEndpointFromMetadata(metadata) {
+    this.nonceEndpoint = metadata.nonce_endpoint;
+    return this;
+  }
+  withNonceEndpoint(nonceEndpoint) {
+    this.nonceEndpoint = nonceEndpoint;
+    return this;
+  }
+  withDeferredCredentialAwait(deferredCredentialAwait, deferredCredentialIntervalInMS) {
+    this.deferredCredentialAwait = deferredCredentialAwait;
+    this.deferredCredentialIntervalInMS = deferredCredentialIntervalInMS ?? 5e3;
+    return this;
+  }
+  // 1.0 final: credential_identifiers is an OPTIONAL array
+  withCredentialIdentifiers(credentialIdentifiers) {
+    this.credentialIdentifiers = credentialIdentifiers;
+    return this;
+  }
+  // 1.0 final: credential_configuration_id is REQUIRED
+  withCredentialConfigurationId(credentialConfigurationId) {
+    this.credentialConfigurationId = credentialConfigurationId;
+    return this;
+  }
+  withCredentialType(credentialTypes) {
+    this.credentialTypes = Array.isArray(credentialTypes) ? credentialTypes : [
+      credentialTypes
+    ];
+    return this;
+  }
+  withSubjectIssuance(subjectIssuance) {
+    this.subjectIssuance = subjectIssuance;
+    return this;
+  }
+  withToken(accessToken) {
+    this.token = accessToken;
+    return this;
+  }
+  withTokenFromResponse(response) {
+    this.token = response.access_token;
+    return this;
+  }
+  withVersion(version) {
+    this.version = version;
+    return this;
+  }
+  build() {
+    if (!this.version) {
+      this.withVersion(OpenId4VCIVersion7.VER_1_0);
+    }
+    return new CredentialRequestClient(this);
+  }
+};
+
 // lib/CredentialRequestClientBuilder.ts
 function isV1_0_15(builder) {
   return builder.withCredentialIdentifier !== void 0;
 }
 __name(isV1_0_15, "isV1_0_15");
+function isV1_0(builder) {
+  return builder.withCredentialIdentifiers !== void 0;
+}
+__name(isV1_0, "isV1_0");
 var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
   static {
     __name(this, "CredentialRequestClientBuilder");
@@ -1908,16 +2151,28 @@ var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
   constructor(builder) {
     this._builder = builder;
   }
-  static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialIdentifier, credentialTypes }) {
+  static fromCredentialIssuer({ credentialIssuer, metadata, version, credentialIdentifier, credentialIdentifiers, credentialTypes }) {
+    const specVersion = version ?? OpenId4VCIVersion8.VER_1_0;
     let builder;
-    const metadataV15 = metadata;
-    builder = CredentialRequestClientBuilderV1_0_15.fromCredentialIssuer({
-      credentialIssuer,
-      metadata: metadataV15,
-      version,
-      credentialIdentifier,
-      credentialTypes
-    });
+    if (specVersion >= OpenId4VCIVersion8.VER_1_0) {
+      builder = CredentialRequestClientBuilderV1_0.fromCredentialIssuer({
+        credentialIssuer,
+        metadata,
+        version: specVersion,
+        credentialIdentifiers: credentialIdentifiers ?? (credentialIdentifier ? [
+          credentialIdentifier
+        ] : void 0),
+        credentialTypes
+      });
+    } else {
+      builder = CredentialRequestClientBuilderV1_0_15.fromCredentialIssuer({
+        credentialIssuer,
+        metadata,
+        version: specVersion,
+        credentialIdentifier,
+        credentialTypes
+      });
+    }
     return new _CredentialRequestClientBuilder(builder);
   }
   static async fromURI({ uri, metadata }) {
@@ -1968,11 +2223,24 @@ var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
     return this;
   }
   withCredentialIdentifier(credentialIdentifier) {
-    if (this._builder.version === void 0 || this._builder.version < OpenId4VCIVersion7.VER_1_0_15) {
+    if (this._builder.version === void 0 || this._builder.version < OpenId4VCIVersion8.VER_1_0_15) {
       throw new Error("Version of spec should be equal or higher than v1_0_15");
     }
-    ;
-    this._builder.withCredentialIdentifier(credentialIdentifier);
+    if (isV1_0(this._builder)) {
+      this._builder.withCredentialIdentifiers([
+        credentialIdentifier
+      ]);
+    } else if (isV1_0_15(this._builder)) {
+      this._builder.withCredentialIdentifier(credentialIdentifier);
+    }
+    return this;
+  }
+  withCredentialIdentifiers(credentialIdentifiers) {
+    if (isV1_0(this._builder)) {
+      this._builder.withCredentialIdentifiers(credentialIdentifiers);
+    } else if (isV1_0_15(this._builder) && credentialIdentifiers.length > 0) {
+      this._builder.withCredentialIdentifier(credentialIdentifiers[0]);
+    }
     return this;
   }
   withIssuerState(issuerState) {
@@ -2004,13 +2272,192 @@ var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
   }
 };
 
+// lib/MetadataClientV1_0.ts
+import { getIssuerFromCredentialOfferPayload as getIssuerFromCredentialOfferPayload6, processSignedMetadata as processSignedMetadata3, WellKnownEndpoints as WellKnownEndpoints3 } from "@sphereon/oid4vci-common";
+import { Loggers as Loggers7 } from "@sphereon/ssi-types";
+var logger7 = Loggers7.DEFAULT.get("sphereon:oid4vci:metadata");
+var MetadataClientV1_0 = class _MetadataClientV1_0 {
+  static {
+    __name(this, "MetadataClientV1_0");
+  }
+  static async retrieveAllMetadataFromCredentialOffer(credentialOffer) {
+    return _MetadataClientV1_0.retrieveAllMetadataFromCredentialOfferRequest(credentialOffer.credential_offer);
+  }
+  static async retrieveAllMetadataFromCredentialOfferRequest(request) {
+    const issuer = getIssuerFromCredentialOfferPayload6(request);
+    if (issuer) {
+      return _MetadataClientV1_0.retrieveAllMetadata(issuer);
+    }
+    throw new Error("can't retrieve metadata from CredentialOfferRequest. No issuer field is present");
+  }
+  static async retrieveAllMetadata(issuer, opts) {
+    let token_endpoint;
+    let credential_endpoint;
+    let nonce_endpoint;
+    let deferred_credential_endpoint;
+    let notification_endpoint;
+    let authorization_endpoint;
+    let authorization_challenge_endpoint;
+    let authorizationServerType = "OID4VCI";
+    let authorization_servers = [
+      issuer
+    ];
+    const oid4vciResponse = await _MetadataClientV1_0.retrieveOpenID4VCIServerMetadata(issuer, {
+      errorOnNotFound: false
+    });
+    let credentialIssuerMetadata = oid4vciResponse?.successBody;
+    if (credentialIssuerMetadata) {
+      logger7.debug(`Issuer ${issuer} OID4VCI well-known server metadata\r
+${JSON.stringify(credentialIssuerMetadata)}`);
+      credential_endpoint = credentialIssuerMetadata.credential_endpoint;
+      nonce_endpoint = credentialIssuerMetadata.nonce_endpoint;
+      deferred_credential_endpoint = credentialIssuerMetadata.deferred_credential_endpoint;
+      notification_endpoint = credentialIssuerMetadata.notification_endpoint;
+      if (credentialIssuerMetadata.token_endpoint) {
+        token_endpoint = credentialIssuerMetadata.token_endpoint;
+      }
+      authorization_challenge_endpoint = credentialIssuerMetadata.authorization_challenge_endpoint;
+      if (credentialIssuerMetadata.authorization_servers) {
+        authorization_servers = credentialIssuerMetadata.authorization_servers;
+      }
+    }
+    let response = await retrieveWellknown(authorization_servers[0], WellKnownEndpoints3.OPENID_CONFIGURATION, {
+      errorOnNotFound: false
+    });
+    let authMetadata = response.successBody;
+    if (authMetadata) {
+      logger7.debug(`Issuer ${issuer} has OpenID Connect Server metadata in well-known location`);
+      authorizationServerType = "OIDC";
+    } else {
+      response = await retrieveWellknown(authorization_servers[0], WellKnownEndpoints3.OAUTH_AS, {
+        errorOnNotFound: false
+      });
+      authMetadata = response.successBody;
+    }
+    if (!authMetadata) {
+      if (!authorization_servers.includes(issuer)) {
+        throw Error(`Issuer ${issuer} provided a separate authorization server ${authorization_servers}, but that server did not provide metadata`);
+      }
+    } else {
+      logger7.debug(`Issuer ${issuer} has ${authorizationServerType} Server metadata in well-known location`);
+      if (!authMetadata.authorization_endpoint) {
+        console.warn(`Issuer ${issuer} of type ${authorizationServerType} has no authorization_endpoint! Will use ${authorization_endpoint}. This only works for pre-authorized flows`);
+      } else if (authorization_endpoint && authMetadata.authorization_endpoint !== authorization_endpoint) {
+        throw Error(`Credential issuer has a different authorization_endpoint (${authorization_endpoint}) from the Authorization Server (${authMetadata.authorization_endpoint})`);
+      }
+      authorization_endpoint = authMetadata.authorization_endpoint;
+      if (authorization_challenge_endpoint && authMetadata.authorization_challenge_endpoint !== authorization_challenge_endpoint) {
+        throw Error(`Credential issuer has a different authorization_challenge_endpoint (${authorization_challenge_endpoint}) from the Authorization Server (${authMetadata.authorization_challenge_endpoint})`);
+      }
+      authorization_challenge_endpoint = authMetadata.authorization_challenge_endpoint;
+      if (!authMetadata.token_endpoint) {
+        throw Error(`Authorization Server ${authorization_servers} did not provide a token_endpoint`);
+      } else if (token_endpoint && authMetadata.token_endpoint !== token_endpoint) {
+        throw Error(`Credential issuer has a different token_endpoint (${token_endpoint}) from the Authorization Server (${authMetadata.token_endpoint})`);
+      }
+      token_endpoint = authMetadata.token_endpoint;
+      if (authMetadata.credential_endpoint) {
+        if (credential_endpoint && authMetadata.credential_endpoint !== credential_endpoint) {
+          logger7.debug(`Credential issuer has a different credential_endpoint (${credential_endpoint}) from the Authorization Server (${authMetadata.credential_endpoint}). Will use the issuer value`);
+        } else {
+          credential_endpoint = authMetadata.credential_endpoint;
+        }
+      }
+      if (authMetadata.deferred_credential_endpoint) {
+        if (deferred_credential_endpoint && authMetadata.deferred_credential_endpoint !== deferred_credential_endpoint) {
+          logger7.debug(`Credential issuer has a different deferred_credential_endpoint (${deferred_credential_endpoint}) from the Authorization Server (${authMetadata.deferred_credential_endpoint}). Will use the issuer value`);
+        } else {
+          deferred_credential_endpoint = authMetadata.deferred_credential_endpoint;
+        }
+      }
+      if (authMetadata.notification_endpoint) {
+        if (notification_endpoint && authMetadata.notification_endpoint !== notification_endpoint) {
+          logger7.debug(`Credential issuer has a different notification_endpoint (${notification_endpoint}) from the Authorization Server (${authMetadata.notification_endpoint}). Will use the issuer value`);
+        } else {
+          notification_endpoint = authMetadata.notification_endpoint;
+        }
+      }
+    }
+    if (!authorization_endpoint) {
+      logger7.debug(`Issuer ${issuer} does not expose authorization_endpoint, so only pre-auth will be supported`);
+    }
+    if (!token_endpoint) {
+      logger7.debug(`Issuer ${issuer} does not have a token_endpoint listed in well-known locations!`);
+      if (opts?.errorOnNotFound) {
+        throw Error(`Could not deduce the token_endpoint for ${issuer}`);
+      } else {
+        token_endpoint = `${issuer}${issuer.endsWith("/") ? "token" : "/token"}`;
+      }
+    }
+    if (!credential_endpoint) {
+      logger7.debug(`Issuer ${issuer} does not have a credential_endpoint listed in well-known locations!`);
+      if (opts?.errorOnNotFound) {
+        throw Error(`Could not deduce the credential endpoint for ${issuer}`);
+      } else {
+        credential_endpoint = `${issuer}${issuer.endsWith("/") ? "credential" : "/credential"}`;
+      }
+    }
+    if (!credentialIssuerMetadata && authMetadata) {
+      credentialIssuerMetadata = authMetadata;
+    }
+    const ci = credentialIssuerMetadata ?? {};
+    const ciAuthorizationServers = Array.isArray(ci.authorization_servers) && ci.authorization_servers.length > 0 ? ci.authorization_servers : authorization_servers;
+    const v1_0CredentialIssuerMetadata = {
+      credential_issuer: ci.credential_issuer ?? issuer,
+      credential_endpoint,
+      authorization_servers: ciAuthorizationServers,
+      credential_configurations_supported: ci.credential_configurations_supported ?? {},
+      display: ci.display ?? [],
+      ...nonce_endpoint && {
+        nonce_endpoint
+      },
+      ...deferred_credential_endpoint && {
+        deferred_credential_endpoint
+      },
+      ...notification_endpoint && {
+        notification_endpoint
+      },
+      ...ci.batch_credential_issuance_supported !== void 0 && {
+        batch_credential_issuance_supported: ci.batch_credential_issuance_supported
+      },
+      ...ci.credential_issuer_public_key && {
+        credential_issuer_public_key: ci.credential_issuer_public_key
+      },
+      ...ci.signed_metadata && {
+        signed_metadata: ci.signed_metadata
+      }
+    };
+    logger7.debug(`Issuer ${issuer} token endpoint ${token_endpoint}, credential endpoint ${credential_endpoint}`);
+    const processedMetadata = await processSignedMetadata3({
+      metadata: v1_0CredentialIssuerMetadata,
+      issuer,
+      signedMetadataVerifyCallback: opts?.signedMetadataVerifyCallback
+    });
+    return {
+      issuer,
+      token_endpoint,
+      credential_endpoint,
+      authorization_challenge_endpoint,
+      notification_endpoint,
+      authorizationServerType,
+      credentialIssuerMetadata: processedMetadata,
+      authorizationServerMetadata: authMetadata
+    };
+  }
+  static async retrieveOpenID4VCIServerMetadata(issuerHost, opts) {
+    return retrieveWellknown(issuerHost, WellKnownEndpoints3.OPENID4VCI_ISSUER, {
+      errorOnNotFound: opts?.errorOnNotFound === void 0 ? true : opts.errorOnNotFound
+    });
+  }
+};
+
 // lib/OpenID4VCIClient.ts
-import { AuthzFlowType as AuthzFlowType3, CodeChallengeMethod as CodeChallengeMethod4, DefaultURISchemes as DefaultURISchemes2, determineVersionsFromIssuerMetadata, getClientIdFromCredentialOfferPayload as getClientIdFromCredentialOfferPayload3, getIssuerFromCredentialOfferPayload as getIssuerFromCredentialOfferPayload6, getSupportedCredentials as getSupportedCredentials2, getTypesFromCredentialSupported, KID_JWK_X5C_ERROR as KID_JWK_X5C_ERROR2, OpenId4VCIVersion as OpenId4VCIVersion9, toAuthorizationResponsePayload as toAuthorizationResponsePayload2 } from "@sphereon/oid4vci-common";
-import { Loggers as Loggers8 } from "@sphereon/ssi-types";
+import { AuthzFlowType as AuthzFlowType3, CodeChallengeMethod as CodeChallengeMethod4, DefaultURISchemes as DefaultURISchemes2, determineVersionsFromIssuerMetadata as determineVersionsFromIssuerMetadata2, getClientIdFromCredentialOfferPayload as getClientIdFromCredentialOfferPayload3, getIssuerFromCredentialOfferPayload as getIssuerFromCredentialOfferPayload8, getSupportedCredentials as getSupportedCredentials2, getTypesFromCredentialSupported, KID_JWK_X5C_ERROR as KID_JWK_X5C_ERROR2, OpenId4VCIVersion as OpenId4VCIVersion10, toAuthorizationResponsePayload as toAuthorizationResponsePayload2 } from "@sphereon/oid4vci-common";
+import { Loggers as Loggers9 } from "@sphereon/ssi-types";
 
 // lib/OpenID4VCIClientV1_0_15.ts
-import { AuthzFlowType as AuthzFlowType2, CodeChallengeMethod as CodeChallengeMethod3, DefaultURISchemes, getClientIdFromCredentialOfferPayload as getClientIdFromCredentialOfferPayload2, getIssuerFromCredentialOfferPayload as getIssuerFromCredentialOfferPayload5, getSupportedCredentials, KID_JWK_X5C_ERROR, OpenId4VCIVersion as OpenId4VCIVersion8, toAuthorizationResponsePayload } from "@sphereon/oid4vci-common";
-import { Loggers as Loggers7 } from "@sphereon/ssi-types";
+import { AuthzFlowType as AuthzFlowType2, CodeChallengeMethod as CodeChallengeMethod3, DefaultURISchemes, getClientIdFromCredentialOfferPayload as getClientIdFromCredentialOfferPayload2, getIssuerFromCredentialOfferPayload as getIssuerFromCredentialOfferPayload7, getSupportedCredentials, KID_JWK_X5C_ERROR, OpenId4VCIVersion as OpenId4VCIVersion9, toAuthorizationResponsePayload } from "@sphereon/oid4vci-common";
+import { Loggers as Loggers8 } from "@sphereon/ssi-types";
 
 // lib/NonceClient.ts
 import { formPost as formPost3 } from "@sphereon/oid4vci-common";
@@ -2033,14 +2480,14 @@ var acquireNonceFromAuthorizationServer = /* @__PURE__ */ __name(async (opts) =>
 }, "acquireNonceFromAuthorizationServer");
 
 // lib/OpenID4VCIClientV1_0_15.ts
-var logger7 = Loggers7.DEFAULT.get("sphereon:oid4vci:v15");
+var logger8 = Loggers8.DEFAULT.get("sphereon:oid4vci:v15");
 var OpenID4VCIClientV1_0_15 = class _OpenID4VCIClientV1_0_15 {
   static {
     __name(this, "OpenID4VCIClientV1_0_15");
   }
   _state;
   constructor({ credentialOffer, clientId, kid, alg, credentialIssuer, pkce, authorizationRequest, jwk, endpointMetadata, accessTokenResponse, authorizationRequestOpts, authorizationCodeResponse, authorizationURL, keyAttestation }) {
-    const issuer = credentialIssuer ?? (credentialOffer ? getIssuerFromCredentialOfferPayload5(credentialOffer.credential_offer) : void 0);
+    const issuer = credentialIssuer ?? (credentialOffer ? getIssuerFromCredentialOfferPayload7(credentialOffer.credential_offer) : void 0);
     if (!issuer) {
       throw Error("No credential issuer supplied or deduced from offer");
     }
@@ -2066,7 +2513,7 @@ var OpenID4VCIClientV1_0_15 = class _OpenID4VCIClientV1_0_15 {
     if (!this._state.authorizationRequestOpts) {
       this._state.authorizationRequestOpts = this.syncAuthorizationRequestOpts(authorizationRequest);
     }
-    logger7.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
+    logger8.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
   }
   static async fromCredentialIssuer({ kid, alg, retrieveServerMetadata, clientId, credentialIssuer, pkce, authorizationRequest, createAuthorizationRequestURL, keyAttestation }) {
     const client = new _OpenID4VCIClientV1_0_15({
@@ -2114,7 +2561,7 @@ var OpenID4VCIClientV1_0_15 = class _OpenID4VCIClientV1_0_15 {
         authorizationRequest,
         pkce
       });
-      logger7.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
+      logger8.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
     }
     return client;
   }
@@ -2160,11 +2607,11 @@ var OpenID4VCIClientV1_0_15 = class _OpenID4VCIClientV1_0_15 {
       }
     });
     if (response.errorBody) {
-      logger7.debug(`Nonce request error:\r
+      logger8.debug(`Nonce request error:\r
 ${JSON.stringify(response.errorBody)}`);
       return Promise.reject(Error(`Retrieving a nonce from ${this._state.endpointMetadata?.credentialIssuerMetadata?.nonce_endpoint} for issuer ${this.getIssuer()} failed with error: ${response.errorBody.error}${response.errorBody.error_description ? ` - ${response.errorBody.error_description}` : ""}`));
     } else if (!response.successBody) {
-      logger7.debug(`Nonce request error. No success body`);
+      logger8.debug(`Nonce request error. No success body`);
       return Promise.reject(Error(`Retrieving a nonce from ${this._state.endpointMetadata?.credentialIssuerMetadata?.nonce_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
     }
     this._state.cachedCNonce = response.successBody.c_nonce;
@@ -2184,12 +2631,12 @@ ${JSON.stringify(response.errorBody)}`);
       ...opts
     });
     if (response.errorBody) {
-      logger7.debug(`Authorization code error:\r
+      logger8.debug(`Authorization code error:\r
 ${JSON.stringify(response.errorBody)}`);
       const error = response.errorBody;
       return Promise.reject(error);
     } else if (!response.successBody) {
-      logger7.debug(`Authorization code error. No success body`);
+      logger8.debug(`Authorization code error. No success body`);
       return Promise.reject(Error(`Retrieving an authorization code token from ${this._state.endpointMetadata?.authorization_challenge_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
     }
     return {
@@ -2261,11 +2708,11 @@ ${JSON.stringify(response.errorBody)}`);
         }
       });
       if (response.errorBody) {
-        logger7.debug(`Access token error:\r
+        logger8.debug(`Access token error:\r
 ${JSON.stringify(response.errorBody)}`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
       } else if (!response.successBody) {
-        logger7.debug(`Access token error. No success body`);
+        logger8.debug(`Access token error. No success body`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
       }
       this._state.accessTokenResponse = response.successBody;
@@ -2374,11 +2821,11 @@ ${JSON.stringify(response.errorBody)}`);
     });
     this._state.dpopResponseParams = response.params;
     if (response.errorBody) {
-      logger7.debug(`Credential request error:\r
+      logger8.debug(`Credential request error:\r
 ${JSON.stringify(response.errorBody)}`);
       throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
     } else if (!response.successBody) {
-      logger7.debug(`Credential request error. No success body`);
+      logger8.debug(`Credential request error. No success body`);
       throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
     }
     return {
@@ -2429,7 +2876,7 @@ ${JSON.stringify(response.errorBody)}`);
     return this._state.credentialOffer;
   }
   version() {
-    return OpenId4VCIVersion8.VER_1_0_15;
+    return OpenId4VCIVersion9.VER_1_0_15;
   }
   get endpointMetadata() {
     this.assertServerMetadata();
@@ -2561,14 +3008,14 @@ ${JSON.stringify(response.errorBody)}`);
 };
 
 // lib/OpenID4VCIClient.ts
-var logger8 = Loggers8.DEFAULT.get("sphereon:oid4vci");
+var logger9 = Loggers9.DEFAULT.get("sphereon:oid4vci");
 var OpenID4VCIClient = class _OpenID4VCIClient {
   static {
     __name(this, "OpenID4VCIClient");
   }
   _state;
   constructor({ credentialOffer, clientId, kid, alg, credentialIssuer, pkce, authorizationRequest, accessToken, jwk, endpointMetadata, accessTokenResponse, authorizationRequestOpts, authorizationCodeResponse, authorizationURL }) {
-    const issuer = credentialIssuer ?? (credentialOffer ? getIssuerFromCredentialOfferPayload6(credentialOffer.credential_offer) : void 0);
+    const issuer = credentialIssuer ?? (credentialOffer ? getIssuerFromCredentialOfferPayload8(credentialOffer.credential_offer) : void 0);
     if (!issuer) {
       throw Error("No credential issuer supplied or deduced from offer");
     }
@@ -2595,7 +3042,7 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
     if (!this._state.authorizationRequestOpts) {
       this._state.authorizationRequestOpts = this.syncAuthorizationRequestOpts(authorizationRequest);
     }
-    logger8.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
+    logger9.debug(`Authorization req options: ${JSON.stringify(this._state.authorizationRequestOpts, null, 2)}`);
   }
   static async fromCredentialIssuer({ kid, alg, retrieveServerMetadata, clientId, credentialIssuer, pkce, authorizationRequest, createAuthorizationRequestURL, endpointMetadata }) {
     const client = new _OpenID4VCIClient({
@@ -2643,7 +3090,7 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
         authorizationRequest,
         pkce
       });
-      logger8.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
+      logger9.debug(`Authorization Request URL: ${client._state.authorizationURL}`);
     }
     return client;
   }
@@ -2700,12 +3147,12 @@ var OpenID4VCIClient = class _OpenID4VCIClient {
       ...opts
     });
     if (response.errorBody) {
-      logger8.debug(`Authorization code error:\r
+      logger9.debug(`Authorization code error:\r
 ${JSON.stringify(response.errorBody)}`);
       const error = response.errorBody;
       return Promise.reject(error);
     } else if (!response.successBody) {
-      logger8.debug(`Authorization code error. No success body`);
+      logger9.debug(`Authorization code error. No success body`);
       return Promise.reject(Error(`Retrieving an authorization code token from ${this._state.endpointMetadata?.authorization_challenge_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`));
     }
     return {
@@ -2777,11 +3224,12 @@ ${JSON.stringify(response.errorBody)}`);
         }
       });
       if (response.errorBody) {
-        logger8.debug(`Access token error:\r
-${JSON.stringify(response.errorBody)}`);
-        throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
+        const errorDetail = typeof response.errorBody === "object" ? JSON.stringify(response.errorBody) : String(response.errorBody);
+        logger9.error(`Access token error response (status ${response.origResponse.status}):\r
+${errorDetail}`);
+        throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}. Response: ${errorDetail}`);
       } else if (!response.successBody) {
-        logger8.debug(`Access token error. No success body`);
+        logger9.debug(`Access token error. No success body`);
         throw Error(`Retrieving an access token from ${this._state.endpointMetadata?.token_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
       }
       this._state.accessTokenResponse = response.successBody;
@@ -2798,7 +3246,7 @@ ${JSON.stringify(response.errorBody)}`);
       }
     };
   }
-  async acquireCredentials({ credentialTypes, context, proofCallbacks, format, kid, jwk, alg, jti, deferredCredentialAwait, deferredCredentialIntervalInMS, createDPoPOpts }) {
+  async acquireCredentials({ credentialIdentifier, credentialConfigurationId, credentialTypes, context, proofCallbacks, format, kid, jwk, alg, jti, deferredCredentialAwait, deferredCredentialIntervalInMS, createDPoPOpts }) {
     if ([
       jwk,
       kid
@@ -2808,13 +3256,11 @@ ${JSON.stringify(response.errorBody)}`);
     if (alg) this._state.alg = alg;
     if (jwk) this._state.jwk = jwk;
     if (kid) this._state.kid = kid;
-    if (this.version() === OpenId4VCIVersion9.VER_1_0_15 && this.hasNonceEndpoint()) {
-      if (!this._state.cachedCNonce) {
-        try {
-          await this.acquireNonceViaV15Delegate();
-        } catch (e) {
-          return Promise.reject(Error(`failed to acquire nonce: ${String(e)}`));
-        }
+    if (!this._state.cachedCNonce && this.hasNonceEndpoint()) {
+      try {
+        await this.acquireNonceViaV15Delegate();
+      } catch (e) {
+        return Promise.reject(Error(`failed to acquire nonce: ${String(e)}`));
       }
     }
     let requestBuilder = this.credentialOffer ? CredentialRequestClientBuilderV1_0_15.fromCredentialOffer({
@@ -2823,15 +3269,22 @@ ${JSON.stringify(response.errorBody)}`);
     }) : CredentialRequestClientBuilderV1_0_15.fromCredentialIssuer({
       credentialIssuer: this.getIssuer(),
       credentialTypes,
+      credentialIdentifier,
+      credentialConfigurationId,
       metadata: this.endpointMetadata,
       version: this.version()
     });
+    if (credentialIdentifier) {
+      requestBuilder.withCredentialIdentifier(credentialIdentifier);
+    } else if (credentialConfigurationId) {
+      requestBuilder.withCredentialConfigurationId(credentialConfigurationId);
+    }
     const issuerState = this.issuerSupportedFlowTypes().includes(AuthzFlowType3.AUTHORIZATION_CODE_FLOW) && this._state.authorizationCodeResponse && !this.accessTokenResponse?.c_nonce && this._state.credentialOffer?.issuerState ? this._state.credentialOffer.issuerState : void 0;
     requestBuilder.withIssuerState(issuerState);
     requestBuilder.withTokenFromResponse(this.accessTokenResponse);
     requestBuilder.withDeferredCredentialAwait(deferredCredentialAwait ?? false, deferredCredentialIntervalInMS);
     let subjectIssuance;
-    if (this.endpointMetadata?.credentialIssuerMetadata) {
+    if (this.endpointMetadata?.credentialIssuerMetadata && credentialTypes) {
       const metadata = this.endpointMetadata.credentialIssuerMetadata;
       const types = Array.isArray(credentialTypes) ? credentialTypes : [
         credentialTypes
@@ -2886,7 +3339,7 @@ ${JSON.stringify(response.errorBody)}`);
       }
       const response = await credentialRequestClient.acquireCredentialsUsingProof({
         proofInput: proofBuilder,
-        credentialTypes,
+        credentialTypes: credentialTypes ?? credentialIdentifier ?? credentialConfigurationId,
         context,
         format,
         subjectIssuance,
@@ -2894,11 +3347,12 @@ ${JSON.stringify(response.errorBody)}`);
       });
       this._state.dpopResponseParams = response.params;
       if (response.errorBody) {
-        logger8.debug(`Credential request error:\r
+        logger9.debug(`Credential request error:\r
 ${JSON.stringify(response.errorBody)}`);
-        throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}`);
+        const errDesc = response.errorBody.error_description ? `: ${response.errorBody.error_description}` : response.errorBody.error ? `: ${response.errorBody.error}` : "";
+        throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed with status: ${response.origResponse.status}${errDesc}`);
       } else if (!response.successBody) {
-        logger8.debug(`Credential request error. No success body`);
+        logger9.debug(`Credential request error. No success body`);
         throw Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed as there was no success response body`);
       }
       return {
@@ -2946,11 +3400,12 @@ ${JSON.stringify(response.errorBody)}`);
       });
       this._state.dpopResponseParams = response2.params;
       if (response2.errorBody) {
-        logger8.debug(`Credential request error (after retry):\r
+        logger9.debug(`Credential request error (after retry):\r
 ${JSON.stringify(response2.errorBody)}`);
-        return Promise.reject(Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed after retry with status: ${response2.origResponse.status}`));
+        const errDesc2 = response2.errorBody.error_description ? `: ${response2.errorBody.error_description}` : response2.errorBody.error ? `: ${response2.errorBody.error}` : "";
+        return Promise.reject(Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed after retry with status: ${response2.origResponse.status}${errDesc2}`));
       } else if (!response2.successBody) {
-        logger8.debug(`Credential request error after retry. No success body`);
+        logger9.debug(`Credential request error after retry. No success body`);
         return Promise.reject(Error(`Retrieving a credential from ${this._state.endpointMetadata?.credential_endpoint} for issuer ${this.getIssuer()} failed after retry as there was no success response body`));
       }
       return {
@@ -2993,17 +3448,17 @@ ${JSON.stringify(response2.errorBody)}`);
     return this._state.credentialOffer;
   }
   version() {
-    if (this.credentialOffer?.version && this.credentialOffer.version !== OpenId4VCIVersion9.VER_UNKNOWN) {
-      return this.credentialOffer.version;
-    }
     const metadata = this._state.endpointMetadata;
     if (metadata?.credentialIssuerMetadata) {
-      const versions = determineVersionsFromIssuerMetadata(metadata.credentialIssuerMetadata);
-      if (versions.length > 0 && !versions.includes(OpenId4VCIVersion9.VER_UNKNOWN)) {
+      const versions = determineVersionsFromIssuerMetadata2(metadata.credentialIssuerMetadata);
+      if (versions.length > 0 && !versions.includes(OpenId4VCIVersion10.VER_UNKNOWN)) {
         return versions[0];
       }
     }
-    return OpenId4VCIVersion9.VER_1_0_15;
+    if (this.credentialOffer?.version && this.credentialOffer.version !== OpenId4VCIVersion10.VER_UNKNOWN) {
+      return this.credentialOffer.version;
+    }
+    return OpenId4VCIVersion10.VER_1_0;
   }
   get endpointMetadata() {
     this.assertServerMetadata();
@@ -3151,7 +3606,8 @@ ${JSON.stringify(response2.errorBody)}`);
     state.cachedCNonce = v15Client.state.cachedCNonce;
   }
   shouldRetryWithFreshNonce(err) {
-    if (!this.hasNonceEndpoint() && this.version() !== OpenId4VCIVersion9.VER_1_0_15) {
+    const canRetry = this.hasNonceEndpoint() || this.version() >= OpenId4VCIVersion10.VER_1_0;
+    if (!canRetry) {
       return false;
     }
     const status = err?.response?.status ?? err?.status;
@@ -3185,9 +3641,11 @@ export {
   CredentialOfferClientV1_0_15,
   CredentialRequestClient,
   CredentialRequestClientBuilder,
+  CredentialRequestClientBuilderV1_0,
   CredentialRequestClientBuilderV1_0_15,
   LOG2 as LOG,
   MetadataClient,
+  MetadataClientV1_0,
   MetadataClientV1_0_15,
   OpenID4VCIClient,
   OpenID4VCIClientV1_0_15,