@sphereon/oid4vci-common 0.10.3 → 0.10.4-next.119

package/lib/types/CredentialIssuance.types.ts

@@ -1,33 +1,47 @@
 import { W3CVerifiableCredential } from '@sphereon/ssi-types';
 
+import { ExperimentalSubjectIssuance } from '../experimental/holder-vci';
+
 import { AuthzFlowType } from './Authorization.types';
-import { OID4VCICredentialFormat } from './Generic.types';
+import { OID4VCICredentialFormat, TxCode, UniformCredentialRequest } from './Generic.types';
 import { OpenId4VCIVersion } from './OpenID4VCIVersions.types';
-import { CredentialOfferPayloadV1_0_08 } from './v1_0_08.types';
+import { CredentialOfferPayloadV1_0_08, CredentialRequestV1_0_08 } from './v1_0_08.types';
 import { CredentialOfferPayloadV1_0_09, CredentialOfferV1_0_09 } from './v1_0_09.types';
-import { CredentialOfferPayloadV1_0_11, CredentialOfferV1_0_11 } from './v1_0_11.types';
+import { CredentialOfferPayloadV1_0_11, CredentialOfferV1_0_11, CredentialRequestV1_0_11 } from './v1_0_11.types';
+import { CredentialOfferPayloadV1_0_13, CredentialOfferV1_0_13, CredentialRequestV1_0_13 } from './v1_0_13.types';
 
-export interface CredentialResponse {
+export interface CredentialResponse extends ExperimentalSubjectIssuance {
   credential?: W3CVerifiableCredential; // OPTIONAL. Contains issued Credential. MUST be present when acceptance_token is not returned. MAY be a JSON string or a JSON object, depending on the Credential format. See Appendix E for the Credential format specific encoding requirements
-  format: OID4VCICredentialFormat /* | OID4VCICredentialFormat[]*/; // REQUIRED. JSON string denoting the format of the issued Credential
+  format?: OID4VCICredentialFormat /* | OID4VCICredentialFormat[]*/; // REQUIRED. JSON string denoting the format of the issued Credential  TODO: remove when cleaning <v13
   transaction_id?: string; //OPTIONAL. A string identifying a Deferred Issuance transaction. This claim is contained in the response if the Credential Issuer was unable to immediately issue the credential. The value is subsequently used to obtain the respective Credential with the Deferred Credential Endpoint (see Section 9). It MUST be present when the credential parameter is not returned. It MUST be invalidated after the credential for which it was meant has been obtained by the Wallet.
   acceptance_token?: string; //deprecated // OPTIONAL. A JSON string containing a security token subsequently used to obtain a Credential. MUST be present when credential is not returned
   c_nonce?: string; // OPTIONAL. JSON string containing a nonce to be used to create a proof of possession of key material when requesting a Credential (see Section 7.2). When received, the Wallet MUST use this nonce value for its subsequent credential requests until the Credential Issuer provides a fresh nonce
   c_nonce_expires_in?: number; // OPTIONAL. JSON integer denoting the lifetime in seconds of the c_nonce
+  notification_id?: string;
 }
 
 export interface CredentialOfferRequestWithBaseUrl extends UniformCredentialOfferRequest {
   scheme: string;
   clientId?: string;
   baseUrl: string;
-  userPinRequired: boolean;
+  txCode?: TxCode;
   issuerState?: string;
   preAuthorizedCode?: string;
+  userPinRequired: boolean;
 }
 
-export type CredentialOffer = CredentialOfferV1_0_09 | CredentialOfferV1_0_11;
+export type CredentialOffer = CredentialOfferV1_0_09 | CredentialOfferV1_0_11 | CredentialOfferV1_0_13;
 
-export type CredentialOfferPayload = (CredentialOfferPayloadV1_0_08 | CredentialOfferPayloadV1_0_09 | CredentialOfferPayloadV1_0_11) & {
+export type CredentialOfferPayloadLatest = CredentialOfferPayloadV1_0_13;
+
+export type CredentialRequest = UniformCredentialRequest | CredentialRequestV1_0_13 | CredentialRequestV1_0_11 | CredentialRequestV1_0_08;
+
+export type CredentialOfferPayload = (
+  | CredentialOfferPayloadV1_0_08
+  | CredentialOfferPayloadV1_0_09
+  | CredentialOfferPayloadV1_0_11
+  | CredentialOfferPayloadV1_0_13
+) & {
   [x: string]: any;
 };
 
@@ -46,7 +60,8 @@ export interface UniformCredentialOfferRequest extends AssertedUniformCredential
   supportedFlows: AuthzFlowType[];
 }
 
-export type UniformCredentialOfferPayload = CredentialOfferPayloadV1_0_11;
+//todo: drop v11
+export type UniformCredentialOfferPayload = CredentialOfferPayloadV1_0_11 | CredentialOfferPayloadV1_0_13;
 
 export interface ProofOfPossession {
   proof_type: 'jwt';
@@ -184,6 +199,7 @@ export interface JWTPayload {
   nonce?: string; // REQUIRED (string). The value type of this claim MUST be a string, where the value is a c_nonce provided by the credential issuer. //TODO: Marked as required not present in NGI flow
   jti?: string; // A new nonce chosen by the wallet. Used to prevent replay
   exp?: number; // Not longer than 5 minutes
+  client_id?: string; // (string). The value of this claim MUST be the client_id of the client making the credential request.
   [s: string]: unknown;
 }
 
@@ -196,6 +212,6 @@ export interface JwtVerifyResult<DIDDoc> {
   alg: string;
   did?: string;
   didDocument?: DIDDoc;
-  x5c?: string;
+  x5c?: string[];
   jwk?: BaseJWK;
 }

package/lib/types/Generic.types.ts

@@ -1,9 +1,23 @@
 import { ICredentialContextType, IVerifiableCredential, W3CVerifiableCredential } from '@sphereon/ssi-types';
 
+import { ExperimentalSubjectIssuance } from '../experimental/holder-vci';
+
 import { ProofOfPossession } from './CredentialIssuance.types';
 import { AuthorizationServerMetadata } from './ServerMetadata';
 import { CredentialOfferSession } from './StateManager.types';
-import { CredentialRequestV1_0_11 } from './v1_0_11.types';
+import { IssuerMetadataV1_0_08 } from './v1_0_08.types';
+import { CredentialRequestV1_0_11, EndpointMetadataResultV1_0_11 } from './v1_0_11.types';
+import {
+  CredentialConfigurationSupportedV1_0_13,
+  CredentialRequestV1_0_13,
+  EndpointMetadataResultV1_0_13,
+  IssuerMetadataV1_0_13,
+} from './v1_0_13.types';
+
+export type InputCharSet = 'numeric' | 'text';
+export type KeyProofType = 'jwt' | 'cwt' | 'ldp_vp';
+
+export type PoPMode = 'pop' | 'jwt'; // Proof of posession, or regular JWT
 
 /**
  * Important Note: please be aware that these Common interfaces are based on versions v1_0.11 and v1_0.09
@@ -48,19 +62,50 @@ export interface CredentialSupplierConfig {
 export interface CredentialIssuerMetadataOpts {
   credential_endpoint?: string; // REQUIRED. URL of the Credential Issuer's Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components.
   batch_credential_endpoint?: string; // OPTIONAL. URL of the Credential Issuer's Batch Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components. If omitted, the Credential Issuer does not support the Batch Credential Endpoint.
-  credentials_supported: CredentialSupported[]; // REQUIRED. A JSON array containing a list of JSON objects, each of them representing metadata about a separate credential type that the Credential Issuer can issue. The JSON objects in the array MUST conform to the structure of the Section 10.2.3.1.
+  credentials_supported: CredentialConfigurationSupported[]; // REQUIRED. A JSON array containing a list of JSON objects, each of them representing metadata about a separate credential type that the Credential Issuer can issue. The JSON objects in the array MUST conform to the structure of the Section 10.2.3.1.
   credential_issuer: string; // REQUIRED. The Credential Issuer's identifier.
   authorization_server?: string; // OPTIONAL. Identifier of the OAuth 2.0 Authorization Server (as defined in [RFC8414]) the Credential Issuer relies on for authorization. If this element is omitted, the entity providing the Credential Issuer is also acting as the AS, i.e. the Credential Issuer's identifier is used as the OAuth 2.0 Issuer value to obtain the Authorization Server metadata as per [RFC8414].
-  // authorization_servers?: string[]; // OPTIONAL. Array of strings that identify the OAuth 2.0 Authorization Servers (as defined in [RFC8414]) the Credential Issuer relies on for authorization. If this element is omitted, the entity providing the Credential Issuer is also acting as the AS, i.e. the Credential Issuer's identifier is used as the OAuth 2.0 Issuer value to obtain the Authorization Server metadata as per [RFC8414].
   token_endpoint?: string;
+  notification_endpoint?: string;
   display?: MetadataDisplay[]; //  An array of objects, where each object contains display properties of a Credential Issuer for a certain language. Below is a non-exhaustive list of valid parameters that MAY be included:
   credential_supplier_config?: CredentialSupplierConfig;
 }
 
+//todo: investigate if these values are enough.
+export type AlgValue = 'RS256' | 'ES256' | 'PS256' | 'HS256' | string;
+export type EncValue = 'A128GCM' | 'A256GCM' | 'A128CBC-HS256' | 'A256CBC-HS512' | string;
+
+export interface ResponseEncryption {
+  /**
+   * REQUIRED. Array containing a list of the JWE [RFC7516] encryption algorithms
+   * (alg values) [RFC7518] supported by the Credential and Batch Credential Endpoint to encode the
+   * Credential or Batch Credential Response in a JWT
+   */
+  alg_values_supported: AlgValue[];
+
+  /**
+   * REQUIRED. Array containing a list of the JWE [RFC7516] encryption algorithms
+   * (enc values) [RFC7518] supported by the Credential and Batch Credential Endpoint to encode the
+   * Credential or Batch Credential Response in a JWT
+   */
+  enc_values_supported: EncValue[];
+
+  /**
+   * REQUIRED. Boolean value specifying whether the Credential Issuer requires the
+   * additional encryption on top of TLS for the Credential Response. If the value is true, the Credential
+   * Issuer requires encryption for every Credential Response and therefore the Wallet MUST provide
+   * encryption keys in the Credential Request. If the value is false, the Wallet MAY chose whether it
+   * provides encryption keys or not.
+   */
+  encryption_required: boolean;
+}
+
 // For now we extend the opts above. Only difference is that the credential endpoint is optional in the Opts, as it can come from other sources. The value is however required in the eventual Issuer Metadata
 export interface CredentialIssuerMetadata extends CredentialIssuerMetadataOpts, Partial<AuthorizationServerMetadata> {
   authorization_servers?: string[]; // OPTIONAL. Array of strings that identify the OAuth 2.0 Authorization Servers (as defined in [RFC8414]) the Credential Issuer relies on for authorization. If this element is omitted, the entity providing the Credential Issuer is also acting as the AS, i.e. the Credential Issuer's identifier is used as the OAuth 2.0 Issuer value to obtain the Authorization Server metadata as per [RFC8414].
   credential_endpoint: string; // REQUIRED. URL of the Credential Issuer's Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components.
+  credential_configurations_supported: Record<string, CredentialConfigurationSupported>; // REQUIRED. A JSON array containing a list of JSON objects, each of them representing metadata about a separate credential type that the Credential Issuer can issue. The JSON objects in the array MUST conform to the structure of the Section 10.2.3.1.
+  credential_issuer: string; // REQUIRED. The Credential Issuer's identifier.
   credential_response_encryption_alg_values_supported?: string; // OPTIONAL. Array containing a list of the JWE [RFC7516] encryption algorithms (alg values) [RFC7518] supported by the Credential and/or Batch Credential Endpoint to encode the Credential or Batch Credential Response in a JWT [RFC7519].
   credential_response_encryption_enc_values_supported?: string; //OPTIONAL. Array containing a list of the JWE [RFC7516] encryption algorithms (enc values) [RFC7518] supported by the Credential and/or Batch Credential Endpoint to encode the Credential or Batch Credential Response in a JWT [RFC7519].
   require_credential_response_encryption?: boolean; //OPTIONAL. Boolean value specifying whether the Credential Issuer requires additional encryption on top of TLS for the Credential Response and expects encryption parameters to be present in the Credential Request and/or Batch Credential Request, with true indicating support. When the value is true, credential_response_encryption_alg_values_supported parameter MUST also be provided. If omitted, the default value is false.
@@ -71,17 +116,25 @@ export interface CredentialIssuerMetadata extends CredentialIssuerMetadataOpts,
 
 export interface CredentialSupportedBrief {
   cryptographic_binding_methods_supported?: string[]; // OPTIONAL. Array of case sensitive strings that identify how the Credential is bound to the identifier of the End-User who possesses the Credential
-  cryptographic_suites_supported?: string[]; // OPTIONAL. Array of case sensitive strings that identify the cryptographic suites that are supported for the cryptographic_binding_methods_supported
+  credential_signing_alg_values_supported?: string[]; // OPTIONAL. Array of case sensitive strings that identify the cryptographic suites that are supported for the cryptographic_binding_methods_supported
 }
 
-export type CommonCredentialSupported = CredentialSupportedBrief & {
-  format: OID4VCICredentialFormat | string; //REQUIRED. A JSON string identifying the format of this credential, e.g. jwt_vc_json or ldp_vc.
-  id?: string; // OPTIONAL. A JSON string identifying the respective object. The value MUST be unique across all credentials_supported entries in the Credential Issuer Metadata
-  display?: CredentialsSupportedDisplay[]; // OPTIONAL. An array of objects, where each object contains the display properties of the supported credential for a certain language
-  /**
-   * following properties are non-mso_mdoc specific and we might wanna rethink them when we're going to support mso_mdoc
-   */
-};
+export interface ProofType {
+  proof_signing_alg_values_supported: string[];
+}
+
+export type CommonCredentialSupported = CredentialSupportedBrief &
+  ExperimentalSubjectIssuance & {
+    format: OID4VCICredentialFormat | string; //REQUIRED. A JSON string identifying the format of this credential, e.g. jwt_vc_json or ldp_vc.
+    id?: string; // OPTIONAL. A JSON string identifying the respective object. The value MUST be unique across all credentials_supported entries in the Credential Issuer Metadata
+    display?: CredentialsSupportedDisplay[]; // OPTIONAL. An array of objects, where each object contains the display properties of the supported credential for a certain language
+    scope?: string; // OPTIONAL. A JSON string identifying the scope value that this Credential Issuer supports for this particular Credential. The value can be the same across multiple credential_configurations_supported objects. The Authorization Server MUST be able to uniquely identify the Credential Issuer based on the scope value. The Wallet can use this value in the Authorization Request as defined in Section 5.1.2. Scope values in this Credential Issuer metadata MAY duplicate those in the scopes_supported parameter of the Authorization Server.
+    proof_types_supported?: Record<KeyProofType, ProofType>;
+
+    /**
+     * following properties are non-mso_mdoc specific and we might wanna rethink them when we're going to support mso_mdoc
+     */
+  };
 
 export interface CredentialSupportedJwtVcJsonLdAndLdpVc extends CommonCredentialSupported {
   types: string[]; // REQUIRED. JSON array designating the types a certain credential type supports
@@ -107,7 +160,11 @@ export interface CredentialSupportedSdJwtVc extends CommonCredentialSupported {
   order?: string[]; //An array of claims.display.name values that lists them in the order they should be displayed by the Wallet.
 }
 
-export type CredentialSupported = CommonCredentialSupported &
+export type CredentialConfigurationSupported =
+  | CredentialConfigurationSupportedV1_0_13
+  | (CommonCredentialSupported & (CredentialSupportedJwtVcJson | CredentialSupportedJwtVcJsonLdAndLdpVc | CredentialSupportedSdJwtVc));
+
+export type CredentialsSupportedLegacy = CommonCredentialSupported &
   (CredentialSupportedJwtVcJson | CredentialSupportedJwtVcJsonLdAndLdpVc | CredentialSupportedSdJwtVc);
 
 export interface CommonCredentialOfferFormat {
@@ -148,8 +205,7 @@ export type CreateCredentialOfferURIResult = {
   qrCodeDataUri?: string;
   session: CredentialOfferSession;
   userPin?: string;
-  userPinLength?: number;
-  userPinRequired: boolean;
+  txCode?: TxCode;
 };
 
 export interface JsonLdIssuerCredentialDefinition {
@@ -165,9 +221,9 @@ export interface ErrorResponse extends Response {
   state?: string;
 }
 
-export type UniformCredentialRequest = CredentialRequestV1_0_11;
+export type UniformCredentialRequest = CredentialRequestV1_0_11 | CredentialRequestV1_0_13;
 
-export interface CommonCredentialRequest {
+export interface CommonCredentialRequest extends ExperimentalSubjectIssuance {
   format: OID4VCICredentialFormat /* | OID4VCICredentialFormat[];*/; // for now it seems only one is supported in the spec
   proof?: ProofOfPossession;
 }
@@ -189,8 +245,8 @@ export interface CredentialRequestSdJwtVc extends CommonCredentialRequest {
   claims?: IssuerCredentialSubject;
 }
 
-export interface CommonCredentialResponse {
-  format: string;
+export interface CommonCredentialResponse extends ExperimentalSubjectIssuance {
+  // format: string;  TODO do we still need this for previous version support?
   credential?: W3CVerifiableCredential;
   acceptance_token?: string;
   c_nonce?: string;
@@ -198,17 +254,17 @@ export interface CommonCredentialResponse {
 }
 
 export interface CredentialResponseLdpVc extends CommonCredentialResponse {
-  format: 'ldp_vc';
+  //  format: 'ldp_vc';
   credential: IVerifiableCredential;
 }
 
 export interface CredentialResponseJwtVc {
-  format: 'jwt_vc_json' | 'jwt_vc_json-ld';
+  //  format: 'jwt_vc_json' | 'jwt_vc_json-ld';  TODO do we still need this for previous version support?
   credential: string;
 }
 
 export interface CredentialResponseSdJwtVc {
-  format: 'vc+sd-jwt';
+  //  format: 'vc+sd-jwt';   TODO do we still need this for previous version support?
   credential: string;
 }
 
@@ -245,28 +301,95 @@ export interface GrantAuthorizationCode {
   authorization_server?: string;
 }
 
+export interface TxCode {
+  /**
+   * OPTIONAL. String specifying the input character set. Possible values are numeric (only digits) and text (any characters). The default is numeric.
+   */
+  input_mode?: InputCharSet;
+
+  /**
+   * OPTIONAL. Integer specifying the length of the Transaction Code. This helps the Wallet to render the input screen and improve the user experience.
+   */
+  length?: number;
+
+  /**
+   * OPTIONAL. String containing guidance for the Holder of the Wallet on how to obtain the Transaction Code, e.g.,
+   * describing over which communication channel it is delivered. The Wallet is RECOMMENDED to display this description
+   * next to the Transaction Code input screen to improve the user experience. The length of the string MUST NOT exceed
+   * 300 characters. The description does not support internationalization, however the Issuer MAY detect the Holder's
+   * language by previous communication or an HTTP Accept-Language header within an HTTP GET request for a Credential Offer URI.
+   */
+  description?: string;
+}
+
 export interface GrantUrnIetf {
   /**
    * REQUIRED. The code representing the Credential Issuer's authorization for the Wallet to obtain Credentials of a certain type.
    */
+  // v12, v13
   'pre-authorized_code': string;
+  // v13
   /**
-   * OPTIONAL. Boolean value specifying whether the Credential Issuer expects presentation of a user PIN along with the Token Request
-   * in a Pre-Authorized Code Flow. Default is false.
+   * OPTIONAL. Object specifying whether the Authorization Server expects presentation of a Transaction Code by the
+   * End-User along with the Token Request in a Pre-Authorized Code Flow. If the Authorization Server does not expect a
+   * Transaction Code, this object is absent; this is the default. The Transaction Code is intended to bind the Pre-Authorized
+   * Code to a certain transaction to prevent replay of this code by an attacker that, for example, scanned the QR code while
+   * standing behind the legitimate End-User. It is RECOMMENDED to send the Transaction Code via a separate channel. If the Wallet
+   * decides to use the Pre-Authorized Code Flow, the Transaction Code value MUST be sent in the tx_code parameter with
+   * the respective Token Request as defined in Section 6.1. If no length or description is given, this object may be empty,
+   * indicating that a Transaction Code is required.
    */
-  user_pin_required: boolean;
+  tx_code?: TxCode;
 
-  //v12
+  // v12, v13
   /**
    * OPTIONAL. The minimum amount of time in seconds that the Wallet SHOULD wait between polling requests to the token endpoint (in case the Authorization Server responds with error code authorization_pending - see Section 6.3). If no value is provided, Wallets MUST use 5 as the default.
    */
   interval?: number;
 
-  // v12 feature
+  // v12, v13 feature
   /**
    * OPTIONAL string that the Wallet can use to identify the Authorization Server to use with this grant type when authorization_servers parameter in the Credential Issuer metadata has multiple entries. MUST NOT be used otherwise. The value of this parameter MUST match with one of the values in the authorization_servers array obtained from the Credential Issuer metadata
    */
   authorization_server?: string;
+
+  // v12 feature
+  /**
+   * OPTIONAL. Boolean value specifying whether the AS
+   * expects presentation of the End-User PIN along with the Token Request
+   * in a Pre-Authorized Code Flow. Default is false. This PIN is intended
+   * to bind the Pre-Authorized Code to a certain transaction to prevent
+   * replay of this code by an attacker that, for example, scanned the QR
+   * code while standing behind the legitimate End-User. It is RECOMMENDED
+   * to send a PIN via a separate channel. If the Wallet decides to use
+   * the Pre-Authorized Code Flow, a PIN value MUST be sent in
+   * the user_pin parameter with the respective Token Request.
+   */
+  user_pin_required?: boolean;
 }
 
 export const PRE_AUTH_CODE_LITERAL = 'pre-authorized_code';
+
+export type EndpointMetadataResult = EndpointMetadataResultV1_0_13 | EndpointMetadataResultV1_0_11;
+
+export type IssuerMetadata = IssuerMetadataV1_0_13 | IssuerMetadataV1_0_08;
+
+export type NotificationEventType = 'credential_accepted' | 'credential_failure' | 'credential_deleted';
+
+export interface NotificationRequest {
+  notification_id: string;
+  event: NotificationEventType | string;
+  event_description?: string;
+  credential?: any; // Experimental support to have a wallet sign a credential. Not part of the spec
+}
+
+export type NotificationError = 'invalid_notification_id' | 'invalid_notification_request';
+
+export type NotificationResult = {
+  error: boolean;
+  response?: NotificationErrorResponse;
+};
+
+export interface NotificationErrorResponse {
+  error: NotificationError | string;
+}

package/lib/types/OpenID4VCIErrors.ts

@@ -37,3 +37,4 @@ export const STATE_MANAGER_REQUIRED_ERROR = 'StateManager instance is required';
 export const NONCE_STATE_MANAGER_REQUIRED_ERROR = 'NonceStateManager instance is required';
 export const PIN_NOT_MATCHING_ERROR = 'PIN does not match';
 export const ACCESS_TOKEN_ISSUER_REQUIRED_ERROR = 'access token issuer is required';
+export const WRONG_METADATA_FORMAT = 'Wrong metadata format';

package/lib/types/OpenID4VCIVersions.types.ts

@@ -3,6 +3,7 @@ export enum OpenId4VCIVersion {
   VER_1_0_09 = 1009,
   VER_1_0_11 = 1011,
   VER_1_0_12 = 1012,
+  VER_1_0_13 = 1013,
   VER_UNKNOWN = Number.MAX_VALUE,
 }
 

package/lib/types/ServerMetadata.ts

@@ -1,6 +1,3 @@
-import { CredentialIssuerMetadata } from './Generic.types';
-import { IssuerMetadataV1_0_08 } from './v1_0_08.types';
-
 export interface AuthorizationServerMetadata {
   issuer: string;
   authorization_endpoint?: string;
@@ -71,10 +68,3 @@ export interface EndpointMetadata {
   authorization_server?: string;
   authorization_endpoint?: string; // Can be undefined in pre-auth flow
 }
-export interface EndpointMetadataResult extends EndpointMetadata {
-  // The EndpointMetadata are snake-case so they can easily be used in payloads/JSON.
-  // The values below should not end up in requests/responses directly, so they are using our normal CamelCase convention
-  authorizationServerType: AuthorizationServerType;
-  authorizationServerMetadata?: AuthorizationServerMetadata;
-  credentialIssuerMetadata?: Partial<AuthorizationServerMetadata> & (CredentialIssuerMetadata | IssuerMetadataV1_0_08);
-}

package/lib/types/StateManager.types.ts

@@ -13,6 +13,7 @@ export interface CredentialOfferSession extends StateType {
   status: IssueStatus;
   error?: string;
   lastUpdatedAt: number;
+  notification_id: string;
   issuerState?: string; //todo: Probably good to hash it here, since it would come in from the client and we could match the hash and thus use the client value
   preAuthorizedCode?: string; //todo: Probably good to hash it here, since it would come in from the client and we could match the hash and thus use the client value
 }

package/lib/types/index.ts

@@ -4,6 +4,7 @@ export * from './Generic.types';
 export * from './v1_0_08.types';
 export * from './v1_0_09.types';
 export * from './v1_0_11.types';
+export * from './v1_0_13.types';
 export * from './ServerMetadata';
 export * from './OpenID4VCIErrors';
 export * from './OpenID4VCIVersions.types';

package/lib/types/v1_0_11.types.ts

@@ -1,4 +1,7 @@
-import { AuthorizationDetailsJwtVcJson, CommonAuthorizationRequest } from './Authorization.types';
+import { ExperimentalSubjectIssuance } from '../experimental/holder-vci';
+
+import { AuthorizationDetailsJwtVcJson, AuthorizationServerOpts, CommonAuthorizationRequest } from './Authorization.types';
+import { UniformCredentialOffer, UniformCredentialOfferRequest } from './CredentialIssuance.types';
 import {
   CommonCredentialRequest,
   CredentialDataSupplierInput,
@@ -10,14 +13,26 @@ import {
   Grant,
 } from './Generic.types';
 import { QRCodeOpts } from './QRCode.types';
-import { AuthorizationServerMetadata } from './ServerMetadata';
+import { AuthorizationServerMetadata, AuthorizationServerType, EndpointMetadata } from './ServerMetadata';
+import { IssuerMetadataV1_0_08 } from './v1_0_08.types';
+
+export interface AccessTokenRequestOptsV1_0_11 {
+  credentialOffer?: UniformCredentialOffer;
+  credentialIssuer?: string;
+  asOpts?: AuthorizationServerOpts;
+  metadata?: EndpointMetadata;
+  codeVerifier?: string; // only required for authorization flow
+  code?: string; // only required for authorization flow
+  redirectUri?: string; // only required for authorization flow
+  pin?: string; // Pin-number. Only used when required
+}
 
 export interface CredentialOfferV1_0_11 {
   credential_offer?: CredentialOfferPayloadV1_0_11;
   credential_offer_uri?: string;
 }
 
-export interface CredentialOfferRESTRequest extends CredentialOfferV1_0_11 {
+export interface CredentialOfferRESTRequestV1_0_11 extends CredentialOfferV1_0_11 {
   baseUri?: string;
   scheme?: string;
   pinLength?: number;
@@ -25,6 +40,15 @@ export interface CredentialOfferRESTRequest extends CredentialOfferV1_0_11 {
   credentialDataSupplierInput?: CredentialDataSupplierInput;
 }
 
+export interface CredentialOfferRequestWithBaseUrlV1_0_11 extends UniformCredentialOfferRequest {
+  scheme: string;
+  clientId?: string;
+  baseUrl: string;
+  userPinRequired: boolean;
+  issuerState?: string;
+  preAuthorizedCode?: string;
+}
+
 export interface CredentialOfferPayloadV1_0_11 {
   /**
    * REQUIRED. The URL of the Credential Issuer, the Wallet is requested to obtain one or more Credentials from.
@@ -58,11 +82,16 @@ export interface CredentialOfferPayloadV1_0_11 {
 }
 
 export type CredentialRequestV1_0_11 = CommonCredentialRequest &
+  ExperimentalSubjectIssuance &
   (CredentialRequestJwtVcJson | CredentialRequestJwtVcJsonLdAndLdpVc | CredentialRequestSdJwtVc);
 
 export interface CredentialIssuerMetadataV1_0_11 extends CredentialIssuerMetadataOpts, Partial<AuthorizationServerMetadata> {
+  authorization_servers?: string[]; // OPTIONAL. Array of strings that identify the OAuth 2.0 Authorization Servers (as defined in [RFC8414]) the Credential Issuer relies on for authorization. If this element is omitted, the entity providing the Credential Issuer is also acting as the AS, i.e. the Credential Issuer's identifier is used as the OAuth 2.0 Issuer value to obtain the Authorization Server metadata as per [RFC8414].
   credential_endpoint: string; // REQUIRED. URL of the Credential Issuer's Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components.
-  authorization_server?: string;
+  credential_response_encryption_alg_values_supported?: string; // OPTIONAL. Array containing a list of the JWE [RFC7516] encryption algorithms (alg values) [RFC7518] supported by the Credential and/or Batch Credential Endpoint to encode the Credential or Batch Credential Response in a JWT [RFC7519].
+  credential_response_encryption_enc_values_supported?: string; //OPTIONAL. Array containing a list of the JWE [RFC7516] encryption algorithms (enc values) [RFC7518] supported by the Credential and/or Batch Credential Endpoint to encode the Credential or Batch Credential Response in a JWT [RFC7519].
+  require_credential_response_encryption?: boolean; //OPTIONAL. Boolean value specifying whether the Credential Issuer requires additional encryption on top of TLS for the Credential Response and expects encryption parameters to be present in the Credential Request and/or Batch Credential Request, with true indicating support. When the value is true, credential_response_encryption_alg_values_supported parameter MUST also be provided. If omitted, the default value is false.
+  credential_identifiers_supported?: boolean; // OPTIONAL. Boolean value specifying whether the Credential Issuer supports returning credential_identifiers parameter in the authorization_details Token Response parameter, with true indicating support. If omitted, the default value is false.
 }
 
 export interface AuthorizationRequestV1_0_11 extends AuthorizationDetailsJwtVcJson, AuthorizationDetailsJwtVcJson {
@@ -73,3 +102,11 @@ export interface AuthorizationRequestV1_0_11 extends AuthorizationDetailsJwtVcJs
 export function isAuthorizationRequestV1_0_11(request: CommonAuthorizationRequest): boolean {
   return request && 'issuer_state' in request;
 }
+
+export interface EndpointMetadataResultV1_0_11 extends EndpointMetadata {
+  // The EndpointMetadata are snake-case so they can easily be used in payloads/JSON.
+  // The values below should not end up in requests/responses directly, so they are using our normal CamelCase convention
+  authorizationServerType: AuthorizationServerType;
+  authorizationServerMetadata?: AuthorizationServerMetadata;
+  credentialIssuerMetadata?: Partial<AuthorizationServerMetadata> & IssuerMetadataV1_0_08;
+}

package/lib/types/v1_0_12.types.ts

@@ -1,4 +1,42 @@
-import { CommonCredentialRequest, CredentialRequestJwtVcJson, CredentialRequestJwtVcJsonLdAndLdpVc, CredentialRequestSdJwtVc } from './Generic.types';
+import {
+  CommonCredentialRequest,
+  CredentialRequestJwtVcJson,
+  CredentialRequestJwtVcJsonLdAndLdpVc,
+  CredentialRequestSdJwtVc,
+  Grant,
+} from './Generic.types';
 
 export type CredentialRequestV1_0_12 = CommonCredentialRequest &
   (CredentialRequestJwtVcJson | CredentialRequestJwtVcJsonLdAndLdpVc | CredentialRequestSdJwtVc);
+
+export interface CredentialOfferPayloadV1_0_12 {
+  /**
+   * REQUIRED. The URL of the Credential Issuer, as defined in Section 11.2.1, from which the Wallet is requested to
+   * obtain one or more Credentials. The Wallet uses it to obtain the Credential Issuer's Metadata following the steps
+   * defined in Section 11.2.2.
+   */
+  credential_issuer: string;
+
+  /**
+   *  REQUIRED. Array of unique strings that each identify one of the keys in the name/value pairs stored in
+   *  the credential_configurations_supported Credential Issuer metadata. The Wallet uses these string values
+   *  to obtain the respective object that contains information about the Credential being offered as defined
+   *  in Section 11.2.3. For example, these string values can be used to obtain scope values to be used in
+   *  the Authorization Request.
+   */
+  credential_configurations: string[];
+  /**
+   * OPTIONAL. A JSON object indicating to the Wallet the Grant Types the Credential Issuer's AS is prepared
+   * to process for this credential offer. Every grant is represented by a key and an object.
+   * The key value is the Grant Type identifier, the object MAY contain parameters either determining the way
+   * the Wallet MUST use the particular grant and/or parameters the Wallet MUST send with the respective request(s).
+   * If grants is not present or empty, the Wallet MUST determine the Grant Types the Credential Issuer's AS supports
+   * using the respective metadata. When multiple grants are present, it's at the Wallet's discretion which one to use.
+   */
+  grants?: Grant;
+
+  /**
+   * Some implementations might include a client_id in the offer. For instance EBSI in a same-device flow. (Cross-device tucks it in the state JWT)
+   */
+  client_id?: string;
+}