@sphereon/oid4vci-common 0.10.4-unstable.81 → 0.12.0

package/lib/functions/CredentialRequestUtil.ts

@@ -12,14 +12,9 @@ import { getFormatForVersion } from './FormatUtils';
 export function getTypesFromRequest(credentialRequest: CredentialRequest, opts?: { filterVerifiableCredential: boolean }) {
   let types: string[] = [];
   if ('credential_identifier' in credentialRequest && credentialRequest.credential_identifier) {
-    types = [credentialRequest.credential_identifier];
+    throw Error(`Cannot get types from request when it contains a credential_identifier`);
   } else if (credentialRequest.format === 'jwt_vc_json' || credentialRequest.format === 'jwt_vc') {
-    types =
-      'types' in credentialRequest
-        ? credentialRequest.types
-        : 'credential_identifier' in credentialRequest
-          ? [credentialRequest.credential_identifier]
-          : [];
+    types = 'types' in credentialRequest ? credentialRequest.types : [];
   } else if (credentialRequest.format === 'jwt_vc_json-ld' || credentialRequest.format === 'ldp_vc') {
     types =
       'credential_definition' in credentialRequest && credentialRequest.credential_definition
@@ -28,9 +23,7 @@ export function getTypesFromRequest(credentialRequest: CredentialRequest, opts?:
           // @ts-ignore
           'types' in credentialRequest.types
           ? (credentialRequest['types' as keyof CredentialRequest] as unknown as string[])
-          : 'credential_identifier' in credentialRequest
-            ? [credentialRequest.credential_identifier]
-            : [];
+          : [];
   } else if (credentialRequest.format === 'vc+sd-jwt') {
     types = 'vct' in credentialRequest ? [credentialRequest.vct as string] : [];
   }
@@ -49,9 +42,13 @@ export function getCredentialRequestForVersion(
   version: OpenId4VCIVersion,
 ): UniformCredentialRequest | CredentialRequestV1_0_08 | CredentialRequestV1_0_11 | CredentialRequestV1_0_13 {
   if (version === OpenId4VCIVersion.VER_1_0_08) {
-    const draft8Format = getFormatForVersion(credentialRequest.format, version);
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    const draft8Format = getFormatForVersion(credentialRequest.format!, version);
     const types = getTypesFromRequest(credentialRequest, { filterVerifiableCredential: true });
 
+    if (credentialRequest.credential_subject_issuance) {
+      throw Error('Experimental subject issuance is not supported for older versions of the spec');
+    }
     return {
       format: draft8Format,
       proof: credentialRequest.proof,

package/lib/functions/CredentialResponseUtil.ts

@@ -47,8 +47,8 @@ export async function acquireDeferredCredential({
   deferredCredentialIntervalInMS?: number;
   deferredCredentialAwait?: boolean;
   deferredCredentialEndpoint: string;
-}): Promise<OpenIDResponse<CredentialResponse>> {
-  let credentialResponse: OpenIDResponse<CredentialResponse> = await acquireDeferredCredentialImpl({
+}): Promise<OpenIDResponse<CredentialResponse> & { access_token: string }> {
+  let credentialResponse: OpenIDResponse<CredentialResponse> & { access_token: string } = await acquireDeferredCredentialImpl({
     bearerToken,
     transactionId,
     deferredCredentialEndpoint,
@@ -77,7 +77,7 @@ async function acquireDeferredCredentialImpl({
   bearerToken: string;
   transactionId?: string;
   deferredCredentialEndpoint: string;
-}): Promise<OpenIDResponse<CredentialResponse>> {
+}): Promise<OpenIDResponse<CredentialResponse> & { access_token: string }> {
   const response: OpenIDResponse<CredentialResponse> = await post(
     deferredCredentialEndpoint,
     JSON.stringify(transactionId ? { transaction_id: transactionId } : ''),
@@ -86,5 +86,5 @@ async function acquireDeferredCredentialImpl({
   console.log(JSON.stringify(response, null, 2));
   assertNonFatalError(response);
 
-  return response;
+  return { ...response, access_token: bearerToken };
 }

package/lib/functions/IssuerMetadataUtils.ts

@@ -1,3 +1,4 @@
+import { CredentialDefinitionV1_0_13, CredentialOfferFormat, JsonLdIssuerCredentialDefinition, VCI_LOG_COMMON } from '../index';
 import {
   AuthorizationServerMetadata,
   CredentialConfigurationSupported,
@@ -11,27 +12,58 @@ import {
   OpenId4VCIVersion,
 } from '../types';
 
-export function getSupportedCredentials(options?: {
+export function getSupportedCredentials(opts?: {
   issuerMetadata?: CredentialIssuerMetadata | IssuerMetadata;
   version: OpenId4VCIVersion;
   types?: string[][];
   format?: OID4VCICredentialFormat | string | (OID4VCICredentialFormat | string)[];
-}): Record<string, CredentialConfigurationSupportedV1_0_13> {
-  if (options?.types && Array.isArray(options.types)) {
-    return options.types
-      .map((typeSet) => {
-        return getSupportedCredential({ ...options, types: typeSet });
-      })
-      .reduce(
-        (acc, result) => {
-          Object.assign(acc, result);
-          return acc;
-        },
-        {} as Record<string, CredentialConfigurationSupportedV1_0_13>,
-      );
+}): Record<string, CredentialConfigurationSupportedV1_0_13> | Array<CredentialConfigurationSupported> {
+  const { version = OpenId4VCIVersion.VER_1_0_13, types } = opts ?? {};
+  if (types && Array.isArray(types)) {
+    if (version < OpenId4VCIVersion.VER_1_0_13) {
+      return types.flatMap((typeSet) => getSupportedCredential({ ...opts, version, types: typeSet }) as Array<CredentialConfigurationSupported>);
+    } else {
+      return types
+        .map((typeSet) => {
+          return getSupportedCredential({ ...opts, version, types: typeSet });
+        })
+        .reduce(
+          (acc, result) => {
+            Object.assign(acc, result);
+            return acc;
+          },
+          {} as Record<string, CredentialConfigurationSupportedV1_0_13>,
+        );
+    }
+  }
+
+  return getSupportedCredential(opts ? { ...opts, types: undefined } : undefined);
+}
+
+export function determineVersionsFromIssuerMetadata(issuerMetadata: CredentialIssuerMetadata | IssuerMetadata): Array<OpenId4VCIVersion> {
+  const versions = new Set<OpenId4VCIVersion>();
+  if ('authorization_server' in issuerMetadata) {
+    versions.add(OpenId4VCIVersion.VER_1_0_11);
+  } else if ('authorization_servers' in issuerMetadata) {
+    versions.add(OpenId4VCIVersion.VER_1_0_13);
+  }
+  if (versions.size === 0) {
+    // The above checks where already very specific and only applicable to single versions we support, so let's skip if we encounter them
+    if ('credential_configurations_supported' in issuerMetadata) {
+      versions.add(OpenId4VCIVersion.VER_1_0_13);
+    } else if ('credentials_supported' in issuerMetadata) {
+      if (typeof issuerMetadata.credentials_supported === 'object') {
+        versions.add(OpenId4VCIVersion.VER_1_0_08);
+      } else {
+        versions.add(OpenId4VCIVersion.VER_1_0_09).add(OpenId4VCIVersion.VER_1_0_11);
+      }
+    }
+  }
+  if (versions.size === 0) {
+    versions.add(OpenId4VCIVersion.VER_UNKNOWN);
   }
 
-  return getSupportedCredential(options ? { ...options, types: undefined } : undefined);
+  return Array.from(versions).sort().reverse(); // highest version first
 }
 
 export function getSupportedCredential(opts?: {
@@ -39,31 +71,82 @@ export function getSupportedCredential(opts?: {
   version: OpenId4VCIVersion;
   types?: string | string[];
   format?: OID4VCICredentialFormat | string | (OID4VCICredentialFormat | string)[];
-}): Record<string, CredentialConfigurationSupportedV1_0_13> {
-  const { issuerMetadata, types, format } = opts ?? {};
+}): Record<string, CredentialConfigurationSupportedV1_0_13> | Array<CredentialConfigurationSupported> {
+  const { issuerMetadata, types, format, version = OpenId4VCIVersion.VER_1_0_13 } = opts ?? {};
 
-  if (!issuerMetadata || !issuerMetadata.credential_configurations_supported) {
-    return {};
+  let credentialConfigurationsV11: Array<CredentialConfigurationSupported> | undefined = undefined;
+  let credentialConfigurationsV13: Record<string, CredentialConfigurationSupportedV1_0_13> | undefined = undefined;
+  if (version < OpenId4VCIVersion.VER_1_0_12 || issuerMetadata?.credentials_supported) {
+    if (issuerMetadata?.credentials_supported && !Array.isArray(issuerMetadata?.credentials_supported)) {
+      // The current code duplication and logic is such a mess, that we re-adjust the object to the proper type again
+      credentialConfigurationsV11 = [];
+      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+      Object.entries(issuerMetadata.credentials_supported!).forEach(([id, supported]) => {
+        if (!supported.id) {
+          supported.id = id;
+        }
+        credentialConfigurationsV11?.push(supported as CredentialConfigurationSupported);
+      });
+    } else {
+      credentialConfigurationsV11 = (issuerMetadata?.credentials_supported as Array<CredentialConfigurationSupported>) ?? [];
+    }
+  } else {
+    credentialConfigurationsV13 =
+      (issuerMetadata?.credential_configurations_supported as Record<string, CredentialConfigurationSupportedV1_0_13>) ?? {};
+  }
+  if (!issuerMetadata || (!issuerMetadata.credential_configurations_supported && !issuerMetadata.credentials_supported)) {
+    VCI_LOG_COMMON.warning(`No credential issuer metadata or supported credentials found for issuer}`);
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    return version < OpenId4VCIVersion.VER_1_0_13 ? credentialConfigurationsV11! : credentialConfigurationsV13!;
   }
 
-  const credentialConfigurations: Record<string, CredentialConfigurationSupportedV1_0_13> =
-    issuerMetadata.credential_configurations_supported as Record<string, CredentialConfigurationSupportedV1_0_13>;
   const normalizedTypes: string[] = Array.isArray(types) ? types : types ? [types] : [];
   const normalizedFormats: string[] = Array.isArray(format) ? format : format ? [format] : [];
 
-  return Object.entries(credentialConfigurations).reduce(
-    (filteredConfigs, [id, config]) => {
-      const isTypeMatch = normalizedTypes.length === 0 || normalizedTypes.some((type) => config.credential_definition.type?.includes(type));
-      const isFormatMatch = normalizedFormats.length === 0 || normalizedFormats.includes(config.format);
-
-      if (isTypeMatch && isFormatMatch) {
-        filteredConfigs[id] = config;
+  function filterMatchingConfig(config: CredentialConfigurationSupported): CredentialConfigurationSupported | undefined {
+    let isTypeMatch = normalizedTypes.length === 0;
+    const types = getTypesFromObject(config);
+    if (!isTypeMatch) {
+      if (normalizedTypes.length === 1 && config.id === normalizedTypes[0]) {
+        isTypeMatch = true;
+      } else if (types) {
+        isTypeMatch = normalizedTypes.every((type) => types.includes(type));
+      } else {
+        if ('credential_definition' in config) {
+          isTypeMatch = normalizedTypes.every((type) => config.credential_definition.type?.includes(type));
+        } else if ('type' in config && Array.isArray(config.type)) {
+          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-ignore
+          isTypeMatch = normalizedTypes.every((type) => config.type.includes(type));
+        } else if ('types' in config) {
+          isTypeMatch = normalizedTypes.every((type) => config.types?.includes(type));
+        }
       }
+    }
+
+    const isFormatMatch = normalizedFormats.length === 0 || normalizedFormats.includes(config.format);
+
+    return isTypeMatch && isFormatMatch ? config : undefined;
+  }
 
-      return filteredConfigs;
-    },
-    {} as Record<string, CredentialConfigurationSupportedV1_0_13>,
-  );
+  if (credentialConfigurationsV13) {
+    return Object.entries(credentialConfigurationsV13).reduce(
+      (filteredConfigs, [id, config]) => {
+        if (filterMatchingConfig(config)) {
+          filteredConfigs[id] = config;
+          // Added to enable support < 13. We basically assign the
+          if (!config.id) {
+            config.id = id;
+          }
+        }
+        return filteredConfigs;
+      },
+      {} as Record<string, CredentialConfigurationSupportedV1_0_13>,
+    );
+  } else if (credentialConfigurationsV11) {
+    return credentialConfigurationsV11.filter((config) => filterMatchingConfig(config));
+  }
+  throw Error(`Either < v11 configurations or V13 configurations should have been filtered at this point`);
 }
 
 export function getTypesFromCredentialSupported(
@@ -77,12 +160,7 @@ export function getTypesFromCredentialSupported(
     credentialSupported.format === 'jwt_vc_json-ld' ||
     credentialSupported.format === 'ldp_vc'
   ) {
-    types =
-      (credentialSupported.types
-        ? (credentialSupported.types as string[])
-        : 'credential_definition' in credentialSupported
-          ? credentialSupported.credential_definition?.type
-          : []) ?? [];
+    types = getTypesFromObject(credentialSupported) ?? [];
   } else if (credentialSupported.format === 'vc+sd-jwt') {
     // eslint-disable-next-line @typescript-eslint/ban-ts-comment
     // @ts-ignore
@@ -152,3 +230,28 @@ export function getIssuerName(
   }
   return url;
 }
+
+/**
+ * The specs had many places where types could be expressed. This method ensures we get them in any way possible
+ * @param subject
+ */
+export function getTypesFromObject(
+  subject: CredentialConfigurationSupported | CredentialOfferFormat | CredentialDefinitionV1_0_13 | JsonLdIssuerCredentialDefinition | string,
+): string[] | undefined {
+  if (subject === undefined) {
+    return undefined;
+  } else if (typeof subject === 'string') {
+    return [subject];
+  } else if ('credential_definition' in subject && subject.credential_definition) {
+    return getTypesFromObject(subject.credential_definition);
+  } else if ('types' in subject && subject.types) {
+    return Array.isArray(subject.types) ? subject.types : [subject.types];
+  } else if ('type' in subject && subject.type) {
+    return Array.isArray(subject.type) ? subject.type : [subject.type];
+  } else if ('vct' in subject && subject.vct) {
+    return [subject.vct];
+  }
+
+  VCI_LOG_COMMON.warning('Could not deduce credential types. Probably a failure down the line will happen!');
+  return undefined;
+}

package/lib/functions/ProofUtil.ts

@@ -0,0 +1,185 @@
+import Debug from 'debug';
+import jwtDecode from 'jwt-decode';
+
+import { PoPMode, VCI_LOG_COMMON } from '..';
+import {
+  BAD_PARAMS,
+  BaseJWK,
+  JWK,
+  JWS_NOT_VALID,
+  Jwt,
+  JWTHeader,
+  JWTPayload,
+  JWTVerifyCallback,
+  JwtVerifyResult,
+  ProofOfPossession,
+  ProofOfPossessionCallbacks,
+  Typ,
+} from '../types';
+
+const debug = Debug('sphereon:openid4vci:common');
+
+/**
+ *
+ *  - proofOfPossessionCallback: JWTSignerCallback
+ *    Mandatory if you want to create (sign) ProofOfPossession
+ *  - proofOfPossessionVerifierCallback?: JWTVerifyCallback
+ *    If exists, verifies the ProofOfPossession
+ *  - proofOfPossessionCallbackArgs: ProofOfPossessionCallbackArgs
+ *    arguments needed for signing ProofOfPossession
+ * @param callbacks:
+ *    - proofOfPossessionCallback: JWTSignerCallback
+ *      Mandatory to create (sign) ProofOfPossession
+ *    - proofOfPossessionVerifierCallback?: JWTVerifyCallback
+ *      If exists, verifies the ProofOfPossession
+ * @param jwtProps
+ * @param existingJwt
+ *  - Optional, clientId of the party requesting the credential
+ */
+export const createProofOfPossession = async <DIDDoc>(
+  popMode: PoPMode,
+  callbacks: ProofOfPossessionCallbacks<DIDDoc>,
+  jwtProps?: JwtProps,
+  existingJwt?: Jwt,
+): Promise<ProofOfPossession> => {
+  if (!callbacks.signCallback) {
+    debug(`no jwt signer callback or arguments supplied!`);
+    throw new Error(BAD_PARAMS);
+  }
+
+  const signerArgs = createJWT(popMode, jwtProps, existingJwt);
+  const jwt = await callbacks.signCallback(signerArgs, signerArgs.header.kid);
+  const proof = {
+    proof_type: 'jwt',
+    jwt,
+  } as ProofOfPossession;
+
+  try {
+    partiallyValidateJWS(jwt);
+    if (callbacks.verifyCallback) {
+      debug(`Calling supplied verify callback....`);
+      await callbacks.verifyCallback({ jwt, kid: signerArgs.header.kid });
+      debug(`Supplied verify callback return success result`);
+    }
+  } catch {
+    debug(`JWS was not valid`);
+    throw new Error(JWS_NOT_VALID);
+  }
+  debug(`Proof of Possession JWT:\r\n${jwt}`);
+  return proof;
+};
+
+const partiallyValidateJWS = (jws: string): void => {
+  if (jws.split('.').length !== 3 || !jws.startsWith('ey')) {
+    throw new Error(JWS_NOT_VALID);
+  }
+};
+
+export const isJWS = (token: string): boolean => {
+  try {
+    partiallyValidateJWS(token);
+    return true;
+  } catch (e) {
+    return false;
+  }
+};
+
+export const extractBearerToken = (authorizationHeader?: string): string | undefined => {
+  return authorizationHeader ? /Bearer (.*)/i.exec(authorizationHeader)?.[1] : undefined;
+};
+
+export const validateJWT = async (
+  jwt?: string,
+  opts?: { kid?: string; accessTokenVerificationCallback?: JWTVerifyCallback<never> },
+): Promise<JwtVerifyResult<any>> => {
+  if (!jwt) {
+    throw Error('No JWT was supplied');
+  }
+
+  if (!opts?.accessTokenVerificationCallback) {
+    VCI_LOG_COMMON.warning(`No access token verification callback supplied. Access tokens will not be verified, except for a very basic check`);
+    partiallyValidateJWS(jwt);
+    const header = jwtDecode<JWTHeader>(jwt, { header: true });
+    const payload = jwtDecode<JWTPayload>(jwt, { header: false });
+    return {
+      jwt: { header, payload } satisfies Jwt,
+      ...header,
+      ...payload,
+    };
+  } else {
+    return await opts.accessTokenVerificationCallback({ jwt, kid: opts.kid });
+  }
+};
+
+export interface JwtProps {
+  typ?: Typ;
+  kid?: string;
+  jwk?: JWK;
+  aud?: string | string[];
+  issuer?: string;
+  clientId?: string;
+  alg?: string;
+  jti?: string;
+  nonce?: string;
+}
+
+const createJWT = (mode: PoPMode, jwtProps?: JwtProps, existingJwt?: Jwt): Jwt => {
+  const aud =
+    mode === 'pop'
+      ? getJwtProperty<string | string[]>('aud', true, jwtProps?.issuer, existingJwt?.payload?.aud)
+      : getJwtProperty<string | string[]>('aud', false, jwtProps?.aud, existingJwt?.payload?.aud);
+  const iss =
+    // mode === 'pop'
+       getJwtProperty<string>('iss', false, jwtProps?.clientId, existingJwt?.payload?.iss)
+      // : getJwtProperty<string>('iss', false, jwtProps?.issuer, existingJwt?.payload?.iss);
+  const client_id = mode === 'jwt' ? getJwtProperty<string>('client_id', false, jwtProps?.clientId, existingJwt?.payload?.client_id) : undefined;
+  const jti = getJwtProperty<string>('jti', false, jwtProps?.jti, existingJwt?.payload?.jti);
+  const typ = getJwtProperty<string>('typ', true, jwtProps?.typ, existingJwt?.header?.typ, 'jwt');
+  const nonce = getJwtProperty<string>('nonce', false, jwtProps?.nonce, existingJwt?.payload?.nonce); // Officially this is required, but some implementations don't have it
+  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+  const alg = getJwtProperty<string>('alg', false, jwtProps?.alg, existingJwt?.header?.alg, 'ES256')!;
+  const kid = getJwtProperty<string>('kid', false, jwtProps?.kid, existingJwt?.header?.kid);
+  const jwk = getJwtProperty<BaseJWK>('jwk', false, jwtProps?.jwk, existingJwt?.header?.jwk);
+  const jwt: Partial<Jwt> = existingJwt ? existingJwt : {};
+  const now = +new Date();
+  const jwtPayload: Partial<JWTPayload> = {
+    ...(aud && { aud }),
+    iat: jwt.payload?.iat ?? Math.round(now / 1000 - 60), // Let's ensure we subtract 60 seconds for potential time offsets
+    exp: jwt.payload?.exp ?? Math.round(now / 1000 + 10 * 60),
+    nonce,
+    ...(client_id && { client_id }),
+    ...(iss && { iss }),
+    ...(jti && { jti }),
+  };
+
+  const jwtHeader: JWTHeader = {
+    typ,
+    alg,
+    ...(kid && { kid }),
+    ...(jwk && { jwk }),
+  };
+  return {
+    payload: { ...jwt.payload, ...jwtPayload },
+    header: { ...jwt.header, ...jwtHeader },
+  };
+};
+
+const getJwtProperty = <T>(
+  propertyName: string,
+  required: boolean,
+  option?: string | string[] | JWK,
+  jwtProperty?: T,
+  defaultValue?: T,
+): T | undefined => {
+  if (typeof option === 'string' && option && jwtProperty && option !== jwtProperty) {
+    throw Error(`Cannot have a property '${propertyName}' with value '${option}' and different JWT value '${jwtProperty}' at the same time`);
+  }
+  let result = (jwtProperty ? jwtProperty : option) as T | undefined;
+  if (!result) {
+    if (required) {
+      throw Error(`No ${propertyName} property provided either in a JWT or as option`);
+    }
+    result = defaultValue;
+  }
+  return result;
+};

package/lib/functions/index.ts

@@ -7,6 +7,7 @@ export * from './TypeConversionUtils';
 export * from './IssuerMetadataUtils';
 export * from './FormatUtils';
 export * from './HttpUtils';
+export * from './ProofUtil';
 export * from './AuthorizationResponseUtil';
 export { randomBytes };
 export * from './RandomUtils';

package/lib/index.ts

@@ -1,2 +1,9 @@
+import { Loggers } from '@sphereon/ssi-types';
+
+export const VCI_LOGGERS = Loggers.DEFAULT;
+export const VCI_LOG_COMMON = VCI_LOGGERS.get('sphereon:oid4vci:common');
+
 export * from './functions';
 export * from './types';
+export * from './experimental/holder-vci';
+export * from './events';

package/lib/types/Authorization.types.ts

@@ -1,4 +1,4 @@
-import { CredentialOfferPayload, UniformCredentialOffer } from './CredentialIssuance.types';
+import { CredentialOfferPayload, ProofOfPossessionCallbacks, UniformCredentialOffer } from './CredentialIssuance.types';
 import {
   ErrorResponse,
   IssuerCredentialSubject,
@@ -260,6 +260,21 @@ export interface PKCEOpts {
   codeVerifier?: string;
 }
 
+export enum CreateRequestObjectMode {
+  NONE,
+  REQUEST_OBJECT,
+  REQUEST_URI,
+}
+
+export type RequestObjectOpts = {
+  requestObjectMode?: CreateRequestObjectMode;
+  signCallbacks?: ProofOfPossessionCallbacks<never>;
+  clientMetadata?: Record<string, any>; // TODO: Merge SIOP/OID4VP
+  iss?: string;
+  jwksUri?: string;
+  kid?: string;
+};
+
 export interface AuthorizationRequestOpts {
   clientId?: string;
   pkce?: PKCEOpts;
@@ -267,6 +282,7 @@ export interface AuthorizationRequestOpts {
   authorizationDetails?: AuthorizationDetails | AuthorizationDetails[];
   redirectUri?: string;
   scope?: string;
+  requestObjectOpts?: RequestObjectOpts;
 }
 
 export interface AuthorizationResponse {

package/lib/types/CredentialIssuance.types.ts

@@ -1,5 +1,7 @@
 import { W3CVerifiableCredential } from '@sphereon/ssi-types';
 
+import { ExperimentalSubjectIssuance } from '../experimental/holder-vci';
+
 import { AuthzFlowType } from './Authorization.types';
 import { OID4VCICredentialFormat, TxCode, UniformCredentialRequest } from './Generic.types';
 import { OpenId4VCIVersion } from './OpenID4VCIVersions.types';
@@ -8,13 +10,14 @@ import { CredentialOfferPayloadV1_0_09, CredentialOfferV1_0_09 } from './v1_0_09
 import { CredentialOfferPayloadV1_0_11, CredentialOfferV1_0_11, CredentialRequestV1_0_11 } from './v1_0_11.types';
 import { CredentialOfferPayloadV1_0_13, CredentialOfferV1_0_13, CredentialRequestV1_0_13 } from './v1_0_13.types';
 
-export interface CredentialResponse {
+export interface CredentialResponse extends ExperimentalSubjectIssuance {
   credential?: W3CVerifiableCredential; // OPTIONAL. Contains issued Credential. MUST be present when acceptance_token is not returned. MAY be a JSON string or a JSON object, depending on the Credential format. See Appendix E for the Credential format specific encoding requirements
-  format: OID4VCICredentialFormat /* | OID4VCICredentialFormat[]*/; // REQUIRED. JSON string denoting the format of the issued Credential  TODO: remove when cleaning <v13
+  format?: OID4VCICredentialFormat /* | OID4VCICredentialFormat[]*/; // REQUIRED. JSON string denoting the format of the issued Credential  TODO: remove when cleaning <v13
   transaction_id?: string; //OPTIONAL. A string identifying a Deferred Issuance transaction. This claim is contained in the response if the Credential Issuer was unable to immediately issue the credential. The value is subsequently used to obtain the respective Credential with the Deferred Credential Endpoint (see Section 9). It MUST be present when the credential parameter is not returned. It MUST be invalidated after the credential for which it was meant has been obtained by the Wallet.
   acceptance_token?: string; //deprecated // OPTIONAL. A JSON string containing a security token subsequently used to obtain a Credential. MUST be present when credential is not returned
   c_nonce?: string; // OPTIONAL. JSON string containing a nonce to be used to create a proof of possession of key material when requesting a Credential (see Section 7.2). When received, the Wallet MUST use this nonce value for its subsequent credential requests until the Credential Issuer provides a fresh nonce
   c_nonce_expires_in?: number; // OPTIONAL. JSON integer denoting the lifetime in seconds of the c_nonce
+  notification_id?: string;
 }
 
 export interface CredentialOfferRequestWithBaseUrl extends UniformCredentialOfferRequest {
@@ -24,6 +27,7 @@ export interface CredentialOfferRequestWithBaseUrl extends UniformCredentialOffe
   txCode?: TxCode;
   issuerState?: string;
   preAuthorizedCode?: string;
+  userPinRequired: boolean;
 }
 
 export type CredentialOffer = CredentialOfferV1_0_09 | CredentialOfferV1_0_11 | CredentialOfferV1_0_13;
@@ -195,6 +199,7 @@ export interface JWTPayload {
   nonce?: string; // REQUIRED (string). The value type of this claim MUST be a string, where the value is a c_nonce provided by the credential issuer. //TODO: Marked as required not present in NGI flow
   jti?: string; // A new nonce chosen by the wallet. Used to prevent replay
   exp?: number; // Not longer than 5 minutes
+  client_id?: string; // (string). The value of this claim MUST be the client_id of the client making the credential request.
   [s: string]: unknown;
 }
 
@@ -207,6 +212,6 @@ export interface JwtVerifyResult<DIDDoc> {
   alg: string;
   did?: string;
   didDocument?: DIDDoc;
-  x5c?: string;
+  x5c?: string[];
   jwk?: BaseJWK;
 }