@sphereon/oid4vci-common 0.4.1-next.285

package/lib/types/Generic.types.ts

@@ -0,0 +1,234 @@
+import { ICredentialContextType, IVerifiableCredential, W3CVerifiableCredential } from '@sphereon/ssi-types';
+
+import { ProofOfPossession } from './CredentialIssuance.types';
+import { Oauth2ASWithOID4VCIMetadata } from './OpenID4VCIServerMetadata';
+import { IssuerMetadataV1_0_08 } from './v1_0_08.types';
+import { CredentialRequestV1_0_11 } from './v1_0_11.types';
+
+/**
+ * Important Note: please be aware that these Common interfaces are based on versions v1_0.11 and v1_0.09
+ */
+export interface CredentialLogo {
+  url?: string;
+  alt_text?: string;
+
+  [key: string]: unknown;
+}
+
+export type OID4VCICredentialFormat = 'jwt_vc_json' | 'jwt_vc_json-ld' | 'ldp_vc' /*| 'mso_mdoc'*/; // we do not support mdocs at this point
+
+export interface NameAndLocale {
+  name?: string; // REQUIRED. String value of a display name for the Credential.
+  locale?: string; // OPTIONAL. String value that identifies the language of this object represented as a language tag taken from values defined in BCP47 [RFC5646]. Multiple display objects MAY be included for separate languages. There MUST be only one object with the same language identifier.
+  [key: string]: unknown;
+}
+
+export interface LogoAndColor {
+  logo?: CredentialLogo; // OPTIONAL. A JSON object with information about the logo of the Credential with a following non-exhaustive list of parameters that MAY be included:
+  description?: string; // OPTIONAL. String value of a description of the Credential.
+  background_color?: string; //OPTIONAL. String value of a background color of the Credential represented as numerical color values defined in CSS Color Module Level 37 [CSS-Color].
+  text_color?: string; // OPTIONAL. String value of a text color of the Credential represented as numerical color values defined in CSS Color Module Level 37 [CSS-Color].
+}
+
+export type CredentialsSupportedDisplay = NameAndLocale &
+  LogoAndColor & {
+    name: string; // REQUIRED. String value of a display name for the Credential.
+  };
+
+export type MetadataDisplay = NameAndLocale &
+  LogoAndColor & {
+    name?: string; //OPTIONAL. String value of a display name for the Credential Issuer.
+  };
+
+export interface CredentialIssuerMetadataOpts {
+  credential_endpoint?: string; // REQUIRED. URL of the Credential Issuer's Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components.
+  batch_credential_endpoint?: string; // OPTIONAL. URL of the Credential Issuer's Batch Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components. If omitted, the Credential Issuer does not support the Batch Credential Endpoint.
+  credentials_supported: CredentialSupported[]; // REQUIRED. A JSON array containing a list of JSON objects, each of them representing metadata about a separate credential type that the Credential Issuer can issue. The JSON objects in the array MUST conform to the structure of the Section 10.2.3.1.
+  credential_issuer: string; // REQUIRED. The Credential Issuer's identifier.
+  authorization_server?: string; // OPTIONAL. Identifier of the OAuth 2.0 Authorization Server (as defined in [RFC8414]) the Credential Issuer relies on for authorization. If this element is omitted, the entity providing the Credential Issuer is also acting as the AS, i.e. the Credential Issuer's identifier is used as the OAuth 2.0 Issuer value to obtain the Authorization Server metadata as per [RFC8414].
+  token_endpoint?: string;
+  display?: MetadataDisplay[]; //  An array of objects, where each object contains display properties of a Credential Issuer for a certain language. Below is a non-exhaustive list of valid parameters that MAY be included:
+}
+
+// For now we extend the opts above. Only difference is that the credential endpoint is optional in the Opts, as it can come from other sources. The value is however required in the eventual Issuer Metadata
+export interface CredentialIssuerMetadata extends CredentialIssuerMetadataOpts {
+  credential_endpoint: string; // REQUIRED. URL of the Credential Issuer's Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components.
+  /*batch_credential_endpoint?: string; // OPTIONAL. URL of the Credential Issuer's Batch Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components. If omitted, the Credential Issuer does not support the Batch Credential Endpoint.
+  credentials_supported: CredentialSupported[]; // REQUIRED. A JSON array containing a list of JSON objects, each of them representing metadata about a separate credential type that the Credential Issuer can issue. The JSON objects in the array MUST conform to the structure of the Section 10.2.3.1.
+  credential_issuer: string; // REQUIRED. The Credential Issuer's identifier.
+  authorization_server?: string; // OPTIONAL. Identifier of the OAuth 2.0 Authorization Server (as defined in [RFC8414]) the Credential Issuer relies on for authorization. If this element is omitted, the entity providing the Credential Issuer is also acting as the AS, i.e. the Credential Issuer's identifier is used as the OAuth 2.0 Issuer value to obtain the Authorization Server metadata as per [RFC8414].
+  token_endpoint?: string;
+  display?: MetadataDisplay[]; //  An array of objects, where each object contains display properties of a Credential Issuer for a certain language. Below is a non-exhaustive list of valid parameters that MAY be included:*/
+}
+
+export interface CredentialSupportedBrief {
+  name?: string; // fixme: Probably should not be here, is part of the display object
+  types: string[]; // REQUIRED. JSON array designating the types a certain credential type supports
+  cryptographic_binding_methods_supported?: string[]; // OPTIONAL. Array of case sensitive strings that identify how the Credential is bound to the identifier of the End-User who possesses the Credential
+  cryptographic_suites_supported?: string[]; // OPTIONAL. Array of case sensitive strings that identify the cryptographic suites that are supported for the cryptographic_binding_methods_supported
+}
+
+export type CommonCredentialSupported = CredentialSupportedBrief & {
+  format: OID4VCICredentialFormat | string; //REQUIRED. A JSON string identifying the format of this credential, e.g. jwt_vc_json or ldp_vc.
+  id?: string; // OPTIONAL. A JSON string identifying the respective object. The value MUST be unique across all credentials_supported entries in the Credential Issuer Metadata
+  display?: CredentialsSupportedDisplay[]; // OPTIONAL. An array of objects, where each object contains the display properties of the supported credential for a certain language
+  /**
+   * following properties are non-mso_mdoc specific and we might wanna rethink them when we're going to support mso_mdoc
+   */
+  credentialSubject?: IssuerCredentialSubject; // OPTIONAL. A JSON object containing a list of key value pairs, where the key identifies the claim offered in the Credential. The value MAY be a dictionary, which allows to represent the full (potentially deeply nested) structure of the verifiable credential to be issued.
+  order?: string[]; //An array of claims.display.name values that lists them in the order they should be displayed by the Wallet.
+};
+
+export interface CredentialSupportedJwtVcJsonLdAndLdpVc extends CommonCredentialSupported {
+  '@context': ICredentialContextType[]; // REQUIRED. JSON array as defined in [VC_DATA], Section 4.1.
+}
+
+export interface CredentialSupportedJwtVcJson extends CommonCredentialSupported {
+  format: 'jwt_vc_json';
+}
+
+export type CredentialSupported = CommonCredentialSupported & (CredentialSupportedJwtVcJson | CredentialSupportedJwtVcJsonLdAndLdpVc);
+
+export interface CredentialOfferFormat {
+  format: OID4VCICredentialFormat | string;
+  types: string[];
+}
+
+export interface IssuerCredentialDefinition {
+  '@context': ICredentialContextType[];
+  types: string[];
+  credentialSubject: IssuerCredentialSubject;
+}
+
+/*
+export interface CredentialOfferCredentialDefinition {
+  '@context': ICredentialContextType[];
+  types: string[];
+  credentialSubject?: IssuerCredentialSubject;
+  order?: string[]; // An array of claims.display.name values that lists them in the order they should be displayed by the Wallet.
+}
+*/
+
+// export type GrantType = GrantTypes;
+
+/*
+export interface CommonAccessTokenRequest {
+  client_id?: string;
+  code?: string;
+  code_verifier?: string;
+  grant_type: GrantType;
+  'pre-authorized_code'?: string;
+  redirect_uri?: string;
+  scope?: string;
+  user_pin?: string;
+}
+*/
+
+/*
+export interface CommonAccessTokenResponse {
+  access_token: string;
+  scope?: string;
+  token_type?: string;
+  expires_in?: number; // in seconds
+  c_nonce?: string;
+  c_nonce_expires_in?: number; // in seconds
+  authorization_pending?: boolean;
+  interval?: number; // in seconds
+}
+*/
+
+export interface ErrorResponse extends Response {
+  error: string;
+  error_description?: string;
+  error_uri?: string;
+  state?: string;
+}
+
+export type UniformCredentialRequest = CredentialRequestV1_0_11;
+
+export interface CommonCredentialRequest {
+  format: OID4VCICredentialFormat /* | OID4VCICredentialFormat[];*/; // for now it seems only one is supported in the spec
+  proof?: ProofOfPossession;
+}
+
+export interface CredentialRequestJwtVcJson extends CommonCredentialRequest {
+  format: 'jwt_vc_json';
+  types: string[];
+  credentialSubject?: IssuerCredentialSubject;
+}
+
+export interface CredentialRequestJwtVcJsonLdAndLdpVc extends CommonCredentialRequest {
+  format: 'jwt_vc_json-ld' | 'ldp_vc';
+  credential_definition: IssuerCredentialDefinition;
+}
+
+export interface CommonCredentialResponse {
+  format: string;
+  credential?: W3CVerifiableCredential;
+  acceptance_token?: string;
+  c_nonce?: string;
+  c_nonce_expires_in?: string;
+}
+
+export interface CredentialResponseJwtVcJsonLdAndLdpVc extends CommonCredentialResponse {
+  format: 'jwt_vc_json-ld' | 'ldp_vc';
+  credential: IVerifiableCredential;
+}
+
+export interface CredentialResponseJwtVcJson {
+  credential: string;
+}
+// export type CredentialSubjectDisplay = NameAndLocale[];
+
+export type IssuerCredentialSubjectDisplay = CredentialSubjectDisplay & { [key: string]: CredentialSubjectDisplay };
+
+export interface CredentialSubjectDisplay {
+  mandatory?: boolean; // OPTIONAL. Boolean which when set to true indicates the claim MUST be present in the issued Credential. If the mandatory property is omitted its default should be assumed to be false.
+  value_type?: string; // OPTIONAL. String value determining type of value of the claim. A non-exhaustive list of valid values defined by this specification are string, number, and image media types such as image/jpeg as defined in IANA media type registry for images
+  display?: NameAndLocale[]; // OPTIONAL. An array of objects, where each object contains display properties of a certain claim in the Credential for a certain language. Below is a non-exhaustive list of valid parameters that MAY be included:
+}
+
+export interface IssuerCredentialSubject {
+  [key: string]: IssuerCredentialSubjectDisplay;
+}
+
+export interface Grant {
+  authorization_code?: GrantAuthorizationCode;
+  'urn:ietf:params:oauth:grant-type:pre-authorized_code'?: GrantUrnIetf;
+}
+
+export interface GrantAuthorizationCode {
+  /**
+   * OPTIONAL. String value created by the Credential Issuer and opaque to the Wallet that is used to bind the subsequent
+   * Authorization Request with the Credential Issuer to a context set up during previous steps.
+   */
+  issuer_state?: string;
+}
+
+export interface GrantUrnIetf {
+  /**
+   * REQUIRED. The code representing the Credential Issuer's authorization for the Wallet to obtain Credentials of a certain type.
+   */
+  'pre-authorized_code': string;
+  /**
+   * OPTIONAL. Boolean value specifying whether the Credential Issuer expects presentation of a user PIN along with the Token Request
+   * in a Pre-Authorized Code Flow. Default is false.
+   */
+  user_pin_required: boolean;
+}
+
+export const PRE_AUTH_CODE_LITERAL = 'pre-authorized_code';
+
+export enum WellKnownEndpoints {
+  OPENID_CONFIGURATION = '/.well-known/openid-configuration',
+  OAUTH_AS = '/.well-known/oauth-authorization-server',
+  OPENID4VCI_ISSUER = '/.well-known/openid-credential-issuer',
+}
+
+export interface EndpointMetadata {
+  issuer: string;
+  token_endpoint: string;
+  credential_endpoint: string;
+  authorization_endpoint?: string;
+  issuerMetadata?: CredentialIssuerMetadata | Oauth2ASWithOID4VCIMetadata | IssuerMetadataV1_0_08;
+}

package/lib/types/OAuth2ASMetadata.ts

@@ -0,0 +1,49 @@
+export interface OAuth2ASMetadata {
+  issuer: string;
+  authorization_endpoint?: string;
+  token_endpoint?: string;
+  token_endpoint_auth_methods_supported?: string[];
+  token_endpoint_auth_signing_alg_values_supported?: string[];
+
+  jwks_uri?: string;
+  registration_endpoint?: string;
+  scopes_supported?: string[];
+  response_types_supported: string[];
+  response_modes_supported?: string[];
+  grant_types_supported?: string[];
+  service_documentation?: string;
+  ui_locales_supported?: string[];
+  op_policy_uri?: string;
+  op_tos_uri?: string;
+
+  revocation_endpoint?: string;
+  revocation_endpoint_auth_methods_supported?: string[];
+  revocation_endpoint_auth_signing_alg_values_supported?: string[];
+
+  introspection_endpoint?: string;
+  code_challenge_methods_supported?: string[];
+
+  pushed_authorization_request_endpoint?: string; // The URL of the pushed authorization request endpoint at which a client can post an authorization request to exchange for a request_uri value usable at the authorization server
+  // Note that the presence of pushed_authorization_request_endpoint is sufficient for a client to determine that it may use the PAR flow. A request_uri value obtained from the PAR endpoint is usable at the authorization endpoint regardless of other authorization server metadata such as request_uri_parameter_supported or require_request_uri_registration
+  require_pushed_authorization_requests?: boolean; // Boolean parameter indicating whether Indicates whether the client is required to use PAR to initiate authorization. If omitted, the default value is false.
+  'pre-authorized_grant_anonymous_access_supported': boolean; // OPTIONAL. A JSON Boolean indicating whether the issuer accepts a Token Request with a Pre-Authorized Code but without a client id. The default is false
+
+  // OIDC values
+  frontchannel_logout_supported?: boolean;
+  frontchannel_logout_session_supported?: boolean;
+  backchannel_logout_supported?: boolean;
+  backchannel_logout_session_supported?: boolean;
+  userinfo_endpoint?: string;
+  check_session_iframe?: string;
+  end_session_endpoint?: string;
+  acr_values_supported?: string[];
+  subject_types_supported?: string[];
+  request_object_signing_alg_values_supported?: string[];
+  display_values_supported?: string[];
+  claim_types_supported?: string[];
+  claims_supported?: string[];
+  claims_parameter_supported?: boolean;
+
+  // eslint-disable-next-line  @typescript-eslint/no-explicit-any
+  [x: string]: any; //We use any, so you can access properties if you know the structure
+}

package/lib/types/OpenID4VCIErrors.ts

@@ -0,0 +1,35 @@
+import { Alg } from './CredentialIssuance.types';
+
+export const BAD_PARAMS = 'Wrong parameters provided';
+export const URL_NOT_VALID = 'Request url is not valid';
+export const JWS_NOT_VALID = 'JWS is not valid';
+export const PROOF_CANT_BE_CONSTRUCTED = "Proof can't be constructed.";
+export const NO_JWT_PROVIDED = 'No JWT provided';
+export const TYP_ERROR = 'Typ must be "openid4vci-proof+jwt"';
+export const ALG_ERROR = `Algorithm is a required field and must be one of: ${Object.keys(Alg).join(', ')}`;
+export const KID_JWK_X5C_ERROR = 'Only one must be present: kid, jwk or x5c';
+export const AUD_ERROR = 'aud must be the URL of the credential issuer';
+export const IAT_ERROR = 'iat must be the time at which the proof was issued';
+export const NONCE_ERROR = 'nonce must be c_nonce provided by the credential issuer';
+export const JWT_VERIFY_CONFIG_ERROR = 'JWT verify callback not configured correctly.';
+export const ISSUER_CONFIG_ERROR = 'Issuer not configured correctly.';
+export const UNKNOWN_CLIENT_ERROR = 'The client is not known by the issuer';
+export const NO_ISS_IN_AUTHORIZATION_CODE_CONTEXT = 'iss missing in authorization-code context';
+export const ISS_PRESENT_IN_PRE_AUTHORIZED_CODE_CONTEXT = 'iss should be omitted in pre-authorized-code context';
+export const ISS_MUST_BE_CLIENT_ID = 'iss must be the client id';
+export const GRANTS_MUST_NOT_BE_UNDEFINED = 'Grants must not be undefined';
+export const STATE_MISSING_ERROR = 'issuer state or pre-authorized key not found';
+export const CREDENTIAL_MISSING_ERROR = 'Credential must be present in response';
+export const UNSUPPORTED_GRANT_TYPE_ERROR = 'unsupported grant_type';
+export const PRE_AUTHORIZED_CODE_REQUIRED_ERROR = 'pre-authorized_code is required';
+export const USER_PIN_REQUIRED_ERROR = 'User pin is required';
+export const USER_PIN_NOT_REQUIRED_ERROR = 'User pin is not required';
+export const PIN_VALIDATION_ERROR = 'PIN must consist of maximum 8 numeric characters';
+export const PIN_NOT_MATCH_ERROR = 'PIN is invalid';
+export const INVALID_PRE_AUTHORIZED_CODE = 'pre-authorized_code is invalid';
+export const EXPIRED_PRE_AUTHORIZED_CODE = 'pre-authorized_code is expired';
+export const JWT_SIGNER_CALLBACK_REQUIRED_ERROR = 'JWT signer callback function is required';
+export const STATE_MANAGER_REQUIRED_ERROR = 'StateManager instance is required';
+export const NONCE_STATE_MANAGER_REQUIRED_ERROR = 'NonceStateManager instance is required';
+export const PIN_NOT_MATCHING_ERROR = 'PIN does not match';
+export const ACCESS_TOKEN_ISSUER_REQUIRED_ERROR = 'access token issuer is required';

package/lib/types/OpenID4VCIServerMetadata.ts

@@ -0,0 +1,20 @@
+import { CredentialIssuerMetadata } from './Generic.types';
+import { OAuth2ASMetadata } from './OAuth2ASMetadata';
+
+export type Oauth2ASWithOID4VCIMetadata = OAuth2ASMetadata & CredentialIssuerMetadata;
+
+// export type OpenID4VCICredentialFormatTypes = CredentialFormat | 'mdl_iso' | 'ac_vc' | string;
+
+/*export interface CredentialFormatSupport {
+  types: string[]; //REQUIRED. Array of strings representing a format specific type of a Credential. This value corresponds to type in W3C [VC_DATA] and a doctype in ISO/IEC 18013-5 (mobile Driving License).
+  cryptographic_binding_methods_supported?: string[]; //OPTIONAL. Array of case sensitive strings that identify how the Credential is bound to the identifier of the End-User who possesses the Credential as defined in Section 9.1. A non-exhaustive list of valid values defined by this specification are did, jwk, and mso.
+  cryptographic_suites_supported?: string[]; //OPTIONAL. Array of case sensitive strings that identify the cryptographic suites that are supported for the cryptographic_binding_methods_supported. Cryptosuites for Credentials in jwt_vc format should use algorithm names defined in IANA JOSE Algorithms Registry. Cryptosuites for Credentials in ldp_vc format should use signature suites names defined in Linked Data Cryptographic Suite Registry.
+  // eslint-disable-next-line  @typescript-eslint/no-explicit-any
+  [x: string]: any; //We use any, so you can access properties if you know the structure
+}*/
+/*
+
+export type Formats = {
+  [format in OpenID4VCICredentialFormatTypes]: CredentialFormatSupport;
+};
+*/

package/lib/types/OpenID4VCIVersions.types.ts

@@ -0,0 +1,11 @@
+export enum OpenId4VCIVersion {
+  VER_1_0_08 = 1008,
+  VER_1_0_09 = 1009,
+  VER_1_0_11 = 1011,
+  VER_UNKNOWN = Number.MIN_VALUE,
+}
+
+export enum DefaultURISchemes {
+  INITIATE_ISSUANCE = 'openid-initiate-issuance',
+  CREDENTIAL_OFFER = 'openid-credential-offer',
+}

package/lib/types/StateManager.types.ts

@@ -0,0 +1,45 @@
+import { AssertedUniformCredentialOffer } from './CredentialIssuance.types';
+
+export interface StateType {
+  createdAt: number;
+}
+
+export interface CredentialOfferSession extends StateType {
+  clientId?: string;
+  credentialOffer: AssertedUniformCredentialOffer;
+  userPin?: string;
+  issuerState?: string; //todo: Probably good to hash it here, since it would come in from the client and we could match the hash and thus use the client value
+  preAuthorizedCode?: string; //todo: Probably good to hash it here, since it would come in from the client and we could match the hash and thus use the client value
+}
+
+export interface CNonceState extends StateType {
+  cNonce: string;
+  issuerState?: string;
+  preAuthorizedCode?: string; //todo: Probably good to hash it here, since it would come in from the client and we could match the hash and thus use the client value
+}
+
+export interface URIState extends StateType {
+  issuerState?: string; //todo: Probably good to hash it here, since it would come in from the client and we could match the hash and thus use the client value
+  preAuthorizedCode?: string; //todo: Probably good to hash it here, since it would come in from the client and we could match the hash and thus use the client value
+  uri: string; //todo: Probably good to hash it here, since it would come in from the client and we could match the hash and thus use the client value
+}
+
+export interface IStateManager<T extends StateType> {
+  set(id: string, stateValue: T): Promise<void>;
+
+  get(id: string): Promise<T | undefined>;
+
+  has(id: string): Promise<boolean>;
+
+  delete(id: string): Promise<boolean>;
+
+  clearExpired(timestamp?: number): Promise<void>; // clears all expired states compared against timestamp if provided, otherwise current timestamp
+
+  clearAll(): Promise<void>; // clears all states
+
+  getAsserted(id: string): Promise<T>;
+
+  startCleanupRoutine(timeout?: number): Promise<void>;
+
+  stopCleanupRoutine(): Promise<void>;
+}

package/lib/types/Token.types.ts

@@ -0,0 +1,29 @@
+export enum TokenErrorResponse {
+  invalid_request = 'invalid_request',
+  invalid_grant = 'invalid_grant',
+  invalid_client = 'invalid_client', // this code has been added only in v1_0-11, but I've added this to the common interface. @nklomp is this ok?
+  invalid_scope = 'invalid_scope',
+}
+
+export class TokenError extends Error {
+  private readonly _statusCode: number;
+  private readonly _responseError: TokenErrorResponse;
+  constructor(statusCode: number, responseError: TokenErrorResponse, message: string) {
+    super(message);
+    this._statusCode = statusCode;
+    this._responseError = responseError;
+
+    // 👇️ because we are extending a built-in class
+    Object.setPrototypeOf(this, TokenError.prototype);
+  }
+  get statusCode(): number {
+    return this._statusCode;
+  }
+  get responseError(): TokenErrorResponse {
+    return this._responseError;
+  }
+
+  getDescription() {
+    return this.message;
+  }
+}

package/lib/types/index.ts

@@ -0,0 +1,12 @@
+export * from './Authorization.types';
+export * from './CredentialIssuance.types';
+export * from './Generic.types';
+export * from './v1_0_08.types';
+export * from './v1_0_09.types';
+export * from './v1_0_11.types';
+export * from './OAuth2ASMetadata';
+export * from './OpenID4VCIErrors';
+export * from './OpenID4VCIServerMetadata';
+export * from './OpenID4VCIVersions.types';
+export * from './StateManager.types';
+export * from './Token.types';

package/lib/types/v1_0_08.types.ts

@@ -0,0 +1,44 @@
+import { CredentialFormat } from '@sphereon/ssi-types';
+
+import { ProofOfPossession } from './CredentialIssuance.types';
+import { CredentialsSupportedDisplay, CredentialSupportedBrief, IssuerCredentialSubject, MetadataDisplay, NameAndLocale } from './Generic.types';
+
+export interface CredentialRequestV1_0_08 {
+  type: string;
+  format: CredentialFormat;
+  proof: ProofOfPossession;
+}
+
+export interface IssuerMetadataV1_0_08 {
+  issuer?: string;
+  credential_endpoint: string; // REQUIRED. URL of the OP's Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components.
+  credentials_supported: CredentialSupportedTypeV1_0_08; // REQUIRED. A JSON object containing a list of key value pairs, where the key is a string serving as an abstract identifier of the Credential. This identifier is RECOMMENDED to be collision resistant - it can be globally unique, but does not have to be when naming conflicts are unlikely to arise in a given use case. The value is a JSON object. The JSON object MUST conform to the structure of the Section 11.2.1.
+  credential_issuer?: {
+    //  OPTIONAL. A JSON object containing display properties for the Credential issuer.
+    display: NameAndLocale | NameAndLocale[]; // OPTIONAL. An array of objects, where each object contains display properties of a Credential issuer for a certain language. Below is a non-exhaustive list of valid parameters that MAY be included:
+  };
+  authorization_server?: string;
+  token_endpoint?: string;
+  display?: MetadataDisplay[];
+  [x: string]: unknown;
+}
+
+export interface CredentialOfferPayloadV1_0_08 {
+  issuer: string; //(url) REQUIRED The issuer URL of the Credential issuer, the Wallet is requested to obtain one or more Credentials from.
+  credential_type: string[] | string; //(url) REQUIRED A JSON string denoting the type of the Credential the Wallet shall request
+  'pre-authorized_code'?: string; //CONDITIONAL the code representing the issuer's authorization for the Wallet to obtain Credentials of a certain type. This code MUST be short-lived and single-use. MUST be present in a pre-authorized code flow.
+  user_pin_required?: boolean | string; //OPTIONAL Boolean value specifying whether the issuer expects presentation of a user PIN along with the Token Request in a pre-authorized code flow. Default is false.
+  op_state?: string; //(JWT) OPTIONAL String value created by the Credential Issuer and opaque to the Wallet that is used to bind the subsequent authentication request with the Credential Issuer to a context set up during previous steps
+}
+export interface CredentialSupportedTypeV1_0_08 {
+  [credentialType: string]: CredentialSupportedV1_0_08;
+}
+
+export interface CredentialSupportedV1_0_08 {
+  display?: CredentialsSupportedDisplay[];
+  formats: {
+    // REQUIRED. A JSON object containing a list of key value pairs, where the key is a string identifying the format of the Credential. Below is a non-exhaustive list of valid key values defined by this specification:
+    [credentialFormat: string]: CredentialSupportedBrief;
+  };
+  claims?: IssuerCredentialSubject; // REQUIRED. A JSON object containing a list of key value pairs, where the key identifies the claim offered in the Credential. The value is a JSON object detailing the specifics about the support for the claim with a following non-exhaustive list of parameters that MAY be included:
+}

package/lib/types/v1_0_09.types.ts

@@ -0,0 +1,36 @@
+import { CommonAuthorizationRequest } from './Authorization.types';
+import { CredentialOfferFormat } from './Generic.types';
+
+export interface CredentialOfferV1_0_09 {
+  credential_offer: CredentialOfferPayloadV1_0_09;
+}
+
+// https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-09.html#name-issuance-initiation-request
+export interface CredentialOfferPayloadV1_0_09 {
+  /**
+   * REQUIRED. The URL of the Credential Issuer, the Wallet is requested to obtain one or more Credentials from.
+   */
+  issuer: string;
+  /**
+   * REQUIRED. A JSON array, where every entry is a JSON object or a JSON string. If the entry is an object,
+   * the object contains the data related to a certain credential type the Wallet MAY request.
+   * Each object MUST contain a format Claim determining the format of the credential to be requested and
+   * further parameters characterising the type of the credential to be requested as defined in Appendix E.
+   * If the entry is a string, the string value MUST be one of the id values in one of the objects in the
+   * credentials_supported Credential Issuer metadata parameter.
+   * When processing, the Wallet MUST resolve this string value to the respective object.
+   */
+  credentials: (CredentialOfferFormat | string)[];
+  'pre-authorized_code'?: string; //CONDITIONAL the code representing the issuer's authorization for the Wallet to obtain Credentials of a certain type. This code MUST be short-lived and single-use. MUST be present in a pre-authorized code flow.
+  user_pin_required?: boolean | string; //OPTIONAL Boolean value specifying whether the issuer expects presentation of a user PIN along with the Token Request in a pre-authorized code flow. Default is false.
+  op_state?: string; //(JWT) OPTIONAL String value created by the Credential Issuer and opaque to the Wallet that is used to bind the subsequent authentication request with the Credential Issuer to a context set up during previous steps
+}
+
+export interface AuthorizationRequestV1_0_09 extends CommonAuthorizationRequest {
+  op_state?: string;
+}
+
+// todo https://sphereon.atlassian.net/browse/VDX-185
+export function isAuthorizationRequestV1_0_09(request: CommonAuthorizationRequest): boolean {
+  return request && 'op_state' in request;
+}

package/lib/types/v1_0_11.types.ts

@@ -0,0 +1,68 @@
+import { AuthorizationDetailsJwtVcJson, CommonAuthorizationRequest } from './Authorization.types';
+import {
+  CommonCredentialRequest,
+  CredentialOfferFormat,
+  CredentialRequestJwtVcJson,
+  CredentialRequestJwtVcJsonLdAndLdpVc,
+  Grant,
+  IssuerCredentialDefinition,
+} from './Generic.types';
+
+export interface CredentialOfferV1_0_11 {
+  credential_offer?: CredentialOfferPayloadV1_0_11;
+  credential_offer_uri?: string;
+}
+
+export interface CommonCredentialOfferPayloadV1_0_11 {
+  /**
+   * REQUIRED. The URL of the Credential Issuer, the Wallet is requested to obtain one or more Credentials from.
+   */
+  credential_issuer: string;
+
+  /**
+   * REQUIRED. A JSON array, where every entry is a JSON object or a JSON string. If the entry is an object,
+   * the object contains the data related to a certain credential type the Wallet MAY request.
+   * Each object MUST contain a format Claim determining the format of the credential to be requested and
+   * further parameters characterising the type of the credential to be requested as defined in Appendix E.
+   * If the entry is a string, the string value MUST be one of the id values in one of the objects in the
+   * credentials_supported Credential Issuer metadata parameter.
+   * When processing, the Wallet MUST resolve this string value to the respective object.
+   */
+  credentials: (CredentialOfferFormat | string)[];
+  /**
+   * OPTIONAL. A JSON object indicating to the Wallet the Grant Types the Credential Issuer's AS is prepared
+   * to process for this credential offer. Every grant is represented by a key and an object.
+   * The key value is the Grant Type identifier, the object MAY contain parameters either determining the way
+   * the Wallet MUST use the particular grant and/or parameters the Wallet MUST send with the respective request(s).
+   * If grants is not present or empty, the Wallet MUST determine the Grant Types the Credential Issuer's AS supports
+   * using the respective metadata. When multiple grants are present, it's at the Wallet's discretion which one to use.
+   */
+  grants?: Grant;
+}
+
+export interface CredentialOfferJwtVcJsonLdAndLdpVcV1_0_11 extends CommonCredentialOfferPayloadV1_0_11 {
+  /**
+   * REQUIRED. JSON object containing (and isolating) the detailed description of the credential type.
+   * This object MUST be processed using full JSON-LD processing. It consists of the following sub-claims:
+   *   - @context: REQUIRED. JSON array as defined in Appendix E.1.3.2
+   *   - types: REQUIRED. JSON array as defined in Appendix E.1.3.2.
+   *            This claim contains the type values the Wallet shall request in the subsequent Credential Request
+   */
+  credential_definition: IssuerCredentialDefinition;
+}
+
+export type CredentialOfferJwtVcJsonV1_0_11 = CommonCredentialOfferPayloadV1_0_11;
+
+export type CredentialOfferPayloadV1_0_11 = CommonCredentialOfferPayloadV1_0_11 &
+  (CredentialOfferJwtVcJsonLdAndLdpVcV1_0_11 | CredentialOfferJwtVcJsonV1_0_11);
+
+export type CredentialRequestV1_0_11 = CommonCredentialRequest & (CredentialRequestJwtVcJson | CredentialRequestJwtVcJsonLdAndLdpVc);
+
+export interface AuthorizationRequestV1_0_11 extends AuthorizationDetailsJwtVcJson, AuthorizationDetailsJwtVcJson {
+  issuer_state?: string;
+}
+
+// todo https://sphereon.atlassian.net/browse/VDX-185
+export function isAuthorizationRequestV1_0_11(request: CommonAuthorizationRequest): boolean {
+  return request && 'issuer_state' in request;
+}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@sphereon/oid4vci-common",
+  "version": "0.4.1-next.285+47fec82",
+  "description": "OpenID 4 Verifiable Credential Issuance Common Types",
+  "source": "lib/index.ts",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc"
+  },
+  "dependencies": {
+    "@sphereon/ssi-types": "^0.9.0",
+    "cross-fetch": "^3.1.6",
+    "jwt-decode": "^3.1.2"
+  },
+  "devDependencies": {
+    "@types/jest": "^29.5.0",
+    "typescript": "5.0.4"
+  },
+  "engines": {
+    "node": ">=16"
+  },
+  "files": [
+    "lib/**/*",
+    "dist/**/*"
+  ],
+  "prettier": {
+    "singleQuote": true,
+    "printWidth": 150
+  },
+  "keywords": [
+    "Sphereon",
+    "Verifiable Credentials",
+    "OpenID",
+    "OpenID for Verifiable Credential Issuance",
+    "OAuth2",
+    "SSI",
+    "OpenID4VCI",
+    "OIDC4VCI",
+    "OID4VCI"
+  ],
+  "author": "Sphereon",
+  "license": "Apache-2.0",
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "gitHead": "47fec82924b0d4a32f25737d7ba7379903fdb4f0"
+}