@sphereon/oid4vci-common 0.8.2-next.4 → 0.8.2-next.46

package/dist/types/v1_0_11.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"v1_0_11.types.d.ts","sourceRoot":"","sources":["../../lib/types/v1_0_11.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,EACL,0BAA0B,EAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA2B,SAAQ,sBAAsB;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,2BAA2B,CAAC,EAAE,2BAA2B,CAAC;CAC3D;AAED,MAAM,WAAW,mCAAmC;IAClD;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,WAAW,EAAE,CAAC,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC;IAChD;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;CAChB;AAED,MAAM,WAAW,2BAA4B,SAAQ,mCAAmC;IACtF;;;;;;OAMG;IACH,qBAAqB,EAAE,0BAA0B,CAAC;CACnD;AAED,MAAM,MAAM,2BAA2B,GAAG,mCAAmC,CAAC;AAE9E,MAAM,MAAM,6BAA6B,GAAG,mCAAmC,GAAG,CAAC,2BAA2B,GAAG,2BAA2B,CAAC,CAAC;AAE9I,MAAM,MAAM,wBAAwB,GAAG,uBAAuB,GAAG,CAAC,sBAAsB,GAAG,sBAAsB,CAAC,CAAC;AAEnH,MAAM,WAAW,2BAA4B,SAAQ,6BAA6B,EAAE,6BAA6B;IAC/G,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAGD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAE1F"}
+{"version":3,"file":"v1_0_11.types.d.ts","sourceRoot":"","sources":["../../lib/types/v1_0_11.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,0BAA0B,EAC1B,oCAAoC,EACpC,wBAAwB,EACxB,KAAK,EACN,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA2B,SAAQ,sBAAsB;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,2BAA2B,CAAC,EAAE,2BAA2B,CAAC;CAC3D;AAED,MAAM,WAAW,6BAA6B;IAC5C;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;;;;;OAQG;IACH,WAAW,EAAE,CAAC,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC;IAChD;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;CAChB;AAED,MAAM,MAAM,wBAAwB,GAAG,uBAAuB,GAC5D,CAAC,0BAA0B,GAAG,oCAAoC,GAAG,wBAAwB,CAAC,CAAC;AAEjG,MAAM,WAAW,2BAA4B,SAAQ,6BAA6B,EAAE,6BAA6B;IAC/G,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAGD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAE1F"}

package/dist/types/v1_0_11.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"v1_0_11.types.js","sourceRoot":"","sources":["../../lib/types/v1_0_11.types.ts"],"names":[],"mappings":";;;AAyEA,qDAAqD;AACrD,SAAgB,6BAA6B,CAAC,OAAmC;IAC/E,OAAO,OAAO,IAAI,cAAc,IAAI,OAAO,CAAC;AAC9C,CAAC;AAFD,sEAEC"}
+{"version":3,"file":"v1_0_11.types.js","sourceRoot":"","sources":["../../lib/types/v1_0_11.types.ts"],"names":[],"mappings":";;;AA2DA,qDAAqD;AACrD,SAAgB,6BAA6B,CAAC,OAAmC;IAC/E,OAAO,OAAO,IAAI,cAAc,IAAI,OAAO,CAAC;AAC9C,CAAC;AAFD,sEAEC"}

package/lib/functions/CredentialOfferUtil.ts

@@ -340,3 +340,30 @@ function recordVersion(currentVersion: OpenId4VCIVersion, matchingVersion: OpenI
     `Invalid param. Some keys have been used from version: ${currentVersion} version while '${key}' is used from version: ${matchingVersion}`,
   );
 }
+
+export function getTypesFromOffer(credentialOffer: UniformCredentialOfferPayload, opts?: { filterVerifiableCredential: boolean }) {
+  const types = credentialOffer.credentials.reduce<string[]>((prev, curr) => {
+    // FIXME returning the string value is wrong (as it's an id), but just matching the current behavior of this library
+    // The credential_type (from draft 8) and the actual 'type' value in a VC (from draft 11) are mixed up
+    // Fix for this here: https://github.com/Sphereon-Opensource/OID4VCI/pull/54
+    if (typeof curr === 'string') {
+      return [...prev, curr];
+    } else if (curr.format === 'jwt_vc_json-ld' || curr.format === 'ldp_vc') {
+      return [...prev, ...curr.credential_definition.types];
+    } else if (curr.format === 'jwt_vc_json' || curr.format === 'jwt_vc') {
+      return [...prev, ...curr.types];
+    } else if (curr.format === 'vc+sd-jwt') {
+      return [...prev, curr.vct];
+    }
+
+    return prev;
+  }, []);
+
+  if (!types || types.length === 0) {
+    throw Error('Could not deduce types from credential offer');
+  }
+  if (opts?.filterVerifiableCredential) {
+    return types.filter((type) => type !== 'VerifiableCredential');
+  }
+  return types;
+}

package/lib/functions/CredentialRequestUtil.ts

@@ -1,7 +1,17 @@
-import { CredentialRequestV1_0_11 } from '../types';
+import { CredentialRequestV1_0_08, OpenId4VCIVersion, UniformCredentialRequest } from '../types';
+
+import { getFormatForVersion } from './FormatUtils';
+
+export function getTypesFromRequest(credentialRequest: UniformCredentialRequest, opts?: { filterVerifiableCredential: boolean }) {
+  let types: string[] = [];
+  if (credentialRequest.format === 'jwt_vc_json' || credentialRequest.format === 'jwt_vc') {
+    types = credentialRequest.types;
+  } else if (credentialRequest.format === 'jwt_vc_json-ld' || credentialRequest.format === 'ldp_vc') {
+    types = credentialRequest.credential_definition.types;
+  } else if (credentialRequest.format === 'vc+sd-jwt') {
+    types = [credentialRequest.vct];
+  }
 
-export function getTypesFromRequest(credentialRequest: CredentialRequestV1_0_11, opts?: { filterVerifiableCredential: boolean }) {
-  const types = 'types' in credentialRequest ? credentialRequest.types : credentialRequest.credential_definition.types;
   if (!types || types.length === 0) {
     throw Error('Could not deduce types from credential request');
   }
@@ -10,3 +20,21 @@ export function getTypesFromRequest(credentialRequest: CredentialRequestV1_0_11,
   }
   return types;
 }
+
+export function getCredentialRequestForVersion(
+  credentialRequest: UniformCredentialRequest,
+  version: OpenId4VCIVersion,
+): UniformCredentialRequest | CredentialRequestV1_0_08 {
+  if (version === OpenId4VCIVersion.VER_1_0_08) {
+    const draft8Format = getFormatForVersion(credentialRequest.format, version);
+    const types = getTypesFromRequest(credentialRequest, { filterVerifiableCredential: true });
+
+    return {
+      format: draft8Format,
+      proof: credentialRequest.proof,
+      type: types[0],
+    } satisfies CredentialRequestV1_0_08;
+  }
+
+  return credentialRequest;
+}

package/lib/functions/CredentialResponseUtil.ts

@@ -0,0 +1,90 @@
+import { CredentialResponse, OpenIDResponse } from '../types';
+
+import { post } from './HttpUtils';
+
+export function isDeferredCredentialResponse(credentialResponse: OpenIDResponse<CredentialResponse>) {
+  const orig = credentialResponse.successBody;
+  // Specs mention 202, but some implementations like EBSI return 200
+  return credentialResponse.origResponse.status % 200 <= 2 && !!orig && !orig.credential && (!!orig.acceptance_token || !!orig.transaction_id);
+}
+function assertNonFatalError(credentialResponse: OpenIDResponse<CredentialResponse>) {
+  if (credentialResponse.origResponse.status === 400 && credentialResponse.errorBody?.error) {
+    if (credentialResponse.errorBody.error === 'invalid_transaction_id' || credentialResponse.errorBody.error.includes('acceptance_token')) {
+      throw Error('Invalid transaction id. Probably the deferred credential request expired');
+    }
+  }
+}
+
+export function isDeferredCredentialIssuancePending(credentialResponse: OpenIDResponse<CredentialResponse>) {
+  if (isDeferredCredentialResponse(credentialResponse)) {
+    return !!credentialResponse?.successBody?.transaction_id ?? !!credentialResponse?.successBody?.acceptance_token;
+  }
+  if (credentialResponse.origResponse.status === 400 && credentialResponse.errorBody?.error) {
+    if (credentialResponse.errorBody.error === 'issuance_pending') {
+      return true;
+    } else if (credentialResponse.errorBody.error_description?.toLowerCase().includes('not available yet')) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function sleep(ms: number) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+
+export async function acquireDeferredCredential({
+  bearerToken,
+  transactionId,
+  deferredCredentialEndpoint,
+  deferredCredentialIntervalInMS,
+  deferredCredentialAwait,
+}: {
+  bearerToken: string;
+  transactionId?: string;
+  deferredCredentialIntervalInMS?: number;
+  deferredCredentialAwait?: boolean;
+  deferredCredentialEndpoint: string;
+}): Promise<OpenIDResponse<CredentialResponse>> {
+  let credentialResponse: OpenIDResponse<CredentialResponse> = await acquireDeferredCredentialImpl({
+    bearerToken,
+    transactionId,
+    deferredCredentialEndpoint,
+  });
+
+  const DEFAULT_SLEEP_IN_MS = 5000;
+  while (!credentialResponse.successBody?.credential && deferredCredentialAwait) {
+    assertNonFatalError(credentialResponse);
+    const pending = isDeferredCredentialIssuancePending(credentialResponse);
+    console.log(`Issuance still pending?: ${pending}`);
+    if (!pending) {
+      throw Error(`Issuance isn't pending anymore: ${credentialResponse}`);
+    }
+
+    await sleep(deferredCredentialIntervalInMS ?? DEFAULT_SLEEP_IN_MS);
+    credentialResponse = await acquireDeferredCredentialImpl({ bearerToken, transactionId, deferredCredentialEndpoint });
+  }
+  return credentialResponse;
+}
+
+async function acquireDeferredCredentialImpl({
+  bearerToken,
+  transactionId,
+  deferredCredentialEndpoint,
+}: {
+  bearerToken: string;
+  transactionId?: string;
+  deferredCredentialEndpoint: string;
+}): Promise<OpenIDResponse<CredentialResponse>> {
+  const response: OpenIDResponse<CredentialResponse> = await post(
+    deferredCredentialEndpoint,
+    JSON.stringify(transactionId ? { transaction_id: transactionId } : ''),
+    { bearerToken },
+  );
+  console.log(JSON.stringify(response, null, 2));
+  assertNonFatalError(response);
+
+  return response;
+}

package/lib/functions/FormatUtils.ts

@@ -0,0 +1,52 @@
+import { CredentialFormat } from '@sphereon/ssi-types';
+
+import { OID4VCICredentialFormat, OpenId4VCIVersion } from '../types';
+
+export function isFormat<T extends { format?: OID4VCICredentialFormat }, Format extends OID4VCICredentialFormat>(
+  formatObject: T,
+  format: Format,
+): formatObject is T & { format: Format } {
+  return formatObject.format === format;
+}
+
+export function isNotFormat<T extends { format?: OID4VCICredentialFormat }, Format extends OID4VCICredentialFormat>(
+  formatObject: T,
+  format: Format,
+): formatObject is T & { format: Exclude<OID4VCICredentialFormat, Format> } {
+  return formatObject.format !== format;
+}
+
+const isUniformFormat = (format: string): format is OID4VCICredentialFormat => {
+  return ['jwt_vc_json', 'jwt_vc_json-ld', 'ldp_vc', 'vc+sd-jwt'].includes(format);
+};
+
+export function getUniformFormat(format: string | OID4VCICredentialFormat | CredentialFormat): OID4VCICredentialFormat {
+  // Already valid format
+  if (isUniformFormat(format)) {
+    return format;
+  }
+
+  // Older formats
+  if (format === 'jwt_vc' || format === 'jwt') {
+    return 'jwt_vc';
+  }
+  if (format === 'ldp_vc' || format === 'ldp') {
+    return 'ldp_vc';
+  }
+
+  throw new Error(`Invalid format: ${format}`);
+}
+
+export function getFormatForVersion(format: string, version: OpenId4VCIVersion) {
+  const uniformFormat = isUniformFormat(format) ? format : getUniformFormat(format);
+
+  if (version === OpenId4VCIVersion.VER_1_0_08) {
+    if (uniformFormat === 'jwt_vc_json') {
+      return 'jwt_vc' as const;
+    } else if (uniformFormat === 'ldp_vc' || uniformFormat === 'jwt_vc_json-ld') {
+      return 'ldp_vc' as const;
+    }
+  }
+
+  return uniformFormat;
+}

package/lib/functions/HttpUtils.ts

@@ -8,7 +8,7 @@ const debug = Debug('sphereon:openid4vci:http');
 export const getJson = async <T>(
   URL: string,
   opts?: {
-    bearerToken?: string;
+    bearerToken?: (() => Promise<string>) | string;
     contentType?: string;
     accept?: string;
     customHeaders?: Record<string, string>;
@@ -22,7 +22,7 @@ export const formPost = async <T>(
   url: string,
   body: BodyInit,
   opts?: {
-    bearerToken?: string;
+    bearerToken?: (() => Promise<string>) | string;
     contentType?: string;
     accept?: string;
     customHeaders?: Record<string, string>;
@@ -36,7 +36,7 @@ export const post = async <T>(
   url: string,
   body?: BodyInit,
   opts?: {
-    bearerToken?: string;
+    bearerToken?: (() => Promise<string>) | string;
     contentType?: string;
     accept?: string;
     customHeaders?: Record<string, string>;
@@ -51,7 +51,7 @@ const openIdFetch = async <T>(
   body?: BodyInit,
   opts?: {
     method?: string;
-    bearerToken?: string;
+    bearerToken?: (() => Promise<string>) | string;
     contentType?: string;
     accept?: string;
     customHeaders?: Record<string, string>;
@@ -60,7 +60,7 @@ const openIdFetch = async <T>(
 ): Promise<OpenIDResponse<T>> => {
   const headers: Record<string, string> = opts?.customHeaders ?? {};
   if (opts?.bearerToken) {
-    headers['Authorization'] = `Bearer ${opts.bearerToken}`;
+    headers['Authorization'] = `Bearer ${typeof opts.bearerToken === 'function' ? await opts.bearerToken() : opts.bearerToken}`;
   }
   const method = opts?.method ? opts.method : body ? 'POST' : 'GET';
   const accept = opts?.accept ? opts.accept : 'application/json';

package/lib/functions/IssuerMetadataUtils.ts

@@ -43,7 +43,7 @@ export function getSupportedCredential(opts?: {
   }
   const { version, types } = opts ?? { version: OpenId4VCIVersion.VER_1_0_11 };
   if (version === OpenId4VCIVersion.VER_1_0_08 || !Array.isArray(issuerMetadata.credentials_supported)) {
-    credentialsSupported = credentialsSupportedV8ToV11((issuerMetadata as IssuerMetadataV1_0_08).credentials_supported);
+    credentialsSupported = credentialsSupportedV8ToV11((issuerMetadata as IssuerMetadataV1_0_08).credentials_supported ?? {});
   } else {
     credentialsSupported = (issuerMetadata as CredentialIssuerMetadata).credentials_supported;
   }
@@ -73,7 +73,7 @@ export function getSupportedCredential(opts?: {
   if ((opts?.types && typeof opts?.types === 'string') || opts?.types?.length === 1) {
     const types = Array.isArray(opts.types) ? opts.types[0] : opts.types;
     const supported = credentialsSupported.filter(
-      (sup) => sup.id === types || (initiationTypes && arrayEqualsIgnoreOrder(sup.types, initiationTypes)),
+      (sup) => sup.id === types || (initiationTypes && arrayEqualsIgnoreOrder(getTypesFromCredentialSupported(sup), initiationTypes)),
     );
     if (supported) {
       credentialSupportedOverlap.push(...supported);
@@ -86,7 +86,7 @@ export function getSupportedCredential(opts?: {
       initiationTypes.push('VerifiableCredential');
     }
     const supported = credentialsSupported.filter((sup) => {
-      const supTypes = sup.types;
+      const supTypes = getTypesFromCredentialSupported(sup);
       if (!supTypes.includes('VerifiableCredential')) {
         supTypes.push('VerifiableCredential');
       }
@@ -99,6 +99,28 @@ export function getSupportedCredential(opts?: {
   return credentialSupportedOverlap;
 }
 
+export function getTypesFromCredentialSupported(credentialSupported: CredentialSupported, opts?: { filterVerifiableCredential: boolean }) {
+  let types: string[] = [];
+  if (
+    credentialSupported.format === 'jwt_vc_json' ||
+    credentialSupported.format === 'jwt_vc' ||
+    credentialSupported.format === 'jwt_vc_json-ld' ||
+    credentialSupported.format === 'ldp_vc'
+  ) {
+    types = credentialSupported.types;
+  } else if (credentialSupported.format === 'vc+sd-jwt') {
+    types = [credentialSupported.vct];
+  }
+
+  if (!types || types.length === 0) {
+    throw Error('Could not deduce types from credential supported');
+  }
+  if (opts?.filterVerifiableCredential) {
+    return types.filter((type) => type !== 'VerifiableCredential');
+  }
+  return types;
+}
+
 function arrayEqualsIgnoreOrder(a: string[], b: string[]) {
   if (a.length !== b.length) return false;
   const uniqueValues = new Set([...a, ...b]);
@@ -127,7 +149,7 @@ export function credentialSupportedV8ToV11(key: string, supportedV8: CredentialS
     }
     let credentialSupport: Partial<CredentialSupported> = {};
     credentialSupport = {
-      format,
+      format: format as OID4VCICredentialFormat,
       display: supportedV8.display,
       ...credentialSupportBrief,
       credentialSubject: supportedV8.claims,

package/lib/functions/index.ts

@@ -1,4 +1,7 @@
 export * from './CredentialRequestUtil';
+export * from './CredentialResponseUtil';
 export * from './CredentialOfferUtil';
 export * from './Encoding';
 export * from './TypeConversionUtils';
+export * from './IssuerMetadataUtils';
+export * from './FormatUtils';

package/lib/types/Authorization.types.ts

@@ -1,5 +1,11 @@
 import { CredentialOfferPayload, UniformCredentialOffer } from './CredentialIssuance.types';
-import { ErrorResponse, IssuerCredentialDefinition, IssuerCredentialSubject, OID4VCICredentialFormat, PRE_AUTH_CODE_LITERAL } from './Generic.types';
+import {
+  ErrorResponse,
+  IssuerCredentialSubject,
+  JsonLdIssuerCredentialDefinition,
+  OID4VCICredentialFormat,
+  PRE_AUTH_CODE_LITERAL,
+} from './Generic.types';
 import { EndpointMetadata } from './ServerMetadata';
 
 export interface CommonAuthorizationRequest {
@@ -64,9 +70,9 @@ export interface CommonAuthorizationRequest {
 /**
  * string type added for conformity with our previous code in the client
  */
-export type AuthorizationDetails = AuthorizationDetailsJwtVcJson | AuthorizationRequestJwtVcJsonLdAndLdpVc | string;
+export type AuthorizationDetails = AuthorizationDetailsJwtVcJson | AuthorizationDetailsJwtVcJsonLdAndLdpVc | AuthorizationDetailsSdJwtVc | string;
 
-export type AuthorizationRequest = AuthorizationRequestJwtVcJson | AuthorizationDetailsJwtVcJsonLdAndLdpVc;
+export type AuthorizationRequest = AuthorizationRequestJwtVcJson | AuthorizationRequestJwtVcJsonLdAndLdpVc | AuthorizationRequestSdJwtVc;
 
 export interface AuthorizationRequestJwtVcJson extends CommonAuthorizationRequest {
   authorization_details?: AuthorizationDetailsJwtVcJson[];
@@ -76,6 +82,10 @@ export interface AuthorizationRequestJwtVcJsonLdAndLdpVc extends CommonAuthoriza
   authorization_details?: AuthorizationDetailsJwtVcJsonLdAndLdpVc[];
 }
 
+export interface AuthorizationRequestSdJwtVc extends CommonAuthorizationRequest {
+  authorization_details?: AuthorizationDetailsSdJwtVc[];
+}
+
 export interface CommonAuthorizationDetails {
   /**
    * REQUIRED. JSON string that determines the authorization details type.
@@ -94,12 +104,14 @@ export interface CommonAuthorizationDetails {
    * the authorization detail's locations common data field MUST be set to the Credential Issuer Identifier value.
    */
   locations?: string[];
-  types: string[]; // This claim contains the type values the Wallet requests authorization for at the issuer.
+
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   [key: string]: any;
 }
 
 export interface AuthorizationDetailsJwtVcJson extends CommonAuthorizationDetails {
+  format: 'jwt_vc_json' | 'jwt_vc'; // jwt_vc added for backward compat
+
   /**
    * A JSON object containing a list of key value pairs, where the key identifies the claim offered in the Credential.
    * The value MAY be a dictionary, which allows to represent the full (potentially deeply nested) structure of the
@@ -107,9 +119,13 @@ export interface AuthorizationDetailsJwtVcJson extends CommonAuthorizationDetail
    * credential to be issued.
    */
   credentialSubject?: IssuerCredentialSubject;
+
+  types: string[]; // This claim contains the type values the Wallet requests authorization for at the issuer.
 }
 
 export interface AuthorizationDetailsJwtVcJsonLdAndLdpVc extends CommonAuthorizationDetails {
+  format: 'ldp_vc' | 'jwt_vc_json-ld';
+
   /**
    * REQUIRED. JSON object containing (and isolating) the detailed description of the credential type.
    * This object MUST be processed using full JSON-LD processing. It consists of the following sub-claims:
@@ -117,7 +133,14 @@ export interface AuthorizationDetailsJwtVcJsonLdAndLdpVc extends CommonAuthoriza
    *   - types: REQUIRED. JSON array as defined in Appendix E.1.3.2.
    *            This claim contains the type values the Wallet shall request in the subsequent Credential Request
    */
-  credential_definition: IssuerCredentialDefinition;
+  credential_definition: JsonLdIssuerCredentialDefinition;
+}
+
+export interface AuthorizationDetailsSdJwtVc extends CommonAuthorizationDetails {
+  format: 'vc+sd-jwt';
+
+  vct: string;
+  claims?: IssuerCredentialSubject;
 }
 
 export enum GrantTypes {
@@ -154,7 +177,8 @@ export interface IssuerOpts {
 }
 
 export interface AccessTokenRequestOpts {
-  credentialOffer: UniformCredentialOffer;
+  credentialOffer?: UniformCredentialOffer;
+  credentialIssuer?: string;
   asOpts?: AuthorizationServerOpts;
   metadata?: EndpointMetadata;
   codeVerifier?: string; // only required for authorization flow

package/lib/types/CredentialIssuance.types.ts

@@ -10,7 +10,8 @@ import { CredentialOfferPayloadV1_0_11, CredentialOfferV1_0_11 } from './v1_0_11
 export interface CredentialResponse {
   credential?: W3CVerifiableCredential; // OPTIONAL. Contains issued Credential. MUST be present when acceptance_token is not returned. MAY be a JSON string or a JSON object, depending on the Credential format. See Appendix E for the Credential format specific encoding requirements
   format: OID4VCICredentialFormat /* | OID4VCICredentialFormat[]*/; // REQUIRED. JSON string denoting the format of the issued Credential
-  acceptance_token?: string; // OPTIONAL. A JSON string containing a security token subsequently used to obtain a Credential. MUST be present when credential is not returned
+  transaction_id?: string; //OPTIONAL. A string identifying a Deferred Issuance transaction. This claim is contained in the response if the Credential Issuer was unable to immediately issue the credential. The value is subsequently used to obtain the respective Credential with the Deferred Credential Endpoint (see Section 9). It MUST be present when the credential parameter is not returned. It MUST be invalidated after the credential for which it was meant has been obtained by the Wallet.
+  acceptance_token?: string; //deprecated // OPTIONAL. A JSON string containing a security token subsequently used to obtain a Credential. MUST be present when credential is not returned
   c_nonce?: string; // OPTIONAL. JSON string containing a nonce to be used to create a proof of possession of key material when requesting a Credential (see Section 7.2). When received, the Wallet MUST use this nonce value for its subsequent credential requests until the Credential Issuer provides a fresh nonce
   c_nonce_expires_in?: number; // OPTIONAL. JSON integer denoting the lifetime in seconds of the c_nonce
 }

package/lib/types/Generic.types.ts

@@ -15,7 +15,7 @@ export interface ImageInfo {
   [key: string]: unknown;
 }
 
-export type OID4VCICredentialFormat = 'jwt_vc_json' | 'jwt_vc_json-ld' | 'ldp_vc' /*| 'mso_mdoc'*/; // we do not support mdocs at this point
+export type OID4VCICredentialFormat = 'jwt_vc_json' | 'jwt_vc_json-ld' | 'ldp_vc' | 'vc+sd-jwt' | 'jwt_vc'; // jwt_vc is added for backwards compat /*| 'mso_mdoc'*/; // we do not support mdocs at this point
 
 export interface NameAndLocale {
   name?: string; // REQUIRED. String value of a display name for the Credential.
@@ -62,8 +62,6 @@ export interface CredentialIssuerMetadata extends CredentialIssuerMetadataOpts,
 }
 
 export interface CredentialSupportedBrief {
-  name?: string; // fixme: Probably should not be here, is part of the display object
-  types: string[]; // REQUIRED. JSON array designating the types a certain credential type supports
   cryptographic_binding_methods_supported?: string[]; // OPTIONAL. Array of case sensitive strings that identify how the Credential is bound to the identifier of the End-User who possesses the Credential
   cryptographic_suites_supported?: string[]; // OPTIONAL. Array of case sensitive strings that identify the cryptographic suites that are supported for the cryptographic_binding_methods_supported
 }
@@ -75,25 +73,63 @@ export type CommonCredentialSupported = CredentialSupportedBrief & {
   /**
    * following properties are non-mso_mdoc specific and we might wanna rethink them when we're going to support mso_mdoc
    */
-  credentialSubject?: IssuerCredentialSubject; // OPTIONAL. A JSON object containing a list of key value pairs, where the key identifies the claim offered in the Credential. The value MAY be a dictionary, which allows to represent the full (potentially deeply nested) structure of the verifiable credential to be issued.
-  order?: string[]; //An array of claims.display.name values that lists them in the order they should be displayed by the Wallet.
 };
 
 export interface CredentialSupportedJwtVcJsonLdAndLdpVc extends CommonCredentialSupported {
+  types: string[]; // REQUIRED. JSON array designating the types a certain credential type supports
   '@context': ICredentialContextType[]; // REQUIRED. JSON array as defined in [VC_DATA], Section 4.1.
+  credentialSubject?: IssuerCredentialSubject; // OPTIONAL. A JSON object containing a list of key value pairs, where the key identifies the claim offered in the Credential. The value MAY be a dictionary, which allows to represent the full (potentially deeply nested) structure of the verifiable credential to be issued.
+  order?: string[]; //An array of claims.display.name values that lists them in the order they should be displayed by the Wallet.
+  format: 'ldp_vc' | 'jwt_vc_json-ld';
 }
 
 export interface CredentialSupportedJwtVcJson extends CommonCredentialSupported {
-  format: 'jwt_vc_json';
+  types: string[]; // REQUIRED. JSON array designating the types a certain credential type supports
+  credentialSubject?: IssuerCredentialSubject; // OPTIONAL. A JSON object containing a list of key value pairs, where the key identifies the claim offered in the Credential. The value MAY be a dictionary, which allows to represent the full (potentially deeply nested) structure of the verifiable credential to be issued.
+  order?: string[]; //An array of claims.display.name values that lists them in the order they should be displayed by the Wallet.
+  format: 'jwt_vc_json' | 'jwt_vc'; // jwt_vc added for backwards compat
+}
+
+export interface CredentialSupportedSdJwtVc extends CommonCredentialSupported {
+  format: 'vc+sd-jwt';
+
+  vct: string;
+  claims?: IssuerCredentialSubject;
+
+  order?: string[]; //An array of claims.display.name values that lists them in the order they should be displayed by the Wallet.
 }
 
-export type CredentialSupported = CommonCredentialSupported & (CredentialSupportedJwtVcJson | CredentialSupportedJwtVcJsonLdAndLdpVc);
+export type CredentialSupported = CommonCredentialSupported &
+  (CredentialSupportedJwtVcJson | CredentialSupportedJwtVcJsonLdAndLdpVc | CredentialSupportedSdJwtVc);
 
-export interface CredentialOfferFormat {
+export interface CommonCredentialOfferFormat {
   format: OID4VCICredentialFormat | string;
-  types: string[];
 }
 
+export interface CredentialOfferFormatJwtVcJsonLdAndLdpVc extends CommonCredentialOfferFormat {
+  format: 'ldp_vc' | 'jwt_vc_json-ld';
+  // REQUIRED. JSON object containing (and isolating) the detailed description of the credential type. This object MUST be processed using full JSON-LD processing.
+  credential_definition: JsonLdIssuerCredentialDefinition;
+}
+
+export interface CredentialOfferFormatJwtVcJson extends CommonCredentialOfferFormat {
+  format: 'jwt_vc_json' | 'jwt_vc'; // jwt_vc is added for backwards compat
+  types: string[]; // REQUIRED. JSON array as defined in Appendix E.1.1.2. This claim contains the type values the Wallet shall request in the subsequent Credential Request.
+}
+
+// NOTE: the sd-jwt format is added to oid4vci in a later draft version than currently
+// supported, so there's no defined offer format. However, based on the request structure
+// we support sd-jwt for older drafts of oid4vci as well
+export interface CredentialOfferFormatSdJwtVc extends CommonCredentialOfferFormat {
+  format: 'vc+sd-jwt';
+
+  vct: string;
+  claims?: IssuerCredentialSubject;
+}
+
+export type CredentialOfferFormat = CommonCredentialOfferFormat &
+  (CredentialOfferFormatJwtVcJsonLdAndLdpVc | CredentialOfferFormatJwtVcJson | CredentialOfferFormatSdJwtVc);
+
 /**
  * Optional storage that can help the credential Data Supplier. For instance to store credential input data during offer creation, if no additional data can be supplied later on
  */
@@ -108,10 +144,10 @@ export type CreateCredentialOfferURIResult = {
   userPinRequired: boolean;
 };
 
-export interface IssuerCredentialDefinition {
+export interface JsonLdIssuerCredentialDefinition {
   '@context': ICredentialContextType[];
   types: string[];
-  credentialSubject: IssuerCredentialSubject;
+  credentialSubject?: IssuerCredentialSubject;
 }
 
 export interface ErrorResponse extends Response {
@@ -128,15 +164,21 @@ export interface CommonCredentialRequest {
   proof?: ProofOfPossession;
 }
 
-export interface CredentialRequestJwtVc extends CommonCredentialRequest {
-  format: 'jwt_vc_json' | 'jwt_vc_json-ld';
+export interface CredentialRequestJwtVcJson extends CommonCredentialRequest {
+  format: 'jwt_vc_json' | 'jwt_vc'; // jwt_vc for backwards compat
   types: string[];
   credentialSubject?: IssuerCredentialSubject;
 }
 
-export interface CredentialRequestLdpVc extends CommonCredentialRequest {
-  format: 'ldp_vc';
-  credential_definition: IssuerCredentialDefinition;
+export interface CredentialRequestJwtVcJsonLdAndLdpVc extends CommonCredentialRequest {
+  format: 'ldp_vc' | 'jwt_vc_json-ld';
+  credential_definition: JsonLdIssuerCredentialDefinition;
+}
+
+export interface CredentialRequestSdJwtVc extends CommonCredentialRequest {
+  format: 'vc+sd-jwt';
+  vct: string;
+  claims?: IssuerCredentialSubject;
 }
 
 export interface CommonCredentialResponse {
@@ -157,6 +199,11 @@ export interface CredentialResponseJwtVc {
   credential: string;
 }
 
+export interface CredentialResponseSdJwtVc {
+  format: 'vc+sd-jwt';
+  credential: string;
+}
+
 // export type CredentialSubjectDisplay = NameAndLocale[];
 
 export type IssuerCredentialSubjectDisplay = CredentialSubjectDisplay & { [key: string]: CredentialSubjectDisplay };

package/lib/types/QRCode.types.ts

@@ -60,7 +60,7 @@ export interface ComponentOptions {
      */
     protectors?: boolean;
   };
-};
+}
 
 export interface QRCodeOpts {
   /**
@@ -224,4 +224,4 @@ export interface QRCodeOpts {
    * @deafultValue 0.4
    */
   dotScale?: number;
-};
+}

package/lib/types/ServerMetadata.ts

@@ -49,6 +49,7 @@ export interface AuthorizationServerMetadata {
 
   // VCI values. In case an AS provides a credential_endpoint itself
   credential_endpoint?: string;
+  deferred_credential_endpoint?: string;
 
   // eslint-disable-next-line  @typescript-eslint/no-explicit-any
   [x: string]: any; //We use any, so you can access properties if you know the structure
@@ -66,6 +67,7 @@ export interface EndpointMetadata {
   issuer: string;
   token_endpoint: string;
   credential_endpoint: string;
+  deferred_credential_endpoint?: string;
   authorization_server?: string;
   authorization_endpoint?: string; // Can be undefined in pre-auth flow
 }

package/lib/types/v1_0_08.types.ts

@@ -6,7 +6,7 @@ import { CredentialsSupportedDisplay, CredentialSupportedBrief, IssuerCredential
 export interface CredentialRequestV1_0_08 {
   type: string;
   format: CredentialFormat;
-  proof: ProofOfPossession;
+  proof?: ProofOfPossession;
 }
 
 export interface IssuerMetadataV1_0_08 {
@@ -34,11 +34,16 @@ export interface CredentialSupportedTypeV1_0_08 {
   [credentialType: string]: CredentialSupportedV1_0_08;
 }
 
+export interface CredentialSupportedFormatV1_0_08 extends CredentialSupportedBrief {
+  name?: string;
+  types: string[];
+}
+
 export interface CredentialSupportedV1_0_08 {
   display?: CredentialsSupportedDisplay[];
   formats: {
     // REQUIRED. A JSON object containing a list of key value pairs, where the key is a string identifying the format of the Credential. Below is a non-exhaustive list of valid key values defined by this specification:
-    [credentialFormat: string]: CredentialSupportedBrief;
+    [credentialFormat: string]: CredentialSupportedFormatV1_0_08;
   };
   claims?: IssuerCredentialSubject; // REQUIRED. A JSON object containing a list of key value pairs, where the key identifies the claim offered in the Credential. The value is a JSON object detailing the specifics about the support for the claim with a following non-exhaustive list of parameters that MAY be included:
 }