@sphereon/oid4vci-common 0.8.2-next.48 → 0.8.2-next.87

package/lib/functions/CredentialOfferUtil.ts

@@ -1,4 +1,5 @@
 import Debug from 'debug';
+import jwtDecode, { JwtPayload } from 'jwt-decode';
 
 import {
   AssertedUniformCredentialOffer,
@@ -68,8 +69,53 @@ export function getIssuerFromCredentialOfferPayload(request: CredentialOfferPayl
   return 'issuer' in request ? request.issuer : request['credential_issuer'];
 }
 
+export const getClientIdFromCredentialOfferPayload = (credentialOffer?: CredentialOfferPayload): string | undefined => {
+  if (!credentialOffer) {
+    return;
+  }
+  if ('client_id' in credentialOffer) {
+    return credentialOffer.client_id;
+  }
+
+  const state: string | undefined = getStateFromCredentialOfferPayload(credentialOffer);
+  if (state && isJWT(state)) {
+    const decoded = jwtDecode<JwtPayload>(state, { header: false });
+    if ('client_id' in decoded && typeof decoded.client_id === 'string') {
+      return decoded.client_id;
+    }
+  }
+  return;
+};
+
+const isJWT = (input?: string) => {
+  if (!input) {
+    return false;
+  }
+  const noParts = input?.split('.').length;
+  return input?.startsWith('ey') && noParts === 3;
+};
+export const getStateFromCredentialOfferPayload = (credentialOffer: CredentialOfferPayload): string | undefined => {
+  if ('grants' in credentialOffer) {
+    if (credentialOffer.grants?.authorization_code) {
+      return credentialOffer.grants.authorization_code.issuer_state;
+    } else if (credentialOffer.grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']) {
+      return credentialOffer.grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']?.['pre-authorized_code'];
+    }
+  }
+  if ('op_state' in credentialOffer) {
+    // older spec versions
+    return credentialOffer.op_state;
+  } else if ('pre-authorized_code' in credentialOffer) {
+    return credentialOffer['pre-authorized_code'];
+  }
+
+  return;
+};
+
 export function determineSpecVersionFromOffer(offer: CredentialOfferPayload | CredentialOffer): OpenId4VCIVersion {
-  if (isCredentialOfferV1_0_11(offer)) {
+  if (isCredentialOfferV1_0_12(offer)) {
+    return OpenId4VCIVersion.VER_1_0_12;
+  } else if (isCredentialOfferV1_0_11(offer)) {
     return OpenId4VCIVersion.VER_1_0_11;
   } else if (isCredentialOfferV1_0_09(offer)) {
     return OpenId4VCIVersion.VER_1_0_09;
@@ -139,6 +185,21 @@ function isCredentialOfferV1_0_11(offer: CredentialOfferPayload | CredentialOffe
   return 'credential_offer_uri' in offer;
 }
 
+function isCredentialOfferV1_0_12(offer: CredentialOfferPayload | CredentialOffer): boolean {
+  if (!offer) {
+    return false;
+  }
+  if ('credential_issuer' in offer && 'credentials' in offer) {
+    // payload
+    return true;
+  }
+  if ('credential_offer' in offer && offer['credential_offer']) {
+    // offer, so check payload
+    return isCredentialOfferV1_0_12(offer['credential_offer']);
+  }
+  return 'credential_offer_uri' in offer;
+}
+
 export async function toUniformCredentialOfferRequest(
   offer: CredentialOffer,
   opts?: {

package/lib/functions/CredentialRequestUtil.ts

@@ -1,4 +1,4 @@
-import { CredentialRequestV1_0_08, OpenId4VCIVersion, UniformCredentialRequest } from '../types';
+import { CredentialRequestV1_0_08, CredentialRequestV1_0_11, OpenId4VCIVersion, UniformCredentialRequest } from '../types';
 
 import { getFormatForVersion } from './FormatUtils';
 
@@ -7,7 +7,14 @@ export function getTypesFromRequest(credentialRequest: UniformCredentialRequest,
   if (credentialRequest.format === 'jwt_vc_json' || credentialRequest.format === 'jwt_vc') {
     types = credentialRequest.types;
   } else if (credentialRequest.format === 'jwt_vc_json-ld' || credentialRequest.format === 'ldp_vc') {
-    types = credentialRequest.credential_definition.types;
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore
+    types =
+      'credential_definition' in credentialRequest && credentialRequest.credential_definition
+        ? // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-ignore
+          credentialRequest.credential_definition.types
+        : credentialRequest.types;
   } else if (credentialRequest.format === 'vc+sd-jwt') {
     types = [credentialRequest.vct];
   }
@@ -24,7 +31,7 @@ export function getTypesFromRequest(credentialRequest: UniformCredentialRequest,
 export function getCredentialRequestForVersion(
   credentialRequest: UniformCredentialRequest,
   version: OpenId4VCIVersion,
-): UniformCredentialRequest | CredentialRequestV1_0_08 {
+): UniformCredentialRequest | CredentialRequestV1_0_08 | CredentialRequestV1_0_11 {
   if (version === OpenId4VCIVersion.VER_1_0_08) {
     const draft8Format = getFormatForVersion(credentialRequest.format, version);
     const types = getTypesFromRequest(credentialRequest, { filterVerifiableCredential: true });
@@ -34,6 +41,14 @@ export function getCredentialRequestForVersion(
       proof: credentialRequest.proof,
       type: types[0],
     } satisfies CredentialRequestV1_0_08;
+    /* } else if (version === OpenId4VCIVersion.VER_1_0_11) {
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore
+    const { credential_definition = undefined, ...requestv11 } = credentialRequest;
+    return {
+      ...requestv11,
+      ...credential_definition,
+    } as CredentialRequestV1_0_11;*/
   }
 
   return credentialRequest;

package/lib/functions/Encoding.ts

@@ -88,7 +88,7 @@ export function convertJsonToURI(
  *          - arrayTypeProperties: properties that can show up more that once
  */
 export function convertURIToJsonObject(uri: string, opts?: DecodeURIAsJsonOpts): unknown {
-  if (!uri || !opts?.requiredProperties?.every((p) => uri.includes(p))) {
+  if (!uri || (opts?.requiredProperties && !opts.requiredProperties?.every((p) => uri.includes(p)))) {
     throw new Error(BAD_PARAMS);
   }
   const uriComponents = getURIComponentsAsArray(uri, opts?.arrayTypeProperties);

package/lib/functions/HttpUtils.ts

@@ -87,7 +87,7 @@ const openIdFetch = async <T>(
 
   debug(`START fetching url: ${url}`);
   if (body) {
-    debug(`Body:\r\n${JSON.stringify(body)}`);
+    debug(`Body:\r\n${typeof body == 'string' ? body : JSON.stringify(body)}`);
   }
   debug(`Headers:\r\n${JSON.stringify(payload.headers)}`);
   const origResponse = await fetch(url, payload);

package/lib/functions/IssuerMetadataUtils.ts

@@ -1,4 +1,5 @@
 import {
+  AuthorizationServerMetadata,
   CredentialIssuerMetadata,
   CredentialOfferFormat,
   CredentialSupported,
@@ -165,3 +166,21 @@ export function getIssuerDisplays(metadata: CredentialIssuerMetadata | IssuerMet
     ) ?? [];
   return matchedDisplays.sort((item) => (item.locale ? opts?.prefLocales.indexOf(item.locale) ?? 1 : Number.MAX_VALUE));
 }
+
+/**
+ * TODO check again when WAL-617 is done to replace how we get the issuer name.
+ */
+export function getIssuerName(
+  url: string,
+  credentialIssuerMetadata?: Partial<AuthorizationServerMetadata> & (CredentialIssuerMetadata | IssuerMetadataV1_0_08),
+): string {
+  if (credentialIssuerMetadata) {
+    const displays: Array<MetadataDisplay> = credentialIssuerMetadata ? getIssuerDisplays(credentialIssuerMetadata) : [];
+    for (const display of displays) {
+      if (display.name) {
+        return display.name;
+      }
+    }
+  }
+  return url;
+}

package/lib/functions/RandomUtils.ts

@@ -0,0 +1,43 @@
+import SHA from 'sha.js';
+import * as u8a from 'uint8arrays';
+import { SupportedEncodings } from 'uint8arrays/to-string';
+
+import { CodeChallengeMethod } from '../types';
+
+import { randomBytes } from './randomBytes';
+
+export const CODE_VERIFIER_DEFAULT_LENGTH = 128;
+export const NONCE_LENGTH = 32;
+
+export const generateRandomString = (length: number, encoding?: SupportedEncodings): string => {
+  return u8a.toString(randomBytes(length), encoding).slice(0, length);
+};
+
+export const generateNonce = (length?: number): string => {
+  return generateRandomString(length ?? NONCE_LENGTH);
+};
+export const generateCodeVerifier = (length?: number): string => {
+  const codeVerifier = generateRandomString(length ?? CODE_VERIFIER_DEFAULT_LENGTH, 'base64url');
+  assertValidCodeVerifier(codeVerifier);
+  return codeVerifier;
+};
+
+export const createCodeChallenge = (codeVerifier: string, codeChallengeMethod?: CodeChallengeMethod): string => {
+  if (codeChallengeMethod === CodeChallengeMethod.plain) {
+    return codeVerifier;
+  } else if (!codeChallengeMethod || codeChallengeMethod === CodeChallengeMethod.S256) {
+    return u8a.toString(SHA('sha256').update(codeVerifier).digest(), 'base64url');
+  } else {
+    // Just a precaution if a new method would be introduced
+    throw Error(`code challenge method ${codeChallengeMethod} not implemented`);
+  }
+};
+
+export const assertValidCodeVerifier = (codeVerifier: string) => {
+  const length = codeVerifier.length;
+  if (length < 43) {
+    throw Error(`code_verifier should have a minimum length of 43; see rfc7636`);
+  } else if (length > 128) {
+    throw Error(`code_verifier should have a maximum length of 128; see rfc7636`);
+  }
+};

package/lib/functions/index.ts

@@ -1,3 +1,4 @@
+import { randomBytes } from './randomBytes.js';
 export * from './CredentialRequestUtil';
 export * from './CredentialResponseUtil';
 export * from './CredentialOfferUtil';
@@ -5,3 +6,7 @@ export * from './Encoding';
 export * from './TypeConversionUtils';
 export * from './IssuerMetadataUtils';
 export * from './FormatUtils';
+export * from './HttpUtils';
+export * from './AuthorizationResponseUtil';
+export { randomBytes };
+export * from './RandomUtils';

package/lib/functions/randomBytes.js

@@ -0,0 +1,61 @@
+'use strict';
+
+// limit of Crypto.getRandomValues()
+// https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues
+const MAX_BYTES = 65536;
+
+// Node supports requesting up to this number of bytes
+// https://github.com/nodejs/node/blob/master/lib/internal/crypto/random.js#L48
+const MAX_UINT32 = 4294967295;
+
+function oldBrowser() {
+  throw new Error('Secure random number generation is not supported by this browser.\nUse Chrome, Firefox or Internet Explorer 11');
+}
+
+// eslint-disable-next-line no-undef
+const _global = typeof globalThis !== 'undefined' ? globalThis : global;
+
+let crypto = _global.crypto || _global.msCrypto;
+if (!crypto) {
+  try {
+    // eslint-disable-next-line no-undef
+    crypto = require('crypto');
+  } catch (err) {
+    throw Error('crypto module is not available');
+  }
+}
+
+if (crypto && crypto.getRandomValues) {
+  // eslint-disable-next-line no-undef
+  module.exports = randomBytes;
+} else {
+  // eslint-disable-next-line no-undef
+  module.exports = oldBrowser;
+}
+
+function randomBytes(size) {
+  // phantomjs needs to throw
+  if (size > MAX_UINT32) throw new Error('requested too many random bytes');
+
+  // eslint-disable-next-line no-undef
+  const bytes = Buffer.allocUnsafe(size);
+
+  if (size > 0) {
+    // getRandomValues fails on IE if size == 0
+    if (size > MAX_BYTES) {
+      // this is the max bytes crypto.getRandomValues
+      // can do at once see https://developer.mozilla.org/en-US/docs/Web/API/window.crypto.getRandomValues
+      for (let generated = 0; generated < size; generated += MAX_BYTES) {
+        // buffer.slice automatically checks if the end is past the end of
+        // the buffer so we don't have to here
+        crypto.getRandomValues(bytes.slice(generated, generated + MAX_BYTES));
+      }
+    } else {
+      crypto.getRandomValues(bytes);
+    }
+  }
+  return Uint8Array.from(bytes);
+}
+
+// eslint-disable-next-line no-undef
+module.exports = { randomBytes };

package/lib/types/Authorization.types.ts

@@ -70,7 +70,9 @@ export interface CommonAuthorizationRequest {
 /**
  * string type added for conformity with our previous code in the client
  */
-export type AuthorizationDetails = AuthorizationDetailsJwtVcJson | AuthorizationDetailsJwtVcJsonLdAndLdpVc | AuthorizationDetailsSdJwtVc | string;
+export type AuthorizationDetails =
+  | (CommonAuthorizationDetails & (AuthorizationDetailsJwtVcJson | AuthorizationDetailsJwtVcJsonLdAndLdpVc | AuthorizationDetailsSdJwtVc))
+  | string;
 
 export type AuthorizationRequest = AuthorizationRequestJwtVcJson | AuthorizationRequestJwtVcJsonLdAndLdpVc | AuthorizationRequestSdJwtVc;
 
@@ -86,6 +88,16 @@ export interface AuthorizationRequestSdJwtVc extends CommonAuthorizationRequest
   authorization_details?: AuthorizationDetailsSdJwtVc[];
 }
 
+/*
+export interface AuthDetails {
+  type: 'openid_credential' | string;
+  locations?: string | string[];
+  format: CredentialFormat | CredentialFormat[];
+
+  [s: string]: unknown;
+}
+*/
+
 export interface CommonAuthorizationDetails {
   /**
    * REQUIRED. JSON string that determines the authorization details type.
@@ -159,8 +171,8 @@ export enum ResponseType {
 }
 
 export enum CodeChallengeMethod {
-  TEXT = 'text',
-  SHA256 = 'S256',
+  plain = 'plain',
+  S256 = 'S256',
 }
 
 export interface AuthorizationServerOpts {
@@ -176,6 +188,9 @@ export interface IssuerOpts {
   fetchMetadata?: boolean;
 }
 
+export interface AccessTokenFromAuthorizationResponseOpts extends AccessTokenRequestOpts {
+  authorizationResponse: AuthorizationResponse;
+}
 export interface AccessTokenRequestOpts {
   credentialOffer?: UniformCredentialOffer;
   credentialIssuer?: string;
@@ -187,22 +202,72 @@ export interface AccessTokenRequestOpts {
   pin?: string; // Pin-number. Only used when required
 }
 
-export interface AuthorizationRequestOpts {
+/*export interface AuthorizationRequestOpts {
   clientId: string;
   codeChallenge: string;
   codeChallengeMethod: CodeChallengeMethod;
   authorizationDetails?: AuthorizationDetails[];
   redirectUri: string;
   scope?: string;
+}*/
+
+/**
+ * Determinse whether PAR should be used when supported
+ *
+ * REQUIRE: Require PAR, if AS does not support it throw an error
+ * AUTO: Use PAR is the AS supports it, otherwise construct a reqular URI,
+ * NEVER: Do not use PAR even if the AS supports it (not recommended)
+ */
+export enum PARMode {
+  REQUIRE,
+  AUTO,
+  NEVER,
 }
 
-export interface AuthorizationGrantResponse {
-  grant_type: string;
+/**
+ * Optional options to provide PKCE params like code verifier and challenge yourself, or to disable PKCE altogether. If not provide PKCE will still be used! If individual params are not provide, they will be generated/calculated
+ */
+export interface PKCEOpts {
+  /**
+   * PKCE is enabled by default even if you do not provide these options. Set this to true to disable PKCE
+   */
+  disabled?: boolean;
+
+  /**
+   * Provide a code_challenge, otherwise it will be calculated using the code_verifier and method
+   */
+  codeChallenge?: string;
+
+  /**
+   * The code_challenge_method, should always by S256
+   */
+  codeChallengeMethod?: CodeChallengeMethod;
+
+  /**
+   * Provide a code_verifier, otherwise it will be generated
+   */
+  codeVerifier?: string;
+}
+
+export interface AuthorizationRequestOpts {
+  clientId?: string;
+  pkce?: PKCEOpts;
+  parMode?: PARMode;
+  authorizationDetails?: AuthorizationDetails | AuthorizationDetails[];
+  redirectUri?: string;
+  scope?: string;
+}
+
+export interface AuthorizationResponse {
   code: string;
   scope?: string;
   state?: string;
 }
 
+export interface AuthorizationGrantResponse extends AuthorizationResponse {
+  grant_type: string;
+}
+
 export interface AccessTokenRequest {
   client_id?: string;
   code?: string;

package/lib/types/CredentialIssuance.types.ts

@@ -18,6 +18,7 @@ export interface CredentialResponse {
 
 export interface CredentialOfferRequestWithBaseUrl extends UniformCredentialOfferRequest {
   scheme: string;
+  clientId?: string;
   baseUrl: string;
   userPinRequired: boolean;
   issuerState?: string;
@@ -26,7 +27,9 @@ export interface CredentialOfferRequestWithBaseUrl extends UniformCredentialOffe
 
 export type CredentialOffer = CredentialOfferV1_0_09 | CredentialOfferV1_0_11;
 
-export type CredentialOfferPayload = CredentialOfferPayloadV1_0_08 | CredentialOfferPayloadV1_0_09 | CredentialOfferPayloadV1_0_11;
+export type CredentialOfferPayload = (CredentialOfferPayloadV1_0_08 | CredentialOfferPayloadV1_0_09 | CredentialOfferPayloadV1_0_11) & {
+  [x: string]: any;
+};
 
 export interface AssertedUniformCredentialOffer extends UniformCredentialOffer {
   credential_offer: UniformCredentialOfferPayload;
@@ -107,6 +110,7 @@ export interface JWK extends BaseJWK {
   x5t?: string;
   'x5t#S256'?: string;
   x5u?: string;
+
   [propName: string]: unknown;
 }
 
@@ -147,6 +151,7 @@ export interface JWSHeaderParameters extends JoseHeaderParameters {
   alg?: Alg | string; // REQUIRED by the JWT signer
   b64?: boolean;
   crit?: string[];
+
   [propName: string]: unknown;
 }
 
@@ -172,6 +177,7 @@ export interface JWTPayload {
 
 export type JWTSignerCallback = (jwt: Jwt, kid?: string) => Promise<string>;
 export type JWTVerifyCallback<DIDDoc> = (args: { jwt: string; kid?: string }) => Promise<JwtVerifyResult<DIDDoc>>;
+
 export interface JwtVerifyResult<DIDDoc> {
   jwt: Jwt;
   kid?: string;

package/lib/types/Generic.types.ts

@@ -51,6 +51,7 @@ export interface CredentialIssuerMetadataOpts {
   credentials_supported: CredentialSupported[]; // REQUIRED. A JSON array containing a list of JSON objects, each of them representing metadata about a separate credential type that the Credential Issuer can issue. The JSON objects in the array MUST conform to the structure of the Section 10.2.3.1.
   credential_issuer: string; // REQUIRED. The Credential Issuer's identifier.
   authorization_server?: string; // OPTIONAL. Identifier of the OAuth 2.0 Authorization Server (as defined in [RFC8414]) the Credential Issuer relies on for authorization. If this element is omitted, the entity providing the Credential Issuer is also acting as the AS, i.e. the Credential Issuer's identifier is used as the OAuth 2.0 Issuer value to obtain the Authorization Server metadata as per [RFC8414].
+  // authorization_servers?: string[]; // OPTIONAL. Array of strings that identify the OAuth 2.0 Authorization Servers (as defined in [RFC8414]) the Credential Issuer relies on for authorization. If this element is omitted, the entity providing the Credential Issuer is also acting as the AS, i.e. the Credential Issuer's identifier is used as the OAuth 2.0 Issuer value to obtain the Authorization Server metadata as per [RFC8414].
   token_endpoint?: string;
   display?: MetadataDisplay[]; //  An array of objects, where each object contains display properties of a Credential Issuer for a certain language. Below is a non-exhaustive list of valid parameters that MAY be included:
   credential_supplier_config?: CredentialSupplierConfig;
@@ -58,9 +59,16 @@ export interface CredentialIssuerMetadataOpts {
 
 // For now we extend the opts above. Only difference is that the credential endpoint is optional in the Opts, as it can come from other sources. The value is however required in the eventual Issuer Metadata
 export interface CredentialIssuerMetadata extends CredentialIssuerMetadataOpts, Partial<AuthorizationServerMetadata> {
+  authorization_servers?: string[]; // OPTIONAL. Array of strings that identify the OAuth 2.0 Authorization Servers (as defined in [RFC8414]) the Credential Issuer relies on for authorization. If this element is omitted, the entity providing the Credential Issuer is also acting as the AS, i.e. the Credential Issuer's identifier is used as the OAuth 2.0 Issuer value to obtain the Authorization Server metadata as per [RFC8414].
   credential_endpoint: string; // REQUIRED. URL of the Credential Issuer's Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components.
+  credential_response_encryption_alg_values_supported?: string; // OPTIONAL. Array containing a list of the JWE [RFC7516] encryption algorithms (alg values) [RFC7518] supported by the Credential and/or Batch Credential Endpoint to encode the Credential or Batch Credential Response in a JWT [RFC7519].
+  credential_response_encryption_enc_values_supported?: string; //OPTIONAL. Array containing a list of the JWE [RFC7516] encryption algorithms (enc values) [RFC7518] supported by the Credential and/or Batch Credential Endpoint to encode the Credential or Batch Credential Response in a JWT [RFC7519].
+  require_credential_response_encryption?: boolean; //OPTIONAL. Boolean value specifying whether the Credential Issuer requires additional encryption on top of TLS for the Credential Response and expects encryption parameters to be present in the Credential Request and/or Batch Credential Request, with true indicating support. When the value is true, credential_response_encryption_alg_values_supported parameter MUST also be provided. If omitted, the default value is false.
+  credential_identifiers_supported?: boolean; // OPTIONAL. Boolean value specifying whether the Credential Issuer supports returning credential_identifiers parameter in the authorization_details Token Response parameter, with true indicating support. If omitted, the default value is false.
 }
 
+// For now we extend the opts above. Only difference is that the credential endpoint is optional in the Opts, as it can come from other sources. The value is however required in the eventual Issuer Metadata
+
 export interface CredentialSupportedBrief {
   cryptographic_binding_methods_supported?: string[]; // OPTIONAL. Array of case sensitive strings that identify how the Credential is bound to the identifier of the End-User who possesses the Credential
   cryptographic_suites_supported?: string[]; // OPTIONAL. Array of case sensitive strings that identify the cryptographic suites that are supported for the cryptographic_binding_methods_supported
@@ -229,6 +237,12 @@ export interface GrantAuthorizationCode {
    * Authorization Request with the Credential Issuer to a context set up during previous steps.
    */
   issuer_state?: string;
+
+  // v12 feature
+  /**
+   * OPTIONAL string that the Wallet can use to identify the Authorization Server to use with this grant type when authorization_servers parameter in the Credential Issuer metadata has multiple entries. MUST NOT be used otherwise. The value of this parameter MUST match with one of the values in the authorization_servers array obtained from the Credential Issuer metadata
+   */
+  authorization_server?: string;
 }
 
 export interface GrantUrnIetf {
@@ -241,6 +255,18 @@ export interface GrantUrnIetf {
    * in a Pre-Authorized Code Flow. Default is false.
    */
   user_pin_required: boolean;
+
+  //v12
+  /**
+   * OPTIONAL. The minimum amount of time in seconds that the Wallet SHOULD wait between polling requests to the token endpoint (in case the Authorization Server responds with error code authorization_pending - see Section 6.3). If no value is provided, Wallets MUST use 5 as the default.
+   */
+  interval?: number;
+
+  // v12 feature
+  /**
+   * OPTIONAL string that the Wallet can use to identify the Authorization Server to use with this grant type when authorization_servers parameter in the Credential Issuer metadata has multiple entries. MUST NOT be used otherwise. The value of this parameter MUST match with one of the values in the authorization_servers array obtained from the Credential Issuer metadata
+   */
+  authorization_server?: string;
 }
 
 export const PRE_AUTH_CODE_LITERAL = 'pre-authorized_code';

package/lib/types/OpenID4VCIVersions.types.ts

@@ -2,7 +2,8 @@ export enum OpenId4VCIVersion {
   VER_1_0_08 = 1008,
   VER_1_0_09 = 1009,
   VER_1_0_11 = 1011,
-  VER_UNKNOWN = Number.MIN_VALUE,
+  VER_1_0_12 = 1012,
+  VER_UNKNOWN = Number.MAX_VALUE,
 }
 
 export enum DefaultURISchemes {

package/lib/types/v1_0_11.types.ts

@@ -2,13 +2,15 @@ import { AuthorizationDetailsJwtVcJson, CommonAuthorizationRequest } from './Aut
 import {
   CommonCredentialRequest,
   CredentialDataSupplierInput,
+  CredentialIssuerMetadataOpts,
   CredentialOfferFormat,
   CredentialRequestJwtVcJson,
-  CredentialRequestJwtVcJsonLdAndLdpVc,
   CredentialRequestSdJwtVc,
   Grant,
+  JsonLdIssuerCredentialDefinition,
 } from './Generic.types';
 import { QRCodeOpts } from './QRCode.types';
+import { AuthorizationServerMetadata } from './ServerMetadata';
 
 export interface CredentialOfferV1_0_11 {
   credential_offer?: CredentialOfferPayloadV1_0_11;
@@ -48,10 +50,25 @@ export interface CredentialOfferPayloadV1_0_11 {
    * using the respective metadata. When multiple grants are present, it's at the Wallet's discretion which one to use.
    */
   grants?: Grant;
+
+  /**
+   * Some implementations might include a client_id in the offer. For instance EBSI in a same-device flow. (Cross-device tucks it in the state JWT)
+   */
+  client_id?: string;
 }
 
 export type CredentialRequestV1_0_11 = CommonCredentialRequest &
-  (CredentialRequestJwtVcJson | CredentialRequestJwtVcJsonLdAndLdpVc | CredentialRequestSdJwtVc);
+  (CredentialRequestJwtVcJson | CredentialRequestJwtVcJsonLdAndLdpVcV1_0_11 | CredentialRequestSdJwtVc);
+
+export interface CredentialRequestJwtVcJsonLdAndLdpVcV1_0_11
+  extends CommonCredentialRequest,
+    Pick<JsonLdIssuerCredentialDefinition, 'credentialSubject' | 'types'> {
+  format: 'ldp_vc' | 'jwt_vc_json-ld';
+}
+export interface CredentialIssuerMetadataV1_0_11 extends CredentialIssuerMetadataOpts, Partial<AuthorizationServerMetadata> {
+  credential_endpoint: string; // REQUIRED. URL of the Credential Issuer's Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components.
+  authorization_server?: string;
+}
 
 export interface AuthorizationRequestV1_0_11 extends AuthorizationDetailsJwtVcJson, AuthorizationDetailsJwtVcJson {
   issuer_state?: string;

package/lib/types/v1_0_12.types.ts

@@ -0,0 +1,4 @@
+import { CommonCredentialRequest, CredentialRequestJwtVcJson, CredentialRequestJwtVcJsonLdAndLdpVc, CredentialRequestSdJwtVc } from './Generic.types';
+
+export type CredentialRequestV1_0_12 = CommonCredentialRequest &
+  (CredentialRequestJwtVcJson | CredentialRequestJwtVcJsonLdAndLdpVc | CredentialRequestSdJwtVc);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphereon/oid4vci-common",
-  "version": "0.8.2-next.48+81adb47",
+  "version": "0.8.2-next.87+9f0679e",
   "description": "OpenID 4 Verifiable Credential Issuance Common Types",
   "source": "lib/index.ts",
   "main": "dist/index.js",
@@ -12,12 +12,23 @@
   "dependencies": {
     "@sphereon/ssi-types": "^0.18.1",
     "cross-fetch": "^3.1.8",
-    "jwt-decode": "^3.1.2"
+    "jwt-decode": "^3.1.2",
+    "sha.js": "^2.4.11",
+    "uint8arrays": "3.1.1"
   },
   "devDependencies": {
     "@types/jest": "^29.5.3",
+    "@types/sha.js": "^2.4.4",
     "typescript": "5.3.3"
   },
+  "peerDependencies": {
+    "msrcrypto": "^1.5.8"
+  },
+  "peerDependenciesMeta": {
+    "msrcrypto": {
+      "optional": true
+    }
+  },
   "engines": {
     "node": ">=18"
   },
@@ -46,5 +57,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "81adb47112f687715737f17c5e8518739b8a6a58"
+  "gitHead": "9f0679e6cbf0b0ba7f7d4f8ecc2263981d4ef80e"
 }