@sphereon/oid4vci-common 0.8.2-next.6 → 0.8.2-next.87

package/lib/functions/randomBytes.js

@@ -0,0 +1,61 @@
+'use strict';
+
+// limit of Crypto.getRandomValues()
+// https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues
+const MAX_BYTES = 65536;
+
+// Node supports requesting up to this number of bytes
+// https://github.com/nodejs/node/blob/master/lib/internal/crypto/random.js#L48
+const MAX_UINT32 = 4294967295;
+
+function oldBrowser() {
+  throw new Error('Secure random number generation is not supported by this browser.\nUse Chrome, Firefox or Internet Explorer 11');
+}
+
+// eslint-disable-next-line no-undef
+const _global = typeof globalThis !== 'undefined' ? globalThis : global;
+
+let crypto = _global.crypto || _global.msCrypto;
+if (!crypto) {
+  try {
+    // eslint-disable-next-line no-undef
+    crypto = require('crypto');
+  } catch (err) {
+    throw Error('crypto module is not available');
+  }
+}
+
+if (crypto && crypto.getRandomValues) {
+  // eslint-disable-next-line no-undef
+  module.exports = randomBytes;
+} else {
+  // eslint-disable-next-line no-undef
+  module.exports = oldBrowser;
+}
+
+function randomBytes(size) {
+  // phantomjs needs to throw
+  if (size > MAX_UINT32) throw new Error('requested too many random bytes');
+
+  // eslint-disable-next-line no-undef
+  const bytes = Buffer.allocUnsafe(size);
+
+  if (size > 0) {
+    // getRandomValues fails on IE if size == 0
+    if (size > MAX_BYTES) {
+      // this is the max bytes crypto.getRandomValues
+      // can do at once see https://developer.mozilla.org/en-US/docs/Web/API/window.crypto.getRandomValues
+      for (let generated = 0; generated < size; generated += MAX_BYTES) {
+        // buffer.slice automatically checks if the end is past the end of
+        // the buffer so we don't have to here
+        crypto.getRandomValues(bytes.slice(generated, generated + MAX_BYTES));
+      }
+    } else {
+      crypto.getRandomValues(bytes);
+    }
+  }
+  return Uint8Array.from(bytes);
+}
+
+// eslint-disable-next-line no-undef
+module.exports = { randomBytes };

package/lib/types/Authorization.types.ts

@@ -1,5 +1,11 @@
 import { CredentialOfferPayload, UniformCredentialOffer } from './CredentialIssuance.types';
-import { ErrorResponse, IssuerCredentialDefinition, IssuerCredentialSubject, OID4VCICredentialFormat, PRE_AUTH_CODE_LITERAL } from './Generic.types';
+import {
+  ErrorResponse,
+  IssuerCredentialSubject,
+  JsonLdIssuerCredentialDefinition,
+  OID4VCICredentialFormat,
+  PRE_AUTH_CODE_LITERAL,
+} from './Generic.types';
 import { EndpointMetadata } from './ServerMetadata';
 
 export interface CommonAuthorizationRequest {
@@ -64,9 +70,11 @@ export interface CommonAuthorizationRequest {
 /**
  * string type added for conformity with our previous code in the client
  */
-export type AuthorizationDetails = AuthorizationDetailsJwtVcJson | AuthorizationRequestJwtVcJsonLdAndLdpVc | string;
+export type AuthorizationDetails =
+  | (CommonAuthorizationDetails & (AuthorizationDetailsJwtVcJson | AuthorizationDetailsJwtVcJsonLdAndLdpVc | AuthorizationDetailsSdJwtVc))
+  | string;
 
-export type AuthorizationRequest = AuthorizationRequestJwtVcJson | AuthorizationDetailsJwtVcJsonLdAndLdpVc;
+export type AuthorizationRequest = AuthorizationRequestJwtVcJson | AuthorizationRequestJwtVcJsonLdAndLdpVc | AuthorizationRequestSdJwtVc;
 
 export interface AuthorizationRequestJwtVcJson extends CommonAuthorizationRequest {
   authorization_details?: AuthorizationDetailsJwtVcJson[];
@@ -76,6 +84,20 @@ export interface AuthorizationRequestJwtVcJsonLdAndLdpVc extends CommonAuthoriza
   authorization_details?: AuthorizationDetailsJwtVcJsonLdAndLdpVc[];
 }
 
+export interface AuthorizationRequestSdJwtVc extends CommonAuthorizationRequest {
+  authorization_details?: AuthorizationDetailsSdJwtVc[];
+}
+
+/*
+export interface AuthDetails {
+  type: 'openid_credential' | string;
+  locations?: string | string[];
+  format: CredentialFormat | CredentialFormat[];
+
+  [s: string]: unknown;
+}
+*/
+
 export interface CommonAuthorizationDetails {
   /**
    * REQUIRED. JSON string that determines the authorization details type.
@@ -94,12 +116,14 @@ export interface CommonAuthorizationDetails {
    * the authorization detail's locations common data field MUST be set to the Credential Issuer Identifier value.
    */
   locations?: string[];
-  types: string[]; // This claim contains the type values the Wallet requests authorization for at the issuer.
+
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   [key: string]: any;
 }
 
 export interface AuthorizationDetailsJwtVcJson extends CommonAuthorizationDetails {
+  format: 'jwt_vc_json' | 'jwt_vc'; // jwt_vc added for backward compat
+
   /**
    * A JSON object containing a list of key value pairs, where the key identifies the claim offered in the Credential.
    * The value MAY be a dictionary, which allows to represent the full (potentially deeply nested) structure of the
@@ -107,9 +131,13 @@ export interface AuthorizationDetailsJwtVcJson extends CommonAuthorizationDetail
    * credential to be issued.
    */
   credentialSubject?: IssuerCredentialSubject;
+
+  types: string[]; // This claim contains the type values the Wallet requests authorization for at the issuer.
 }
 
 export interface AuthorizationDetailsJwtVcJsonLdAndLdpVc extends CommonAuthorizationDetails {
+  format: 'ldp_vc' | 'jwt_vc_json-ld';
+
   /**
    * REQUIRED. JSON object containing (and isolating) the detailed description of the credential type.
    * This object MUST be processed using full JSON-LD processing. It consists of the following sub-claims:
@@ -117,7 +145,14 @@ export interface AuthorizationDetailsJwtVcJsonLdAndLdpVc extends CommonAuthoriza
    *   - types: REQUIRED. JSON array as defined in Appendix E.1.3.2.
    *            This claim contains the type values the Wallet shall request in the subsequent Credential Request
    */
-  credential_definition: IssuerCredentialDefinition;
+  credential_definition: JsonLdIssuerCredentialDefinition;
+}
+
+export interface AuthorizationDetailsSdJwtVc extends CommonAuthorizationDetails {
+  format: 'vc+sd-jwt';
+
+  vct: string;
+  claims?: IssuerCredentialSubject;
 }
 
 export enum GrantTypes {
@@ -136,8 +171,8 @@ export enum ResponseType {
 }
 
 export enum CodeChallengeMethod {
-  TEXT = 'text',
-  SHA256 = 'S256',
+  plain = 'plain',
+  S256 = 'S256',
 }
 
 export interface AuthorizationServerOpts {
@@ -153,8 +188,12 @@ export interface IssuerOpts {
   fetchMetadata?: boolean;
 }
 
+export interface AccessTokenFromAuthorizationResponseOpts extends AccessTokenRequestOpts {
+  authorizationResponse: AuthorizationResponse;
+}
 export interface AccessTokenRequestOpts {
-  credentialOffer: UniformCredentialOffer;
+  credentialOffer?: UniformCredentialOffer;
+  credentialIssuer?: string;
   asOpts?: AuthorizationServerOpts;
   metadata?: EndpointMetadata;
   codeVerifier?: string; // only required for authorization flow
@@ -163,22 +202,72 @@ export interface AccessTokenRequestOpts {
   pin?: string; // Pin-number. Only used when required
 }
 
-export interface AuthorizationRequestOpts {
+/*export interface AuthorizationRequestOpts {
   clientId: string;
   codeChallenge: string;
   codeChallengeMethod: CodeChallengeMethod;
   authorizationDetails?: AuthorizationDetails[];
   redirectUri: string;
   scope?: string;
+}*/
+
+/**
+ * Determinse whether PAR should be used when supported
+ *
+ * REQUIRE: Require PAR, if AS does not support it throw an error
+ * AUTO: Use PAR is the AS supports it, otherwise construct a reqular URI,
+ * NEVER: Do not use PAR even if the AS supports it (not recommended)
+ */
+export enum PARMode {
+  REQUIRE,
+  AUTO,
+  NEVER,
 }
 
-export interface AuthorizationGrantResponse {
-  grant_type: string;
+/**
+ * Optional options to provide PKCE params like code verifier and challenge yourself, or to disable PKCE altogether. If not provide PKCE will still be used! If individual params are not provide, they will be generated/calculated
+ */
+export interface PKCEOpts {
+  /**
+   * PKCE is enabled by default even if you do not provide these options. Set this to true to disable PKCE
+   */
+  disabled?: boolean;
+
+  /**
+   * Provide a code_challenge, otherwise it will be calculated using the code_verifier and method
+   */
+  codeChallenge?: string;
+
+  /**
+   * The code_challenge_method, should always by S256
+   */
+  codeChallengeMethod?: CodeChallengeMethod;
+
+  /**
+   * Provide a code_verifier, otherwise it will be generated
+   */
+  codeVerifier?: string;
+}
+
+export interface AuthorizationRequestOpts {
+  clientId?: string;
+  pkce?: PKCEOpts;
+  parMode?: PARMode;
+  authorizationDetails?: AuthorizationDetails | AuthorizationDetails[];
+  redirectUri?: string;
+  scope?: string;
+}
+
+export interface AuthorizationResponse {
   code: string;
   scope?: string;
   state?: string;
 }
 
+export interface AuthorizationGrantResponse extends AuthorizationResponse {
+  grant_type: string;
+}
+
 export interface AccessTokenRequest {
   client_id?: string;
   code?: string;

package/lib/types/CredentialIssuance.types.ts

@@ -10,13 +10,15 @@ import { CredentialOfferPayloadV1_0_11, CredentialOfferV1_0_11 } from './v1_0_11
 export interface CredentialResponse {
   credential?: W3CVerifiableCredential; // OPTIONAL. Contains issued Credential. MUST be present when acceptance_token is not returned. MAY be a JSON string or a JSON object, depending on the Credential format. See Appendix E for the Credential format specific encoding requirements
   format: OID4VCICredentialFormat /* | OID4VCICredentialFormat[]*/; // REQUIRED. JSON string denoting the format of the issued Credential
-  acceptance_token?: string; // OPTIONAL. A JSON string containing a security token subsequently used to obtain a Credential. MUST be present when credential is not returned
+  transaction_id?: string; //OPTIONAL. A string identifying a Deferred Issuance transaction. This claim is contained in the response if the Credential Issuer was unable to immediately issue the credential. The value is subsequently used to obtain the respective Credential with the Deferred Credential Endpoint (see Section 9). It MUST be present when the credential parameter is not returned. It MUST be invalidated after the credential for which it was meant has been obtained by the Wallet.
+  acceptance_token?: string; //deprecated // OPTIONAL. A JSON string containing a security token subsequently used to obtain a Credential. MUST be present when credential is not returned
   c_nonce?: string; // OPTIONAL. JSON string containing a nonce to be used to create a proof of possession of key material when requesting a Credential (see Section 7.2). When received, the Wallet MUST use this nonce value for its subsequent credential requests until the Credential Issuer provides a fresh nonce
   c_nonce_expires_in?: number; // OPTIONAL. JSON integer denoting the lifetime in seconds of the c_nonce
 }
 
 export interface CredentialOfferRequestWithBaseUrl extends UniformCredentialOfferRequest {
   scheme: string;
+  clientId?: string;
   baseUrl: string;
   userPinRequired: boolean;
   issuerState?: string;
@@ -25,7 +27,9 @@ export interface CredentialOfferRequestWithBaseUrl extends UniformCredentialOffe
 
 export type CredentialOffer = CredentialOfferV1_0_09 | CredentialOfferV1_0_11;
 
-export type CredentialOfferPayload = CredentialOfferPayloadV1_0_08 | CredentialOfferPayloadV1_0_09 | CredentialOfferPayloadV1_0_11;
+export type CredentialOfferPayload = (CredentialOfferPayloadV1_0_08 | CredentialOfferPayloadV1_0_09 | CredentialOfferPayloadV1_0_11) & {
+  [x: string]: any;
+};
 
 export interface AssertedUniformCredentialOffer extends UniformCredentialOffer {
   credential_offer: UniformCredentialOfferPayload;
@@ -106,6 +110,7 @@ export interface JWK extends BaseJWK {
   x5t?: string;
   'x5t#S256'?: string;
   x5u?: string;
+
   [propName: string]: unknown;
 }
 
@@ -146,6 +151,7 @@ export interface JWSHeaderParameters extends JoseHeaderParameters {
   alg?: Alg | string; // REQUIRED by the JWT signer
   b64?: boolean;
   crit?: string[];
+
   [propName: string]: unknown;
 }
 
@@ -171,6 +177,7 @@ export interface JWTPayload {
 
 export type JWTSignerCallback = (jwt: Jwt, kid?: string) => Promise<string>;
 export type JWTVerifyCallback<DIDDoc> = (args: { jwt: string; kid?: string }) => Promise<JwtVerifyResult<DIDDoc>>;
+
 export interface JwtVerifyResult<DIDDoc> {
   jwt: Jwt;
   kid?: string;

package/lib/types/Generic.types.ts

@@ -15,7 +15,7 @@ export interface ImageInfo {
   [key: string]: unknown;
 }
 
-export type OID4VCICredentialFormat = 'jwt_vc_json' | 'jwt_vc_json-ld' | 'ldp_vc' /*| 'mso_mdoc'*/; // we do not support mdocs at this point
+export type OID4VCICredentialFormat = 'jwt_vc_json' | 'jwt_vc_json-ld' | 'ldp_vc' | 'vc+sd-jwt' | 'jwt_vc'; // jwt_vc is added for backwards compat /*| 'mso_mdoc'*/; // we do not support mdocs at this point
 
 export interface NameAndLocale {
   name?: string; // REQUIRED. String value of a display name for the Credential.
@@ -51,6 +51,7 @@ export interface CredentialIssuerMetadataOpts {
   credentials_supported: CredentialSupported[]; // REQUIRED. A JSON array containing a list of JSON objects, each of them representing metadata about a separate credential type that the Credential Issuer can issue. The JSON objects in the array MUST conform to the structure of the Section 10.2.3.1.
   credential_issuer: string; // REQUIRED. The Credential Issuer's identifier.
   authorization_server?: string; // OPTIONAL. Identifier of the OAuth 2.0 Authorization Server (as defined in [RFC8414]) the Credential Issuer relies on for authorization. If this element is omitted, the entity providing the Credential Issuer is also acting as the AS, i.e. the Credential Issuer's identifier is used as the OAuth 2.0 Issuer value to obtain the Authorization Server metadata as per [RFC8414].
+  // authorization_servers?: string[]; // OPTIONAL. Array of strings that identify the OAuth 2.0 Authorization Servers (as defined in [RFC8414]) the Credential Issuer relies on for authorization. If this element is omitted, the entity providing the Credential Issuer is also acting as the AS, i.e. the Credential Issuer's identifier is used as the OAuth 2.0 Issuer value to obtain the Authorization Server metadata as per [RFC8414].
   token_endpoint?: string;
   display?: MetadataDisplay[]; //  An array of objects, where each object contains display properties of a Credential Issuer for a certain language. Below is a non-exhaustive list of valid parameters that MAY be included:
   credential_supplier_config?: CredentialSupplierConfig;
@@ -58,12 +59,17 @@ export interface CredentialIssuerMetadataOpts {
 
 // For now we extend the opts above. Only difference is that the credential endpoint is optional in the Opts, as it can come from other sources. The value is however required in the eventual Issuer Metadata
 export interface CredentialIssuerMetadata extends CredentialIssuerMetadataOpts, Partial<AuthorizationServerMetadata> {
+  authorization_servers?: string[]; // OPTIONAL. Array of strings that identify the OAuth 2.0 Authorization Servers (as defined in [RFC8414]) the Credential Issuer relies on for authorization. If this element is omitted, the entity providing the Credential Issuer is also acting as the AS, i.e. the Credential Issuer's identifier is used as the OAuth 2.0 Issuer value to obtain the Authorization Server metadata as per [RFC8414].
   credential_endpoint: string; // REQUIRED. URL of the Credential Issuer's Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components.
+  credential_response_encryption_alg_values_supported?: string; // OPTIONAL. Array containing a list of the JWE [RFC7516] encryption algorithms (alg values) [RFC7518] supported by the Credential and/or Batch Credential Endpoint to encode the Credential or Batch Credential Response in a JWT [RFC7519].
+  credential_response_encryption_enc_values_supported?: string; //OPTIONAL. Array containing a list of the JWE [RFC7516] encryption algorithms (enc values) [RFC7518] supported by the Credential and/or Batch Credential Endpoint to encode the Credential or Batch Credential Response in a JWT [RFC7519].
+  require_credential_response_encryption?: boolean; //OPTIONAL. Boolean value specifying whether the Credential Issuer requires additional encryption on top of TLS for the Credential Response and expects encryption parameters to be present in the Credential Request and/or Batch Credential Request, with true indicating support. When the value is true, credential_response_encryption_alg_values_supported parameter MUST also be provided. If omitted, the default value is false.
+  credential_identifiers_supported?: boolean; // OPTIONAL. Boolean value specifying whether the Credential Issuer supports returning credential_identifiers parameter in the authorization_details Token Response parameter, with true indicating support. If omitted, the default value is false.
 }
 
+// For now we extend the opts above. Only difference is that the credential endpoint is optional in the Opts, as it can come from other sources. The value is however required in the eventual Issuer Metadata
+
 export interface CredentialSupportedBrief {
-  name?: string; // fixme: Probably should not be here, is part of the display object
-  types: string[]; // REQUIRED. JSON array designating the types a certain credential type supports
   cryptographic_binding_methods_supported?: string[]; // OPTIONAL. Array of case sensitive strings that identify how the Credential is bound to the identifier of the End-User who possesses the Credential
   cryptographic_suites_supported?: string[]; // OPTIONAL. Array of case sensitive strings that identify the cryptographic suites that are supported for the cryptographic_binding_methods_supported
 }
@@ -75,25 +81,63 @@ export type CommonCredentialSupported = CredentialSupportedBrief & {
   /**
    * following properties are non-mso_mdoc specific and we might wanna rethink them when we're going to support mso_mdoc
    */
-  credentialSubject?: IssuerCredentialSubject; // OPTIONAL. A JSON object containing a list of key value pairs, where the key identifies the claim offered in the Credential. The value MAY be a dictionary, which allows to represent the full (potentially deeply nested) structure of the verifiable credential to be issued.
-  order?: string[]; //An array of claims.display.name values that lists them in the order they should be displayed by the Wallet.
 };
 
 export interface CredentialSupportedJwtVcJsonLdAndLdpVc extends CommonCredentialSupported {
+  types: string[]; // REQUIRED. JSON array designating the types a certain credential type supports
   '@context': ICredentialContextType[]; // REQUIRED. JSON array as defined in [VC_DATA], Section 4.1.
+  credentialSubject?: IssuerCredentialSubject; // OPTIONAL. A JSON object containing a list of key value pairs, where the key identifies the claim offered in the Credential. The value MAY be a dictionary, which allows to represent the full (potentially deeply nested) structure of the verifiable credential to be issued.
+  order?: string[]; //An array of claims.display.name values that lists them in the order they should be displayed by the Wallet.
+  format: 'ldp_vc' | 'jwt_vc_json-ld';
 }
 
 export interface CredentialSupportedJwtVcJson extends CommonCredentialSupported {
-  format: 'jwt_vc_json';
+  types: string[]; // REQUIRED. JSON array designating the types a certain credential type supports
+  credentialSubject?: IssuerCredentialSubject; // OPTIONAL. A JSON object containing a list of key value pairs, where the key identifies the claim offered in the Credential. The value MAY be a dictionary, which allows to represent the full (potentially deeply nested) structure of the verifiable credential to be issued.
+  order?: string[]; //An array of claims.display.name values that lists them in the order they should be displayed by the Wallet.
+  format: 'jwt_vc_json' | 'jwt_vc'; // jwt_vc added for backwards compat
 }
 
-export type CredentialSupported = CommonCredentialSupported & (CredentialSupportedJwtVcJson | CredentialSupportedJwtVcJsonLdAndLdpVc);
+export interface CredentialSupportedSdJwtVc extends CommonCredentialSupported {
+  format: 'vc+sd-jwt';
 
-export interface CredentialOfferFormat {
+  vct: string;
+  claims?: IssuerCredentialSubject;
+
+  order?: string[]; //An array of claims.display.name values that lists them in the order they should be displayed by the Wallet.
+}
+
+export type CredentialSupported = CommonCredentialSupported &
+  (CredentialSupportedJwtVcJson | CredentialSupportedJwtVcJsonLdAndLdpVc | CredentialSupportedSdJwtVc);
+
+export interface CommonCredentialOfferFormat {
   format: OID4VCICredentialFormat | string;
-  types: string[];
 }
 
+export interface CredentialOfferFormatJwtVcJsonLdAndLdpVc extends CommonCredentialOfferFormat {
+  format: 'ldp_vc' | 'jwt_vc_json-ld';
+  // REQUIRED. JSON object containing (and isolating) the detailed description of the credential type. This object MUST be processed using full JSON-LD processing.
+  credential_definition: JsonLdIssuerCredentialDefinition;
+}
+
+export interface CredentialOfferFormatJwtVcJson extends CommonCredentialOfferFormat {
+  format: 'jwt_vc_json' | 'jwt_vc'; // jwt_vc is added for backwards compat
+  types: string[]; // REQUIRED. JSON array as defined in Appendix E.1.1.2. This claim contains the type values the Wallet shall request in the subsequent Credential Request.
+}
+
+// NOTE: the sd-jwt format is added to oid4vci in a later draft version than currently
+// supported, so there's no defined offer format. However, based on the request structure
+// we support sd-jwt for older drafts of oid4vci as well
+export interface CredentialOfferFormatSdJwtVc extends CommonCredentialOfferFormat {
+  format: 'vc+sd-jwt';
+
+  vct: string;
+  claims?: IssuerCredentialSubject;
+}
+
+export type CredentialOfferFormat = CommonCredentialOfferFormat &
+  (CredentialOfferFormatJwtVcJsonLdAndLdpVc | CredentialOfferFormatJwtVcJson | CredentialOfferFormatSdJwtVc);
+
 /**
  * Optional storage that can help the credential Data Supplier. For instance to store credential input data during offer creation, if no additional data can be supplied later on
  */
@@ -108,10 +152,10 @@ export type CreateCredentialOfferURIResult = {
   userPinRequired: boolean;
 };
 
-export interface IssuerCredentialDefinition {
+export interface JsonLdIssuerCredentialDefinition {
   '@context': ICredentialContextType[];
   types: string[];
-  credentialSubject: IssuerCredentialSubject;
+  credentialSubject?: IssuerCredentialSubject;
 }
 
 export interface ErrorResponse extends Response {
@@ -128,15 +172,21 @@ export interface CommonCredentialRequest {
   proof?: ProofOfPossession;
 }
 
-export interface CredentialRequestJwtVc extends CommonCredentialRequest {
-  format: 'jwt_vc_json' | 'jwt_vc_json-ld';
+export interface CredentialRequestJwtVcJson extends CommonCredentialRequest {
+  format: 'jwt_vc_json' | 'jwt_vc'; // jwt_vc for backwards compat
   types: string[];
   credentialSubject?: IssuerCredentialSubject;
 }
 
-export interface CredentialRequestLdpVc extends CommonCredentialRequest {
-  format: 'ldp_vc';
-  credential_definition: IssuerCredentialDefinition;
+export interface CredentialRequestJwtVcJsonLdAndLdpVc extends CommonCredentialRequest {
+  format: 'ldp_vc' | 'jwt_vc_json-ld';
+  credential_definition: JsonLdIssuerCredentialDefinition;
+}
+
+export interface CredentialRequestSdJwtVc extends CommonCredentialRequest {
+  format: 'vc+sd-jwt';
+  vct: string;
+  claims?: IssuerCredentialSubject;
 }
 
 export interface CommonCredentialResponse {
@@ -157,6 +207,11 @@ export interface CredentialResponseJwtVc {
   credential: string;
 }
 
+export interface CredentialResponseSdJwtVc {
+  format: 'vc+sd-jwt';
+  credential: string;
+}
+
 // export type CredentialSubjectDisplay = NameAndLocale[];
 
 export type IssuerCredentialSubjectDisplay = CredentialSubjectDisplay & { [key: string]: CredentialSubjectDisplay };
@@ -182,6 +237,12 @@ export interface GrantAuthorizationCode {
    * Authorization Request with the Credential Issuer to a context set up during previous steps.
    */
   issuer_state?: string;
+
+  // v12 feature
+  /**
+   * OPTIONAL string that the Wallet can use to identify the Authorization Server to use with this grant type when authorization_servers parameter in the Credential Issuer metadata has multiple entries. MUST NOT be used otherwise. The value of this parameter MUST match with one of the values in the authorization_servers array obtained from the Credential Issuer metadata
+   */
+  authorization_server?: string;
 }
 
 export interface GrantUrnIetf {
@@ -194,6 +255,18 @@ export interface GrantUrnIetf {
    * in a Pre-Authorized Code Flow. Default is false.
    */
   user_pin_required: boolean;
+
+  //v12
+  /**
+   * OPTIONAL. The minimum amount of time in seconds that the Wallet SHOULD wait between polling requests to the token endpoint (in case the Authorization Server responds with error code authorization_pending - see Section 6.3). If no value is provided, Wallets MUST use 5 as the default.
+   */
+  interval?: number;
+
+  // v12 feature
+  /**
+   * OPTIONAL string that the Wallet can use to identify the Authorization Server to use with this grant type when authorization_servers parameter in the Credential Issuer metadata has multiple entries. MUST NOT be used otherwise. The value of this parameter MUST match with one of the values in the authorization_servers array obtained from the Credential Issuer metadata
+   */
+  authorization_server?: string;
 }
 
 export const PRE_AUTH_CODE_LITERAL = 'pre-authorized_code';

package/lib/types/OpenID4VCIVersions.types.ts

@@ -2,7 +2,8 @@ export enum OpenId4VCIVersion {
   VER_1_0_08 = 1008,
   VER_1_0_09 = 1009,
   VER_1_0_11 = 1011,
-  VER_UNKNOWN = Number.MIN_VALUE,
+  VER_1_0_12 = 1012,
+  VER_UNKNOWN = Number.MAX_VALUE,
 }
 
 export enum DefaultURISchemes {

package/lib/types/QRCode.types.ts

@@ -60,7 +60,7 @@ export interface ComponentOptions {
      */
     protectors?: boolean;
   };
-};
+}
 
 export interface QRCodeOpts {
   /**
@@ -224,4 +224,4 @@ export interface QRCodeOpts {
    * @deafultValue 0.4
    */
   dotScale?: number;
-};
+}

package/lib/types/ServerMetadata.ts

@@ -49,6 +49,7 @@ export interface AuthorizationServerMetadata {
 
   // VCI values. In case an AS provides a credential_endpoint itself
   credential_endpoint?: string;
+  deferred_credential_endpoint?: string;
 
   // eslint-disable-next-line  @typescript-eslint/no-explicit-any
   [x: string]: any; //We use any, so you can access properties if you know the structure
@@ -66,6 +67,7 @@ export interface EndpointMetadata {
   issuer: string;
   token_endpoint: string;
   credential_endpoint: string;
+  deferred_credential_endpoint?: string;
   authorization_server?: string;
   authorization_endpoint?: string; // Can be undefined in pre-auth flow
 }

package/lib/types/v1_0_08.types.ts

@@ -6,7 +6,7 @@ import { CredentialsSupportedDisplay, CredentialSupportedBrief, IssuerCredential
 export interface CredentialRequestV1_0_08 {
   type: string;
   format: CredentialFormat;
-  proof: ProofOfPossession;
+  proof?: ProofOfPossession;
 }
 
 export interface IssuerMetadataV1_0_08 {
@@ -34,11 +34,16 @@ export interface CredentialSupportedTypeV1_0_08 {
   [credentialType: string]: CredentialSupportedV1_0_08;
 }
 
+export interface CredentialSupportedFormatV1_0_08 extends CredentialSupportedBrief {
+  name?: string;
+  types: string[];
+}
+
 export interface CredentialSupportedV1_0_08 {
   display?: CredentialsSupportedDisplay[];
   formats: {
     // REQUIRED. A JSON object containing a list of key value pairs, where the key is a string identifying the format of the Credential. Below is a non-exhaustive list of valid key values defined by this specification:
-    [credentialFormat: string]: CredentialSupportedBrief;
+    [credentialFormat: string]: CredentialSupportedFormatV1_0_08;
   };
   claims?: IssuerCredentialSubject; // REQUIRED. A JSON object containing a list of key value pairs, where the key identifies the claim offered in the Credential. The value is a JSON object detailing the specifics about the support for the claim with a following non-exhaustive list of parameters that MAY be included:
 }

package/lib/types/v1_0_11.types.ts

@@ -2,13 +2,15 @@ import { AuthorizationDetailsJwtVcJson, CommonAuthorizationRequest } from './Aut
 import {
   CommonCredentialRequest,
   CredentialDataSupplierInput,
+  CredentialIssuerMetadataOpts,
   CredentialOfferFormat,
-  CredentialRequestJwtVc,
-  CredentialRequestLdpVc,
+  CredentialRequestJwtVcJson,
+  CredentialRequestSdJwtVc,
   Grant,
-  IssuerCredentialDefinition,
+  JsonLdIssuerCredentialDefinition,
 } from './Generic.types';
 import { QRCodeOpts } from './QRCode.types';
+import { AuthorizationServerMetadata } from './ServerMetadata';
 
 export interface CredentialOfferV1_0_11 {
   credential_offer?: CredentialOfferPayloadV1_0_11;
@@ -23,7 +25,7 @@ export interface CredentialOfferRESTRequest extends CredentialOfferV1_0_11 {
   credentialDataSupplierInput?: CredentialDataSupplierInput;
 }
 
-export interface CommonCredentialOfferPayloadV1_0_11 {
+export interface CredentialOfferPayloadV1_0_11 {
   /**
    * REQUIRED. The URL of the Credential Issuer, the Wallet is requested to obtain one or more Credentials from.
    */
@@ -48,24 +50,25 @@ export interface CommonCredentialOfferPayloadV1_0_11 {
    * using the respective metadata. When multiple grants are present, it's at the Wallet's discretion which one to use.
    */
   grants?: Grant;
-}
 
-export interface CredentialOfferLdpVcV1_0_11 extends CommonCredentialOfferPayloadV1_0_11 {
   /**
-   * REQUIRED. JSON object containing (and isolating) the detailed description of the credential type.
-   * This object MUST be processed using full JSON-LD processing. It consists of the following sub-claims:
-   *   - @context: REQUIRED. JSON array as defined in Appendix E.1.3.2
-   *   - types: REQUIRED. JSON array as defined in Appendix E.1.3.2.
-   *            This claim contains the type values the Wallet shall request in the subsequent Credential Request
+   * Some implementations might include a client_id in the offer. For instance EBSI in a same-device flow. (Cross-device tucks it in the state JWT)
    */
-  credential_definition: IssuerCredentialDefinition;
+  client_id?: string;
 }
 
-export type CredentialOfferJwtVcV1_0_11 = CommonCredentialOfferPayloadV1_0_11;
-
-export type CredentialOfferPayloadV1_0_11 = CommonCredentialOfferPayloadV1_0_11 & (CredentialOfferLdpVcV1_0_11 | CredentialOfferJwtVcV1_0_11);
+export type CredentialRequestV1_0_11 = CommonCredentialRequest &
+  (CredentialRequestJwtVcJson | CredentialRequestJwtVcJsonLdAndLdpVcV1_0_11 | CredentialRequestSdJwtVc);
 
-export type CredentialRequestV1_0_11 = CommonCredentialRequest & (CredentialRequestJwtVc | CredentialRequestLdpVc);
+export interface CredentialRequestJwtVcJsonLdAndLdpVcV1_0_11
+  extends CommonCredentialRequest,
+    Pick<JsonLdIssuerCredentialDefinition, 'credentialSubject' | 'types'> {
+  format: 'ldp_vc' | 'jwt_vc_json-ld';
+}
+export interface CredentialIssuerMetadataV1_0_11 extends CredentialIssuerMetadataOpts, Partial<AuthorizationServerMetadata> {
+  credential_endpoint: string; // REQUIRED. URL of the Credential Issuer's Credential Endpoint. This URL MUST use the https scheme and MAY contain port, path and query parameter components.
+  authorization_server?: string;
+}
 
 export interface AuthorizationRequestV1_0_11 extends AuthorizationDetailsJwtVcJson, AuthorizationDetailsJwtVcJson {
   issuer_state?: string;

package/lib/types/v1_0_12.types.ts

@@ -0,0 +1,4 @@
+import { CommonCredentialRequest, CredentialRequestJwtVcJson, CredentialRequestJwtVcJsonLdAndLdpVc, CredentialRequestSdJwtVc } from './Generic.types';
+
+export type CredentialRequestV1_0_12 = CommonCredentialRequest &
+  (CredentialRequestJwtVcJson | CredentialRequestJwtVcJsonLdAndLdpVc | CredentialRequestSdJwtVc);