@openid4vc/oauth2 0.2.0-alpha-20250109205223

package/dist/index.js

@@ -0,0 +1,2703 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  HashAlgorithm: () => HashAlgorithm,
+  InvalidFetchResponseError: () => import_utils43.InvalidFetchResponseError,
+  Oauth2AuthorizationServer: () => Oauth2AuthorizationServer,
+  Oauth2Client: () => Oauth2Client,
+  Oauth2ClientAuthorizationChallengeError: () => Oauth2ClientAuthorizationChallengeError,
+  Oauth2ClientErrorResponseError: () => Oauth2ClientErrorResponseError,
+  Oauth2Error: () => Oauth2Error,
+  Oauth2ErrorCodes: () => Oauth2ErrorCodes,
+  Oauth2JwtParseError: () => Oauth2JwtParseError,
+  Oauth2JwtVerificationError: () => Oauth2JwtVerificationError,
+  Oauth2ResourceServer: () => Oauth2ResourceServer,
+  Oauth2ResourceUnauthorizedError: () => Oauth2ResourceUnauthorizedError,
+  Oauth2ServerErrorResponseError: () => Oauth2ServerErrorResponseError,
+  PkceCodeChallengeMethod: () => PkceCodeChallengeMethod,
+  SupportedAuthenticationScheme: () => SupportedAuthenticationScheme,
+  authorizationCodeGrantIdentifier: () => authorizationCodeGrantIdentifier,
+  calculateJwkThumbprint: () => calculateJwkThumbprint,
+  clientAuthenticationClientSecretBasic: () => clientAuthenticationClientSecretBasic,
+  clientAuthenticationClientSecretPost: () => clientAuthenticationClientSecretPost,
+  clientAuthenticationDynamic: () => clientAuthenticationDynamic,
+  clientAuthenticationNone: () => clientAuthenticationNone,
+  decodeJwt: () => decodeJwt,
+  fetchAuthorizationServerMetadata: () => fetchAuthorizationServerMetadata,
+  fetchJwks: () => fetchJwks,
+  fetchWellKnownMetadata: () => fetchWellKnownMetadata,
+  getAuthorizationServerMetadataFromList: () => getAuthorizationServerMetadataFromList,
+  getGlobalConfig: () => import_utils42.getGlobalConfig,
+  isJwkInSet: () => isJwkInSet,
+  jwtHeaderFromJwtSigner: () => jwtHeaderFromJwtSigner,
+  jwtSignerFromJwt: () => jwtSignerFromJwt,
+  preAuthorizedCodeGrantIdentifier: () => preAuthorizedCodeGrantIdentifier,
+  refreshTokenGrantIdentifier: () => refreshTokenGrantIdentifier,
+  resourceRequest: () => resourceRequest,
+  setGlobalConfig: () => import_utils42.setGlobalConfig,
+  vAuthorizationCodeGrantIdentifier: () => vAuthorizationCodeGrantIdentifier,
+  vAuthorizationServerMetadata: () => vAuthorizationServerMetadata,
+  vCompactJwt: () => vCompactJwt,
+  vJwk: () => vJwk,
+  vJwtHeader: () => vJwtHeader,
+  vJwtPayload: () => vJwtPayload,
+  vOauth2ErrorResponse: () => vOauth2ErrorResponse,
+  vPreAuthorizedCodeGrantIdentifier: () => vPreAuthorizedCodeGrantIdentifier,
+  vRefreshTokenGrantIdentifier: () => vRefreshTokenGrantIdentifier,
+  verifyJwt: () => verifyJwt,
+  verifyResourceRequest: () => verifyResourceRequest
+});
+module.exports = __toCommonJS(src_exports);
+var import_utils42 = require("@openid4vc/utils");
+
+// src/common/v-oauth2-error.ts
+var v = __toESM(require("valibot"));
+var Oauth2ErrorCodes = /* @__PURE__ */ ((Oauth2ErrorCodes2) => {
+  Oauth2ErrorCodes2["ServerError"] = "server_error";
+  Oauth2ErrorCodes2["InvalidTarget"] = "invalid_target";
+  Oauth2ErrorCodes2["InvalidRequest"] = "invalid_request";
+  Oauth2ErrorCodes2["InvalidToken"] = "invalid_token";
+  Oauth2ErrorCodes2["InsufficientScope"] = "insufficient_scope";
+  Oauth2ErrorCodes2["InvalidGrant"] = "invalid_grant";
+  Oauth2ErrorCodes2["InvalidClient"] = "invalid_client";
+  Oauth2ErrorCodes2["UnauthorizedClient"] = "unauthorized_client";
+  Oauth2ErrorCodes2["UnsupportedGrantType"] = "unsupported_grant_type";
+  Oauth2ErrorCodes2["InvalidScope"] = "invalid_scope";
+  Oauth2ErrorCodes2["InvalidDpopProof"] = "invalid_dpop_proof";
+  Oauth2ErrorCodes2["UseDpopNonce"] = "use_dpop_nonce";
+  Oauth2ErrorCodes2["RedirectToWeb"] = "redirect_to_web";
+  Oauth2ErrorCodes2["InvalidSession"] = "invalid_session";
+  Oauth2ErrorCodes2["InsufficientAuthorization"] = "insufficient_authorization";
+  Oauth2ErrorCodes2["InvalidCredentialRequest"] = "invalid_credential_request";
+  Oauth2ErrorCodes2["CredentialRequestDenied"] = "credential_request_denied";
+  Oauth2ErrorCodes2["UnsupportedCredentialType"] = "unsupported_credential_type";
+  Oauth2ErrorCodes2["UnsupportedCredentialFormat"] = "unsupported_credential_format";
+  Oauth2ErrorCodes2["InvalidProof"] = "invalid_proof";
+  Oauth2ErrorCodes2["InvalidNonce"] = "invalid_nonce";
+  Oauth2ErrorCodes2["InvalidEncryptionParameters"] = "invalid_encryption_parameters";
+  return Oauth2ErrorCodes2;
+})(Oauth2ErrorCodes || {});
+var vOauth2ErrorResponse = v.looseObject({
+  error: v.union([v.enum(Oauth2ErrorCodes), v.string()]),
+  error_description: v.optional(v.string()),
+  error_uri: v.optional(v.string())
+});
+
+// src/common/jwk/jwk-thumbprint.ts
+var v2 = __toESM(require("valibot"));
+var import_utils = require("@openid4vc/utils");
+var vJwkThumbprintComponents = v2.variant("kty", [
+  v2.pipe(
+    v2.looseObject({
+      kty: v2.literal("EC"),
+      crv: v2.string(),
+      x: v2.string(),
+      y: v2.string()
+    }),
+    v2.transform(({ crv, kty, x, y }) => ({ crv, kty, x, y }))
+  ),
+  v2.pipe(
+    v2.looseObject({
+      kty: v2.literal("OKP"),
+      crv: v2.string(),
+      x: v2.string()
+    }),
+    v2.transform(({ crv, kty, x }) => ({ crv, kty, x }))
+  ),
+  v2.pipe(
+    v2.looseObject({
+      kty: v2.literal("RSA"),
+      e: v2.string(),
+      n: v2.string()
+    }),
+    v2.transform(({ e, kty, n }) => ({ e, kty, n }))
+  ),
+  v2.pipe(
+    v2.looseObject({
+      kty: v2.literal("oct"),
+      k: v2.string()
+    }),
+    v2.transform(({ k, kty }) => ({ k, kty }))
+  )
+]);
+async function calculateJwkThumbprint(options) {
+  const jwkThumbprintComponents = (0, import_utils.parseWithErrorHandling)(
+    vJwkThumbprintComponents,
+    options.jwk,
+    `Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing.`
+  );
+  const thumbprint = (0, import_utils.encodeToBase64Url)(
+    await options.hashCallback((0, import_utils.decodeUtf8String)(JSON.stringify(jwkThumbprintComponents)), options.hashAlgorithm)
+  );
+  return thumbprint;
+}
+
+// src/callbacks.ts
+var HashAlgorithm = /* @__PURE__ */ ((HashAlgorithm2) => {
+  HashAlgorithm2["Sha256"] = "SHA-256";
+  return HashAlgorithm2;
+})(HashAlgorithm || {});
+
+// src/error/Oauth2Error.ts
+var Oauth2Error = class extends Error {
+  constructor(message, options) {
+    const errorMessage = message ?? "Unknown error occured.";
+    const causeMessage = options?.cause instanceof Error ? ` ${options.cause.message}` : options?.cause ? ` ${options?.cause}` : "";
+    super(`${errorMessage}${causeMessage}`);
+    this.cause = options?.cause;
+  }
+};
+
+// src/common/jwk/jwks.ts
+function extractJwkFromJwksForJwt(options) {
+  const jwksForUse = options.jwks.keys.filter(({ use }) => !use || use === options.use);
+  const jwkForKid = options.kid ? jwksForUse.find(({ kid }) => kid === options.kid) : void 0;
+  if (jwkForKid) {
+    return jwkForKid;
+  }
+  if (jwksForUse.length === 1) {
+    return jwksForUse[0];
+  }
+  throw new Oauth2Error(
+    `Unable to extract jwk from jwks for use '${options.use}'${options.kid ? `with kid '${options.kid}'.` : ". No kid provided and more than jwk."}`
+  );
+}
+async function isJwkInSet({
+  jwk,
+  jwks,
+  callbacks
+}) {
+  const jwkThumbprint = await calculateJwkThumbprint({
+    hashAlgorithm: "SHA-256" /* Sha256 */,
+    hashCallback: callbacks.hash,
+    jwk
+  });
+  for (const jwkFromSet of jwks) {
+    const jwkFromSetThumbprint = await calculateJwkThumbprint({
+      hashAlgorithm: "SHA-256" /* Sha256 */,
+      hashCallback: callbacks.hash,
+      jwk: jwkFromSet
+    });
+    if (jwkFromSetThumbprint === jwkThumbprint) return true;
+  }
+  return false;
+}
+
+// src/common/jwk/v-jwk.ts
+var v3 = __toESM(require("valibot"));
+var vJwk = v3.looseObject({
+  kty: v3.string(),
+  crv: v3.optional(v3.string()),
+  x: v3.optional(v3.string()),
+  y: v3.optional(v3.string()),
+  e: v3.optional(v3.string()),
+  n: v3.optional(v3.string()),
+  alg: v3.optional(v3.string()),
+  d: v3.optional(v3.string()),
+  dp: v3.optional(v3.string()),
+  dq: v3.optional(v3.string()),
+  ext: v3.optional(v3.boolean()),
+  k: v3.optional(v3.string()),
+  key_ops: v3.optional(v3.string()),
+  kid: v3.optional(v3.string()),
+  oth: v3.optional(
+    v3.array(
+      v3.looseObject({
+        d: v3.optional(v3.string()),
+        r: v3.optional(v3.string()),
+        t: v3.optional(v3.string())
+      })
+    )
+  ),
+  p: v3.optional(v3.string()),
+  q: v3.optional(v3.string()),
+  qi: v3.optional(v3.string()),
+  use: v3.optional(v3.string()),
+  x5c: v3.optional(v3.string()),
+  x5t: v3.optional(v3.string()),
+  "x5t#S256": v3.optional(v3.string()),
+  x5u: v3.optional(v3.string())
+});
+var vJwkSet = v3.looseObject({
+  keys: v3.array(vJwk)
+});
+
+// src/common/jwt/verify-jwt.ts
+var import_utils2 = require("@openid4vc/utils");
+
+// src/error/Oauth2JwtVerificationError.ts
+var Oauth2JwtVerificationError = class extends Oauth2Error {
+  constructor(message, options) {
+    const errorMessage = message ?? "Error verifiying jwt.";
+    super(errorMessage, options);
+  }
+};
+
+// src/common/jwt/verify-jwt.ts
+async function verifyJwt(options) {
+  const errorMessage = options.errorMessage ?? "Error during verification of jwt.";
+  let signerJwk;
+  try {
+    const result = await options.verifyJwtCallback(options.signer, {
+      header: options.header,
+      payload: options.payload,
+      compact: options.compact
+    });
+    if (!result.verified) throw new Oauth2JwtVerificationError(errorMessage);
+    signerJwk = result.signerJwk;
+  } catch (error) {
+    if (error instanceof Oauth2JwtVerificationError) throw error;
+    throw new Oauth2JwtVerificationError(errorMessage, { cause: error });
+  }
+  const nowInSeconds = (0, import_utils2.dateToSeconds)(options.now ?? /* @__PURE__ */ new Date());
+  const skewInSeconds = options.allowedSkewInSeconds ?? 0;
+  const timeBasedValidation = options.skipTimeBasedValidation !== void 0 ? !options.skipTimeBasedValidation : true;
+  if (timeBasedValidation && options.payload.nbf && nowInSeconds < options.payload.nbf - skewInSeconds) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'nbf' is in the future`);
+  }
+  if (timeBasedValidation && options.payload.exp && nowInSeconds > options.payload.exp + skewInSeconds) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'exp' is in the past`);
+  }
+  if (options.expectedAudience && options.expectedAudience !== options.payload.aud) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'aud' does not match expected value.`);
+  }
+  if (options.expectedIssuer && options.expectedIssuer !== options.payload.iss) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'iss' does not match expected value.`);
+  }
+  if (options.expectedNonce && options.expectedNonce !== options.payload.nonce) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'nonce' does not match expected value.`);
+  }
+  if (options.expectedSubject && options.expectedSubject !== options.payload.sub) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'sub' does not match expected value.`);
+  }
+  return {
+    signer: {
+      ...options.signer,
+      publicJwk: signerJwk
+    }
+  };
+}
+
+// src/common/jwt/decode-jwt.ts
+var import_utils4 = require("@openid4vc/utils");
+
+// src/error/Oauth2JwtParseError.ts
+var Oauth2JwtParseError = class extends Oauth2Error {
+  constructor(message) {
+    const errorMessage = message ?? "Error parsing jwt";
+    super(errorMessage);
+  }
+};
+
+// src/common/jwt/v-jwt.ts
+var import_utils3 = require("@openid4vc/utils");
+var v5 = __toESM(require("valibot"));
+
+// src/common/v-common.ts
+var v4 = __toESM(require("valibot"));
+var vAlgValueNotNone = v4.pipe(
+  v4.string(),
+  v4.check((alg) => alg !== "none", `alg value may not be 'none'`)
+);
+
+// src/common/jwt/v-jwt.ts
+var vCompactJwt = v5.pipe(
+  v5.string(),
+  v5.regex(/^([a-zA-Z0-9_=]+)\.([a-zA-Z0-9_=]+)\.([a-zA-Z0-9_\-\+\/=]*)$/, "Not a valid compact jwt")
+);
+var vJwtConfirmationPayload = v5.looseObject({
+  jwk: v5.optional(vJwk),
+  // RFC9449. jwk thumbprint of the dpop public key to which the access token is bound
+  jkt: v5.optional(v5.string())
+});
+var vJwtPayload = v5.looseObject({
+  iss: v5.optional(v5.string()),
+  aud: v5.optional(v5.string()),
+  iat: v5.optional(import_utils3.vInteger),
+  exp: v5.optional(import_utils3.vInteger),
+  nbf: v5.optional(import_utils3.vInteger),
+  nonce: v5.optional(v5.string()),
+  jti: v5.optional(v5.string()),
+  cnf: v5.optional(vJwtConfirmationPayload),
+  // Reserved for status parameters
+  status: v5.optional(v5.looseObject({}))
+});
+var vJwtHeader = v5.looseObject({
+  alg: vAlgValueNotNone,
+  typ: v5.optional(v5.string()),
+  kid: v5.optional(v5.string()),
+  jwk: v5.optional(vJwk),
+  x5c: v5.optional(v5.array(v5.string())),
+  trust_chain: v5.optional(v5.array(v5.string()))
+});
+
+// src/common/jwt/decode-jwt.ts
+function decodeJwt(options) {
+  const jwtParts = options.jwt.split(".");
+  if (jwtParts.length !== 3) {
+    throw new Oauth2JwtParseError("Jwt is not a valid jwt, unable to decode");
+  }
+  let headerJson;
+  let payloadJson;
+  try {
+    headerJson = (0, import_utils4.stringToJsonWithErrorHandling)(
+      (0, import_utils4.encodeToUtf8String)((0, import_utils4.decodeBase64)(jwtParts[0])),
+      "Unable to parse jwt header to JSON"
+    );
+    payloadJson = (0, import_utils4.stringToJsonWithErrorHandling)(
+      (0, import_utils4.encodeToUtf8String)((0, import_utils4.decodeBase64)(jwtParts[1])),
+      "Unable to parse jwt payload to JSON"
+    );
+  } catch (error) {
+    throw new Oauth2JwtParseError("Error parsing JWT");
+  }
+  const header = (0, import_utils4.parseWithErrorHandling)(options.headerSchema ?? vJwtHeader, headerJson);
+  const payload = (0, import_utils4.parseWithErrorHandling)(options.payloadSchema ?? vJwtPayload, payloadJson);
+  return {
+    header,
+    payload,
+    signature: jwtParts[2]
+  };
+}
+function jwtHeaderFromJwtSigner(signer) {
+  if (signer.method === "did") {
+    return {
+      alg: signer.alg,
+      kid: signer.didUrl
+    };
+  }
+  if (signer.method === "trustChain") {
+    return {
+      alg: signer.alg,
+      kid: signer.kid,
+      trust_chain: signer.trustChain
+    };
+  }
+  if (signer.method === "jwk") {
+    return {
+      alg: signer.alg,
+      jwk: signer.publicJwk,
+      kid: signer.publicJwk.kid
+    };
+  }
+  if (signer.method === "x5c") {
+    return {
+      alg: signer.alg,
+      x5c: signer.x5c
+    };
+  }
+  return {
+    alg: signer.alg
+  };
+}
+function jwtSignerFromJwt({ header, payload }) {
+  if (header.x5c) {
+    return {
+      alg: header.alg,
+      method: "x5c",
+      x5c: header.x5c
+    };
+  }
+  if (header.trust_chain) {
+    if (!header.kid) {
+      throw new Error(`When 'trust_chain' is used in jwt header, the 'kid' parameter is required.`);
+    }
+    return {
+      method: "trustChain",
+      alg: header.alg,
+      trustChain: header.trust_chain,
+      kid: header.kid
+    };
+  }
+  if (header.kid) {
+    if (header.kid.startsWith("did:")) {
+      if (payload.iss && header.kid.startsWith(payload.iss)) {
+      }
+      if (!header.kid.includes("#")) {
+      }
+      return {
+        method: "did",
+        didUrl: header.kid,
+        alg: header.alg
+      };
+    }
+    if (header.kid.startsWith("#") && payload.iss?.startsWith("did:")) {
+      return {
+        method: "did",
+        didUrl: `${payload.iss}${header.kid}`,
+        alg: header.alg
+      };
+    }
+  }
+  if (header.jwk) {
+    return {
+      alg: header.alg,
+      method: "jwk",
+      publicJwk: header.jwk
+    };
+  }
+  return {
+    method: "custom",
+    alg: header.alg
+  };
+}
+
+// src/error/Oauth2ResourceUnauthorizedError.ts
+var import_utils5 = require("@openid4vc/utils");
+var Oauth2ResourceUnauthorizedError = class _Oauth2ResourceUnauthorizedError extends Oauth2Error {
+  constructor(internalMessage, wwwAuthenticateHeaders) {
+    super(`${internalMessage}
+${JSON.stringify(wwwAuthenticateHeaders, null, 2)}`);
+    this.wwwAuthenticateHeaders = Array.isArray(wwwAuthenticateHeaders) ? wwwAuthenticateHeaders : [wwwAuthenticateHeaders];
+  }
+  static fromHeaderValue(value) {
+    const headers = (0, import_utils5.parseWwwAuthenticateHeader)(value);
+    return new _Oauth2ResourceUnauthorizedError(
+      void 0,
+      headers.map(
+        ({ scheme, payload: { error, error_description, scope, ...additionalPayload } }) => ({
+          scheme,
+          error: Array.isArray(error) ? error.join(",") : error ?? void 0,
+          error_description: Array.isArray(error_description) ? error_description.join(",") : error_description ?? void 0,
+          scope: Array.isArray(scope) ? scope.join(",") : scope ?? void 0,
+          ...additionalPayload
+        })
+      )
+    );
+  }
+  toHeaderValue() {
+    return (0, import_utils5.encodeWwwAuthenticateHeader)(
+      this.wwwAuthenticateHeaders.map((header) => ({
+        scheme: header.scheme,
+        payload: {
+          error: header.error ?? null,
+          error_description: header.error_description ?? null,
+          scope: header.scope ?? null,
+          ...header.additionalPayload
+        }
+      }))
+    );
+  }
+};
+
+// src/index.ts
+var import_utils43 = require("@openid4vc/utils");
+
+// src/error/Oauth2ClientErrorResponseError.ts
+var Oauth2ClientErrorResponseError = class extends Oauth2Error {
+  constructor(message, errorResponse, response) {
+    super(`${message}
+${JSON.stringify(errorResponse, null, 2)}`);
+    this.errorResponse = errorResponse;
+    this.response = response.clone();
+  }
+};
+
+// src/error/Oauth2ClientAuthorizationChallengeError.ts
+var Oauth2ClientAuthorizationChallengeError = class extends Oauth2ClientErrorResponseError {
+  constructor(message, errorResponse, response) {
+    super(message, errorResponse, response);
+    this.errorResponse = errorResponse;
+  }
+};
+
+// src/error/Oauth2ServerErrorResponseError.ts
+var Oauth2ServerErrorResponseError = class extends Oauth2Error {
+  constructor(errorResponse, options) {
+    super(
+      `${options?.internalMessage ?? errorResponse.error_description}
+${JSON.stringify(errorResponse, null, 2)}`,
+      options
+    );
+    this.errorResponse = errorResponse;
+    this.status = options?.status ?? 400;
+  }
+};
+
+// src/metadata/authorization-server/v-authorization-server-metadata.ts
+var import_utils6 = require("@openid4vc/utils");
+var v6 = __toESM(require("valibot"));
+var vAuthorizationServerMetadata = v6.pipe(
+  v6.looseObject({
+    issuer: import_utils6.vHttpsUrl,
+    token_endpoint: import_utils6.vHttpsUrl,
+    token_endpoint_auth_methods_supported: v6.optional(v6.array(v6.string())),
+    authorization_endpoint: v6.optional(import_utils6.vHttpsUrl),
+    jwks_uri: v6.optional(import_utils6.vHttpsUrl),
+    // RFC7636
+    code_challenge_methods_supported: v6.optional(v6.array(v6.string())),
+    // RFC9449
+    dpop_signing_alg_values_supported: v6.optional(v6.array(v6.string())),
+    // RFC9126
+    require_pushed_authorization_requests: v6.optional(v6.boolean()),
+    pushed_authorization_request_endpoint: v6.optional(import_utils6.vHttpsUrl),
+    // RFC9068
+    introspection_endpoint: v6.optional(import_utils6.vHttpsUrl),
+    introspection_endpoint_auth_methods_supported: v6.optional(
+      v6.array(v6.union([v6.literal("client_secret_jwt"), v6.literal("private_key_jwt"), v6.string()]))
+    ),
+    introspection_endpoint_auth_signing_alg_values_supported: v6.optional(v6.array(vAlgValueNotNone)),
+    // FiPA (no RFC yet)
+    authorization_challenge_endpoint: v6.optional(import_utils6.vHttpsUrl),
+    // From OID4VCI specification
+    "pre-authorized_grant_anonymous_access_supported": v6.optional(v6.boolean())
+  }),
+  v6.check(
+    ({
+      introspection_endpoint_auth_methods_supported: methodsSupported,
+      introspection_endpoint_auth_signing_alg_values_supported: algValuesSupported
+    }) => {
+      if (!methodsSupported) return true;
+      if (!methodsSupported.includes("private_key_jwt") && !methodsSupported.includes("client_secret_jwt")) return true;
+      return algValuesSupported !== void 0 && algValuesSupported.length > 0;
+    },
+    `Metadata value 'introspection_endpoint_auth_signing_alg_values_supported' must be defined if metadata 'introspection_endpoint_auth_methods_supported' value contains values 'private_key_jwt' or 'client_secret_jwt'`
+  )
+);
+
+// src/metadata/authorization-server/authorization-server-metadata.ts
+var import_utils9 = require("@openid4vc/utils");
+
+// src/metadata/fetch-well-known-metadata.ts
+var import_utils7 = require("@openid4vc/utils");
+var import_utils8 = require("@openid4vc/utils");
+
+// ../utils/src/parse.ts
+var v7 = __toESM(require("valibot"));
+
+// ../utils/src/object.ts
+function isObject(item) {
+  return item != null && typeof item === "object" && !Array.isArray(item);
+}
+function mergeDeep(target, ...sources) {
+  if (!sources.length) return target;
+  const source = sources.shift();
+  if (isObject(target) && isObject(source)) {
+    for (const key in source) {
+      if (isObject(source[key])) {
+        if (!target[key]) Object.assign(target, { [key]: {} });
+        mergeDeep(target[key], source[key]);
+      } else {
+        Object.assign(target, { [key]: source[key] });
+      }
+    }
+  }
+  return mergeDeep(target, ...sources);
+}
+
+// ../utils/src/parse.ts
+function valibotRecursiveFlattenIssues(issues) {
+  let flattened = v7.flatten(issues);
+  for (const issue of issues) {
+    if (issue.issues) {
+      flattened = mergeDeep(flattened, valibotRecursiveFlattenIssues(issue.issues));
+    }
+  }
+  return flattened;
+}
+
+// ../utils/src/error/ValidationError.ts
+var ValidationError = class extends Error {
+  constructor(message, valibotIssues = []) {
+    const errorDetails = valibotIssues.length > 0 ? JSON.stringify(valibotRecursiveFlattenIssues(valibotIssues), null, 2) : "No details provided";
+    super(`${message}
+${errorDetails}`);
+    this.valibotIssues = valibotIssues;
+  }
+};
+
+// src/metadata/fetch-well-known-metadata.ts
+async function fetchWellKnownMetadata(wellKnownMetadataUrl, schema, fetch) {
+  const fetcher = (0, import_utils7.createValibotFetcher)(fetch);
+  const { result, response } = await fetcher(schema, import_utils7.ContentType.Json, wellKnownMetadataUrl);
+  if (response.status === 404) {
+    return null;
+  }
+  if (!response.ok) {
+    throw new import_utils8.InvalidFetchResponseError(
+      `Fetching well known metadata from '${wellKnownMetadataUrl}' resulted in an unsuccessfull response with status '${response.status}'.`,
+      await response.clone().text(),
+      response
+    );
+  }
+  if (!result || !result.success) {
+    throw new ValidationError(`Validation of metadata from '${wellKnownMetadataUrl}' failed`, result?.issues);
+  }
+  return result.output;
+}
+
+// src/metadata/authorization-server/authorization-server-metadata.ts
+var wellKnownAuthorizationServerSuffix = ".well-known/oauth-authorization-server";
+var wellKnownOpenIdConfigurationServerSuffix = ".well-known/openid-configuration";
+async function fetchAuthorizationServerMetadata(issuer, fetch) {
+  const openIdConfigurationWellKnownMetadataUrl = (0, import_utils9.joinUriParts)(issuer, [wellKnownOpenIdConfigurationServerSuffix]);
+  const openIdConfigurationResult = await fetchWellKnownMetadata(
+    openIdConfigurationWellKnownMetadataUrl,
+    vAuthorizationServerMetadata,
+    fetch
+  );
+  if (openIdConfigurationResult) {
+    if (openIdConfigurationResult.issuer !== issuer) {
+      throw new Oauth2Error(
+        `The 'issuer' parameter '${openIdConfigurationResult.issuer}' in the well known openid configuration at '${openIdConfigurationWellKnownMetadataUrl}' does not match the provided issuer '${issuer}'.`
+      );
+    }
+    return openIdConfigurationResult;
+  }
+  const authorizationServerWellKnownMetadataUrl = (0, import_utils9.joinUriParts)(issuer, [wellKnownAuthorizationServerSuffix]);
+  const authorizationServerResult = await fetchWellKnownMetadata(
+    authorizationServerWellKnownMetadataUrl,
+    vAuthorizationServerMetadata,
+    fetch
+  );
+  if (authorizationServerResult) {
+    if (authorizationServerResult.issuer !== issuer) {
+      throw new Oauth2Error(
+        `The 'issuer' parameter '${authorizationServerResult.issuer}' in the well known authorization server metadata at '${authorizationServerWellKnownMetadataUrl}' does not match the provided issuer '${issuer}'.`
+      );
+    }
+    return authorizationServerResult;
+  }
+  return null;
+}
+function getAuthorizationServerMetadataFromList(authorizationServersMetadata, issuer) {
+  const authorizationServerMetadata = authorizationServersMetadata.find(
+    (authorizationServerMetadata2) => authorizationServerMetadata2.issuer === issuer
+  );
+  if (!authorizationServerMetadata) {
+    throw new Oauth2Error(
+      `Authorization server '${issuer}' not found in list of authorization servers. Availalbe authorization servers are ${authorizationServersMetadata.map((as) => `'${as.issuer}'`).join(", ")}`
+    );
+  }
+  return authorizationServerMetadata;
+}
+
+// src/metadata/fetch-jwks-uri.ts
+var import_utils10 = require("@openid4vc/utils");
+var import_utils11 = require("@openid4vc/utils");
+async function fetchJwks(authorizationServer, fetch) {
+  const fetcher = (0, import_utils10.createValibotFetcher)(fetch);
+  const jwksUrl = authorizationServer.jwks_uri;
+  if (!jwksUrl) {
+    throw new Oauth2Error(
+      `Authorization server '${authorizationServer.issuer}' does not have a 'jwks_uri' parameter to fetch JWKs.`
+    );
+  }
+  const { result, response } = await fetcher(vJwkSet, import_utils10.ContentType.JwkSet, jwksUrl);
+  if (!response.ok) {
+    throw new import_utils11.InvalidFetchResponseError(
+      `Fetching JWKs from jwks_uri '${jwksUrl}' resulted in an unsuccessfull response with status code '${response.status}'.`,
+      await response.clone().text(),
+      response
+    );
+  }
+  if (!result || !result.success) {
+    throw new ValidationError(`Validation of JWKs from jwks_uri '${jwksUrl}' failed`, result?.issues);
+  }
+  return result.output;
+}
+
+// src/access-token/v-access-token-jwt.ts
+var import_utils12 = require("@openid4vc/utils");
+var v8 = __toESM(require("valibot"));
+var vAccessTokenProfileJwtHeader = v8.looseObject({
+  ...vJwtHeader.entries,
+  typ: v8.picklist(["application/at+jwt", "at+jwt"])
+});
+var vAccessTokenProfileJwtPayload = v8.looseObject({
+  ...vJwtPayload.entries,
+  iss: v8.string(),
+  exp: import_utils12.vInteger,
+  iat: import_utils12.vInteger,
+  aud: v8.string(),
+  sub: v8.string(),
+  // REQUIRED according to RFC 9068, but OID4VCI allows anonymous access
+  client_id: v8.optional(v8.string()),
+  jti: v8.string(),
+  // SHOULD be included in the authorization request contained it
+  scope: v8.optional(v8.string())
+});
+
+// src/access-token/verify-access-token.ts
+var SupportedAuthenticationScheme = /* @__PURE__ */ ((SupportedAuthenticationScheme2) => {
+  SupportedAuthenticationScheme2["Bearer"] = "Bearer";
+  SupportedAuthenticationScheme2["DPoP"] = "DPoP";
+  return SupportedAuthenticationScheme2;
+})(SupportedAuthenticationScheme || {});
+async function verifyJwtProfileAccessToken(options) {
+  const decodedJwt = decodeJwt({
+    jwt: options.accessToken,
+    headerSchema: vAccessTokenProfileJwtHeader,
+    payloadSchema: vAccessTokenProfileJwtPayload
+  });
+  const authorizationServer = options.authorizationServers.find(({ issuer }) => decodedJwt.payload.iss === issuer);
+  if (!authorizationServer) {
+    throw new Oauth2Error(
+      `Access token jwt contains unrecognized authorization server 'iss' value of '${decodedJwt.payload.iss}'`
+    );
+  }
+  const jwks = await fetchJwks(authorizationServer, options.callbacks.fetch);
+  const publicJwk = extractJwkFromJwksForJwt({
+    kid: decodedJwt.header.kid,
+    jwks,
+    use: "sig"
+  });
+  await verifyJwt({
+    compact: options.accessToken,
+    header: decodedJwt.header,
+    payload: decodedJwt.payload,
+    signer: { method: "jwk", publicJwk, alg: decodedJwt.header.alg },
+    verifyJwtCallback: options.callbacks.verifyJwt,
+    errorMessage: "Error during verification of access token jwt.",
+    now: options.now,
+    expectedAudience: options.resourceServer
+  });
+  return {
+    header: decodedJwt.header,
+    payload: decodedJwt.payload,
+    authorizationServer
+  };
+}
+
+// src/resource-request/make-resource-request.ts
+var import_utils15 = require("@openid4vc/utils");
+
+// src/dpop/dpop.ts
+var import_utils14 = require("@openid4vc/utils");
+
+// src/dpop/v-dpop.ts
+var v9 = __toESM(require("valibot"));
+var import_utils13 = require("@openid4vc/utils");
+var vDpopJwtPayload = v9.looseObject({
+  ...vJwtPayload.entries,
+  iat: import_utils13.vInteger,
+  htu: import_utils13.vHttpsUrl,
+  htm: import_utils13.vHttpMethod,
+  jti: v9.string(),
+  // Only required when presenting in combination with access token
+  ath: v9.optional(v9.string())
+});
+var vDpopJwtHeader = v9.looseObject({
+  ...vJwtHeader.entries,
+  typ: v9.literal("dpop+jwt"),
+  jwk: vJwk
+});
+
+// src/dpop/dpop.ts
+async function createDpopHeadersForRequest(options) {
+  const dpopJwt = await createDpopJwt(options);
+  return {
+    DPoP: dpopJwt
+  };
+}
+async function createDpopJwt(options) {
+  let ath = void 0;
+  if (options.accessToken) {
+    ath = (0, import_utils14.encodeToBase64Url)(await options.callbacks.hash((0, import_utils14.decodeUtf8String)(options.accessToken), "SHA-256" /* Sha256 */));
+  }
+  const header = (0, import_utils14.parseWithErrorHandling)(vDpopJwtHeader, {
+    typ: "dpop+jwt",
+    jwk: options.signer.publicJwk,
+    alg: options.signer.alg
+  });
+  const payload = (0, import_utils14.parseWithErrorHandling)(vDpopJwtPayload, {
+    htu: htuFromRequestUrl(options.request.url),
+    iat: (0, import_utils14.dateToSeconds)(options.issuedAt),
+    htm: options.request.method,
+    jti: (0, import_utils14.encodeToBase64Url)(await options.callbacks.generateRandom(32)),
+    ath,
+    nonce: options.nonce,
+    ...options.additionalPayload
+  });
+  const { jwt } = await options.callbacks.signJwt(options.signer, {
+    header,
+    payload
+  });
+  return jwt;
+}
+async function verifyDpopJwt(options) {
+  const { header, payload } = decodeJwt({
+    jwt: options.dpopJwt,
+    headerSchema: vDpopJwtHeader,
+    payloadSchema: vDpopJwtPayload
+  });
+  if (options.allowedSigningAlgs && !options.allowedSigningAlgs.includes(header.alg)) {
+    throw new Oauth2Error(
+      `dpop jwt uses alg value '${header.alg}' but allowed dpop signging alg values are ${options.allowedSigningAlgs.join(", ")}.`
+    );
+  }
+  if (options.expectedNonce) {
+    if (!payload.nonce) {
+      throw new Oauth2Error(`Dpop jwt does not have a nonce value, but expected nonce value '${options.expectedNonce}'`);
+    }
+    if (payload.nonce !== options.expectedNonce) {
+      throw new Oauth2Error(
+        `Dpop jwt contains nonce value '${payload.nonce}', but expected nonce value '${options.expectedNonce}'`
+      );
+    }
+  }
+  if (options.request.method !== payload.htm) {
+    throw new Oauth2Error(
+      `Dpop jwt contains htm value '${payload.htm}', but expected htm value '${options.request.method}'`
+    );
+  }
+  const expectedHtu = htuFromRequestUrl(options.request.url);
+  if (expectedHtu !== payload.htu) {
+    throw new Oauth2Error(`Dpop jwt contains htu value '${payload.htu}', but expected htu value '${expectedHtu}'.`);
+  }
+  if (options.accessToken) {
+    const expectedAth = (0, import_utils14.encodeToBase64Url)(
+      await options.callbacks.hash((0, import_utils14.decodeUtf8String)(options.accessToken), "SHA-256" /* Sha256 */)
+    );
+    if (!payload.ath) {
+      throw new Oauth2Error(`Dpop jwt does not have a ath value, but expected ath value '${expectedAth}'.`);
+    }
+    if (payload.ath !== expectedAth) {
+      throw new Oauth2Error(`Dpop jwt contains ath value '${payload.ath}', but expected ath value '${expectedAth}'.`);
+    }
+  }
+  if (options.expectedJwkThumbprint) {
+    const jwkThumprint = await calculateJwkThumbprint({
+      hashAlgorithm: "SHA-256" /* Sha256 */,
+      hashCallback: options.callbacks.hash,
+      jwk: header.jwk
+    });
+    if (options.expectedJwkThumbprint !== jwkThumprint) {
+      throw new Oauth2Error(
+        `Dpop is signed with jwk with thumbprint value '${jwkThumprint}', but expect jwk thumbprint value '${options.expectedJwkThumbprint}'`
+      );
+    }
+  }
+  await verifyJwt({
+    signer: {
+      alg: header.alg,
+      method: "jwk",
+      publicJwk: header.jwk
+    },
+    now: options.now,
+    header,
+    payload,
+    compact: options.dpopJwt,
+    verifyJwtCallback: options.callbacks.verifyJwt,
+    errorMessage: "dpop jwt verification failed"
+  });
+  return {
+    header,
+    payload
+  };
+}
+function htuFromRequestUrl(requestUrl) {
+  const htu = new import_utils14.URL(requestUrl);
+  htu.search = "";
+  htu.hash = "";
+  return htu.toString();
+}
+function extractDpopNonceFromHeaders(headers) {
+  return headers.get("DPoP-Nonce");
+}
+function extractDpopJwtFromHeaders(headers) {
+  const dpopJwt = headers.get("DPoP");
+  if (dpopJwt && (typeof dpopJwt !== "string" || dpopJwt.includes(","))) {
+    return { valid: false };
+  }
+  return { valid: true, dpopJwt: dpopJwt ?? void 0 };
+}
+
+// src/dpop/dpop-retry.ts
+async function authorizationServerRequestWithDpopRetry(options) {
+  try {
+    return await options.request(options.dpop);
+  } catch (error) {
+    if (options.dpop && error instanceof Oauth2ClientErrorResponseError) {
+      const dpopRetry = shouldRetryAuthorizationServerRequestWithDPoPNonce({
+        responseHeaders: error.response.headers,
+        errorResponse: error.errorResponse
+      });
+      if (dpopRetry.retry) {
+        return options.request({
+          ...options.dpop,
+          nonce: dpopRetry.dpopNonce
+        });
+      }
+    }
+    throw error;
+  }
+}
+function shouldRetryAuthorizationServerRequestWithDPoPNonce(options) {
+  if (options.errorResponse.error !== "use_dpop_nonce") {
+    return {
+      retry: false
+    };
+  }
+  const dpopNonce = extractDpopNonceFromHeaders(options.responseHeaders);
+  if (!dpopNonce) {
+    throw new Oauth2Error(
+      `Error response error contains error 'use_dpop_nonce' but the response headers do not include a valid 'DPoP-Nonce' header value.`
+    );
+  }
+  return {
+    retry: true,
+    dpopNonce
+  };
+}
+function shouldRetryResourceRequestWithDPoPNonce(options) {
+  const useDpopNonceChallenge = options.resourceUnauthorizedError.wwwAuthenticateHeaders.find(
+    (challenge) => challenge.scheme === "DPoP" /* DPoP */ && challenge.error === "use_dpop_nonce" /* UseDpopNonce */
+  );
+  if (!useDpopNonceChallenge) {
+    return { retry: false };
+  }
+  const dpopNonce = extractDpopNonceFromHeaders(options.responseHeaders);
+  if (!dpopNonce || typeof dpopNonce !== "string") {
+    throw new Oauth2Error(
+      `Resource request error in 'WWW-Authenticate' response header contains error 'use_dpop_nonce' but the response headers do not include a valid 'DPoP-Nonce' value.`
+    );
+  }
+  return {
+    retry: true,
+    dpopNonce
+  };
+}
+
+// src/resource-request/make-resource-request.ts
+async function resourceRequest(options) {
+  const dpopHeaders = options.dpop ? await createDpopHeadersForRequest({
+    request: {
+      url: options.url,
+      // in fetch the default is GET if not provided
+      method: options.requestOptions.method ?? "GET"
+    },
+    signer: options.dpop.signer,
+    callbacks: options.callbacks,
+    nonce: options.dpop.nonce,
+    accessToken: options.accessToken
+  }) : void 0;
+  const fetch = options.callbacks.fetch ?? import_utils15.defaultFetcher;
+  const response = await fetch(options.url, {
+    ...options.requestOptions,
+    headers: {
+      ...options.requestOptions.headers,
+      Authorization: `${dpopHeaders ? "DPoP" : "Bearer"} ${options.accessToken}`,
+      ...dpopHeaders
+    }
+  });
+  const dpopNonce = extractDpopNonceFromHeaders(response.headers);
+  if (response.ok) {
+    return {
+      ok: true,
+      response,
+      dpop: dpopNonce ? {
+        nonce: dpopNonce
+      } : void 0
+    };
+  }
+  const wwwAuthenticateHeader = response.headers.get("WWW-Authenticate");
+  const resourceUnauthorizedError = wwwAuthenticateHeader ? Oauth2ResourceUnauthorizedError.fromHeaderValue(wwwAuthenticateHeader) : void 0;
+  const shouldRetryWithNonce = options.dpop?.retryWithNonce ?? true;
+  const dpopRetry = resourceUnauthorizedError ? shouldRetryResourceRequestWithDPoPNonce({
+    responseHeaders: response.headers,
+    resourceUnauthorizedError
+  }) : void 0;
+  if (shouldRetryWithNonce && dpopRetry?.retry && options.dpop) {
+    return await resourceRequest({
+      ...options,
+      dpop: {
+        ...options.dpop,
+        nonce: dpopRetry.dpopNonce,
+        // We'll never try multiple times (to prevent endless recursion)
+        retryWithNonce: false
+      }
+    });
+  }
+  return {
+    ok: false,
+    response,
+    dpop: dpopNonce ? {
+      nonce: dpopNonce
+    } : void 0,
+    wwwAuthenticate: resourceUnauthorizedError?.wwwAuthenticateHeaders
+  };
+}
+
+// src/resource-request/verify-resource-request.ts
+var import_utils20 = require("@openid4vc/utils");
+
+// src/access-token/introspect-token.ts
+var import_utils17 = require("@openid4vc/utils");
+var import_utils18 = require("@openid4vc/utils");
+var import_utils19 = require("@openid4vc/utils");
+
+// src/access-token/v-token-introspection.ts
+var import_utils16 = require("@openid4vc/utils");
+var v10 = __toESM(require("valibot"));
+var vTokenIntrospectionRequest = v10.looseObject({
+  token: v10.string(),
+  token_type_hint: v10.optional(v10.string())
+});
+var vTokenIntrospectionResponse = v10.looseObject({
+  active: v10.boolean(),
+  scope: v10.optional(v10.string()),
+  client_id: v10.optional(v10.string()),
+  username: v10.optional(v10.string()),
+  token_type: v10.optional(v10.string()),
+  exp: v10.optional(import_utils16.vInteger),
+  iat: v10.optional(import_utils16.vInteger),
+  nbf: v10.optional(import_utils16.vInteger),
+  sub: v10.optional(v10.string()),
+  aud: v10.optional(v10.string()),
+  iss: v10.optional(v10.string()),
+  jti: v10.optional(v10.string()),
+  cnf: v10.optional(vJwtConfirmationPayload)
+});
+
+// src/access-token/introspect-token.ts
+async function introspectToken(options) {
+  const fetchWithValibot = (0, import_utils17.createValibotFetcher)(options.callbacks.fetch);
+  const introspectionRequest = (0, import_utils17.parseWithErrorHandling)(vTokenIntrospectionRequest, {
+    token: options.token,
+    token_type_hint: options.tokenTypeHint,
+    ...options.additionalPayload
+  });
+  const introspectionEndpoint = options.authorizationServerMetadata.introspection_endpoint;
+  if (!introspectionEndpoint) {
+    throw new Oauth2Error(`Missing required 'introspection_endpoint' parameter in authorization server metadata`);
+  }
+  const headers = new import_utils19.Headers({
+    "Content-Type": import_utils17.ContentType.XWwwFormUrlencoded
+  });
+  await options.callbacks.clientAuthentication({
+    url: introspectionEndpoint,
+    method: "POST",
+    authorizationServerMetata: options.authorizationServerMetadata,
+    body: introspectionRequest,
+    contentType: import_utils17.ContentType.XWwwFormUrlencoded,
+    headers
+  });
+  const { result, response } = await fetchWithValibot(
+    vTokenIntrospectionResponse,
+    import_utils17.ContentType.Json,
+    introspectionEndpoint,
+    {
+      body: (0, import_utils17.objectToQueryParams)(introspectionRequest).toString(),
+      method: "POST",
+      headers
+    }
+  );
+  if (!response.ok || !result?.success) {
+    throw new import_utils18.InvalidFetchResponseError(
+      `Unable to introspect token from '${introspectionEndpoint}'. Received response with status ${response.status}`,
+      await response.clone().text(),
+      response
+    );
+  }
+  return result.output;
+}
+
+// src/resource-request/verify-resource-request.ts
+async function verifyResourceRequest(options) {
+  const allowedAuthenticationSchemes = options.allowedAuthenticationSchemes ?? Object.values(SupportedAuthenticationScheme);
+  if (allowedAuthenticationSchemes.length === 0) {
+    throw new Oauth2Error(
+      `Emtpy array provided for 'allowedAuthenticationSchemes', provide at least one allowed authentication scheme, or remove the value to allow all supported authentication schemes`
+    );
+  }
+  const authorizationHeader = options.request.headers.get("Authorization");
+  if (!authorizationHeader) {
+    throw new Oauth2ResourceUnauthorizedError(
+      `No 'Authorization' header provided in request.`,
+      allowedAuthenticationSchemes.map((scheme2) => ({ scheme: scheme2 }))
+    );
+  }
+  const [scheme, accessToken] = authorizationHeader.split(" ", 2);
+  if (!scheme || !accessToken) {
+    throw new Oauth2ResourceUnauthorizedError(
+      `Malformed 'Authorization' header provided in request.`,
+      allowedAuthenticationSchemes.map((scheme2) => ({ scheme: scheme2 }))
+    );
+  }
+  if (!allowedAuthenticationSchemes.includes(scheme) || scheme !== "Bearer" /* Bearer */ && scheme !== "DPoP" /* DPoP */) {
+    throw new Oauth2ResourceUnauthorizedError(
+      `Provided authentication scheme '${scheme}' is not allowed. Allowed authentication schemes are ${allowedAuthenticationSchemes.map((s) => `'${s}'`).join(", ")}.`,
+      allowedAuthenticationSchemes.map((scheme2) => ({ scheme: scheme2 }))
+    );
+  }
+  const verificationResult = await verifyJwtProfileAccessToken({
+    accessToken,
+    callbacks: options.callbacks,
+    authorizationServers: options.authorizationServers,
+    resourceServer: options.resourceServer,
+    now: options.now
+  }).catch((error) => {
+    if (error instanceof Oauth2JwtParseError || error instanceof import_utils20.ValidationError) return null;
+    const errorMessage = error instanceof Oauth2Error ? error.message : "Invalid access token";
+    throw new Oauth2ResourceUnauthorizedError(
+      `Error occured during verification of jwt profile access token: ${error.message}`,
+      {
+        scheme,
+        error: "invalid_token" /* InvalidToken */,
+        error_description: errorMessage
+      }
+    );
+  });
+  let tokenPayload = verificationResult?.payload;
+  let authorizationServer = verificationResult?.authorizationServer;
+  if (!tokenPayload) {
+    for (const authorizationServerMetadata of options.authorizationServers) {
+      try {
+        tokenPayload = await introspectToken({
+          authorizationServerMetadata,
+          callbacks: options.callbacks,
+          token: accessToken,
+          tokenTypeHint: scheme
+        });
+        authorizationServer = authorizationServerMetadata;
+        if (tokenPayload.active) break;
+      } catch (error) {
+      }
+    }
+  }
+  if (!tokenPayload || !authorizationServer) {
+    throw new Oauth2ResourceUnauthorizedError("Could not verify token as jwt or using token introspection.", {
+      scheme,
+      error: "invalid_token" /* InvalidToken */,
+      error_description: "Token is not valid"
+    });
+  }
+  let dpopJwk = void 0;
+  if (scheme === "DPoP" /* DPoP */ || // two alternative methods to determine whether DPoP was used. As the user can
+  // choose to include `Bearer` scheme even if DPoP was used
+  tokenPayload.token_type === "DPoP" /* DPoP */ || tokenPayload.cnf?.jkt) {
+    const dpopJwtResult = extractDpopJwtFromHeaders(options.request.headers);
+    if (!dpopJwtResult.valid) {
+      throw new Oauth2ResourceUnauthorizedError(
+        `Request contains a 'DPoP' header, but the value is not a valid DPoP jwt.`,
+        {
+          scheme,
+          error: "invalid_dpop_proof" /* InvalidDpopProof */,
+          error_description: `Request contains a 'DPoP' header, but the value is not a valid DPoP jwt.`
+        }
+      );
+    }
+    if (!dpopJwtResult.dpopJwt) {
+      throw new Oauth2ResourceUnauthorizedError(`Request is missing required 'DPoP' header.`, {
+        scheme,
+        error: "invalid_dpop_proof" /* InvalidDpopProof */,
+        error_description: `Request is missing required 'DPoP' header.`
+      });
+    }
+    if (!tokenPayload.cnf?.jkt) {
+      throw new Oauth2ResourceUnauthorizedError(
+        `Token payload is missing required 'cnf.jkt' value for DPoP verification.`,
+        {
+          scheme,
+          error: "invalid_token" /* InvalidToken */,
+          error_description: `Token payload is missing required 'cnf.jkt' value for DPoP verification.`
+        }
+      );
+    }
+    try {
+      const decodedDpopJwt = await verifyDpopJwt({
+        callbacks: options.callbacks,
+        dpopJwt: dpopJwtResult.dpopJwt,
+        request: options.request,
+        accessToken,
+        now: options.now,
+        expectedJwkThumbprint: tokenPayload.cnf?.jkt,
+        allowedSigningAlgs: authorizationServer.dpop_signing_alg_values_supported
+      });
+      dpopJwk = decodedDpopJwt.header.jwk;
+    } catch (error) {
+      const errorMessage = error instanceof Oauth2Error ? error.message : "Error verifying DPoP jwt";
+      throw new Oauth2ResourceUnauthorizedError(
+        `Error occured during verification of jwt profile access token: ${error instanceof Error ? error.message : error}`,
+        {
+          scheme,
+          error: "invalid_dpop_proof" /* InvalidDpopProof */,
+          error_description: errorMessage
+        }
+      );
+    }
+  }
+  return {
+    tokenPayload,
+    dpopJwk,
+    scheme,
+    accessToken,
+    authorizationServer: authorizationServer.issuer
+  };
+}
+
+// src/client-authentication.ts
+var import_utils21 = require("@openid4vc/utils");
+var SupportedClientAuthenticationMethod = /* @__PURE__ */ ((SupportedClientAuthenticationMethod2) => {
+  SupportedClientAuthenticationMethod2["ClientSecretBasic"] = "client_secret_basic";
+  SupportedClientAuthenticationMethod2["ClientSecretPost"] = "client_secret_post";
+  return SupportedClientAuthenticationMethod2;
+})(SupportedClientAuthenticationMethod || {});
+function getSupportedClientAuthenticationMethod(authorizationServer, endpointType) {
+  if (endpointType === "introspection" && authorizationServer.introspection_endpoint_auth_methods_supported) {
+    const supportedMethod = authorizationServer.introspection_endpoint_auth_methods_supported.find(
+      (m) => Object.values(SupportedClientAuthenticationMethod).includes(m)
+    );
+    if (!supportedMethod) {
+      throw new Oauth2Error(
+        `Authorization server metadata for issuer '${authorizationServer.issuer}' has 'introspection_endpoint_auth_methods_supported' metadata, but does not contain a supported value. Supported values are '${Object.values(
+          SupportedClientAuthenticationMethod
+        ).join(
+          ", "
+        )}', found values are '${authorizationServer.introspection_endpoint_auth_methods_supported.join(", ")}'`
+      );
+    }
+    return supportedMethod;
+  }
+  if (authorizationServer.token_endpoint_auth_methods_supported) {
+    const supportedMethod = authorizationServer.token_endpoint_auth_methods_supported.find(
+      (m) => Object.values(SupportedClientAuthenticationMethod).includes(m)
+    );
+    if (!supportedMethod) {
+      throw new Oauth2Error(
+        `Authorization server metadata for issuer '${authorizationServer.issuer}' has 'token_endpoint_auth_methods_supported' metadata, but does not contain a supported value. Supported values are '${Object.values(
+          SupportedClientAuthenticationMethod
+        ).join(", ")}', found values are '${authorizationServer.token_endpoint_auth_methods_supported.join(", ")}'`
+      );
+    }
+    return supportedMethod;
+  }
+  return "client_secret_basic" /* ClientSecretBasic */;
+}
+function clientAuthenticationDynamic(options) {
+  return (callbackOptions) => {
+    const { url: url3, authorizationServerMetata } = callbackOptions;
+    const endpointType = url3 === authorizationServerMetata.introspection_endpoint ? "introspection" : "endpoint";
+    const method = getSupportedClientAuthenticationMethod(authorizationServerMetata, endpointType);
+    if (method === "client_secret_basic" /* ClientSecretBasic */) {
+      return clientAuthenticationClientSecretBasic(options)(callbackOptions);
+    }
+    if (method === "client_secret_post" /* ClientSecretPost */) {
+      return clientAuthenticationClientSecretPost(options)(callbackOptions);
+    }
+    throw new Oauth2Error(
+      `Unsupported client auth method ${method}. Supported values are ${Object.values(
+        SupportedClientAuthenticationMethod
+      ).join(", ")}`
+    );
+  };
+}
+function clientAuthenticationClientSecretPost(options) {
+  return ({ body }) => {
+    body.client_id = options.clientId;
+    body.client_secret = options.clientSecret;
+  };
+}
+function clientAuthenticationClientSecretBasic(options) {
+  return ({ headers }) => {
+    const authorization = (0, import_utils21.encodeToBase64Url)((0, import_utils21.decodeUtf8String)(`${options.clientId}:${options.clientSecret}`));
+    headers.set("Authorization", `Basic ${authorization}`);
+  };
+}
+function clientAuthenticationNone() {
+  return () => {
+  };
+}
+
+// src/Oauth2AuthorizationServer.ts
+var import_utils34 = require("@openid4vc/utils");
+
+// src/access-token/create-access-token.ts
+var import_utils22 = require("@openid4vc/utils");
+async function createAccessTokenJwt(options) {
+  const header = (0, import_utils22.parseWithErrorHandling)(vAccessTokenProfileJwtHeader, {
+    ...jwtHeaderFromJwtSigner(options.signer),
+    typ: "at+jwt"
+  });
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const payload = (0, import_utils22.parseWithErrorHandling)(vAccessTokenProfileJwtPayload, {
+    iat: (0, import_utils22.dateToSeconds)(now),
+    exp: (0, import_utils22.dateToSeconds)((0, import_utils22.addSecondsToDate)(now, options.expiresInSeconds)),
+    aud: options.audience,
+    iss: options.authorizationServer,
+    jti: (0, import_utils22.encodeToBase64Url)(await options.callbacks.generateRandom(32)),
+    client_id: options.clientId,
+    sub: options.subject,
+    scope: options.scope,
+    cnf: options.dpopJwk ? {
+      jkt: await calculateJwkThumbprint({
+        hashAlgorithm: "SHA-256" /* Sha256 */,
+        hashCallback: options.callbacks.hash,
+        jwk: options.dpopJwk
+      })
+    } : void 0,
+    ...options.additionalPayload
+  });
+  const { jwt } = await options.callbacks.signJwt(options.signer, {
+    header,
+    payload
+  });
+  return {
+    jwt
+  };
+}
+
+// src/access-token/create-access-token-response.ts
+var import_utils24 = require("@openid4vc/utils");
+
+// src/access-token/v-access-token.ts
+var v12 = __toESM(require("valibot"));
+var import_utils23 = require("@openid4vc/utils");
+
+// src/v-grant-type.ts
+var v11 = __toESM(require("valibot"));
+var vPreAuthorizedCodeGrantIdentifier = v11.literal("urn:ietf:params:oauth:grant-type:pre-authorized_code");
+var preAuthorizedCodeGrantIdentifier = vPreAuthorizedCodeGrantIdentifier.literal;
+var vAuthorizationCodeGrantIdentifier = v11.literal("authorization_code");
+var authorizationCodeGrantIdentifier = vAuthorizationCodeGrantIdentifier.literal;
+var vRefreshTokenGrantIdentifier = v11.literal("refresh_token");
+var refreshTokenGrantIdentifier = vRefreshTokenGrantIdentifier.literal;
+
+// src/access-token/v-access-token.ts
+var vAccessTokenRequest = v12.intersect([
+  v12.looseObject({
+    // Pre authorized code flow
+    "pre-authorized_code": v12.optional(v12.string()),
+    // Authorization code flow
+    code: v12.optional(v12.string()),
+    redirect_uri: v12.optional(v12.pipe(v12.string(), v12.url())),
+    // Refresh token grant
+    refresh_token: v12.optional(v12.string()),
+    resource: v12.optional(import_utils23.vHttpsUrl),
+    code_verifier: v12.optional(v12.string()),
+    grant_type: v12.union([
+      vPreAuthorizedCodeGrantIdentifier,
+      vAuthorizationCodeGrantIdentifier,
+      vRefreshTokenGrantIdentifier,
+      // string makes the previous ones unessary, but it does help with error messages
+      v12.string()
+    ])
+  }),
+  v12.pipe(
+    v12.looseObject({
+      tx_code: v12.optional(v12.string()),
+      // user_pin is from OID4VCI draft 11
+      user_pin: v12.optional(v12.string())
+    }),
+    // Check that user_pin and tx_code are the same if both are provided
+    // and transform user_pin to tx_code if only user_pin is provided
+    v12.check(
+      ({ tx_code, user_pin }) => !tx_code || !user_pin || user_pin === tx_code,
+      `If both 'tx_code' and 'user_pin' are present they must match`
+    ),
+    v12.transform(({ tx_code, user_pin, ...rest }) => {
+      return {
+        ...rest,
+        ...tx_code ?? user_pin ? { tx_code: tx_code ?? user_pin } : {}
+      };
+    })
+  )
+]);
+var vAccessTokenResponse = v12.looseObject({
+  access_token: v12.string(),
+  token_type: v12.string(),
+  expires_in: v12.optional(v12.pipe(v12.number(), v12.integer())),
+  scope: v12.optional(v12.string()),
+  state: v12.optional(v12.string()),
+  refresh_token: v12.optional(v12.string()),
+  // Oid4vci specific parameters
+  c_nonce: v12.optional(v12.string()),
+  c_nonce_expires_in: v12.optional(v12.pipe(v12.number(), v12.integer())),
+  // TODO: add additional params
+  authorization_details: v12.optional(
+    v12.array(
+      v12.looseObject({
+        // requried when type is openid_credential (so we probably need a discriminator)
+        // credential_identifiers: v.array(v.string()),
+      })
+    )
+  )
+});
+var vAccessTokenErrorResponse = vOauth2ErrorResponse;
+
+// src/access-token/create-access-token-response.ts
+async function createAccessTokenResponse(options) {
+  const accessTokenResponse = (0, import_utils24.parseWithErrorHandling)(vAccessTokenResponse, {
+    access_token: options.accessToken,
+    token_type: options.tokenType,
+    expires_in: options.expiresInSeconds,
+    c_nonce: options.cNonce,
+    c_nonce_expires_in: options.cNonceExpiresIn,
+    ...options.additionalPayload
+  });
+  return accessTokenResponse;
+}
+
+// src/access-token/parse-access-token-request.ts
+var import_utils25 = require("@openid4vc/utils");
+var v13 = __toESM(require("valibot"));
+function parseAccessTokenRequest(options) {
+  const parsedAccessTokenRequest = v13.safeParse(vAccessTokenRequest, options.accessTokenRequest);
+  if (!parsedAccessTokenRequest.success) {
+    throw new Oauth2ServerErrorResponseError({
+      error: "invalid_request" /* InvalidRequest */,
+      error_description: `Error occured during validation of authorization request.
+${JSON.stringify((0, import_utils25.valibotRecursiveFlattenIssues)(parsedAccessTokenRequest.issues), null, 2)}`
+    });
+  }
+  const accessTokenRequest = parsedAccessTokenRequest.output;
+  let grant;
+  if (accessTokenRequest.grant_type === preAuthorizedCodeGrantIdentifier) {
+    if (!accessTokenRequest["pre-authorized_code"]) {
+      throw new Oauth2ServerErrorResponseError({
+        error: "invalid_request" /* InvalidRequest */,
+        error_description: `Missing required 'pre-authorized_code' for grant type '${preAuthorizedCodeGrantIdentifier}'`
+      });
+    }
+    grant = {
+      grantType: preAuthorizedCodeGrantIdentifier,
+      preAuthorizedCode: accessTokenRequest["pre-authorized_code"],
+      txCode: accessTokenRequest.tx_code
+    };
+  } else if (accessTokenRequest.grant_type === authorizationCodeGrantIdentifier) {
+    if (!accessTokenRequest.code) {
+      throw new Oauth2ServerErrorResponseError({
+        error: "invalid_request" /* InvalidRequest */,
+        error_description: `Missing required 'code' for grant type '${authorizationCodeGrantIdentifier}'`
+      });
+    }
+    grant = {
+      grantType: authorizationCodeGrantIdentifier,
+      code: accessTokenRequest.code
+    };
+  } else {
+    throw new Oauth2ServerErrorResponseError({
+      error: "unsupported_grant_type" /* UnsupportedGrantType */,
+      error_description: `The grant type '${accessTokenRequest.grant_type}' is not supported`
+    });
+  }
+  const extractedDpopJwt = extractDpopJwtFromHeaders(options.request.headers);
+  if (!extractedDpopJwt.valid) {
+    throw new Oauth2ServerErrorResponseError({
+      error: "invalid_dpop_proof" /* InvalidDpopProof */,
+      error_description: `Request contains a 'DPoP' header, but the value is not a valid DPoP jwt`
+    });
+  }
+  const pkceCodeVerifier = accessTokenRequest.code_verifier;
+  return {
+    accessTokenRequest,
+    grant,
+    dpopJwt: extractedDpopJwt.dpopJwt,
+    pkceCodeVerifier
+  };
+}
+
+// src/pkce.ts
+var import_utils26 = require("@openid4vc/utils");
+var PkceCodeChallengeMethod = /* @__PURE__ */ ((PkceCodeChallengeMethod2) => {
+  PkceCodeChallengeMethod2["Plain"] = "plain";
+  PkceCodeChallengeMethod2["S256"] = "S256";
+  return PkceCodeChallengeMethod2;
+})(PkceCodeChallengeMethod || {});
+async function createPkce(options) {
+  const allowedCodeChallengeMethods = options.allowedCodeChallengeMethods ?? [
+    "S256" /* S256 */,
+    "plain" /* Plain */
+  ];
+  if (allowedCodeChallengeMethods.length === 0) {
+    throw new Oauth2Error(`Unable to create PKCE code verifier. 'allowedCodeChallengeMethods' is an empty array.`);
+  }
+  const codeChallengeMethod = allowedCodeChallengeMethods.includes("S256" /* S256 */) ? "S256" /* S256 */ : "plain" /* Plain */;
+  const codeVerifier = options.codeVerifier ?? (0, import_utils26.encodeToBase64Url)(await options.callbacks.generateRandom(64));
+  return {
+    codeVerifier,
+    codeChallenge: await calculateCodeChallenge({
+      codeChallengeMethod,
+      codeVerifier,
+      hashCallback: options.callbacks.hash
+    }),
+    codeChallengeMethod
+  };
+}
+async function verifyPkce(options) {
+  const calculatedCodeChallenge = await calculateCodeChallenge({
+    codeChallengeMethod: options.codeChallengeMethod,
+    codeVerifier: options.codeVerifier,
+    hashCallback: options.callbacks.hash
+  });
+  if (options.codeChallenge !== calculatedCodeChallenge) {
+    throw new Oauth2Error(
+      `Derived code challenge '${calculatedCodeChallenge}' from code_verifier '${options.codeVerifier}' using code challenge method '${options.codeChallengeMethod}' does not match the expected code challenge.`
+    );
+  }
+}
+async function calculateCodeChallenge(options) {
+  if (options.codeChallengeMethod === "plain" /* Plain */) {
+    return options.codeVerifier;
+  }
+  if (options.codeChallengeMethod === "S256" /* S256 */) {
+    return (0, import_utils26.encodeToBase64Url)(await options.hashCallback((0, import_utils26.decodeUtf8String)(options.codeVerifier), "SHA-256" /* Sha256 */));
+  }
+  throw new Oauth2Error(`Unsupported code challenge method ${options.codeChallengeMethod}`);
+}
+
+// src/access-token/verify-access-token-request.ts
+async function verifyPreAuthorizedCodeAccessTokenRequest(options) {
+  if (options.grant.preAuthorizedCode !== options.expectedPreAuthorizedCode) {
+    throw new Oauth2ServerErrorResponseError({
+      error: "invalid_grant" /* InvalidGrant */,
+      error_description: `Invalid 'pre-authorized_code' provided`
+    });
+  }
+  if (options.grant.txCode !== options.expectedTxCode) {
+    if (!options.expectedTxCode) {
+      throw new Oauth2ServerErrorResponseError({
+        error: "invalid_request" /* InvalidRequest */,
+        error_description: `Request contains 'tx_code' that was not expected`
+      });
+    }
+    if (!options.grant.txCode) {
+      throw new Oauth2ServerErrorResponseError({
+        error: "invalid_request" /* InvalidRequest */,
+        error_description: `Missing required 'tx_code' in request`
+      });
+    }
+    throw new Oauth2ServerErrorResponseError({
+      error: "invalid_grant" /* InvalidGrant */,
+      error_description: `Invalid 'tx_code' provided`
+    });
+  }
+  if (options.preAuthorizedCodeExpiresAt) {
+    const now = options.now ?? /* @__PURE__ */ new Date();
+    if (now.getTime() > options.preAuthorizedCodeExpiresAt.getTime()) {
+      throw new Oauth2ServerErrorResponseError(
+        {
+          error: "invalid_grant" /* InvalidGrant */,
+          error_description: `Expired 'pre-authorized_code' provided`
+        },
+        {
+          internalMessage: `The provided 'pre-authorized_code' in the request expired at '${options.preAuthorizedCodeExpiresAt.getTime()}', now is '${now.getTime()}'`
+        }
+      );
+    }
+  }
+  if (options.pkce) {
+    await verifyAccessTokenRequestPkce(options.pkce, options.callbacks);
+  }
+  const dpopResult = options.dpop ? await verifyAccessTokenRequestDpop(options.dpop, options.request, options.callbacks) : null;
+  return { dpopJwk: dpopResult?.dpopJwk };
+}
+async function verifyAuthorizationCodeAccessTokenRequest(options) {
+  if (options.grant.code !== options.expectedCode) {
+    throw new Oauth2ServerErrorResponseError({
+      error: "invalid_grant" /* InvalidGrant */,
+      error_description: `Invalid 'code' provided`
+    });
+  }
+  if (options.codeExpiresAt) {
+    const now = options.now ?? /* @__PURE__ */ new Date();
+    if (now.getTime() > options.codeExpiresAt.getTime()) {
+      throw new Oauth2ServerErrorResponseError(
+        {
+          error: "invalid_grant" /* InvalidGrant */,
+          error_description: `Expired 'code' provided`
+        },
+        {
+          internalMessage: `The provided 'code' in the request expired at '${options.codeExpiresAt.getTime()}', now is '${now.getTime()}'`
+        }
+      );
+    }
+  }
+  if (options.pkce) {
+    await verifyAccessTokenRequestPkce(options.pkce, options.callbacks);
+  }
+  const dpopResult = options.dpop ? await verifyAccessTokenRequestDpop(options.dpop, options.request, options.callbacks) : null;
+  return { dpopJwk: dpopResult?.dpopJwk };
+}
+async function verifyAccessTokenRequestDpop(options, request, callbacks) {
+  if (options.required && !options.jwt) {
+    throw new Oauth2ServerErrorResponseError({
+      error: "invalid_dpop_proof" /* InvalidDpopProof */,
+      error_description: "Missing required DPoP proof"
+    });
+  }
+  if (!options.jwt) return null;
+  try {
+    const { header } = await verifyDpopJwt({
+      callbacks,
+      dpopJwt: options.jwt,
+      request,
+      allowedSigningAlgs: options.allowedSigningAlgs
+    });
+    return {
+      dpopJwk: header.jwk
+    };
+  } catch (error) {
+    if (error instanceof Oauth2Error) {
+      throw new Oauth2ServerErrorResponseError({
+        error: "invalid_dpop_proof" /* InvalidDpopProof */,
+        error_description: error.message
+      });
+    }
+    throw error;
+  }
+}
+async function verifyAccessTokenRequestPkce(options, callbacks) {
+  if (options.codeChallenge && !options.codeVerifier) {
+    throw new Oauth2ServerErrorResponseError({
+      error: "invalid_request" /* InvalidRequest */,
+      error_description: `Missing required 'code_verifier' in access token request`
+    });
+  }
+  if (!options.codeVerifier) return null;
+  try {
+    await verifyPkce({
+      callbacks,
+      codeChallenge: options.codeChallenge,
+      codeChallengeMethod: options.codeChallengeMethod,
+      codeVerifier: options.codeVerifier
+    });
+  } catch (error) {
+    if (error instanceof Oauth2Error) {
+      throw new Oauth2ServerErrorResponseError({
+        error: "invalid_grant" /* InvalidGrant */,
+        error_description: error.message
+      });
+    }
+    throw error;
+  }
+}
+
+// src/authorization-challenge/create-authorization-challenge-response.ts
+var import_utils29 = require("@openid4vc/utils");
+
+// src/authorization-challenge/v-authorization-challenge.ts
+var import_utils28 = require("@openid4vc/utils");
+var v15 = __toESM(require("valibot"));
+
+// src/authorization-request/v-authorization-request.ts
+var import_utils27 = require("@openid4vc/utils");
+var v14 = __toESM(require("valibot"));
+var vAuthorizationRequest = v14.looseObject({
+  response_type: v14.string(),
+  client_id: v14.string(),
+  issuer_state: v14.optional(v14.string()),
+  redirect_uri: v14.optional(v14.pipe(v14.string(), v14.url())),
+  resource: v14.optional(import_utils27.vHttpsUrl),
+  scope: v14.optional(v14.string()),
+  // DPoP jwk thumbprint
+  dpop_jkt: v14.optional(v14.string()),
+  code_challenge: v14.optional(v14.string()),
+  code_challenge_method: v14.optional(v14.string())
+});
+var vPushedAuthorizationRequest = v14.looseObject({
+  request_uri: v14.string(),
+  client_id: v14.string()
+});
+var vPushedAuthorizationResponse = v14.looseObject({
+  request_uri: v14.string(),
+  expires_in: v14.pipe(v14.number(), v14.integer())
+});
+
+// src/authorization-challenge/v-authorization-challenge.ts
+var vAuthorizationChallengeRequest = v15.looseObject({
+  // authorization challenge request can include same parameters as an authorization request
+  // except for response_type (always `code`), and `client_id` is optional (becase
+  // it's possible to do client authentication using different methods)
+  ...v15.omit(vAuthorizationRequest, ["response_type", "client_id"]).entries,
+  client_id: v15.optional(vAuthorizationRequest.entries.client_id),
+  auth_session: v15.optional(v15.string()),
+  // DRAFT presentation during issuance
+  presentation_during_issuance_session: v15.optional(v15.string())
+});
+var vAuthorizationChallengeResponse = v15.looseObject({
+  authorization_code: v15.string()
+});
+var vAuthorizationChallengeErrorResponse = v15.looseObject({
+  ...vOauth2ErrorResponse.entries,
+  auth_session: v15.optional(v15.string()),
+  request_uri: v15.optional(v15.string()),
+  expires_in: v15.optional(import_utils28.vInteger),
+  // DRAFT: presentation during issuance
+  presentation: v15.optional(v15.string())
+});
+
+// src/authorization-challenge/create-authorization-challenge-response.ts
+function createAuthorizationChallengeResponse(options) {
+  const authorizationChallengeResponse = (0, import_utils29.parseWithErrorHandling)(vAuthorizationChallengeResponse, {
+    ...options.additionalPayload,
+    authorization_code: options.authorizationCode
+  });
+  return { authorizationChallengeResponse };
+}
+function createAuthorizationChallengeErrorResponse(options) {
+  const authorizationChallengeErrorResponse = (0, import_utils29.parseWithErrorHandling)(vAuthorizationChallengeErrorResponse, {
+    ...options.additionalPayload,
+    // General FiPA
+    error: options.error,
+    error_description: options.errorDescription,
+    auth_session: options.authSession,
+    // Presentation during issuance
+    presentation: options.presentation,
+    // PAR
+    request_uri: options.requestUri,
+    expires_in: options.expiresIn
+  });
+  return authorizationChallengeErrorResponse;
+}
+
+// src/authorization-challenge/parse-authorization-challenge-request.ts
+var import_utils30 = require("@openid4vc/utils");
+function parseAuthorizationChallengeRequest(options) {
+  const authorizationChallengeRequest = (0, import_utils30.parseWithErrorHandling)(
+    vAuthorizationChallengeRequest,
+    options.authorizationChallengeRequest
+  );
+  return { authorizationChallengeRequest };
+}
+
+// src/client-attestation/clent-attestation.ts
+var import_utils32 = require("@openid4vc/utils");
+
+// src/client-attestation/v-client-attestation.ts
+var v16 = __toESM(require("valibot"));
+var import_utils31 = require("@openid4vc/utils");
+var vOauthClientAttestationHeader = v16.literal("OAuth-Client-Attestation");
+var oauthClientAttestationHeader = vOauthClientAttestationHeader.literal;
+var vClientAttestationJwtPayload = v16.looseObject({
+  ...vJwtPayload.entries,
+  iss: v16.string(),
+  sub: v16.string(),
+  exp: import_utils31.vInteger,
+  cnf: v16.looseObject({
+    jwk: vJwk,
+    key_type: v16.optional(
+      v16.union([
+        v16.picklist(["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]),
+        v16.string()
+      ])
+    ),
+    user_authentication: v16.optional(
+      v16.union([
+        v16.picklist(["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]),
+        v16.string()
+      ])
+    )
+  }),
+  aal: v16.optional(v16.string())
+});
+var vClientAttestationJwtHeader = v16.looseObject({
+  ...vJwtHeader.entries,
+  typ: v16.literal("oauth-client-attestation+jwt")
+});
+var vOauthClientAttestationPopHeader = v16.literal("OAuth-Client-Attestation-PoP");
+var oauthClientAttestationPopHeader = vOauthClientAttestationPopHeader.literal;
+var vClientAttestationPopJwtPayload = v16.looseObject({
+  ...vJwtPayload.entries,
+  iss: v16.string(),
+  exp: import_utils31.vInteger,
+  aud: import_utils31.vHttpsUrl,
+  jti: v16.string(),
+  nonce: v16.optional(v16.string())
+});
+var vClientAttestationPopJwtHeader = v16.looseObject({
+  ...vJwtHeader.entries,
+  typ: v16.literal("oauth-client-attestation-pop+jwt")
+});
+
+// src/client-attestation/clent-attestation.ts
+async function verifyClientAttestationJwt(options) {
+  const { header, payload } = decodeJwt({
+    jwt: options.clientAttestationJwt,
+    headerSchema: vClientAttestationJwtHeader,
+    payloadSchema: vClientAttestationJwtPayload
+  });
+  const { signer } = await verifyJwt({
+    signer: jwtSignerFromJwt({ header, payload }),
+    now: options.now,
+    header,
+    payload,
+    compact: options.clientAttestationJwt,
+    verifyJwtCallback: options.callbacks.verifyJwt,
+    errorMessage: "client attestation jwt verification failed"
+  });
+  return {
+    header,
+    payload,
+    signer
+  };
+}
+async function createClientAttestationJwt(options) {
+  const header = (0, import_utils32.parseWithErrorHandling)(vClientAttestationJwtHeader, {
+    typ: "oauth-client-attestation+jwt",
+    ...jwtHeaderFromJwtSigner(options.signer)
+  });
+  const payload = (0, import_utils32.parseWithErrorHandling)(vClientAttestationJwtPayload, {
+    iss: options.issuer,
+    iat: (0, import_utils32.dateToSeconds)(options.issuedAt),
+    exp: (0, import_utils32.dateToSeconds)(options.expiresAt),
+    sub: options.clientId,
+    cnf: options.confirmation,
+    ...options.additionalPayload
+  });
+  const { jwt } = await options.callbacks.signJwt(options.signer, {
+    header,
+    payload
+  });
+  return jwt;
+}
+function extractClientAttestationJwtsFromHeaders(headers) {
+  const clientAttestationHeader = headers.get(oauthClientAttestationHeader);
+  const clientAttestationPopHeader = headers.get(oauthClientAttestationPopHeader);
+  if (!clientAttestationHeader || clientAttestationHeader.includes(",")) {
+    throw new Oauth2Error(`Missing or invalid '${oauthClientAttestationHeader}' header.`);
+  }
+  if (!clientAttestationPopHeader || clientAttestationPopHeader.includes(",")) {
+    throw new Oauth2Error(`Missing or invalid '${oauthClientAttestationPopHeader}' header.`);
+  }
+  return {
+    clientAttestationPopHeader,
+    clientAttestationHeader
+  };
+}
+
+// src/client-attestation/client-attestation-pop.ts
+var import_utils33 = require("@openid4vc/utils");
+async function createClientAttestationForRequest(options) {
+  const clientAttestationPopJwt = await createClientAttestationPopJwt({
+    authorizationServer: options.authorizationServer,
+    clientAttestation: options.clientAttestation.jwt,
+    callbacks: options.callbacks,
+    expiresAt: options.clientAttestation.expiresAt,
+    signer: options.clientAttestation.signer,
+    nonce: options.clientAttestation.nonce
+  });
+  return {
+    headers: {
+      [oauthClientAttestationHeader]: options.clientAttestation.jwt,
+      [oauthClientAttestationPopHeader]: clientAttestationPopJwt
+    },
+    body: options.clientAttestation.includeLegacyDraft2ClientAssertion ? {
+      client_assertion: `${options.clientAttestation.jwt}~${clientAttestationPopJwt}`,
+      client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-client-attestation"
+    } : void 0
+  };
+}
+async function verifyClientAttestationPopJwt(options) {
+  const { header, payload } = decodeJwt({
+    jwt: options.clientAttestationPopJwt,
+    headerSchema: vClientAttestationPopJwtHeader,
+    payloadSchema: vClientAttestationPopJwtPayload
+  });
+  if (payload.iss !== options.clientAttestation.payload.sub) {
+    throw new Oauth2Error(
+      `Client Attestation Pop jwt contains 'iss' (client_id) value '${payload.iss}', but expected 'sub' value from client attestation '${options.clientAttestation.payload.sub}'`
+    );
+  }
+  if (payload.aud !== options.authorizationServer) {
+    throw new Oauth2Error(
+      `Client Attestation Pop jwt contains 'aud' value '${payload.aud}', but expected authorization server identifier '${options.authorizationServer}'`
+    );
+  }
+  const { signer } = await verifyJwt({
+    signer: {
+      alg: header.alg,
+      method: "jwk",
+      publicJwk: options.clientAttestation.payload.cnf.jwk
+    },
+    now: options.now,
+    header,
+    expectedNonce: options.expectedNonce,
+    payload,
+    compact: options.clientAttestationPopJwt,
+    verifyJwtCallback: options.callbacks.verifyJwt,
+    errorMessage: "client attestation pop jwt verification failed"
+  });
+  return {
+    header,
+    payload,
+    signer
+  };
+}
+async function createClientAttestationPopJwt(options) {
+  const header = (0, import_utils33.parseWithErrorHandling)(vClientAttestationPopJwtHeader, {
+    typ: "oauth-client-attestation-pop+jwt",
+    alg: options.signer.alg
+  });
+  const clientAttestation = decodeJwt({
+    jwt: options.clientAttestation,
+    headerSchema: vClientAttestationJwtHeader,
+    payloadSchema: vClientAttestationJwtPayload
+  });
+  const expiresAt = options.expiresAt ?? (0, import_utils33.addSecondsToDate)(options.issuedAt ?? /* @__PURE__ */ new Date(), 1 * 60);
+  const payload = (0, import_utils33.parseWithErrorHandling)(vClientAttestationPopJwtPayload, {
+    aud: options.authorizationServer,
+    iss: clientAttestation.payload.sub,
+    iat: (0, import_utils33.dateToSeconds)(options.issuedAt),
+    exp: (0, import_utils33.dateToSeconds)(expiresAt),
+    jti: (0, import_utils33.encodeToBase64Url)(await options.callbacks.generateRandom(32)),
+    nonce: options.nonce,
+    ...options.additionalPayload
+  });
+  const { jwt } = await options.callbacks.signJwt(options.signer, {
+    header,
+    payload
+  });
+  return jwt;
+}
+
+// src/Oauth2AuthorizationServer.ts
+var Oauth2AuthorizationServer = class {
+  constructor(options) {
+    this.options = options;
+  }
+  createAuthorizationServerMetadata(authorizationServerMetadata) {
+    return (0, import_utils34.parseWithErrorHandling)(
+      vAuthorizationServerMetadata,
+      authorizationServerMetadata,
+      "Error validating authorization server metadata"
+    );
+  }
+  /**
+   * Parse access token request and extract the grant specific properties.
+   *
+   * If something goes wrong, such as the grant is not supported, missing parameters, etc,
+   * it will throw `Oauth2ServerErrorResponseError` containing an error response object
+   * that can be returned to the client.
+   */
+  parseAccessTokenRequest(options) {
+    return parseAccessTokenRequest(options);
+  }
+  verifyPreAuthorizedCodeAccessTokenRequest(options) {
+    return verifyPreAuthorizedCodeAccessTokenRequest({
+      ...options,
+      callbacks: this.options.callbacks
+    });
+  }
+  verifyAuthorizationCodeAccessTokenRequest(options) {
+    return verifyAuthorizationCodeAccessTokenRequest({
+      ...options,
+      callbacks: this.options.callbacks
+    });
+  }
+  /**
+   * Create an access token response.
+   *
+   * The `sub` claim can be used to identify the resource owner is subsequent requests.
+   * For pre-auth flow this can be the pre-authorized_code but there are no requirements
+   * on the value.
+   */
+  async createAccessTokenResponse(options) {
+    const { jwt: accessToken } = await createAccessTokenJwt({
+      audience: options.audience,
+      authorizationServer: options.authorizationServer,
+      callbacks: this.options.callbacks,
+      expiresInSeconds: options.expiresInSeconds,
+      subject: options.subject,
+      scope: options.scope,
+      clientId: options.clientId,
+      signer: options.signer,
+      dpopJwk: options.dpopJwk,
+      now: options.now,
+      additionalPayload: options.additionalAccessTokenPayload
+    });
+    return createAccessTokenResponse({
+      accessToken,
+      callbacks: this.options.callbacks,
+      expiresInSeconds: options.expiresInSeconds,
+      tokenType: options.dpopJwk ? "DPoP" : "Bearer",
+      cNonce: options.cNonce,
+      cNonceExpiresIn: options.cNonceExpiresIn,
+      additionalPayload: options.additionalAccessTokenResponsePayload
+    });
+  }
+  /**
+   * Parse an authorization challenge request
+   */
+  parseAuthorizationChallengeRequest(options) {
+    return parseAuthorizationChallengeRequest(options);
+  }
+  createAuthorizationChallengeResponse(options) {
+    return createAuthorizationChallengeResponse(options);
+  }
+  /**
+   * Create an authorization challenge error response indicating presentation of credenitals
+   * using OpenID4VP is required before authorization can be granted.
+   *
+   * The `presentation` parameter should be an OpenID4VP authorization request url.
+   * The `authSession` should be used to track the session
+   */
+  createAuthorizationChallengePresentationErrorResponse(options) {
+    return createAuthorizationChallengeErrorResponse({
+      error: "insufficient_authorization" /* InsufficientAuthorization */,
+      errorDescription: options.errorDescription,
+      additionalPayload: options.additionalPayload,
+      authSession: options.authSession,
+      presentation: options.presentation
+    });
+  }
+  createAuthorizationChallengeErrorResponse(options) {
+    return createAuthorizationChallengeErrorResponse(options);
+  }
+  async verifyClientAttestation({
+    authorizationServer,
+    headers
+  }) {
+    const { clientAttestationHeader, clientAttestationPopHeader } = extractClientAttestationJwtsFromHeaders(headers);
+    const clientAttestation = await verifyClientAttestationJwt({
+      callbacks: this.options.callbacks,
+      clientAttestationJwt: clientAttestationHeader
+    });
+    const clientAttestationPop = await verifyClientAttestationPopJwt({
+      callbacks: this.options.callbacks,
+      authorizationServer,
+      clientAttestation,
+      clientAttestationPopJwt: clientAttestationPopHeader
+    });
+    return {
+      clientAttestation,
+      clientAttestationPop
+    };
+  }
+};
+
+// src/Oauth2ResourceServer.ts
+var Oauth2ResourceServer = class {
+  constructor(options) {
+    this.options = options;
+  }
+  async verifyResourceRequest(options) {
+    return verifyResourceRequest({
+      callbacks: this.options.callbacks,
+      ...options
+    });
+  }
+};
+
+// src/Oauth2Client.ts
+var import_utils41 = require("@openid4vc/utils");
+
+// src/access-token/retrieve-access-token.ts
+var import_utils35 = require("@openid4vc/utils");
+var import_utils36 = require("@openid4vc/utils");
+var v17 = __toESM(require("valibot"));
+async function retrievePreAuthorizedCodeAccessToken(options) {
+  const request = {
+    grant_type: preAuthorizedCodeGrantIdentifier,
+    "pre-authorized_code": options.preAuthorizedCode,
+    tx_code: options.txCode,
+    resource: options.resource,
+    ...options.additionalRequestPayload
+  };
+  return retrieveAccessToken({
+    authorizationServerMetadata: options.authorizationServerMetadata,
+    request,
+    dpop: options.dpop,
+    callbacks: options.callbacks,
+    resource: options.resource,
+    clientAttestation: options.clientAttestation
+  });
+}
+async function retrieveAuthorizationCodeAccessToken(options) {
+  const request = {
+    grant_type: authorizationCodeGrantIdentifier,
+    code: options.authorizationCode,
+    code_verifier: options.pkceCodeVerifier,
+    redirect_uri: options.redirectUri,
+    resource: options.resource,
+    ...options.additionalRequestPayload
+  };
+  return retrieveAccessToken({
+    authorizationServerMetadata: options.authorizationServerMetadata,
+    request,
+    dpop: options.dpop,
+    resource: options.resource,
+    callbacks: options.callbacks,
+    clientAttestation: options.clientAttestation
+  });
+}
+async function retrieveRefreshTokenAccessToken(options) {
+  const request = {
+    grant_type: refreshTokenGrantIdentifier,
+    refresh_token: options.refreshToken,
+    resource: options.resource,
+    ...options.additionalRequestPayload
+  };
+  return retrieveAccessToken({
+    authorizationServerMetadata: options.authorizationServerMetadata,
+    request,
+    dpop: options.dpop,
+    callbacks: options.callbacks,
+    resource: options.resource,
+    clientAttestation: options.clientAttestation
+  });
+}
+async function retrieveAccessToken(options) {
+  const fetchWithValibot = (0, import_utils35.createValibotFetcher)(options.callbacks.fetch);
+  const accessTokenRequest = (0, import_utils35.parseWithErrorHandling)(
+    vAccessTokenRequest,
+    options.request,
+    "Error validating access token request"
+  );
+  if (accessTokenRequest.tx_code) {
+    accessTokenRequest.user_pin = accessTokenRequest.tx_code;
+  }
+  const clientAttestation = options.clientAttestation ? await createClientAttestationForRequest({
+    authorizationServer: options.authorizationServerMetadata.issuer,
+    clientAttestation: options.clientAttestation,
+    callbacks: options.callbacks
+  }) : void 0;
+  return await authorizationServerRequestWithDpopRetry({
+    dpop: options.dpop,
+    request: async (dpop) => {
+      const dpopHeaders = dpop ? await createDpopHeadersForRequest({
+        request: {
+          method: "POST",
+          url: options.authorizationServerMetadata.token_endpoint
+        },
+        signer: dpop.signer,
+        callbacks: options.callbacks,
+        nonce: dpop.nonce
+      }) : void 0;
+      const requestQueryParams = (0, import_utils35.objectToQueryParams)({
+        ...accessTokenRequest,
+        ...clientAttestation?.body
+      });
+      const { response, result } = await fetchWithValibot(
+        vAccessTokenResponse,
+        import_utils35.ContentType.Json,
+        options.authorizationServerMetadata.token_endpoint,
+        {
+          body: requestQueryParams.toString(),
+          method: "POST",
+          headers: {
+            "Content-Type": import_utils35.ContentType.XWwwFormUrlencoded,
+            ...clientAttestation?.headers,
+            ...dpopHeaders
+          }
+        }
+      );
+      if (!response.ok || !result) {
+        const tokenErrorResponse = v17.safeParse(
+          vAccessTokenErrorResponse,
+          await response.clone().json().catch(() => null)
+        );
+        if (tokenErrorResponse.success) {
+          throw new Oauth2ClientErrorResponseError(
+            `Unable to retrieve access token from '${options.authorizationServerMetadata.token_endpoint}'. Received token error response with status ${response.status}`,
+            tokenErrorResponse.output,
+            response
+          );
+        }
+        throw new import_utils36.InvalidFetchResponseError(
+          `Unable to retrieve access token from '${options.authorizationServerMetadata.token_endpoint}'. Received response with status ${response.status}`,
+          await response.clone().text(),
+          response
+        );
+      }
+      if (!result.success) {
+        throw new ValidationError("Error validating access token response", result.issues);
+      }
+      const dpopNonce = extractDpopNonceFromHeaders(response.headers) ?? void 0;
+      return {
+        dpop: dpop ? {
+          ...dpop,
+          nonce: dpopNonce
+        } : void 0,
+        accessTokenResponse: result.output
+      };
+    }
+  });
+}
+
+// src/authorization-challenge/send-authorization-challenge.ts
+var import_utils37 = require("@openid4vc/utils");
+var import_utils38 = require("@openid4vc/utils");
+var v18 = __toESM(require("valibot"));
+async function sendAuthorizationChallengeRequest(options) {
+  const fetchWithValibot = (0, import_utils37.createValibotFetcher)(options.callbacks.fetch);
+  const authorizationServerMetadata = options.authorizationServerMetadata;
+  const authorizationChallengeEndpoint = authorizationServerMetadata.authorization_challenge_endpoint;
+  if (!authorizationChallengeEndpoint) {
+    throw new Oauth2Error(
+      `Unable to send authorization challange. Authorization server '${authorizationServerMetadata.issuer}' has no 'authorization_challenge_endpoint'`
+    );
+  }
+  const pkce = authorizationServerMetadata.code_challenge_methods_supported && !options.authSession ? await createPkce({
+    allowedCodeChallengeMethods: authorizationServerMetadata.code_challenge_methods_supported,
+    callbacks: options.callbacks,
+    codeVerifier: options.pkceCodeVerifier
+  }) : void 0;
+  const clientAttestation = options.clientAttestation ? await createClientAttestationForRequest({
+    authorizationServer: options.authorizationServerMetadata.issuer,
+    clientAttestation: options.clientAttestation,
+    callbacks: options.callbacks
+  }) : void 0;
+  const authorizationChallengeRequest = (0, import_utils37.parseWithErrorHandling)(vAuthorizationChallengeRequest, {
+    ...options.additionalRequestPayload,
+    auth_session: options.authSession,
+    client_id: options.clientId,
+    scope: options.scope,
+    resource: options.resource,
+    code_challenge: pkce?.codeChallenge,
+    code_challenge_method: pkce?.codeChallengeMethod,
+    presentation_during_issuance_session: options.presentationDuringIssuanceSession,
+    ...clientAttestation?.body
+  });
+  return authorizationServerRequestWithDpopRetry({
+    dpop: options.dpop,
+    request: async (dpop) => {
+      const dpopHeaders = dpop ? await createDpopHeadersForRequest({
+        request: {
+          method: "POST",
+          url: authorizationChallengeEndpoint
+        },
+        signer: dpop.signer,
+        callbacks: options.callbacks,
+        nonce: dpop.nonce
+      }) : void 0;
+      const { response, result } = await fetchWithValibot(
+        vAuthorizationChallengeResponse,
+        import_utils37.ContentType.Json,
+        authorizationChallengeEndpoint,
+        {
+          method: "POST",
+          body: (0, import_utils37.objectToQueryParams)(authorizationChallengeRequest).toString(),
+          headers: {
+            ...clientAttestation?.headers,
+            ...dpopHeaders,
+            "Content-Type": import_utils37.ContentType.XWwwFormUrlencoded
+          }
+        }
+      );
+      if (!response.ok || !result) {
+        const authorizationChallengeErrorResponse = v18.safeParse(
+          vAuthorizationChallengeErrorResponse,
+          await response.clone().json().catch(() => null)
+        );
+        if (authorizationChallengeErrorResponse.success) {
+          throw new Oauth2ClientAuthorizationChallengeError(
+            `Error requesting authorization code from authorization challenge endpoint '${authorizationServerMetadata.authorization_challenge_endpoint}'. Received response with status ${response.status}`,
+            authorizationChallengeErrorResponse.output,
+            response
+          );
+        }
+        throw new import_utils38.InvalidFetchResponseError(
+          `Error requesting authorization code from authorization challenge endpoint '${authorizationServerMetadata.authorization_challenge_endpoint}'. Received response with status ${response.status}`,
+          await response.clone().text(),
+          response
+        );
+      }
+      if (!result.success) {
+        throw new import_utils37.ValidationError("Error validating authorization challenge response", result.issues);
+      }
+      const dpopNonce = extractDpopNonceFromHeaders(response.headers) ?? void 0;
+      return {
+        pkce,
+        dpop: dpop ? {
+          ...dpop,
+          nonce: dpopNonce
+        } : void 0,
+        authorizationChallengeResponse: result.output
+      };
+    }
+  });
+}
+
+// src/authorization-request/create-authorization-request.ts
+var import_utils39 = require("@openid4vc/utils");
+var import_utils40 = require("@openid4vc/utils");
+var v19 = __toESM(require("valibot"));
+async function createAuthorizationRequestUrl(options) {
+  const authorizationServerMetadata = options.authorizationServerMetadata;
+  const pushedAuthorizationRequestEndpoint = authorizationServerMetadata.pushed_authorization_request_endpoint;
+  if (!authorizationServerMetadata.authorization_endpoint) {
+    throw new Oauth2Error(
+      `Unable to create authorization request url. Authorization server '${authorizationServerMetadata.issuer}' has no 'authorization_endpoint'`
+    );
+  }
+  const pkce = authorizationServerMetadata.code_challenge_methods_supported ? await createPkce({
+    allowedCodeChallengeMethods: authorizationServerMetadata.code_challenge_methods_supported,
+    callbacks: options.callbacks,
+    codeVerifier: options.pkceCodeVerifier
+  }) : void 0;
+  const authorizationRequest = {
+    ...options.additionalRequestPayload,
+    response_type: "code",
+    client_id: options.clientId,
+    redirect_uri: options.redirectUri,
+    resource: options.resource,
+    scope: options.scope,
+    code_challenge: pkce?.codeChallenge,
+    code_challenge_method: pkce?.codeChallengeMethod
+  };
+  let pushedAuthorizationRequest = void 0;
+  let dpop = options.dpop;
+  if (authorizationServerMetadata.require_pushed_authorization_requests || pushedAuthorizationRequestEndpoint) {
+    if (!pushedAuthorizationRequestEndpoint) {
+      throw new Oauth2Error(
+        `Authorization server '${authorizationServerMetadata.issuer}' indicated that pushed authorization requests are required, but the 'pushed_authorization_request_endpoint' is missing in the authorization server metadata.`
+      );
+    }
+    const clientAttestation = options.clientAttestation ? await createClientAttestationForRequest({
+      authorizationServer: options.authorizationServerMetadata.issuer,
+      clientAttestation: options.clientAttestation,
+      callbacks: options.callbacks
+    }) : void 0;
+    const { pushedAuthorizationResponse, dpopNonce } = await authorizationServerRequestWithDpopRetry({
+      dpop: options.dpop,
+      request: async (dpop2) => {
+        const dpopHeaders = dpop2 ? await createDpopHeadersForRequest({
+          request: {
+            method: "POST",
+            url: pushedAuthorizationRequestEndpoint
+          },
+          signer: dpop2.signer,
+          callbacks: options.callbacks,
+          nonce: dpop2.nonce
+        }) : void 0;
+        return await pushAuthorizationRequest({
+          authorizationRequest: {
+            ...authorizationRequest,
+            ...clientAttestation?.headers
+          },
+          pushedAuthorizationRequestEndpoint,
+          fetch: options.callbacks.fetch,
+          headers: {
+            ...clientAttestation?.headers,
+            ...dpopHeaders
+          }
+        });
+      }
+    });
+    pushedAuthorizationRequest = {
+      request_uri: pushedAuthorizationResponse.request_uri,
+      client_id: authorizationRequest.client_id
+    };
+    if (options.dpop && dpopNonce) {
+      dpop = {
+        ...options.dpop,
+        nonce: dpopNonce
+      };
+    }
+  } else {
+    if (options.dpop) {
+      authorizationRequest.dpop_jkt = await calculateJwkThumbprint({
+        hashAlgorithm: "SHA-256" /* Sha256 */,
+        hashCallback: options.callbacks.hash,
+        jwk: options.dpop.signer.publicJwk
+      });
+    }
+  }
+  const authorizationRequestUrl = `${authorizationServerMetadata.authorization_endpoint}?${(0, import_utils39.objectToQueryParams)(pushedAuthorizationRequest ?? authorizationRequest).toString()}`;
+  return {
+    authorizationRequestUrl,
+    pkce,
+    dpop
+  };
+}
+async function pushAuthorizationRequest(options) {
+  const fetchWithValibot = (0, import_utils39.createValibotFetcher)(options.fetch);
+  if (options.authorizationRequest.request_uri) {
+    throw new Oauth2Error(
+      `Authorization request contains 'request_uri' parameter. This is not allowed for pushed authorization reuqests.`
+    );
+  }
+  const { response, result } = await fetchWithValibot(
+    vPushedAuthorizationResponse,
+    import_utils39.ContentType.Json,
+    options.pushedAuthorizationRequestEndpoint,
+    {
+      method: "POST",
+      body: (0, import_utils39.objectToQueryParams)(options.authorizationRequest).toString(),
+      headers: {
+        ...options.headers,
+        "Content-Type": import_utils39.ContentType.XWwwFormUrlencoded
+      }
+    }
+  );
+  if (!response.ok || !result) {
+    const parErrorResponse = v19.safeParse(
+      vOauth2ErrorResponse,
+      await response.clone().json().catch(() => null)
+    );
+    if (parErrorResponse.success) {
+      throw new Oauth2ClientErrorResponseError(
+        `Unable to push authorization request to '${options.pushedAuthorizationRequestEndpoint}'. Received response with status ${response.status}`,
+        parErrorResponse.output,
+        response
+      );
+    }
+    throw new import_utils40.InvalidFetchResponseError(
+      `Unable to push authorization request to '${options.pushedAuthorizationRequestEndpoint}'. Received response with status ${response.status}`,
+      await response.clone().text(),
+      response
+    );
+  }
+  if (!result.success) {
+    throw new ValidationError("Error validating pushed authorization response", result.issues);
+  }
+  const dpopNonce = extractDpopNonceFromHeaders(response.headers);
+  return {
+    dpopNonce,
+    pushedAuthorizationResponse: result.output
+  };
+}
+
+// src/Oauth2Client.ts
+var Oauth2Client = class {
+  constructor(options) {
+    this.options = options;
+  }
+  isDpopSupported(options) {
+    if (!options.authorizationServerMetadata.dpop_signing_alg_values_supported || options.authorizationServerMetadata.dpop_signing_alg_values_supported.length === 0) {
+      return {
+        supported: false
+      };
+    }
+    return {
+      supported: true,
+      dpopSigningAlgValuesSupported: options.authorizationServerMetadata.dpop_signing_alg_values_supported
+    };
+  }
+  async fetchAuthorizationServerMetadata(issuer) {
+    return fetchAuthorizationServerMetadata(issuer, this.options.callbacks.fetch);
+  }
+  /**
+   * Initiate authorization.
+   *
+   * It will take the followings steps:
+   * - if `authorization_challenge_endpoint` is defined, send an authorization challenge request
+   * - if authorization challenge request returns a `redirect_to_web` error code with `request_uri`
+   *   then construct the authorization request url based on the `request_uri`
+   * - if the `authorization_challenge_endpoint` is not defined, or authorization challenge request reuturns a `redirect_to_web` error code without `request_uri`
+   *   then the authorization request url will be constructed as usual (optionally using PAR).
+   *
+   * @throws {Oauth2ClientAuthorizationChallengeError} in case of an error response. If `error` is
+   * `insufficient_authorization` possible extra steps can be taken.
+   */
+  async initiateAuthorization(options) {
+    const pkce = options.authorizationServerMetadata.code_challenge_methods_supported ? await createPkce({
+      allowedCodeChallengeMethods: options.authorizationServerMetadata.code_challenge_methods_supported,
+      callbacks: this.options.callbacks,
+      codeVerifier: options.pkceCodeVerifier
+    }) : void 0;
+    if (options.authorizationServerMetadata.authorization_challenge_endpoint) {
+      try {
+        await this.sendAuthorizationChallengeRequest({
+          authorizationServerMetadata: options.authorizationServerMetadata,
+          additionalRequestPayload: options.additionalRequestPayload,
+          clientId: options.clientId,
+          pkceCodeVerifier: pkce?.codeVerifier,
+          scope: options.scope,
+          resource: options.resource,
+          clientAttestation: options.clientAttestation,
+          dpop: options.dpop
+        });
+      } catch (error) {
+        const isRecoverableError = error instanceof Oauth2ClientAuthorizationChallengeError && error.errorResponse.error === "redirect_to_web" /* RedirectToWeb */;
+        if (!isRecoverableError) throw error;
+        if (error.errorResponse.request_uri) {
+          const authorizationRequestUrl = `${options.authorizationServerMetadata.authorization_endpoint}?${(0, import_utils41.objectToQueryParams)(
+            {
+              request_uri: error.errorResponse.request_uri,
+              client_id: options.clientId
+            }
+          ).toString()}`;
+          const dpopNonce = extractDpopNonceFromHeaders(error.response.headers);
+          return {
+            dpop: options.dpop ? {
+              ...options.dpop,
+              nonce: dpopNonce
+            } : void 0,
+            authorizationRequestUrl,
+            pkce
+          };
+        }
+      }
+    }
+    return this.createAuthorizationRequestUrl({
+      authorizationServerMetadata: options.authorizationServerMetadata,
+      clientId: options.clientId,
+      additionalRequestPayload: options.additionalRequestPayload,
+      redirectUri: options.redirectUri,
+      scope: options.scope,
+      pkceCodeVerifier: pkce?.codeVerifier,
+      resource: options.resource,
+      clientAttestation: options.clientAttestation,
+      dpop: options.dpop
+    });
+  }
+  sendAuthorizationChallengeRequest(options) {
+    return sendAuthorizationChallengeRequest({
+      ...options,
+      callbacks: this.options.callbacks
+    });
+  }
+  async createAuthorizationRequestUrl(options) {
+    return createAuthorizationRequestUrl({
+      authorizationServerMetadata: options.authorizationServerMetadata,
+      clientId: options.clientId,
+      additionalRequestPayload: options.additionalRequestPayload,
+      redirectUri: options.redirectUri,
+      resource: options.resource,
+      scope: options.scope,
+      callbacks: this.options.callbacks,
+      pkceCodeVerifier: options.pkceCodeVerifier,
+      clientAttestation: options.clientAttestation,
+      dpop: options.dpop
+    });
+  }
+  async retrievePreAuthorizedCodeAccessToken({
+    authorizationServerMetadata,
+    preAuthorizedCode,
+    additionalRequestPayload,
+    txCode,
+    dpop,
+    resource,
+    clientAttestation
+  }) {
+    const result = await retrievePreAuthorizedCodeAccessToken({
+      authorizationServerMetadata,
+      preAuthorizedCode,
+      txCode,
+      resource,
+      additionalRequestPayload: {
+        ...additionalRequestPayload,
+        tx_code: txCode
+      },
+      callbacks: this.options.callbacks,
+      dpop,
+      clientAttestation
+    });
+    return result;
+  }
+  async retrieveAuthorizationCodeAccessToken({
+    authorizationServerMetadata,
+    additionalRequestPayload,
+    authorizationCode,
+    pkceCodeVerifier,
+    redirectUri,
+    resource,
+    dpop,
+    clientAttestation
+  }) {
+    const result = await retrieveAuthorizationCodeAccessToken({
+      authorizationServerMetadata,
+      authorizationCode,
+      pkceCodeVerifier,
+      additionalRequestPayload,
+      resource,
+      callbacks: this.options.callbacks,
+      dpop,
+      redirectUri,
+      clientAttestation
+    });
+    return result;
+  }
+  async retrieveRefreshTokenAccessToken({
+    authorizationServerMetadata,
+    additionalRequestPayload,
+    refreshToken,
+    resource,
+    dpop,
+    clientAttestation
+  }) {
+    const result = await retrieveRefreshTokenAccessToken({
+      authorizationServerMetadata,
+      refreshToken,
+      additionalRequestPayload,
+      resource,
+      callbacks: this.options.callbacks,
+      dpop,
+      clientAttestation
+    });
+    return result;
+  }
+  async resourceRequest(options) {
+    return resourceRequest(options);
+  }
+  /**
+   * @todo move this to another class?
+   */
+  async createClientAttestationJwt(options) {
+    return await createClientAttestationJwt({
+      callbacks: this.options.callbacks,
+      ...options
+    });
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  HashAlgorithm,
+  InvalidFetchResponseError,
+  Oauth2AuthorizationServer,
+  Oauth2Client,
+  Oauth2ClientAuthorizationChallengeError,
+  Oauth2ClientErrorResponseError,
+  Oauth2Error,
+  Oauth2ErrorCodes,
+  Oauth2JwtParseError,
+  Oauth2JwtVerificationError,
+  Oauth2ResourceServer,
+  Oauth2ResourceUnauthorizedError,
+  Oauth2ServerErrorResponseError,
+  PkceCodeChallengeMethod,
+  SupportedAuthenticationScheme,
+  authorizationCodeGrantIdentifier,
+  calculateJwkThumbprint,
+  clientAuthenticationClientSecretBasic,
+  clientAuthenticationClientSecretPost,
+  clientAuthenticationDynamic,
+  clientAuthenticationNone,
+  decodeJwt,
+  fetchAuthorizationServerMetadata,
+  fetchJwks,
+  fetchWellKnownMetadata,
+  getAuthorizationServerMetadataFromList,
+  getGlobalConfig,
+  isJwkInSet,
+  jwtHeaderFromJwtSigner,
+  jwtSignerFromJwt,
+  preAuthorizedCodeGrantIdentifier,
+  refreshTokenGrantIdentifier,
+  resourceRequest,
+  setGlobalConfig,
+  vAuthorizationCodeGrantIdentifier,
+  vAuthorizationServerMetadata,
+  vCompactJwt,
+  vJwk,
+  vJwtHeader,
+  vJwtPayload,
+  vOauth2ErrorResponse,
+  vPreAuthorizedCodeGrantIdentifier,
+  vRefreshTokenGrantIdentifier,
+  verifyJwt,
+  verifyResourceRequest
+});
+//# sourceMappingURL=index.js.map