@openid4vc/oauth2 0.2.1-alpha-20250130103023 → 0.3.0-alpha-20250202020720

package/dist/index.js

@@ -31,7 +31,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var src_exports = {};
 __export(src_exports, {
   HashAlgorithm: () => HashAlgorithm,
-  InvalidFetchResponseError: () => import_utils43.InvalidFetchResponseError,
+  InvalidFetchResponseError: () => import_utils42.InvalidFetchResponseError,
   Oauth2AuthorizationServer: () => Oauth2AuthorizationServer,
   Oauth2Client: () => Oauth2Client,
   Oauth2ClientAuthorizationChallengeError: () => Oauth2ClientAuthorizationChallengeError,
@@ -56,31 +56,31 @@ __export(src_exports, {
   fetchJwks: () => fetchJwks,
   fetchWellKnownMetadata: () => fetchWellKnownMetadata,
   getAuthorizationServerMetadataFromList: () => getAuthorizationServerMetadataFromList,
-  getGlobalConfig: () => import_utils42.getGlobalConfig,
+  getGlobalConfig: () => import_utils41.getGlobalConfig,
   isJwkInSet: () => isJwkInSet,
   jwtHeaderFromJwtSigner: () => jwtHeaderFromJwtSigner,
   jwtSignerFromJwt: () => jwtSignerFromJwt,
   preAuthorizedCodeGrantIdentifier: () => preAuthorizedCodeGrantIdentifier,
   refreshTokenGrantIdentifier: () => refreshTokenGrantIdentifier,
   resourceRequest: () => resourceRequest,
-  setGlobalConfig: () => import_utils42.setGlobalConfig,
-  vAuthorizationCodeGrantIdentifier: () => vAuthorizationCodeGrantIdentifier,
-  vAuthorizationServerMetadata: () => vAuthorizationServerMetadata,
-  vCompactJwt: () => vCompactJwt,
-  vJwk: () => vJwk,
-  vJwtHeader: () => vJwtHeader,
-  vJwtPayload: () => vJwtPayload,
-  vOauth2ErrorResponse: () => vOauth2ErrorResponse,
-  vPreAuthorizedCodeGrantIdentifier: () => vPreAuthorizedCodeGrantIdentifier,
-  vRefreshTokenGrantIdentifier: () => vRefreshTokenGrantIdentifier,
+  setGlobalConfig: () => import_utils41.setGlobalConfig,
   verifyJwt: () => verifyJwt,
-  verifyResourceRequest: () => verifyResourceRequest
+  verifyResourceRequest: () => verifyResourceRequest,
+  zAuthorizationCodeGrantIdentifier: () => zAuthorizationCodeGrantIdentifier,
+  zAuthorizationServerMetadata: () => zAuthorizationServerMetadata,
+  zCompactJwt: () => zCompactJwt,
+  zJwk: () => zJwk,
+  zJwtHeader: () => zJwtHeader,
+  zJwtPayload: () => zJwtPayload,
+  zOauth2ErrorResponse: () => zOauth2ErrorResponse,
+  zPreAuthorizedCodeGrantIdentifier: () => zPreAuthorizedCodeGrantIdentifier,
+  zRefreshTokenGrantIdentifier: () => zRefreshTokenGrantIdentifier
 });
 module.exports = __toCommonJS(src_exports);
-var import_utils42 = require("@openid4vc/utils");
+var import_utils41 = require("@openid4vc/utils");
 
-// src/common/v-oauth2-error.ts
-var v = __toESM(require("valibot"));
+// src/common/z-oauth2-error.ts
+var import_zod = __toESM(require("zod"));
 var Oauth2ErrorCodes = /* @__PURE__ */ ((Oauth2ErrorCodes2) => {
   Oauth2ErrorCodes2["ServerError"] = "server_error";
   Oauth2ErrorCodes2["InvalidTarget"] = "invalid_target";
@@ -106,52 +106,54 @@ var Oauth2ErrorCodes = /* @__PURE__ */ ((Oauth2ErrorCodes2) => {
   Oauth2ErrorCodes2["InvalidEncryptionParameters"] = "invalid_encryption_parameters";
   return Oauth2ErrorCodes2;
 })(Oauth2ErrorCodes || {});
-var vOauth2ErrorResponse = v.looseObject({
-  error: v.union([v.enum(Oauth2ErrorCodes), v.string()]),
-  error_description: v.optional(v.string()),
-  error_uri: v.optional(v.string())
-});
+var zOauth2ErrorResponse = import_zod.default.object({
+  error: import_zod.default.union([import_zod.default.nativeEnum(Oauth2ErrorCodes), import_zod.default.string()]),
+  error_description: import_zod.default.string().optional(),
+  error_uri: import_zod.default.string().optional()
+}).passthrough();
 
 // src/common/jwk/jwk-thumbprint.ts
-var v2 = __toESM(require("valibot"));
 var import_utils = require("@openid4vc/utils");
-var vJwkThumbprintComponents = v2.variant("kty", [
-  v2.pipe(
-    v2.looseObject({
-      kty: v2.literal("EC"),
-      crv: v2.string(),
-      x: v2.string(),
-      y: v2.string()
-    }),
-    v2.transform(({ crv, kty, x, y }) => ({ crv, kty, x, y }))
-  ),
-  v2.pipe(
-    v2.looseObject({
-      kty: v2.literal("OKP"),
-      crv: v2.string(),
-      x: v2.string()
-    }),
-    v2.transform(({ crv, kty, x }) => ({ crv, kty, x }))
-  ),
-  v2.pipe(
-    v2.looseObject({
-      kty: v2.literal("RSA"),
-      e: v2.string(),
-      n: v2.string()
-    }),
-    v2.transform(({ e, kty, n }) => ({ e, kty, n }))
-  ),
-  v2.pipe(
-    v2.looseObject({
-      kty: v2.literal("oct"),
-      k: v2.string()
-    }),
-    v2.transform(({ k, kty }) => ({ k, kty }))
-  )
-]);
+var import_zod2 = __toESM(require("zod"));
+var zJwkThumbprintComponents = import_zod2.default.discriminatedUnion("kty", [
+  import_zod2.default.object({
+    kty: import_zod2.default.literal("EC"),
+    crv: import_zod2.default.string(),
+    x: import_zod2.default.string(),
+    y: import_zod2.default.string()
+  }),
+  import_zod2.default.object({
+    kty: import_zod2.default.literal("OKP"),
+    crv: import_zod2.default.string(),
+    x: import_zod2.default.string()
+  }),
+  import_zod2.default.object({
+    kty: import_zod2.default.literal("RSA"),
+    e: import_zod2.default.string(),
+    n: import_zod2.default.string()
+  }),
+  import_zod2.default.object({
+    kty: import_zod2.default.literal("oct"),
+    k: import_zod2.default.string()
+  })
+]).transform((data) => {
+  if (data.kty === "EC") {
+    return { crv: data.crv, kty: data.kty, x: data.x, y: data.y };
+  }
+  if (data.kty === "OKP") {
+    return { crv: data.crv, kty: data.kty, x: data.x };
+  }
+  if (data.kty === "RSA") {
+    return { e: data.e, kty: data.kty, n: data.n };
+  }
+  if (data.kty === "oct") {
+    return { k: data.k, kty: data.kty };
+  }
+  throw new Error("Unsupported kty");
+});
 async function calculateJwkThumbprint(options) {
   const jwkThumbprintComponents = (0, import_utils.parseWithErrorHandling)(
-    vJwkThumbprintComponents,
+    zJwkThumbprintComponents,
     options.jwk,
     `Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing.`
   );
@@ -212,44 +214,42 @@ async function isJwkInSet({
   return false;
 }
 
-// src/common/jwk/v-jwk.ts
-var v3 = __toESM(require("valibot"));
-var vJwk = v3.looseObject({
-  kty: v3.string(),
-  crv: v3.optional(v3.string()),
-  x: v3.optional(v3.string()),
-  y: v3.optional(v3.string()),
-  e: v3.optional(v3.string()),
-  n: v3.optional(v3.string()),
-  alg: v3.optional(v3.string()),
-  d: v3.optional(v3.string()),
-  dp: v3.optional(v3.string()),
-  dq: v3.optional(v3.string()),
-  ext: v3.optional(v3.boolean()),
-  k: v3.optional(v3.string()),
-  key_ops: v3.optional(v3.string()),
-  kid: v3.optional(v3.string()),
-  oth: v3.optional(
-    v3.array(
-      v3.looseObject({
-        d: v3.optional(v3.string()),
-        r: v3.optional(v3.string()),
-        t: v3.optional(v3.string())
-      })
+// src/common/jwk/z-jwk.ts
+var import_zod3 = __toESM(require("zod"));
+var zJwk = import_zod3.default.object({
+  kty: import_zod3.default.string(),
+  crv: import_zod3.default.optional(import_zod3.default.string()),
+  x: import_zod3.default.optional(import_zod3.default.string()),
+  y: import_zod3.default.optional(import_zod3.default.string()),
+  e: import_zod3.default.optional(import_zod3.default.string()),
+  n: import_zod3.default.optional(import_zod3.default.string()),
+  alg: import_zod3.default.optional(import_zod3.default.string()),
+  d: import_zod3.default.optional(import_zod3.default.string()),
+  dp: import_zod3.default.optional(import_zod3.default.string()),
+  dq: import_zod3.default.optional(import_zod3.default.string()),
+  ext: import_zod3.default.optional(import_zod3.default.boolean()),
+  k: import_zod3.default.optional(import_zod3.default.string()),
+  key_ops: import_zod3.default.optional(import_zod3.default.string()),
+  kid: import_zod3.default.optional(import_zod3.default.string()),
+  oth: import_zod3.default.optional(
+    import_zod3.default.array(
+      import_zod3.default.object({
+        d: import_zod3.default.optional(import_zod3.default.string()),
+        r: import_zod3.default.optional(import_zod3.default.string()),
+        t: import_zod3.default.optional(import_zod3.default.string())
+      }).passthrough()
     )
   ),
-  p: v3.optional(v3.string()),
-  q: v3.optional(v3.string()),
-  qi: v3.optional(v3.string()),
-  use: v3.optional(v3.string()),
-  x5c: v3.optional(v3.string()),
-  x5t: v3.optional(v3.string()),
-  "x5t#S256": v3.optional(v3.string()),
-  x5u: v3.optional(v3.string())
-});
-var vJwkSet = v3.looseObject({
-  keys: v3.array(vJwk)
-});
+  p: import_zod3.default.optional(import_zod3.default.string()),
+  q: import_zod3.default.optional(import_zod3.default.string()),
+  qi: import_zod3.default.optional(import_zod3.default.string()),
+  use: import_zod3.default.optional(import_zod3.default.string()),
+  x5c: import_zod3.default.optional(import_zod3.default.string()),
+  x5t: import_zod3.default.optional(import_zod3.default.string()),
+  "x5t#S256": import_zod3.default.optional(import_zod3.default.string()),
+  x5u: import_zod3.default.optional(import_zod3.default.string())
+}).passthrough();
+var zJwkSet = import_zod3.default.object({ keys: import_zod3.default.array(zJwk) }).passthrough();
 
 // src/common/jwt/verify-jwt.ts
 var import_utils2 = require("@openid4vc/utils");
@@ -318,47 +318,43 @@ var Oauth2JwtParseError = class extends Oauth2Error {
   }
 };
 
-// src/common/jwt/v-jwt.ts
+// src/common/jwt/z-jwt.ts
 var import_utils3 = require("@openid4vc/utils");
-var v5 = __toESM(require("valibot"));
+var import_zod5 = __toESM(require("zod"));
 
-// src/common/v-common.ts
-var v4 = __toESM(require("valibot"));
-var vAlgValueNotNone = v4.pipe(
-  v4.string(),
-  v4.check((alg) => alg !== "none", `alg value may not be 'none'`)
-);
+// src/common/z-common.ts
+var import_zod4 = __toESM(require("zod"));
+var zAlgValueNotNone = import_zod4.default.string().refine((alg) => alg !== "none", { message: `alg value may not be 'none'` });
 
-// src/common/jwt/v-jwt.ts
-var vCompactJwt = v5.pipe(
-  v5.string(),
-  v5.regex(/^([a-zA-Z0-9_=]+)\.([a-zA-Z0-9_=]+)\.([a-zA-Z0-9_\-\+\/=]*)$/, "Not a valid compact jwt")
-);
-var vJwtConfirmationPayload = v5.looseObject({
-  jwk: v5.optional(vJwk),
-  // RFC9449. jwk thumbprint of the dpop public key to which the access token is bound
-  jkt: v5.optional(v5.string())
+// src/common/jwt/z-jwt.ts
+var zCompactJwt = import_zod5.default.string().regex(/^([a-zA-Z0-9_=]+)\.([a-zA-Z0-9_=]+)\.([a-zA-Z0-9_\-\+\/=]*)$/, {
+  message: "Not a valid compact jwt"
 });
-var vJwtPayload = v5.looseObject({
-  iss: v5.optional(v5.string()),
-  aud: v5.optional(v5.string()),
-  iat: v5.optional(import_utils3.vInteger),
-  exp: v5.optional(import_utils3.vInteger),
-  nbf: v5.optional(import_utils3.vInteger),
-  nonce: v5.optional(v5.string()),
-  jti: v5.optional(v5.string()),
-  cnf: v5.optional(vJwtConfirmationPayload),
+var zJwtConfirmationPayload = import_zod5.default.object({
+  jwk: zJwk.optional(),
+  // RFC9449. jwk thumbprint of the dpop public key to which the access token is bound
+  jkt: import_zod5.default.string().optional()
+}).passthrough();
+var zJwtPayload = import_zod5.default.object({
+  iss: import_zod5.default.string().optional(),
+  aud: import_zod5.default.string().optional(),
+  iat: import_utils3.zInteger.optional(),
+  exp: import_utils3.zInteger.optional(),
+  nbf: import_utils3.zInteger.optional(),
+  nonce: import_zod5.default.string().optional(),
+  jti: import_zod5.default.string().optional(),
+  cnf: zJwtConfirmationPayload.optional(),
   // Reserved for status parameters
-  status: v5.optional(v5.looseObject({}))
-});
-var vJwtHeader = v5.looseObject({
-  alg: vAlgValueNotNone,
-  typ: v5.optional(v5.string()),
-  kid: v5.optional(v5.string()),
-  jwk: v5.optional(vJwk),
-  x5c: v5.optional(v5.array(v5.string())),
-  trust_chain: v5.optional(v5.array(v5.string()))
-});
+  status: import_zod5.default.record(import_zod5.default.string(), import_zod5.default.any()).optional()
+}).passthrough();
+var zJwtHeader = import_zod5.default.object({
+  alg: zAlgValueNotNone,
+  typ: import_zod5.default.string().optional(),
+  kid: import_zod5.default.string().optional(),
+  jwk: zJwk.optional(),
+  x5c: import_zod5.default.array(import_zod5.default.string()).optional(),
+  trust_chain: import_zod5.default.array(import_zod5.default.string()).optional()
+}).passthrough();
 
 // src/common/jwt/decode-jwt.ts
 function decodeJwt(options) {
@@ -380,8 +376,8 @@ function decodeJwt(options) {
   } catch (error) {
     throw new Oauth2JwtParseError("Error parsing JWT");
   }
-  const header = (0, import_utils4.parseWithErrorHandling)(options.headerSchema ?? vJwtHeader, headerJson);
-  const payload = (0, import_utils4.parseWithErrorHandling)(options.payloadSchema ?? vJwtPayload, payloadJson);
+  const header = (0, import_utils4.parseWithErrorHandling)(options.headerSchema ?? zJwtHeader, headerJson);
+  const payload = (0, import_utils4.parseWithErrorHandling)(options.payloadSchema ?? zJwtPayload, payloadJson);
   return {
     header,
     payload,
@@ -510,7 +506,7 @@ ${JSON.stringify(wwwAuthenticateHeaders, null, 2)}`);
 };
 
 // src/index.ts
-var import_utils43 = require("@openid4vc/utils");
+var import_utils42 = require("@openid4vc/utils");
 
 // src/error/Oauth2ClientErrorResponseError.ts
 var Oauth2ClientErrorResponseError = class extends Oauth2Error {
@@ -543,45 +539,42 @@ ${JSON.stringify(errorResponse, null, 2)}`,
   }
 };
 
-// src/metadata/authorization-server/v-authorization-server-metadata.ts
+// src/metadata/authorization-server/z-authorization-server-metadata.ts
 var import_utils6 = require("@openid4vc/utils");
-var v6 = __toESM(require("valibot"));
-var vAuthorizationServerMetadata = v6.pipe(
-  v6.looseObject({
-    issuer: import_utils6.vHttpsUrl,
-    token_endpoint: import_utils6.vHttpsUrl,
-    token_endpoint_auth_methods_supported: v6.optional(v6.array(v6.string())),
-    authorization_endpoint: v6.optional(import_utils6.vHttpsUrl),
-    jwks_uri: v6.optional(import_utils6.vHttpsUrl),
-    // RFC7636
-    code_challenge_methods_supported: v6.optional(v6.array(v6.string())),
-    // RFC9449
-    dpop_signing_alg_values_supported: v6.optional(v6.array(v6.string())),
-    // RFC9126
-    require_pushed_authorization_requests: v6.optional(v6.boolean()),
-    pushed_authorization_request_endpoint: v6.optional(import_utils6.vHttpsUrl),
-    // RFC9068
-    introspection_endpoint: v6.optional(import_utils6.vHttpsUrl),
-    introspection_endpoint_auth_methods_supported: v6.optional(
-      v6.array(v6.union([v6.literal("client_secret_jwt"), v6.literal("private_key_jwt"), v6.string()]))
-    ),
-    introspection_endpoint_auth_signing_alg_values_supported: v6.optional(v6.array(vAlgValueNotNone)),
-    // FiPA (no RFC yet)
-    authorization_challenge_endpoint: v6.optional(import_utils6.vHttpsUrl),
-    // From OID4VCI specification
-    "pre-authorized_grant_anonymous_access_supported": v6.optional(v6.boolean())
-  }),
-  v6.check(
-    ({
-      introspection_endpoint_auth_methods_supported: methodsSupported,
-      introspection_endpoint_auth_signing_alg_values_supported: algValuesSupported
-    }) => {
-      if (!methodsSupported) return true;
-      if (!methodsSupported.includes("private_key_jwt") && !methodsSupported.includes("client_secret_jwt")) return true;
-      return algValuesSupported !== void 0 && algValuesSupported.length > 0;
-    },
-    `Metadata value 'introspection_endpoint_auth_signing_alg_values_supported' must be defined if metadata 'introspection_endpoint_auth_methods_supported' value contains values 'private_key_jwt' or 'client_secret_jwt'`
-  )
+var import_zod6 = __toESM(require("zod"));
+var zAuthorizationServerMetadata = import_zod6.default.object({
+  issuer: import_utils6.zHttpsUrl,
+  token_endpoint: import_utils6.zHttpsUrl,
+  token_endpoint_auth_methods_supported: import_zod6.default.optional(import_zod6.default.array(import_zod6.default.string())),
+  authorization_endpoint: import_zod6.default.optional(import_utils6.zHttpsUrl),
+  jwks_uri: import_zod6.default.optional(import_utils6.zHttpsUrl),
+  // RFC7636
+  code_challenge_methods_supported: import_zod6.default.optional(import_zod6.default.array(import_zod6.default.string())),
+  // RFC9449
+  dpop_signing_alg_values_supported: import_zod6.default.optional(import_zod6.default.array(import_zod6.default.string())),
+  // RFC9126
+  require_pushed_authorization_requests: import_zod6.default.optional(import_zod6.default.boolean()),
+  pushed_authorization_request_endpoint: import_zod6.default.optional(import_utils6.zHttpsUrl),
+  // RFC9068
+  introspection_endpoint: import_zod6.default.optional(import_utils6.zHttpsUrl),
+  introspection_endpoint_auth_methods_supported: import_zod6.default.optional(
+    import_zod6.default.array(import_zod6.default.union([import_zod6.default.literal("client_secret_jwt"), import_zod6.default.literal("private_key_jwt"), import_zod6.default.string()]))
+  ),
+  introspection_endpoint_auth_signing_alg_values_supported: import_zod6.default.optional(import_zod6.default.array(zAlgValueNotNone)),
+  // FiPA (no RFC yet)
+  authorization_challenge_endpoint: import_zod6.default.optional(import_utils6.zHttpsUrl),
+  // From OID4VCI specification
+  pre_authorized_grant_anonymous_access_supported: import_zod6.default.optional(import_zod6.default.boolean())
+}).passthrough().refine(
+  ({
+    introspection_endpoint_auth_methods_supported: methodsSupported,
+    introspection_endpoint_auth_signing_alg_values_supported: algValuesSupported
+  }) => {
+    if (!methodsSupported) return true;
+    if (!methodsSupported.includes("private_key_jwt") && !methodsSupported.includes("client_secret_jwt")) return true;
+    return algValuesSupported !== void 0 && algValuesSupported.length > 0;
+  },
+  `Metadata value 'introspection_endpoint_auth_signing_alg_values_supported' must be defined if metadata 'introspection_endpoint_auth_methods_supported' value contains values 'private_key_jwt' or 'client_secret_jwt'`
 );
 
 // src/metadata/authorization-server/authorization-server-metadata.ts
@@ -591,53 +584,88 @@ var import_utils9 = require("@openid4vc/utils");
 var import_utils7 = require("@openid4vc/utils");
 var import_utils8 = require("@openid4vc/utils");
 
-// ../utils/src/parse.ts
-var v7 = __toESM(require("valibot"));
-
-// ../utils/src/object.ts
-function isObject(item) {
-  return item != null && typeof item === "object" && !Array.isArray(item);
-}
-function mergeDeep(target, ...sources) {
-  if (!sources.length) return target;
-  const source = sources.shift();
-  if (isObject(target) && isObject(source)) {
-    for (const key in source) {
-      if (isObject(source[key])) {
-        if (!target[key]) Object.assign(target, { [key]: {} });
-        mergeDeep(target[key], source[key]);
-      } else {
-        Object.assign(target, { [key]: source[key] });
+// ../utils/src/error/ValidationError.ts
+var import_zod7 = require("zod");
+var constants = {
+  // biome-ignore lint/suspicious/noMisleadingCharacterClass: expected
+  identifierRegex: /[$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*/u,
+  unionSeparator: ", or ",
+  issueSeparator: "\n	- "
+};
+var ValidationError = class extends Error {
+  escapeQuotes(str) {
+    return str.replace(/"/g, '\\"');
+  }
+  joinPath(path) {
+    if (path.length === 1) {
+      return path[0].toString();
+    }
+    return path.reduce((acc, item) => {
+      if (typeof item === "number") {
+        return `${acc}[${item.toString()}]`;
+      }
+      if (item.includes('"')) {
+        return `${acc}["${this.escapeQuotes(item)}"]`;
       }
+      if (!constants.identifierRegex.test(item)) {
+        return `${acc}["${item}"]`;
+      }
+      const separator = acc.length === 0 ? "" : ".";
+      return acc + separator + item;
+    }, "");
+  }
+  getMessageFromUnionErrors(unionErrors) {
+    return unionErrors.reduce((acc, zodError) => {
+      const newIssues = zodError.issues.map((issue) => this.getMessageFromZodIssue(issue)).join(constants.issueSeparator);
+      if (!acc.includes(newIssues)) acc.push(newIssues);
+      return acc;
+    }, []).join(constants.unionSeparator);
+  }
+  getMessageFromZodIssue(issue) {
+    if (issue.code === import_zod7.ZodIssueCode.invalid_union) {
+      return this.getMessageFromUnionErrors(issue.unionErrors);
     }
-  }
-  return mergeDeep(target, ...sources);
-}
-
-// ../utils/src/parse.ts
-function valibotRecursiveFlattenIssues(issues) {
-  let flattened = v7.flatten(issues);
-  for (const issue of issues) {
-    if (issue.issues) {
-      flattened = mergeDeep(flattened, valibotRecursiveFlattenIssues(issue.issues));
+    if (issue.code === import_zod7.ZodIssueCode.invalid_arguments) {
+      return [issue.message, ...issue.argumentsError.issues.map((issue2) => this.getMessageFromZodIssue(issue2))].join(
+        constants.issueSeparator
+      );
     }
-  }
-  return flattened;
-}
-
-// ../utils/src/error/ValidationError.ts
-var ValidationError = class extends Error {
-  constructor(message, valibotIssues = []) {
-    const errorDetails = valibotIssues.length > 0 ? JSON.stringify(valibotRecursiveFlattenIssues(valibotIssues), null, 2) : "No details provided";
-    super(`${message}
-${errorDetails}`);
-    this.valibotIssues = valibotIssues;
+    if (issue.code === import_zod7.ZodIssueCode.invalid_return_type) {
+      return [issue.message, ...issue.returnTypeError.issues.map((issue2) => this.getMessageFromZodIssue(issue2))].join(
+        constants.issueSeparator
+      );
+    }
+    if (issue.path.length !== 0) {
+      if (issue.path.length === 1) {
+        const identifier = issue.path[0];
+        if (typeof identifier === "number") {
+          return `${issue.message} at index ${identifier}`;
+        }
+      }
+      return `${issue.message} at "${this.joinPath(issue.path)}"`;
+    }
+    return issue.message;
+  }
+  formatError(error) {
+    if (!error) return "";
+    return error?.issues.map((issue) => this.getMessageFromZodIssue(issue)).join(constants.issueSeparator);
+  }
+  constructor(message, zodError) {
+    super(message);
+    const formattedError = this.formatError(zodError);
+    this.message = `${message}
+	- ${formattedError}`;
+    Object.defineProperty(this, "zodError", {
+      value: zodError,
+      writable: false,
+      enumerable: false
+    });
   }
 };
 
 // src/metadata/fetch-well-known-metadata.ts
 async function fetchWellKnownMetadata(wellKnownMetadataUrl, schema, fetch) {
-  const fetcher = (0, import_utils7.createValibotFetcher)(fetch);
+  const fetcher = (0, import_utils7.createZodFetcher)(fetch);
   const { result, response } = await fetcher(schema, import_utils7.ContentType.Json, wellKnownMetadataUrl);
   if (response.status === 404) {
     return null;
@@ -649,10 +677,10 @@ async function fetchWellKnownMetadata(wellKnownMetadataUrl, schema, fetch) {
       response
     );
   }
-  if (!result || !result.success) {
-    throw new ValidationError(`Validation of metadata from '${wellKnownMetadataUrl}' failed`, result?.issues);
+  if (!result?.success) {
+    throw new ValidationError(`Validation of metadata from '${wellKnownMetadataUrl}' failed`, result?.error);
   }
-  return result.output;
+  return result.data;
 }
 
 // src/metadata/authorization-server/authorization-server-metadata.ts
@@ -663,7 +691,7 @@ async function fetchAuthorizationServerMetadata(issuer, fetch) {
   const authorizationServerWellKnownMetadataUrl = (0, import_utils9.joinUriParts)(issuer, [wellKnownAuthorizationServerSuffix]);
   const authorizationServerResult = await fetchWellKnownMetadata(
     authorizationServerWellKnownMetadataUrl,
-    vAuthorizationServerMetadata,
+    zAuthorizationServerMetadata,
     fetch
   );
   if (authorizationServerResult) {
@@ -676,7 +704,7 @@ async function fetchAuthorizationServerMetadata(issuer, fetch) {
   }
   const openIdConfigurationResult = await fetchWellKnownMetadata(
     openIdConfigurationWellKnownMetadataUrl,
-    vAuthorizationServerMetadata,
+    zAuthorizationServerMetadata,
     fetch
   );
   if (openIdConfigurationResult) {
@@ -705,14 +733,14 @@ function getAuthorizationServerMetadataFromList(authorizationServersMetadata, is
 var import_utils10 = require("@openid4vc/utils");
 var import_utils11 = require("@openid4vc/utils");
 async function fetchJwks(authorizationServer, fetch) {
-  const fetcher = (0, import_utils10.createValibotFetcher)(fetch);
+  const fetcher = (0, import_utils10.createZodFetcher)(fetch);
   const jwksUrl = authorizationServer.jwks_uri;
   if (!jwksUrl) {
     throw new Oauth2Error(
       `Authorization server '${authorizationServer.issuer}' does not have a 'jwks_uri' parameter to fetch JWKs.`
     );
   }
-  const { result, response } = await fetcher(vJwkSet, import_utils10.ContentType.JwkSet, jwksUrl);
+  const { result, response } = await fetcher(zJwkSet, import_utils10.ContentType.JwkSet, jwksUrl);
   if (!response.ok) {
     throw new import_utils11.InvalidFetchResponseError(
       `Fetching JWKs from jwks_uri '${jwksUrl}' resulted in an unsuccessfull response with status code '${response.status}'.`,
@@ -720,32 +748,32 @@ async function fetchJwks(authorizationServer, fetch) {
       response
     );
   }
-  if (!result || !result.success) {
-    throw new ValidationError(`Validation of JWKs from jwks_uri '${jwksUrl}' failed`, result?.issues);
+  if (!result?.success) {
+    throw new ValidationError(`Validation of JWKs from jwks_uri '${jwksUrl}' failed`, result?.error);
   }
-  return result.output;
+  return result.data;
 }
 
-// src/access-token/v-access-token-jwt.ts
+// src/access-token/z-access-token-jwt.ts
 var import_utils12 = require("@openid4vc/utils");
-var v8 = __toESM(require("valibot"));
-var vAccessTokenProfileJwtHeader = v8.looseObject({
-  ...vJwtHeader.entries,
-  typ: v8.picklist(["application/at+jwt", "at+jwt"])
-});
-var vAccessTokenProfileJwtPayload = v8.looseObject({
-  ...vJwtPayload.entries,
-  iss: v8.string(),
-  exp: import_utils12.vInteger,
-  iat: import_utils12.vInteger,
-  aud: v8.string(),
-  sub: v8.string(),
+var import_zod8 = __toESM(require("zod"));
+var zAccessTokenProfileJwtHeader = import_zod8.default.object({
+  ...zJwtHeader.shape,
+  typ: import_zod8.default.enum(["application/at+jwt", "at+jwt"])
+}).passthrough();
+var zAccessTokenProfileJwtPayload = import_zod8.default.object({
+  ...zJwtPayload.shape,
+  iss: import_zod8.default.string(),
+  exp: import_utils12.zInteger,
+  iat: import_utils12.zInteger,
+  aud: import_zod8.default.string(),
+  sub: import_zod8.default.string(),
   // REQUIRED according to RFC 9068, but OID4VCI allows anonymous access
-  client_id: v8.optional(v8.string()),
-  jti: v8.string(),
+  client_id: import_zod8.default.optional(import_zod8.default.string()),
+  jti: import_zod8.default.string(),
   // SHOULD be included in the authorization request contained it
-  scope: v8.optional(v8.string())
-});
+  scope: import_zod8.default.optional(import_zod8.default.string())
+}).passthrough();
 
 // src/access-token/verify-access-token.ts
 var SupportedAuthenticationScheme = /* @__PURE__ */ ((SupportedAuthenticationScheme2) => {
@@ -756,8 +784,8 @@ var SupportedAuthenticationScheme = /* @__PURE__ */ ((SupportedAuthenticationSch
 async function verifyJwtProfileAccessToken(options) {
   const decodedJwt = decodeJwt({
     jwt: options.accessToken,
-    headerSchema: vAccessTokenProfileJwtHeader,
-    payloadSchema: vAccessTokenProfileJwtPayload
+    headerSchema: zAccessTokenProfileJwtHeader,
+    payloadSchema: zAccessTokenProfileJwtPayload
   });
   const authorizationServer = options.authorizationServers.find(({ issuer }) => decodedJwt.payload.iss === issuer);
   if (!authorizationServer) {
@@ -794,23 +822,23 @@ var import_utils15 = require("@openid4vc/utils");
 // src/dpop/dpop.ts
 var import_utils14 = require("@openid4vc/utils");
 
-// src/dpop/v-dpop.ts
-var v9 = __toESM(require("valibot"));
+// src/dpop/z-dpop.ts
 var import_utils13 = require("@openid4vc/utils");
-var vDpopJwtPayload = v9.looseObject({
-  ...vJwtPayload.entries,
-  iat: import_utils13.vInteger,
-  htu: import_utils13.vHttpsUrl,
-  htm: import_utils13.vHttpMethod,
-  jti: v9.string(),
+var import_zod9 = __toESM(require("zod"));
+var zDpopJwtPayload = import_zod9.default.object({
+  ...zJwtPayload.shape,
+  iat: import_utils13.zInteger,
+  htu: import_utils13.zHttpsUrl,
+  htm: import_utils13.zHttpMethod,
+  jti: import_zod9.default.string(),
   // Only required when presenting in combination with access token
-  ath: v9.optional(v9.string())
-});
-var vDpopJwtHeader = v9.looseObject({
-  ...vJwtHeader.entries,
-  typ: v9.literal("dpop+jwt"),
-  jwk: vJwk
-});
+  ath: import_zod9.default.optional(import_zod9.default.string())
+}).passthrough();
+var zDpopJwtHeader = import_zod9.default.object({
+  ...zJwtHeader.shape,
+  typ: import_zod9.default.literal("dpop+jwt"),
+  jwk: zJwk
+}).passthrough();
 
 // src/dpop/dpop.ts
 async function createDpopHeadersForRequest(options) {
@@ -824,12 +852,12 @@ async function createDpopJwt(options) {
   if (options.accessToken) {
     ath = (0, import_utils14.encodeToBase64Url)(await options.callbacks.hash((0, import_utils14.decodeUtf8String)(options.accessToken), "SHA-256" /* Sha256 */));
   }
-  const header = (0, import_utils14.parseWithErrorHandling)(vDpopJwtHeader, {
+  const header = (0, import_utils14.parseWithErrorHandling)(zDpopJwtHeader, {
     typ: "dpop+jwt",
     jwk: options.signer.publicJwk,
     alg: options.signer.alg
   });
-  const payload = (0, import_utils14.parseWithErrorHandling)(vDpopJwtPayload, {
+  const payload = (0, import_utils14.parseWithErrorHandling)(zDpopJwtPayload, {
     htu: htuFromRequestUrl(options.request.url),
     iat: (0, import_utils14.dateToSeconds)(options.issuedAt),
     htm: options.request.method,
@@ -847,8 +875,8 @@ async function createDpopJwt(options) {
 async function verifyDpopJwt(options) {
   const { header, payload } = decodeJwt({
     jwt: options.dpopJwt,
-    headerSchema: vDpopJwtHeader,
-    payloadSchema: vDpopJwtPayload
+    headerSchema: zDpopJwtHeader,
+    payloadSchema: zDpopJwtPayload
   });
   if (options.allowedSigningAlgs && !options.allowedSigningAlgs.includes(header.alg)) {
     throw new Oauth2Error(
@@ -1056,33 +1084,33 @@ var import_utils17 = require("@openid4vc/utils");
 var import_utils18 = require("@openid4vc/utils");
 var import_utils19 = require("@openid4vc/utils");
 
-// src/access-token/v-token-introspection.ts
+// src/access-token/z-token-introspection.ts
 var import_utils16 = require("@openid4vc/utils");
-var v10 = __toESM(require("valibot"));
-var vTokenIntrospectionRequest = v10.looseObject({
-  token: v10.string(),
-  token_type_hint: v10.optional(v10.string())
-});
-var vTokenIntrospectionResponse = v10.looseObject({
-  active: v10.boolean(),
-  scope: v10.optional(v10.string()),
-  client_id: v10.optional(v10.string()),
-  username: v10.optional(v10.string()),
-  token_type: v10.optional(v10.string()),
-  exp: v10.optional(import_utils16.vInteger),
-  iat: v10.optional(import_utils16.vInteger),
-  nbf: v10.optional(import_utils16.vInteger),
-  sub: v10.optional(v10.string()),
-  aud: v10.optional(v10.string()),
-  iss: v10.optional(v10.string()),
-  jti: v10.optional(v10.string()),
-  cnf: v10.optional(vJwtConfirmationPayload)
-});
+var import_zod10 = __toESM(require("zod"));
+var zTokenIntrospectionRequest = import_zod10.default.object({
+  token: import_zod10.default.string(),
+  token_type_hint: import_zod10.default.optional(import_zod10.default.string())
+}).passthrough();
+var zTokenIntrospectionResponse = import_zod10.default.object({
+  active: import_zod10.default.boolean(),
+  scope: import_zod10.default.optional(import_zod10.default.string()),
+  client_id: import_zod10.default.optional(import_zod10.default.string()),
+  username: import_zod10.default.optional(import_zod10.default.string()),
+  token_type: import_zod10.default.optional(import_zod10.default.string()),
+  exp: import_zod10.default.optional(import_utils16.zInteger),
+  iat: import_zod10.default.optional(import_utils16.zInteger),
+  nbf: import_zod10.default.optional(import_utils16.zInteger),
+  sub: import_zod10.default.optional(import_zod10.default.string()),
+  aud: import_zod10.default.optional(import_zod10.default.string()),
+  iss: import_zod10.default.optional(import_zod10.default.string()),
+  jti: import_zod10.default.optional(import_zod10.default.string()),
+  cnf: import_zod10.default.optional(zJwtConfirmationPayload)
+}).passthrough();
 
 // src/access-token/introspect-token.ts
 async function introspectToken(options) {
-  const fetchWithValibot = (0, import_utils17.createValibotFetcher)(options.callbacks.fetch);
-  const introspectionRequest = (0, import_utils17.parseWithErrorHandling)(vTokenIntrospectionRequest, {
+  const fetchWithZod = (0, import_utils17.createZodFetcher)(options.callbacks.fetch);
+  const introspectionRequest = (0, import_utils17.parseWithErrorHandling)(zTokenIntrospectionRequest, {
     token: options.token,
     token_type_hint: options.tokenTypeHint,
     ...options.additionalPayload
@@ -1102,8 +1130,8 @@ async function introspectToken(options) {
     contentType: import_utils17.ContentType.XWwwFormUrlencoded,
     headers
   });
-  const { result, response } = await fetchWithValibot(
-    vTokenIntrospectionResponse,
+  const { result, response } = await fetchWithZod(
+    zTokenIntrospectionResponse,
     import_utils17.ContentType.Json,
     introspectionEndpoint,
     {
@@ -1119,7 +1147,7 @@ async function introspectToken(options) {
       response
     );
   }
-  return result.output;
+  return result.data;
 }
 
 // src/resource-request/verify-resource-request.ts
@@ -1296,8 +1324,8 @@ function getSupportedClientAuthenticationMethod(authorizationServer, endpointTyp
 }
 function clientAuthenticationDynamic(options) {
   return (callbackOptions) => {
-    const { url: url3, authorizationServerMetata } = callbackOptions;
-    const endpointType = url3 === authorizationServerMetata.introspection_endpoint ? "introspection" : "endpoint";
+    const { url, authorizationServerMetata } = callbackOptions;
+    const endpointType = url === authorizationServerMetata.introspection_endpoint ? "introspection" : "endpoint";
     const method = getSupportedClientAuthenticationMethod(authorizationServerMetata, endpointType);
     if (method === "client_secret_basic" /* ClientSecretBasic */) {
       return clientAuthenticationClientSecretBasic(options)(callbackOptions);
@@ -1330,17 +1358,17 @@ function clientAuthenticationNone() {
 }
 
 // src/Oauth2AuthorizationServer.ts
-var import_utils34 = require("@openid4vc/utils");
+var import_utils33 = require("@openid4vc/utils");
 
 // src/access-token/create-access-token.ts
 var import_utils22 = require("@openid4vc/utils");
 async function createAccessTokenJwt(options) {
-  const header = (0, import_utils22.parseWithErrorHandling)(vAccessTokenProfileJwtHeader, {
+  const header = (0, import_utils22.parseWithErrorHandling)(zAccessTokenProfileJwtHeader, {
     ...jwtHeaderFromJwtSigner(options.signer),
     typ: "at+jwt"
   });
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const payload = (0, import_utils22.parseWithErrorHandling)(vAccessTokenProfileJwtPayload, {
+  const payload = (0, import_utils22.parseWithErrorHandling)(zAccessTokenProfileJwtPayload, {
     iat: (0, import_utils22.dateToSeconds)(now),
     exp: (0, import_utils22.dateToSeconds)((0, import_utils22.addSecondsToDate)(now, options.expiresInSeconds)),
     aud: options.audience,
@@ -1370,84 +1398,75 @@ async function createAccessTokenJwt(options) {
 // src/access-token/create-access-token-response.ts
 var import_utils24 = require("@openid4vc/utils");
 
-// src/access-token/v-access-token.ts
-var v12 = __toESM(require("valibot"));
+// src/access-token/z-access-token.ts
+var import_zod12 = __toESM(require("zod"));
 var import_utils23 = require("@openid4vc/utils");
 
-// src/v-grant-type.ts
-var v11 = __toESM(require("valibot"));
-var vPreAuthorizedCodeGrantIdentifier = v11.literal("urn:ietf:params:oauth:grant-type:pre-authorized_code");
-var preAuthorizedCodeGrantIdentifier = vPreAuthorizedCodeGrantIdentifier.literal;
-var vAuthorizationCodeGrantIdentifier = v11.literal("authorization_code");
-var authorizationCodeGrantIdentifier = vAuthorizationCodeGrantIdentifier.literal;
-var vRefreshTokenGrantIdentifier = v11.literal("refresh_token");
-var refreshTokenGrantIdentifier = vRefreshTokenGrantIdentifier.literal;
-
-// src/access-token/v-access-token.ts
-var vAccessTokenRequest = v12.intersect([
-  v12.looseObject({
+// src/z-grant-type.ts
+var import_zod11 = __toESM(require("zod"));
+var zPreAuthorizedCodeGrantIdentifier = import_zod11.default.literal("urn:ietf:params:oauth:grant-type:pre-authorized_code");
+var preAuthorizedCodeGrantIdentifier = zPreAuthorizedCodeGrantIdentifier.value;
+var zAuthorizationCodeGrantIdentifier = import_zod11.default.literal("authorization_code");
+var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
+var zRefreshTokenGrantIdentifier = import_zod11.default.literal("refresh_token");
+var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
+
+// src/access-token/z-access-token.ts
+var zAccessTokenRequest = import_zod12.default.intersection(
+  import_zod12.default.object({
     // Pre authorized code flow
-    "pre-authorized_code": v12.optional(v12.string()),
+    "pre-authorized_code": import_zod12.default.optional(import_zod12.default.string()),
     // Authorization code flow
-    code: v12.optional(v12.string()),
-    redirect_uri: v12.optional(v12.pipe(v12.string(), v12.url())),
+    code: import_zod12.default.optional(import_zod12.default.string()),
+    redirect_uri: import_zod12.default.string().url().optional(),
     // Refresh token grant
-    refresh_token: v12.optional(v12.string()),
-    resource: v12.optional(import_utils23.vHttpsUrl),
-    code_verifier: v12.optional(v12.string()),
-    grant_type: v12.union([
-      vPreAuthorizedCodeGrantIdentifier,
-      vAuthorizationCodeGrantIdentifier,
-      vRefreshTokenGrantIdentifier,
+    refresh_token: import_zod12.default.optional(import_zod12.default.string()),
+    resource: import_zod12.default.optional(import_utils23.zHttpsUrl),
+    code_verifier: import_zod12.default.optional(import_zod12.default.string()),
+    grant_type: import_zod12.default.union([
+      zPreAuthorizedCodeGrantIdentifier,
+      zAuthorizationCodeGrantIdentifier,
+      zRefreshTokenGrantIdentifier,
       // string makes the previous ones unessary, but it does help with error messages
-      v12.string()
+      import_zod12.default.string()
     ])
-  }),
-  v12.pipe(
-    v12.looseObject({
-      tx_code: v12.optional(v12.string()),
-      // user_pin is from OID4VCI draft 11
-      user_pin: v12.optional(v12.string())
-    }),
-    // Check that user_pin and tx_code are the same if both are provided
-    // and transform user_pin to tx_code if only user_pin is provided
-    v12.check(
-      ({ tx_code, user_pin }) => !tx_code || !user_pin || user_pin === tx_code,
-      `If both 'tx_code' and 'user_pin' are present they must match`
-    ),
-    v12.transform(({ tx_code, user_pin, ...rest }) => {
-      return {
-        ...rest,
-        ...tx_code ?? user_pin ? { tx_code: tx_code ?? user_pin } : {}
-      };
-    })
-  )
-]);
-var vAccessTokenResponse = v12.looseObject({
-  access_token: v12.string(),
-  token_type: v12.string(),
-  expires_in: v12.optional(v12.pipe(v12.number(), v12.integer())),
-  scope: v12.optional(v12.string()),
-  state: v12.optional(v12.string()),
-  refresh_token: v12.optional(v12.string()),
+  }).passthrough(),
+  import_zod12.default.object({
+    tx_code: import_zod12.default.optional(import_zod12.default.string()),
+    // user_pin is from OID4VCI draft 11
+    user_pin: import_zod12.default.optional(import_zod12.default.string())
+  }).passthrough().refine(({ tx_code, user_pin }) => !tx_code || !user_pin || user_pin === tx_code, {
+    message: `If both 'tx_code' and 'user_pin' are present they must match`
+  }).transform(({ tx_code, user_pin, ...rest }) => {
+    return {
+      ...rest,
+      ...tx_code ?? user_pin ? { tx_code: tx_code ?? user_pin } : {}
+    };
+  })
+);
+var zAccessTokenResponse = import_zod12.default.object({
+  access_token: import_zod12.default.string(),
+  token_type: import_zod12.default.string(),
+  expires_in: import_zod12.default.optional(import_zod12.default.number().int()),
+  scope: import_zod12.default.optional(import_zod12.default.string()),
+  state: import_zod12.default.optional(import_zod12.default.string()),
+  refresh_token: import_zod12.default.optional(import_zod12.default.string()),
   // Oid4vci specific parameters
-  c_nonce: v12.optional(v12.string()),
-  c_nonce_expires_in: v12.optional(v12.pipe(v12.number(), v12.integer())),
+  c_nonce: import_zod12.default.optional(import_zod12.default.string()),
+  c_nonce_expires_in: import_zod12.default.optional(import_zod12.default.number().int()),
   // TODO: add additional params
-  authorization_details: v12.optional(
-    v12.array(
-      v12.looseObject({
-        // requried when type is openid_credential (so we probably need a discriminator)
-        // credential_identifiers: v.array(v.string()),
-      })
-    )
-  )
-});
-var vAccessTokenErrorResponse = vOauth2ErrorResponse;
+  authorization_details: import_zod12.default.array(
+    import_zod12.default.object({
+      // requried when type is openid_credential (so we probably need a discriminator)
+      // credential_identifiers: z.array(z.string()),
+    }).passthrough()
+  ).optional()
+}).passthrough();
+var zAccessTokenErrorResponse = zOauth2ErrorResponse;
 
 // src/access-token/create-access-token-response.ts
 async function createAccessTokenResponse(options) {
-  const accessTokenResponse = (0, import_utils24.parseWithErrorHandling)(vAccessTokenResponse, {
+  const accessTokenResponse = (0, import_utils24.parseWithErrorHandling)(zAccessTokenResponse, {
     access_token: options.accessToken,
     token_type: options.tokenType,
     expires_in: options.expiresInSeconds,
@@ -1459,18 +1478,16 @@ async function createAccessTokenResponse(options) {
 }
 
 // src/access-token/parse-access-token-request.ts
-var import_utils25 = require("@openid4vc/utils");
-var v13 = __toESM(require("valibot"));
 function parseAccessTokenRequest(options) {
-  const parsedAccessTokenRequest = v13.safeParse(vAccessTokenRequest, options.accessTokenRequest);
+  const parsedAccessTokenRequest = zAccessTokenRequest.safeParse(options.accessTokenRequest);
   if (!parsedAccessTokenRequest.success) {
     throw new Oauth2ServerErrorResponseError({
       error: "invalid_request" /* InvalidRequest */,
       error_description: `Error occured during validation of authorization request.
-${JSON.stringify((0, import_utils25.valibotRecursiveFlattenIssues)(parsedAccessTokenRequest.issues), null, 2)}`
+${JSON.stringify(parsedAccessTokenRequest.error.issues, null, 2)}`
     });
   }
-  const accessTokenRequest = parsedAccessTokenRequest.output;
+  const accessTokenRequest = parsedAccessTokenRequest.data;
   let grant;
   if (accessTokenRequest.grant_type === preAuthorizedCodeGrantIdentifier) {
     if (!accessTokenRequest["pre-authorized_code"]) {
@@ -1518,7 +1535,7 @@ ${JSON.stringify((0, import_utils25.valibotRecursiveFlattenIssues)(parsedAccessT
 }
 
 // src/pkce.ts
-var import_utils26 = require("@openid4vc/utils");
+var import_utils25 = require("@openid4vc/utils");
 var PkceCodeChallengeMethod = /* @__PURE__ */ ((PkceCodeChallengeMethod2) => {
   PkceCodeChallengeMethod2["Plain"] = "plain";
   PkceCodeChallengeMethod2["S256"] = "S256";
@@ -1533,7 +1550,7 @@ async function createPkce(options) {
     throw new Oauth2Error(`Unable to create PKCE code verifier. 'allowedCodeChallengeMethods' is an empty array.`);
   }
   const codeChallengeMethod = allowedCodeChallengeMethods.includes("S256" /* S256 */) ? "S256" /* S256 */ : "plain" /* Plain */;
-  const codeVerifier = options.codeVerifier ?? (0, import_utils26.encodeToBase64Url)(await options.callbacks.generateRandom(64));
+  const codeVerifier = options.codeVerifier ?? (0, import_utils25.encodeToBase64Url)(await options.callbacks.generateRandom(64));
   return {
     codeVerifier,
     codeChallenge: await calculateCodeChallenge({
@@ -1561,7 +1578,7 @@ async function calculateCodeChallenge(options) {
     return options.codeVerifier;
   }
   if (options.codeChallengeMethod === "S256" /* S256 */) {
-    return (0, import_utils26.encodeToBase64Url)(await options.hashCallback((0, import_utils26.decodeUtf8String)(options.codeVerifier), "SHA-256" /* Sha256 */));
+    return (0, import_utils25.encodeToBase64Url)(await options.hashCallback((0, import_utils25.decodeUtf8String)(options.codeVerifier), "SHA-256" /* Sha256 */));
   }
   throw new Oauth2Error(`Unsupported code challenge method ${options.codeChallengeMethod}`);
 }
@@ -1694,69 +1711,69 @@ async function verifyAccessTokenRequestPkce(options, callbacks) {
 }
 
 // src/authorization-challenge/create-authorization-challenge-response.ts
-var import_utils29 = require("@openid4vc/utils");
-
-// src/authorization-challenge/v-authorization-challenge.ts
 var import_utils28 = require("@openid4vc/utils");
-var v15 = __toESM(require("valibot"));
 
-// src/authorization-request/v-authorization-request.ts
+// src/authorization-challenge/z-authorization-challenge.ts
 var import_utils27 = require("@openid4vc/utils");
-var v14 = __toESM(require("valibot"));
-var vAuthorizationRequest = v14.looseObject({
-  response_type: v14.string(),
-  client_id: v14.string(),
-  issuer_state: v14.optional(v14.string()),
-  redirect_uri: v14.optional(v14.pipe(v14.string(), v14.url())),
-  resource: v14.optional(import_utils27.vHttpsUrl),
-  scope: v14.optional(v14.string()),
-  // DPoP jwk thumbprint
-  dpop_jkt: v14.optional(v14.string()),
-  code_challenge: v14.optional(v14.string()),
-  code_challenge_method: v14.optional(v14.string())
-});
-var vPushedAuthorizationRequest = v14.looseObject({
-  request_uri: v14.string(),
-  client_id: v14.string()
-});
-var vPushedAuthorizationResponse = v14.looseObject({
-  request_uri: v14.string(),
-  expires_in: v14.pipe(v14.number(), v14.integer())
-});
+var import_zod14 = __toESM(require("zod"));
 
-// src/authorization-challenge/v-authorization-challenge.ts
-var vAuthorizationChallengeRequest = v15.looseObject({
+// src/authorization-request/z-authorization-request.ts
+var import_utils26 = require("@openid4vc/utils");
+var import_zod13 = __toESM(require("zod"));
+var zAuthorizationRequest = import_zod13.default.object({
+  response_type: import_zod13.default.string(),
+  client_id: import_zod13.default.string(),
+  issuer_state: import_zod13.default.optional(import_zod13.default.string()),
+  redirect_uri: import_zod13.default.string().url().optional(),
+  resource: import_zod13.default.optional(import_utils26.zHttpsUrl),
+  scope: import_zod13.default.optional(import_zod13.default.string()),
+  // DPoP jwk thumbprint
+  dpop_jkt: import_zod13.default.optional(import_zod13.default.string()),
+  code_challenge: import_zod13.default.optional(import_zod13.default.string()),
+  code_challenge_method: import_zod13.default.optional(import_zod13.default.string())
+}).passthrough();
+var zPushedAuthorizationRequest = import_zod13.default.object({
+  request_uri: import_zod13.default.string(),
+  client_id: import_zod13.default.string()
+}).passthrough();
+var zPushedAuthorizationResponse = import_zod13.default.object({
+  request_uri: import_zod13.default.string(),
+  expires_in: import_zod13.default.number().int()
+}).passthrough();
+
+// src/authorization-challenge/z-authorization-challenge.ts
+var zAuthorizationChallengeRequest = import_zod14.default.object({
   // authorization challenge request can include same parameters as an authorization request
   // except for response_type (always `code`), and `client_id` is optional (becase
   // it's possible to do client authentication using different methods)
-  ...v15.omit(vAuthorizationRequest, ["response_type", "client_id"]).entries,
-  client_id: v15.optional(vAuthorizationRequest.entries.client_id),
-  auth_session: v15.optional(v15.string()),
+  ...zAuthorizationRequest.omit({ response_type: true, client_id: true }).shape,
+  client_id: import_zod14.default.optional(zAuthorizationRequest.shape.client_id),
+  auth_session: import_zod14.default.optional(import_zod14.default.string()),
   // DRAFT presentation during issuance
-  presentation_during_issuance_session: v15.optional(v15.string())
-});
-var vAuthorizationChallengeResponse = v15.looseObject({
-  authorization_code: v15.string()
-});
-var vAuthorizationChallengeErrorResponse = v15.looseObject({
-  ...vOauth2ErrorResponse.entries,
-  auth_session: v15.optional(v15.string()),
-  request_uri: v15.optional(v15.string()),
-  expires_in: v15.optional(import_utils28.vInteger),
+  presentation_during_issuance_session: import_zod14.default.optional(import_zod14.default.string())
+}).passthrough();
+var zAuthorizationChallengeResponse = import_zod14.default.object({
+  authorization_code: import_zod14.default.string()
+}).passthrough();
+var zAuthorizationChallengeErrorResponse = import_zod14.default.object({
+  ...zOauth2ErrorResponse.shape,
+  auth_session: import_zod14.default.optional(import_zod14.default.string()),
+  request_uri: import_zod14.default.optional(import_zod14.default.string()),
+  expires_in: import_zod14.default.optional(import_utils27.zInteger),
   // DRAFT: presentation during issuance
-  presentation: v15.optional(v15.string())
-});
+  presentation: import_zod14.default.optional(import_zod14.default.string())
+}).passthrough();
 
 // src/authorization-challenge/create-authorization-challenge-response.ts
 function createAuthorizationChallengeResponse(options) {
-  const authorizationChallengeResponse = (0, import_utils29.parseWithErrorHandling)(vAuthorizationChallengeResponse, {
+  const authorizationChallengeResponse = (0, import_utils28.parseWithErrorHandling)(zAuthorizationChallengeResponse, {
     ...options.additionalPayload,
     authorization_code: options.authorizationCode
   });
   return { authorizationChallengeResponse };
 }
 function createAuthorizationChallengeErrorResponse(options) {
-  const authorizationChallengeErrorResponse = (0, import_utils29.parseWithErrorHandling)(vAuthorizationChallengeErrorResponse, {
+  const authorizationChallengeErrorResponse = (0, import_utils28.parseWithErrorHandling)(zAuthorizationChallengeErrorResponse, {
     ...options.additionalPayload,
     // General FiPA
     error: options.error,
@@ -1772,70 +1789,70 @@ function createAuthorizationChallengeErrorResponse(options) {
 }
 
 // src/authorization-challenge/parse-authorization-challenge-request.ts
-var import_utils30 = require("@openid4vc/utils");
+var import_utils29 = require("@openid4vc/utils");
 function parseAuthorizationChallengeRequest(options) {
-  const authorizationChallengeRequest = (0, import_utils30.parseWithErrorHandling)(
-    vAuthorizationChallengeRequest,
+  const authorizationChallengeRequest = (0, import_utils29.parseWithErrorHandling)(
+    zAuthorizationChallengeRequest,
     options.authorizationChallengeRequest
   );
   return { authorizationChallengeRequest };
 }
 
 // src/client-attestation/clent-attestation.ts
-var import_utils32 = require("@openid4vc/utils");
-
-// src/client-attestation/v-client-attestation.ts
-var v16 = __toESM(require("valibot"));
 var import_utils31 = require("@openid4vc/utils");
-var vOauthClientAttestationHeader = v16.literal("OAuth-Client-Attestation");
-var oauthClientAttestationHeader = vOauthClientAttestationHeader.literal;
-var vClientAttestationJwtPayload = v16.looseObject({
-  ...vJwtPayload.entries,
-  iss: v16.string(),
-  sub: v16.string(),
-  exp: import_utils31.vInteger,
-  cnf: v16.looseObject({
-    jwk: vJwk,
-    key_type: v16.optional(
-      v16.union([
-        v16.picklist(["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]),
-        v16.string()
+
+// src/client-attestation/z-client-attestation.ts
+var import_utils30 = require("@openid4vc/utils");
+var import_zod15 = __toESM(require("zod"));
+var zOauthClientAttestationHeader = import_zod15.default.literal("OAuth-Client-Attestation");
+var oauthClientAttestationHeader = zOauthClientAttestationHeader.value;
+var zClientAttestationJwtPayload = import_zod15.default.object({
+  ...zJwtPayload.shape,
+  iss: import_zod15.default.string(),
+  sub: import_zod15.default.string(),
+  exp: import_utils30.zInteger,
+  cnf: import_zod15.default.object({
+    jwk: zJwk,
+    key_type: import_zod15.default.optional(
+      import_zod15.default.union([
+        import_zod15.default.enum(["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]),
+        import_zod15.default.string()
       ])
     ),
-    user_authentication: v16.optional(
-      v16.union([
-        v16.picklist(["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]),
-        v16.string()
+    user_authentication: import_zod15.default.optional(
+      import_zod15.default.union([
+        import_zod15.default.enum(["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]),
+        import_zod15.default.string()
       ])
     )
-  }),
-  aal: v16.optional(v16.string())
-});
-var vClientAttestationJwtHeader = v16.looseObject({
-  ...vJwtHeader.entries,
-  typ: v16.literal("oauth-client-attestation+jwt")
-});
-var vOauthClientAttestationPopHeader = v16.literal("OAuth-Client-Attestation-PoP");
-var oauthClientAttestationPopHeader = vOauthClientAttestationPopHeader.literal;
-var vClientAttestationPopJwtPayload = v16.looseObject({
-  ...vJwtPayload.entries,
-  iss: v16.string(),
-  exp: import_utils31.vInteger,
-  aud: import_utils31.vHttpsUrl,
-  jti: v16.string(),
-  nonce: v16.optional(v16.string())
-});
-var vClientAttestationPopJwtHeader = v16.looseObject({
-  ...vJwtHeader.entries,
-  typ: v16.literal("oauth-client-attestation-pop+jwt")
-});
+  }).passthrough(),
+  aal: import_zod15.default.optional(import_zod15.default.string())
+}).passthrough();
+var zClientAttestationJwtHeader = import_zod15.default.object({
+  ...zJwtHeader.shape,
+  typ: import_zod15.default.literal("oauth-client-attestation+jwt")
+}).passthrough();
+var zOauthClientAttestationPopHeader = import_zod15.default.literal("OAuth-Client-Attestation-PoP");
+var oauthClientAttestationPopHeader = zOauthClientAttestationPopHeader.value;
+var zClientAttestationPopJwtPayload = import_zod15.default.object({
+  ...zJwtPayload.shape,
+  iss: import_zod15.default.string(),
+  exp: import_utils30.zInteger,
+  aud: import_utils30.zHttpsUrl,
+  jti: import_zod15.default.string(),
+  nonce: import_zod15.default.optional(import_zod15.default.string())
+}).passthrough();
+var zClientAttestationPopJwtHeader = import_zod15.default.object({
+  ...zJwtHeader.shape,
+  typ: import_zod15.default.literal("oauth-client-attestation-pop+jwt")
+}).passthrough();
 
 // src/client-attestation/clent-attestation.ts
 async function verifyClientAttestationJwt(options) {
   const { header, payload } = decodeJwt({
     jwt: options.clientAttestationJwt,
-    headerSchema: vClientAttestationJwtHeader,
-    payloadSchema: vClientAttestationJwtPayload
+    headerSchema: zClientAttestationJwtHeader,
+    payloadSchema: zClientAttestationJwtPayload
   });
   const { signer } = await verifyJwt({
     signer: jwtSignerFromJwt({ header, payload }),
@@ -1853,14 +1870,14 @@ async function verifyClientAttestationJwt(options) {
   };
 }
 async function createClientAttestationJwt(options) {
-  const header = (0, import_utils32.parseWithErrorHandling)(vClientAttestationJwtHeader, {
+  const header = (0, import_utils31.parseWithErrorHandling)(zClientAttestationJwtHeader, {
     typ: "oauth-client-attestation+jwt",
     ...jwtHeaderFromJwtSigner(options.signer)
   });
-  const payload = (0, import_utils32.parseWithErrorHandling)(vClientAttestationJwtPayload, {
+  const payload = (0, import_utils31.parseWithErrorHandling)(zClientAttestationJwtPayload, {
     iss: options.issuer,
-    iat: (0, import_utils32.dateToSeconds)(options.issuedAt),
-    exp: (0, import_utils32.dateToSeconds)(options.expiresAt),
+    iat: (0, import_utils31.dateToSeconds)(options.issuedAt),
+    exp: (0, import_utils31.dateToSeconds)(options.expiresAt),
     sub: options.clientId,
     cnf: options.confirmation,
     ...options.additionalPayload
@@ -1887,7 +1904,7 @@ function extractClientAttestationJwtsFromHeaders(headers) {
 }
 
 // src/client-attestation/client-attestation-pop.ts
-var import_utils33 = require("@openid4vc/utils");
+var import_utils32 = require("@openid4vc/utils");
 async function createClientAttestationForRequest(options) {
   const clientAttestationPopJwt = await createClientAttestationPopJwt({
     authorizationServer: options.authorizationServer,
@@ -1911,8 +1928,8 @@ async function createClientAttestationForRequest(options) {
 async function verifyClientAttestationPopJwt(options) {
   const { header, payload } = decodeJwt({
     jwt: options.clientAttestationPopJwt,
-    headerSchema: vClientAttestationPopJwtHeader,
-    payloadSchema: vClientAttestationPopJwtPayload
+    headerSchema: zClientAttestationPopJwtHeader,
+    payloadSchema: zClientAttestationPopJwtPayload
   });
   if (payload.iss !== options.clientAttestation.payload.sub) {
     throw new Oauth2Error(
@@ -1945,22 +1962,22 @@ async function verifyClientAttestationPopJwt(options) {
   };
 }
 async function createClientAttestationPopJwt(options) {
-  const header = (0, import_utils33.parseWithErrorHandling)(vClientAttestationPopJwtHeader, {
+  const header = (0, import_utils32.parseWithErrorHandling)(zClientAttestationPopJwtHeader, {
     typ: "oauth-client-attestation-pop+jwt",
     alg: options.signer.alg
   });
   const clientAttestation = decodeJwt({
     jwt: options.clientAttestation,
-    headerSchema: vClientAttestationJwtHeader,
-    payloadSchema: vClientAttestationJwtPayload
+    headerSchema: zClientAttestationJwtHeader,
+    payloadSchema: zClientAttestationJwtPayload
   });
-  const expiresAt = options.expiresAt ?? (0, import_utils33.addSecondsToDate)(options.issuedAt ?? /* @__PURE__ */ new Date(), 1 * 60);
-  const payload = (0, import_utils33.parseWithErrorHandling)(vClientAttestationPopJwtPayload, {
+  const expiresAt = options.expiresAt ?? (0, import_utils32.addSecondsToDate)(options.issuedAt ?? /* @__PURE__ */ new Date(), 1 * 60);
+  const payload = (0, import_utils32.parseWithErrorHandling)(zClientAttestationPopJwtPayload, {
     aud: options.authorizationServer,
     iss: clientAttestation.payload.sub,
-    iat: (0, import_utils33.dateToSeconds)(options.issuedAt),
-    exp: (0, import_utils33.dateToSeconds)(expiresAt),
-    jti: (0, import_utils33.encodeToBase64Url)(await options.callbacks.generateRandom(32)),
+    iat: (0, import_utils32.dateToSeconds)(options.issuedAt),
+    exp: (0, import_utils32.dateToSeconds)(expiresAt),
+    jti: (0, import_utils32.encodeToBase64Url)(await options.callbacks.generateRandom(32)),
     nonce: options.nonce,
     ...options.additionalPayload
   });
@@ -1977,8 +1994,8 @@ var Oauth2AuthorizationServer = class {
     this.options = options;
   }
   createAuthorizationServerMetadata(authorizationServerMetadata) {
-    return (0, import_utils34.parseWithErrorHandling)(
-      vAuthorizationServerMetadata,
+    return (0, import_utils33.parseWithErrorHandling)(
+      zAuthorizationServerMetadata,
       authorizationServerMetadata,
       "Error validating authorization server metadata"
     );
@@ -2100,12 +2117,11 @@ var Oauth2ResourceServer = class {
 };
 
 // src/Oauth2Client.ts
-var import_utils41 = require("@openid4vc/utils");
+var import_utils40 = require("@openid4vc/utils");
 
 // src/access-token/retrieve-access-token.ts
+var import_utils34 = require("@openid4vc/utils");
 var import_utils35 = require("@openid4vc/utils");
-var import_utils36 = require("@openid4vc/utils");
-var v17 = __toESM(require("valibot"));
 async function retrievePreAuthorizedCodeAccessToken(options) {
   const request = {
     grant_type: preAuthorizedCodeGrantIdentifier,
@@ -2158,9 +2174,9 @@ async function retrieveRefreshTokenAccessToken(options) {
   });
 }
 async function retrieveAccessToken(options) {
-  const fetchWithValibot = (0, import_utils35.createValibotFetcher)(options.callbacks.fetch);
-  const accessTokenRequest = (0, import_utils35.parseWithErrorHandling)(
-    vAccessTokenRequest,
+  const fetchWithZod = (0, import_utils34.createZodFetcher)(options.callbacks.fetch);
+  const accessTokenRequest = (0, import_utils34.parseWithErrorHandling)(
+    zAccessTokenRequest,
     options.request,
     "Error validating access token request"
   );
@@ -2184,44 +2200,43 @@ async function retrieveAccessToken(options) {
         callbacks: options.callbacks,
         nonce: dpop.nonce
       }) : void 0;
-      const requestQueryParams = (0, import_utils35.objectToQueryParams)({
+      const requestQueryParams = (0, import_utils34.objectToQueryParams)({
         ...accessTokenRequest,
         ...clientAttestation?.body
       });
-      const { response, result } = await fetchWithValibot(
-        vAccessTokenResponse,
-        import_utils35.ContentType.Json,
+      const { response, result } = await fetchWithZod(
+        zAccessTokenResponse,
+        import_utils34.ContentType.Json,
         options.authorizationServerMetadata.token_endpoint,
         {
           body: requestQueryParams.toString(),
           method: "POST",
           headers: {
-            "Content-Type": import_utils35.ContentType.XWwwFormUrlencoded,
+            "Content-Type": import_utils34.ContentType.XWwwFormUrlencoded,
             ...clientAttestation?.headers,
             ...dpopHeaders
           }
         }
       );
       if (!response.ok || !result) {
-        const tokenErrorResponse = v17.safeParse(
-          vAccessTokenErrorResponse,
+        const tokenErrorResponse = zAccessTokenErrorResponse.safeParse(
           await response.clone().json().catch(() => null)
         );
         if (tokenErrorResponse.success) {
           throw new Oauth2ClientErrorResponseError(
             `Unable to retrieve access token from '${options.authorizationServerMetadata.token_endpoint}'. Received token error response with status ${response.status}`,
-            tokenErrorResponse.output,
+            tokenErrorResponse.data,
             response
           );
         }
-        throw new import_utils36.InvalidFetchResponseError(
+        throw new import_utils35.InvalidFetchResponseError(
           `Unable to retrieve access token from '${options.authorizationServerMetadata.token_endpoint}'. Received response with status ${response.status}`,
           await response.clone().text(),
           response
         );
       }
       if (!result.success) {
-        throw new ValidationError("Error validating access token response", result.issues);
+        throw new ValidationError("Error validating access token response", result.error);
       }
       const dpopNonce = extractDpopNonceFromHeaders(response.headers) ?? void 0;
       return {
@@ -2229,18 +2244,17 @@ async function retrieveAccessToken(options) {
           ...dpop,
           nonce: dpopNonce
         } : void 0,
-        accessTokenResponse: result.output
+        accessTokenResponse: result.data
       };
     }
   });
 }
 
 // src/authorization-challenge/send-authorization-challenge.ts
+var import_utils36 = require("@openid4vc/utils");
 var import_utils37 = require("@openid4vc/utils");
-var import_utils38 = require("@openid4vc/utils");
-var v18 = __toESM(require("valibot"));
 async function sendAuthorizationChallengeRequest(options) {
-  const fetchWithValibot = (0, import_utils37.createValibotFetcher)(options.callbacks.fetch);
+  const fetchWithZod = (0, import_utils36.createZodFetcher)(options.callbacks.fetch);
   const authorizationServerMetadata = options.authorizationServerMetadata;
   const authorizationChallengeEndpoint = authorizationServerMetadata.authorization_challenge_endpoint;
   if (!authorizationChallengeEndpoint) {
@@ -2258,7 +2272,7 @@ async function sendAuthorizationChallengeRequest(options) {
     clientAttestation: options.clientAttestation,
     callbacks: options.callbacks
   }) : void 0;
-  const authorizationChallengeRequest = (0, import_utils37.parseWithErrorHandling)(vAuthorizationChallengeRequest, {
+  const authorizationChallengeRequest = (0, import_utils36.parseWithErrorHandling)(zAuthorizationChallengeRequest, {
     ...options.additionalRequestPayload,
     auth_session: options.authSession,
     client_id: options.clientId,
@@ -2281,40 +2295,39 @@ async function sendAuthorizationChallengeRequest(options) {
         callbacks: options.callbacks,
         nonce: dpop.nonce
       }) : void 0;
-      const { response, result } = await fetchWithValibot(
-        vAuthorizationChallengeResponse,
-        import_utils37.ContentType.Json,
+      const { response, result } = await fetchWithZod(
+        zAuthorizationChallengeResponse,
+        import_utils36.ContentType.Json,
         authorizationChallengeEndpoint,
         {
           method: "POST",
-          body: (0, import_utils37.objectToQueryParams)(authorizationChallengeRequest).toString(),
+          body: (0, import_utils36.objectToQueryParams)(authorizationChallengeRequest).toString(),
           headers: {
             ...clientAttestation?.headers,
             ...dpopHeaders,
-            "Content-Type": import_utils37.ContentType.XWwwFormUrlencoded
+            "Content-Type": import_utils36.ContentType.XWwwFormUrlencoded
           }
         }
       );
       if (!response.ok || !result) {
-        const authorizationChallengeErrorResponse = v18.safeParse(
-          vAuthorizationChallengeErrorResponse,
+        const authorizationChallengeErrorResponse = zAuthorizationChallengeErrorResponse.safeParse(
           await response.clone().json().catch(() => null)
         );
         if (authorizationChallengeErrorResponse.success) {
           throw new Oauth2ClientAuthorizationChallengeError(
             `Error requesting authorization code from authorization challenge endpoint '${authorizationServerMetadata.authorization_challenge_endpoint}'. Received response with status ${response.status}`,
-            authorizationChallengeErrorResponse.output,
+            authorizationChallengeErrorResponse.data,
             response
           );
         }
-        throw new import_utils38.InvalidFetchResponseError(
+        throw new import_utils37.InvalidFetchResponseError(
           `Error requesting authorization code from authorization challenge endpoint '${authorizationServerMetadata.authorization_challenge_endpoint}'. Received response with status ${response.status}`,
           await response.clone().text(),
           response
         );
       }
       if (!result.success) {
-        throw new import_utils37.ValidationError("Error validating authorization challenge response", result.issues);
+        throw new import_utils36.ValidationError("Error validating authorization challenge response", result.error);
       }
       const dpopNonce = extractDpopNonceFromHeaders(response.headers) ?? void 0;
       return {
@@ -2323,16 +2336,15 @@ async function sendAuthorizationChallengeRequest(options) {
           ...dpop,
           nonce: dpopNonce
         } : void 0,
-        authorizationChallengeResponse: result.output
+        authorizationChallengeResponse: result.data
       };
     }
   });
 }
 
 // src/authorization-request/create-authorization-request.ts
+var import_utils38 = require("@openid4vc/utils");
 var import_utils39 = require("@openid4vc/utils");
-var import_utils40 = require("@openid4vc/utils");
-var v19 = __toESM(require("valibot"));
 async function createAuthorizationRequestUrl(options) {
   const authorizationServerMetadata = options.authorizationServerMetadata;
   const pushedAuthorizationRequestEndpoint = authorizationServerMetadata.pushed_authorization_request_endpoint;
@@ -2414,7 +2426,7 @@ async function createAuthorizationRequestUrl(options) {
       });
     }
   }
-  const authorizationRequestUrl = `${authorizationServerMetadata.authorization_endpoint}?${(0, import_utils39.objectToQueryParams)(pushedAuthorizationRequest ?? authorizationRequest).toString()}`;
+  const authorizationRequestUrl = `${authorizationServerMetadata.authorization_endpoint}?${(0, import_utils38.objectToQueryParams)(pushedAuthorizationRequest ?? authorizationRequest).toString()}`;
   return {
     authorizationRequestUrl,
     pkce,
@@ -2422,50 +2434,49 @@ async function createAuthorizationRequestUrl(options) {
   };
 }
 async function pushAuthorizationRequest(options) {
-  const fetchWithValibot = (0, import_utils39.createValibotFetcher)(options.fetch);
+  const fetchWithZod = (0, import_utils38.createZodFetcher)(options.fetch);
   if (options.authorizationRequest.request_uri) {
     throw new Oauth2Error(
       `Authorization request contains 'request_uri' parameter. This is not allowed for pushed authorization reuqests.`
     );
   }
-  const { response, result } = await fetchWithValibot(
-    vPushedAuthorizationResponse,
-    import_utils39.ContentType.Json,
+  const { response, result } = await fetchWithZod(
+    zPushedAuthorizationResponse,
+    import_utils38.ContentType.Json,
     options.pushedAuthorizationRequestEndpoint,
     {
       method: "POST",
-      body: (0, import_utils39.objectToQueryParams)(options.authorizationRequest).toString(),
+      body: (0, import_utils38.objectToQueryParams)(options.authorizationRequest).toString(),
       headers: {
         ...options.headers,
-        "Content-Type": import_utils39.ContentType.XWwwFormUrlencoded
+        "Content-Type": import_utils38.ContentType.XWwwFormUrlencoded
       }
     }
   );
   if (!response.ok || !result) {
-    const parErrorResponse = v19.safeParse(
-      vOauth2ErrorResponse,
+    const parErrorResponse = zOauth2ErrorResponse.safeParse(
       await response.clone().json().catch(() => null)
     );
     if (parErrorResponse.success) {
       throw new Oauth2ClientErrorResponseError(
         `Unable to push authorization request to '${options.pushedAuthorizationRequestEndpoint}'. Received response with status ${response.status}`,
-        parErrorResponse.output,
+        parErrorResponse.data,
         response
       );
     }
-    throw new import_utils40.InvalidFetchResponseError(
+    throw new import_utils39.InvalidFetchResponseError(
       `Unable to push authorization request to '${options.pushedAuthorizationRequestEndpoint}'. Received response with status ${response.status}`,
       await response.clone().text(),
       response
     );
   }
   if (!result.success) {
-    throw new ValidationError("Error validating pushed authorization response", result.issues);
+    throw new ValidationError("Error validating pushed authorization response", result.error);
   }
   const dpopNonce = extractDpopNonceFromHeaders(response.headers);
   return {
     dpopNonce,
-    pushedAuthorizationResponse: result.output
+    pushedAuthorizationResponse: result.data
   };
 }
 
@@ -2523,7 +2534,7 @@ var Oauth2Client = class {
         const isRecoverableError = error instanceof Oauth2ClientAuthorizationChallengeError && error.errorResponse.error === "redirect_to_web" /* RedirectToWeb */;
         if (!isRecoverableError) throw error;
         if (error.errorResponse.request_uri) {
-          const authorizationRequestUrl = `${options.authorizationServerMetadata.authorization_endpoint}?${(0, import_utils41.objectToQueryParams)(
+          const authorizationRequestUrl = `${options.authorizationServerMetadata.authorization_endpoint}?${(0, import_utils40.objectToQueryParams)(
             {
               request_uri: error.errorResponse.request_uri,
               client_id: options.clientId
@@ -2688,16 +2699,16 @@ var Oauth2Client = class {
   refreshTokenGrantIdentifier,
   resourceRequest,
   setGlobalConfig,
-  vAuthorizationCodeGrantIdentifier,
-  vAuthorizationServerMetadata,
-  vCompactJwt,
-  vJwk,
-  vJwtHeader,
-  vJwtPayload,
-  vOauth2ErrorResponse,
-  vPreAuthorizedCodeGrantIdentifier,
-  vRefreshTokenGrantIdentifier,
   verifyJwt,
-  verifyResourceRequest
+  verifyResourceRequest,
+  zAuthorizationCodeGrantIdentifier,
+  zAuthorizationServerMetadata,
+  zCompactJwt,
+  zJwk,
+  zJwtHeader,
+  zJwtPayload,
+  zOauth2ErrorResponse,
+  zPreAuthorizedCodeGrantIdentifier,
+  zRefreshTokenGrantIdentifier
 });
 //# sourceMappingURL=index.js.map