@openid4vc/oauth2 0.3.0-alpha-20250206100745 → 0.3.0-alpha-20250224151429

package/dist/index.js

@@ -31,7 +31,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var src_exports = {};
 __export(src_exports, {
   HashAlgorithm: () => HashAlgorithm,
-  InvalidFetchResponseError: () => import_utils42.InvalidFetchResponseError,
+  InvalidFetchResponseError: () => import_utils43.InvalidFetchResponseError,
   Oauth2AuthorizationServer: () => Oauth2AuthorizationServer,
   Oauth2Client: () => Oauth2Client,
   Oauth2ClientAuthorizationChallengeError: () => Oauth2ClientAuthorizationChallengeError,
@@ -52,24 +52,28 @@ __export(src_exports, {
   clientAuthenticationDynamic: () => clientAuthenticationDynamic,
   clientAuthenticationNone: () => clientAuthenticationNone,
   decodeJwt: () => decodeJwt,
+  decodeJwtHeader: () => decodeJwtHeader,
   fetchAuthorizationServerMetadata: () => fetchAuthorizationServerMetadata,
   fetchJwks: () => fetchJwks,
   fetchWellKnownMetadata: () => fetchWellKnownMetadata,
   getAuthorizationServerMetadataFromList: () => getAuthorizationServerMetadataFromList,
-  getGlobalConfig: () => import_utils41.getGlobalConfig,
+  getGlobalConfig: () => import_utils42.getGlobalConfig,
   isJwkInSet: () => isJwkInSet,
   jwtHeaderFromJwtSigner: () => jwtHeaderFromJwtSigner,
   jwtSignerFromJwt: () => jwtSignerFromJwt,
   preAuthorizedCodeGrantIdentifier: () => preAuthorizedCodeGrantIdentifier,
   refreshTokenGrantIdentifier: () => refreshTokenGrantIdentifier,
   resourceRequest: () => resourceRequest,
-  setGlobalConfig: () => import_utils41.setGlobalConfig,
+  setGlobalConfig: () => import_utils42.setGlobalConfig,
   verifyJwt: () => verifyJwt,
   verifyResourceRequest: () => verifyResourceRequest,
+  zAlgValueNotNone: () => zAlgValueNotNone,
   zAuthorizationCodeGrantIdentifier: () => zAuthorizationCodeGrantIdentifier,
   zAuthorizationServerMetadata: () => zAuthorizationServerMetadata,
+  zCompactJwe: () => zCompactJwe,
   zCompactJwt: () => zCompactJwt,
   zJwk: () => zJwk,
+  zJwkSet: () => zJwkSet,
   zJwtHeader: () => zJwtHeader,
   zJwtPayload: () => zJwtPayload,
   zOauth2ErrorResponse: () => zOauth2ErrorResponse,
@@ -77,7 +81,7 @@ __export(src_exports, {
   zRefreshTokenGrantIdentifier: () => zRefreshTokenGrantIdentifier
 });
 module.exports = __toCommonJS(src_exports);
-var import_utils41 = require("@openid4vc/utils");
+var import_utils42 = require("@openid4vc/utils");
 
 // src/common/z-oauth2-error.ts
 var import_zod = __toESM(require("zod"));
@@ -104,6 +108,17 @@ var Oauth2ErrorCodes = /* @__PURE__ */ ((Oauth2ErrorCodes2) => {
   Oauth2ErrorCodes2["InvalidProof"] = "invalid_proof";
   Oauth2ErrorCodes2["InvalidNonce"] = "invalid_nonce";
   Oauth2ErrorCodes2["InvalidEncryptionParameters"] = "invalid_encryption_parameters";
+  Oauth2ErrorCodes2["InvalidRequestUri"] = "invalid_request_uri";
+  Oauth2ErrorCodes2["InvalidRequestObject"] = "invalid_request_object";
+  Oauth2ErrorCodes2["RequestNotSupported"] = "request_not_supported";
+  Oauth2ErrorCodes2["RequestUriNotSupported"] = "request_uri_not_supported";
+  Oauth2ErrorCodes2["VpFormatsNotSupported"] = "vp_formats_not_supported";
+  Oauth2ErrorCodes2["AccessDenied"] = "access_denied";
+  Oauth2ErrorCodes2["InvalidPresentationDefinitionUri"] = "invalid_presentation_definition_uri";
+  Oauth2ErrorCodes2["InvalidPresentationDefinitionReference"] = "invalid_presentation_definition_reference";
+  Oauth2ErrorCodes2["InvalidRequestUriMethod"] = "invalid_request_uri_method";
+  Oauth2ErrorCodes2["InvalidTransactionData"] = "invalid_transaction_data";
+  Oauth2ErrorCodes2["WalletUnavailable"] = "wallet_unavailable";
   return Oauth2ErrorCodes2;
 })(Oauth2ErrorCodes || {});
 var zOauth2ErrorResponse = import_zod.default.object({
@@ -244,69 +259,13 @@ var zJwk = import_zod3.default.object({
   q: import_zod3.default.optional(import_zod3.default.string()),
   qi: import_zod3.default.optional(import_zod3.default.string()),
   use: import_zod3.default.optional(import_zod3.default.string()),
-  x5c: import_zod3.default.optional(import_zod3.default.string()),
+  x5c: import_zod3.default.optional(import_zod3.default.array(import_zod3.default.string())),
   x5t: import_zod3.default.optional(import_zod3.default.string()),
   "x5t#S256": import_zod3.default.optional(import_zod3.default.string()),
   x5u: import_zod3.default.optional(import_zod3.default.string())
 }).passthrough();
 var zJwkSet = import_zod3.default.object({ keys: import_zod3.default.array(zJwk) }).passthrough();
 
-// src/common/jwt/verify-jwt.ts
-var import_utils2 = require("@openid4vc/utils");
-
-// src/error/Oauth2JwtVerificationError.ts
-var Oauth2JwtVerificationError = class extends Oauth2Error {
-  constructor(message, options) {
-    const errorMessage = message ?? "Error verifiying jwt.";
-    super(errorMessage, options);
-  }
-};
-
-// src/common/jwt/verify-jwt.ts
-async function verifyJwt(options) {
-  const errorMessage = options.errorMessage ?? "Error during verification of jwt.";
-  let signerJwk;
-  try {
-    const result = await options.verifyJwtCallback(options.signer, {
-      header: options.header,
-      payload: options.payload,
-      compact: options.compact
-    });
-    if (!result.verified) throw new Oauth2JwtVerificationError(errorMessage);
-    signerJwk = result.signerJwk;
-  } catch (error) {
-    if (error instanceof Oauth2JwtVerificationError) throw error;
-    throw new Oauth2JwtVerificationError(errorMessage, { cause: error });
-  }
-  const nowInSeconds = (0, import_utils2.dateToSeconds)(options.now ?? /* @__PURE__ */ new Date());
-  const skewInSeconds = options.allowedSkewInSeconds ?? 0;
-  const timeBasedValidation = options.skipTimeBasedValidation !== void 0 ? !options.skipTimeBasedValidation : true;
-  if (timeBasedValidation && options.payload.nbf && nowInSeconds < options.payload.nbf - skewInSeconds) {
-    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'nbf' is in the future`);
-  }
-  if (timeBasedValidation && options.payload.exp && nowInSeconds > options.payload.exp + skewInSeconds) {
-    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'exp' is in the past`);
-  }
-  if (options.expectedAudience && options.expectedAudience !== options.payload.aud) {
-    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'aud' does not match expected value.`);
-  }
-  if (options.expectedIssuer && options.expectedIssuer !== options.payload.iss) {
-    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'iss' does not match expected value.`);
-  }
-  if (options.expectedNonce && options.expectedNonce !== options.payload.nonce) {
-    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'nonce' does not match expected value.`);
-  }
-  if (options.expectedSubject && options.expectedSubject !== options.payload.sub) {
-    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'sub' does not match expected value.`);
-  }
-  return {
-    signer: {
-      ...options.signer,
-      publicJwk: signerJwk
-    }
-  };
-}
-
 // src/common/jwt/decode-jwt.ts
 var import_utils4 = require("@openid4vc/utils");
 
@@ -318,8 +277,11 @@ var Oauth2JwtParseError = class extends Oauth2Error {
   }
 };
 
-// src/common/jwt/z-jwt.ts
+// src/common/jwt/decode-jwt-header.ts
 var import_utils3 = require("@openid4vc/utils");
+
+// src/common/jwt/z-jwt.ts
+var import_utils2 = require("@openid4vc/utils");
 var import_zod5 = __toESM(require("zod"));
 
 // src/common/z-common.ts
@@ -338,9 +300,9 @@ var zJwtConfirmationPayload = import_zod5.default.object({
 var zJwtPayload = import_zod5.default.object({
   iss: import_zod5.default.string().optional(),
   aud: import_zod5.default.string().optional(),
-  iat: import_utils3.zInteger.optional(),
-  exp: import_utils3.zInteger.optional(),
-  nbf: import_utils3.zInteger.optional(),
+  iat: import_utils2.zInteger.optional(),
+  exp: import_utils2.zInteger.optional(),
+  nbf: import_utils2.zInteger.optional(),
   nonce: import_zod5.default.string().optional(),
   jti: import_zod5.default.string().optional(),
   cnf: zJwtConfirmationPayload.optional(),
@@ -356,27 +318,43 @@ var zJwtHeader = import_zod5.default.object({
   trust_chain: import_zod5.default.array(import_zod5.default.string()).optional()
 }).passthrough();
 
+// src/common/jwt/decode-jwt-header.ts
+function decodeJwtHeader(options) {
+  const jwtParts = options.jwt.split(".");
+  if (jwtParts.length <= 2) {
+    throw new Oauth2JwtParseError("Jwt is not a valid jwt, unable to decode");
+  }
+  let headerJson;
+  try {
+    headerJson = (0, import_utils3.stringToJsonWithErrorHandling)(
+      (0, import_utils3.encodeToUtf8String)((0, import_utils3.decodeBase64)(jwtParts[0])),
+      "Unable to parse jwt header to JSON"
+    );
+  } catch (error) {
+    throw new Oauth2JwtParseError(`Error parsing JWT. ${error instanceof Error ? error.message : ""}`);
+  }
+  const header = (0, import_utils3.parseWithErrorHandling)(options.headerSchema ?? zJwtHeader, headerJson);
+  return {
+    header
+  };
+}
+
 // src/common/jwt/decode-jwt.ts
 function decodeJwt(options) {
   const jwtParts = options.jwt.split(".");
   if (jwtParts.length !== 3) {
     throw new Oauth2JwtParseError("Jwt is not a valid jwt, unable to decode");
   }
-  let headerJson;
   let payloadJson;
   try {
-    headerJson = (0, import_utils4.stringToJsonWithErrorHandling)(
-      (0, import_utils4.encodeToUtf8String)((0, import_utils4.decodeBase64)(jwtParts[0])),
-      "Unable to parse jwt header to JSON"
-    );
     payloadJson = (0, import_utils4.stringToJsonWithErrorHandling)(
       (0, import_utils4.encodeToUtf8String)((0, import_utils4.decodeBase64)(jwtParts[1])),
       "Unable to parse jwt payload to JSON"
     );
   } catch (error) {
-    throw new Oauth2JwtParseError("Error parsing JWT");
+    throw new Oauth2JwtParseError(`Error parsing JWT. ${error instanceof Error ? error.message : ""}`);
   }
-  const header = (0, import_utils4.parseWithErrorHandling)(options.headerSchema ?? zJwtHeader, headerJson);
+  const { header } = decodeJwtHeader({ jwt: options.jwt, headerSchema: options.headerSchema });
   const payload = (0, import_utils4.parseWithErrorHandling)(options.payloadSchema ?? zJwtPayload, payloadJson);
   return {
     header,
@@ -467,6 +445,41 @@ function jwtSignerFromJwt({ header, payload }) {
   };
 }
 
+// src/common/jwt/z-jwe.ts
+var import_zod6 = require("zod");
+var zCompactJwe = import_zod6.z.string().regex(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, {
+  message: "Not a valid compact jwe"
+});
+
+// src/index.ts
+var import_utils43 = require("@openid4vc/utils");
+
+// src/error/Oauth2ClientErrorResponseError.ts
+var Oauth2ClientErrorResponseError = class extends Oauth2Error {
+  constructor(message, errorResponse, response) {
+    super(`${message}
+${JSON.stringify(errorResponse, null, 2)}`);
+    this.errorResponse = errorResponse;
+    this.response = response.clone();
+  }
+};
+
+// src/error/Oauth2ClientAuthorizationChallengeError.ts
+var Oauth2ClientAuthorizationChallengeError = class extends Oauth2ClientErrorResponseError {
+  constructor(message, errorResponse, response) {
+    super(message, errorResponse, response);
+    this.errorResponse = errorResponse;
+  }
+};
+
+// src/error/Oauth2JwtVerificationError.ts
+var Oauth2JwtVerificationError = class extends Oauth2Error {
+  constructor(message, options) {
+    const errorMessage = message ?? "Error verifiying jwt.";
+    super(errorMessage, options);
+  }
+};
+
 // src/error/Oauth2ResourceUnauthorizedError.ts
 var import_utils5 = require("@openid4vc/utils");
 var Oauth2ResourceUnauthorizedError = class _Oauth2ResourceUnauthorizedError extends Oauth2Error {
@@ -505,27 +518,6 @@ ${JSON.stringify(wwwAuthenticateHeaders, null, 2)}`);
   }
 };
 
-// src/index.ts
-var import_utils42 = require("@openid4vc/utils");
-
-// src/error/Oauth2ClientErrorResponseError.ts
-var Oauth2ClientErrorResponseError = class extends Oauth2Error {
-  constructor(message, errorResponse, response) {
-    super(`${message}
-${JSON.stringify(errorResponse, null, 2)}`);
-    this.errorResponse = errorResponse;
-    this.response = response.clone();
-  }
-};
-
-// src/error/Oauth2ClientAuthorizationChallengeError.ts
-var Oauth2ClientAuthorizationChallengeError = class extends Oauth2ClientErrorResponseError {
-  constructor(message, errorResponse, response) {
-    super(message, errorResponse, response);
-    this.errorResponse = errorResponse;
-  }
-};
-
 // src/error/Oauth2ServerErrorResponseError.ts
 var Oauth2ServerErrorResponseError = class extends Oauth2Error {
   constructor(errorResponse, options) {
@@ -539,50 +531,12 @@ ${JSON.stringify(errorResponse, null, 2)}`,
   }
 };
 
-// src/metadata/authorization-server/z-authorization-server-metadata.ts
-var import_utils6 = require("@openid4vc/utils");
-var import_zod6 = __toESM(require("zod"));
-var zAuthorizationServerMetadata = import_zod6.default.object({
-  issuer: import_utils6.zHttpsUrl,
-  token_endpoint: import_utils6.zHttpsUrl,
-  token_endpoint_auth_methods_supported: import_zod6.default.optional(import_zod6.default.array(import_zod6.default.string())),
-  authorization_endpoint: import_zod6.default.optional(import_utils6.zHttpsUrl),
-  jwks_uri: import_zod6.default.optional(import_utils6.zHttpsUrl),
-  // RFC7636
-  code_challenge_methods_supported: import_zod6.default.optional(import_zod6.default.array(import_zod6.default.string())),
-  // RFC9449
-  dpop_signing_alg_values_supported: import_zod6.default.optional(import_zod6.default.array(import_zod6.default.string())),
-  // RFC9126
-  require_pushed_authorization_requests: import_zod6.default.optional(import_zod6.default.boolean()),
-  pushed_authorization_request_endpoint: import_zod6.default.optional(import_utils6.zHttpsUrl),
-  // RFC9068
-  introspection_endpoint: import_zod6.default.optional(import_utils6.zHttpsUrl),
-  introspection_endpoint_auth_methods_supported: import_zod6.default.optional(
-    import_zod6.default.array(import_zod6.default.union([import_zod6.default.literal("client_secret_jwt"), import_zod6.default.literal("private_key_jwt"), import_zod6.default.string()]))
-  ),
-  introspection_endpoint_auth_signing_alg_values_supported: import_zod6.default.optional(import_zod6.default.array(zAlgValueNotNone)),
-  // FiPA (no RFC yet)
-  authorization_challenge_endpoint: import_zod6.default.optional(import_utils6.zHttpsUrl),
-  // From OID4VCI specification
-  pre_authorized_grant_anonymous_access_supported: import_zod6.default.optional(import_zod6.default.boolean())
-}).passthrough().refine(
-  ({
-    introspection_endpoint_auth_methods_supported: methodsSupported,
-    introspection_endpoint_auth_signing_alg_values_supported: algValuesSupported
-  }) => {
-    if (!methodsSupported) return true;
-    if (!methodsSupported.includes("private_key_jwt") && !methodsSupported.includes("client_secret_jwt")) return true;
-    return algValuesSupported !== void 0 && algValuesSupported.length > 0;
-  },
-  `Metadata value 'introspection_endpoint_auth_signing_alg_values_supported' must be defined if metadata 'introspection_endpoint_auth_methods_supported' value contains values 'private_key_jwt' or 'client_secret_jwt'`
-);
-
 // src/metadata/authorization-server/authorization-server-metadata.ts
 var import_utils9 = require("@openid4vc/utils");
 
 // src/metadata/fetch-well-known-metadata.ts
+var import_utils6 = require("@openid4vc/utils");
 var import_utils7 = require("@openid4vc/utils");
-var import_utils8 = require("@openid4vc/utils");
 
 // ../utils/src/error/ValidationError.ts
 var import_zod7 = require("zod");
@@ -665,13 +619,13 @@ var ValidationError = class extends Error {
 
 // src/metadata/fetch-well-known-metadata.ts
 async function fetchWellKnownMetadata(wellKnownMetadataUrl, schema, fetch) {
-  const fetcher = (0, import_utils7.createZodFetcher)(fetch);
-  const { result, response } = await fetcher(schema, import_utils7.ContentType.Json, wellKnownMetadataUrl);
+  const fetcher = (0, import_utils6.createZodFetcher)(fetch);
+  const { result, response } = await fetcher(schema, import_utils6.ContentType.Json, wellKnownMetadataUrl);
   if (response.status === 404) {
     return null;
   }
   if (!response.ok) {
-    throw new import_utils8.InvalidFetchResponseError(
+    throw new import_utils7.InvalidFetchResponseError(
       `Fetching well known metadata from '${wellKnownMetadataUrl}' resulted in an unsuccessfull response with status '${response.status}'.`,
       await response.clone().text(),
       response
@@ -683,6 +637,44 @@ async function fetchWellKnownMetadata(wellKnownMetadataUrl, schema, fetch) {
   return result.data;
 }
 
+// src/metadata/authorization-server/z-authorization-server-metadata.ts
+var import_utils8 = require("@openid4vc/utils");
+var import_zod8 = __toESM(require("zod"));
+var zAuthorizationServerMetadata = import_zod8.default.object({
+  issuer: import_utils8.zHttpsUrl,
+  token_endpoint: import_utils8.zHttpsUrl,
+  token_endpoint_auth_methods_supported: import_zod8.default.optional(import_zod8.default.array(import_zod8.default.string())),
+  authorization_endpoint: import_zod8.default.optional(import_utils8.zHttpsUrl),
+  jwks_uri: import_zod8.default.optional(import_utils8.zHttpsUrl),
+  // RFC7636
+  code_challenge_methods_supported: import_zod8.default.optional(import_zod8.default.array(import_zod8.default.string())),
+  // RFC9449
+  dpop_signing_alg_values_supported: import_zod8.default.optional(import_zod8.default.array(import_zod8.default.string())),
+  // RFC9126
+  require_pushed_authorization_requests: import_zod8.default.optional(import_zod8.default.boolean()),
+  pushed_authorization_request_endpoint: import_zod8.default.optional(import_utils8.zHttpsUrl),
+  // RFC9068
+  introspection_endpoint: import_zod8.default.optional(import_utils8.zHttpsUrl),
+  introspection_endpoint_auth_methods_supported: import_zod8.default.optional(
+    import_zod8.default.array(import_zod8.default.union([import_zod8.default.literal("client_secret_jwt"), import_zod8.default.literal("private_key_jwt"), import_zod8.default.string()]))
+  ),
+  introspection_endpoint_auth_signing_alg_values_supported: import_zod8.default.optional(import_zod8.default.array(zAlgValueNotNone)),
+  // FiPA (no RFC yet)
+  authorization_challenge_endpoint: import_zod8.default.optional(import_utils8.zHttpsUrl),
+  // From OpenID4VCI specification
+  pre_authorized_grant_anonymous_access_supported: import_zod8.default.optional(import_zod8.default.boolean())
+}).passthrough().refine(
+  ({
+    introspection_endpoint_auth_methods_supported: methodsSupported,
+    introspection_endpoint_auth_signing_alg_values_supported: algValuesSupported
+  }) => {
+    if (!methodsSupported) return true;
+    if (!methodsSupported.includes("private_key_jwt") && !methodsSupported.includes("client_secret_jwt")) return true;
+    return algValuesSupported !== void 0 && algValuesSupported.length > 0;
+  },
+  `Metadata value 'introspection_endpoint_auth_signing_alg_values_supported' must be defined if metadata 'introspection_endpoint_auth_methods_supported' value contains values 'private_key_jwt' or 'client_secret_jwt'`
+);
+
 // src/metadata/authorization-server/authorization-server-metadata.ts
 var wellKnownAuthorizationServerSuffix = ".well-known/oauth-authorization-server";
 var wellKnownOpenIdConfigurationServerSuffix = ".well-known/openid-configuration";
@@ -754,25 +746,78 @@ async function fetchJwks(authorizationServer, fetch) {
   return result.data;
 }
 
-// src/access-token/z-access-token-jwt.ts
+// src/common/jwt/verify-jwt.ts
 var import_utils12 = require("@openid4vc/utils");
-var import_zod8 = __toESM(require("zod"));
-var zAccessTokenProfileJwtHeader = import_zod8.default.object({
+async function verifyJwt(options) {
+  const errorMessage = options.errorMessage ?? "Error during verification of jwt.";
+  let signerJwk;
+  try {
+    const result = await options.verifyJwtCallback(options.signer, {
+      header: options.header,
+      payload: options.payload,
+      compact: options.compact
+    });
+    if (!result.verified) throw new Oauth2JwtVerificationError(errorMessage);
+    signerJwk = result.signerJwk;
+  } catch (error) {
+    if (error instanceof Oauth2JwtVerificationError) throw error;
+    throw new Oauth2JwtVerificationError(errorMessage, { cause: error });
+  }
+  const nowInSeconds = (0, import_utils12.dateToSeconds)(options.now ?? /* @__PURE__ */ new Date());
+  const skewInSeconds = options.allowedSkewInSeconds ?? 0;
+  const timeBasedValidation = options.skipTimeBasedValidation !== void 0 ? !options.skipTimeBasedValidation : true;
+  if (timeBasedValidation && options.payload.nbf && nowInSeconds < options.payload.nbf - skewInSeconds) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'nbf' is in the future`);
+  }
+  if (timeBasedValidation && options.payload.exp && nowInSeconds > options.payload.exp + skewInSeconds) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'exp' is in the past`);
+  }
+  if (options.expectedAudience && options.expectedAudience !== options.payload.aud) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'aud' does not match expected value.`);
+  }
+  if (options.expectedIssuer && options.expectedIssuer !== options.payload.iss) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'iss' does not match expected value.`);
+  }
+  if (options.expectedNonce && options.expectedNonce !== options.payload.nonce) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'nonce' does not match expected value.`);
+  }
+  if (options.expectedSubject && options.expectedSubject !== options.payload.sub) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'sub' does not match expected value.`);
+  }
+  if (options.requiredClaims) {
+    for (const claim of options.requiredClaims) {
+      if (!options.payload[claim]) {
+        throw new Oauth2JwtVerificationError(`${errorMessage} jwt '${claim}' is missing.`);
+      }
+    }
+  }
+  return {
+    signer: {
+      ...options.signer,
+      publicJwk: signerJwk
+    }
+  };
+}
+
+// src/access-token/z-access-token-jwt.ts
+var import_utils13 = require("@openid4vc/utils");
+var import_zod9 = __toESM(require("zod"));
+var zAccessTokenProfileJwtHeader = import_zod9.default.object({
   ...zJwtHeader.shape,
-  typ: import_zod8.default.enum(["application/at+jwt", "at+jwt"])
+  typ: import_zod9.default.enum(["application/at+jwt", "at+jwt"])
 }).passthrough();
-var zAccessTokenProfileJwtPayload = import_zod8.default.object({
+var zAccessTokenProfileJwtPayload = import_zod9.default.object({
   ...zJwtPayload.shape,
-  iss: import_zod8.default.string(),
-  exp: import_utils12.zInteger,
-  iat: import_utils12.zInteger,
-  aud: import_zod8.default.string(),
-  sub: import_zod8.default.string(),
-  // REQUIRED according to RFC 9068, but OID4VCI allows anonymous access
-  client_id: import_zod8.default.optional(import_zod8.default.string()),
-  jti: import_zod8.default.string(),
+  iss: import_zod9.default.string(),
+  exp: import_utils13.zInteger,
+  iat: import_utils13.zInteger,
+  aud: import_zod9.default.string(),
+  sub: import_zod9.default.string(),
+  // REQUIRED according to RFC 9068, but OpenID4VCI allows anonymous access
+  client_id: import_zod9.default.optional(import_zod9.default.string()),
+  jti: import_zod9.default.string(),
   // SHOULD be included in the authorization request contained it
-  scope: import_zod8.default.optional(import_zod8.default.string())
+  scope: import_zod9.default.optional(import_zod9.default.string())
 }).passthrough();
 
 // src/access-token/verify-access-token.ts
@@ -817,26 +862,26 @@ async function verifyJwtProfileAccessToken(options) {
 }
 
 // src/resource-request/make-resource-request.ts
-var import_utils15 = require("@openid4vc/utils");
+var import_utils16 = require("@openid4vc/utils");
 
 // src/dpop/dpop.ts
-var import_utils14 = require("@openid4vc/utils");
+var import_utils15 = require("@openid4vc/utils");
 
 // src/dpop/z-dpop.ts
-var import_utils13 = require("@openid4vc/utils");
-var import_zod9 = __toESM(require("zod"));
-var zDpopJwtPayload = import_zod9.default.object({
+var import_utils14 = require("@openid4vc/utils");
+var import_zod10 = __toESM(require("zod"));
+var zDpopJwtPayload = import_zod10.default.object({
   ...zJwtPayload.shape,
-  iat: import_utils13.zInteger,
-  htu: import_utils13.zHttpsUrl,
-  htm: import_utils13.zHttpMethod,
-  jti: import_zod9.default.string(),
+  iat: import_utils14.zInteger,
+  htu: import_utils14.zHttpsUrl,
+  htm: import_utils14.zHttpMethod,
+  jti: import_zod10.default.string(),
   // Only required when presenting in combination with access token
-  ath: import_zod9.default.optional(import_zod9.default.string())
+  ath: import_zod10.default.optional(import_zod10.default.string())
 }).passthrough();
-var zDpopJwtHeader = import_zod9.default.object({
+var zDpopJwtHeader = import_zod10.default.object({
   ...zJwtHeader.shape,
-  typ: import_zod9.default.literal("dpop+jwt"),
+  typ: import_zod10.default.literal("dpop+jwt"),
   jwk: zJwk
 }).passthrough();
 
@@ -850,18 +895,18 @@ async function createDpopHeadersForRequest(options) {
 async function createDpopJwt(options) {
   let ath = void 0;
   if (options.accessToken) {
-    ath = (0, import_utils14.encodeToBase64Url)(await options.callbacks.hash((0, import_utils14.decodeUtf8String)(options.accessToken), "SHA-256" /* Sha256 */));
+    ath = (0, import_utils15.encodeToBase64Url)(await options.callbacks.hash((0, import_utils15.decodeUtf8String)(options.accessToken), "SHA-256" /* Sha256 */));
   }
-  const header = (0, import_utils14.parseWithErrorHandling)(zDpopJwtHeader, {
+  const header = (0, import_utils15.parseWithErrorHandling)(zDpopJwtHeader, {
     typ: "dpop+jwt",
     jwk: options.signer.publicJwk,
     alg: options.signer.alg
   });
-  const payload = (0, import_utils14.parseWithErrorHandling)(zDpopJwtPayload, {
+  const payload = (0, import_utils15.parseWithErrorHandling)(zDpopJwtPayload, {
     htu: htuFromRequestUrl(options.request.url),
-    iat: (0, import_utils14.dateToSeconds)(options.issuedAt),
+    iat: (0, import_utils15.dateToSeconds)(options.issuedAt),
     htm: options.request.method,
-    jti: (0, import_utils14.encodeToBase64Url)(await options.callbacks.generateRandom(32)),
+    jti: (0, import_utils15.encodeToBase64Url)(await options.callbacks.generateRandom(32)),
     ath,
     nonce: options.nonce,
     ...options.additionalPayload
@@ -903,8 +948,8 @@ async function verifyDpopJwt(options) {
     throw new Oauth2Error(`Dpop jwt contains htu value '${payload.htu}', but expected htu value '${expectedHtu}'.`);
   }
   if (options.accessToken) {
-    const expectedAth = (0, import_utils14.encodeToBase64Url)(
-      await options.callbacks.hash((0, import_utils14.decodeUtf8String)(options.accessToken), "SHA-256" /* Sha256 */)
+    const expectedAth = (0, import_utils15.encodeToBase64Url)(
+      await options.callbacks.hash((0, import_utils15.decodeUtf8String)(options.accessToken), "SHA-256" /* Sha256 */)
     );
     if (!payload.ath) {
       throw new Oauth2Error(`Dpop jwt does not have a ath value, but expected ath value '${expectedAth}'.`);
@@ -944,7 +989,7 @@ async function verifyDpopJwt(options) {
   };
 }
 function htuFromRequestUrl(requestUrl) {
-  const htu = new import_utils14.URL(requestUrl);
+  const htu = new import_utils15.URL(requestUrl);
   htu.search = "";
   htu.hash = "";
   return htu.toString();
@@ -1029,7 +1074,7 @@ async function resourceRequest(options) {
     nonce: options.dpop.nonce,
     accessToken: options.accessToken
   }) : void 0;
-  const fetch = options.callbacks.fetch ?? import_utils15.defaultFetcher;
+  const fetch = options.callbacks.fetch ?? import_utils16.defaultFetcher;
   const response = await fetch(options.url, {
     ...options.requestOptions,
     headers: {
@@ -1077,40 +1122,40 @@ async function resourceRequest(options) {
 }
 
 // src/resource-request/verify-resource-request.ts
-var import_utils20 = require("@openid4vc/utils");
+var import_utils21 = require("@openid4vc/utils");
 
 // src/access-token/introspect-token.ts
-var import_utils17 = require("@openid4vc/utils");
 var import_utils18 = require("@openid4vc/utils");
 var import_utils19 = require("@openid4vc/utils");
+var import_utils20 = require("@openid4vc/utils");
 
 // src/access-token/z-token-introspection.ts
-var import_utils16 = require("@openid4vc/utils");
-var import_zod10 = __toESM(require("zod"));
-var zTokenIntrospectionRequest = import_zod10.default.object({
-  token: import_zod10.default.string(),
-  token_type_hint: import_zod10.default.optional(import_zod10.default.string())
+var import_utils17 = require("@openid4vc/utils");
+var import_zod11 = __toESM(require("zod"));
+var zTokenIntrospectionRequest = import_zod11.default.object({
+  token: import_zod11.default.string(),
+  token_type_hint: import_zod11.default.optional(import_zod11.default.string())
 }).passthrough();
-var zTokenIntrospectionResponse = import_zod10.default.object({
-  active: import_zod10.default.boolean(),
-  scope: import_zod10.default.optional(import_zod10.default.string()),
-  client_id: import_zod10.default.optional(import_zod10.default.string()),
-  username: import_zod10.default.optional(import_zod10.default.string()),
-  token_type: import_zod10.default.optional(import_zod10.default.string()),
-  exp: import_zod10.default.optional(import_utils16.zInteger),
-  iat: import_zod10.default.optional(import_utils16.zInteger),
-  nbf: import_zod10.default.optional(import_utils16.zInteger),
-  sub: import_zod10.default.optional(import_zod10.default.string()),
-  aud: import_zod10.default.optional(import_zod10.default.string()),
-  iss: import_zod10.default.optional(import_zod10.default.string()),
-  jti: import_zod10.default.optional(import_zod10.default.string()),
-  cnf: import_zod10.default.optional(zJwtConfirmationPayload)
+var zTokenIntrospectionResponse = import_zod11.default.object({
+  active: import_zod11.default.boolean(),
+  scope: import_zod11.default.optional(import_zod11.default.string()),
+  client_id: import_zod11.default.optional(import_zod11.default.string()),
+  username: import_zod11.default.optional(import_zod11.default.string()),
+  token_type: import_zod11.default.optional(import_zod11.default.string()),
+  exp: import_zod11.default.optional(import_utils17.zInteger),
+  iat: import_zod11.default.optional(import_utils17.zInteger),
+  nbf: import_zod11.default.optional(import_utils17.zInteger),
+  sub: import_zod11.default.optional(import_zod11.default.string()),
+  aud: import_zod11.default.optional(import_zod11.default.string()),
+  iss: import_zod11.default.optional(import_zod11.default.string()),
+  jti: import_zod11.default.optional(import_zod11.default.string()),
+  cnf: import_zod11.default.optional(zJwtConfirmationPayload)
 }).passthrough();
 
 // src/access-token/introspect-token.ts
 async function introspectToken(options) {
-  const fetchWithZod = (0, import_utils17.createZodFetcher)(options.callbacks.fetch);
-  const introspectionRequest = (0, import_utils17.parseWithErrorHandling)(zTokenIntrospectionRequest, {
+  const fetchWithZod = (0, import_utils18.createZodFetcher)(options.callbacks.fetch);
+  const introspectionRequest = (0, import_utils18.parseWithErrorHandling)(zTokenIntrospectionRequest, {
     token: options.token,
     token_type_hint: options.tokenTypeHint,
     ...options.additionalPayload
@@ -1119,29 +1164,29 @@ async function introspectToken(options) {
   if (!introspectionEndpoint) {
     throw new Oauth2Error(`Missing required 'introspection_endpoint' parameter in authorization server metadata`);
   }
-  const headers = new import_utils19.Headers({
-    "Content-Type": import_utils17.ContentType.XWwwFormUrlencoded
+  const headers = new import_utils20.Headers({
+    "Content-Type": import_utils18.ContentType.XWwwFormUrlencoded
   });
   await options.callbacks.clientAuthentication({
     url: introspectionEndpoint,
     method: "POST",
     authorizationServerMetata: options.authorizationServerMetadata,
     body: introspectionRequest,
-    contentType: import_utils17.ContentType.XWwwFormUrlencoded,
+    contentType: import_utils18.ContentType.XWwwFormUrlencoded,
     headers
   });
   const { result, response } = await fetchWithZod(
     zTokenIntrospectionResponse,
-    import_utils17.ContentType.Json,
+    import_utils18.ContentType.Json,
     introspectionEndpoint,
     {
-      body: (0, import_utils17.objectToQueryParams)(introspectionRequest).toString(),
+      body: (0, import_utils18.objectToQueryParams)(introspectionRequest).toString(),
       method: "POST",
       headers
     }
   );
   if (!response.ok || !result?.success) {
-    throw new import_utils18.InvalidFetchResponseError(
+    throw new import_utils19.InvalidFetchResponseError(
       `Unable to introspect token from '${introspectionEndpoint}'. Received response with status ${response.status}`,
       await response.clone().text(),
       response
@@ -1185,7 +1230,7 @@ async function verifyResourceRequest(options) {
     resourceServer: options.resourceServer,
     now: options.now
   }).catch((error) => {
-    if (error instanceof Oauth2JwtParseError || error instanceof import_utils20.ValidationError) return null;
+    if (error instanceof Oauth2JwtParseError || error instanceof import_utils21.ValidationError) return null;
     const errorMessage = error instanceof Oauth2Error ? error.message : "Invalid access token";
     throw new Oauth2ResourceUnauthorizedError(
       `Error occured during verification of jwt profile access token: ${error.message}`,
@@ -1285,7 +1330,7 @@ async function verifyResourceRequest(options) {
 }
 
 // src/client-authentication.ts
-var import_utils21 = require("@openid4vc/utils");
+var import_utils22 = require("@openid4vc/utils");
 var SupportedClientAuthenticationMethod = /* @__PURE__ */ ((SupportedClientAuthenticationMethod2) => {
   SupportedClientAuthenticationMethod2["ClientSecretBasic"] = "client_secret_basic";
   SupportedClientAuthenticationMethod2["ClientSecretPost"] = "client_secret_post";
@@ -1348,7 +1393,7 @@ function clientAuthenticationClientSecretPost(options) {
 }
 function clientAuthenticationClientSecretBasic(options) {
   return ({ headers }) => {
-    const authorization = (0, import_utils21.encodeToBase64Url)((0, import_utils21.decodeUtf8String)(`${options.clientId}:${options.clientSecret}`));
+    const authorization = (0, import_utils22.encodeToBase64Url)((0, import_utils22.decodeUtf8String)(`${options.clientId}:${options.clientSecret}`));
     headers.set("Authorization", `Basic ${authorization}`);
   };
 }
@@ -1358,22 +1403,22 @@ function clientAuthenticationNone() {
 }
 
 // src/Oauth2AuthorizationServer.ts
-var import_utils33 = require("@openid4vc/utils");
+var import_utils34 = require("@openid4vc/utils");
 
 // src/access-token/create-access-token.ts
-var import_utils22 = require("@openid4vc/utils");
+var import_utils23 = require("@openid4vc/utils");
 async function createAccessTokenJwt(options) {
-  const header = (0, import_utils22.parseWithErrorHandling)(zAccessTokenProfileJwtHeader, {
+  const header = (0, import_utils23.parseWithErrorHandling)(zAccessTokenProfileJwtHeader, {
     ...jwtHeaderFromJwtSigner(options.signer),
     typ: "at+jwt"
   });
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const payload = (0, import_utils22.parseWithErrorHandling)(zAccessTokenProfileJwtPayload, {
-    iat: (0, import_utils22.dateToSeconds)(now),
-    exp: (0, import_utils22.dateToSeconds)((0, import_utils22.addSecondsToDate)(now, options.expiresInSeconds)),
+  const payload = (0, import_utils23.parseWithErrorHandling)(zAccessTokenProfileJwtPayload, {
+    iat: (0, import_utils23.dateToSeconds)(now),
+    exp: (0, import_utils23.dateToSeconds)((0, import_utils23.addSecondsToDate)(now, options.expiresInSeconds)),
     aud: options.audience,
     iss: options.authorizationServer,
-    jti: (0, import_utils22.encodeToBase64Url)(await options.callbacks.generateRandom(32)),
+    jti: (0, import_utils23.encodeToBase64Url)(await options.callbacks.generateRandom(32)),
     client_id: options.clientId,
     sub: options.subject,
     scope: options.scope,
@@ -1396,45 +1441,45 @@ async function createAccessTokenJwt(options) {
 }
 
 // src/access-token/create-access-token-response.ts
-var import_utils24 = require("@openid4vc/utils");
+var import_utils25 = require("@openid4vc/utils");
 
 // src/access-token/z-access-token.ts
-var import_zod12 = __toESM(require("zod"));
-var import_utils23 = require("@openid4vc/utils");
+var import_zod13 = __toESM(require("zod"));
+var import_utils24 = require("@openid4vc/utils");
 
 // src/z-grant-type.ts
-var import_zod11 = __toESM(require("zod"));
-var zPreAuthorizedCodeGrantIdentifier = import_zod11.default.literal("urn:ietf:params:oauth:grant-type:pre-authorized_code");
+var import_zod12 = __toESM(require("zod"));
+var zPreAuthorizedCodeGrantIdentifier = import_zod12.default.literal("urn:ietf:params:oauth:grant-type:pre-authorized_code");
 var preAuthorizedCodeGrantIdentifier = zPreAuthorizedCodeGrantIdentifier.value;
-var zAuthorizationCodeGrantIdentifier = import_zod11.default.literal("authorization_code");
+var zAuthorizationCodeGrantIdentifier = import_zod12.default.literal("authorization_code");
 var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
-var zRefreshTokenGrantIdentifier = import_zod11.default.literal("refresh_token");
+var zRefreshTokenGrantIdentifier = import_zod12.default.literal("refresh_token");
 var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
 
 // src/access-token/z-access-token.ts
-var zAccessTokenRequest = import_zod12.default.intersection(
-  import_zod12.default.object({
+var zAccessTokenRequest = import_zod13.default.intersection(
+  import_zod13.default.object({
     // Pre authorized code flow
-    "pre-authorized_code": import_zod12.default.optional(import_zod12.default.string()),
+    "pre-authorized_code": import_zod13.default.optional(import_zod13.default.string()),
     // Authorization code flow
-    code: import_zod12.default.optional(import_zod12.default.string()),
-    redirect_uri: import_zod12.default.string().url().optional(),
+    code: import_zod13.default.optional(import_zod13.default.string()),
+    redirect_uri: import_zod13.default.string().url().optional(),
     // Refresh token grant
-    refresh_token: import_zod12.default.optional(import_zod12.default.string()),
-    resource: import_zod12.default.optional(import_utils23.zHttpsUrl),
-    code_verifier: import_zod12.default.optional(import_zod12.default.string()),
-    grant_type: import_zod12.default.union([
+    refresh_token: import_zod13.default.optional(import_zod13.default.string()),
+    resource: import_zod13.default.optional(import_utils24.zHttpsUrl),
+    code_verifier: import_zod13.default.optional(import_zod13.default.string()),
+    grant_type: import_zod13.default.union([
       zPreAuthorizedCodeGrantIdentifier,
       zAuthorizationCodeGrantIdentifier,
       zRefreshTokenGrantIdentifier,
       // string makes the previous ones unessary, but it does help with error messages
-      import_zod12.default.string()
+      import_zod13.default.string()
     ])
   }).passthrough(),
-  import_zod12.default.object({
-    tx_code: import_zod12.default.optional(import_zod12.default.string()),
-    // user_pin is from OID4VCI draft 11
-    user_pin: import_zod12.default.optional(import_zod12.default.string())
+  import_zod13.default.object({
+    tx_code: import_zod13.default.optional(import_zod13.default.string()),
+    // user_pin is from OpenID4VCI draft 11
+    user_pin: import_zod13.default.optional(import_zod13.default.string())
   }).passthrough().refine(({ tx_code, user_pin }) => !tx_code || !user_pin || user_pin === tx_code, {
     message: `If both 'tx_code' and 'user_pin' are present they must match`
   }).transform(({ tx_code, user_pin, ...rest }) => {
@@ -1444,19 +1489,19 @@ var zAccessTokenRequest = import_zod12.default.intersection(
     };
   })
 );
-var zAccessTokenResponse = import_zod12.default.object({
-  access_token: import_zod12.default.string(),
-  token_type: import_zod12.default.string(),
-  expires_in: import_zod12.default.optional(import_zod12.default.number().int()),
-  scope: import_zod12.default.optional(import_zod12.default.string()),
-  state: import_zod12.default.optional(import_zod12.default.string()),
-  refresh_token: import_zod12.default.optional(import_zod12.default.string()),
-  // Oid4vci specific parameters
-  c_nonce: import_zod12.default.optional(import_zod12.default.string()),
-  c_nonce_expires_in: import_zod12.default.optional(import_zod12.default.number().int()),
+var zAccessTokenResponse = import_zod13.default.object({
+  access_token: import_zod13.default.string(),
+  token_type: import_zod13.default.string(),
+  expires_in: import_zod13.default.optional(import_zod13.default.number().int()),
+  scope: import_zod13.default.optional(import_zod13.default.string()),
+  state: import_zod13.default.optional(import_zod13.default.string()),
+  refresh_token: import_zod13.default.optional(import_zod13.default.string()),
+  // OpenID4VCI specific parameters
+  c_nonce: import_zod13.default.optional(import_zod13.default.string()),
+  c_nonce_expires_in: import_zod13.default.optional(import_zod13.default.number().int()),
   // TODO: add additional params
-  authorization_details: import_zod12.default.array(
-    import_zod12.default.object({
+  authorization_details: import_zod13.default.array(
+    import_zod13.default.object({
       // requried when type is openid_credential (so we probably need a discriminator)
       // credential_identifiers: z.array(z.string()),
     }).passthrough()
@@ -1466,7 +1511,7 @@ var zAccessTokenErrorResponse = zOauth2ErrorResponse;
 
 // src/access-token/create-access-token-response.ts
 async function createAccessTokenResponse(options) {
-  const accessTokenResponse = (0, import_utils24.parseWithErrorHandling)(zAccessTokenResponse, {
+  const accessTokenResponse = (0, import_utils25.parseWithErrorHandling)(zAccessTokenResponse, {
     access_token: options.accessToken,
     token_type: options.tokenType,
     expires_in: options.expiresInSeconds,
@@ -1535,7 +1580,7 @@ ${JSON.stringify(parsedAccessTokenRequest.error.issues, null, 2)}`
 }
 
 // src/pkce.ts
-var import_utils25 = require("@openid4vc/utils");
+var import_utils26 = require("@openid4vc/utils");
 var PkceCodeChallengeMethod = /* @__PURE__ */ ((PkceCodeChallengeMethod2) => {
   PkceCodeChallengeMethod2["Plain"] = "plain";
   PkceCodeChallengeMethod2["S256"] = "S256";
@@ -1550,7 +1595,7 @@ async function createPkce(options) {
     throw new Oauth2Error(`Unable to create PKCE code verifier. 'allowedCodeChallengeMethods' is an empty array.`);
   }
   const codeChallengeMethod = allowedCodeChallengeMethods.includes("S256" /* S256 */) ? "S256" /* S256 */ : "plain" /* Plain */;
-  const codeVerifier = options.codeVerifier ?? (0, import_utils25.encodeToBase64Url)(await options.callbacks.generateRandom(64));
+  const codeVerifier = options.codeVerifier ?? (0, import_utils26.encodeToBase64Url)(await options.callbacks.generateRandom(64));
   return {
     codeVerifier,
     codeChallenge: await calculateCodeChallenge({
@@ -1578,7 +1623,7 @@ async function calculateCodeChallenge(options) {
     return options.codeVerifier;
   }
   if (options.codeChallengeMethod === "S256" /* S256 */) {
-    return (0, import_utils25.encodeToBase64Url)(await options.hashCallback((0, import_utils25.decodeUtf8String)(options.codeVerifier), "SHA-256" /* Sha256 */));
+    return (0, import_utils26.encodeToBase64Url)(await options.hashCallback((0, import_utils26.decodeUtf8String)(options.codeVerifier), "SHA-256" /* Sha256 */));
   }
   throw new Oauth2Error(`Unsupported code challenge method ${options.codeChallengeMethod}`);
 }
@@ -1711,69 +1756,69 @@ async function verifyAccessTokenRequestPkce(options, callbacks) {
 }
 
 // src/authorization-challenge/create-authorization-challenge-response.ts
-var import_utils28 = require("@openid4vc/utils");
+var import_utils29 = require("@openid4vc/utils");
 
 // src/authorization-challenge/z-authorization-challenge.ts
-var import_utils27 = require("@openid4vc/utils");
-var import_zod14 = __toESM(require("zod"));
+var import_utils28 = require("@openid4vc/utils");
+var import_zod15 = __toESM(require("zod"));
 
 // src/authorization-request/z-authorization-request.ts
-var import_utils26 = require("@openid4vc/utils");
-var import_zod13 = __toESM(require("zod"));
-var zAuthorizationRequest = import_zod13.default.object({
-  response_type: import_zod13.default.string(),
-  client_id: import_zod13.default.string(),
-  issuer_state: import_zod13.default.optional(import_zod13.default.string()),
-  redirect_uri: import_zod13.default.string().url().optional(),
-  resource: import_zod13.default.optional(import_utils26.zHttpsUrl),
-  scope: import_zod13.default.optional(import_zod13.default.string()),
+var import_utils27 = require("@openid4vc/utils");
+var import_zod14 = __toESM(require("zod"));
+var zAuthorizationRequest = import_zod14.default.object({
+  response_type: import_zod14.default.string(),
+  client_id: import_zod14.default.string(),
+  issuer_state: import_zod14.default.optional(import_zod14.default.string()),
+  redirect_uri: import_zod14.default.string().url().optional(),
+  resource: import_zod14.default.optional(import_utils27.zHttpsUrl),
+  scope: import_zod14.default.optional(import_zod14.default.string()),
   // DPoP jwk thumbprint
-  dpop_jkt: import_zod13.default.optional(import_zod13.default.string()),
-  code_challenge: import_zod13.default.optional(import_zod13.default.string()),
-  code_challenge_method: import_zod13.default.optional(import_zod13.default.string())
+  dpop_jkt: import_zod14.default.optional(import_zod14.default.string()),
+  code_challenge: import_zod14.default.optional(import_zod14.default.string()),
+  code_challenge_method: import_zod14.default.optional(import_zod14.default.string())
 }).passthrough();
-var zPushedAuthorizationRequest = import_zod13.default.object({
-  request_uri: import_zod13.default.string(),
-  client_id: import_zod13.default.string()
+var zPushedAuthorizationRequest = import_zod14.default.object({
+  request_uri: import_zod14.default.string(),
+  client_id: import_zod14.default.string()
 }).passthrough();
-var zPushedAuthorizationResponse = import_zod13.default.object({
-  request_uri: import_zod13.default.string(),
-  expires_in: import_zod13.default.number().int()
+var zPushedAuthorizationResponse = import_zod14.default.object({
+  request_uri: import_zod14.default.string(),
+  expires_in: import_zod14.default.number().int()
 }).passthrough();
 
 // src/authorization-challenge/z-authorization-challenge.ts
-var zAuthorizationChallengeRequest = import_zod14.default.object({
+var zAuthorizationChallengeRequest = import_zod15.default.object({
   // authorization challenge request can include same parameters as an authorization request
   // except for response_type (always `code`), and `client_id` is optional (becase
   // it's possible to do client authentication using different methods)
   ...zAuthorizationRequest.omit({ response_type: true, client_id: true }).shape,
-  client_id: import_zod14.default.optional(zAuthorizationRequest.shape.client_id),
-  auth_session: import_zod14.default.optional(import_zod14.default.string()),
+  client_id: import_zod15.default.optional(zAuthorizationRequest.shape.client_id),
+  auth_session: import_zod15.default.optional(import_zod15.default.string()),
   // DRAFT presentation during issuance
-  presentation_during_issuance_session: import_zod14.default.optional(import_zod14.default.string())
+  presentation_during_issuance_session: import_zod15.default.optional(import_zod15.default.string())
 }).passthrough();
-var zAuthorizationChallengeResponse = import_zod14.default.object({
-  authorization_code: import_zod14.default.string()
+var zAuthorizationChallengeResponse = import_zod15.default.object({
+  authorization_code: import_zod15.default.string()
 }).passthrough();
-var zAuthorizationChallengeErrorResponse = import_zod14.default.object({
+var zAuthorizationChallengeErrorResponse = import_zod15.default.object({
   ...zOauth2ErrorResponse.shape,
-  auth_session: import_zod14.default.optional(import_zod14.default.string()),
-  request_uri: import_zod14.default.optional(import_zod14.default.string()),
-  expires_in: import_zod14.default.optional(import_utils27.zInteger),
+  auth_session: import_zod15.default.optional(import_zod15.default.string()),
+  request_uri: import_zod15.default.optional(import_zod15.default.string()),
+  expires_in: import_zod15.default.optional(import_utils28.zInteger),
   // DRAFT: presentation during issuance
-  presentation: import_zod14.default.optional(import_zod14.default.string())
+  presentation: import_zod15.default.optional(import_zod15.default.string())
 }).passthrough();
 
 // src/authorization-challenge/create-authorization-challenge-response.ts
 function createAuthorizationChallengeResponse(options) {
-  const authorizationChallengeResponse = (0, import_utils28.parseWithErrorHandling)(zAuthorizationChallengeResponse, {
+  const authorizationChallengeResponse = (0, import_utils29.parseWithErrorHandling)(zAuthorizationChallengeResponse, {
     ...options.additionalPayload,
     authorization_code: options.authorizationCode
   });
   return { authorizationChallengeResponse };
 }
 function createAuthorizationChallengeErrorResponse(options) {
-  const authorizationChallengeErrorResponse = (0, import_utils28.parseWithErrorHandling)(zAuthorizationChallengeErrorResponse, {
+  const authorizationChallengeErrorResponse = (0, import_utils29.parseWithErrorHandling)(zAuthorizationChallengeErrorResponse, {
     ...options.additionalPayload,
     // General FiPA
     error: options.error,
@@ -1789,9 +1834,9 @@ function createAuthorizationChallengeErrorResponse(options) {
 }
 
 // src/authorization-challenge/parse-authorization-challenge-request.ts
-var import_utils29 = require("@openid4vc/utils");
+var import_utils30 = require("@openid4vc/utils");
 function parseAuthorizationChallengeRequest(options) {
-  const authorizationChallengeRequest = (0, import_utils29.parseWithErrorHandling)(
+  const authorizationChallengeRequest = (0, import_utils30.parseWithErrorHandling)(
     zAuthorizationChallengeRequest,
     options.authorizationChallengeRequest
   );
@@ -1799,52 +1844,52 @@ function parseAuthorizationChallengeRequest(options) {
 }
 
 // src/client-attestation/clent-attestation.ts
-var import_utils31 = require("@openid4vc/utils");
+var import_utils32 = require("@openid4vc/utils");
 
 // src/client-attestation/z-client-attestation.ts
-var import_utils30 = require("@openid4vc/utils");
-var import_zod15 = __toESM(require("zod"));
-var zOauthClientAttestationHeader = import_zod15.default.literal("OAuth-Client-Attestation");
+var import_utils31 = require("@openid4vc/utils");
+var import_zod16 = __toESM(require("zod"));
+var zOauthClientAttestationHeader = import_zod16.default.literal("OAuth-Client-Attestation");
 var oauthClientAttestationHeader = zOauthClientAttestationHeader.value;
-var zClientAttestationJwtPayload = import_zod15.default.object({
+var zClientAttestationJwtPayload = import_zod16.default.object({
   ...zJwtPayload.shape,
-  iss: import_zod15.default.string(),
-  sub: import_zod15.default.string(),
-  exp: import_utils30.zInteger,
-  cnf: import_zod15.default.object({
+  iss: import_zod16.default.string(),
+  sub: import_zod16.default.string(),
+  exp: import_utils31.zInteger,
+  cnf: import_zod16.default.object({
     jwk: zJwk,
-    key_type: import_zod15.default.optional(
-      import_zod15.default.union([
-        import_zod15.default.enum(["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]),
-        import_zod15.default.string()
+    key_type: import_zod16.default.optional(
+      import_zod16.default.union([
+        import_zod16.default.enum(["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]),
+        import_zod16.default.string()
       ])
     ),
-    user_authentication: import_zod15.default.optional(
-      import_zod15.default.union([
-        import_zod15.default.enum(["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]),
-        import_zod15.default.string()
+    user_authentication: import_zod16.default.optional(
+      import_zod16.default.union([
+        import_zod16.default.enum(["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]),
+        import_zod16.default.string()
       ])
     )
   }).passthrough(),
-  aal: import_zod15.default.optional(import_zod15.default.string())
+  aal: import_zod16.default.optional(import_zod16.default.string())
 }).passthrough();
-var zClientAttestationJwtHeader = import_zod15.default.object({
+var zClientAttestationJwtHeader = import_zod16.default.object({
   ...zJwtHeader.shape,
-  typ: import_zod15.default.literal("oauth-client-attestation+jwt")
+  typ: import_zod16.default.literal("oauth-client-attestation+jwt")
 }).passthrough();
-var zOauthClientAttestationPopHeader = import_zod15.default.literal("OAuth-Client-Attestation-PoP");
+var zOauthClientAttestationPopHeader = import_zod16.default.literal("OAuth-Client-Attestation-PoP");
 var oauthClientAttestationPopHeader = zOauthClientAttestationPopHeader.value;
-var zClientAttestationPopJwtPayload = import_zod15.default.object({
+var zClientAttestationPopJwtPayload = import_zod16.default.object({
   ...zJwtPayload.shape,
-  iss: import_zod15.default.string(),
-  exp: import_utils30.zInteger,
-  aud: import_utils30.zHttpsUrl,
-  jti: import_zod15.default.string(),
-  nonce: import_zod15.default.optional(import_zod15.default.string())
+  iss: import_zod16.default.string(),
+  exp: import_utils31.zInteger,
+  aud: import_utils31.zHttpsUrl,
+  jti: import_zod16.default.string(),
+  nonce: import_zod16.default.optional(import_zod16.default.string())
 }).passthrough();
-var zClientAttestationPopJwtHeader = import_zod15.default.object({
+var zClientAttestationPopJwtHeader = import_zod16.default.object({
   ...zJwtHeader.shape,
-  typ: import_zod15.default.literal("oauth-client-attestation-pop+jwt")
+  typ: import_zod16.default.literal("oauth-client-attestation-pop+jwt")
 }).passthrough();
 
 // src/client-attestation/clent-attestation.ts
@@ -1870,14 +1915,14 @@ async function verifyClientAttestationJwt(options) {
   };
 }
 async function createClientAttestationJwt(options) {
-  const header = (0, import_utils31.parseWithErrorHandling)(zClientAttestationJwtHeader, {
+  const header = (0, import_utils32.parseWithErrorHandling)(zClientAttestationJwtHeader, {
     typ: "oauth-client-attestation+jwt",
     ...jwtHeaderFromJwtSigner(options.signer)
   });
-  const payload = (0, import_utils31.parseWithErrorHandling)(zClientAttestationJwtPayload, {
+  const payload = (0, import_utils32.parseWithErrorHandling)(zClientAttestationJwtPayload, {
     iss: options.issuer,
-    iat: (0, import_utils31.dateToSeconds)(options.issuedAt),
-    exp: (0, import_utils31.dateToSeconds)(options.expiresAt),
+    iat: (0, import_utils32.dateToSeconds)(options.issuedAt),
+    exp: (0, import_utils32.dateToSeconds)(options.expiresAt),
     sub: options.clientId,
     cnf: options.confirmation,
     ...options.additionalPayload
@@ -1904,7 +1949,7 @@ function extractClientAttestationJwtsFromHeaders(headers) {
 }
 
 // src/client-attestation/client-attestation-pop.ts
-var import_utils32 = require("@openid4vc/utils");
+var import_utils33 = require("@openid4vc/utils");
 async function createClientAttestationForRequest(options) {
   const clientAttestationPopJwt = await createClientAttestationPopJwt({
     authorizationServer: options.authorizationServer,
@@ -1962,7 +2007,7 @@ async function verifyClientAttestationPopJwt(options) {
   };
 }
 async function createClientAttestationPopJwt(options) {
-  const header = (0, import_utils32.parseWithErrorHandling)(zClientAttestationPopJwtHeader, {
+  const header = (0, import_utils33.parseWithErrorHandling)(zClientAttestationPopJwtHeader, {
     typ: "oauth-client-attestation-pop+jwt",
     alg: options.signer.alg
   });
@@ -1971,13 +2016,13 @@ async function createClientAttestationPopJwt(options) {
     headerSchema: zClientAttestationJwtHeader,
     payloadSchema: zClientAttestationJwtPayload
   });
-  const expiresAt = options.expiresAt ?? (0, import_utils32.addSecondsToDate)(options.issuedAt ?? /* @__PURE__ */ new Date(), 1 * 60);
-  const payload = (0, import_utils32.parseWithErrorHandling)(zClientAttestationPopJwtPayload, {
+  const expiresAt = options.expiresAt ?? (0, import_utils33.addSecondsToDate)(options.issuedAt ?? /* @__PURE__ */ new Date(), 1 * 60);
+  const payload = (0, import_utils33.parseWithErrorHandling)(zClientAttestationPopJwtPayload, {
     aud: options.authorizationServer,
     iss: clientAttestation.payload.sub,
-    iat: (0, import_utils32.dateToSeconds)(options.issuedAt),
-    exp: (0, import_utils32.dateToSeconds)(expiresAt),
-    jti: (0, import_utils32.encodeToBase64Url)(await options.callbacks.generateRandom(32)),
+    iat: (0, import_utils33.dateToSeconds)(options.issuedAt),
+    exp: (0, import_utils33.dateToSeconds)(expiresAt),
+    jti: (0, import_utils33.encodeToBase64Url)(await options.callbacks.generateRandom(32)),
     nonce: options.nonce,
     ...options.additionalPayload
   });
@@ -1994,7 +2039,7 @@ var Oauth2AuthorizationServer = class {
     this.options = options;
   }
   createAuthorizationServerMetadata(authorizationServerMetadata) {
-    return (0, import_utils33.parseWithErrorHandling)(
+    return (0, import_utils34.parseWithErrorHandling)(
       zAuthorizationServerMetadata,
       authorizationServerMetadata,
       "Error validating authorization server metadata"
@@ -2103,25 +2148,12 @@ var Oauth2AuthorizationServer = class {
   }
 };
 
-// src/Oauth2ResourceServer.ts
-var Oauth2ResourceServer = class {
-  constructor(options) {
-    this.options = options;
-  }
-  async verifyResourceRequest(options) {
-    return verifyResourceRequest({
-      callbacks: this.options.callbacks,
-      ...options
-    });
-  }
-};
-
 // src/Oauth2Client.ts
-var import_utils40 = require("@openid4vc/utils");
+var import_utils41 = require("@openid4vc/utils");
 
 // src/access-token/retrieve-access-token.ts
-var import_utils34 = require("@openid4vc/utils");
 var import_utils35 = require("@openid4vc/utils");
+var import_utils36 = require("@openid4vc/utils");
 async function retrievePreAuthorizedCodeAccessToken(options) {
   const request = {
     grant_type: preAuthorizedCodeGrantIdentifier,
@@ -2174,8 +2206,8 @@ async function retrieveRefreshTokenAccessToken(options) {
   });
 }
 async function retrieveAccessToken(options) {
-  const fetchWithZod = (0, import_utils34.createZodFetcher)(options.callbacks.fetch);
-  const accessTokenRequest = (0, import_utils34.parseWithErrorHandling)(
+  const fetchWithZod = (0, import_utils35.createZodFetcher)(options.callbacks.fetch);
+  const accessTokenRequest = (0, import_utils35.parseWithErrorHandling)(
     zAccessTokenRequest,
     options.request,
     "Error validating access token request"
@@ -2200,19 +2232,19 @@ async function retrieveAccessToken(options) {
         callbacks: options.callbacks,
         nonce: dpop.nonce
       }) : void 0;
-      const requestQueryParams = (0, import_utils34.objectToQueryParams)({
+      const requestQueryParams = (0, import_utils35.objectToQueryParams)({
         ...accessTokenRequest,
         ...clientAttestation?.body
       });
       const { response, result } = await fetchWithZod(
         zAccessTokenResponse,
-        import_utils34.ContentType.Json,
+        import_utils35.ContentType.Json,
         options.authorizationServerMetadata.token_endpoint,
         {
           body: requestQueryParams.toString(),
           method: "POST",
           headers: {
-            "Content-Type": import_utils34.ContentType.XWwwFormUrlencoded,
+            "Content-Type": import_utils35.ContentType.XWwwFormUrlencoded,
             ...clientAttestation?.headers,
             ...dpopHeaders
           }
@@ -2229,7 +2261,7 @@ async function retrieveAccessToken(options) {
             response
           );
         }
-        throw new import_utils35.InvalidFetchResponseError(
+        throw new import_utils36.InvalidFetchResponseError(
           `Unable to retrieve access token from '${options.authorizationServerMetadata.token_endpoint}'. Received response with status ${response.status}`,
           await response.clone().text(),
           response
@@ -2251,10 +2283,10 @@ async function retrieveAccessToken(options) {
 }
 
 // src/authorization-challenge/send-authorization-challenge.ts
-var import_utils36 = require("@openid4vc/utils");
 var import_utils37 = require("@openid4vc/utils");
+var import_utils38 = require("@openid4vc/utils");
 async function sendAuthorizationChallengeRequest(options) {
-  const fetchWithZod = (0, import_utils36.createZodFetcher)(options.callbacks.fetch);
+  const fetchWithZod = (0, import_utils37.createZodFetcher)(options.callbacks.fetch);
   const authorizationServerMetadata = options.authorizationServerMetadata;
   const authorizationChallengeEndpoint = authorizationServerMetadata.authorization_challenge_endpoint;
   if (!authorizationChallengeEndpoint) {
@@ -2272,7 +2304,7 @@ async function sendAuthorizationChallengeRequest(options) {
     clientAttestation: options.clientAttestation,
     callbacks: options.callbacks
   }) : void 0;
-  const authorizationChallengeRequest = (0, import_utils36.parseWithErrorHandling)(zAuthorizationChallengeRequest, {
+  const authorizationChallengeRequest = (0, import_utils37.parseWithErrorHandling)(zAuthorizationChallengeRequest, {
     ...options.additionalRequestPayload,
     auth_session: options.authSession,
     client_id: options.clientId,
@@ -2297,15 +2329,15 @@ async function sendAuthorizationChallengeRequest(options) {
       }) : void 0;
       const { response, result } = await fetchWithZod(
         zAuthorizationChallengeResponse,
-        import_utils36.ContentType.Json,
+        import_utils37.ContentType.Json,
         authorizationChallengeEndpoint,
         {
           method: "POST",
-          body: (0, import_utils36.objectToQueryParams)(authorizationChallengeRequest).toString(),
+          body: (0, import_utils37.objectToQueryParams)(authorizationChallengeRequest).toString(),
           headers: {
             ...clientAttestation?.headers,
             ...dpopHeaders,
-            "Content-Type": import_utils36.ContentType.XWwwFormUrlencoded
+            "Content-Type": import_utils37.ContentType.XWwwFormUrlencoded
           }
         }
       );
@@ -2320,14 +2352,14 @@ async function sendAuthorizationChallengeRequest(options) {
             response
           );
         }
-        throw new import_utils37.InvalidFetchResponseError(
+        throw new import_utils38.InvalidFetchResponseError(
           `Error requesting authorization code from authorization challenge endpoint '${authorizationServerMetadata.authorization_challenge_endpoint}'. Received response with status ${response.status}`,
           await response.clone().text(),
           response
         );
       }
       if (!result.success) {
-        throw new import_utils36.ValidationError("Error validating authorization challenge response", result.error);
+        throw new import_utils37.ValidationError("Error validating authorization challenge response", result.error);
       }
       const dpopNonce = extractDpopNonceFromHeaders(response.headers) ?? void 0;
       return {
@@ -2343,8 +2375,8 @@ async function sendAuthorizationChallengeRequest(options) {
 }
 
 // src/authorization-request/create-authorization-request.ts
-var import_utils38 = require("@openid4vc/utils");
 var import_utils39 = require("@openid4vc/utils");
+var import_utils40 = require("@openid4vc/utils");
 async function createAuthorizationRequestUrl(options) {
   const authorizationServerMetadata = options.authorizationServerMetadata;
   const pushedAuthorizationRequestEndpoint = authorizationServerMetadata.pushed_authorization_request_endpoint;
@@ -2426,7 +2458,7 @@ async function createAuthorizationRequestUrl(options) {
       });
     }
   }
-  const authorizationRequestUrl = `${authorizationServerMetadata.authorization_endpoint}?${(0, import_utils38.objectToQueryParams)(pushedAuthorizationRequest ?? authorizationRequest).toString()}`;
+  const authorizationRequestUrl = `${authorizationServerMetadata.authorization_endpoint}?${(0, import_utils39.objectToQueryParams)(pushedAuthorizationRequest ?? authorizationRequest).toString()}`;
   return {
     authorizationRequestUrl,
     pkce,
@@ -2434,7 +2466,7 @@ async function createAuthorizationRequestUrl(options) {
   };
 }
 async function pushAuthorizationRequest(options) {
-  const fetchWithZod = (0, import_utils38.createZodFetcher)(options.fetch);
+  const fetchWithZod = (0, import_utils39.createZodFetcher)(options.fetch);
   if (options.authorizationRequest.request_uri) {
     throw new Oauth2Error(
       `Authorization request contains 'request_uri' parameter. This is not allowed for pushed authorization reuqests.`
@@ -2442,14 +2474,14 @@ async function pushAuthorizationRequest(options) {
   }
   const { response, result } = await fetchWithZod(
     zPushedAuthorizationResponse,
-    import_utils38.ContentType.Json,
+    import_utils39.ContentType.Json,
     options.pushedAuthorizationRequestEndpoint,
     {
       method: "POST",
-      body: (0, import_utils38.objectToQueryParams)(options.authorizationRequest).toString(),
+      body: (0, import_utils39.objectToQueryParams)(options.authorizationRequest).toString(),
       headers: {
         ...options.headers,
-        "Content-Type": import_utils38.ContentType.XWwwFormUrlencoded
+        "Content-Type": import_utils39.ContentType.XWwwFormUrlencoded
       }
     }
   );
@@ -2464,7 +2496,7 @@ async function pushAuthorizationRequest(options) {
         response
       );
     }
-    throw new import_utils39.InvalidFetchResponseError(
+    throw new import_utils40.InvalidFetchResponseError(
       `Unable to push authorization request to '${options.pushedAuthorizationRequestEndpoint}'. Received response with status ${response.status}`,
       await response.clone().text(),
       response
@@ -2534,7 +2566,7 @@ var Oauth2Client = class {
         const isRecoverableError = error instanceof Oauth2ClientAuthorizationChallengeError && error.errorResponse.error === "redirect_to_web" /* RedirectToWeb */;
         if (!isRecoverableError) throw error;
         if (error.errorResponse.request_uri) {
-          const authorizationRequestUrl = `${options.authorizationServerMetadata.authorization_endpoint}?${(0, import_utils40.objectToQueryParams)(
+          const authorizationRequestUrl = `${options.authorizationServerMetadata.authorization_endpoint}?${(0, import_utils41.objectToQueryParams)(
             {
               request_uri: error.errorResponse.request_uri,
               client_id: options.clientId
@@ -2663,6 +2695,19 @@ var Oauth2Client = class {
     });
   }
 };
+
+// src/Oauth2ResourceServer.ts
+var Oauth2ResourceServer = class {
+  constructor(options) {
+    this.options = options;
+  }
+  async verifyResourceRequest(options) {
+    return verifyResourceRequest({
+      callbacks: this.options.callbacks,
+      ...options
+    });
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   HashAlgorithm,
@@ -2687,6 +2732,7 @@ var Oauth2Client = class {
   clientAuthenticationDynamic,
   clientAuthenticationNone,
   decodeJwt,
+  decodeJwtHeader,
   fetchAuthorizationServerMetadata,
   fetchJwks,
   fetchWellKnownMetadata,
@@ -2701,10 +2747,13 @@ var Oauth2Client = class {
   setGlobalConfig,
   verifyJwt,
   verifyResourceRequest,
+  zAlgValueNotNone,
   zAuthorizationCodeGrantIdentifier,
   zAuthorizationServerMetadata,
+  zCompactJwe,
   zCompactJwt,
   zJwk,
+  zJwkSet,
   zJwtHeader,
   zJwtPayload,
   zOauth2ErrorResponse,