@openid4vc/oauth2 0.3.0-alpha-20250206100745 → 0.3.0-alpha-20250224151429

package/dist/index.mjs

@@ -26,6 +26,17 @@ var Oauth2ErrorCodes = /* @__PURE__ */ ((Oauth2ErrorCodes2) => {
   Oauth2ErrorCodes2["InvalidProof"] = "invalid_proof";
   Oauth2ErrorCodes2["InvalidNonce"] = "invalid_nonce";
   Oauth2ErrorCodes2["InvalidEncryptionParameters"] = "invalid_encryption_parameters";
+  Oauth2ErrorCodes2["InvalidRequestUri"] = "invalid_request_uri";
+  Oauth2ErrorCodes2["InvalidRequestObject"] = "invalid_request_object";
+  Oauth2ErrorCodes2["RequestNotSupported"] = "request_not_supported";
+  Oauth2ErrorCodes2["RequestUriNotSupported"] = "request_uri_not_supported";
+  Oauth2ErrorCodes2["VpFormatsNotSupported"] = "vp_formats_not_supported";
+  Oauth2ErrorCodes2["AccessDenied"] = "access_denied";
+  Oauth2ErrorCodes2["InvalidPresentationDefinitionUri"] = "invalid_presentation_definition_uri";
+  Oauth2ErrorCodes2["InvalidPresentationDefinitionReference"] = "invalid_presentation_definition_reference";
+  Oauth2ErrorCodes2["InvalidRequestUriMethod"] = "invalid_request_uri_method";
+  Oauth2ErrorCodes2["InvalidTransactionData"] = "invalid_transaction_data";
+  Oauth2ErrorCodes2["WalletUnavailable"] = "wallet_unavailable";
   return Oauth2ErrorCodes2;
 })(Oauth2ErrorCodes || {});
 var zOauth2ErrorResponse = z.object({
@@ -166,75 +177,19 @@ var zJwk = z3.object({
   q: z3.optional(z3.string()),
   qi: z3.optional(z3.string()),
   use: z3.optional(z3.string()),
-  x5c: z3.optional(z3.string()),
+  x5c: z3.optional(z3.array(z3.string())),
   x5t: z3.optional(z3.string()),
   "x5t#S256": z3.optional(z3.string()),
   x5u: z3.optional(z3.string())
 }).passthrough();
 var zJwkSet = z3.object({ keys: z3.array(zJwk) }).passthrough();
 
-// src/common/jwt/verify-jwt.ts
-import { dateToSeconds } from "@openid4vc/utils";
-
-// src/error/Oauth2JwtVerificationError.ts
-var Oauth2JwtVerificationError = class extends Oauth2Error {
-  constructor(message, options) {
-    const errorMessage = message ?? "Error verifiying jwt.";
-    super(errorMessage, options);
-  }
-};
-
-// src/common/jwt/verify-jwt.ts
-async function verifyJwt(options) {
-  const errorMessage = options.errorMessage ?? "Error during verification of jwt.";
-  let signerJwk;
-  try {
-    const result = await options.verifyJwtCallback(options.signer, {
-      header: options.header,
-      payload: options.payload,
-      compact: options.compact
-    });
-    if (!result.verified) throw new Oauth2JwtVerificationError(errorMessage);
-    signerJwk = result.signerJwk;
-  } catch (error) {
-    if (error instanceof Oauth2JwtVerificationError) throw error;
-    throw new Oauth2JwtVerificationError(errorMessage, { cause: error });
-  }
-  const nowInSeconds = dateToSeconds(options.now ?? /* @__PURE__ */ new Date());
-  const skewInSeconds = options.allowedSkewInSeconds ?? 0;
-  const timeBasedValidation = options.skipTimeBasedValidation !== void 0 ? !options.skipTimeBasedValidation : true;
-  if (timeBasedValidation && options.payload.nbf && nowInSeconds < options.payload.nbf - skewInSeconds) {
-    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'nbf' is in the future`);
-  }
-  if (timeBasedValidation && options.payload.exp && nowInSeconds > options.payload.exp + skewInSeconds) {
-    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'exp' is in the past`);
-  }
-  if (options.expectedAudience && options.expectedAudience !== options.payload.aud) {
-    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'aud' does not match expected value.`);
-  }
-  if (options.expectedIssuer && options.expectedIssuer !== options.payload.iss) {
-    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'iss' does not match expected value.`);
-  }
-  if (options.expectedNonce && options.expectedNonce !== options.payload.nonce) {
-    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'nonce' does not match expected value.`);
-  }
-  if (options.expectedSubject && options.expectedSubject !== options.payload.sub) {
-    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'sub' does not match expected value.`);
-  }
-  return {
-    signer: {
-      ...options.signer,
-      publicJwk: signerJwk
-    }
-  };
-}
-
 // src/common/jwt/decode-jwt.ts
 import {
-  decodeBase64,
-  encodeToUtf8String,
-  parseWithErrorHandling as parseWithErrorHandling2,
-  stringToJsonWithErrorHandling
+  decodeBase64 as decodeBase642,
+  encodeToUtf8String as encodeToUtf8String2,
+  parseWithErrorHandling as parseWithErrorHandling3,
+  stringToJsonWithErrorHandling as stringToJsonWithErrorHandling2
 } from "@openid4vc/utils";
 
 // src/error/Oauth2JwtParseError.ts
@@ -245,6 +200,14 @@ var Oauth2JwtParseError = class extends Oauth2Error {
   }
 };
 
+// src/common/jwt/decode-jwt-header.ts
+import {
+  decodeBase64,
+  encodeToUtf8String,
+  parseWithErrorHandling as parseWithErrorHandling2,
+  stringToJsonWithErrorHandling
+} from "@openid4vc/utils";
+
 // src/common/jwt/z-jwt.ts
 import { zInteger } from "@openid4vc/utils";
 import z5 from "zod";
@@ -283,28 +246,44 @@ var zJwtHeader = z5.object({
   trust_chain: z5.array(z5.string()).optional()
 }).passthrough();
 
-// src/common/jwt/decode-jwt.ts
-function decodeJwt(options) {
+// src/common/jwt/decode-jwt-header.ts
+function decodeJwtHeader(options) {
   const jwtParts = options.jwt.split(".");
-  if (jwtParts.length !== 3) {
+  if (jwtParts.length <= 2) {
     throw new Oauth2JwtParseError("Jwt is not a valid jwt, unable to decode");
   }
   let headerJson;
-  let payloadJson;
   try {
     headerJson = stringToJsonWithErrorHandling(
       encodeToUtf8String(decodeBase64(jwtParts[0])),
       "Unable to parse jwt header to JSON"
     );
-    payloadJson = stringToJsonWithErrorHandling(
-      encodeToUtf8String(decodeBase64(jwtParts[1])),
+  } catch (error) {
+    throw new Oauth2JwtParseError(`Error parsing JWT. ${error instanceof Error ? error.message : ""}`);
+  }
+  const header = parseWithErrorHandling2(options.headerSchema ?? zJwtHeader, headerJson);
+  return {
+    header
+  };
+}
+
+// src/common/jwt/decode-jwt.ts
+function decodeJwt(options) {
+  const jwtParts = options.jwt.split(".");
+  if (jwtParts.length !== 3) {
+    throw new Oauth2JwtParseError("Jwt is not a valid jwt, unable to decode");
+  }
+  let payloadJson;
+  try {
+    payloadJson = stringToJsonWithErrorHandling2(
+      encodeToUtf8String2(decodeBase642(jwtParts[1])),
       "Unable to parse jwt payload to JSON"
     );
   } catch (error) {
-    throw new Oauth2JwtParseError("Error parsing JWT");
+    throw new Oauth2JwtParseError(`Error parsing JWT. ${error instanceof Error ? error.message : ""}`);
   }
-  const header = parseWithErrorHandling2(options.headerSchema ?? zJwtHeader, headerJson);
-  const payload = parseWithErrorHandling2(options.payloadSchema ?? zJwtPayload, payloadJson);
+  const { header } = decodeJwtHeader({ jwt: options.jwt, headerSchema: options.headerSchema });
+  const payload = parseWithErrorHandling3(options.payloadSchema ?? zJwtPayload, payloadJson);
   return {
     header,
     payload,
@@ -394,6 +373,41 @@ function jwtSignerFromJwt({ header, payload }) {
   };
 }
 
+// src/common/jwt/z-jwe.ts
+import { z as z6 } from "zod";
+var zCompactJwe = z6.string().regex(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, {
+  message: "Not a valid compact jwe"
+});
+
+// src/index.ts
+import { InvalidFetchResponseError as InvalidFetchResponseError7 } from "@openid4vc/utils";
+
+// src/error/Oauth2ClientErrorResponseError.ts
+var Oauth2ClientErrorResponseError = class extends Oauth2Error {
+  constructor(message, errorResponse, response) {
+    super(`${message}
+${JSON.stringify(errorResponse, null, 2)}`);
+    this.errorResponse = errorResponse;
+    this.response = response.clone();
+  }
+};
+
+// src/error/Oauth2ClientAuthorizationChallengeError.ts
+var Oauth2ClientAuthorizationChallengeError = class extends Oauth2ClientErrorResponseError {
+  constructor(message, errorResponse, response) {
+    super(message, errorResponse, response);
+    this.errorResponse = errorResponse;
+  }
+};
+
+// src/error/Oauth2JwtVerificationError.ts
+var Oauth2JwtVerificationError = class extends Oauth2Error {
+  constructor(message, options) {
+    const errorMessage = message ?? "Error verifiying jwt.";
+    super(errorMessage, options);
+  }
+};
+
 // src/error/Oauth2ResourceUnauthorizedError.ts
 import { encodeWwwAuthenticateHeader, parseWwwAuthenticateHeader } from "@openid4vc/utils";
 var Oauth2ResourceUnauthorizedError = class _Oauth2ResourceUnauthorizedError extends Oauth2Error {
@@ -432,27 +446,6 @@ ${JSON.stringify(wwwAuthenticateHeaders, null, 2)}`);
   }
 };
 
-// src/index.ts
-import { InvalidFetchResponseError as InvalidFetchResponseError7 } from "@openid4vc/utils";
-
-// src/error/Oauth2ClientErrorResponseError.ts
-var Oauth2ClientErrorResponseError = class extends Oauth2Error {
-  constructor(message, errorResponse, response) {
-    super(`${message}
-${JSON.stringify(errorResponse, null, 2)}`);
-    this.errorResponse = errorResponse;
-    this.response = response.clone();
-  }
-};
-
-// src/error/Oauth2ClientAuthorizationChallengeError.ts
-var Oauth2ClientAuthorizationChallengeError = class extends Oauth2ClientErrorResponseError {
-  constructor(message, errorResponse, response) {
-    super(message, errorResponse, response);
-    this.errorResponse = errorResponse;
-  }
-};
-
 // src/error/Oauth2ServerErrorResponseError.ts
 var Oauth2ServerErrorResponseError = class extends Oauth2Error {
   constructor(errorResponse, options) {
@@ -466,44 +459,6 @@ ${JSON.stringify(errorResponse, null, 2)}`,
   }
 };
 
-// src/metadata/authorization-server/z-authorization-server-metadata.ts
-import { zHttpsUrl } from "@openid4vc/utils";
-import z6 from "zod";
-var zAuthorizationServerMetadata = z6.object({
-  issuer: zHttpsUrl,
-  token_endpoint: zHttpsUrl,
-  token_endpoint_auth_methods_supported: z6.optional(z6.array(z6.string())),
-  authorization_endpoint: z6.optional(zHttpsUrl),
-  jwks_uri: z6.optional(zHttpsUrl),
-  // RFC7636
-  code_challenge_methods_supported: z6.optional(z6.array(z6.string())),
-  // RFC9449
-  dpop_signing_alg_values_supported: z6.optional(z6.array(z6.string())),
-  // RFC9126
-  require_pushed_authorization_requests: z6.optional(z6.boolean()),
-  pushed_authorization_request_endpoint: z6.optional(zHttpsUrl),
-  // RFC9068
-  introspection_endpoint: z6.optional(zHttpsUrl),
-  introspection_endpoint_auth_methods_supported: z6.optional(
-    z6.array(z6.union([z6.literal("client_secret_jwt"), z6.literal("private_key_jwt"), z6.string()]))
-  ),
-  introspection_endpoint_auth_signing_alg_values_supported: z6.optional(z6.array(zAlgValueNotNone)),
-  // FiPA (no RFC yet)
-  authorization_challenge_endpoint: z6.optional(zHttpsUrl),
-  // From OID4VCI specification
-  pre_authorized_grant_anonymous_access_supported: z6.optional(z6.boolean())
-}).passthrough().refine(
-  ({
-    introspection_endpoint_auth_methods_supported: methodsSupported,
-    introspection_endpoint_auth_signing_alg_values_supported: algValuesSupported
-  }) => {
-    if (!methodsSupported) return true;
-    if (!methodsSupported.includes("private_key_jwt") && !methodsSupported.includes("client_secret_jwt")) return true;
-    return algValuesSupported !== void 0 && algValuesSupported.length > 0;
-  },
-  `Metadata value 'introspection_endpoint_auth_signing_alg_values_supported' must be defined if metadata 'introspection_endpoint_auth_methods_supported' value contains values 'private_key_jwt' or 'client_secret_jwt'`
-);
-
 // src/metadata/authorization-server/authorization-server-metadata.ts
 import { joinUriParts } from "@openid4vc/utils";
 
@@ -610,6 +565,44 @@ async function fetchWellKnownMetadata(wellKnownMetadataUrl, schema, fetch) {
   return result.data;
 }
 
+// src/metadata/authorization-server/z-authorization-server-metadata.ts
+import { zHttpsUrl } from "@openid4vc/utils";
+import z7 from "zod";
+var zAuthorizationServerMetadata = z7.object({
+  issuer: zHttpsUrl,
+  token_endpoint: zHttpsUrl,
+  token_endpoint_auth_methods_supported: z7.optional(z7.array(z7.string())),
+  authorization_endpoint: z7.optional(zHttpsUrl),
+  jwks_uri: z7.optional(zHttpsUrl),
+  // RFC7636
+  code_challenge_methods_supported: z7.optional(z7.array(z7.string())),
+  // RFC9449
+  dpop_signing_alg_values_supported: z7.optional(z7.array(z7.string())),
+  // RFC9126
+  require_pushed_authorization_requests: z7.optional(z7.boolean()),
+  pushed_authorization_request_endpoint: z7.optional(zHttpsUrl),
+  // RFC9068
+  introspection_endpoint: z7.optional(zHttpsUrl),
+  introspection_endpoint_auth_methods_supported: z7.optional(
+    z7.array(z7.union([z7.literal("client_secret_jwt"), z7.literal("private_key_jwt"), z7.string()]))
+  ),
+  introspection_endpoint_auth_signing_alg_values_supported: z7.optional(z7.array(zAlgValueNotNone)),
+  // FiPA (no RFC yet)
+  authorization_challenge_endpoint: z7.optional(zHttpsUrl),
+  // From OpenID4VCI specification
+  pre_authorized_grant_anonymous_access_supported: z7.optional(z7.boolean())
+}).passthrough().refine(
+  ({
+    introspection_endpoint_auth_methods_supported: methodsSupported,
+    introspection_endpoint_auth_signing_alg_values_supported: algValuesSupported
+  }) => {
+    if (!methodsSupported) return true;
+    if (!methodsSupported.includes("private_key_jwt") && !methodsSupported.includes("client_secret_jwt")) return true;
+    return algValuesSupported !== void 0 && algValuesSupported.length > 0;
+  },
+  `Metadata value 'introspection_endpoint_auth_signing_alg_values_supported' must be defined if metadata 'introspection_endpoint_auth_methods_supported' value contains values 'private_key_jwt' or 'client_secret_jwt'`
+);
+
 // src/metadata/authorization-server/authorization-server-metadata.ts
 var wellKnownAuthorizationServerSuffix = ".well-known/oauth-authorization-server";
 var wellKnownOpenIdConfigurationServerSuffix = ".well-known/openid-configuration";
@@ -681,25 +674,78 @@ async function fetchJwks(authorizationServer, fetch) {
   return result.data;
 }
 
+// src/common/jwt/verify-jwt.ts
+import { dateToSeconds } from "@openid4vc/utils";
+async function verifyJwt(options) {
+  const errorMessage = options.errorMessage ?? "Error during verification of jwt.";
+  let signerJwk;
+  try {
+    const result = await options.verifyJwtCallback(options.signer, {
+      header: options.header,
+      payload: options.payload,
+      compact: options.compact
+    });
+    if (!result.verified) throw new Oauth2JwtVerificationError(errorMessage);
+    signerJwk = result.signerJwk;
+  } catch (error) {
+    if (error instanceof Oauth2JwtVerificationError) throw error;
+    throw new Oauth2JwtVerificationError(errorMessage, { cause: error });
+  }
+  const nowInSeconds = dateToSeconds(options.now ?? /* @__PURE__ */ new Date());
+  const skewInSeconds = options.allowedSkewInSeconds ?? 0;
+  const timeBasedValidation = options.skipTimeBasedValidation !== void 0 ? !options.skipTimeBasedValidation : true;
+  if (timeBasedValidation && options.payload.nbf && nowInSeconds < options.payload.nbf - skewInSeconds) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'nbf' is in the future`);
+  }
+  if (timeBasedValidation && options.payload.exp && nowInSeconds > options.payload.exp + skewInSeconds) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'exp' is in the past`);
+  }
+  if (options.expectedAudience && options.expectedAudience !== options.payload.aud) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'aud' does not match expected value.`);
+  }
+  if (options.expectedIssuer && options.expectedIssuer !== options.payload.iss) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'iss' does not match expected value.`);
+  }
+  if (options.expectedNonce && options.expectedNonce !== options.payload.nonce) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'nonce' does not match expected value.`);
+  }
+  if (options.expectedSubject && options.expectedSubject !== options.payload.sub) {
+    throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'sub' does not match expected value.`);
+  }
+  if (options.requiredClaims) {
+    for (const claim of options.requiredClaims) {
+      if (!options.payload[claim]) {
+        throw new Oauth2JwtVerificationError(`${errorMessage} jwt '${claim}' is missing.`);
+      }
+    }
+  }
+  return {
+    signer: {
+      ...options.signer,
+      publicJwk: signerJwk
+    }
+  };
+}
+
 // src/access-token/z-access-token-jwt.ts
 import { zInteger as zInteger2 } from "@openid4vc/utils";
-import z7 from "zod";
-var zAccessTokenProfileJwtHeader = z7.object({
+import z8 from "zod";
+var zAccessTokenProfileJwtHeader = z8.object({
   ...zJwtHeader.shape,
-  typ: z7.enum(["application/at+jwt", "at+jwt"])
+  typ: z8.enum(["application/at+jwt", "at+jwt"])
 }).passthrough();
-var zAccessTokenProfileJwtPayload = z7.object({
+var zAccessTokenProfileJwtPayload = z8.object({
   ...zJwtPayload.shape,
-  iss: z7.string(),
+  iss: z8.string(),
   exp: zInteger2,
   iat: zInteger2,
-  aud: z7.string(),
-  sub: z7.string(),
-  // REQUIRED according to RFC 9068, but OID4VCI allows anonymous access
-  client_id: z7.optional(z7.string()),
-  jti: z7.string(),
+  aud: z8.string(),
+  sub: z8.string(),
+  // REQUIRED according to RFC 9068, but OpenID4VCI allows anonymous access
+  client_id: z8.optional(z8.string()),
+  jti: z8.string(),
   // SHOULD be included in the authorization request contained it
-  scope: z7.optional(z7.string())
+  scope: z8.optional(z8.string())
 }).passthrough();
 
 // src/access-token/verify-access-token.ts
@@ -752,24 +798,24 @@ import {
   dateToSeconds as dateToSeconds2,
   decodeUtf8String as decodeUtf8String2,
   encodeToBase64Url as encodeToBase64Url2,
-  parseWithErrorHandling as parseWithErrorHandling3
+  parseWithErrorHandling as parseWithErrorHandling4
 } from "@openid4vc/utils";
 
 // src/dpop/z-dpop.ts
 import { zHttpMethod, zHttpsUrl as zHttpsUrl2, zInteger as zInteger3 } from "@openid4vc/utils";
-import z8 from "zod";
-var zDpopJwtPayload = z8.object({
+import z9 from "zod";
+var zDpopJwtPayload = z9.object({
   ...zJwtPayload.shape,
   iat: zInteger3,
   htu: zHttpsUrl2,
   htm: zHttpMethod,
-  jti: z8.string(),
+  jti: z9.string(),
   // Only required when presenting in combination with access token
-  ath: z8.optional(z8.string())
+  ath: z9.optional(z9.string())
 }).passthrough();
-var zDpopJwtHeader = z8.object({
+var zDpopJwtHeader = z9.object({
   ...zJwtHeader.shape,
-  typ: z8.literal("dpop+jwt"),
+  typ: z9.literal("dpop+jwt"),
   jwk: zJwk
 }).passthrough();
 
@@ -785,12 +831,12 @@ async function createDpopJwt(options) {
   if (options.accessToken) {
     ath = encodeToBase64Url2(await options.callbacks.hash(decodeUtf8String2(options.accessToken), "SHA-256" /* Sha256 */));
   }
-  const header = parseWithErrorHandling3(zDpopJwtHeader, {
+  const header = parseWithErrorHandling4(zDpopJwtHeader, {
     typ: "dpop+jwt",
     jwk: options.signer.publicJwk,
     alg: options.signer.alg
   });
-  const payload = parseWithErrorHandling3(zDpopJwtPayload, {
+  const payload = parseWithErrorHandling4(zDpopJwtPayload, {
     htu: htuFromRequestUrl(options.request.url),
     iat: dateToSeconds2(options.issuedAt),
     htm: options.request.method,
@@ -1013,37 +1059,37 @@ async function resourceRequest(options) {
 import { ValidationError as ValidationError2 } from "@openid4vc/utils";
 
 // src/access-token/introspect-token.ts
-import { ContentType as ContentType3, createZodFetcher as createZodFetcher3, objectToQueryParams, parseWithErrorHandling as parseWithErrorHandling4 } from "@openid4vc/utils";
+import { ContentType as ContentType3, createZodFetcher as createZodFetcher3, objectToQueryParams, parseWithErrorHandling as parseWithErrorHandling5 } from "@openid4vc/utils";
 import { InvalidFetchResponseError as InvalidFetchResponseError3 } from "@openid4vc/utils";
 import { Headers } from "@openid4vc/utils";
 
 // src/access-token/z-token-introspection.ts
 import { zInteger as zInteger4 } from "@openid4vc/utils";
-import z9 from "zod";
-var zTokenIntrospectionRequest = z9.object({
-  token: z9.string(),
-  token_type_hint: z9.optional(z9.string())
+import z10 from "zod";
+var zTokenIntrospectionRequest = z10.object({
+  token: z10.string(),
+  token_type_hint: z10.optional(z10.string())
 }).passthrough();
-var zTokenIntrospectionResponse = z9.object({
-  active: z9.boolean(),
-  scope: z9.optional(z9.string()),
-  client_id: z9.optional(z9.string()),
-  username: z9.optional(z9.string()),
-  token_type: z9.optional(z9.string()),
-  exp: z9.optional(zInteger4),
-  iat: z9.optional(zInteger4),
-  nbf: z9.optional(zInteger4),
-  sub: z9.optional(z9.string()),
-  aud: z9.optional(z9.string()),
-  iss: z9.optional(z9.string()),
-  jti: z9.optional(z9.string()),
-  cnf: z9.optional(zJwtConfirmationPayload)
+var zTokenIntrospectionResponse = z10.object({
+  active: z10.boolean(),
+  scope: z10.optional(z10.string()),
+  client_id: z10.optional(z10.string()),
+  username: z10.optional(z10.string()),
+  token_type: z10.optional(z10.string()),
+  exp: z10.optional(zInteger4),
+  iat: z10.optional(zInteger4),
+  nbf: z10.optional(zInteger4),
+  sub: z10.optional(z10.string()),
+  aud: z10.optional(z10.string()),
+  iss: z10.optional(z10.string()),
+  jti: z10.optional(z10.string()),
+  cnf: z10.optional(zJwtConfirmationPayload)
 }).passthrough();
 
 // src/access-token/introspect-token.ts
 async function introspectToken(options) {
   const fetchWithZod = createZodFetcher3(options.callbacks.fetch);
-  const introspectionRequest = parseWithErrorHandling4(zTokenIntrospectionRequest, {
+  const introspectionRequest = parseWithErrorHandling5(zTokenIntrospectionRequest, {
     token: options.token,
     token_type_hint: options.tokenTypeHint,
     ...options.additionalPayload
@@ -1291,17 +1337,17 @@ function clientAuthenticationNone() {
 }
 
 // src/Oauth2AuthorizationServer.ts
-import { parseWithErrorHandling as parseWithErrorHandling11 } from "@openid4vc/utils";
+import { parseWithErrorHandling as parseWithErrorHandling12 } from "@openid4vc/utils";
 
 // src/access-token/create-access-token.ts
-import { addSecondsToDate, dateToSeconds as dateToSeconds3, encodeToBase64Url as encodeToBase64Url4, parseWithErrorHandling as parseWithErrorHandling5 } from "@openid4vc/utils";
+import { addSecondsToDate, dateToSeconds as dateToSeconds3, encodeToBase64Url as encodeToBase64Url4, parseWithErrorHandling as parseWithErrorHandling6 } from "@openid4vc/utils";
 async function createAccessTokenJwt(options) {
-  const header = parseWithErrorHandling5(zAccessTokenProfileJwtHeader, {
+  const header = parseWithErrorHandling6(zAccessTokenProfileJwtHeader, {
     ...jwtHeaderFromJwtSigner(options.signer),
     typ: "at+jwt"
   });
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const payload = parseWithErrorHandling5(zAccessTokenProfileJwtPayload, {
+  const payload = parseWithErrorHandling6(zAccessTokenProfileJwtPayload, {
     iat: dateToSeconds3(now),
     exp: dateToSeconds3(addSecondsToDate(now, options.expiresInSeconds)),
     aud: options.audience,
@@ -1329,45 +1375,45 @@ async function createAccessTokenJwt(options) {
 }
 
 // src/access-token/create-access-token-response.ts
-import { parseWithErrorHandling as parseWithErrorHandling6 } from "@openid4vc/utils";
+import { parseWithErrorHandling as parseWithErrorHandling7 } from "@openid4vc/utils";
 
 // src/access-token/z-access-token.ts
-import z11 from "zod";
+import z12 from "zod";
 import { zHttpsUrl as zHttpsUrl3 } from "@openid4vc/utils";
 
 // src/z-grant-type.ts
-import z10 from "zod";
-var zPreAuthorizedCodeGrantIdentifier = z10.literal("urn:ietf:params:oauth:grant-type:pre-authorized_code");
+import z11 from "zod";
+var zPreAuthorizedCodeGrantIdentifier = z11.literal("urn:ietf:params:oauth:grant-type:pre-authorized_code");
 var preAuthorizedCodeGrantIdentifier = zPreAuthorizedCodeGrantIdentifier.value;
-var zAuthorizationCodeGrantIdentifier = z10.literal("authorization_code");
+var zAuthorizationCodeGrantIdentifier = z11.literal("authorization_code");
 var authorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier.value;
-var zRefreshTokenGrantIdentifier = z10.literal("refresh_token");
+var zRefreshTokenGrantIdentifier = z11.literal("refresh_token");
 var refreshTokenGrantIdentifier = zRefreshTokenGrantIdentifier.value;
 
 // src/access-token/z-access-token.ts
-var zAccessTokenRequest = z11.intersection(
-  z11.object({
+var zAccessTokenRequest = z12.intersection(
+  z12.object({
     // Pre authorized code flow
-    "pre-authorized_code": z11.optional(z11.string()),
+    "pre-authorized_code": z12.optional(z12.string()),
     // Authorization code flow
-    code: z11.optional(z11.string()),
-    redirect_uri: z11.string().url().optional(),
+    code: z12.optional(z12.string()),
+    redirect_uri: z12.string().url().optional(),
     // Refresh token grant
-    refresh_token: z11.optional(z11.string()),
-    resource: z11.optional(zHttpsUrl3),
-    code_verifier: z11.optional(z11.string()),
-    grant_type: z11.union([
+    refresh_token: z12.optional(z12.string()),
+    resource: z12.optional(zHttpsUrl3),
+    code_verifier: z12.optional(z12.string()),
+    grant_type: z12.union([
       zPreAuthorizedCodeGrantIdentifier,
       zAuthorizationCodeGrantIdentifier,
       zRefreshTokenGrantIdentifier,
       // string makes the previous ones unessary, but it does help with error messages
-      z11.string()
+      z12.string()
     ])
   }).passthrough(),
-  z11.object({
-    tx_code: z11.optional(z11.string()),
-    // user_pin is from OID4VCI draft 11
-    user_pin: z11.optional(z11.string())
+  z12.object({
+    tx_code: z12.optional(z12.string()),
+    // user_pin is from OpenID4VCI draft 11
+    user_pin: z12.optional(z12.string())
   }).passthrough().refine(({ tx_code, user_pin }) => !tx_code || !user_pin || user_pin === tx_code, {
     message: `If both 'tx_code' and 'user_pin' are present they must match`
   }).transform(({ tx_code, user_pin, ...rest }) => {
@@ -1377,19 +1423,19 @@ var zAccessTokenRequest = z11.intersection(
     };
   })
 );
-var zAccessTokenResponse = z11.object({
-  access_token: z11.string(),
-  token_type: z11.string(),
-  expires_in: z11.optional(z11.number().int()),
-  scope: z11.optional(z11.string()),
-  state: z11.optional(z11.string()),
-  refresh_token: z11.optional(z11.string()),
-  // Oid4vci specific parameters
-  c_nonce: z11.optional(z11.string()),
-  c_nonce_expires_in: z11.optional(z11.number().int()),
+var zAccessTokenResponse = z12.object({
+  access_token: z12.string(),
+  token_type: z12.string(),
+  expires_in: z12.optional(z12.number().int()),
+  scope: z12.optional(z12.string()),
+  state: z12.optional(z12.string()),
+  refresh_token: z12.optional(z12.string()),
+  // OpenID4VCI specific parameters
+  c_nonce: z12.optional(z12.string()),
+  c_nonce_expires_in: z12.optional(z12.number().int()),
   // TODO: add additional params
-  authorization_details: z11.array(
-    z11.object({
+  authorization_details: z12.array(
+    z12.object({
       // requried when type is openid_credential (so we probably need a discriminator)
       // credential_identifiers: z.array(z.string()),
     }).passthrough()
@@ -1399,7 +1445,7 @@ var zAccessTokenErrorResponse = zOauth2ErrorResponse;
 
 // src/access-token/create-access-token-response.ts
 async function createAccessTokenResponse(options) {
-  const accessTokenResponse = parseWithErrorHandling6(zAccessTokenResponse, {
+  const accessTokenResponse = parseWithErrorHandling7(zAccessTokenResponse, {
     access_token: options.accessToken,
     token_type: options.tokenType,
     expires_in: options.expiresInSeconds,
@@ -1644,69 +1690,69 @@ async function verifyAccessTokenRequestPkce(options, callbacks) {
 }
 
 // src/authorization-challenge/create-authorization-challenge-response.ts
-import { parseWithErrorHandling as parseWithErrorHandling7 } from "@openid4vc/utils";
+import { parseWithErrorHandling as parseWithErrorHandling8 } from "@openid4vc/utils";
 
 // src/authorization-challenge/z-authorization-challenge.ts
 import { zInteger as zInteger5 } from "@openid4vc/utils";
-import z13 from "zod";
+import z14 from "zod";
 
 // src/authorization-request/z-authorization-request.ts
 import { zHttpsUrl as zHttpsUrl4 } from "@openid4vc/utils";
-import z12 from "zod";
-var zAuthorizationRequest = z12.object({
-  response_type: z12.string(),
-  client_id: z12.string(),
-  issuer_state: z12.optional(z12.string()),
-  redirect_uri: z12.string().url().optional(),
-  resource: z12.optional(zHttpsUrl4),
-  scope: z12.optional(z12.string()),
+import z13 from "zod";
+var zAuthorizationRequest = z13.object({
+  response_type: z13.string(),
+  client_id: z13.string(),
+  issuer_state: z13.optional(z13.string()),
+  redirect_uri: z13.string().url().optional(),
+  resource: z13.optional(zHttpsUrl4),
+  scope: z13.optional(z13.string()),
   // DPoP jwk thumbprint
-  dpop_jkt: z12.optional(z12.string()),
-  code_challenge: z12.optional(z12.string()),
-  code_challenge_method: z12.optional(z12.string())
+  dpop_jkt: z13.optional(z13.string()),
+  code_challenge: z13.optional(z13.string()),
+  code_challenge_method: z13.optional(z13.string())
 }).passthrough();
-var zPushedAuthorizationRequest = z12.object({
-  request_uri: z12.string(),
-  client_id: z12.string()
+var zPushedAuthorizationRequest = z13.object({
+  request_uri: z13.string(),
+  client_id: z13.string()
 }).passthrough();
-var zPushedAuthorizationResponse = z12.object({
-  request_uri: z12.string(),
-  expires_in: z12.number().int()
+var zPushedAuthorizationResponse = z13.object({
+  request_uri: z13.string(),
+  expires_in: z13.number().int()
 }).passthrough();
 
 // src/authorization-challenge/z-authorization-challenge.ts
-var zAuthorizationChallengeRequest = z13.object({
+var zAuthorizationChallengeRequest = z14.object({
   // authorization challenge request can include same parameters as an authorization request
   // except for response_type (always `code`), and `client_id` is optional (becase
   // it's possible to do client authentication using different methods)
   ...zAuthorizationRequest.omit({ response_type: true, client_id: true }).shape,
-  client_id: z13.optional(zAuthorizationRequest.shape.client_id),
-  auth_session: z13.optional(z13.string()),
+  client_id: z14.optional(zAuthorizationRequest.shape.client_id),
+  auth_session: z14.optional(z14.string()),
   // DRAFT presentation during issuance
-  presentation_during_issuance_session: z13.optional(z13.string())
+  presentation_during_issuance_session: z14.optional(z14.string())
 }).passthrough();
-var zAuthorizationChallengeResponse = z13.object({
-  authorization_code: z13.string()
+var zAuthorizationChallengeResponse = z14.object({
+  authorization_code: z14.string()
 }).passthrough();
-var zAuthorizationChallengeErrorResponse = z13.object({
+var zAuthorizationChallengeErrorResponse = z14.object({
   ...zOauth2ErrorResponse.shape,
-  auth_session: z13.optional(z13.string()),
-  request_uri: z13.optional(z13.string()),
-  expires_in: z13.optional(zInteger5),
+  auth_session: z14.optional(z14.string()),
+  request_uri: z14.optional(z14.string()),
+  expires_in: z14.optional(zInteger5),
   // DRAFT: presentation during issuance
-  presentation: z13.optional(z13.string())
+  presentation: z14.optional(z14.string())
 }).passthrough();
 
 // src/authorization-challenge/create-authorization-challenge-response.ts
 function createAuthorizationChallengeResponse(options) {
-  const authorizationChallengeResponse = parseWithErrorHandling7(zAuthorizationChallengeResponse, {
+  const authorizationChallengeResponse = parseWithErrorHandling8(zAuthorizationChallengeResponse, {
     ...options.additionalPayload,
     authorization_code: options.authorizationCode
   });
   return { authorizationChallengeResponse };
 }
 function createAuthorizationChallengeErrorResponse(options) {
-  const authorizationChallengeErrorResponse = parseWithErrorHandling7(zAuthorizationChallengeErrorResponse, {
+  const authorizationChallengeErrorResponse = parseWithErrorHandling8(zAuthorizationChallengeErrorResponse, {
     ...options.additionalPayload,
     // General FiPA
     error: options.error,
@@ -1722,9 +1768,9 @@ function createAuthorizationChallengeErrorResponse(options) {
 }
 
 // src/authorization-challenge/parse-authorization-challenge-request.ts
-import { parseWithErrorHandling as parseWithErrorHandling8 } from "@openid4vc/utils";
+import { parseWithErrorHandling as parseWithErrorHandling9 } from "@openid4vc/utils";
 function parseAuthorizationChallengeRequest(options) {
-  const authorizationChallengeRequest = parseWithErrorHandling8(
+  const authorizationChallengeRequest = parseWithErrorHandling9(
     zAuthorizationChallengeRequest,
     options.authorizationChallengeRequest
   );
@@ -1732,52 +1778,52 @@ function parseAuthorizationChallengeRequest(options) {
 }
 
 // src/client-attestation/clent-attestation.ts
-import { dateToSeconds as dateToSeconds4, parseWithErrorHandling as parseWithErrorHandling9 } from "@openid4vc/utils";
+import { dateToSeconds as dateToSeconds4, parseWithErrorHandling as parseWithErrorHandling10 } from "@openid4vc/utils";
 
 // src/client-attestation/z-client-attestation.ts
 import { zHttpsUrl as zHttpsUrl5, zInteger as zInteger6 } from "@openid4vc/utils";
-import z14 from "zod";
-var zOauthClientAttestationHeader = z14.literal("OAuth-Client-Attestation");
+import z15 from "zod";
+var zOauthClientAttestationHeader = z15.literal("OAuth-Client-Attestation");
 var oauthClientAttestationHeader = zOauthClientAttestationHeader.value;
-var zClientAttestationJwtPayload = z14.object({
+var zClientAttestationJwtPayload = z15.object({
   ...zJwtPayload.shape,
-  iss: z14.string(),
-  sub: z14.string(),
+  iss: z15.string(),
+  sub: z15.string(),
   exp: zInteger6,
-  cnf: z14.object({
+  cnf: z15.object({
     jwk: zJwk,
-    key_type: z14.optional(
-      z14.union([
-        z14.enum(["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]),
-        z14.string()
+    key_type: z15.optional(
+      z15.union([
+        z15.enum(["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]),
+        z15.string()
       ])
     ),
-    user_authentication: z14.optional(
-      z14.union([
-        z14.enum(["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]),
-        z14.string()
+    user_authentication: z15.optional(
+      z15.union([
+        z15.enum(["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]),
+        z15.string()
       ])
     )
   }).passthrough(),
-  aal: z14.optional(z14.string())
+  aal: z15.optional(z15.string())
 }).passthrough();
-var zClientAttestationJwtHeader = z14.object({
+var zClientAttestationJwtHeader = z15.object({
   ...zJwtHeader.shape,
-  typ: z14.literal("oauth-client-attestation+jwt")
+  typ: z15.literal("oauth-client-attestation+jwt")
 }).passthrough();
-var zOauthClientAttestationPopHeader = z14.literal("OAuth-Client-Attestation-PoP");
+var zOauthClientAttestationPopHeader = z15.literal("OAuth-Client-Attestation-PoP");
 var oauthClientAttestationPopHeader = zOauthClientAttestationPopHeader.value;
-var zClientAttestationPopJwtPayload = z14.object({
+var zClientAttestationPopJwtPayload = z15.object({
   ...zJwtPayload.shape,
-  iss: z14.string(),
+  iss: z15.string(),
   exp: zInteger6,
   aud: zHttpsUrl5,
-  jti: z14.string(),
-  nonce: z14.optional(z14.string())
+  jti: z15.string(),
+  nonce: z15.optional(z15.string())
 }).passthrough();
-var zClientAttestationPopJwtHeader = z14.object({
+var zClientAttestationPopJwtHeader = z15.object({
   ...zJwtHeader.shape,
-  typ: z14.literal("oauth-client-attestation-pop+jwt")
+  typ: z15.literal("oauth-client-attestation-pop+jwt")
 }).passthrough();
 
 // src/client-attestation/clent-attestation.ts
@@ -1803,11 +1849,11 @@ async function verifyClientAttestationJwt(options) {
   };
 }
 async function createClientAttestationJwt(options) {
-  const header = parseWithErrorHandling9(zClientAttestationJwtHeader, {
+  const header = parseWithErrorHandling10(zClientAttestationJwtHeader, {
     typ: "oauth-client-attestation+jwt",
     ...jwtHeaderFromJwtSigner(options.signer)
   });
-  const payload = parseWithErrorHandling9(zClientAttestationJwtPayload, {
+  const payload = parseWithErrorHandling10(zClientAttestationJwtPayload, {
     iss: options.issuer,
     iat: dateToSeconds4(options.issuedAt),
     exp: dateToSeconds4(options.expiresAt),
@@ -1837,7 +1883,7 @@ function extractClientAttestationJwtsFromHeaders(headers) {
 }
 
 // src/client-attestation/client-attestation-pop.ts
-import { addSecondsToDate as addSecondsToDate2, dateToSeconds as dateToSeconds5, encodeToBase64Url as encodeToBase64Url6, parseWithErrorHandling as parseWithErrorHandling10 } from "@openid4vc/utils";
+import { addSecondsToDate as addSecondsToDate2, dateToSeconds as dateToSeconds5, encodeToBase64Url as encodeToBase64Url6, parseWithErrorHandling as parseWithErrorHandling11 } from "@openid4vc/utils";
 async function createClientAttestationForRequest(options) {
   const clientAttestationPopJwt = await createClientAttestationPopJwt({
     authorizationServer: options.authorizationServer,
@@ -1895,7 +1941,7 @@ async function verifyClientAttestationPopJwt(options) {
   };
 }
 async function createClientAttestationPopJwt(options) {
-  const header = parseWithErrorHandling10(zClientAttestationPopJwtHeader, {
+  const header = parseWithErrorHandling11(zClientAttestationPopJwtHeader, {
     typ: "oauth-client-attestation-pop+jwt",
     alg: options.signer.alg
   });
@@ -1905,7 +1951,7 @@ async function createClientAttestationPopJwt(options) {
     payloadSchema: zClientAttestationJwtPayload
   });
   const expiresAt = options.expiresAt ?? addSecondsToDate2(options.issuedAt ?? /* @__PURE__ */ new Date(), 1 * 60);
-  const payload = parseWithErrorHandling10(zClientAttestationPopJwtPayload, {
+  const payload = parseWithErrorHandling11(zClientAttestationPopJwtPayload, {
     aud: options.authorizationServer,
     iss: clientAttestation.payload.sub,
     iat: dateToSeconds5(options.issuedAt),
@@ -1927,7 +1973,7 @@ var Oauth2AuthorizationServer = class {
     this.options = options;
   }
   createAuthorizationServerMetadata(authorizationServerMetadata) {
-    return parseWithErrorHandling11(
+    return parseWithErrorHandling12(
       zAuthorizationServerMetadata,
       authorizationServerMetadata,
       "Error validating authorization server metadata"
@@ -2036,24 +2082,11 @@ var Oauth2AuthorizationServer = class {
   }
 };
 
-// src/Oauth2ResourceServer.ts
-var Oauth2ResourceServer = class {
-  constructor(options) {
-    this.options = options;
-  }
-  async verifyResourceRequest(options) {
-    return verifyResourceRequest({
-      callbacks: this.options.callbacks,
-      ...options
-    });
-  }
-};
-
 // src/Oauth2Client.ts
 import { objectToQueryParams as objectToQueryParams5 } from "@openid4vc/utils";
 
 // src/access-token/retrieve-access-token.ts
-import { ContentType as ContentType4, createZodFetcher as createZodFetcher4, objectToQueryParams as objectToQueryParams2, parseWithErrorHandling as parseWithErrorHandling12 } from "@openid4vc/utils";
+import { ContentType as ContentType4, createZodFetcher as createZodFetcher4, objectToQueryParams as objectToQueryParams2, parseWithErrorHandling as parseWithErrorHandling13 } from "@openid4vc/utils";
 import { InvalidFetchResponseError as InvalidFetchResponseError4 } from "@openid4vc/utils";
 async function retrievePreAuthorizedCodeAccessToken(options) {
   const request = {
@@ -2108,7 +2141,7 @@ async function retrieveRefreshTokenAccessToken(options) {
 }
 async function retrieveAccessToken(options) {
   const fetchWithZod = createZodFetcher4(options.callbacks.fetch);
-  const accessTokenRequest = parseWithErrorHandling12(
+  const accessTokenRequest = parseWithErrorHandling13(
     zAccessTokenRequest,
     options.request,
     "Error validating access token request"
@@ -2189,7 +2222,7 @@ import {
   ValidationError as ValidationError3,
   createZodFetcher as createZodFetcher5,
   objectToQueryParams as objectToQueryParams3,
-  parseWithErrorHandling as parseWithErrorHandling13
+  parseWithErrorHandling as parseWithErrorHandling14
 } from "@openid4vc/utils";
 import { InvalidFetchResponseError as InvalidFetchResponseError5 } from "@openid4vc/utils";
 async function sendAuthorizationChallengeRequest(options) {
@@ -2211,7 +2244,7 @@ async function sendAuthorizationChallengeRequest(options) {
     clientAttestation: options.clientAttestation,
     callbacks: options.callbacks
   }) : void 0;
-  const authorizationChallengeRequest = parseWithErrorHandling13(zAuthorizationChallengeRequest, {
+  const authorizationChallengeRequest = parseWithErrorHandling14(zAuthorizationChallengeRequest, {
     ...options.additionalRequestPayload,
     auth_session: options.authSession,
     client_id: options.clientId,
@@ -2602,6 +2635,19 @@ var Oauth2Client = class {
     });
   }
 };
+
+// src/Oauth2ResourceServer.ts
+var Oauth2ResourceServer = class {
+  constructor(options) {
+    this.options = options;
+  }
+  async verifyResourceRequest(options) {
+    return verifyResourceRequest({
+      callbacks: this.options.callbacks,
+      ...options
+    });
+  }
+};
 export {
   HashAlgorithm,
   InvalidFetchResponseError7 as InvalidFetchResponseError,
@@ -2625,6 +2671,7 @@ export {
   clientAuthenticationDynamic,
   clientAuthenticationNone,
   decodeJwt,
+  decodeJwtHeader,
   fetchAuthorizationServerMetadata,
   fetchJwks,
   fetchWellKnownMetadata,
@@ -2639,10 +2686,13 @@ export {
   setGlobalConfig,
   verifyJwt,
   verifyResourceRequest,
+  zAlgValueNotNone,
   zAuthorizationCodeGrantIdentifier,
   zAuthorizationServerMetadata,
+  zCompactJwe,
   zCompactJwt,
   zJwk,
+  zJwkSet,
   zJwtHeader,
   zJwtPayload,
   zOauth2ErrorResponse,