@openid4vc/oauth2 0.3.0-alpha-20250425121212 → 0.3.0-alpha-20250511115959

package/dist/index.d.mts

@@ -763,26 +763,52 @@ type JwtSignerDid = {
     method: 'did';
     didUrl: string;
     alg: string;
+    /**
+     * The key id that should be used for signing. You need to make sure the kid actuall matches
+     * with the key associated with the didUrl.
+     */
+    kid?: string;
 };
 type JwtSignerJwk = {
     method: 'jwk';
     publicJwk: Jwk;
     alg: string;
+    /**
+     * The key id that should be used for signing. You need to make sure the kid actuall matches
+     * with the key associated with the jwk.
+     *
+     * If not provided the kid can also be extracted from the `publicJwk`. Providing it here means the `kid` won't
+     * be included in the JWT header.
+     */
+    kid?: string;
 };
 type JwtSignerX5c = {
     method: 'x5c';
     x5c: string[];
     alg: string;
+    /**
+     * The key id that should be used for signing. You need to make sure the kid actuall matches
+     * with the key associated with the leaf certificate.
+     */
+    kid?: string;
 };
 type JwtSignerFederation = {
     method: 'federation';
     trustChain?: [string, ...string[]];
     alg: string;
+    /**
+     * The key id that should be used for signing. You need to make sure the kid actuall matches
+     * with a key present in the federation.
+     */
     kid: string;
 };
 type JwtSignerCustom = {
     method: 'custom';
     alg: string;
+    /**
+     * The key id that should be used for signing.
+     */
+    kid?: string;
 };
 type JwtSigner = JwtSignerDid | JwtSignerJwk | JwtSignerX5c | JwtSignerFederation | JwtSignerCustom;
 type JwtSignerWithJwk = JwtSigner & {

package/dist/index.d.ts

@@ -763,26 +763,52 @@ type JwtSignerDid = {
     method: 'did';
     didUrl: string;
     alg: string;
+    /**
+     * The key id that should be used for signing. You need to make sure the kid actuall matches
+     * with the key associated with the didUrl.
+     */
+    kid?: string;
 };
 type JwtSignerJwk = {
     method: 'jwk';
     publicJwk: Jwk;
     alg: string;
+    /**
+     * The key id that should be used for signing. You need to make sure the kid actuall matches
+     * with the key associated with the jwk.
+     *
+     * If not provided the kid can also be extracted from the `publicJwk`. Providing it here means the `kid` won't
+     * be included in the JWT header.
+     */
+    kid?: string;
 };
 type JwtSignerX5c = {
     method: 'x5c';
     x5c: string[];
     alg: string;
+    /**
+     * The key id that should be used for signing. You need to make sure the kid actuall matches
+     * with the key associated with the leaf certificate.
+     */
+    kid?: string;
 };
 type JwtSignerFederation = {
     method: 'federation';
     trustChain?: [string, ...string[]];
     alg: string;
+    /**
+     * The key id that should be used for signing. You need to make sure the kid actuall matches
+     * with a key present in the federation.
+     */
     kid: string;
 };
 type JwtSignerCustom = {
     method: 'custom';
     alg: string;
+    /**
+     * The key id that should be used for signing.
+     */
+    kid?: string;
 };
 type JwtSigner = JwtSignerDid | JwtSignerJwk | JwtSignerX5c | JwtSignerFederation | JwtSignerCustom;
 type JwtSignerWithJwk = JwtSigner & {

package/dist/index.js

@@ -295,7 +295,7 @@ var import_zod4 = __toESM(require("zod"));
 var zAlgValueNotNone = import_zod4.default.string().refine((alg) => alg !== "none", { message: `alg value may not be 'none'` });
 
 // src/common/jwt/z-jwt.ts
-var zCompactJwt = import_zod5.default.string().regex(/^([a-zA-Z0-9_=]+)\.([a-zA-Z0-9_=]+)\.([a-zA-Z0-9_\-\+\/=]*)$/, {
+var zCompactJwt = import_zod5.default.string().regex(/^([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)$/, {
   message: "Not a valid compact jwt"
 });
 var zJwtConfirmationPayload = import_zod5.default.object({
@@ -415,7 +415,8 @@ function jwtSignerFromJwt({
       signer: {
         alg: header.alg,
         method: "x5c",
-        x5c: header.x5c
+        x5c: header.x5c,
+        kid: header.kid
       }
     });
   }
@@ -491,7 +492,8 @@ ${found.map((m) => m.valid ? `SUCCEEDED: method ${m.method}` : `FAILED: method $
   if (!allowedSignerMethods || allowedSignerMethods.includes("custom")) {
     return {
       method: "custom",
-      alg: header.alg
+      alg: header.alg,
+      kid: header.kid
     };
   }
   throw new Oauth2Error(