@openid4vc/openid4vci 0.3.0-alpha-20251017122507 → 0.3.0-alpha-20251021082313

package/dist/index.js

@@ -30,7 +30,7 @@ zod = __toESM(zod);
 
 //#region src/version.ts
 let Openid4vciDraftVersion = /* @__PURE__ */ function(Openid4vciDraftVersion$1) {
-	Openid4vciDraftVersion$1["Draft16"] = "Draft16";
+	Openid4vciDraftVersion$1["V1"] = "V1";
 	Openid4vciDraftVersion$1["Draft15"] = "Draft15";
 	Openid4vciDraftVersion$1["Draft14"] = "Draft14";
 	Openid4vciDraftVersion$1["Draft11"] = "Draft11";
@@ -330,7 +330,7 @@ const zLegacySdJwtVcFormatIdentifier = zod.default.literal("vc+sd-jwt");
 * of the OpenID for Verifiable Presentations specification. Please update your
 * implementations accordingly.
 */
-const zLegacySdJwtVcCredentialIssuerMetadataDraft16 = zCredentialConfigurationSupportedCommon.extend({
+const zLegacySdJwtVcCredentialIssuerMetadataV1 = zCredentialConfigurationSupportedCommon.extend({
 	vct: zod.default.string(),
 	format: zLegacySdJwtVcFormatIdentifier,
 	order: zod.default.optional(zod.default.array(zod.default.string())),
@@ -607,7 +607,7 @@ const allCredentialIssuerMetadataFormats = [
 	zJwtVcJsonCredentialIssuerMetadata,
 	zSdJwtW3VcCredentialIssuerMetadata,
 	zSdJwtW3VcCredentialIssuerMetadataDraft15,
-	zLegacySdJwtVcCredentialIssuerMetadataDraft16,
+	zLegacySdJwtVcCredentialIssuerMetadataV1,
 	zSdJwtDcCredentialIssuerMetadataDraft15,
 	zMsoMdocCredentialIssuerMetadataDraft15,
 	zJwtVcJsonLdCredentialIssuerMetadataDraft15,
@@ -639,7 +639,7 @@ const zCredentialIssuerMetadataDisplayEntry = zod.default.object({
 		alt_text: zod.default.string().optional()
 	}).loose().optional()
 }).loose();
-const zCredentialIssuerMetadataDraft14Draft15Draft16 = zod.default.object({
+const zCredentialIssuerMetadataDraft14Draft15V1 = zod.default.object({
 	credential_issuer: __openid4vc_utils.zHttpsUrl,
 	authorization_servers: zod.default.array(__openid4vc_utils.zHttpsUrl).optional(),
 	credential_endpoint: __openid4vc_utils.zHttpsUrl,
@@ -652,7 +652,6 @@ const zCredentialIssuerMetadataDraft14Draft15Draft16 = zod.default.object({
 		encryption_required: zod.default.boolean()
 	}).loose().optional(),
 	batch_credential_issuance: zod.default.object({ batch_size: zod.default.number().positive() }).loose().optional(),
-	signed_metadata: __openid4vc_oauth2.zCompactJwt.optional(),
 	display: zod.default.array(zCredentialIssuerMetadataDisplayEntry).optional(),
 	credential_configurations_supported: zod.default.record(zod.default.string(), zCredentialConfigurationSupportedWithFormats)
 }).loose();
@@ -691,7 +690,7 @@ const zCredentialConfigurationSupportedDraft11To16 = zod.default.object({
 	});
 	return zod.default.NEVER;
 }).pipe(zCredentialConfigurationSupportedWithFormats);
-const zCredentialConfigurationSupportedDraft16To11 = zCredentialConfigurationSupportedWithFormats.transform(({ credential_metadata,...rest }) => ({
+const zCredentialConfigurationSupportedV1ToDraft11 = zCredentialConfigurationSupportedWithFormats.transform(({ credential_metadata,...rest }) => ({
 	...credential_metadata,
 	...rest
 })).and(zod.default.object({ id: zod.default.string() }).loose()).transform(({ id, credential_signing_alg_values_supported, display, proof_types_supported, scope,...rest }) => ({
@@ -732,17 +731,17 @@ const zCredentialIssuerMetadataDraft11To16 = zod.default.object({
 		...authorization_server ? { authorization_servers: [authorization_server] } : {},
 		credential_configurations_supported: Object.fromEntries(credentials_supported.map((supported) => supported.id ? [supported.id, supported] : void 0).filter((i) => i !== void 0))
 	};
-}).pipe(zod.default.object({ credential_configurations_supported: zod.default.record(zod.default.string(), zCredentialConfigurationSupportedDraft11To16) }).loose()).pipe(zCredentialIssuerMetadataDraft14Draft15Draft16);
-const zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14Draft15Draft16.transform((issuerMetadata) => ({
+}).pipe(zod.default.object({ credential_configurations_supported: zod.default.record(zod.default.string(), zCredentialConfigurationSupportedDraft11To16) }).loose()).pipe(zCredentialIssuerMetadataDraft14Draft15V1);
+const zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14Draft15V1.transform((issuerMetadata) => ({
 	...issuerMetadata,
 	...issuerMetadata.authorization_servers ? { authorization_server: issuerMetadata.authorization_servers[0] } : {},
 	credentials_supported: Object.entries(issuerMetadata.credential_configurations_supported).map(([id, value]) => ({
 		...value,
 		id
 	}))
-})).pipe(zCredentialIssuerMetadataDraft14Draft15Draft16.extend({ credentials_supported: zod.default.array(zCredentialConfigurationSupportedDraft16To11) }));
-const zCredentialIssuerMetadata = zod.default.union([zCredentialIssuerMetadataDraft14Draft15Draft16, zCredentialIssuerMetadataDraft11To16]);
-const zCredentialIssuerMetadataWithDraftVersion = zod.default.union([zCredentialIssuerMetadataDraft14Draft15Draft16.transform((credentialIssuerMetadata) => {
+})).pipe(zCredentialIssuerMetadataDraft14Draft15V1.extend({ credentials_supported: zod.default.array(zCredentialConfigurationSupportedV1ToDraft11) }));
+const zCredentialIssuerMetadata = zod.default.union([zCredentialIssuerMetadataDraft14Draft15V1, zCredentialIssuerMetadataDraft11To16]);
+const zCredentialIssuerMetadataWithDraftVersion = zod.default.union([zCredentialIssuerMetadataDraft14Draft15V1.transform((credentialIssuerMetadata) => {
 	const credentialConfigurations = Object.values(credentialIssuerMetadata.credential_configurations_supported);
 	const isDraft15 = credentialConfigurations.some((configuration) => {
 		const knownConfiguration = configuration;
@@ -753,29 +752,83 @@ const zCredentialIssuerMetadataWithDraftVersion = zod.default.union([zCredential
 	});
 	return {
 		credentialIssuerMetadata,
-		originalDraftVersion: credentialConfigurations.some((configuration) => {
-			return configuration.credential_metadata;
-		}) ? Openid4vciDraftVersion.Draft16 : isDraft15 ? Openid4vciDraftVersion.Draft15 : Openid4vciDraftVersion.Draft14
+		originalDraftVersion: credentialConfigurations.some((configuration) => configuration.credential_metadata) ? Openid4vciDraftVersion.V1 : isDraft15 ? Openid4vciDraftVersion.Draft15 : Openid4vciDraftVersion.Draft14
 	};
 }), zCredentialIssuerMetadataDraft11To16.transform((credentialIssuerMetadata) => ({
 	credentialIssuerMetadata,
 	originalDraftVersion: Openid4vciDraftVersion.Draft11
 }))]);
 
+//#endregion
+//#region src/metadata/credential-issuer/z-signed-credential-issuer-metadata.ts
+const zSignedCredentialIssuerMetadataHeader = zod.default.object({
+	...__openid4vc_oauth2.zJwtHeader.shape,
+	typ: zod.default.literal("openidvci-issuer-metadata+jwt")
+}).loose();
+const zSignedCredentialIssuerMetadataPayload = zod.default.object({
+	...__openid4vc_oauth2.zJwtPayload.shape,
+	iat: __openid4vc_utils.zInteger,
+	sub: zod.default.string(),
+	...zCredentialIssuerMetadataDraft14Draft15V1.shape
+}).loose();
+
 //#endregion
 //#region src/metadata/credential-issuer/credential-issuer-metadata.ts
 const wellKnownCredentialIssuerSuffix = ".well-known/openid-credential-issuer";
 /**
 * @inheritdoc {@link fetchWellKnownMetadata}
 */
-async function fetchCredentialIssuerMetadata(credentialIssuer, fetch) {
+async function fetchCredentialIssuerMetadata(credentialIssuer, options) {
 	const parsedIssuerUrl = new __openid4vc_utils.URL(credentialIssuer);
 	const legacyWellKnownMetadataUrl = (0, __openid4vc_utils.joinUriParts)(credentialIssuer, [wellKnownCredentialIssuerSuffix]);
 	const wellKnownMetadataUrl = (0, __openid4vc_utils.joinUriParts)(parsedIssuerUrl.origin, [wellKnownCredentialIssuerSuffix, parsedIssuerUrl.pathname]);
-	let result = await (0, __openid4vc_oauth2.fetchWellKnownMetadata)(wellKnownMetadataUrl, zCredentialIssuerMetadataWithDraftVersion, fetch);
-	if (!result && legacyWellKnownMetadataUrl !== wellKnownMetadataUrl) result = await (0, __openid4vc_oauth2.fetchWellKnownMetadata)(legacyWellKnownMetadataUrl, zCredentialIssuerMetadataWithDraftVersion, fetch);
-	if (result && result.credentialIssuerMetadata.credential_issuer !== credentialIssuer) throw new __openid4vc_oauth2.Oauth2Error(`The 'credential_issuer' parameter '${result.credentialIssuerMetadata.credential_issuer}' in the well known credential issuer metadata at '${wellKnownMetadataUrl}' does not match the provided credential issuer '${credentialIssuer}'.`);
-	return result;
+	const acceptedContentType = options?.callbacks?.verifyJwt ? [__openid4vc_utils.ContentType.Jwt, __openid4vc_utils.ContentType.Json] : [__openid4vc_utils.ContentType.Json];
+	const responseSchema = zCredentialIssuerMetadataWithDraftVersion.or(__openid4vc_oauth2.zCompactJwt);
+	let result = await (0, __openid4vc_oauth2.fetchWellKnownMetadata)(wellKnownMetadataUrl, responseSchema, {
+		fetch: options?.callbacks?.fetch,
+		acceptedContentType
+	});
+	if (!result && legacyWellKnownMetadataUrl !== wellKnownMetadataUrl) result = await (0, __openid4vc_oauth2.fetchWellKnownMetadata)(legacyWellKnownMetadataUrl, responseSchema, {
+		fetch: options?.callbacks?.fetch,
+		acceptedContentType
+	});
+	let issuerMetadataWithVersion = null;
+	if (typeof result === "string") {
+		if (!options?.callbacks?.verifyJwt) throw new __openid4vc_oauth2.Oauth2Error(`Unable to verify signed credential issuer metadata, no 'verifyJwt' callback provided to fetch credential issuer metadata method.`);
+		const { header, payload, signature } = (0, __openid4vc_oauth2.decodeJwt)({
+			jwt: result,
+			headerSchema: zSignedCredentialIssuerMetadataHeader,
+			payloadSchema: zSignedCredentialIssuerMetadataPayload
+		});
+		if (payload.sub !== credentialIssuer) throw new __openid4vc_oauth2.Oauth2Error(`The 'sub' parameter '${payload.sub}' in the signed well known credential issuer metadata at '${wellKnownMetadataUrl}' does not match the provided credential issuer '${credentialIssuer}'.`);
+		const signer = (0, __openid4vc_oauth2.jwtSignerFromJwt)({
+			header,
+			payload
+		});
+		const verifyResult = await (0, __openid4vc_oauth2.verifyJwt)({
+			compact: result,
+			header,
+			payload,
+			verifyJwtCallback: options.callbacks.verifyJwt,
+			now: options.now,
+			signer,
+			errorMessage: "signed credential issuer metadata jwt verification failed"
+		});
+		issuerMetadataWithVersion = {
+			...(0, __openid4vc_utils.parseWithErrorHandling)(zCredentialIssuerMetadataWithDraftVersion, payload, "Unable to determine version for signed issuer metadata"),
+			signed: {
+				signer: verifyResult.signer,
+				jwt: {
+					header,
+					payload,
+					signature,
+					compact: result
+				}
+			}
+		};
+	} else if (result) issuerMetadataWithVersion = result;
+	if (issuerMetadataWithVersion && issuerMetadataWithVersion.credentialIssuerMetadata.credential_issuer !== credentialIssuer) throw new __openid4vc_oauth2.Oauth2Error(`The 'credential_issuer' parameter '${issuerMetadataWithVersion.credentialIssuerMetadata.credential_issuer}' in the well known credential issuer metadata at '${wellKnownMetadataUrl}' does not match the provided credential issuer '${credentialIssuer}'.`);
+	return issuerMetadataWithVersion;
 }
 /**
 * Extract credential configuration supported entries where the `format` is known to this
@@ -934,7 +987,7 @@ function credentialsSupportedToCredentialConfigurationsSupported(credentialsSupp
 //#region src/credential-request/format-payload.ts
 function getCredentialRequestFormatPayloadForCredentialConfigurationId(options) {
 	const credentialConfiguration = getCredentialConfigurationSupportedById(options.issuerMetadata.credentialIssuer.credential_configurations_supported, options.credentialConfigurationId);
-	if ((0, __openid4vc_utils.zIs)(zLegacySdJwtVcCredentialIssuerMetadataDraft16, credentialConfiguration) || (0, __openid4vc_utils.zIs)(zLegacySdJwtVcCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
+	if ((0, __openid4vc_utils.zIs)(zLegacySdJwtVcCredentialIssuerMetadataV1, credentialConfiguration) || (0, __openid4vc_utils.zIs)(zLegacySdJwtVcCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
 		format: credentialConfiguration.format,
 		vct: credentialConfiguration.vct
 	};
@@ -1159,12 +1212,12 @@ const zOauth2ErrorResponse = zod.default.object({
 const zCredentialEncoding = zod.default.union([zod.default.string(), zod.default.record(zod.default.string(), zod.default.any())]);
 const zBaseCredentialResponse = zod.default.object({
 	credentials: zod.default.union([zod.default.array(zod.default.object({ credential: zCredentialEncoding })), zod.default.array(zCredentialEncoding)]).optional(),
-	interval: zod.default.number().int().positive().optional(),
-	notification_id: zod.default.string().optional()
+	notification_id: zod.default.string().optional(),
+	transaction_id: zod.default.string().optional(),
+	interval: zod.default.number().int().positive().optional()
 }).loose();
 const zCredentialResponse = zBaseCredentialResponse.extend({
 	credential: zod.default.optional(zCredentialEncoding),
-	transaction_id: zod.default.string().optional(),
 	c_nonce: zod.default.string().optional(),
 	c_nonce_expires_in: zod.default.number().int().optional()
 }).loose().superRefine((value, ctx) => {
@@ -1191,15 +1244,26 @@ const zCredentialErrorResponse = zod.default.object({
 	c_nonce: zod.default.string().optional(),
 	c_nonce_expires_in: zod.default.number().int().optional()
 }).loose();
-const zDeferredCredentialResponse = zBaseCredentialResponse.refine((value) => {
-	const { credentials, interval } = value;
-	return [credentials, interval].filter((i) => i !== void 0).length === 1;
-}, { message: `Exactly one of 'credentials' or 'interval' MUST be defined.` });
+const zDeferredCredentialResponse = zBaseCredentialResponse.superRefine((value, ctx) => {
+	const { credentials, transaction_id, interval, notification_id } = value;
+	if ([credentials, transaction_id].filter((i) => i !== void 0).length !== 1) ctx.addIssue({
+		code: "custom",
+		message: `Exactly one of 'credentials', or 'transaction_id' MUST be defined.`
+	});
+	if (transaction_id && !interval) ctx.addIssue({
+		code: "custom",
+		message: `'interval' MUST be defined when 'transaction_id' is defined.`
+	});
+	if (notification_id && credentials) ctx.addIssue({
+		code: "custom",
+		message: `'notification_id' MUST NOT be defined when 'credentials' is not defined.`
+	});
+});
 
 //#endregion
 //#region src/credential-request/retrieve-credentials.ts
 async function retrieveCredentialsWithCredentialConfigurationId(options) {
-	if (options.issuerMetadata.originalDraftVersion !== Openid4vciDraftVersion.Draft15 && options.issuerMetadata.originalDraftVersion !== Openid4vciDraftVersion.Draft16) throw new Openid4vciError("Requesting credentials based on credential configuration ID is not supported in OpenID4VCI below draft 15. Make sure to provide the format and format specific claims in the request.");
+	if (options.issuerMetadata.originalDraftVersion !== Openid4vciDraftVersion.Draft15 && options.issuerMetadata.originalDraftVersion !== Openid4vciDraftVersion.V1) throw new Openid4vciError("Requesting credentials based on credential configuration ID is not supported in OpenID4VCI below draft 15. Make sure to provide the format and format specific claims in the request.");
 	getCredentialConfigurationSupportedById(options.issuerMetadata.credentialIssuer.credential_configurations_supported, options.credentialConfigurationId);
 	const credentialRequest = {
 		...options.additionalRequestPayload,
@@ -1216,7 +1280,7 @@ async function retrieveCredentialsWithCredentialConfigurationId(options) {
 	});
 }
 async function retrieveCredentialsWithFormat(options) {
-	if (options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft15 || options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft16) throw new Openid4vciError("Requesting credentials based on format is not supported in OpenID4VCI draft 15. Provide the credential configuration id directly in the request.");
+	if (options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft15 || options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.V1) throw new Openid4vciError("Requesting credentials based on format is not supported on OpenID4VCI above draft 15. Provide the credential configuration id directly in the request.");
 	const credentialRequest = {
 		...options.formatPayload,
 		...options.additionalRequestPayload,
@@ -1298,7 +1362,7 @@ async function retrieveDeferredCredentials(options) {
 			deferredCredentialErrorResponseResult
 		};
 	}
-	const deferredCredentialResponseResult = (0, __openid4vc_utils.isResponseContentType)(__openid4vc_utils.ContentType.Json, resourceResponse.response) ? zDeferredCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
+	const deferredCredentialResponseResult = (0, __openid4vc_utils.isResponseContentType)(__openid4vc_utils.ContentType.Json, resourceResponse.response) ? zDeferredCredentialResponse.refine((response) => response.credentials || response.transaction_id === options.transactionId, { error: `Transaction id in deferred credential response does not match transaction id in deferred credential request '${options.transactionId}'` }).safeParse(await resourceResponse.response.clone().json()) : void 0;
 	if (!deferredCredentialResponseResult?.success) return {
 		...resourceResponse,
 		ok: false,
@@ -1389,14 +1453,17 @@ async function verifyCredentialRequestJwtProof(options) {
 //#region src/metadata/fetch-issuer-metadata.ts
 async function resolveIssuerMetadata(credentialIssuer, options) {
 	const allowAuthorizationMetadataFromCredentialIssuerMetadata = options?.allowAuthorizationMetadataFromCredentialIssuerMetadata ?? true;
-	const credentialIssuerMetadataWithDraftVersion = await fetchCredentialIssuerMetadata(credentialIssuer, options?.fetch);
+	const credentialIssuerMetadataWithDraftVersion = await fetchCredentialIssuerMetadata(credentialIssuer, {
+		callbacks: options?.callbacks,
+		now: options?.now
+	});
 	if (!credentialIssuerMetadataWithDraftVersion) throw new __openid4vc_oauth2.Oauth2Error(`Well known credential issuer metadata for issuer '${credentialIssuer}' not found.`);
-	const { credentialIssuerMetadata, originalDraftVersion } = credentialIssuerMetadataWithDraftVersion;
+	const { credentialIssuerMetadata, originalDraftVersion, signed } = credentialIssuerMetadataWithDraftVersion;
 	const authorizationServers = credentialIssuerMetadata.authorization_servers ?? [credentialIssuer];
 	const authoriationServersMetadata = [];
 	for (const authorizationServer of authorizationServers) {
 		if (options?.restrictToAuthorizationServers && !options.restrictToAuthorizationServers.includes(authorizationServer)) continue;
-		let authorizationServerMetadata = await (0, __openid4vc_oauth2.fetchAuthorizationServerMetadata)(authorizationServer, options?.fetch);
+		let authorizationServerMetadata = await (0, __openid4vc_oauth2.fetchAuthorizationServerMetadata)(authorizationServer, options?.callbacks.fetch);
 		if (!authorizationServerMetadata && authorizationServer === credentialIssuer && allowAuthorizationMetadataFromCredentialIssuerMetadata) authorizationServerMetadata = (0, __openid4vc_utils.parseWithErrorHandling)(__openid4vc_oauth2.zAuthorizationServerMetadata, {
 			token_endpoint: credentialIssuerMetadata.token_endpoint,
 			issuer: credentialIssuer
@@ -1407,6 +1474,7 @@ async function resolveIssuerMetadata(credentialIssuer, options) {
 	return {
 		originalDraftVersion,
 		credentialIssuer: credentialIssuerMetadata,
+		signedCredentialIssuer: signed,
 		authorizationServers: authoriationServersMetadata
 	};
 }
@@ -1512,7 +1580,7 @@ var Openid4vciClient = class {
 		return resolveCredentialOffer(credentialOffer, { fetch: this.options.callbacks.fetch });
 	}
 	async resolveIssuerMetadata(credentialIssuer) {
-		return resolveIssuerMetadata(credentialIssuer, { fetch: this.options.callbacks.fetch });
+		return resolveIssuerMetadata(credentialIssuer, { callbacks: this.options.callbacks });
 	}
 	/**
 	* Retrieve an authorization code for a presentation during issuance session
@@ -1716,7 +1784,7 @@ var Openid4vciClient = class {
 	*/
 	async retrieveCredentials({ issuerMetadata, proof, proofs, credentialConfigurationId, additionalRequestPayload, accessToken, dpop }) {
 		let credentialResponse;
-		if (issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft15 || issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft16) credentialResponse = await retrieveCredentialsWithCredentialConfigurationId({
+		if (issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft15 || issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.V1) credentialResponse = await retrieveCredentialsWithCredentialConfigurationId({
 			accessToken,
 			credentialConfigurationId,
 			issuerMetadata,
@@ -1791,6 +1859,7 @@ function createDeferredCredentialResponse(options) {
 	return (0, __openid4vc_utils.parseWithErrorHandling)(zDeferredCredentialResponse, {
 		credentials: options.credentials,
 		notification_id: options.notificationId,
+		transaction_id: options.transactionId,
 		interval: options.interval,
 		...options.additionalPayload
 	});
@@ -1846,6 +1915,28 @@ async function verifyCredentialRequestAttestationProof(options) {
 	});
 }
 
+//#endregion
+//#region src/metadata/credential-issuer/signed-credential-issuer-metadata.ts
+async function createSignedCredentialIssuerMetadataJwt(options) {
+	const header = (0, __openid4vc_utils.parseWithErrorHandling)(zSignedCredentialIssuerMetadataHeader, {
+		...(0, __openid4vc_oauth2.jwtHeaderFromJwtSigner)(options.signer),
+		typ: "openidvci-issuer-metadata+jwt"
+	});
+	const payload = (0, __openid4vc_utils.parseWithErrorHandling)(zSignedCredentialIssuerMetadataPayload, {
+		...options.credentialIssuerMetadata,
+		sub: options.credentialIssuerMetadata.credential_issuer,
+		iat: (0, __openid4vc_utils.dateToSeconds)(options.issuedAt),
+		exp: options.expiresAt ? (0, __openid4vc_utils.dateToSeconds)(options.expiresAt) : void 0,
+		iss: options.issuer,
+		...options.additionalPayload
+	});
+	const { jwt } = await options.callbacks.signJwt(options.signer, {
+		header,
+		payload
+	});
+	return jwt;
+}
+
 //#endregion
 //#region src/Openid4vciIssuer.ts
 var Openid4vciIssuer = class {
@@ -1864,6 +1955,15 @@ var Openid4vciIssuer = class {
 	createCredentialIssuerMetadata(credentialIssuerMetadata) {
 		return (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialIssuerMetadata, credentialIssuerMetadata, "Error validating credential issuer metadata");
 	}
+	/**
+	* Validates credential issuer metadata structure is correct and creates signed credential issuer metadata JWT
+	*/
+	createSignedCredentialIssuerMetadataJwt(options) {
+		return createSignedCredentialIssuerMetadataJwt({
+			callbacks: this.options.callbacks,
+			...options
+		});
+	}
 	async createCredentialOffer(options) {
 		return createCredentialOffer({
 			callbacks: this.options.callbacks,