@pagopa/io-wallet-oid4vp 1.5.8 → 2.0.0-apt

package/dist/index.js

@@ -39,7 +39,7 @@ __export(index_exports, {
   ParseAuthorizeRequestError: () => ParseAuthorizeRequestError,
   createAuthorizationRequest: () => createAuthorizationRequest,
   createAuthorizationResponse: () => createAuthorizationResponse3,
-  createOpenid4vpAuthorizationResponse: () => import_openid4vp.createOpenid4vpAuthorizationResponse,
+  createOpenid4vpAuthorizationResponse: () => createOpenid4vpAuthorizationResponse,
   createParsedQrCode: () => createParsedQrCode,
   createX509HashClientId: () => createX509HashClientId,
   extractClientIdPrefix: () => extractClientIdPrefix,
@@ -71,7 +71,7 @@ module.exports = __toCommonJS(index_exports);
 
 // src/authorization-request/create-authorization-request.ts
 var import_io_wallet_oauth22 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils2 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils3 = require("@pagopa/io-wallet-utils");
 
 // src/errors.ts
 var Oid4vpError = class extends Error {
@@ -188,6 +188,7 @@ function getLeafCertificate(certificateChain) {
 // src/authorization-request/z-authorization-request.ts
 var import_io_wallet_oauth2 = require("@pagopa/io-wallet-oauth2");
 var import_io_wallet_oid_federation = require("@pagopa/io-wallet-oid-federation");
+var import_io_wallet_utils2 = require("@pagopa/io-wallet-utils");
 var import_zod = require("zod");
 var zOpenid4vpCredentialVerifierMetadata = import_io_wallet_oid_federation.itWalletCredentialVerifierMetadataV1_3.partial({
   application_type: true,
@@ -214,36 +215,40 @@ var zOpenid4vpAuthorizationRequestPayload = import_zod.z.looseObject({
   wallet_nonce: import_zod.z.string().optional()
 }).and(
   import_zod.z.object({
-    ...import_io_wallet_oauth2.zJwtPayload.shape
+    ...import_io_wallet_utils2.zJwtPayload.shape
   })
 );
 var zOpenid4vpAuthorizationRequestHeaderBase = import_zod.z.object({
-  alg: import_io_wallet_oauth2.zAlgValueNotNone,
+  alg: import_io_wallet_utils2.zAlgValueNotNone,
   kid: import_zod.z.string(),
   typ: import_io_wallet_oauth2.zSignedAuthorizationRequestJwtHeaderTyp
 });
 var zOpenid4vpAuthorizationRequestHeaderV1_0 = zOpenid4vpAuthorizationRequestHeaderBase.extend({
-  trust_chain: import_io_wallet_oauth2.zTrustChain
+  trust_chain: import_io_wallet_utils2.zTrustChain
 }).loose();
 var zOpenid4vpAuthorizationRequestHeaderV1_3 = zOpenid4vpAuthorizationRequestHeaderBase.extend({
   // kid is only mandatory for openid_federation/legacy; x509_hash RPs use x5c instead (see getPublicKeyForVerification).
   kid: import_zod.z.string().optional(),
-  trust_chain: import_io_wallet_oauth2.zTrustChain.optional(),
-  x5c: import_io_wallet_oauth2.zCertificateChain.optional()
+  trust_chain: import_io_wallet_utils2.zTrustChain.optional(),
+  x5c: import_io_wallet_utils2.zCertificateChain.optional()
 }).loose();
 
 // src/authorization-request/create-authorization-request.ts
-var dispatchCreateAuthorizationRequest = (0, import_io_wallet_utils2.createVersionDispatcher)({
-  [import_io_wallet_utils2.ItWalletSpecsVersion.V1_0]: async (o) => createAuthorizationRequestWithHeader(
+var dispatchCreateAuthorizationRequest = (0, import_io_wallet_utils3.createVersionDispatcher)({
+  [import_io_wallet_utils3.ItWalletSpecsVersion.APTITUDE]: async (o) => createAuthorizationRequestWithHeader(
+    o,
+    zOpenid4vpAuthorizationRequestHeaderV1_3
+  ),
+  [import_io_wallet_utils3.ItWalletSpecsVersion.V1_0]: async (o) => createAuthorizationRequestWithHeader(
     o,
     zOpenid4vpAuthorizationRequestHeaderV1_0
   ),
-  [import_io_wallet_utils2.ItWalletSpecsVersion.V1_3]: async (o) => createAuthorizationRequestWithHeader(
+  [import_io_wallet_utils3.ItWalletSpecsVersion.V1_3]: async (o) => createAuthorizationRequestWithHeader(
     o,
     zOpenid4vpAuthorizationRequestHeaderV1_3
   ),
   // V1_4 reuses the V1_3 JAR header schema; the conditional x5c rule is a normative 1.4.4 LTS backport.
-  [import_io_wallet_utils2.ItWalletSpecsVersion.V1_4]: async (o) => createAuthorizationRequestWithHeader(
+  [import_io_wallet_utils3.ItWalletSpecsVersion.V1_4]: async (o) => createAuthorizationRequestWithHeader(
     o,
     zOpenid4vpAuthorizationRequestHeaderV1_3
   )
@@ -252,7 +257,7 @@ async function createAuthorizationRequest(options) {
   try {
     return await dispatchCreateAuthorizationRequest(options);
   } catch (error) {
-    if (error instanceof import_io_wallet_utils2.ValidationError) {
+    if (error instanceof import_io_wallet_utils3.ValidationError) {
       throw new Oid4vpError(`Invalid authorization request: ${error.message}`);
     }
     throw error;
@@ -260,11 +265,11 @@ async function createAuthorizationRequest(options) {
 }
 async function createAuthorizationRequestWithHeader(options, headerSchema) {
   const { callbacks, jar, scheme = "openid4vp://" } = options;
-  const authorizationRequestHeader = (0, import_io_wallet_utils2.parseWithErrorHandling)(headerSchema, {
-    ...(0, import_io_wallet_oauth22.jwtHeaderFromJwtSigner)(jar.jwtSigner),
+  const authorizationRequestHeader = (0, import_io_wallet_utils3.parseWithErrorHandling)(headerSchema, {
+    ...(0, import_io_wallet_utils3.jwtHeaderFromJwtSigner)(jar.jwtSigner),
     typ: import_io_wallet_oauth22.signedAuthorizationRequestJwtHeaderTyp
   });
-  const authorizationRequestPayload = (0, import_io_wallet_utils2.parseWithErrorHandling)(
+  const authorizationRequestPayload = (0, import_io_wallet_utils3.parseWithErrorHandling)(
     zOpenid4vpAuthorizationRequestPayload,
     options.authorizationRequestPayload
   );
@@ -300,13 +305,13 @@ function createAuthorizationRequestUrl(scheme, request) {
   const url = new URL(scheme);
   const searchParams = new URLSearchParams([
     ...url.searchParams.entries(),
-    ...(0, import_io_wallet_utils2.objectToQueryParams)(request).entries()
+    ...(0, import_io_wallet_utils3.objectToQueryParams)(request).entries()
   ]);
   url.search = searchParams.toString();
   return url.toString();
 }
 function validateJarSignerForAuthorizationRequest(specsVersion, jwtSigner, payload) {
-  if (specsVersion === import_io_wallet_utils2.ItWalletSpecsVersion.V1_0) {
+  if (specsVersion === import_io_wallet_utils3.ItWalletSpecsVersion.V1_0) {
     return;
   }
   const { prefix } = extractClientIdPrefix(payload.client_id);
@@ -323,8 +328,7 @@ function validateJarSignerForAuthorizationRequest(specsVersion, jwtSigner, paylo
 }
 
 // src/authorization-request/fetch-authorization-request.ts
-var import_oauth2 = require("@openid4vc/oauth2");
-var import_io_wallet_utils3 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
 
 // src/authorization-request/validate-authorization-request.ts
 function validateAuthorizationRequestParams(params) {
@@ -461,7 +465,7 @@ function createParsedQrCode(authorizeRequestUrl) {
   };
 }
 async function fetchRequestObjectJwt(requestUri, options) {
-  const fetch = (0, import_io_wallet_utils3.createFetcher)(options.fetch);
+  const fetch = (0, import_io_wallet_utils4.createFetcher)(options.fetch);
   const requestInit = {
     method: options.method.toUpperCase()
   };
@@ -482,7 +486,7 @@ async function fetchRequestObjectJwt(requestUri, options) {
     requestInit.body = formData.toString();
   }
   const response = await fetch(requestUri, requestInit);
-  await (0, import_io_wallet_utils3.hasStatusOrThrow)(200, import_io_wallet_utils3.UnexpectedStatusCodeError)(response);
+  await (0, import_io_wallet_utils4.hasStatusOrThrow)(200, import_io_wallet_utils4.UnexpectedStatusCodeError)(response);
   return await response.text();
 }
 async function fetchAuthorizationRequest(options) {
@@ -520,7 +524,7 @@ async function fetchAuthorizationRequest(options) {
       sendBy: parsedQrCode.request ? "value" : "reference"
     };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils3.ValidationError || error instanceof import_oauth2.Oauth2JwtParseError || error instanceof Oid4vpError || error instanceof import_io_wallet_utils3.UnexpectedStatusCodeError) {
+    if (error instanceof import_io_wallet_utils4.ValidationError || error instanceof import_io_wallet_utils4.JwtParseError || error instanceof Oid4vpError || error instanceof import_io_wallet_utils4.UnexpectedStatusCodeError) {
       throw error;
     }
     throw new Oid4vpError(
@@ -530,9 +534,7 @@ async function fetchAuthorizationRequest(options) {
 }
 
 // src/authorization-request/parse-authorization-request.ts
-var import_oauth22 = require("@openid4vc/oauth2");
-var import_io_wallet_oauth23 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
 function getPublicKeyForVerification(options) {
   const { header, payload } = options;
   const { prefix: clientIdPrefix } = extractClientIdPrefix(payload.client_id);
@@ -569,18 +571,19 @@ function getPublicKeyForVerification(options) {
 }
 async function parseAuthorizeRequest(options) {
   try {
-    const headerSchema = (0, import_io_wallet_utils4.dispatchByVersion)(options.config.itWalletSpecsVersion, {
-      [import_io_wallet_utils4.ItWalletSpecsVersion.V1_0]: () => zOpenid4vpAuthorizationRequestHeaderV1_0,
-      [import_io_wallet_utils4.ItWalletSpecsVersion.V1_3]: () => zOpenid4vpAuthorizationRequestHeaderV1_3,
-      [import_io_wallet_utils4.ItWalletSpecsVersion.V1_4]: () => zOpenid4vpAuthorizationRequestHeaderV1_3
+    const headerSchema = (0, import_io_wallet_utils5.dispatchByVersion)(options.config.itWalletSpecsVersion, {
+      [import_io_wallet_utils5.ItWalletSpecsVersion.APTITUDE]: () => zOpenid4vpAuthorizationRequestHeaderV1_3,
+      [import_io_wallet_utils5.ItWalletSpecsVersion.V1_0]: () => zOpenid4vpAuthorizationRequestHeaderV1_0,
+      [import_io_wallet_utils5.ItWalletSpecsVersion.V1_3]: () => zOpenid4vpAuthorizationRequestHeaderV1_3,
+      [import_io_wallet_utils5.ItWalletSpecsVersion.V1_4]: () => zOpenid4vpAuthorizationRequestHeaderV1_3
     });
-    const decoded = (0, import_io_wallet_oauth23.decodeJwt)({
+    const decoded = (0, import_io_wallet_utils5.decodeJwt)({
       errorMessagePrefix: "Error decoding authorization request JWT:",
       headerSchema,
       jwt: options.requestObjectJwt,
       payloadSchema: zOpenid4vpAuthorizationRequestPayload
     });
-    if (options.config.itWalletSpecsVersion !== import_io_wallet_utils4.ItWalletSpecsVersion.V1_0) {
+    if (options.config.itWalletSpecsVersion !== import_io_wallet_utils5.ItWalletSpecsVersion.V1_0) {
       await validateAuthorizationRequestClientBinding({
         hash: options.callbacks?.hash,
         header: decoded.header,
@@ -605,7 +608,7 @@ async function parseAuthorizeRequest(options) {
         header: decoded.header,
         payload: decoded.payload
       });
-      await (0, import_oauth22.verifyJwt)({
+      await (0, import_io_wallet_utils5.verifyJwt)({
         compact: options.requestObjectJwt,
         errorMessage: "Error verifying Request Object signature",
         header: decoded.header,
@@ -625,7 +628,7 @@ async function parseAuthorizeRequest(options) {
       }
     };
   } catch (error) {
-    if (error instanceof import_io_wallet_utils4.ItWalletSpecsVersionError || error instanceof import_io_wallet_utils4.ValidationError || error instanceof import_oauth22.Oauth2JwtParseError || error instanceof Oid4vpError)
+    if (error instanceof import_io_wallet_utils5.ItWalletSpecsVersionError || error instanceof import_io_wallet_utils5.ValidationError || error instanceof import_io_wallet_utils5.JwtParseError || error instanceof Oid4vpError)
       throw error;
     throw new ParseAuthorizeRequestError(
       `Unexpected error during Request Object parsing: ${error instanceof Error ? error.message : String(error)}`
@@ -634,10 +637,10 @@ async function parseAuthorizeRequest(options) {
 }
 
 // src/authorization-response/create-authorization-response.ts
-var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
 
 // src/authorization-response/build-jarm-response.ts
-var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
 
 // src/jarm/jarm-extract-jwks.ts
 function extractEncryptionJwkFromJwks(jwks, {
@@ -693,8 +696,8 @@ async function buildJarmResponse(options) {
     const nonceBytes = await options.callbacks.generateRandom(32);
     const jweEncryptor = {
       alg,
-      apu: (0, import_io_wallet_utils5.encodeToBase64Url)(nonceBytes),
-      apv: (0, import_io_wallet_utils5.encodeToBase64Url)(options.requestObject.nonce),
+      apu: (0, import_io_wallet_utils6.encodeToBase64Url)(nonceBytes),
+      apv: (0, import_io_wallet_utils6.encodeToBase64Url)(options.requestObject.nonce),
       enc,
       kid: encryptionJwk.kid,
       method: "jwk",
@@ -773,17 +776,20 @@ async function createAuthorizationResponse2(options) {
 }
 
 // src/authorization-response/create-authorization-response.ts
-var dispatchCreateAuthorizationResponse = (0, import_io_wallet_utils6.createVersionDispatcher)({
-  [import_io_wallet_utils6.ItWalletSpecsVersion.V1_0]: (o) => (
+var dispatchCreateAuthorizationResponse = (0, import_io_wallet_utils7.createVersionDispatcher)({
+  [import_io_wallet_utils7.ItWalletSpecsVersion.APTITUDE]: (o) => createAuthorizationResponse2(
+    o
+  ),
+  [import_io_wallet_utils7.ItWalletSpecsVersion.V1_0]: (o) => (
     // V1_0 shares the v1.3 response logic — JWKS / enc resolution is identical.
     createAuthorizationResponse(
       o
     )
   ),
-  [import_io_wallet_utils6.ItWalletSpecsVersion.V1_3]: (o) => createAuthorizationResponse(
+  [import_io_wallet_utils7.ItWalletSpecsVersion.V1_3]: (o) => createAuthorizationResponse(
     o
   ),
-  [import_io_wallet_utils6.ItWalletSpecsVersion.V1_4]: (o) => createAuthorizationResponse2(
+  [import_io_wallet_utils7.ItWalletSpecsVersion.V1_4]: (o) => createAuthorizationResponse2(
     o
   )
 });
@@ -791,8 +797,218 @@ async function createAuthorizationResponse3(options) {
   return dispatchCreateAuthorizationResponse(options);
 }
 
+// src/authorization-response/create-openid4vp-authorization-response.ts
+var import_io_wallet_oauth23 = require("@pagopa/io-wallet-oauth2");
+var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
+var jarmResponseModes = /* @__PURE__ */ new Set([
+  "jwt",
+  "query.jwt",
+  "fragment.jwt",
+  "form_post.jwt",
+  "direct_post.jwt",
+  "dc_api.jwt"
+]);
+function assertValueSupported(options) {
+  const { actual, errorMessage, supported } = options;
+  const found = supported.find((value) => value === actual);
+  if (!found) {
+    throw new import_io_wallet_oauth23.Oauth2Error(errorMessage);
+  }
+  return found;
+}
+function assertClientJarmMetadataSupported(clientMetadata, serverMetadata) {
+  const {
+    authorization_encrypted_response_alg: encryptedAlg,
+    authorization_encrypted_response_enc: encryptedEnc,
+    authorization_signed_response_alg: signedAlg
+  } = clientMetadata;
+  if (encryptedAlg) {
+    assertValueSupported({
+      actual: encryptedAlg,
+      errorMessage: `Invalid authorization_encrypted_response_alg ${encryptedAlg}`,
+      supported: serverMetadata.authorization_encryption_alg_values_supported
+    });
+  }
+  if (encryptedEnc) {
+    assertValueSupported({
+      actual: encryptedEnc,
+      errorMessage: `Invalid authorization_encrypted_response_enc ${encryptedEnc}`,
+      supported: serverMetadata.authorization_encryption_enc_values_supported
+    });
+  }
+  if (signedAlg && serverMetadata.authorization_signed_response_alg_values_supported) {
+    assertValueSupported({
+      actual: signedAlg,
+      errorMessage: `Invalid authorization_signed_response_alg ${signedAlg}`,
+      supported: serverMetadata.authorization_signed_response_alg_values_supported
+    });
+  }
+}
+async function fetchJwks(jwksUrl, fetchCallback) {
+  if (!fetchCallback) {
+    throw new import_io_wallet_oauth23.Oauth2Error(
+      `Missing fetch callback required to resolve jwks_uri '${jwksUrl}'.`
+    );
+  }
+  const response = await fetchCallback(jwksUrl, {
+    headers: {
+      Accept: `${import_io_wallet_utils8.ContentType.JwkSet}, ${import_io_wallet_utils8.ContentType.Json};q=0.9`
+    }
+  });
+  await (0, import_io_wallet_utils8.hasStatusOrThrow)(200, import_io_wallet_utils8.UnexpectedStatusCodeError)(response);
+  return (0, import_io_wallet_utils8.parseWithErrorHandling)(
+    import_io_wallet_utils8.zJwkSet,
+    await response.json(),
+    `Validation of JWKs from jwks_uri '${jwksUrl}' failed`
+  );
+}
+async function createJarmAuthorizationResponse(options) {
+  const { callbacks, jarmAuthorizationResponse, jweEncryptor, jwtSigner } = options;
+  if (!jwtSigner && jweEncryptor) {
+    const { encryptionJwk: encryptionJwk2, jwe: jwe2 } = await callbacks.encryptJwe(
+      jweEncryptor,
+      JSON.stringify(jarmAuthorizationResponse)
+    );
+    return {
+      encryptionJwk: encryptionJwk2,
+      jarmAuthorizationResponseJwt: jwe2
+    };
+  }
+  if (jwtSigner && !jweEncryptor) {
+    const { jwt } = await callbacks.signJwt(jwtSigner, {
+      header: (0, import_io_wallet_utils8.jwtHeaderFromJwtSigner)(jwtSigner),
+      payload: jarmAuthorizationResponse
+    });
+    return {
+      jarmAuthorizationResponseJwt: jwt
+    };
+  }
+  if (!jwtSigner || !jweEncryptor) {
+    throw new import_io_wallet_oauth23.Oauth2Error(
+      "JWT signer and/or encryptor are required to create a JARM auth response."
+    );
+  }
+  const signed = await callbacks.signJwt(jwtSigner, {
+    header: (0, import_io_wallet_utils8.jwtHeaderFromJwtSigner)(jwtSigner),
+    payload: jarmAuthorizationResponse
+  });
+  const { encryptionJwk, jwe } = await callbacks.encryptJwe(
+    jweEncryptor,
+    signed.jwt
+  );
+  return {
+    encryptionJwk,
+    jarmAuthorizationResponseJwt: jwe
+  };
+}
+async function createOpenid4vpAuthorizationResponse(options) {
+  const { authorizationRequestPayload, jarm } = options;
+  const authorizationResponsePayload = {
+    ...options.authorizationResponsePayload,
+    state: authorizationRequestPayload.state
+  };
+  const { prefix: clientIdPrefix } = extractClientIdPrefix(
+    authorizationRequestPayload.client_id
+  );
+  if (authorizationRequestPayload.response_mode && jarmResponseModes.has(authorizationRequestPayload.response_mode) && !jarm) {
+    throw new import_io_wallet_oauth23.Oauth2Error(
+      `Missing jarm options for creating Jarm response with response mode '${authorizationRequestPayload.response_mode}'`
+    );
+  }
+  if (!jarm) {
+    return { authorizationResponsePayload };
+  }
+  if ((clientIdPrefix === "openid_federation" /* OPENID_FEDERATION */ || clientIdPrefix === "none" /* NONE */) && !options.clientMetadata) {
+    throw new import_io_wallet_oauth23.Oauth2Error(
+      "When OpenID Federation is used as the client id prefix (https/openid_federation), passing externally fetched and verified 'clientMetadata' to 'createOpenid4vpAuthorizationResponse' is required."
+    );
+  }
+  const clientMetadata = options.clientMetadata ?? authorizationRequestPayload.client_metadata;
+  if (!clientMetadata) {
+    throw new import_io_wallet_oauth23.Oauth2Error(
+      "Missing client metadata in the request params to assert Jarm metadata support."
+    );
+  }
+  const jwks = clientMetadata.jwks ? clientMetadata.jwks : clientMetadata.jwks_uri ? await fetchJwks(clientMetadata.jwks_uri, options.callbacks.fetch) : void 0;
+  if (!jwks) {
+    throw new import_io_wallet_oauth23.Oauth2Error(
+      "Missing 'jwks' or 'jwks_uri' in client metadata. Cannot extract encryption JWK."
+    );
+  }
+  assertClientJarmMetadataSupported(clientMetadata, jarm.serverMetadata);
+  const encryptionJwk = jarm.encryption?.jwk ?? extractEncryptionJwkFromJwks(jwks, {
+    supportedAlgValues: jarm.serverMetadata.authorization_encryption_alg_values_supported ?? (clientMetadata.authorization_encrypted_response_alg ? [clientMetadata.authorization_encrypted_response_alg] : void 0)
+  });
+  if (!encryptionJwk) {
+    throw new import_io_wallet_oauth23.Oauth2Error(
+      "No encryption JWK provided and could not extract encryption JWK from client metadata. Failed to create JARM response."
+    );
+  }
+  const enc = clientMetadata.encrypted_response_enc_values_supported ? jarm.serverMetadata.authorization_encryption_enc_values_supported.find(
+    (value) => clientMetadata.encrypted_response_enc_values_supported?.includes(
+      value
+    )
+  ) ?? clientMetadata.encrypted_response_enc_values_supported[0] ?? "A128GCM" : clientMetadata.authorization_encrypted_response_enc ?? "A128GCM";
+  assertValueSupported({
+    actual: enc,
+    errorMessage: `Invalid 'enc' value ${enc}. Supported values are ${jarm.serverMetadata.authorization_encryption_enc_values_supported.join(", ")}`,
+    supported: jarm.serverMetadata.authorization_encryption_enc_values_supported
+  });
+  const alg = encryptionJwk.alg ?? clientMetadata.authorization_encrypted_response_alg ?? "ECDH-ES";
+  assertValueSupported({
+    actual: alg,
+    errorMessage: `Invalid 'alg' value ${alg}. Supported values are ${jarm.serverMetadata.authorization_encryption_alg_values_supported.join(", ")}`,
+    supported: jarm.serverMetadata.authorization_encryption_alg_values_supported
+  });
+  if (clientMetadata.authorization_signed_response_alg && jarm.jwtSigner && clientMetadata.authorization_signed_response_alg !== jarm.jwtSigner.alg) {
+    throw new import_io_wallet_oauth23.Oauth2Error(
+      `Invalid signed response alg value ${jarm.jwtSigner.alg}. Expected ${clientMetadata.authorization_signed_response_alg}.`
+    );
+  }
+  const additionalJwtPayload = jarm.jwtSigner ? {
+    aud: jarm.audience ?? (() => {
+      throw new import_io_wallet_oauth23.Oauth2Error(
+        "Missing required aud in JARM configuration for creating OpenID4VP authorization response."
+      );
+    })(),
+    exp: jarm.expiresInSeconds ? (0, import_io_wallet_utils8.dateToSeconds)((0, import_io_wallet_utils8.addSecondsToDate)(/* @__PURE__ */ new Date(), jarm.expiresInSeconds)) : (0, import_io_wallet_utils8.dateToSeconds)((0, import_io_wallet_utils8.addSecondsToDate)(/* @__PURE__ */ new Date(), 600)),
+    iss: jarm.authorizationServer ?? (() => {
+      throw new import_io_wallet_oauth23.Oauth2Error(
+        "Missing required iss in JARM configuration for creating OpenID4VP authorization response."
+      );
+    })()
+  } : void 0;
+  const jarmResponsePayload = {
+    ...authorizationResponsePayload,
+    ...additionalJwtPayload
+  };
+  const { encryptionJwk: usedEncryptionJwk, jarmAuthorizationResponseJwt } = await createJarmAuthorizationResponse({
+    callbacks: {
+      encryptJwe: options.callbacks.encryptJwe,
+      signJwt: options.callbacks.signJwt
+    },
+    jarmAuthorizationResponse: jarmResponsePayload,
+    jweEncryptor: jarm.encryption ? {
+      alg,
+      apu: jarm.encryption.nonce ? (0, import_io_wallet_utils8.encodeToBase64Url)(jarm.encryption.nonce) : void 0,
+      apv: (0, import_io_wallet_utils8.encodeToBase64Url)(authorizationRequestPayload.nonce),
+      enc,
+      method: "jwk",
+      publicJwk: encryptionJwk
+    } : void 0,
+    jwtSigner: jarm.jwtSigner
+  });
+  return {
+    authorizationResponsePayload: jarmResponsePayload,
+    jarm: {
+      encryptionJwk: usedEncryptionJwk,
+      responseJwt: jarmAuthorizationResponseJwt
+    }
+  };
+}
+
 // src/authorization-response/fetch-authorization-response.ts
-var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
 
 // src/authorization-response/z-authorization-response.ts
 var import_zod4 = __toESM(require("zod"));
@@ -828,7 +1044,7 @@ async function fetchAuthorizationResponse(options) {
         ]
       });
     }
-    const fetch = (0, import_io_wallet_utils7.createFetcher)(options.callbacks.fetch);
+    const fetch = (0, import_io_wallet_utils9.createFetcher)(options.callbacks.fetch);
     const authorizationResponseResult = await fetch(
       options.presentationResponseUri,
       {
@@ -836,17 +1052,17 @@ async function fetchAuthorizationResponse(options) {
           response: options.authorizationResponseJarm
         }),
         headers: {
-          [import_io_wallet_utils7.HEADERS.CONTENT_TYPE]: import_io_wallet_utils7.CONTENT_TYPES.FORM_URLENCODED
+          [import_io_wallet_utils9.HEADERS.CONTENT_TYPE]: import_io_wallet_utils9.CONTENT_TYPES.FORM_URLENCODED
         },
         method: "POST"
       }
     );
-    await (0, import_io_wallet_utils7.hasStatusOrThrow)(
+    await (0, import_io_wallet_utils9.hasStatusOrThrow)(
       200,
-      import_io_wallet_utils7.UnexpectedStatusCodeError
+      import_io_wallet_utils9.UnexpectedStatusCodeError
     )(authorizationResponseResult);
     const authorizationResponseResultJson = await authorizationResponseResult.json();
-    const parsedAuthorizationResponseResult = (0, import_io_wallet_utils7.parseWithErrorHandling)(
+    const parsedAuthorizationResponseResult = (0, import_io_wallet_utils9.parseWithErrorHandling)(
       zOpenid4vpAuthorizationResponseResult,
       authorizationResponseResultJson
     );
@@ -864,7 +1080,7 @@ async function fetchAuthorizationResponse(options) {
     }
     return parsedAuthorizationResponseResult;
   } catch (error) {
-    if (error instanceof import_io_wallet_utils7.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils7.ValidationError || error instanceof FetchAuthorizationResponseError) {
+    if (error instanceof import_io_wallet_utils9.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils9.ValidationError || error instanceof FetchAuthorizationResponseError) {
       throw error;
     }
     throw new FetchAuthorizationResponseError(
@@ -874,19 +1090,18 @@ async function fetchAuthorizationResponse(options) {
 }
 
 // src/authorization-response/parse-authorization-response.ts
-var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils14 = require("@pagopa/io-wallet-utils");
 
 // src/jarm/parse-jarm-authorization-response.ts
-var import_io_wallet_oauth26 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils13 = require("@pagopa/io-wallet-utils");
 var import_zod7 = __toESM(require("zod"));
 
 // src/vp-token/parse-vp-token.ts
-var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils10 = require("@pagopa/io-wallet-utils");
 function parseVpToken(vpToken) {
-  return (0, import_io_wallet_utils8.parseWithErrorHandling)(
+  return (0, import_io_wallet_utils10.parseWithErrorHandling)(
     zVpToken,
-    (0, import_io_wallet_utils8.parseIfJson)(vpToken),
+    (0, import_io_wallet_utils10.parseIfJson)(vpToken),
     "Could not parse dcql vp_token. Expected an object where the values are encoded presentations"
   );
 }
@@ -905,22 +1120,21 @@ function validateOpenid4vpAuthorizationResponsePayload(options) {
 }
 
 // src/jarm/verify-jarm-authorization-response.ts
-var import_oauth23 = require("@openid4vc/oauth2");
-var import_io_wallet_oauth25 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_oauth24 = require("@pagopa/io-wallet-oauth2");
+var import_io_wallet_utils12 = require("@pagopa/io-wallet-utils");
 var import_zod6 = __toESM(require("zod"));
 
 // src/jarm/z-jarm.ts
-var import_io_wallet_oauth24 = require("@pagopa/io-wallet-oauth2");
+var import_io_wallet_utils11 = require("@pagopa/io-wallet-utils");
 var import_zod5 = require("zod");
 var zJarmHeader = import_zod5.z.object({
-  ...import_io_wallet_oauth24.zJwtHeader.shape,
+  ...import_io_wallet_utils11.zJwtHeader.shape,
   apu: import_zod5.z.string().optional(),
   apv: import_zod5.z.string().optional(),
   kid: import_zod5.z.string()
 });
 var zEncryptedJarmHeader = import_zod5.z.object({
-  ...import_io_wallet_oauth24.zJwtHeader.shape,
+  ...import_io_wallet_utils11.zJwtHeader.shape,
   apu: import_zod5.z.string().optional(),
   apv: import_zod5.z.string().optional(),
   enc: import_zod5.z.string().optional(),
@@ -932,12 +1146,12 @@ var zJarmAuthorizationResponse = import_zod5.z.looseObject({
    * aud: The client_id of the client the response is intended for
    * exp: The expiration time of the JWT. A maximum JWT lifetime of 10 minutes is RECOMMENDED.
    */
-  ...import_io_wallet_oauth24.zJwtPayload.shape,
-  ...import_io_wallet_oauth24.zJwtPayload.pick({ aud: true, exp: true, iss: true }).required().shape,
+  ...import_io_wallet_utils11.zJwtPayload.shape,
+  ...import_io_wallet_utils11.zJwtPayload.pick({ aud: true, exp: true, iss: true }).required().shape,
   state: import_zod5.z.optional(import_zod5.z.string())
 });
 var zJarmAuthorizationResponseEncryptedOnly = import_zod5.z.looseObject({
-  ...import_io_wallet_oauth24.zJwtPayload.shape,
+  ...import_io_wallet_utils11.zJwtPayload.shape,
   state: import_zod5.z.optional(import_zod5.z.string())
 });
 
@@ -955,7 +1169,7 @@ var decryptJarmAuthorizationResponseJwt = async (options) => {
     jarmAuthorizationResponseJwt
   } = options;
   let encryptionJwk;
-  const { header } = (0, import_io_wallet_oauth25.decodeJwtHeader)({
+  const { header } = (0, import_io_wallet_utils12.decodeJwtHeader)({
     headerSchema: zEncryptedJarmHeader,
     jwt: jarmAuthorizationResponseJwt
   });
@@ -967,7 +1181,7 @@ var decryptJarmAuthorizationResponseJwt = async (options) => {
     jwk: encryptionJwk
   });
   if (!result.decrypted) {
-    throw new import_io_wallet_oauth25.Oauth2Error("Failed to decrypt jarm auth response.");
+    throw new import_io_wallet_oauth24.Oauth2Error("Failed to decrypt jarm auth response.");
   }
   return {
     decryptionJwk: result.decryptionJwk,
@@ -980,7 +1194,7 @@ async function verifyJarmAuthorizationResponse(options) {
     callbacks,
     jarmAuthorizationResponseJwt
   } = options;
-  const requestDataIsEncrypted = import_io_wallet_oauth25.zCompactJwe.safeParse(
+  const requestDataIsEncrypted = import_io_wallet_utils12.zCompactJwe.safeParse(
     jarmAuthorizationResponseJwt
   ).success;
   const decryptedRequestData = requestDataIsEncrypted ? await decryptJarmAuthorizationResponseJwt({
@@ -988,23 +1202,23 @@ async function verifyJarmAuthorizationResponse(options) {
     callbacks,
     jarmAuthorizationResponseJwt
   }) : { decryptionJwk: void 0, payload: jarmAuthorizationResponseJwt };
-  const responseIsSigned = import_io_wallet_oauth25.zCompactJwt.safeParse(
+  const responseIsSigned = import_io_wallet_utils12.zCompactJwt.safeParse(
     decryptedRequestData.payload
   ).success;
   if (!requestDataIsEncrypted && !responseIsSigned) {
-    throw new import_io_wallet_oauth25.Oauth2Error(
+    throw new import_io_wallet_oauth24.Oauth2Error(
       "Jarm Auth Response must be either encrypted, signed, or signed and encrypted."
     );
   }
   let jarmAuthorizationResponse;
   if (responseIsSigned) {
-    const { header: jwsProtectedHeader, payload: jwsPayload } = (0, import_io_wallet_oauth25.decodeJwt)({
+    const { header: jwsProtectedHeader, payload: jwsPayload } = (0, import_io_wallet_utils12.decodeJwt)({
       errorMessagePrefix: "Error decoding JARM authorization response JWT:",
-      headerSchema: import_zod6.default.object({ ...import_io_wallet_oauth25.zJwtHeader.shape, kid: import_zod6.default.string() }),
+      headerSchema: import_zod6.default.object({ ...import_io_wallet_utils12.zJwtHeader.shape, kid: import_zod6.default.string() }),
       jwt: decryptedRequestData.payload
     });
     const response = zJarmAuthorizationResponse.parse(jwsPayload);
-    const jwtSigner = (0, import_oauth23.jwtSignerFromJwt)({
+    const jwtSigner = (0, import_io_wallet_utils12.jwtSignerFromJwt)({
       header: jwsProtectedHeader,
       payload: jwsPayload
     });
@@ -1014,31 +1228,31 @@ async function verifyJarmAuthorizationResponse(options) {
       payload: jwsPayload
     });
     if (!verificationResult.verified) {
-      throw new import_io_wallet_oauth25.Oauth2Error("Jarm Auth Response is not valid.");
+      throw new import_io_wallet_oauth24.Oauth2Error("Jarm Auth Response is not valid.");
     }
     const expectedAudience = authorizationRequestPayload.client_id;
     const expectedIssuer = authorizationRequestPayload.iss;
     if (response.aud !== expectedAudience) {
-      throw new import_io_wallet_oauth25.Oauth2Error(
+      throw new import_io_wallet_oauth24.Oauth2Error(
         `Jarm Auth Response contains 'aud' value '${response.aud}', but expected '${expectedAudience}'.`
       );
     }
     if (expectedIssuer && response.iss !== expectedIssuer) {
-      throw new import_io_wallet_oauth25.Oauth2Error(
+      throw new import_io_wallet_oauth24.Oauth2Error(
         `Jarm Auth Response contains 'iss' value '${response.iss}', but expected '${expectedIssuer}'.`
       );
     }
     const now = options.now ?? /* @__PURE__ */ new Date();
     const nowSeconds = Math.floor(now.getTime() / 1e3);
     if (response.exp < nowSeconds) {
-      throw new import_io_wallet_oauth25.Oauth2Error("Jarm Auth Response has expired.");
+      throw new import_io_wallet_oauth24.Oauth2Error("Jarm Auth Response has expired.");
     }
     if (response.nbf !== void 0 && response.nbf > nowSeconds) {
-      throw new import_io_wallet_oauth25.Oauth2Error("Jarm Auth Response is not active yet.");
+      throw new import_io_wallet_oauth24.Oauth2Error("Jarm Auth Response is not active yet.");
     }
     jarmAuthorizationResponse = response;
   } else {
-    const jsonRequestData = (0, import_io_wallet_utils9.stringToJsonWithErrorHandling)(
+    const jsonRequestData = (0, import_io_wallet_utils12.stringToJsonWithErrorHandling)(
       decryptedRequestData.payload,
       "Unable to parse decrypted JARM JWE body to JSON"
     );
@@ -1057,8 +1271,8 @@ async function verifyJarmAuthorizationResponse(options) {
 // src/jarm/parse-jarm-authorization-response.ts
 async function parseJarmAuthorizationResponse(options) {
   const { authorizationRequestPayload, callbacks, jarmResponseJwt, now } = options;
-  const jarmAuthorizationResponseJwt = (0, import_io_wallet_utils10.parseWithErrorHandling)(
-    import_zod7.default.union([import_io_wallet_oauth26.zCompactJwt, import_io_wallet_oauth26.zCompactJwe]),
+  const jarmAuthorizationResponseJwt = (0, import_io_wallet_utils13.parseWithErrorHandling)(
+    import_zod7.default.union([import_io_wallet_utils13.zCompactJwt, import_io_wallet_utils13.zCompactJwe]),
     jarmResponseJwt,
     "Invalid jarm authorization response jwt."
   );
@@ -1068,11 +1282,11 @@ async function parseJarmAuthorizationResponse(options) {
     jarmAuthorizationResponseJwt,
     now
   });
-  const { header: jarmHeader } = (0, import_io_wallet_oauth26.decodeJwtHeader)({
+  const { header: jarmHeader } = (0, import_io_wallet_utils13.decodeJwtHeader)({
     headerSchema: zJarmHeader,
     jwt: jarmAuthorizationResponseJwt
   });
-  const authorizationResponsePayload = (0, import_io_wallet_utils10.parseWithErrorHandling)(
+  const authorizationResponsePayload = (0, import_io_wallet_utils13.parseWithErrorHandling)(
     zOpenid4vpAuthorizationResponse,
     verifiedJarmResponse.jarmAuthorizationResponse,
     "Failed to parse openid4vp authorization response."
@@ -1104,7 +1318,7 @@ async function parseAuthorizationResponse(options) {
       jarmResponseJwt: authorizationResponse.response
     });
   }
-  const authorizationResponsePayload = (0, import_io_wallet_utils11.parseWithErrorHandling)(
+  const authorizationResponsePayload = (0, import_io_wallet_utils14.parseWithErrorHandling)(
     zOpenid4vpAuthorizationResponse,
     authorizationResponse,
     "Failed to parse openid4vp authorization response."
@@ -1119,9 +1333,6 @@ async function parseAuthorizationResponse(options) {
     expectedNonce: authorizationRequestPayload.nonce
   };
 }
-
-// src/index.ts
-var import_openid4vp = require("@openid4vc/openid4vp");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ClientIdPrefix,