@pagopa/io-wallet-utils 1.5.7 → 2.0.0-apt

package/dist/index.mjs

@@ -1,5 +1,6 @@
 // src/config.ts
 var ItWalletSpecsVersion = /* @__PURE__ */ ((ItWalletSpecsVersion2) => {
+  ItWalletSpecsVersion2["APTITUDE"] = "APTITUDE";
   ItWalletSpecsVersion2["V1_0"] = "V1_0";
   ItWalletSpecsVersion2["V1_3"] = "V1_3";
   ItWalletSpecsVersion2["V1_4"] = "V1_4";
@@ -48,6 +49,59 @@ var HEADERS = {
 var MAX_IAT_AGE_SECONDS = 5 * 60;
 var CLOCK_SKEW_TOLERANCE_SECONDS = 60;
 
+// src/content-type.ts
+var ContentType = /* @__PURE__ */ ((ContentType2) => {
+  ContentType2["Html"] = "text/html";
+  ContentType2["Json"] = "application/json";
+  ContentType2["JwkSet"] = "application/jwk-set+json";
+  ContentType2["Jwt"] = "application/jwt";
+  ContentType2["OAuthAuthorizationRequestJwt"] = "application/oauth-authz-req+jwt";
+  ContentType2["XWwwFormUrlencoded"] = "application/x-www-form-urlencoded";
+  return ContentType2;
+})(ContentType || {});
+
+// src/crypto/hash.ts
+var HashAlgorithm = /* @__PURE__ */ ((HashAlgorithm2) => {
+  HashAlgorithm2["Sha256"] = "sha-256";
+  HashAlgorithm2["Sha384"] = "sha-384";
+  HashAlgorithm2["Sha512"] = "sha-512";
+  return HashAlgorithm2;
+})(HashAlgorithm || {});
+
+// src/encoding.ts
+var utf8Encoder = new TextEncoder();
+var utf8Decoder = new TextDecoder();
+function base64UrlToBase64(base64) {
+  const normalized = base64.replace(/-/g, "+").replace(/_/g, "/");
+  const paddingLength = normalized.length % 4;
+  return paddingLength === 0 ? normalized : normalized.padEnd(normalized.length + (4 - paddingLength), "=");
+}
+function base64ToBase64Url(base64) {
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function encodeBase64(data) {
+  let binary = "";
+  for (const byte of data) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+}
+function decodeUtf8String(value) {
+  return utf8Encoder.encode(value);
+}
+function encodeToUtf8String(data) {
+  return utf8Decoder.decode(data);
+}
+function decodeBase64(base64) {
+  const binary = atob(base64UrlToBase64(base64));
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+function encodeToBase64Url(data) {
+  return base64ToBase64Url(
+    encodeBase64(typeof data === "string" ? decodeUtf8String(data) : data)
+  );
+}
+
 // src/errors/parse.ts
 var constants = {
   identifierRegex: /[$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*/u,
@@ -106,6 +160,27 @@ function formatZodError(error) {
 }
 
 // src/errors/errors.ts
+var JsonParseError = class extends Error {
+  constructor(message, jsonString) {
+    super(`${message}
+${jsonString}`);
+    this.name = "JsonParseError";
+  }
+};
+var JwtParseError = class extends Error {
+  constructor(message) {
+    super(message ?? "Error parsing jwt");
+    this.name = "JwtParseError";
+  }
+};
+var JwtVerificationError = class extends Error {
+  constructor(message, options) {
+    const errorMessage = message ?? "Error verifying jwt.";
+    const causeMessage = options?.cause instanceof Error ? ` ${options.cause.message}` : options?.cause ? ` ${String(options.cause)}` : "";
+    super(`${errorMessage}${causeMessage}`, options);
+    this.name = "JwtVerificationError";
+  }
+};
 var serializeAttrs = (attrs) => Object.entries(attrs).filter(([, v]) => v !== void 0).map(([k, v]) => {
   if (Array.isArray(v)) return [k, `(${v.join(", ")})`];
   if (typeof v !== "string") return [k, JSON.stringify(v)];
@@ -160,21 +235,6 @@ ${formattedError}`;
   }
 };
 
-// src/fetcher.ts
-var hasStatusOrThrow = (status, customError) => async (res) => {
-  if (Array.isArray(status) ? !status.includes(res.status) : res.status !== status) {
-    const ErrorClass = customError ?? UnexpectedStatusCodeError;
-    throw new ErrorClass({
-      message: `Http request failed. Expected ${status}, got ${res.status}, url: ${res.url}`,
-      reason: await parseRawHttpResponse(res),
-      // Pass the response body as reason so the original error can surface
-      statusCode: res.status
-    });
-  }
-  return res;
-};
-var parseRawHttpResponse = (response) => response.headers.get("content-type")?.includes("application/json") ? response.json() : response.text();
-
 // src/parse.ts
 var SAFE_STRINGIFY_MAX_LENGTH = 200;
 function safeStringify(value) {
@@ -191,6 +251,26 @@ function safeStringify(value) {
     return "[unserializable]";
   }
 }
+function stringToJsonWithErrorHandling(value, errorMessage) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    throw new JsonParseError(
+      errorMessage ?? "Unable to parse string to JSON.",
+      value
+    );
+  }
+}
+function parseIfJson(data) {
+  if (typeof data !== "string") {
+    return data;
+  }
+  try {
+    return JSON.parse(data);
+  } catch {
+    return data;
+  }
+}
 function parseWithErrorHandling(schema, data, customErrorMessage) {
   const parseResult = schema.safeParse(data);
   if (!parseResult.success) {
@@ -205,9 +285,522 @@ function formatError(message, prefix) {
   return prefix ? `${prefix} ${message}` : message;
 }
 
-// src/validation.ts
+// src/crypto/jwk/z-jwk.ts
+import z2 from "zod";
+
+// src/crypto/z-common.ts
 import z from "zod";
-var zItwSupportedSignatureAlg = z.enum([
+var zTrustChain = z.tuple([z.string()], z.string());
+var zCertificateChain = z.array(z.string()).nonempty();
+var zAlgValueNotNone = z.string().refine((alg) => alg !== "none", { message: `alg value may not be 'none'` });
+
+// src/crypto/jwk/z-jwk.ts
+var zJwk = z2.looseObject({
+  alg: z2.optional(z2.string()),
+  crv: z2.optional(z2.string()),
+  d: z2.optional(z2.string()),
+  dp: z2.optional(z2.string()),
+  dq: z2.optional(z2.string()),
+  e: z2.optional(z2.string()),
+  ext: z2.optional(z2.boolean()),
+  k: z2.optional(z2.string()),
+  key_ops: z2.optional(z2.array(z2.string())),
+  kid: z2.optional(z2.string()),
+  kty: z2.string(),
+  n: z2.optional(z2.string()),
+  oth: z2.optional(
+    z2.array(
+      z2.looseObject({
+        d: z2.optional(z2.string()),
+        r: z2.optional(z2.string()),
+        t: z2.optional(z2.string())
+      })
+    )
+  ),
+  p: z2.optional(z2.string()),
+  q: z2.optional(z2.string()),
+  qi: z2.optional(z2.string()),
+  use: z2.optional(z2.string()),
+  x: z2.optional(z2.string()),
+  x5c: z2.optional(zCertificateChain),
+  x5t: z2.optional(z2.string()),
+  "x5t#S256": z2.optional(z2.string()),
+  x5u: z2.optional(z2.string()),
+  y: z2.optional(z2.string())
+});
+var zJwkSet = z2.looseObject({ keys: z2.array(zJwk) });
+
+// src/crypto/jwk/calculate-jwk-thumbprint.ts
+function createJwkThumbprintComponents(jwk) {
+  if (jwk.kty === "EC") {
+    if (!jwk.crv || !jwk.x || !jwk.y) {
+      throw new ValidationError(
+        "Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing."
+      );
+    }
+    return {
+      crv: jwk.crv,
+      kty: jwk.kty,
+      x: jwk.x,
+      y: jwk.y
+    };
+  }
+  if (jwk.kty === "RSA") {
+    if (!jwk.e || !jwk.n) {
+      throw new ValidationError(
+        "Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing."
+      );
+    }
+    return {
+      e: jwk.e,
+      kty: jwk.kty,
+      n: jwk.n
+    };
+  }
+  if (jwk.kty === "oct") {
+    if (!jwk.k) {
+      throw new ValidationError(
+        "Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing."
+      );
+    }
+    return {
+      k: jwk.k,
+      kty: jwk.kty
+    };
+  }
+  throw new ValidationError(
+    "Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing."
+  );
+}
+async function calculateJwkThumbprint(options) {
+  const parsedJwk = parseWithErrorHandling(
+    zJwk,
+    options.jwk,
+    "Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing."
+  );
+  const jwkThumbprintComponents = createJwkThumbprintComponents(parsedJwk);
+  return encodeToBase64Url(
+    await options.hashCallback(
+      decodeUtf8String(JSON.stringify(jwkThumbprintComponents)),
+      options.hashAlgorithm
+    )
+  );
+}
+
+// src/crypto/jwt/z-jwt.ts
+import z3 from "zod";
+var MAX_JTI_LENGTH = 256;
+var zCompactJwt = z3.string().regex(/^([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)$/, {
+  message: "Not a valid compact jwt"
+});
+var zJwtConfirmationPayload = z3.looseObject({
+  // RFC9449. jwk thumbprint of the dpop public key to which the access token is bound
+  jkt: z3.string().optional(),
+  jwk: zJwk.optional()
+});
+var zJwtPayload = z3.looseObject({
+  aud: z3.string().or(z3.array(z3.string())).optional(),
+  cnf: zJwtConfirmationPayload.optional(),
+  exp: z3.number().int().optional(),
+  iat: z3.number().int().optional(),
+  iss: z3.string().optional(),
+  jti: z3.string().max(MAX_JTI_LENGTH).optional(),
+  nbf: z3.number().int().optional(),
+  nonce: z3.string().optional(),
+  // Reserved for status parameters
+  status: z3.record(z3.string(), z3.any()).optional(),
+  sub: z3.string().optional(),
+  // Reserved for OpenID Federation
+  trust_chain: zTrustChain.optional()
+});
+var zJwtHeader = z3.looseObject({
+  alg: zAlgValueNotNone,
+  jwk: zJwk.optional(),
+  kid: z3.string().optional(),
+  // Reserved for OpenID Federation
+  trust_chain: zTrustChain.optional(),
+  typ: z3.string().optional(),
+  x5c: zCertificateChain.optional()
+});
+
+// src/crypto/jwt/decode-jwt-header.ts
+function decodeJwtHeader(options) {
+  const jwtParts = options.jwt.split(".");
+  if (jwtParts.length <= 2) {
+    throw new JwtParseError(
+      formatError(
+        "Unable to decode because Jwt is not a valid!",
+        options.errorMessagePrefix
+      )
+    );
+  }
+  const [headerPart] = jwtParts;
+  let headerJson;
+  try {
+    headerJson = stringToJsonWithErrorHandling(
+      encodeToUtf8String(decodeBase64(headerPart)),
+      formatError(
+        "Unable to parse jwt header to JSON",
+        options.errorMessagePrefix
+      )
+    );
+  } catch (error) {
+    throw new JwtParseError(
+      formatError(
+        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
+        options.errorMessagePrefix
+      )
+    );
+  }
+  const header = parseWithErrorHandling(
+    options.headerSchema ?? zJwtHeader,
+    headerJson,
+    formatError("Invalid JWT header", options.errorMessagePrefix)
+  );
+  return {
+    header
+  };
+}
+function jwtHeaderFromJwtSigner(signer) {
+  if (signer.method === "did") {
+    return {
+      alg: signer.alg,
+      kid: signer.didUrl
+    };
+  }
+  if (signer.method === "federation") {
+    return {
+      alg: signer.alg,
+      kid: signer.kid,
+      trust_chain: signer.trustChain
+    };
+  }
+  if (signer.method === "jwk") {
+    return {
+      alg: signer.alg,
+      jwk: signer.publicJwk
+    };
+  }
+  if (signer.method === "x5c") {
+    return {
+      alg: signer.alg,
+      kid: signer.kid,
+      trust_chain: signer.trustChain,
+      x5c: signer.x5c
+    };
+  }
+  return { alg: signer.alg };
+}
+function jwtSignerFromJwt(options) {
+  const { allowedSignerMethods, header, payload } = options;
+  const found = [];
+  if (header.x5c) {
+    found.push({
+      method: "x5c",
+      signer: {
+        alg: header.alg,
+        kid: header.kid,
+        method: "x5c",
+        trustChain: header.trust_chain,
+        x5c: header.x5c
+      },
+      valid: true
+    });
+  }
+  if (header.trust_chain) {
+    if (!header.kid) {
+      found.push({
+        error: "When 'trust_chain' is used in jwt header, the 'kid' parameter is required.",
+        method: "federation",
+        valid: false
+      });
+    } else {
+      found.push({
+        method: "federation",
+        signer: {
+          alg: header.alg,
+          kid: header.kid,
+          method: "federation",
+          trustChain: header.trust_chain
+        },
+        valid: true
+      });
+    }
+  }
+  if (header.kid?.startsWith("did:") || payload.iss?.startsWith("did:")) {
+    if (payload.iss && header.kid?.startsWith("did:") && !header.kid.startsWith(payload.iss)) {
+      found.push({
+        error: "kid in header starts with did that is different from did value in 'iss'",
+        method: "did",
+        valid: false
+      });
+    } else if (!header.kid?.startsWith("did:") && !header.kid?.startsWith("#")) {
+      found.push({
+        error: "kid in header must start with either 'did:' or '#' when 'iss' value is a did",
+        method: "did",
+        valid: false
+      });
+    } else if (header.kid) {
+      found.push({
+        method: "did",
+        signer: {
+          alg: header.alg,
+          didUrl: header.kid.startsWith("did:") ? header.kid : `${payload.iss}${header.kid}`,
+          method: "did"
+        },
+        valid: true
+      });
+    }
+  }
+  if (header.jwk) {
+    found.push({
+      method: "jwk",
+      signer: {
+        alg: header.alg,
+        method: "jwk",
+        publicJwk: header.jwk
+      },
+      valid: true
+    });
+  }
+  const allowedFoundMethods = found.filter(
+    (candidate) => !allowedSignerMethods || allowedSignerMethods.includes(candidate.method)
+  );
+  const allowedValidMethods = allowedFoundMethods.filter(
+    (candidate) => candidate.valid
+  );
+  const firstAllowedValidMethod = allowedValidMethods[0];
+  if (firstAllowedValidMethod && firstAllowedValidMethod.valid) {
+    return firstAllowedValidMethod.signer;
+  }
+  if (allowedFoundMethods.length > 0) {
+    throw new JwtParseError(
+      `Unable to extract signer method from jwt. Found ${allowedFoundMethods.length} allowed signer method(s) but contained invalid configuration:
+${allowedFoundMethods.map(
+        (candidate) => candidate.valid ? "" : `FAILED: method ${candidate.method} - ${candidate.error}`
+      ).join("\n")}`
+    );
+  }
+  if (found.length > 0) {
+    throw new JwtParseError(
+      `Unable to extract signer method from jwt. Found ${found.length} signer method(s) that are not allowed:
+${found.map(
+        (candidate) => candidate.valid ? `SUCCEEDED: method ${candidate.method}` : `FAILED: method ${candidate.method} - ${candidate.error}`
+      ).join("\n")}`
+    );
+  }
+  if (!allowedSignerMethods || allowedSignerMethods.includes("custom")) {
+    return {
+      alg: header.alg,
+      kid: header.kid,
+      method: "custom"
+    };
+  }
+  throw new JwtParseError(
+    "Unable to extract signer method from jwt. Found no signer methods and 'custom' signer method is not allowed."
+  );
+}
+
+// src/crypto/jwt/decode-jwt.ts
+function decodeJwt(options) {
+  const jwtParts = options.jwt.split(".");
+  if (jwtParts.length !== 3) {
+    throw new JwtParseError(
+      formatError(
+        "Unable to decode because Jwt is not a valid!",
+        options.errorMessagePrefix
+      )
+    );
+  }
+  let payloadJson;
+  try {
+    const payloadPart = jwtParts[1];
+    if (payloadPart === void 0) {
+      throw new JwtParseError(
+        formatError(
+          "Unable to decode because Jwt is not a valid!",
+          options.errorMessagePrefix
+        )
+      );
+    }
+    payloadJson = stringToJsonWithErrorHandling(
+      encodeToUtf8String(decodeBase64(payloadPart)),
+      formatError(
+        "Unable to parse jwt payload to JSON",
+        options.errorMessagePrefix
+      )
+    );
+  } catch (error) {
+    throw new JwtParseError(
+      formatError(
+        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
+        options.errorMessagePrefix
+      )
+    );
+  }
+  const signaturePart = jwtParts[2];
+  if (signaturePart === void 0) {
+    throw new JwtParseError(
+      formatError(
+        "Unable to decode because Jwt is not a valid!",
+        options.errorMessagePrefix
+      )
+    );
+  }
+  const { header } = decodeJwtHeader({
+    errorMessagePrefix: options.errorMessagePrefix,
+    headerSchema: options.headerSchema,
+    jwt: options.jwt
+  });
+  const payload = parseWithErrorHandling(
+    options.payloadSchema ?? zJwtPayload,
+    payloadJson,
+    formatError("Invalid JWT payload", options.errorMessagePrefix)
+  );
+  return {
+    compact: options.jwt,
+    header,
+    payload,
+    signature: signaturePart
+  };
+}
+
+// src/date.ts
+function dateToSeconds(date) {
+  const milliseconds = date?.getTime() ?? Date.now();
+  return Math.floor(milliseconds / 1e3);
+}
+function addSecondsToDate(date, seconds) {
+  return new Date(date.getTime() + seconds * 1e3);
+}
+
+// src/crypto/jwt/verify-jwt.ts
+async function verifyJwt(options) {
+  const errorMessage = options.errorMessage ?? "Error during verification of jwt.";
+  let signerJwk;
+  try {
+    const result = await options.verifyJwtCallback(options.signer, {
+      compact: options.compact,
+      header: options.header,
+      payload: options.payload
+    });
+    if (!result.verified) {
+      throw new JwtVerificationError(errorMessage);
+    }
+    signerJwk = result.signerJwk;
+  } catch (error) {
+    if (error instanceof JwtVerificationError) {
+      throw error;
+    }
+    throw new JwtVerificationError(errorMessage, { cause: error });
+  }
+  const nowInSeconds = dateToSeconds(options.now ?? /* @__PURE__ */ new Date());
+  const skewInSeconds = options.allowedSkewInSeconds ?? 0;
+  const timeBasedValidation = options.skipTimeBasedValidation !== void 0 ? !options.skipTimeBasedValidation : true;
+  if (timeBasedValidation && options.payload.nbf && nowInSeconds < options.payload.nbf - skewInSeconds) {
+    throw new JwtVerificationError(
+      `${errorMessage} jwt 'nbf' is in the future`
+    );
+  }
+  if (timeBasedValidation && options.payload.exp && nowInSeconds > options.payload.exp + skewInSeconds) {
+    throw new JwtVerificationError(`${errorMessage} jwt 'exp' is in the past`);
+  }
+  if (options.expectedAudience) {
+    const { aud } = options.payload;
+    if (Array.isArray(aud) && !aud.includes(options.expectedAudience) || typeof aud === "string" && aud !== options.expectedAudience) {
+      throw new JwtVerificationError(
+        `${errorMessage} jwt 'aud' does not match expected value.`
+      );
+    }
+  }
+  if (options.expectedIssuer && options.expectedIssuer !== options.payload.iss) {
+    throw new JwtVerificationError(
+      `${errorMessage} jwt 'iss' does not match expected value.`
+    );
+  }
+  if (options.expectedNonce && options.expectedNonce !== options.payload.nonce) {
+    throw new JwtVerificationError(
+      `${errorMessage} jwt 'nonce' does not match expected value.`
+    );
+  }
+  if (options.expectedSubject && options.expectedSubject !== options.payload.sub) {
+    throw new JwtVerificationError(
+      `${errorMessage} jwt 'sub' does not match expected value.`
+    );
+  }
+  if (options.requiredClaims) {
+    for (const claim of options.requiredClaims) {
+      if (!options.payload[claim]) {
+        throw new JwtVerificationError(
+          `${errorMessage} jwt '${claim}' is missing.`
+        );
+      }
+    }
+  }
+  return {
+    signer: {
+      ...options.signer,
+      publicJwk: signerJwk
+    }
+  };
+}
+
+// src/crypto/jwt/z-jwe.ts
+import { z as z4 } from "zod";
+var zCompactJwe = z4.string().regex(
+  /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
+  {
+    message: "Not a valid compact jwe"
+  }
+);
+
+// src/fetcher.ts
+var defaultFetcher = fetch;
+function createFetcher(fetcher = defaultFetcher) {
+  return (input, init) => fetcher(
+    input,
+    init ? {
+      ...init,
+      body: init.body instanceof URLSearchParams ? init.body.toString() : init.body
+    } : void 0
+  ).catch((error) => {
+    throw new Error(
+      `Unknown error occurred during fetch to '${String(input)}'
+Cause: ${error instanceof Error ? error.message : String(error)}`
+    );
+  });
+}
+var hasStatusOrThrow = (status, customError) => async (res) => {
+  if (Array.isArray(status) ? !status.includes(res.status) : res.status !== status) {
+    const ErrorClass = customError ?? UnexpectedStatusCodeError;
+    throw new ErrorClass({
+      message: `Http request failed. Expected ${status}, got ${res.status}, url: ${res.url}`,
+      reason: await parseRawHttpResponse(res),
+      // Pass the response body as reason so the original error can surface
+      statusCode: res.status
+    });
+  }
+  return res;
+};
+var parseRawHttpResponse = (response) => response.headers.get("content-type")?.includes("application/json") ? response.json() : response.text();
+
+// src/url.ts
+function objectToQueryParams(object) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(object)) {
+    if (value != null) {
+      params.append(
+        key,
+        typeof value === "object" ? JSON.stringify(value) : String(value)
+      );
+    }
+  }
+  return params;
+}
+
+// src/validation.ts
+import z5 from "zod";
+var zItwSupportedSignatureAlg = z5.enum([
   "ES256",
   "ES384",
   "ES512",
@@ -215,7 +808,7 @@ var zItwSupportedSignatureAlg = z.enum([
   "PS384",
   "PS512"
 ]);
-var zHttpMethod = z.enum([
+var zHttpMethod = z5.enum([
   "GET",
   "POST",
   "PUT",
@@ -265,28 +858,6 @@ function dispatchByVersion(version, handlers) {
   }
   return handler();
 }
-
-// src/index.ts
-import {
-  HashAlgorithm,
-  calculateJwkThumbprint,
-  decodeJwt
-} from "@openid4vc/oauth2";
-import {
-  ContentType,
-  JsonParseError,
-  addSecondsToDate,
-  createFetcher,
-  dateToSeconds,
-  decodeBase64,
-  decodeUtf8String,
-  encodeToBase64Url,
-  encodeToUtf8String,
-  objectToQueryParams,
-  parseIfJson,
-  setGlobalConfig,
-  stringToJsonWithErrorHandling
-} from "@openid4vc/utils";
 export {
   CLOCK_SKEW_TOLERANCE_SECONDS,
   CONTENT_TYPES,
@@ -297,7 +868,10 @@ export {
   ItWalletSpecsVersion,
   ItWalletSpecsVersionError,
   JsonParseError,
+  JwtParseError,
+  JwtVerificationError,
   MAX_IAT_AGE_SECONDS,
+  MAX_JTI_LENGTH,
   UnexpectedStatusCodeError,
   ValidationError,
   addSecondsToDate,
@@ -307,6 +881,7 @@ export {
   dateToSeconds,
   decodeBase64,
   decodeJwt,
+  decodeJwtHeader,
   decodeUtf8String,
   dispatchByVersion,
   encodeToBase64Url,
@@ -315,15 +890,27 @@ export {
   formatZodError,
   hasConfigVersion,
   hasStatusOrThrow,
+  jwtHeaderFromJwtSigner,
+  jwtSignerFromJwt,
   objectToQueryParams,
   parseIfJson,
   parseRawHttpResponse,
   parseWithErrorHandling,
   serializeAttrs,
-  setGlobalConfig,
   stringToJsonWithErrorHandling,
+  verifyJwt,
   verifyJwtIatOrThrow,
+  zAlgValueNotNone,
+  zCertificateChain,
+  zCompactJwe,
+  zCompactJwt,
   zHttpMethod,
-  zItwSupportedSignatureAlg
+  zItwSupportedSignatureAlg,
+  zJwk,
+  zJwkSet,
+  zJwtConfirmationPayload,
+  zJwtHeader,
+  zJwtPayload,
+  zTrustChain
 };
 //# sourceMappingURL=index.mjs.map