@pagopa/io-wallet-utils 1.5.8 → 2.0.0-launchpad

package/dist/index.d.mts

@@ -1,6 +1,4 @@
-import z$1, { ZodError, z } from 'zod';
-export { CallbackContext, HashAlgorithm, HashCallback, JwtSignerJwk, calculateJwkThumbprint, decodeJwt } from '@openid4vc/oauth2';
-export { ContentType, Fetch, JsonParseError, addSecondsToDate, createFetcher, dateToSeconds, decodeBase64, decodeUtf8String, encodeToBase64Url, encodeToUtf8String, objectToQueryParams, parseIfJson, setGlobalConfig, stringToJsonWithErrorHandling } from '@openid4vc/utils';
+import z, { z as z$1, ZodError } from 'zod';
 
 /**
  * Supported versions of the Italian Wallet technical specifications
@@ -93,6 +91,608 @@ declare const HEADERS: {
 declare const MAX_IAT_AGE_SECONDS: number;
 declare const CLOCK_SKEW_TOLERANCE_SECONDS = 60;
 
+declare enum ContentType {
+    Html = "text/html",
+    Json = "application/json",
+    JwkSet = "application/jwk-set+json",
+    Jwt = "application/jwt",
+    OAuthAuthorizationRequestJwt = "application/oauth-authz-req+jwt",
+    XWwwFormUrlencoded = "application/x-www-form-urlencoded"
+}
+
+/**
+ * For the moment, these are all the supported algorithms in both
+ * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/algorithms.html#cryptographic-algorithms|v1.3.3} and
+ * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.0.2/en/algorithms.html#cryptographic-algorithms|v1.0.2},
+ * and in both specifications the `alg` field MUST be one of those values.
+ */
+declare const zItwSupportedSignatureAlg: z.ZodEnum<{
+    ES256: "ES256";
+    ES384: "ES384";
+    ES512: "ES512";
+    PS256: "PS256";
+    PS384: "PS384";
+    PS512: "PS512";
+}>;
+type ItwSupportedSignatureAlg = z.infer<typeof zItwSupportedSignatureAlg>;
+declare const zHttpMethod: z.ZodEnum<{
+    GET: "GET";
+    POST: "POST";
+    PUT: "PUT";
+    DELETE: "DELETE";
+    HEAD: "HEAD";
+    OPTIONS: "OPTIONS";
+    TRACE: "TRACE";
+    CONNECT: "CONNECT";
+    PATCH: "PATCH";
+}>;
+type HttpMethod = z.infer<typeof zHttpMethod>;
+
+type Fetch = typeof fetch;
+type FetchHeaders = globalThis.Headers;
+interface RequestLike {
+    headers: FetchHeaders;
+    method: HttpMethod;
+    url: string;
+}
+
+type OrPromise$1<T> = Promise<T> | T;
+declare enum HashAlgorithm {
+    Sha256 = "sha-256",
+    Sha384 = "sha-384",
+    Sha512 = "sha-512"
+}
+type HashCallback = (data: Uint8Array, alg: HashAlgorithm) => OrPromise$1<Uint8Array>;
+
+declare const zJwk: z.ZodObject<{
+    alg: z.ZodOptional<z.ZodString>;
+    crv: z.ZodOptional<z.ZodString>;
+    d: z.ZodOptional<z.ZodString>;
+    dp: z.ZodOptional<z.ZodString>;
+    dq: z.ZodOptional<z.ZodString>;
+    e: z.ZodOptional<z.ZodString>;
+    ext: z.ZodOptional<z.ZodBoolean>;
+    k: z.ZodOptional<z.ZodString>;
+    key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    kid: z.ZodOptional<z.ZodString>;
+    kty: z.ZodString;
+    n: z.ZodOptional<z.ZodString>;
+    oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        d: z.ZodOptional<z.ZodString>;
+        r: z.ZodOptional<z.ZodString>;
+        t: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>>;
+    p: z.ZodOptional<z.ZodString>;
+    q: z.ZodOptional<z.ZodString>;
+    qi: z.ZodOptional<z.ZodString>;
+    use: z.ZodOptional<z.ZodString>;
+    x: z.ZodOptional<z.ZodString>;
+    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    x5t: z.ZodOptional<z.ZodString>;
+    "x5t#S256": z.ZodOptional<z.ZodString>;
+    x5u: z.ZodOptional<z.ZodString>;
+    y: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+type Jwk = z.infer<typeof zJwk>;
+declare const zJwkSet: z.ZodObject<{
+    keys: z.ZodArray<z.ZodObject<{
+        alg: z.ZodOptional<z.ZodString>;
+        crv: z.ZodOptional<z.ZodString>;
+        d: z.ZodOptional<z.ZodString>;
+        dp: z.ZodOptional<z.ZodString>;
+        dq: z.ZodOptional<z.ZodString>;
+        e: z.ZodOptional<z.ZodString>;
+        ext: z.ZodOptional<z.ZodBoolean>;
+        k: z.ZodOptional<z.ZodString>;
+        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        kid: z.ZodOptional<z.ZodString>;
+        kty: z.ZodString;
+        n: z.ZodOptional<z.ZodString>;
+        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            d: z.ZodOptional<z.ZodString>;
+            r: z.ZodOptional<z.ZodString>;
+            t: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>>>;
+        p: z.ZodOptional<z.ZodString>;
+        q: z.ZodOptional<z.ZodString>;
+        qi: z.ZodOptional<z.ZodString>;
+        use: z.ZodOptional<z.ZodString>;
+        x: z.ZodOptional<z.ZodString>;
+        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        x5t: z.ZodOptional<z.ZodString>;
+        "x5t#S256": z.ZodOptional<z.ZodString>;
+        x5u: z.ZodOptional<z.ZodString>;
+        y: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+type JwkSet = z.infer<typeof zJwkSet>;
+
+declare const zTrustChain: z.ZodTuple<[z.ZodString], z.ZodString>;
+type TrustChain = z.infer<typeof zTrustChain>;
+declare const zCertificateChain: z.ZodArray<z.ZodString>;
+type CertificateChain = z.infer<typeof zCertificateChain>;
+declare const zAlgValueNotNone: z.ZodString;
+
+declare const MAX_JTI_LENGTH = 256;
+interface JwtSignerDid {
+    alg: string;
+    didUrl: string;
+    /**
+     * The key id that should be used for signing. You need to make sure the kid actually matches
+     * with the key associated with the didUrl.
+     */
+    kid?: string;
+    method: "did";
+}
+interface JwtSignerJwk {
+    alg: string;
+    /**
+     * The key id that should be used for signing. You need to make sure the kid actually matches
+     * with the key associated with the jwk.
+     *
+     * If not provided the kid can also be extracted from the `publicJwk`. Providing it here means the `kid` won't
+     * be included in the JWT header.
+     */
+    kid?: string;
+    method: "jwk";
+    publicJwk: Jwk;
+}
+interface JwtSignerX5c {
+    alg: string;
+    /**
+     * The key id that should be used for signing. You need to make sure the kid actually matches
+     * with the key associated with the leaf certificate.
+     */
+    kid?: string;
+    method: "x5c";
+    trustChain?: TrustChain;
+    x5c: string[];
+}
+interface JwtSignerFederation {
+    alg: string;
+    /**
+     * The key id that should be used for signing. You need to make sure the kid actually matches
+     * with a key present in the federation.
+     */
+    kid: string;
+    method: "federation";
+    trustChain?: TrustChain;
+}
+interface JwtSignerCustom {
+    alg: string;
+    /**
+     * The key id that should be used for signing.
+     */
+    kid?: string;
+    method: "custom";
+}
+type JwtSigner = JwtSignerCustom | JwtSignerDid | JwtSignerFederation | JwtSignerJwk | JwtSignerX5c;
+type JwtSignerWithJwk = {
+    publicJwk: Jwk;
+} & JwtSigner;
+type JweEncryptor = {
+    /**
+     * base64-url encoded apu
+     */
+    apu?: string;
+    /**
+     * base64-url encoded apv
+     */
+    apv?: string;
+    enc: string;
+} & JwtSignerJwk;
+declare const zCompactJwt: z.ZodString;
+declare const zJwtConfirmationPayload: z.ZodObject<{
+    jkt: z.ZodOptional<z.ZodString>;
+    jwk: z.ZodOptional<z.ZodObject<{
+        alg: z.ZodOptional<z.ZodString>;
+        crv: z.ZodOptional<z.ZodString>;
+        d: z.ZodOptional<z.ZodString>;
+        dp: z.ZodOptional<z.ZodString>;
+        dq: z.ZodOptional<z.ZodString>;
+        e: z.ZodOptional<z.ZodString>;
+        ext: z.ZodOptional<z.ZodBoolean>;
+        k: z.ZodOptional<z.ZodString>;
+        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        kid: z.ZodOptional<z.ZodString>;
+        kty: z.ZodString;
+        n: z.ZodOptional<z.ZodString>;
+        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            d: z.ZodOptional<z.ZodString>;
+            r: z.ZodOptional<z.ZodString>;
+            t: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>>>;
+        p: z.ZodOptional<z.ZodString>;
+        q: z.ZodOptional<z.ZodString>;
+        qi: z.ZodOptional<z.ZodString>;
+        use: z.ZodOptional<z.ZodString>;
+        x: z.ZodOptional<z.ZodString>;
+        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        x5t: z.ZodOptional<z.ZodString>;
+        "x5t#S256": z.ZodOptional<z.ZodString>;
+        x5u: z.ZodOptional<z.ZodString>;
+        y: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+declare const zJwtPayload: z.ZodObject<{
+    aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString>]>>;
+    cnf: z.ZodOptional<z.ZodObject<{
+        jkt: z.ZodOptional<z.ZodString>;
+        jwk: z.ZodOptional<z.ZodObject<{
+            alg: z.ZodOptional<z.ZodString>;
+            crv: z.ZodOptional<z.ZodString>;
+            d: z.ZodOptional<z.ZodString>;
+            dp: z.ZodOptional<z.ZodString>;
+            dq: z.ZodOptional<z.ZodString>;
+            e: z.ZodOptional<z.ZodString>;
+            ext: z.ZodOptional<z.ZodBoolean>;
+            k: z.ZodOptional<z.ZodString>;
+            key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            kid: z.ZodOptional<z.ZodString>;
+            kty: z.ZodString;
+            n: z.ZodOptional<z.ZodString>;
+            oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                d: z.ZodOptional<z.ZodString>;
+                r: z.ZodOptional<z.ZodString>;
+                t: z.ZodOptional<z.ZodString>;
+            }, z.core.$loose>>>;
+            p: z.ZodOptional<z.ZodString>;
+            q: z.ZodOptional<z.ZodString>;
+            qi: z.ZodOptional<z.ZodString>;
+            use: z.ZodOptional<z.ZodString>;
+            x: z.ZodOptional<z.ZodString>;
+            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            x5t: z.ZodOptional<z.ZodString>;
+            "x5t#S256": z.ZodOptional<z.ZodString>;
+            x5u: z.ZodOptional<z.ZodString>;
+            y: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>>;
+    }, z.core.$loose>>;
+    exp: z.ZodOptional<z.ZodNumber>;
+    iat: z.ZodOptional<z.ZodNumber>;
+    iss: z.ZodOptional<z.ZodString>;
+    jti: z.ZodOptional<z.ZodString>;
+    nbf: z.ZodOptional<z.ZodNumber>;
+    nonce: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    sub: z.ZodOptional<z.ZodString>;
+    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
+}, z.core.$loose>;
+type JwtPayload = z.infer<typeof zJwtPayload>;
+declare const zJwtHeader: z.ZodObject<{
+    alg: z.ZodString;
+    jwk: z.ZodOptional<z.ZodObject<{
+        alg: z.ZodOptional<z.ZodString>;
+        crv: z.ZodOptional<z.ZodString>;
+        d: z.ZodOptional<z.ZodString>;
+        dp: z.ZodOptional<z.ZodString>;
+        dq: z.ZodOptional<z.ZodString>;
+        e: z.ZodOptional<z.ZodString>;
+        ext: z.ZodOptional<z.ZodBoolean>;
+        k: z.ZodOptional<z.ZodString>;
+        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        kid: z.ZodOptional<z.ZodString>;
+        kty: z.ZodString;
+        n: z.ZodOptional<z.ZodString>;
+        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            d: z.ZodOptional<z.ZodString>;
+            r: z.ZodOptional<z.ZodString>;
+            t: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>>>;
+        p: z.ZodOptional<z.ZodString>;
+        q: z.ZodOptional<z.ZodString>;
+        qi: z.ZodOptional<z.ZodString>;
+        use: z.ZodOptional<z.ZodString>;
+        x: z.ZodOptional<z.ZodString>;
+        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        x5t: z.ZodOptional<z.ZodString>;
+        "x5t#S256": z.ZodOptional<z.ZodString>;
+        x5u: z.ZodOptional<z.ZodString>;
+        y: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+    kid: z.ZodOptional<z.ZodString>;
+    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
+    typ: z.ZodOptional<z.ZodString>;
+    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>;
+type JwtHeader = z.infer<typeof zJwtHeader>;
+
+type OrPromise<T> = Promise<T> | T;
+type GenerateRandomCallback = (byteLength: number) => OrPromise<Uint8Array>;
+type SignJwtCallback = (jwtSigner: JwtSigner, jwt: {
+    header: JwtHeader;
+    payload: JwtPayload;
+}) => OrPromise<{
+    jwt: string;
+    signerJwk: Jwk;
+}>;
+type VerifyJwtCallback = (jwtSigner: JwtSigner, jwt: {
+    compact: string;
+    header: JwtHeader;
+    payload: JwtPayload;
+}) => OrPromise<{
+    signerJwk: Jwk;
+    verified: true;
+} | {
+    signerJwk?: Jwk;
+    verified: false;
+}>;
+type DecryptJweCallback = (jwe: string, options?: {
+    jwk?: Jwk;
+}) => OrPromise<{
+    decrypted: false;
+    decryptionJwk?: Jwk;
+    payload?: string;
+} | {
+    decrypted: true;
+    decryptionJwk: Jwk;
+    payload: string;
+}>;
+type EncryptJweCallback = (jweEncryptor: JweEncryptor, data: string) => OrPromise<{
+    encryptionJwk: Jwk;
+    jwe: string;
+}>;
+interface ClientAuthenticationCallbackOptionsBase<AuthorizationServerMetadata = unknown> {
+    authorizationServerMetadata: AuthorizationServerMetadata;
+    body: Record<string, unknown>;
+    contentType: ContentType;
+    headers: FetchHeaders;
+    method: HttpMethod;
+    url: string;
+}
+type ClientAuthenticationCallbackOptions<AuthorizationServerMetadata = unknown, ExtraOptions extends object = object> = ClientAuthenticationCallbackOptionsBase<AuthorizationServerMetadata> & ExtraOptions;
+type ClientAuthenticationCallback<Options extends ClientAuthenticationCallbackOptions = ClientAuthenticationCallbackOptions> = (options: Options) => OrPromise<void>;
+interface CallbackContext {
+    clientAuthentication: ClientAuthenticationCallback;
+    decryptJwe: DecryptJweCallback;
+    encryptJwe: EncryptJweCallback;
+    fetch?: Fetch;
+    generateRandom: GenerateRandomCallback;
+    getX509CertificateMetadata?: (certificate: string) => {
+        sanDnsNames: string[];
+        sanUriNames: string[];
+    };
+    hash: HashCallback;
+    signJwt: SignJwtCallback;
+    verifyJwt: VerifyJwtCallback;
+}
+interface RequestDpopOptions {
+    nonce?: string;
+    signer: JwtSignerJwk;
+}
+
+declare function calculateJwkThumbprint(options: {
+    hashAlgorithm: HashAlgorithm;
+    hashCallback: HashCallback;
+    jwk: Jwk;
+}): Promise<string>;
+
+type BaseSchema = z$1.ZodTypeAny;
+/**
+ * Parses a JSON string and throws the SDK `JsonParseError` on failure.
+ *
+ * @param value - JSON string to parse.
+ * @param errorMessage - Optional error message used when parsing fails.
+ * @returns Parsed JSON object.
+ * @throws {JsonParseError} If the value is not valid JSON.
+ */
+declare function stringToJsonWithErrorHandling(value: string, errorMessage?: string): Record<string, unknown>;
+declare function parseIfJson<T>(data: T): Record<string, unknown> | T;
+declare function parseWithErrorHandling<Schema extends BaseSchema>(schema: Schema, data: unknown, customErrorMessage?: string): z$1.infer<Schema>;
+/**
+ * Prefixes an error message with optional contextual text.
+ *
+ * @param message - Base error message.
+ * @param prefix - Optional prefix to prepend.
+ * @returns Formatted error message.
+ */
+declare function formatError(message: string, prefix?: string): string;
+
+interface DecodeJwtOptions<HeaderSchema extends BaseSchema | undefined, PayloadSchema extends BaseSchema | undefined> {
+    /**
+     * Optional prefix for error messages thrown during decoding, to provide more context on where the error occurred
+     */
+    errorMessagePrefix?: string;
+    /**
+     * Schema to use for validating the header. If not provided the
+     * default `zJwtHeader` schema will be used
+     */
+    headerSchema?: HeaderSchema;
+    /**
+     * The compact encoded jwt
+     */
+    jwt: string;
+    /**
+     * Schema to use for validating the payload. If not provided the
+     * default `zJwtPayload` schema will be used
+     */
+    payloadSchema?: PayloadSchema;
+}
+interface DecodeJwtResult<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined> {
+    compact: string;
+    header: InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;
+    payload: InferSchemaOrDefaultOutput<PayloadSchema, typeof zJwtPayload>;
+    signature: string;
+}
+/**
+ * Decodes a compact JWT and validates its header and payload with Zod schemas.
+ *
+ * This helper does not verify the JWT signature.
+ *
+ * @param options - Decode options.
+ * @param options.errorMessagePrefix - Optional context prefix for thrown parse/validation errors.
+ * @param options.headerSchema - Optional schema for the JWT header; defaults to `zJwtHeader`.
+ * @param options.jwt - Compact JWT to decode.
+ * @param options.payloadSchema - Optional schema for the JWT payload; defaults to `zJwtPayload`.
+ * @returns Decoded and schema-validated JWT header, payload, and signature segment.
+ * @throws {JwtParseError} If the JWT shape or base64url JSON segments are invalid.
+ * @throws {ValidationError} If header or payload schema validation fails.
+ */
+declare function decodeJwt<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined>(options: DecodeJwtOptions<HeaderSchema, PayloadSchema>): DecodeJwtResult<HeaderSchema, PayloadSchema>;
+type IsSchemaProvided<T> = T extends undefined ? false : true;
+type InferSchemaOrDefaultOutput<ProvidedSchema extends BaseSchema | undefined, DefaultSchema extends BaseSchema> = IsSchemaProvided<ProvidedSchema> extends true ? ProvidedSchema extends BaseSchema ? z.infer<ProvidedSchema> : never : z.infer<DefaultSchema>;
+
+interface DecodeJwtHeaderOptions<HeaderSchema extends BaseSchema | undefined> {
+    /**
+     * Optional prefix for error messages thrown during decoding, to provide more context on where the error occurred
+     */
+    errorMessagePrefix?: string;
+    /**
+     * Schema to use for validating the header. If not provided the
+     * default `zJwtHeader` schema will be used
+     */
+    headerSchema?: HeaderSchema;
+    /**
+     * The compact encoded jwt
+     */
+    jwt: string;
+}
+interface DecodeJwtHeaderResult<HeaderSchema extends BaseSchema | undefined = undefined> {
+    header: InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;
+}
+/**
+ * Decodes and validates the header of a compact JWT.
+ *
+ * This helper does not verify the JWT signature or parse the payload.
+ *
+ * @param options - Header decode options.
+ * @param options.errorMessagePrefix - Optional context prefix for thrown parse/validation errors.
+ * @param options.headerSchema - Optional schema for the JWT header; defaults to `zJwtHeader`.
+ * @param options.jwt - Compact JWT to decode.
+ * @returns Decoded and schema-validated JWT header.
+ * @throws {JwtParseError} If the JWT shape or header JSON is invalid.
+ * @throws {ValidationError} If header schema validation fails.
+ */
+declare function decodeJwtHeader<HeaderSchema extends BaseSchema | undefined = undefined>(options: DecodeJwtHeaderOptions<HeaderSchema>): DecodeJwtHeaderResult<HeaderSchema>;
+/**
+ * Builds a JWT header from an SDK signer descriptor.
+ *
+ * @param signer - Signer descriptor used by SDK signing callbacks.
+ * @returns Header fields required by the signer method.
+ */
+declare function jwtHeaderFromJwtSigner(signer: JwtSigner): {
+    alg: string;
+    kid: string;
+    trust_chain?: undefined;
+    jwk?: undefined;
+    x5c?: undefined;
+} | {
+    alg: string;
+    kid: string;
+    trust_chain: [string, ...string[]] | undefined;
+    jwk?: undefined;
+    x5c?: undefined;
+} | {
+    alg: string;
+    jwk: {
+        [x: string]: unknown;
+        kty: string;
+        alg?: string | undefined;
+        crv?: string | undefined;
+        d?: string | undefined;
+        dp?: string | undefined;
+        dq?: string | undefined;
+        e?: string | undefined;
+        ext?: boolean | undefined;
+        k?: string | undefined;
+        key_ops?: string[] | undefined;
+        kid?: string | undefined;
+        n?: string | undefined;
+        oth?: {
+            [x: string]: unknown;
+            d?: string | undefined;
+            r?: string | undefined;
+            t?: string | undefined;
+        }[] | undefined;
+        p?: string | undefined;
+        q?: string | undefined;
+        qi?: string | undefined;
+        use?: string | undefined;
+        x?: string | undefined;
+        x5c?: string[] | undefined;
+        x5t?: string | undefined;
+        "x5t#S256"?: string | undefined;
+        x5u?: string | undefined;
+        y?: string | undefined;
+    };
+    kid?: undefined;
+    trust_chain?: undefined;
+    x5c?: undefined;
+} | {
+    alg: string;
+    kid: string | undefined;
+    trust_chain: [string, ...string[]] | undefined;
+    x5c: string[];
+    jwk?: undefined;
+} | {
+    alg: string;
+    kid?: undefined;
+    trust_chain?: undefined;
+    jwk?: undefined;
+    x5c?: undefined;
+};
+/**
+ * Derives the SDK signer descriptor from a decoded JWT header and payload.
+ *
+ * @param options.allowedSignerMethods - Signer methods accepted by the caller; all are allowed when omitted.
+ * @param options.header - Decoded JWT header.
+ * @param options.payload - Decoded JWT payload.
+ * @returns The first valid, allowed signer found in the JWT.
+ * @throws {JwtParseError} If no allowed signer can be extracted from the JWT.
+ */
+declare function jwtSignerFromJwt(options: {
+    allowedSignerMethods?: JwtSigner["method"][];
+    header: Pick<JwtHeader, "alg" | "jwk" | "kid" | "trust_chain" | "x5c">;
+    payload: Pick<JwtPayload, "iss">;
+}): JwtSigner;
+
+interface VerifyJwtOptions {
+    allowedSkewInSeconds?: number;
+    compact: string;
+    errorMessage?: string;
+    expectedAudience?: string;
+    expectedIssuer?: string;
+    expectedNonce?: string;
+    expectedSubject?: string;
+    header: JwtHeader;
+    now?: Date;
+    payload: JwtPayload;
+    requiredClaims?: (keyof JwtPayload)[];
+    signer: JwtSigner;
+    skipTimeBasedValidation?: boolean;
+    verifyJwtCallback: VerifyJwtCallback;
+}
+interface VerifyJwtReturn {
+    signer: JwtSignerWithJwk;
+}
+declare function verifyJwt(options: VerifyJwtOptions): Promise<VerifyJwtReturn>;
+
+declare const zCompactJwe: z$1.ZodString;
+
+/**
+ * Get the time in seconds since epoch for a date.
+ * If date is not provided the current time will be used.
+ */
+declare function dateToSeconds(date?: Date): number;
+declare function addSecondsToDate(date: Date, seconds: number): Date;
+
+declare function decodeUtf8String(value: string): Uint8Array;
+declare function encodeToUtf8String(data: Uint8Array): string;
+/**
+ * Also supports base64 url encoded input.
+ */
+declare function decodeBase64(base64: string): Uint8Array;
+declare function encodeToBase64Url(data: Uint8Array | string): string;
+
+declare class JsonParseError extends Error {
+    constructor(message: string, jsonString: string);
+}
+declare class JwtParseError extends Error {
+    constructor(message?: string);
+}
+declare class JwtVerificationError extends Error {
+    constructor(message?: string, options?: ErrorOptions);
+}
 type GenericErrorReason = Record<string, unknown> | string;
 /**
  * utility to format a set of attributes into an error message string
@@ -146,7 +746,7 @@ declare class ItWalletSpecsVersionError extends Error {
  */
 declare class ValidationError extends Error {
     zodError: ZodError | undefined;
-    constructor(message: string, zodError?: z.ZodError);
+    constructor(message: string, zodError?: z$1.ZodError);
 }
 
 /**
@@ -155,8 +755,9 @@ declare class ValidationError extends Error {
  * @param error - Optional Zod error to format.
  * @returns Empty string when no error is provided, otherwise a formatted issue list.
  */
-declare function formatZodError(error?: z$1.ZodError): string;
+declare function formatZodError(error?: z.ZodError): string;
 
+declare function createFetcher(fetcher?: Fetch): Fetch;
 /**
  * Check if a response is in the expected status, otherwise throw an error
  * @param status - The expected status
@@ -171,62 +772,9 @@ declare const hasStatusOrThrow: (status: number | number[], customError?: typeof
  * @param response - Raw HTTP response to parse.
  * @returns Parsed JSON for JSON responses, otherwise response text.
  */
-declare const parseRawHttpResponse: <T extends Record<string, unknown>>(response: Response) => Promise<T> | Promise<string>;
+declare const parseRawHttpResponse: <T extends Record<string, unknown>>(response: Response) => Promise<string> | Promise<T>;
 
-/**
- * For the moment, these are all the supported algorithms in both
- * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/algorithms.html#cryptographic-algorithms|v1.3.3} and
- * {@link https://italia.github.io/eid-wallet-it-docs/releases/1.0.2/en/algorithms.html#cryptographic-algorithms|v1.0.2},
- * and in both specifications the `alg` field MUST be one of those values.
- */
-declare const zItwSupportedSignatureAlg: z$1.ZodEnum<{
-    ES256: "ES256";
-    ES384: "ES384";
-    ES512: "ES512";
-    PS256: "PS256";
-    PS384: "PS384";
-    PS512: "PS512";
-}>;
-type ItwSupportedSignatureAlg = z$1.infer<typeof zItwSupportedSignatureAlg>;
-declare const zHttpMethod: z$1.ZodEnum<{
-    GET: "GET";
-    POST: "POST";
-    PUT: "PUT";
-    DELETE: "DELETE";
-    HEAD: "HEAD";
-    OPTIONS: "OPTIONS";
-    TRACE: "TRACE";
-    CONNECT: "CONNECT";
-    PATCH: "PATCH";
-}>;
-type HttpMethod = z$1.infer<typeof zHttpMethod>;
-
-type FetchHeaders = globalThis.Headers;
-interface RequestLike {
-    headers: FetchHeaders;
-    method: HttpMethod;
-    url: string;
-}
-
-type BaseSchema = z.ZodTypeAny;
-/**
- * Parses data with a Zod schema and throws the SDK `ValidationError` on failure.
- *
- * @param schema - Zod schema used for validation.
- * @param data - Unknown value to parse.
- * @param customErrorMessage - Optional error message used when validation fails.
- * @returns Parsed schema output.
- * @throws {ValidationError} If the value does not satisfy the provided schema.
- */
-declare function parseWithErrorHandling<Schema extends BaseSchema>(schema: Schema, data: unknown, customErrorMessage?: string): z.infer<Schema>;
-/**
- * Prefixes an error message with optional contextual text.
- *
- * @param message - Base error message.
- * @param prefix - Optional prefix to prepend.
- * @returns Formatted error message.
- */
-declare function formatError(message: string, prefix?: string): string;
+declare function objectToQueryParams(object: Record<string, unknown>): URLSearchParams;
 
 /**
  * Validates a JWT `iat` claim against SDK age and clock-skew limits.
@@ -271,4 +819,4 @@ declare function createVersionDispatcher<TOptions extends VersionedOptions, TRes
  */
 declare function dispatchByVersion<TResult>(version: ItWalletSpecsVersion, handlers: Required<Record<ItWalletSpecsVersion, () => TResult>>): TResult;
 
-export { type BaseSchema, CLOCK_SKEW_TOLERANCE_SECONDS, CONTENT_TYPES, type FetchHeaders, HEADERS, type HttpMethod, IoWalletSdkConfig, type IoWalletSdkConfigOptions, ItWalletSpecsVersion, ItWalletSpecsVersionError, type ItwSupportedSignatureAlg, MAX_IAT_AGE_SECONDS, type RequestLike, UnexpectedStatusCodeError, ValidationError, type VersionedOptions, createVersionDispatcher, dispatchByVersion, formatError, formatZodError, hasConfigVersion, hasStatusOrThrow, parseRawHttpResponse, parseWithErrorHandling, serializeAttrs, verifyJwtIatOrThrow, zHttpMethod, zItwSupportedSignatureAlg };
+export { type BaseSchema, CLOCK_SKEW_TOLERANCE_SECONDS, CONTENT_TYPES, type CallbackContext, type CertificateChain, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationCallbackOptionsBase, ContentType, type DecodeJwtHeaderOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DecryptJweCallback, type EncryptJweCallback, type Fetch, type FetchHeaders, type GenerateRandomCallback, HEADERS, HashAlgorithm, type HashCallback, type HttpMethod, type InferSchemaOrDefaultOutput, IoWalletSdkConfig, type IoWalletSdkConfigOptions, ItWalletSpecsVersion, ItWalletSpecsVersionError, type ItwSupportedSignatureAlg, JsonParseError, type JweEncryptor, type Jwk, type JwkSet, type JwtHeader, JwtParseError, type JwtPayload, type JwtSigner, type JwtSignerCustom, type JwtSignerDid, type JwtSignerFederation, type JwtSignerJwk, type JwtSignerWithJwk, type JwtSignerX5c, JwtVerificationError, MAX_IAT_AGE_SECONDS, MAX_JTI_LENGTH, type RequestDpopOptions, type RequestLike, type SignJwtCallback, type TrustChain, UnexpectedStatusCodeError, ValidationError, type VerifyJwtCallback, type VerifyJwtOptions, type VerifyJwtReturn, type VersionedOptions, addSecondsToDate, calculateJwkThumbprint, createFetcher, createVersionDispatcher, dateToSeconds, decodeBase64, decodeJwt, decodeJwtHeader, decodeUtf8String, dispatchByVersion, encodeToBase64Url, encodeToUtf8String, formatError, formatZodError, hasConfigVersion, hasStatusOrThrow, jwtHeaderFromJwtSigner, jwtSignerFromJwt, objectToQueryParams, parseIfJson, parseRawHttpResponse, parseWithErrorHandling, serializeAttrs, stringToJsonWithErrorHandling, verifyJwt, verifyJwtIatOrThrow, zAlgValueNotNone, zCertificateChain, zCompactJwe, zCompactJwt, zHttpMethod, zItwSupportedSignatureAlg, zJwk, zJwkSet, zJwtConfirmationPayload, zJwtHeader, zJwtPayload, zTrustChain };