@pagopa/io-wallet-utils 1.5.8 → 2.0.0-launchpad

package/dist/index.js

@@ -32,41 +32,57 @@ var index_exports = {};
 __export(index_exports, {
   CLOCK_SKEW_TOLERANCE_SECONDS: () => CLOCK_SKEW_TOLERANCE_SECONDS,
   CONTENT_TYPES: () => CONTENT_TYPES,
-  ContentType: () => import_utils.ContentType,
+  ContentType: () => ContentType,
   HEADERS: () => HEADERS,
-  HashAlgorithm: () => import_oauth2.HashAlgorithm,
+  HashAlgorithm: () => HashAlgorithm,
   IoWalletSdkConfig: () => IoWalletSdkConfig,
   ItWalletSpecsVersion: () => ItWalletSpecsVersion,
   ItWalletSpecsVersionError: () => ItWalletSpecsVersionError,
-  JsonParseError: () => import_utils.JsonParseError,
+  JsonParseError: () => JsonParseError,
+  JwtParseError: () => JwtParseError,
+  JwtVerificationError: () => JwtVerificationError,
   MAX_IAT_AGE_SECONDS: () => MAX_IAT_AGE_SECONDS,
+  MAX_JTI_LENGTH: () => MAX_JTI_LENGTH,
   UnexpectedStatusCodeError: () => UnexpectedStatusCodeError,
   ValidationError: () => ValidationError,
-  addSecondsToDate: () => import_utils.addSecondsToDate,
-  calculateJwkThumbprint: () => import_oauth2.calculateJwkThumbprint,
-  createFetcher: () => import_utils.createFetcher,
+  addSecondsToDate: () => addSecondsToDate,
+  calculateJwkThumbprint: () => calculateJwkThumbprint,
+  createFetcher: () => createFetcher,
   createVersionDispatcher: () => createVersionDispatcher,
-  dateToSeconds: () => import_utils.dateToSeconds,
-  decodeBase64: () => import_utils.decodeBase64,
-  decodeJwt: () => import_oauth2.decodeJwt,
-  decodeUtf8String: () => import_utils.decodeUtf8String,
+  dateToSeconds: () => dateToSeconds,
+  decodeBase64: () => decodeBase64,
+  decodeJwt: () => decodeJwt,
+  decodeJwtHeader: () => decodeJwtHeader,
+  decodeUtf8String: () => decodeUtf8String,
   dispatchByVersion: () => dispatchByVersion,
-  encodeToBase64Url: () => import_utils.encodeToBase64Url,
-  encodeToUtf8String: () => import_utils.encodeToUtf8String,
+  encodeToBase64Url: () => encodeToBase64Url,
+  encodeToUtf8String: () => encodeToUtf8String,
   formatError: () => formatError,
   formatZodError: () => formatZodError,
   hasConfigVersion: () => hasConfigVersion,
   hasStatusOrThrow: () => hasStatusOrThrow,
-  objectToQueryParams: () => import_utils.objectToQueryParams,
-  parseIfJson: () => import_utils.parseIfJson,
+  jwtHeaderFromJwtSigner: () => jwtHeaderFromJwtSigner,
+  jwtSignerFromJwt: () => jwtSignerFromJwt,
+  objectToQueryParams: () => objectToQueryParams,
+  parseIfJson: () => parseIfJson,
   parseRawHttpResponse: () => parseRawHttpResponse,
   parseWithErrorHandling: () => parseWithErrorHandling,
   serializeAttrs: () => serializeAttrs,
-  setGlobalConfig: () => import_utils.setGlobalConfig,
-  stringToJsonWithErrorHandling: () => import_utils.stringToJsonWithErrorHandling,
+  stringToJsonWithErrorHandling: () => stringToJsonWithErrorHandling,
+  verifyJwt: () => verifyJwt,
   verifyJwtIatOrThrow: () => verifyJwtIatOrThrow,
+  zAlgValueNotNone: () => zAlgValueNotNone,
+  zCertificateChain: () => zCertificateChain,
+  zCompactJwe: () => zCompactJwe,
+  zCompactJwt: () => zCompactJwt,
   zHttpMethod: () => zHttpMethod,
-  zItwSupportedSignatureAlg: () => zItwSupportedSignatureAlg
+  zItwSupportedSignatureAlg: () => zItwSupportedSignatureAlg,
+  zJwk: () => zJwk,
+  zJwkSet: () => zJwkSet,
+  zJwtConfirmationPayload: () => zJwtConfirmationPayload,
+  zJwtHeader: () => zJwtHeader,
+  zJwtPayload: () => zJwtPayload,
+  zTrustChain: () => zTrustChain
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -120,6 +136,59 @@ var HEADERS = {
 var MAX_IAT_AGE_SECONDS = 5 * 60;
 var CLOCK_SKEW_TOLERANCE_SECONDS = 60;
 
+// src/content-type.ts
+var ContentType = /* @__PURE__ */ ((ContentType2) => {
+  ContentType2["Html"] = "text/html";
+  ContentType2["Json"] = "application/json";
+  ContentType2["JwkSet"] = "application/jwk-set+json";
+  ContentType2["Jwt"] = "application/jwt";
+  ContentType2["OAuthAuthorizationRequestJwt"] = "application/oauth-authz-req+jwt";
+  ContentType2["XWwwFormUrlencoded"] = "application/x-www-form-urlencoded";
+  return ContentType2;
+})(ContentType || {});
+
+// src/crypto/hash.ts
+var HashAlgorithm = /* @__PURE__ */ ((HashAlgorithm2) => {
+  HashAlgorithm2["Sha256"] = "sha-256";
+  HashAlgorithm2["Sha384"] = "sha-384";
+  HashAlgorithm2["Sha512"] = "sha-512";
+  return HashAlgorithm2;
+})(HashAlgorithm || {});
+
+// src/encoding.ts
+var utf8Encoder = new TextEncoder();
+var utf8Decoder = new TextDecoder();
+function base64UrlToBase64(base64) {
+  const normalized = base64.replace(/-/g, "+").replace(/_/g, "/");
+  const paddingLength = normalized.length % 4;
+  return paddingLength === 0 ? normalized : normalized.padEnd(normalized.length + (4 - paddingLength), "=");
+}
+function base64ToBase64Url(base64) {
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function encodeBase64(data) {
+  let binary = "";
+  for (const byte of data) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+}
+function decodeUtf8String(value) {
+  return utf8Encoder.encode(value);
+}
+function encodeToUtf8String(data) {
+  return utf8Decoder.decode(data);
+}
+function decodeBase64(base64) {
+  const binary = atob(base64UrlToBase64(base64));
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+function encodeToBase64Url(data) {
+  return base64ToBase64Url(
+    encodeBase64(typeof data === "string" ? decodeUtf8String(data) : data)
+  );
+}
+
 // src/errors/parse.ts
 var constants = {
   identifierRegex: /[$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*/u,
@@ -178,6 +247,27 @@ function formatZodError(error) {
 }
 
 // src/errors/errors.ts
+var JsonParseError = class extends Error {
+  constructor(message, jsonString) {
+    super(`${message}
+${jsonString}`);
+    this.name = "JsonParseError";
+  }
+};
+var JwtParseError = class extends Error {
+  constructor(message) {
+    super(message ?? "Error parsing jwt");
+    this.name = "JwtParseError";
+  }
+};
+var JwtVerificationError = class extends Error {
+  constructor(message, options) {
+    const errorMessage = message ?? "Error verifying jwt.";
+    const causeMessage = options?.cause instanceof Error ? ` ${options.cause.message}` : options?.cause ? ` ${String(options.cause)}` : "";
+    super(`${errorMessage}${causeMessage}`, options);
+    this.name = "JwtVerificationError";
+  }
+};
 var serializeAttrs = (attrs) => Object.entries(attrs).filter(([, v]) => v !== void 0).map(([k, v]) => {
   if (Array.isArray(v)) return [k, `(${v.join(", ")})`];
   if (typeof v !== "string") return [k, JSON.stringify(v)];
@@ -232,21 +322,6 @@ ${formattedError}`;
   }
 };
 
-// src/fetcher.ts
-var hasStatusOrThrow = (status, customError) => async (res) => {
-  if (Array.isArray(status) ? !status.includes(res.status) : res.status !== status) {
-    const ErrorClass = customError ?? UnexpectedStatusCodeError;
-    throw new ErrorClass({
-      message: `Http request failed. Expected ${status}, got ${res.status}, url: ${res.url}`,
-      reason: await parseRawHttpResponse(res),
-      // Pass the response body as reason so the original error can surface
-      statusCode: res.status
-    });
-  }
-  return res;
-};
-var parseRawHttpResponse = (response) => response.headers.get("content-type")?.includes("application/json") ? response.json() : response.text();
-
 // src/parse.ts
 var SAFE_STRINGIFY_MAX_LENGTH = 200;
 function safeStringify(value) {
@@ -263,6 +338,26 @@ function safeStringify(value) {
     return "[unserializable]";
   }
 }
+function stringToJsonWithErrorHandling(value, errorMessage) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    throw new JsonParseError(
+      errorMessage ?? "Unable to parse string to JSON.",
+      value
+    );
+  }
+}
+function parseIfJson(data) {
+  if (typeof data !== "string") {
+    return data;
+  }
+  try {
+    return JSON.parse(data);
+  } catch {
+    return data;
+  }
+}
 function parseWithErrorHandling(schema, data, customErrorMessage) {
   const parseResult = schema.safeParse(data);
   if (!parseResult.success) {
@@ -277,9 +372,522 @@ function formatError(message, prefix) {
   return prefix ? `${prefix} ${message}` : message;
 }
 
-// src/validation.ts
+// src/crypto/jwk/z-jwk.ts
+var import_zod2 = __toESM(require("zod"));
+
+// src/crypto/z-common.ts
 var import_zod = __toESM(require("zod"));
-var zItwSupportedSignatureAlg = import_zod.default.enum([
+var zTrustChain = import_zod.default.tuple([import_zod.default.string()], import_zod.default.string());
+var zCertificateChain = import_zod.default.array(import_zod.default.string()).nonempty();
+var zAlgValueNotNone = import_zod.default.string().refine((alg) => alg !== "none", { message: `alg value may not be 'none'` });
+
+// src/crypto/jwk/z-jwk.ts
+var zJwk = import_zod2.default.looseObject({
+  alg: import_zod2.default.optional(import_zod2.default.string()),
+  crv: import_zod2.default.optional(import_zod2.default.string()),
+  d: import_zod2.default.optional(import_zod2.default.string()),
+  dp: import_zod2.default.optional(import_zod2.default.string()),
+  dq: import_zod2.default.optional(import_zod2.default.string()),
+  e: import_zod2.default.optional(import_zod2.default.string()),
+  ext: import_zod2.default.optional(import_zod2.default.boolean()),
+  k: import_zod2.default.optional(import_zod2.default.string()),
+  key_ops: import_zod2.default.optional(import_zod2.default.array(import_zod2.default.string())),
+  kid: import_zod2.default.optional(import_zod2.default.string()),
+  kty: import_zod2.default.string(),
+  n: import_zod2.default.optional(import_zod2.default.string()),
+  oth: import_zod2.default.optional(
+    import_zod2.default.array(
+      import_zod2.default.looseObject({
+        d: import_zod2.default.optional(import_zod2.default.string()),
+        r: import_zod2.default.optional(import_zod2.default.string()),
+        t: import_zod2.default.optional(import_zod2.default.string())
+      })
+    )
+  ),
+  p: import_zod2.default.optional(import_zod2.default.string()),
+  q: import_zod2.default.optional(import_zod2.default.string()),
+  qi: import_zod2.default.optional(import_zod2.default.string()),
+  use: import_zod2.default.optional(import_zod2.default.string()),
+  x: import_zod2.default.optional(import_zod2.default.string()),
+  x5c: import_zod2.default.optional(zCertificateChain),
+  x5t: import_zod2.default.optional(import_zod2.default.string()),
+  "x5t#S256": import_zod2.default.optional(import_zod2.default.string()),
+  x5u: import_zod2.default.optional(import_zod2.default.string()),
+  y: import_zod2.default.optional(import_zod2.default.string())
+});
+var zJwkSet = import_zod2.default.looseObject({ keys: import_zod2.default.array(zJwk) });
+
+// src/crypto/jwk/calculate-jwk-thumbprint.ts
+function createJwkThumbprintComponents(jwk) {
+  if (jwk.kty === "EC") {
+    if (!jwk.crv || !jwk.x || !jwk.y) {
+      throw new ValidationError(
+        "Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing."
+      );
+    }
+    return {
+      crv: jwk.crv,
+      kty: jwk.kty,
+      x: jwk.x,
+      y: jwk.y
+    };
+  }
+  if (jwk.kty === "RSA") {
+    if (!jwk.e || !jwk.n) {
+      throw new ValidationError(
+        "Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing."
+      );
+    }
+    return {
+      e: jwk.e,
+      kty: jwk.kty,
+      n: jwk.n
+    };
+  }
+  if (jwk.kty === "oct") {
+    if (!jwk.k) {
+      throw new ValidationError(
+        "Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing."
+      );
+    }
+    return {
+      k: jwk.k,
+      kty: jwk.kty
+    };
+  }
+  throw new ValidationError(
+    "Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing."
+  );
+}
+async function calculateJwkThumbprint(options) {
+  const parsedJwk = parseWithErrorHandling(
+    zJwk,
+    options.jwk,
+    "Provided jwk does not match a supported jwk structure. Either the 'kty' is not supported, or required values are missing."
+  );
+  const jwkThumbprintComponents = createJwkThumbprintComponents(parsedJwk);
+  return encodeToBase64Url(
+    await options.hashCallback(
+      decodeUtf8String(JSON.stringify(jwkThumbprintComponents)),
+      options.hashAlgorithm
+    )
+  );
+}
+
+// src/crypto/jwt/z-jwt.ts
+var import_zod3 = __toESM(require("zod"));
+var MAX_JTI_LENGTH = 256;
+var zCompactJwt = import_zod3.default.string().regex(/^([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)\.([a-zA-Z0-9-_]+)$/, {
+  message: "Not a valid compact jwt"
+});
+var zJwtConfirmationPayload = import_zod3.default.looseObject({
+  // RFC9449. jwk thumbprint of the dpop public key to which the access token is bound
+  jkt: import_zod3.default.string().optional(),
+  jwk: zJwk.optional()
+});
+var zJwtPayload = import_zod3.default.looseObject({
+  aud: import_zod3.default.string().or(import_zod3.default.array(import_zod3.default.string())).optional(),
+  cnf: zJwtConfirmationPayload.optional(),
+  exp: import_zod3.default.number().int().optional(),
+  iat: import_zod3.default.number().int().optional(),
+  iss: import_zod3.default.string().optional(),
+  jti: import_zod3.default.string().max(MAX_JTI_LENGTH).optional(),
+  nbf: import_zod3.default.number().int().optional(),
+  nonce: import_zod3.default.string().optional(),
+  // Reserved for status parameters
+  status: import_zod3.default.record(import_zod3.default.string(), import_zod3.default.any()).optional(),
+  sub: import_zod3.default.string().optional(),
+  // Reserved for OpenID Federation
+  trust_chain: zTrustChain.optional()
+});
+var zJwtHeader = import_zod3.default.looseObject({
+  alg: zAlgValueNotNone,
+  jwk: zJwk.optional(),
+  kid: import_zod3.default.string().optional(),
+  // Reserved for OpenID Federation
+  trust_chain: zTrustChain.optional(),
+  typ: import_zod3.default.string().optional(),
+  x5c: zCertificateChain.optional()
+});
+
+// src/crypto/jwt/decode-jwt-header.ts
+function decodeJwtHeader(options) {
+  const jwtParts = options.jwt.split(".");
+  if (jwtParts.length <= 2) {
+    throw new JwtParseError(
+      formatError(
+        "Unable to decode because Jwt is not a valid!",
+        options.errorMessagePrefix
+      )
+    );
+  }
+  const [headerPart] = jwtParts;
+  let headerJson;
+  try {
+    headerJson = stringToJsonWithErrorHandling(
+      encodeToUtf8String(decodeBase64(headerPart)),
+      formatError(
+        "Unable to parse jwt header to JSON",
+        options.errorMessagePrefix
+      )
+    );
+  } catch (error) {
+    throw new JwtParseError(
+      formatError(
+        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
+        options.errorMessagePrefix
+      )
+    );
+  }
+  const header = parseWithErrorHandling(
+    options.headerSchema ?? zJwtHeader,
+    headerJson,
+    formatError("Invalid JWT header", options.errorMessagePrefix)
+  );
+  return {
+    header
+  };
+}
+function jwtHeaderFromJwtSigner(signer) {
+  if (signer.method === "did") {
+    return {
+      alg: signer.alg,
+      kid: signer.didUrl
+    };
+  }
+  if (signer.method === "federation") {
+    return {
+      alg: signer.alg,
+      kid: signer.kid,
+      trust_chain: signer.trustChain
+    };
+  }
+  if (signer.method === "jwk") {
+    return {
+      alg: signer.alg,
+      jwk: signer.publicJwk
+    };
+  }
+  if (signer.method === "x5c") {
+    return {
+      alg: signer.alg,
+      kid: signer.kid,
+      trust_chain: signer.trustChain,
+      x5c: signer.x5c
+    };
+  }
+  return { alg: signer.alg };
+}
+function jwtSignerFromJwt(options) {
+  const { allowedSignerMethods, header, payload } = options;
+  const found = [];
+  if (header.x5c) {
+    found.push({
+      method: "x5c",
+      signer: {
+        alg: header.alg,
+        kid: header.kid,
+        method: "x5c",
+        trustChain: header.trust_chain,
+        x5c: header.x5c
+      },
+      valid: true
+    });
+  }
+  if (header.trust_chain) {
+    if (!header.kid) {
+      found.push({
+        error: "When 'trust_chain' is used in jwt header, the 'kid' parameter is required.",
+        method: "federation",
+        valid: false
+      });
+    } else {
+      found.push({
+        method: "federation",
+        signer: {
+          alg: header.alg,
+          kid: header.kid,
+          method: "federation",
+          trustChain: header.trust_chain
+        },
+        valid: true
+      });
+    }
+  }
+  if (header.kid?.startsWith("did:") || payload.iss?.startsWith("did:")) {
+    if (payload.iss && header.kid?.startsWith("did:") && !header.kid.startsWith(payload.iss)) {
+      found.push({
+        error: "kid in header starts with did that is different from did value in 'iss'",
+        method: "did",
+        valid: false
+      });
+    } else if (!header.kid?.startsWith("did:") && !header.kid?.startsWith("#")) {
+      found.push({
+        error: "kid in header must start with either 'did:' or '#' when 'iss' value is a did",
+        method: "did",
+        valid: false
+      });
+    } else if (header.kid) {
+      found.push({
+        method: "did",
+        signer: {
+          alg: header.alg,
+          didUrl: header.kid.startsWith("did:") ? header.kid : `${payload.iss}${header.kid}`,
+          method: "did"
+        },
+        valid: true
+      });
+    }
+  }
+  if (header.jwk) {
+    found.push({
+      method: "jwk",
+      signer: {
+        alg: header.alg,
+        method: "jwk",
+        publicJwk: header.jwk
+      },
+      valid: true
+    });
+  }
+  const allowedFoundMethods = found.filter(
+    (candidate) => !allowedSignerMethods || allowedSignerMethods.includes(candidate.method)
+  );
+  const allowedValidMethods = allowedFoundMethods.filter(
+    (candidate) => candidate.valid
+  );
+  const firstAllowedValidMethod = allowedValidMethods[0];
+  if (firstAllowedValidMethod && firstAllowedValidMethod.valid) {
+    return firstAllowedValidMethod.signer;
+  }
+  if (allowedFoundMethods.length > 0) {
+    throw new JwtParseError(
+      `Unable to extract signer method from jwt. Found ${allowedFoundMethods.length} allowed signer method(s) but contained invalid configuration:
+${allowedFoundMethods.map(
+        (candidate) => candidate.valid ? "" : `FAILED: method ${candidate.method} - ${candidate.error}`
+      ).join("\n")}`
+    );
+  }
+  if (found.length > 0) {
+    throw new JwtParseError(
+      `Unable to extract signer method from jwt. Found ${found.length} signer method(s) that are not allowed:
+${found.map(
+        (candidate) => candidate.valid ? `SUCCEEDED: method ${candidate.method}` : `FAILED: method ${candidate.method} - ${candidate.error}`
+      ).join("\n")}`
+    );
+  }
+  if (!allowedSignerMethods || allowedSignerMethods.includes("custom")) {
+    return {
+      alg: header.alg,
+      kid: header.kid,
+      method: "custom"
+    };
+  }
+  throw new JwtParseError(
+    "Unable to extract signer method from jwt. Found no signer methods and 'custom' signer method is not allowed."
+  );
+}
+
+// src/crypto/jwt/decode-jwt.ts
+function decodeJwt(options) {
+  const jwtParts = options.jwt.split(".");
+  if (jwtParts.length !== 3) {
+    throw new JwtParseError(
+      formatError(
+        "Unable to decode because Jwt is not a valid!",
+        options.errorMessagePrefix
+      )
+    );
+  }
+  let payloadJson;
+  try {
+    const payloadPart = jwtParts[1];
+    if (payloadPart === void 0) {
+      throw new JwtParseError(
+        formatError(
+          "Unable to decode because Jwt is not a valid!",
+          options.errorMessagePrefix
+        )
+      );
+    }
+    payloadJson = stringToJsonWithErrorHandling(
+      encodeToUtf8String(decodeBase64(payloadPart)),
+      formatError(
+        "Unable to parse jwt payload to JSON",
+        options.errorMessagePrefix
+      )
+    );
+  } catch (error) {
+    throw new JwtParseError(
+      formatError(
+        `Error parsing JWT. ${error instanceof Error ? error.message : ""}`,
+        options.errorMessagePrefix
+      )
+    );
+  }
+  const signaturePart = jwtParts[2];
+  if (signaturePart === void 0) {
+    throw new JwtParseError(
+      formatError(
+        "Unable to decode because Jwt is not a valid!",
+        options.errorMessagePrefix
+      )
+    );
+  }
+  const { header } = decodeJwtHeader({
+    errorMessagePrefix: options.errorMessagePrefix,
+    headerSchema: options.headerSchema,
+    jwt: options.jwt
+  });
+  const payload = parseWithErrorHandling(
+    options.payloadSchema ?? zJwtPayload,
+    payloadJson,
+    formatError("Invalid JWT payload", options.errorMessagePrefix)
+  );
+  return {
+    compact: options.jwt,
+    header,
+    payload,
+    signature: signaturePart
+  };
+}
+
+// src/date.ts
+function dateToSeconds(date) {
+  const milliseconds = date?.getTime() ?? Date.now();
+  return Math.floor(milliseconds / 1e3);
+}
+function addSecondsToDate(date, seconds) {
+  return new Date(date.getTime() + seconds * 1e3);
+}
+
+// src/crypto/jwt/verify-jwt.ts
+async function verifyJwt(options) {
+  const errorMessage = options.errorMessage ?? "Error during verification of jwt.";
+  let signerJwk;
+  try {
+    const result = await options.verifyJwtCallback(options.signer, {
+      compact: options.compact,
+      header: options.header,
+      payload: options.payload
+    });
+    if (!result.verified) {
+      throw new JwtVerificationError(errorMessage);
+    }
+    signerJwk = result.signerJwk;
+  } catch (error) {
+    if (error instanceof JwtVerificationError) {
+      throw error;
+    }
+    throw new JwtVerificationError(errorMessage, { cause: error });
+  }
+  const nowInSeconds = dateToSeconds(options.now ?? /* @__PURE__ */ new Date());
+  const skewInSeconds = options.allowedSkewInSeconds ?? 0;
+  const timeBasedValidation = options.skipTimeBasedValidation !== void 0 ? !options.skipTimeBasedValidation : true;
+  if (timeBasedValidation && options.payload.nbf && nowInSeconds < options.payload.nbf - skewInSeconds) {
+    throw new JwtVerificationError(
+      `${errorMessage} jwt 'nbf' is in the future`
+    );
+  }
+  if (timeBasedValidation && options.payload.exp && nowInSeconds > options.payload.exp + skewInSeconds) {
+    throw new JwtVerificationError(`${errorMessage} jwt 'exp' is in the past`);
+  }
+  if (options.expectedAudience) {
+    const { aud } = options.payload;
+    if (Array.isArray(aud) && !aud.includes(options.expectedAudience) || typeof aud === "string" && aud !== options.expectedAudience) {
+      throw new JwtVerificationError(
+        `${errorMessage} jwt 'aud' does not match expected value.`
+      );
+    }
+  }
+  if (options.expectedIssuer && options.expectedIssuer !== options.payload.iss) {
+    throw new JwtVerificationError(
+      `${errorMessage} jwt 'iss' does not match expected value.`
+    );
+  }
+  if (options.expectedNonce && options.expectedNonce !== options.payload.nonce) {
+    throw new JwtVerificationError(
+      `${errorMessage} jwt 'nonce' does not match expected value.`
+    );
+  }
+  if (options.expectedSubject && options.expectedSubject !== options.payload.sub) {
+    throw new JwtVerificationError(
+      `${errorMessage} jwt 'sub' does not match expected value.`
+    );
+  }
+  if (options.requiredClaims) {
+    for (const claim of options.requiredClaims) {
+      if (!options.payload[claim]) {
+        throw new JwtVerificationError(
+          `${errorMessage} jwt '${claim}' is missing.`
+        );
+      }
+    }
+  }
+  return {
+    signer: {
+      ...options.signer,
+      publicJwk: signerJwk
+    }
+  };
+}
+
+// src/crypto/jwt/z-jwe.ts
+var import_zod4 = require("zod");
+var zCompactJwe = import_zod4.z.string().regex(
+  /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
+  {
+    message: "Not a valid compact jwe"
+  }
+);
+
+// src/fetcher.ts
+var defaultFetcher = fetch;
+function createFetcher(fetcher = defaultFetcher) {
+  return (input, init) => fetcher(
+    input,
+    init ? {
+      ...init,
+      body: init.body instanceof URLSearchParams ? init.body.toString() : init.body
+    } : void 0
+  ).catch((error) => {
+    throw new Error(
+      `Unknown error occurred during fetch to '${String(input)}'
+Cause: ${error instanceof Error ? error.message : String(error)}`
+    );
+  });
+}
+var hasStatusOrThrow = (status, customError) => async (res) => {
+  if (Array.isArray(status) ? !status.includes(res.status) : res.status !== status) {
+    const ErrorClass = customError ?? UnexpectedStatusCodeError;
+    throw new ErrorClass({
+      message: `Http request failed. Expected ${status}, got ${res.status}, url: ${res.url}`,
+      reason: await parseRawHttpResponse(res),
+      // Pass the response body as reason so the original error can surface
+      statusCode: res.status
+    });
+  }
+  return res;
+};
+var parseRawHttpResponse = (response) => response.headers.get("content-type")?.includes("application/json") ? response.json() : response.text();
+
+// src/url.ts
+function objectToQueryParams(object) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(object)) {
+    if (value != null) {
+      params.append(
+        key,
+        typeof value === "object" ? JSON.stringify(value) : String(value)
+      );
+    }
+  }
+  return params;
+}
+
+// src/validation.ts
+var import_zod5 = __toESM(require("zod"));
+var zItwSupportedSignatureAlg = import_zod5.default.enum([
   "ES256",
   "ES384",
   "ES512",
@@ -287,7 +895,7 @@ var zItwSupportedSignatureAlg = import_zod.default.enum([
   "PS384",
   "PS512"
 ]);
-var zHttpMethod = import_zod.default.enum([
+var zHttpMethod = import_zod5.default.enum([
   "GET",
   "POST",
   "PUT",
@@ -337,10 +945,6 @@ function dispatchByVersion(version, handlers) {
   }
   return handler();
 }
-
-// src/index.ts
-var import_oauth2 = require("@openid4vc/oauth2");
-var import_utils = require("@openid4vc/utils");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   CLOCK_SKEW_TOLERANCE_SECONDS,
@@ -352,7 +956,10 @@ var import_utils = require("@openid4vc/utils");
   ItWalletSpecsVersion,
   ItWalletSpecsVersionError,
   JsonParseError,
+  JwtParseError,
+  JwtVerificationError,
   MAX_IAT_AGE_SECONDS,
+  MAX_JTI_LENGTH,
   UnexpectedStatusCodeError,
   ValidationError,
   addSecondsToDate,
@@ -362,6 +969,7 @@ var import_utils = require("@openid4vc/utils");
   dateToSeconds,
   decodeBase64,
   decodeJwt,
+  decodeJwtHeader,
   decodeUtf8String,
   dispatchByVersion,
   encodeToBase64Url,
@@ -370,15 +978,27 @@ var import_utils = require("@openid4vc/utils");
   formatZodError,
   hasConfigVersion,
   hasStatusOrThrow,
+  jwtHeaderFromJwtSigner,
+  jwtSignerFromJwt,
   objectToQueryParams,
   parseIfJson,
   parseRawHttpResponse,
   parseWithErrorHandling,
   serializeAttrs,
-  setGlobalConfig,
   stringToJsonWithErrorHandling,
+  verifyJwt,
   verifyJwtIatOrThrow,
+  zAlgValueNotNone,
+  zCertificateChain,
+  zCompactJwe,
+  zCompactJwt,
   zHttpMethod,
-  zItwSupportedSignatureAlg
+  zItwSupportedSignatureAlg,
+  zJwk,
+  zJwkSet,
+  zJwtConfirmationPayload,
+  zJwtHeader,
+  zJwtPayload,
+  zTrustChain
 });
 //# sourceMappingURL=index.js.map