@sphereon/oid4vc-common 0.15.2-next.38

package/dist/jwt/JwkThumbprint.js

@@ -0,0 +1,102 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.calculateJwkThumbprintUri = exports.getDigestAlgorithmFromJwkThumbprintUri = exports.calculateJwkThumbprint = void 0;
+const u8a = __importStar(require("uint8arrays"));
+const hasher_1 = require("../hasher");
+const check = (value, description) => {
+    if (typeof value !== 'string' || !value) {
+        throw Error(`${description} missing or invalid`);
+    }
+};
+function calculateJwkThumbprint(jwk, digestAlgorithm) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!jwk || typeof jwk !== 'object') {
+            throw new TypeError('JWK must be an object');
+        }
+        const algorithm = digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : 'sha256';
+        if (algorithm !== 'sha256' && algorithm !== 'sha384' && algorithm !== 'sha512') {
+            throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
+        }
+        let components;
+        switch (jwk.kty) {
+            case 'EC':
+                check(jwk.crv, '"crv" (Curve) Parameter');
+                check(jwk.x, '"x" (X Coordinate) Parameter');
+                check(jwk.y, '"y" (Y Coordinate) Parameter');
+                components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
+                break;
+            case 'OKP':
+                check(jwk.crv, '"crv" (Subtype of Key Pair) Parameter');
+                check(jwk.x, '"x" (Public Key) Parameter');
+                components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
+                break;
+            case 'RSA':
+                check(jwk.e, '"e" (Exponent) Parameter');
+                check(jwk.n, '"n" (Modulus) Parameter');
+                components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
+                break;
+            case 'oct':
+                check(jwk.k, '"k" (Key Value) Parameter');
+                components = { k: jwk.k, kty: jwk.kty };
+                break;
+            default:
+                throw Error('"kty" (Key Type) Parameter missing or unsupported');
+        }
+        return u8a.toString((0, hasher_1.defaultHasher)(algorithm, JSON.stringify(components)), 'base64url');
+    });
+}
+exports.calculateJwkThumbprint = calculateJwkThumbprint;
+function getDigestAlgorithmFromJwkThumbprintUri(uri) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const match = uri.match(/^urn:ietf:params:oauth:jwk-thumbprint:sha-(\w+):/);
+        if (!match) {
+            throw new Error(`Invalid JWK thumbprint URI structure ${uri}`);
+        }
+        const algorithm = `sha${match[1]}`;
+        if (algorithm !== 'sha256' && algorithm !== 'sha384' && algorithm !== 'sha512') {
+            throw new Error(`Invalid JWK thumbprint URI digest algorithm ${uri}`);
+        }
+        return algorithm;
+    });
+}
+exports.getDigestAlgorithmFromJwkThumbprintUri = getDigestAlgorithmFromJwkThumbprintUri;
+function calculateJwkThumbprintUri(jwk_1) {
+    return __awaiter(this, arguments, void 0, function* (jwk, digestAlgorithm = 'sha256') {
+        const thumbprint = yield calculateJwkThumbprint(jwk, digestAlgorithm);
+        return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
+    });
+}
+exports.calculateJwkThumbprintUri = calculateJwkThumbprintUri;
+//# sourceMappingURL=JwkThumbprint.js.map

package/dist/jwt/JwkThumbprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwkThumbprint.js","sourceRoot":"","sources":["../../lib/jwt/JwkThumbprint.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAmC;AAEnC,sCAA0C;AAK1C,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,WAAmB,EAAE,EAAE;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,GAAG,WAAW,qBAAqB,CAAC,CAAC;IACnD,CAAC;AACH,CAAC,CAAC;AAEF,SAAsB,sBAAsB,CAAC,GAAQ,EAAE,eAAiC;;QACtF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,QAAQ,CAAC;QAC9C,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC/E,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,UAAU,CAAC;QACf,QAAQ,GAAG,CAAC,GAAG,EAAE,CAAC;YAChB,KAAK,IAAI;gBACP,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;gBAC1C,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;gBAC7C,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;gBAC7C,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAChE,MAAM;YACR,KAAK,KAAK;gBACR,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;gBACxD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;gBAC3C,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBACtD,MAAM;YACR,KAAK,KAAK;gBACR,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;gBACzC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;gBACxC,UAAU,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClD,MAAM;YACR,KAAK,KAAK;gBACR,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;gBAC1C,UAAU,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;gBACxC,MAAM;YACR;gBACE,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,sBAAa,EAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACzF,CAAC;CAAA;AAlCD,wDAkCC;AAED,SAAsB,sCAAsC,CAAC,GAAW;;QACtE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAqB,CAAC;QACtD,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CAAA;AAVD,wFAUC;AAED,SAAsB,yBAAyB;yDAAC,GAAQ,EAAE,kBAAmC,QAAQ;QACnG,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QACtE,OAAO,4CAA4C,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;IAC/F,CAAC;CAAA;AAHD,8DAGC"}

package/dist/jwt/Jwt.types.d.ts

@@ -0,0 +1,23 @@
+import { JwtHeader as jwtDecodeJwtHeader, JwtPayload as jwtDecodePayload } from 'jwt-decode';
+import { JWK } from '.';
+export type JwtHeader = jwtDecodeJwtHeader & {
+    alg?: string;
+    x5c?: string[];
+    kid?: string;
+    jwk?: JWK;
+    jwt?: string;
+} & Record<string, unknown>;
+export type JwtPayload = jwtDecodePayload & {
+    client_id?: string;
+    nonce?: string;
+    request_uri?: string;
+    client_id_scheme?: string;
+} & Record<string, unknown>;
+export declare enum SigningAlgo {
+    EDDSA = "EdDSA",
+    RS256 = "RS256",
+    PS256 = "PS256",
+    ES256 = "ES256",
+    ES256K = "ES256K"
+}
+//# sourceMappingURL=Jwt.types.d.ts.map

package/dist/jwt/Jwt.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jwt.types.d.ts","sourceRoot":"","sources":["../../lib/jwt/Jwt.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,kBAAkB,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE7F,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC;AACxB,MAAM,MAAM,SAAS,GAAG,kBAAkB,GAAG;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE5B,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE5B,oBAAY,WAAW;IACrB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,MAAM,WAAW;CAClB"}

package/dist/jwt/Jwt.types.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SigningAlgo = void 0;
+var SigningAlgo;
+(function (SigningAlgo) {
+    SigningAlgo["EDDSA"] = "EdDSA";
+    SigningAlgo["RS256"] = "RS256";
+    SigningAlgo["PS256"] = "PS256";
+    SigningAlgo["ES256"] = "ES256";
+    SigningAlgo["ES256K"] = "ES256K";
+})(SigningAlgo || (exports.SigningAlgo = SigningAlgo = {}));
+//# sourceMappingURL=Jwt.types.js.map

package/dist/jwt/Jwt.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jwt.types.js","sourceRoot":"","sources":["../../lib/jwt/Jwt.types.ts"],"names":[],"mappings":";;;AAkBA,IAAY,WAMX;AAND,WAAY,WAAW;IACrB,8BAAe,CAAA;IACf,8BAAe,CAAA;IACf,8BAAe,CAAA;IACf,8BAAe,CAAA;IACf,gCAAiB,CAAA;AACnB,CAAC,EANW,WAAW,2BAAX,WAAW,QAMtB"}

package/dist/jwt/JwtIssuer.d.ts

@@ -0,0 +1,52 @@
+import { JWK, JwtHeader, JwtPayload, JwtProtectionMethod, SigningAlgo } from '..';
+export interface JwtIssuerBase {
+    method: JwtProtectionMethod;
+    /**
+     * Additional options for the issuance context
+     */
+    options?: Record<string, unknown>;
+}
+export interface JwtIssuerDid extends JwtIssuerBase {
+    method: 'did';
+    didUrl: string;
+    alg: SigningAlgo | string;
+}
+export interface JwtIssuerX5c extends JwtIssuerBase {
+    method: 'x5c';
+    alg: SigningAlgo | string;
+    /**
+     *
+     * Array of base64-encoded certificate strings in the DER-format.
+     *
+     * The certificate containing the public key corresponding to the key used to digitally sign the JWS MUST be the first certificate.
+     */
+    x5c: Array<string>;
+    /**
+     * The issuer jwt
+     *
+     * This value will be used as the iss value of the issue jwt.
+     * It is also used as the client_id.
+     * And will also be set as the redirect_uri
+     *
+     * It must match an entry in the x5c certificate leaf entry dnsName / uriName
+     */
+    issuer: string;
+    clientIdScheme: 'x509_san_dns' | 'x509_san_uri';
+}
+export interface JwtIssuerJwk extends JwtIssuerBase {
+    method: 'jwk';
+    alg: SigningAlgo | string;
+    jwk: JWK;
+}
+export interface JwtIssuerCustom extends JwtIssuerBase {
+    method: 'custom';
+}
+export type JwtIssuer = JwtIssuerDid | JwtIssuerX5c | JwtIssuerJwk | JwtIssuerCustom;
+export interface JwtIssuanceContextBase {
+    type: string;
+}
+export type CreateJwtCallback<T extends JwtIssuer & JwtIssuanceContextBase> = (jwtIssuer: T, jwt: {
+    header: JwtHeader;
+    payload: JwtPayload;
+}) => Promise<string>;
+//# sourceMappingURL=JwtIssuer.d.ts.map

package/dist/jwt/JwtIssuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtIssuer.d.ts","sourceRoot":"","sources":["../../lib/jwt/JwtIssuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAElF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,mBAAmB,CAAC;IAC5B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,MAAM,EAAE,KAAK,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,WAAW,GAAG,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,MAAM,EAAE,KAAK,CAAC;IACd,GAAG,EAAE,WAAW,GAAG,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;;;;;OAQG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf,cAAc,EAAE,cAAc,GAAG,cAAc,CAAC;CACjD;AAED,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,MAAM,EAAE,KAAK,CAAC;IACd,GAAG,EAAE,WAAW,GAAG,MAAM,CAAC;IAC1B,GAAG,EAAE,GAAG,CAAC;CACV;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,YAAY,GAAG,YAAY,GAAG,eAAe,CAAC;AAErF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,SAAS,GAAG,sBAAsB,IAAI,CAC5E,SAAS,EAAE,CAAC,EACZ,GAAG,EAAE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,KAC5C,OAAO,CAAC,MAAM,CAAC,CAAC"}

package/dist/jwt/JwtIssuer.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=JwtIssuer.js.map

package/dist/jwt/JwtIssuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtIssuer.js","sourceRoot":"","sources":["../../lib/jwt/JwtIssuer.ts"],"names":[],"mappings":""}

package/dist/jwt/JwtVerifier.d.ts

@@ -0,0 +1,72 @@
+import { JWK, JwtHeader, JwtPayload, SigningAlgo } from '..';
+import { JwtProtectionMethod, JwtType } from './jwtUtils';
+export interface JwtVerifierBase {
+    type: JwtType;
+    method: JwtProtectionMethod;
+}
+export interface DidJwtVerifier extends JwtVerifierBase {
+    method: 'did';
+    alg: SigningAlgo | string;
+    didUrl: string;
+}
+export interface X5cJwtVerifier extends JwtVerifierBase {
+    method: 'x5c';
+    alg: SigningAlgo | string;
+    /**
+     *
+     * Array of base64-encoded certificate strings in the DER-format.
+     *
+     * The certificate containing the public key corresponding to the key used to digitally sign the JWS MUST be the first certificate.
+     */
+    x5c: Array<string>;
+    /**
+     * The jwt issuer
+     */
+    issuer: string;
+}
+export interface OpenIdFederationJwtVerifier extends JwtVerifierBase {
+    method: 'openid-federation';
+    /**
+     * The OpenId federation Entity
+     */
+    entityId: string;
+}
+export interface JwkJwtVerifier extends JwtVerifierBase {
+    method: 'jwk';
+    alg: SigningAlgo | string;
+    jwk: JWK;
+}
+export interface CustomJwtVerifier extends JwtVerifierBase {
+    method: 'custom';
+}
+export type JwtVerifier = DidJwtVerifier | X5cJwtVerifier | CustomJwtVerifier | JwkJwtVerifier | OpenIdFederationJwtVerifier;
+export declare const getDidJwtVerifier: (jwt: {
+    header: JwtHeader;
+    payload: JwtPayload;
+}, options: {
+    type: JwtType;
+}) => DidJwtVerifier;
+export declare const getX5cVerifier: (jwt: {
+    header: JwtHeader;
+    payload: JwtPayload;
+}, options: {
+    type: JwtType;
+}) => X5cJwtVerifier;
+export declare const getJwkVerifier: (jwt: {
+    header: JwtHeader;
+    payload: JwtPayload;
+}, options: {
+    type: JwtType;
+}) => Promise<JwkJwtVerifier>;
+export declare const getJwtVerifierWithContext: (jwt: {
+    header: JwtHeader;
+    payload: JwtPayload;
+}, options: {
+    type: JwtType;
+}) => Promise<JwtVerifier>;
+export type VerifyJwtCallbackBase<T extends JwtVerifier> = (jwtVerifier: T, jwt: {
+    header: JwtHeader;
+    payload: JwtPayload;
+    raw: string;
+}) => Promise<boolean>;
+//# sourceMappingURL=JwtVerifier.d.ts.map

package/dist/jwt/JwtVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtVerifier.d.ts","sourceRoot":"","sources":["../../lib/jwt/JwtVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,mBAAmB,CAAC;CAC7B;AAED,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,MAAM,EAAE,KAAK,CAAC;IAEd,GAAG,EAAE,WAAW,GAAG,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,MAAM,EAAE,KAAK,CAAC;IAEd,GAAG,EAAE,WAAW,GAAG,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEnB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,2BAA4B,SAAQ,eAAe;IAClE,MAAM,EAAE,mBAAmB,CAAC;IAE5B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,MAAM,EAAE,KAAK,CAAC;IACd,GAAG,EAAE,WAAW,GAAG,MAAM,CAAC;IAE1B,GAAG,EAAE,GAAG,CAAC;CACV;AAED,MAAM,WAAW,iBAAkB,SAAQ,eAAe;IACxD,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG,cAAc,GAAG,iBAAiB,GAAG,cAAc,GAAG,2BAA2B,CAAC;AAE7H,eAAO,MAAM,iBAAiB,QAAS;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,WAAW;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,KAAG,cAS/G,CAAC;AAEF,eAAO,MAAM,cAAc,QAAS;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,WAAW;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,KAAG,cAc5G,CAAC;AAEF,eAAO,MAAM,cAAc,QAAe;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,WAAW;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,KAAG,QAAQ,cAAc,CAUxI,CAAC;AAEF,eAAO,MAAM,yBAAyB,QAC/B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,WACtC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,KACzB,QAAQ,WAAW,CAQrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,WAAW,IAAI,CACzD,WAAW,EAAE,CAAC,EACd,GAAG,EAAE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,KACzD,OAAO,CAAC,OAAO,CAAC,CAAC"}

package/dist/jwt/JwtVerifier.js

@@ -0,0 +1,64 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getJwtVerifierWithContext = exports.getJwkVerifier = exports.getX5cVerifier = exports.getDidJwtVerifier = void 0;
+const getDidJwtVerifier = (jwt, options) => {
+    const { type } = options;
+    if (!jwt.header.kid)
+        throw new Error(`Received an invalid JWT. Missing kid header.`);
+    if (!jwt.header.alg)
+        throw new Error(`Received an invalid JWT. Missing alg header.`);
+    if (!jwt.header.kid.includes('#')) {
+        throw new Error(`Received an invalid JWT.. '${type}' contains an invalid kid header.`);
+    }
+    return { method: 'did', didUrl: jwt.header.kid, type: type, alg: jwt.header.alg };
+};
+exports.getDidJwtVerifier = getDidJwtVerifier;
+const getX5cVerifier = (jwt, options) => {
+    const { type } = options;
+    if (!jwt.header.x5c)
+        throw new Error(`Received an invalid JWT. Missing x5c header.`);
+    if (!jwt.header.alg)
+        throw new Error(`Received an invalid JWT. Missing alg header.`);
+    if (!Array.isArray(jwt.header.x5c) || jwt.header.x5c.length === 0 || !jwt.header.x5c.every((cert) => typeof cert === 'string')) {
+        throw new Error(`Received an invalid JWT.. '${type}' contains an invalid x5c header.`);
+    }
+    if (typeof jwt.payload.iss !== 'string') {
+        throw new Error(`Received an invalid JWT. '${type}' contains an invalid iss claim.`);
+    }
+    return { method: 'x5c', x5c: jwt.header.x5c, issuer: jwt.payload.iss, type: type, alg: jwt.header.alg };
+};
+exports.getX5cVerifier = getX5cVerifier;
+const getJwkVerifier = (jwt, options) => __awaiter(void 0, void 0, void 0, function* () {
+    const { type } = options;
+    if (!jwt.header.jwk)
+        throw new Error(`Received an invalid JWT.  Missing jwk header.`);
+    if (!jwt.header.alg)
+        throw new Error(`Received an invalid JWT. Missing alg header.`);
+    if (typeof jwt.header.jwk !== 'object') {
+        throw new Error(`Received an invalid JWT. '${type}' contains an invalid jwk header.`);
+    }
+    return { method: 'jwk', type, jwk: jwt.header.jwk, alg: jwt.header.alg };
+});
+exports.getJwkVerifier = getJwkVerifier;
+const getJwtVerifierWithContext = (jwt, options) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const { header, payload } = jwt;
+    if ((_a = header.kid) === null || _a === void 0 ? void 0 : _a.startsWith('did:'))
+        return (0, exports.getDidJwtVerifier)({ header, payload }, options);
+    else if (jwt.header.x5c)
+        return (0, exports.getX5cVerifier)({ header, payload }, options);
+    else if (jwt.header.jwk)
+        return (0, exports.getJwkVerifier)({ header, payload }, options);
+    return { method: 'custom', type: options.type };
+});
+exports.getJwtVerifierWithContext = getJwtVerifierWithContext;
+//# sourceMappingURL=JwtVerifier.js.map

package/dist/jwt/JwtVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtVerifier.js","sourceRoot":"","sources":["../../lib/jwt/JwtVerifier.ts"],"names":[],"mappings":";;;;;;;;;;;;AAyDO,MAAM,iBAAiB,GAAG,CAAC,GAA+C,EAAE,OAA0B,EAAkB,EAAE;IAC/H,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACrF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAErF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,mCAAmC,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;AACpF,CAAC,CAAC;AATW,QAAA,iBAAiB,qBAS5B;AAEK,MAAM,cAAc,GAAG,CAAC,GAA+C,EAAE,OAA0B,EAAkB,EAAE;IAC5H,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACrF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAErF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC/H,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,mCAAmC,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,kCAAkC,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;AAC1G,CAAC,CAAC;AAdW,QAAA,cAAc,kBAczB;AAEK,MAAM,cAAc,GAAG,CAAO,GAA+C,EAAE,OAA0B,EAA2B,EAAE;IAC3I,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACtF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAErF,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,mCAAmC,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;AAC3E,CAAC,CAAA,CAAC;AAVW,QAAA,cAAc,kBAUzB;AAEK,MAAM,yBAAyB,GAAG,CACvC,GAA+C,EAC/C,OAA0B,EACJ,EAAE;;IACxB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAEhC,IAAI,MAAA,MAAM,CAAC,GAAG,0CAAE,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAA,yBAAiB,EAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;SACtF,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,IAAA,sBAAc,EAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;SACxE,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,IAAA,sBAAc,EAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAE7E,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC,CAAA,CAAC;AAXW,QAAA,yBAAyB,6BAWpC"}

package/dist/jwt/index.d.ts

@@ -0,0 +1,7 @@
+export * from './JwkThumbprint';
+export * from './Jwt.types';
+export * from './JwtIssuer';
+export * from './JwtVerifier';
+export * from './jwtUtils';
+export * from './Jwk.types';
+//# sourceMappingURL=index.d.ts.map

package/dist/jwt/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../lib/jwt/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/jwt/index.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./JwkThumbprint"), exports);
+__exportStar(require("./Jwt.types"), exports);
+__exportStar(require("./JwtIssuer"), exports);
+__exportStar(require("./JwtVerifier"), exports);
+__exportStar(require("./jwtUtils"), exports);
+__exportStar(require("./Jwk.types"), exports);
+//# sourceMappingURL=index.js.map

package/dist/jwt/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../lib/jwt/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,8CAA4B;AAC5B,8CAA4B;AAC5B,gDAA8B;AAC9B,6CAA2B;AAC3B,8CAA4B"}

package/dist/jwt/jwtUtils.d.ts

@@ -0,0 +1,16 @@
+import { JwtHeader, JwtPayload } from '..';
+export type JwtType = 'id-token' | 'request-object' | 'verifier-attestation' | 'dpop';
+export type JwtProtectionMethod = 'did' | 'x5c' | 'jwk' | 'openid-federation' | 'custom';
+export declare function parseJWT<Header = JwtHeader, Payload = JwtPayload>(jwt: string): {
+    header: NonNullable<Header>;
+    payload: NonNullable<Payload>;
+};
+export declare function getNowSkewed(now?: number, skewTime?: number): {
+    nowSkewedPast: number;
+    nowSkewedFuture: number;
+};
+/**
+ * Returns the current unix timestamp in seconds.
+ */
+export declare function epochTime(): number;
+//# sourceMappingURL=jwtUtils.d.ts.map

package/dist/jwt/jwtUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtUtils.d.ts","sourceRoot":"","sources":["../../lib/jwt/jwtUtils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAE3C,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,gBAAgB,GAAG,sBAAsB,GAAG,MAAM,CAAC;AAEtF,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,mBAAmB,GAAG,QAAQ,CAAC;AAEzF,wBAAgB,QAAQ,CAAC,MAAM,GAAG,SAAS,EAAE,OAAO,GAAG,UAAU,EAAE,GAAG,EAAE,MAAM;;;EAQ7E;AAWD,wBAAgB,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;;;EAQ3D;AAED;;GAEG;AACH,wBAAgB,SAAS,WAExB"}

package/dist/jwt/jwtUtils.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.epochTime = exports.getNowSkewed = exports.parseJWT = void 0;
+const jwt_decode_1 = require("jwt-decode");
+function parseJWT(jwt) {
+    const header = (0, jwt_decode_1.jwtDecode)(jwt, { header: true });
+    const payload = (0, jwt_decode_1.jwtDecode)(jwt, { header: false });
+    if (!payload || !header) {
+        throw new Error('Jwt Payload and/or Header could not be parsed');
+    }
+    return { header, payload };
+}
+exports.parseJWT = parseJWT;
+/**
+ * The maximum allowed clock skew time in seconds. If an time based validation
+ * is performed against current time (`now`), the validation can be of by the skew
+ * time.
+ *
+ * See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.5
+ */
+const DEFAULT_SKEW_TIME = 60;
+function getNowSkewed(now, skewTime) {
+    const _now = now ? now : epochTime();
+    const _skewTime = skewTime ? skewTime : DEFAULT_SKEW_TIME;
+    return {
+        nowSkewedPast: _now - _skewTime,
+        nowSkewedFuture: _now + _skewTime,
+    };
+}
+exports.getNowSkewed = getNowSkewed;
+/**
+ * Returns the current unix timestamp in seconds.
+ */
+function epochTime() {
+    return Math.floor(Date.now() / 1000);
+}
+exports.epochTime = epochTime;
+//# sourceMappingURL=jwtUtils.js.map

package/dist/jwt/jwtUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtUtils.js","sourceRoot":"","sources":["../../lib/jwt/jwtUtils.ts"],"names":[],"mappings":";;;AAAA,2CAAuC;AAQvC,SAAgB,QAAQ,CAA2C,GAAW;IAC5E,MAAM,MAAM,GAAG,IAAA,sBAAS,EAAS,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAA,sBAAS,EAAU,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3D,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AARD,4BAQC;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,SAAgB,YAAY,CAAC,GAAY,EAAE,QAAiB;IAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAE1D,OAAO;QACL,aAAa,EAAE,IAAI,GAAG,SAAS;QAC/B,eAAe,EAAE,IAAI,GAAG,SAAS;KAClC,CAAC;AACJ,CAAC;AARD,oCAQC;AAED;;GAEG;AACH,SAAgB,SAAS;IACvB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAFD,8BAEC"}

package/dist/types/digest.types.d.ts

@@ -0,0 +1,2 @@
+export type DigestAlgorithm = 'sha256' | 'sha384' | 'sha512';
+//# sourceMappingURL=digest.types.d.ts.map

package/dist/types/digest.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.types.d.ts","sourceRoot":"","sources":["../../lib/types/digest.types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC"}

package/dist/types/digest.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=digest.types.js.map

package/dist/types/digest.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.types.js","sourceRoot":"","sources":["../../lib/types/digest.types.ts"],"names":[],"mappings":""}

package/dist/types/index.d.ts

@@ -0,0 +1,2 @@
+export * from './digest.types';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../lib/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC"}

package/dist/types/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./digest.types"), exports);
+//# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../lib/types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B"}

package/lib/__tests__/dpop.spec.ts

@@ -0,0 +1,124 @@
+import { createDPoP, getCreateDPoPOptions, verifyDPoP } from '../dpop';
+
+describe('dpop', () => {
+  const alg = 'HS256';
+  const jwk = { kty: 'Ed25519', crv: 'Ed25519', x: '123', y: '123' };
+  const jwtIssuer = { alg, jwk };
+  const htm = 'POST';
+  const htu = 'https://example.com/token';
+  const nonce = 'nonce';
+  const jwtPayloadProps = { htm, htu, nonce } as const;
+  const jwtHeaderProps = { alg, jwk, typ: 'dpop+jwt' };
+  const unsignedDpop =
+    'eyJhbGciOiJIUzI1NiIsImp3ayI6eyJrdHkiOiJFZDI1NTE5IiwiY3J2IjoiRWQyNTUxOSIsIngiOiIxMjMiLCJ5IjoiMTIzIn0sInR5cCI6ImRwb3Arand0In0.eyJodG0iOiJQT1NUIiwiaHR1IjoiaHR0cHM6Ly9leGFtcGxlLmNvbS90b2tlbiIsIm5vbmNlIjoibm9uY2UiLCJpYXQiOjE3MjIzMjcxOTQsImp0aSI6Ijk4OWNiZTc4LWI1ZTYtNDViYS1iYjMzLWQ0MGE4ZGEwZjFhYSJ9';
+
+  it('should create a dpop with valid options', async () => {
+    const dpop = await createDPoP({
+      jwtIssuer,
+      jwtPayloadProps,
+      createJwtCallback: async (dpopJwtIssuerWithContext, jwt) => {
+        expect(dpopJwtIssuerWithContext.alg).toEqual(alg);
+        expect(dpopJwtIssuerWithContext.jwk).toEqual(jwk);
+        expect(dpopJwtIssuerWithContext.dPoPSigningAlgValuesSupported).toBeUndefined();
+        expect(dpopJwtIssuerWithContext.type).toEqual('dpop');
+
+        expect(jwt.header).toStrictEqual(jwtHeaderProps);
+        expect(jwt.payload).toStrictEqual({
+          ...jwtPayloadProps,
+          iat: expect.any(Number),
+          jti: expect.any(String),
+        });
+
+        return unsignedDpop;
+      },
+    });
+
+    expect(unsignedDpop).toEqual(dpop);
+    expect.assertions(7);
+  });
+
+  it('should create a dpop with valid createDPoPOptions', async () => {
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    const { htm, htu, ...rest } = jwtPayloadProps;
+    const options = getCreateDPoPOptions(
+      {
+        jwtIssuer,
+        jwtPayloadProps: rest,
+        createJwtCallback: async (dpopJwtIssuerWithContext, jwt) => {
+          expect(dpopJwtIssuerWithContext.alg).toEqual(alg);
+          expect(dpopJwtIssuerWithContext.jwk).toEqual(jwk);
+          expect(dpopJwtIssuerWithContext.dPoPSigningAlgValuesSupported).toBeUndefined();
+          expect(dpopJwtIssuerWithContext.type).toEqual('dpop');
+
+          expect(jwt.header).toStrictEqual(jwtHeaderProps);
+          expect(jwt.payload).toStrictEqual({
+            ...jwtPayloadProps,
+            iat: expect.any(Number),
+            jti: expect.any(String),
+          });
+
+          return unsignedDpop;
+        },
+      },
+      htu + '?123412341#xyaksdjfaksdjf',
+    );
+
+    const dpop = await createDPoP(options);
+
+    expect(unsignedDpop).toEqual(dpop);
+    expect.assertions(7);
+  });
+
+  it('verify dpop fails if jwtVerifyCallback throws an error', async () => {
+    await expect(
+      verifyDPoP(
+        {
+          headers: { dpop: unsignedDpop },
+          fullUrl: htu + '?123412341#xyaksdjfaksdjf',
+          method: 'POST',
+        },
+        {
+          jwtVerifyCallback: async () => {
+            throw new Error('jwtVerifyCallback');
+          },
+          expectedNonce: 'nonce',
+          expectAccessToken: false,
+          now: 1722327194,
+        },
+      ),
+    ).rejects.toThrow();
+  });
+
+  it('should verify a dpop with valid options', async () => {
+    const dpop = await verifyDPoP(
+      {
+        headers: { dpop: unsignedDpop },
+        fullUrl: htu + '?123412341#xyaksdjfaksdjf',
+        method: 'POST',
+      },
+      {
+        jwtVerifyCallback: async (jwtVerifier, jwt) => {
+          expect(jwtVerifier.method).toEqual('jwk');
+          expect(jwtVerifier.jwk).toEqual(jwk);
+          expect(jwtVerifier.type).toEqual('dpop');
+          expect(jwtVerifier.alg).toEqual(alg);
+
+          expect(jwt.header).toStrictEqual(jwtHeaderProps);
+          expect(jwt.payload).toStrictEqual({
+            ...jwtPayloadProps,
+            iat: expect.any(Number),
+            jti: expect.any(String),
+          });
+          expect(jwt.raw).toEqual(unsignedDpop);
+
+          return true;
+        },
+        expectAccessToken: false,
+        expectedNonce: 'nonce',
+        now: 1722327194,
+      },
+    );
+    expect(dpop).toStrictEqual(jwk);
+    expect.assertions(8);
+  });
+});