@connectid-tools/rp-nodejs-sdk 4.2.1 → 5.0.1

package/README.md

@@ -1,12 +1,12 @@
-# Relying Party Node.JS SDK
+# Relying Party Node.js SDK
 
 The rp-nodejs-sdk provides an SDK to allows Relying Parties easily integrate with the Digital Identity ecosystem.
 
 # Getting Started
 
-> A minimum of Node JS version 20.x is recommended. Download [here](https://nodejs.org/download/release/v20.9.0/).
+> A minimum of Node.js version 20.x is recommended. Download [here](https://nodejs.org/download/release/v20.9.0/).
 
-Install the package in your nodejs project using:
+Install the package in your Node.js project using:
 
 ```shell
 npm install @connectid-tools/rp-nodejs-sdk
@@ -36,9 +36,9 @@ The above code assumes that you have a config file called `config.js` in your pr
 the configuration required for the sdk, eg: the location of the certificate files, the client details,
 the callback urls, etc. The configuration attributes are described below.
 
-## Using Typescript
+## Using TypeScript
 
-To use Node SDK with Typescript you need to make the following changes in your `tsconfig.json`:
+To use the Node.js SDK with TypeScript you'll need to make the following changes in your `tsconfig.json`:
 
 - Set `"target: "es2016"` or higher
 - Have `"module": "ES2015"` or higher
@@ -61,7 +61,8 @@ Sample tsconfig:
 
 ### Setting up SDK config options
 
-`RelyingPartyClientSdkConfig` has some fixed values, specially inside `client` object, to be able to set the config options for the SDK some type gymnastics will be needed as shown below (see `as const`):
+`RelyingPartyClientSdkConfig` has some fixed values. To be able to set the config 
+options for the SDK you can use the example as below:
 
 ```typescript
 // index.ts
@@ -75,37 +76,11 @@ const relyingPartyClientSdk = new RelyingPartyClientSdk(config)
 // config.ts
 export const config = {
   data: {
-  .
-  .
-  .
-  log_level: 'info' as const,
-  .
-  .
-  .
-  client: {
-      .
-      .
-      .
-      application_type: 'web' as const,
-      grant_types: ['client_credentials', 'authorization_code', 'implicit'] as  ['client_credentials', 'authorization_code', 'implicit'],
-      id_token_signed_response_alg: 'PS256' as const,
-      post_logout_redirect_uris: [] as [],
-      require_auth_time: false as const,
-      response_types: ['code id_token', 'code'] as ['code id_token', 'code'],
-      subject_type: 'public' as const,
-      token_endpoint_auth_method: 'private_key_jwt' as const,
-      token_endpoint_auth_signing_alg: 'PS256' as const,
-      introspection_endpoint_auth_method: 'private_key_jwt' as const,
-      revocation_endpoint_auth_method: 'private_key_jwt' as const,
-      request_object_signing_alg: 'PS256' as const,
-      require_signed_request_object: true as const,
-      require_pushed_authorization_requests: true as const,
-      authorization_signed_response_alg: 'PS256' as const,
-      tls_client_certificate_bound_access_tokens: true as const,
-      backchannel_user_code_parameter: false as const,
-      scope: 'openid' as const,
-      software_roles: ['RP-CORE'] as ['RP-CORE'],
-    },
+    .
+    .
+    .
+    log_level: 'info' as const,
+  }
 ```
 
 # rp-nodejs-sdk Configuration
@@ -124,31 +99,27 @@ const RelyingPartyClientSdk = require('@connectid-tools/rp-nodejs-sdk')
 const rpClient = new RelyingPartyClientSdk(config)
 ```
 
-| Property                              | Description                                                                                                                                                                                                                                                                                                                                          | Example value                                                                                                                                      |
-| ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `ca_pem`                              | The collection of trusted root certificates that can be used for certification validation. May be an absolute or relative path.                                                                                                                                                                                                                      | `'./conf/ca.pem'  `                                                                                                                                |
-| `ca_pem_content`                      | The collection of trusted root certificates content (string) that can be used for certification validation. Overrides `ca_pem`.                                                                                                                                                                                                                      | `'-----BEGIN CERTIFICATE----- MIIFnTCCBIWgAwIBAgIUKl2OAbHVc1r9isRs6WIExS/1BLgwDQYJKoZIhvcNAQEL...'`                                                |
-| `signing_kid`                         | The id for the signing key in the JWKS. This can be found in the registry via Software Statements -> Client Details -> Certificates                                                                                                                                                                                                                  | `'Xf1Pf-GXyhryOY5wwg0ddL5yzUicIcQrOIxja0yHhpg'`                                                                                                    |
-| `signing_key`                         | The path to the signing key used when signing requests. May be an absolute or relative path. `signing_key` or `signing_key_content` must be used to provide the signing key.                                                                                                                                                                         | `'./conf/signing.key'`                                                                                                                             |
-| `signing_key_content`                 | The signing key content (string) used when signing requests. If supplied, will override the key data supplied via `signing_key`.                                                                                                                                                                                                                     | `'-----BEGIN PRIVATE KEY----- MIIFnTCCBIWgAwIBAgIUKl2OAbHVc1r9isRs6WIExS/1BLgwDQYJKoZIhvcNAQEL...'`                                                |
-| `registry_participants_uri`           | The URI for the registry endpoint that provides the participant list                                                                                                                                                                                                                                                                                 | `https://data.directory.sandbox.connectid.com.au/participants`                                                                                     |
-| `signing_pem`                         | The path to the signing certificate used when signing requests. May be an absolute or relative path.                                                                                                                                                                                                                                                 | `'./conf/signing.pem'`                                                                                                                             |
-| `transport_key`                       | The path to the transport key used for mutual TLS. May be an absolute or relative path. `transport_key` or `transport_key_content` must be used to provide the transport key.                                                                                                                                                                        | `'./conf/transport.key'`                                                                                                                           |
-| `transport_key_content`               | The transport key content (string) used for mutual TLS. If supplied, will override the key data supplied via `transport_key`.                                                                                                                                                                                                                        | `'-----BEGIN PRIVATE KEY----- MIIFnTCCBIWgAwIBAgIUKl2OAbHVc1r9isRs6WIExS/1BLgwDQYJKoZIhvcNAQEL...'`                                                |
-| `transport_pem`                       | The path to the transport certificate used for mutual TLS. May be an absolute or relative path. `tranport_pem` or `transport_pem_content` must be used to provide the transport certificate                                                                                                                                                          | `'./conf/transport.pem'`                                                                                                                           |
-| `transport_pem_content`               | The transport certificate content (string) used for mutual TLS. If supplied, will override the certificate supplied via `transport_pem`.                                                                                                                                                                                                             | `'-----BEGIN CERTIFICATE----- MIIFnTCCBIWgAwIBAgIUKl2OAbHVc1r9isRs6WIExS/1BLgwDQYJKoZIhvcNAQEL...'`                                                |
-| `application_redirect_uri`            | The specific redirect url used for all requests from this rp-nodejs-sdk instance. Must be one of the redirect_urls specified in the registry for the client                                                                                                                                                                                          | `'https://tpp.localhost/cb'`                                                                                                                       |
-| `client.client_id`                    | Identifies the client. This value is available from the Registry via Software Statements -> Client Details -> Client ID                                                                                                                                                                                                                              | `'https://rp.directory.sandbox.connectid.com.au/openid_relying_party/280518db-9807-4824-b080-324d94b45f6a'`                                        |
-| `client.organisation_id`              | Identifies the organisation. This value is available from the Registry via Organisation Details                                                                                                                                                                                                                                                      | `'ab837240-9618-4953-966e-90fd1fa63999'`                                                                                                           |
-| `client.jwks_uri`                     | The location of the JWKS for this client. Will be in the format: `'https://keystore.directory.sandbox.connectid.com.au/<organisation_id>/<client_id>/application.jwks'`                                                                                                                                                                              | `'https://keystore.directory.sandbox.connectid.com.au/ab837240-9618-4953-966e-90fd1fa63999/090d41c6-fc27-4b1e-91e9-0fecfc240601/application.jwks'` |
-| `client.redirect_uris`                | The list of redirect_uris supported by the client. Must only contain URIs specified in the registry.                                                                                                                                                                                                                                                 | `['https://demo.relyingpart.net/cb', 'https://tpp.localhost/cb',]`                                                                                 |
-| `log_level`                           | The log level to use for console logs, eg: 'info', 'debug'. Enabling 'debug' will cause all requests and responses to remote servers to be logged. 'debug' must not be used in Production as it will log Personal Information.                                                                                                                       | `'info'`                                                                                                                                           |
-| `cache_ttl`                           | TTL for the participants list caching. Optional setting. Defaults to 600 seconds if not configured.                                                                                                                                                                                                                                                  | `600`                                                                                                                                              |
-| `enable_auto_compliance_verification` | When running the OIDC FAPI compliance suite, it requires a call to userInfo after successfully decoding the response claims. If this is set to true, the SDK will automatically make the required call.                                                                                                                                              | `false`                                                                                                                                            |
-| `purpose`                             | The default purpose to be displayed to the consumer on the IDP consent screen to indicate why their data is being requested to be shared                                                                                                                                                                                                             | `'verifying your identity'`                                                                                                                        |
-| `include_uncertified_participants`    | By default the SDK will filter out all authorisation servers that are not fully certified. If you wish to test one of the uncertified auth servers you will need to set this to `true`. If not provided, defaults to 'false'                                                                                                                         | `false`                                                                                                                                            |
-| `required_claims`                     | The list of claims that the RP will be using and requires IDPs to support. If supplied, this will be used to filter the list of IDPs returned from `getParticipants` so that only IDPs supporting the claims are returned. If this value is not supplied, no filtering by claim support will be performed.                                           | `['name', 'address']`                                                                                                                              |
-| `required_participant_certifications` | The list of required certifications a server must support for the IDP use case (eg: TDIF Certification). If supplied, this will be used to filter the list of IDPs returned from `getParticipants` so that only IDPs with the certification are returned. If this value is not supplied, no filtering for specific certifications will be performed. | `[{ profileType: 'TDIF Accreditation', profileVariant: 'Identity Provider'}]`                                                                      |
+| Property                              | Description                                                                                                                                                                                                                                                                                                                                          | Example value                                                                                               |
+|---------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|
+| `ca_pem`                              | The collection of trusted root certificates that can be used for certification validation. May be an absolute or relative path.                                                                                                                                                                                                                      | `'./conf/ca.pem'  `                                                                                         |
+| `ca_pem_content`                      | The collection of trusted root certificates content (string) that can be used for certification validation. Overrides `ca_pem`.                                                                                                                                                                                                                      | `'-----BEGIN CERTIFICATE----- MIIFnTCCBIWgAwIBAgIUKl2OAbHVc1r9isRs6WIExS/1BLgwDQYJKoZIhvcNAQEL...'`         |
+| `signing_kid`                         | The id for the signing key in the JWKS. This can be found in the registry via Software Statements -> Client Details -> Certificates                                                                                                                                                                                                                  | `'Xf1Pf-GXyhryOY5wwg0ddL5yzUicIcQrOIxja0yHhpg'`                                                             |
+| `signing_key`                         | The path to the signing key used when signing requests. May be an absolute or relative path. `signing_key` or `signing_key_content` must be used to provide the signing key.                                                                                                                                                                         | `'./conf/signing.key'`                                                                                      |
+| `signing_key_content`                 | The signing key content (string) used when signing requests. If supplied, will override the key data supplied via `signing_key`.                                                                                                                                                                                                                     | `'-----BEGIN PRIVATE KEY----- MIIFnTCCBIWgAwIBAgIUKl2OAbHVc1r9isRs6WIExS/1BLgwDQYJKoZIhvcNAQEL...'`         |
+| `registry_participants_uri`           | The URI for the registry endpoint that provides the participant list                                                                                                                                                                                                                                                                                 | `https://data.directory.sandbox.connectid.com.au/participants`                                              |
+| `signing_pem`                         | The path to the signing certificate used when signing requests. May be an absolute or relative path.                                                                                                                                                                                                                                                 | `'./conf/signing.pem'`                                                                                      |
+| `transport_key`                       | The path to the transport key used for mutual TLS. May be an absolute or relative path. `transport_key` or `transport_key_content` must be used to provide the transport key.                                                                                                                                                                        | `'./conf/transport.key'`                                                                                    |
+| `transport_key_content`               | The transport key content (string) used for mutual TLS. If supplied, will override the key data supplied via `transport_key`.                                                                                                                                                                                                                        | `'-----BEGIN PRIVATE KEY----- MIIFnTCCBIWgAwIBAgIUKl2OAbHVc1r9isRs6WIExS/1BLgwDQYJKoZIhvcNAQEL...'`         |
+| `transport_pem`                       | The path to the transport certificate used for mutual TLS. May be an absolute or relative path. `tranport_pem` or `transport_pem_content` must be used to provide the transport certificate                                                                                                                                                          | `'./conf/transport.pem'`                                                                                    |
+| `transport_pem_content`               | The transport certificate content (string) used for mutual TLS. If supplied, will override the certificate supplied via `transport_pem`.                                                                                                                                                                                                             | `'-----BEGIN CERTIFICATE----- MIIFnTCCBIWgAwIBAgIUKl2OAbHVc1r9isRs6WIExS/1BLgwDQYJKoZIhvcNAQEL...'`         |
+| `application_redirect_uri`            | The specific redirect url used for all requests from this rp-nodejs-sdk instance. Must be one of the redirect_urls specified in the registry for the client                                                                                                                                                                                          | `'https://tpp.localhost/cb'`                                                                                |
+| `client_id`                           | Identifies the client. This value is available from the Registry via Software Statements -> Client Details -> Client ID                                                                                                                                                                                                                              | `'https://rp.directory.sandbox.connectid.com.au/openid_relying_party/280518db-9807-4824-b080-324d94b45f6a'` |
+| `log_level`                           | The log level to use for console logs, eg: 'info', 'debug'. Enabling 'debug' will cause all requests and responses to remote servers to be logged. 'debug' must not be used in Production as it will log Personal Information.                                                                                                                       | `'info'`                                                                                                    |
+| `enable_auto_compliance_verification` | When running the OIDC FAPI compliance suite, it requires a call to userInfo after successfully decoding the response claims. If this is set to true, the SDK will automatically make the required call.                                                                                                                                              | `false`                                                                                                     |
+| `purpose`                             | The default purpose to be displayed to the consumer on the IDP consent screen to indicate why their data is being requested to be shared                                                                                                                                                                                                             | `'verifying your identity'`                                                                                 |
+| `include_uncertified_participants`    | By default the SDK will filter out all authorisation servers that are not fully certified. If you wish to test one of the uncertified auth servers you will need to set this to `true`. If not provided, defaults to 'false'                                                                                                                         | `false`                                                                                                     |
+| `required_claims`                     | The list of claims that the RP will be using and requires IDPs to support. If supplied, this will be used to filter the list of IDPs returned from `getParticipants` so that only IDPs supporting the claims are returned. If this value is not supplied, no filtering by claim support will be performed.                                           | `['name', 'address']`                                                                                       |
+| `required_participant_certifications` | The list of required certifications a server must support for the IDP use case (eg: TDIF Certification). If supplied, this will be used to filter the list of IDPs returned from `getParticipants` so that only IDPs with the certification are returned. If this value is not supplied, no filtering for specific certifications will be performed. | `[{ profileType: 'TDIF Accreditation', profileVariant: 'Identity Provider'}]`                               |
 
 # Process Overview Sequence Diagram
 
@@ -354,7 +325,7 @@ The required function parameters are:
   If a user does not consent to `voluntary` claims, but does consent to `essential` claims, this will result in a successful transaction.
 - `purpose` - the purpose to be displayed to the consumer on the IDP consent screen to indicate why their data is being requested to be shared. If not supplied, the default purpose configured in the SDK config will be used.
 
-The method will return: `{ authUrl, code_verifier, state, nonce, xFapiInteractionId }`. The fields are:
+The method will return: `{ authUrl, codeVerifier, state, nonce, xFapiInteractionId }`. The fields are:
 
 - `authUrl` - the URL the user must be redirected to in order to complete the authorisation process with their Identity Provider
 - `codeVerifier`
@@ -399,9 +370,8 @@ The required function parameters are:
 - `state` - from the response to the PAR for this identity request
 - `nonce` - from the response to the PAR for this identity request
 
-The method will return a `ConsolidatedTokenSet` which extends [Tokenset](https://github.com/panva/node-openid-client/blob/main/docs/README.md#class-tokenset)
-that contains the access_token and id_token. The user identity claims can be retrieved using the utility method `claims()`
-on the TokenSet. The `ConsolidatedTokenSet` provides a new method `consolidatedClaims()`, which will return a single
+The method will return a `ConsolidatedTokenSet` that contains the access_token and id_token. The user identity claims can be retrieved using the utility method `claims()`
+on the ConsolidatedTokenSet. The `ConsolidatedTokenSet` provides a method `consolidatedClaims()`, which will return a single
 object containing all the claims, including the extended claims, as a single object. The tokenset also contains an `xFapiInteractionId` which
 is a correlation id for the request that was sent to the IDP.
 
@@ -419,6 +389,29 @@ The required function parameters are:
 
 # Release Notes
 
+### 5.0.1 (Jan 16, 2026)
+
+* Fixed packaging structure which caused conflicts when including the library.
+
+### 5.0.0 (Jan 15, 2026)
+
+**Major architectural refactoring - Breaking Changes**
+
+This release removes the dependency on `openid-client` and implements custom OIDC/FAPI flow logic to align with the Java and .NET SDKs.
+
+**Breaking Changes:**
+- **Removed `cache_ttl` configuration parameter**: Participant list caching has been removed to align with Java/.NET SDKs.
+- **Internal architecture changes**: The SDK now uses a modular endpoint-based architecture with separate classes for each OIDC operation (PAR, token retrieval, userinfo, etc.).
+- **Configuration changes**: The `client_id` parameter is no longer part of the `client` config, but moved up 1 level.  
+- **Configuration changes**: The configuration block for `client` with it's associated parameters is no longer required and has been removed. Please review the `config.ts` for the correct structure and update your configuration accordingly. 
+
+**Internal Improvements:**
+- Replaced `openid-client` dependency with custom implementation using `jose` library for JWT operations
+- Implemented custom HTTP client with mTLS support
+
+**Note:** The public API remains mostly unchanged - all existing public methods maintain the same signatures and behavior, but some of the return types may have become stricter. 
+Note that the field `codeVerifier` has been renamed from `code_verifier` to `codeVerifier` to be more in line with TypeScript naming conventions.
+
 ### 4.2.1 (Nov 27, 2025)
 
 - Updated dependencies.
@@ -433,7 +426,7 @@ The required function parameters are:
 
 ### 4.0.5 (Feb 24, 2025)
 
-- Add README.md and license files to bundle.
+- Add README.md and licence files to bundle.
 
 ### 4.0.4 (Feb 21, 2025)
 
@@ -471,7 +464,7 @@ async sendPushedAuthorisationRequest(authServerId: string, essentialClaims: stri
 
 ### 4.0.0 (Sep 23, 2024)
 
-- Updated Node version to 20.x.
+- Updated Node.js version to 20.x.
 - Removed jest and axios dependencies.
 
 ### 3.0.0 (Aug 27, 2024)
@@ -513,7 +506,7 @@ async sendPushedAuthorisationRequest(authServerId: string, essentialClaims: stri
 
 ### 2.12.0 (October 19, 2023)
 
-- Added support to Node 18.
+- Added support to Node.js 18.
 
 ### 2.11.2 (August 22, 2023)
 
@@ -592,7 +585,7 @@ async sendPushedAuthorisationRequest(authServerId: string, essentialClaims: stri
 
 ### 2.0.7 (Dec 22, 2022)
 
-- Run on Node 14 and 16 (openid-client lib does not support Node 18 yet).
+- Run on Node.js 14 and 16 (openid-client lib does not support Node.js 18 yet).
 
 ### 2.0.6 (Dec 21, 2022)
 
@@ -621,7 +614,7 @@ async sendPushedAuthorisationRequest(authServerId: string, essentialClaims: stri
 
 ### 2.0.0 (Dec 19, 2022)
 
-- Typescript support.
+- TypeScript support.
 - Breaking change: SDK imported using `require` will need to add a `default` at the end of the import.
 
 ```javascript

package/config.js

@@ -40,36 +40,7 @@ export const config = {
         // The purpose to be displayed to the consumer to indicate why their data is being requested to be shared
         // Must be between 3 and 300 chars and not contain any of the following characters: <>(){}'\
         purpose: 'verifying your identity',
-        cache_ttl: 600,
-        client: {
-            // Update with your client specific metadata. The client_id and organisation_id can be found in the registry.
-            client_id: 'https://rp.directory.sandbox.connectid.com.au/openid_relying_party/280518db-9807-4824-b080-324d94b45f6a',
-            organisation_id: 'ab837240-9618-4953-966e-90fd1fa63999',
-            jwks_uri: 'https://keystore.directory.sandbox.connectid.com.au/ab837240-9618-4953-966e-90fd1fa63999/280518db-9807-4824-b080-324d94b45f6a/application.jwks',
-            redirect_uris: ['https://demo.relyingpart.net/cb', 'https://tpp.localhost/cb'],
-            organisation_name: 'ConnectID Developer Tools Sample App',
-            organisation_number: 'ABN123123123',
-            software_description: 'App to demonstrate ConnectID end to end flows.',
-            // The following config is here for reference - you should not need to change any of it
-            application_type: 'web',
-            grant_types: ['client_credentials', 'authorization_code', 'implicit'],
-            id_token_signed_response_alg: 'PS256',
-            post_logout_redirect_uris: [],
-            require_auth_time: false,
-            response_types: ['code id_token', 'code'],
-            subject_type: 'public',
-            token_endpoint_auth_method: 'private_key_jwt',
-            token_endpoint_auth_signing_alg: 'PS256',
-            introspection_endpoint_auth_method: 'private_key_jwt',
-            revocation_endpoint_auth_method: 'private_key_jwt',
-            request_object_signing_alg: 'PS256',
-            require_signed_request_object: true,
-            require_pushed_authorization_requests: true,
-            authorization_signed_response_alg: 'PS256',
-            tls_client_certificate_bound_access_tokens: true,
-            backchannel_user_code_parameter: false,
-            scope: 'openid',
-            software_roles: ['RP-CORE'],
-        },
+        // Update with your client specific metadata. The client_id can be found in the registry.
+        client_id: 'https://rp.directory.sandbox.connectid.com.au/openid_relying_party/280518db-9807-4824-b080-324d94b45f6a',
     },
 };

package/conformance/api/conformance-api.d.ts

@@ -0,0 +1,38 @@
+interface TestModuleInstance {
+    id: string;
+    name: string;
+    url: string;
+}
+interface PlanInfo {
+    id: string;
+    name: string;
+    modules: Module[];
+}
+interface Module {
+    testModule: string;
+}
+interface TestInformation {
+    planId: string;
+    testId: string;
+    testName: string;
+    started: string;
+    status: string;
+    result: string;
+    version: string;
+}
+interface ErrorResponse {
+    error: string;
+    message: string;
+}
+declare class ConformanceApi {
+    private readonly bearerToken;
+    private readonly baseUrl;
+    constructor(bearerToken: string, baseUrl?: string);
+    createPlan(planName: string, variant: string, config: ConformanceConfig): Promise<PlanInfo>;
+    createTestFromPlan(planId: string, testName: string): Promise<TestModuleInstance>;
+    getPlanInfo(planId: string): Promise<PlanInfo>;
+    getTestInformation(testId: string): Promise<TestInformation>;
+}
+declare class ConformanceConfig {
+}
+export { ConformanceApi, ConformanceConfig, TestModuleInstance, PlanInfo, Module, TestInformation, ErrorResponse };

package/conformance/api/conformance-api.js

@@ -0,0 +1,53 @@
+import { URLSearchParams } from 'url';
+class ConformanceApi {
+    constructor(bearerToken, baseUrl = 'https://www.certification.openid.net/') {
+        this.baseUrl = baseUrl;
+        this.bearerToken = bearerToken;
+    }
+    async createPlan(planName, variant, config) {
+        const urlSearchParams = new URLSearchParams({ planName, variant }).toString();
+        console.log('bearerToken', this.bearerToken);
+        console.log('baseUrl', this.baseUrl);
+        const response = await fetch(`${this.baseUrl}api/plan?${urlSearchParams}`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${this.bearerToken}`,
+            },
+            body: JSON.stringify(config),
+        });
+        return await response.json();
+    }
+    async createTestFromPlan(planId, testName) {
+        const urlSearchParams = new URLSearchParams({ test: testName, plan: planId }).toString();
+        const response = await fetch(`${this.baseUrl}api/runner?${urlSearchParams}`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${this.bearerToken}`,
+            },
+        });
+        return await response.json();
+    }
+    async getPlanInfo(planId) {
+        const response = await fetch(`${this.baseUrl}api/plan/${planId}`, {
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${this.bearerToken}`,
+            },
+        });
+        return await response.json();
+    }
+    async getTestInformation(testId) {
+        const response = await fetch(`${this.baseUrl}api/info/${testId}`, {
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${this.bearerToken}`,
+            },
+        });
+        return await response.json();
+    }
+}
+class ConformanceConfig {
+}
+export { ConformanceApi, ConformanceConfig };

package/conformance/conformance-config.d.ts

@@ -0,0 +1,2 @@
+import { RelyingPartyClientSdkConfig } from '../types';
+export declare const conformanceConfig: RelyingPartyClientSdkConfig;

package/conformance/conformance-config.js

@@ -0,0 +1,34 @@
+export const conformanceConfig = {
+    data: {
+        // Set the signing Key Id based on what is contained in the JWKS
+        signing_kid: 'lHf9shwoF1wEES2sB9TBafbs0AVrLiU-1_ntzCrBo8A',
+        // The location of the signing certificate and key that are used for signing purposes
+        signing_key: './certs/signing.key',
+        signing_pem: './certs/signing.pem', // TODO not being used atm
+        // The content (string) of the signing certificate and key that are used for signing purposes - overrides `signing_key` and `signing_pem`
+        signing_key_content: '',
+        signing_pem_content: '', // TODO not being used atm
+        // The location of the transport certificate and key that are used for mutual TLS
+        transport_key: './certs/transport.key',
+        transport_pem: './certs/transport.pem',
+        // The content (string) of the transport certificate and key that are used for mutual TLS - overrides `transport_key` and `transport_pem`
+        transport_key_content: '',
+        transport_pem_content: '',
+        // The location of the root certificate for the trust authority
+        ca_pem: './certs/ca.pem',
+        // The content (string) of the root certificate for the trust authority - overrides `ca_pem`
+        ca_pem_content: '',
+        // This is the URL that this application is actually running on and using for callbacks (noting that multiple may be registered for the client)
+        application_redirect_uri: 'https://tpp.localhost/cb',
+        // The registry API endpoint that will list all participants with their auth server details
+        registry_participants_uri: 'https://api.sandbox.connectid.com.au/oidf-conformance/participants?alias=a/conformance-nodejs',
+        // The application logging level (info - normal logging, debug - full request/response)
+        // This MUST not be set to debug in a production environment as it will log all personal data received
+        log_level: 'info',
+        // When running the OIDC FAPI compliance suite, it requires a call to user info after successfully decoding the
+        // response claims. If this is set to true, the SDK will automatically make the call.
+        enable_auto_compliance_verification: true,
+        // Update with your client specific metadata. The client_id and organisation_id can be found in the registry.
+        client_id: 'https://rp.directory.sandbox.connectid.com.au/openid_relying_party/280518db-9807-4824-b080-324d94b45f6a',
+    },
+};

package/crypto/crypto-loader.d.ts

@@ -0,0 +1,32 @@
+import { KeyObject } from 'node:crypto';
+/**
+ * Utility class for loading cryptographic keys and certificates.
+ *
+ * Handles conversion from PEM format to Node.js crypto objects.
+ */
+export declare class CryptoLoader {
+    /**
+     * Loads a private key from PEM format.
+     *
+     * @param keyPem - Private key in PEM format (string or Buffer)
+     * @returns KeyObject that can be used for signing operations
+     * @throws Error if the key cannot be loaded
+     */
+    static loadPrivateKey(keyPem: string | Buffer): KeyObject;
+    /**
+     * Loads a certificate from PEM format.
+     *
+     * @param certPem - Certificate in PEM format (string or Buffer)
+     * @returns Certificate as string
+     */
+    static loadCertificate(certPem: string | Buffer): string;
+    /**
+     * Loads a certificate chain from PEM format.
+     *
+     * Handles single or multiple certificates in a PEM bundle.
+     *
+     * @param caPem - CA certificate(s) in PEM format (string or Buffer)
+     * @returns Array of certificates as strings
+     */
+    static loadCertificateChain(caPem: string | Buffer): string[];
+}

package/crypto/crypto-loader.js

@@ -0,0 +1,49 @@
+import { createPrivateKey } from 'node:crypto';
+/**
+ * Utility class for loading cryptographic keys and certificates.
+ *
+ * Handles conversion from PEM format to Node.js crypto objects.
+ */
+export class CryptoLoader {
+    /**
+     * Loads a private key from PEM format.
+     *
+     * @param keyPem - Private key in PEM format (string or Buffer)
+     * @returns KeyObject that can be used for signing operations
+     * @throws Error if the key cannot be loaded
+     */
+    static loadPrivateKey(keyPem) {
+        try {
+            return createPrivateKey(keyPem);
+        }
+        catch (error) {
+            throw new Error(`Failed to load private key: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Loads a certificate from PEM format.
+     *
+     * @param certPem - Certificate in PEM format (string or Buffer)
+     * @returns Certificate as string
+     */
+    static loadCertificate(certPem) {
+        return typeof certPem === 'string' ? certPem : certPem.toString('utf-8');
+    }
+    /**
+     * Loads a certificate chain from PEM format.
+     *
+     * Handles single or multiple certificates in a PEM bundle.
+     *
+     * @param caPem - CA certificate(s) in PEM format (string or Buffer)
+     * @returns Array of certificates as strings
+     */
+    static loadCertificateChain(caPem) {
+        const pemString = typeof caPem === 'string' ? caPem : caPem.toString('utf-8');
+        // Split on BEGIN CERTIFICATE markers to handle certificate chains
+        const certificates = pemString
+            .split(/(?=-----BEGIN CERTIFICATE-----)/)
+            .map((cert) => cert.trim())
+            .filter((cert) => cert.length > 0);
+        return certificates;
+    }
+}

package/crypto/jwt-helper.d.ts

@@ -0,0 +1,61 @@
+import { KeyObject } from 'node:crypto';
+import { ClaimsRequest } from '../types.js';
+/**
+ * Parameters for generating a request JWT (PAR request object).
+ */
+export interface RequestJwtParams {
+    issuer: string;
+    audience: string;
+    redirectUri: string;
+    scope: string;
+    responseType: string;
+    codeChallenge: string;
+    codeChallengeMethod: string;
+    state: string;
+    nonce: string;
+    claims: ClaimsRequest;
+    purpose: string;
+    prompt: string;
+}
+/**
+ * Helper class for JWT operations.
+ *
+ * Handles creation and signing of JWTs for:
+ * - Request objects (PAR)
+ * - Client assertions (token endpoint authentication)
+ *
+ * Uses the PS256 algorithm (RSA-PSS with SHA-256) as required by FAPI.
+ */
+export declare class JwtHelper {
+    private readonly signingKey;
+    private readonly signingKid;
+    private readonly clientId;
+    /**
+     * Creates a new JwtHelper instance.
+     *
+     * @param signingKey - Private key for signing JWTs
+     * @param signingKid - Key ID to include in JWT header
+     * @param clientId - OAuth client ID
+     */
+    constructor(signingKey: KeyObject, signingKid: string, clientId: string);
+    /**
+     * Generates a signed request JWT for PAR.
+     *
+     * The request object contains all authorization request parameters
+     * and is signed to prevent tampering.
+     *
+     * @param params - Request parameters
+     * @returns Signed JWT string
+     */
+    generateRequestJwt(params: RequestJwtParams): Promise<string>;
+    /**
+     * Generates a client assertion JWT for token endpoint authentication.
+     *
+     * The client assertion proves the client's identity using JWT-based
+     * authentication (private_key_jwt method).
+     *
+     * @param audience - Token endpoint URL (or issuer)
+     * @returns Signed JWT string
+     */
+    generateClientAssertionJwt(audience: string): Promise<string>;
+}