@eudiplo/sdk-core 5.1.0-main.f800b24 → 6.0.0

package/dist/{types.gen-yESoXBgW.d.ts → types.gen-Cg-nB7uf.d.ts}

@@ -401,7 +401,11 @@ type OfferRequestDto = {
     /**
      * The type of response expected for the offer request.
      */
-    response_type: 'uri' | 'dc-api';
+    response_type: 'uri' | 'dc-api' | 'iso-18013-7';
+    /**
+     * Authorization server id from issuer configuration. If omitted, the first enabled server is used.
+     */
+    authorization_server?: string;
     /**
      * Credential claims configuration per credential. Keys must match credentialConfigurationIds.
      */
@@ -440,10 +444,6 @@ type OfferRequestDto = {
      * List of credential configuration ids to be included in the offer.
      */
     credentialConfigurationIds: Array<string>;
-    /**
-     * Optional authorization server to be used for this issuance flow.
-     */
-    authorization_server?: string;
     /**
      * ID of the webhook endpoint to notify about the status of the issuance process.
      */
@@ -520,6 +520,16 @@ type Session = {
      * Flag indicating whether to use the DC API for the presentation request.
      */
     useDcApi: boolean;
+    /**
+     * DC API sub-protocol: "oid4vp" (OpenID4VP via DC API) or "iso-18013-7" (org.iso.mdoc).
+     * Null/undefined means the standard OID4VP flow (useDcApi=false).
+     */
+    dcApiProtocol?: string;
+    /**
+     * Browser page origin recorded at offer time for BrowserHandover session transcript.
+     * Used exclusively by the ISO 18013-7 Annex C flow.
+     */
+    browserOrigin?: string;
     /**
      * Tenant ID for multi-tenancy support.
      */
@@ -651,8 +661,9 @@ type Session = {
      */
     consumed: boolean;
     /**
-     * Timestamp when the session offer was consumed.
-     * Null if the offer has not yet been consumed.
+     * Timestamp of the first consumption event for the session offer.
+     * For OID4VCI this can be URI resolution or later flow completion.
+     * Null if no consumption event has happened yet.
      */
     consumedAt?: string;
 };
@@ -797,33 +808,45 @@ type AuthenticationMethodPresentation = {
     method: 'presentationDuringIssuance';
     config: PresentationDuringIssuanceConfig;
 };
-type UpstreamOidcConfig = {
+type ManagedAuthorizationServerConfig = {
     /**
-     * The OIDC issuer URL of the upstream provider
+     * Authorization server implementation type
      */
-    issuer: string;
+    type: 'external' | 'oid4vp' | 'chained' | 'built-in';
     /**
-     * The client ID registered with the upstream provider
+     * Unique identifier for this authorization server
      */
-    clientId: string;
+    id: string;
     /**
-     * The client secret for confidential clients
+     * Human-friendly label for the UI
      */
-    clientSecret?: string;
+    label?: string;
     /**
-     * Scopes to request from the upstream provider
+     * Whether this managed authorization server is enabled
      */
-    scopes?: Array<string>;
+    enabled?: boolean;
 };
-type ChainedAsVpConfig = {
+type ExternalAuthorizationServerConfig = {
     /**
-     * Enable VP-backed chained AS mode
+     * Authorization server implementation type
      */
-    enabled: boolean;
+    type: 'external';
     /**
-     * Presentation configuration ID used for OID4VP
+     * Unique identifier for this authorization server
      */
-    presentationConfigId: string;
+    id: string;
+    /**
+     * Human-friendly label for the UI
+     */
+    label?: string;
+    /**
+     * Whether this managed authorization server is enabled
+     */
+    enabled?: boolean;
+    /**
+     * Issuer URL for external authorization servers
+     */
+    issuer: string;
 };
 type ChainedAsTokenConfig = {
     /**
@@ -834,54 +857,114 @@ type ChainedAsTokenConfig = {
      * Key ID for token signing
      */
     signingKeyId?: string;
+    /**
+     * Whether refresh tokens should be issued
+     */
+    refreshTokenEnabled?: boolean;
+    /**
+     * Refresh token lifetime in seconds
+     */
+    refreshTokenExpiresInSeconds?: number;
 };
-type ChainedAsConfig = {
+type Oid4VpAuthorizationServerConfig = {
     /**
-     * Enable chained AS mode
+     * Authorization server implementation type
      */
-    enabled: boolean;
+    type: 'oid4vp';
+    /**
+     * Stable identifier used in the AS URL path
+     */
+    id: string;
+    /**
+     * Human-friendly label for the UI
+     */
+    label?: string;
+    /**
+     * Whether this managed authorization server is enabled
+     */
+    enabled?: boolean;
     /**
-     * Upstream OIDC provider configuration
+     * Presentation configuration ID to use for OID4VP
      */
-    upstream?: UpstreamOidcConfig;
+    presentationConfigId: string;
     /**
-     * VP-backed chained AS configuration
+     * Immediately redirect the browser into the wallet OID4VP request
      */
-    vp?: ChainedAsVpConfig;
+    immediateWalletRedirect?: boolean;
     /**
-     * Token configuration
+     * Token configuration for this authorization server
      */
     token?: ChainedAsTokenConfig;
     /**
-     * Require DPoP binding for tokens
+     * Require DPoP for token requests issued by this authorization server
      */
     requireDPoP?: boolean;
 };
-type ManagedAuthorizationServerConfig = {
+type UpstreamOidcConfig = {
     /**
-     * Stable identifier used in the AS URL path
+     * The OIDC issuer URL of the upstream provider
+     */
+    issuer: string;
+    /**
+     * The client ID registered with the upstream provider
+     */
+    clientId: string;
+    /**
+     * The client secret for confidential clients
+     */
+    clientSecret?: string;
+    /**
+     * Scopes to request from the upstream provider
+     */
+    scopes?: Array<string>;
+};
+type ChainedAuthorizationServerConfig = {
+    /**
+     * Authorization server implementation type
+     */
+    type: 'chained';
+    /**
+     * Unique identifier for this authorization server
      */
     id: string;
     /**
      * Human-friendly label for the UI
      */
     label?: string;
+    /**
+     * Whether this managed authorization server is enabled
+     */
+    enabled?: boolean;
+    /**
+     * Upstream OIDC provider configuration for chained mode
+     */
+    upstream: UpstreamOidcConfig;
+    /**
+     * Token configuration for this authorization server
+     */
+    token?: ChainedAsTokenConfig;
+    /**
+     * Require DPoP for token requests issued by this authorization server
+     */
+    requireDPoP?: boolean;
+};
+type BuiltInAuthorizationServerConfig = {
     /**
      * Authorization server implementation type
      */
-    type: 'oid4vp';
+    type: 'built-in';
     /**
-     * Whether this managed authorization server is enabled
+     * Unique identifier for this authorization server
      */
-    enabled?: boolean;
+    id: string;
     /**
-     * Presentation configuration ID to use for OID4VP
+     * Human-friendly label for the UI
      */
-    presentationConfigId: string;
+    label?: string;
     /**
-     * Immediately redirect the browser into the wallet OID4VP request
+     * Whether this managed authorization server is enabled
      */
-    immediateWalletRedirect?: boolean;
+    enabled?: boolean;
     /**
      * Token configuration for this authorization server
      */
@@ -927,6 +1010,66 @@ type FederationConfig = {
      */
     trustAnchors: Array<FederationTrustAnchorConfig>;
 };
+type IssuerProvidedAttestation = {
+    /**
+     * Attestation format as expected by the registrar (for example dc+sd-jwt, mso_mdoc).
+     */
+    format?: string;
+    /**
+     * Arbitrary attestation metadata forwarded to the registrar.
+     */
+    meta?: {
+        [key: string]: unknown;
+    };
+};
+type IssuerRegistrationCertificateConfig = {
+    /**
+     * Enable inclusion of a registration certificate in credential issuer metadata.
+     */
+    enabled?: boolean;
+    /**
+     * import: use an existing JWT, generate: create via registrar from provided attestations and selected credential configurations.
+     */
+    mode?: 'import' | 'generate';
+    /**
+     * Existing registration certificate JWT used when mode is import.
+     */
+    jwt?: string;
+    /**
+     * Schema metadata IDs selected for inclusion in generated registration certificates.
+     */
+    schemaMetadataIds?: Array<string>;
+    /**
+     * Privacy policy URL used when generating a registration certificate (optional if registrar defaults are configured).
+     */
+    privacyPolicy?: string;
+    /**
+     * Support URI used when generating a registration certificate (optional if registrar defaults are configured).
+     */
+    supportUri?: string;
+    /**
+     * Provided attestations included in generated registration certificates.
+     */
+    providedAttestations?: Array<IssuerProvidedAttestation>;
+};
+type IssuerRegistrationCertificateCache = {
+    /**
+     * Cached registration certificate JWT generated by EUDIPLO.
+     */
+    readonly jwt?: string;
+    /**
+     * Config fingerprint used to detect cache invalidation.
+     */
+    readonly fingerprint?: string;
+    /**
+     * JWT iat claim, seconds since epoch.
+     */
+    readonly issuedAt?: number;
+    /**
+     * JWT exp claim, seconds since epoch.
+     */
+    readonly expiresAt?: number;
+};
 type DisplayLogo = {
     uri: string;
     alt_text?: string;
@@ -942,26 +1085,23 @@ type IssuanceConfig = {
      */
     signingKeyId?: string;
     /**
-     * Configuration for Chained Authorization Server mode.
-     * When enabled, EUDIPLO acts as an OAuth AS facade, delegating user authentication
-     * to an upstream OIDC provider while issuing its own tokens with issuer_state.
-     */
-    chainedAs?: ChainedAsConfig;
-    /**
-     * Dedicated managed authorization servers hosted by this issuer.
-     * Each entry creates a distinct AS endpoint and can be bound to a different
-     * presentation configuration.
+     * Dedicated managed authorization servers hosted by this issuer. At least one entry is required.
      */
-    authorizationServers?: Array<ManagedAuthorizationServerConfig>;
+    authorizationServers: Array<ExternalAuthorizationServerConfig | Oid4VpAuthorizationServerConfig | ChainedAuthorizationServerConfig | BuiltInAuthorizationServerConfig>;
     /**
      * Optional OpenID Federation configuration used for trust evaluation.
      * When omitted, trust checks rely on existing LoTE trust-list behavior.
      */
     federation?: FederationConfig;
     /**
-     * Whether refresh tokens should be issued for OID4VCI token responses.
+     * Optional registration certificate configuration for issuer metadata (`issuer_info`).
+     * Supports importing an existing JWT or generating one via registrar.
      */
-    refreshTokenEnabled?: boolean;
+    registrationCertificate?: IssuerRegistrationCertificateConfig;
+    /**
+     * Server-managed cache for generated issuer registration certificates.
+     */
+    readonly registrationCertificateCache?: IssuerRegistrationCertificateCache;
     /**
      * Whether `credential_response_encryption` should be advertised in the credential issuer metadata.
      */
@@ -970,10 +1110,6 @@ type IssuanceConfig = {
      * Whether `credential_request_encryption` should be advertised in the credential issuer metadata.
      */
     credentialRequestEncryption?: boolean;
-    /**
-     * Refresh token lifetime in seconds. Defaults to 2592000 (30 days).
-     */
-    refreshTokenExpiresInSeconds?: number;
     /**
      * Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5.
      */
@@ -982,10 +1118,6 @@ type IssuanceConfig = {
      * The tenant that owns this object.
      */
     tenant: TenantEntity;
-    /**
-     * Authentication server URL for the issuance process.
-     */
-    authServers?: Array<string>;
     /**
      * Value to determine the amount of credentials that are issued in a batch.
      * Default is 1.
@@ -1007,13 +1139,6 @@ type IssuanceConfig = {
      * If empty and walletAttestationRequired is true, all wallet providers are rejected.
      */
     walletProviderTrustLists?: Array<string>;
-    /**
-     * The URL of the preferred authorization server for wallet-initiated flows.
-     * When set, this AS is placed first in the `authorization_servers` array
-     * of the credential issuer metadata, signaling wallets to use it by default.
-     * Must match one of the configured auth servers, the chained AS URL, or "built-in".
-     */
-    preferredAuthServer?: string;
     display: Array<DisplayInfo>;
     /**
      * The timestamp when the VP request was created.
@@ -1024,32 +1149,29 @@ type IssuanceConfig = {
      */
     updatedAt: string;
 };
-type IssuanceDto = {
+type UpdateIssuanceDto = {
     /**
      * Key ID for signing access tokens. If unset, the default signing key is used.
      */
     signingKeyId?: string;
     /**
-     * Configuration for Chained Authorization Server mode.
-     * When enabled, EUDIPLO acts as an OAuth AS facade, delegating user authentication
-     * to an upstream OIDC provider while issuing its own tokens with issuer_state.
-     */
-    chainedAs?: ChainedAsConfig;
-    /**
-     * Dedicated managed authorization servers hosted by this issuer.
-     * Each entry creates a distinct AS endpoint and can be bound to a different
-     * presentation configuration.
+     * Dedicated managed authorization servers hosted by this issuer. At least one entry is required.
      */
-    authorizationServers?: Array<ManagedAuthorizationServerConfig>;
+    authorizationServers?: Array<ExternalAuthorizationServerConfig | Oid4VpAuthorizationServerConfig | ChainedAuthorizationServerConfig | BuiltInAuthorizationServerConfig>;
     /**
      * Optional OpenID Federation configuration used for trust evaluation.
      * When omitted, trust checks rely on existing LoTE trust-list behavior.
      */
     federation?: FederationConfig;
     /**
-     * Whether refresh tokens should be issued for OID4VCI token responses.
+     * Optional registration certificate configuration for issuer metadata (`issuer_info`).
+     * Supports importing an existing JWT or generating one via registrar.
      */
-    refreshTokenEnabled?: boolean;
+    registrationCertificate?: IssuerRegistrationCertificateConfig;
+    /**
+     * Server-managed cache for generated issuer registration certificates.
+     */
+    readonly registrationCertificateCache?: IssuerRegistrationCertificateCache;
     /**
      * Whether `credential_response_encryption` should be advertised in the credential issuer metadata.
      */
@@ -1058,18 +1180,10 @@ type IssuanceDto = {
      * Whether `credential_request_encryption` should be advertised in the credential issuer metadata.
      */
     credentialRequestEncryption?: boolean;
-    /**
-     * Refresh token lifetime in seconds. Defaults to 2592000 (30 days).
-     */
-    refreshTokenExpiresInSeconds?: number;
     /**
      * Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5.
      */
     txCodeMaxAttempts?: number;
-    /**
-     * Authentication server URL for the issuance process.
-     */
-    authServers?: Array<string>;
     /**
      * Value to determine the amount of credentials that are issued in a batch.
      * Default is 1.
@@ -1091,14 +1205,7 @@ type IssuanceDto = {
      * If empty and walletAttestationRequired is true, all wallet providers are rejected.
      */
     walletProviderTrustLists?: Array<string>;
-    /**
-     * The URL of the preferred authorization server for wallet-initiated flows.
-     * When set, this AS is placed first in the `authorization_servers` array
-     * of the credential issuer metadata, signaling wallets to use it by default.
-     * Must match one of the configured auth servers, the chained AS URL, or "built-in".
-     */
-    preferredAuthServer?: string;
-    display: Array<DisplayInfo>;
+    display?: Array<DisplayInfo>;
 };
 type ClaimsQuery = {
     id?: string;
@@ -1110,6 +1217,10 @@ type TrustedAuthorityQuery = {
     values: Array<string>;
 };
 type CredentialQuery = {
+    /**
+     * Ordered alternative claim combinations for this credential query.
+     */
+    claim_sets?: Array<Array<string>>;
     id: string;
     format: string;
     multiple?: boolean;
@@ -1233,10 +1344,6 @@ type TrustAuthorityEntry = {
      * URI of the trust list or trust anchor (ignored when trustListId is set)
      */
     value?: string;
-    /**
-     * Whether this trust authority is a List of Trusted Entities (LoTE)
-     */
-    isLoTE?: boolean;
     /**
      * Optional verification material for external trusted authorities (for example a JWK). For internal trust-list URLs, EUDIPLO resolves verification material from the database.
      */
@@ -1353,7 +1460,7 @@ type ClaimFieldDefinitionDto = {
      */
     disclosable?: boolean;
     /**
-     * Namespace for mDOC field
+     * Namespace for mDOC field. Optional when the namespace is already present as the first path segment.
      */
     namespace?: string;
     display?: Array<FieldDisplayDto>;
@@ -1628,13 +1735,9 @@ type CredentialConfigUpdate = {
 };
 type SignSchemaMetaConfigDto = {
     /**
-     * The schema metadata configuration to sign and submit
+     * The schema metadata configuration to submit. Registrar builds and signs the final schema metadata.
      */
     config: SchemaMetaConfig;
-    /**
-     * ID of the key chain to use for signing. Defaults to the tenant's default key chain.
-     */
-    keyChainId?: string;
     /**
      * ID of the credential config to link back after submission. When provided, schemaMeta.id on the credential config is updated with the reserved attestation ID.
      */
@@ -1642,13 +1745,9 @@ type SignSchemaMetaConfigDto = {
 };
 type SignVersionSchemaMetaConfigDto = {
     /**
-     * The schema metadata configuration to sign and submit as a new version. Must include the existing id.
+     * The schema metadata configuration to submit as a new version. Must include the existing id.
      */
     config: SchemaMetaConfig;
-    /**
-     * ID of the key chain to use for signing. Defaults to the tenant's default key chain.
-     */
-    keyChainId?: string;
 };
 type VocabularyEntryDto = {
     /**
@@ -1696,9 +1795,9 @@ type MetadataSchemaDto = {
      */
     uri?: string;
     /**
-     * Inline schema content (JSON Schema)
+     * Format-specific metadata for the schema entry
      */
-    schemaContent?: {
+    meta?: {
         [key: string]: unknown;
     };
     /**
@@ -1786,10 +1885,6 @@ type SchemaMetadataResponseDto = {
      * Issuer from the JWT (`iss` claim)
      */
     issuer: string;
-    /**
-     * Serial number of the access certificate that signed this schema metadata
-     */
-    signerCertificateSerial: string;
     /**
      * The access certificate used to sign this schema metadata
      */
@@ -1809,7 +1904,7 @@ type SchemaMetadataResponseDto = {
     /**
      * Whether this version is deprecated
      */
-    deprecated?: boolean;
+    deprecated: boolean;
     /**
      * Deprecation message shown to consumers
      */
@@ -1818,6 +1913,10 @@ type SchemaMetadataResponseDto = {
      * The version that supersedes this one
      */
     supersededByVersion?: string;
+    /**
+     * Timestamp when this version was marked as deprecated
+     */
+    deprecatedAt?: string;
 };
 type UpdateSchemaMetadataDto = {
     /**
@@ -1907,11 +2006,7 @@ type TrustListCreateDto = {
     data?: {
         [key: string]: unknown;
     };
-    entities: Array<({
-        type: 'internal';
-    } & InternalTrustListEntity) | ({
-        type: 'external';
-    } & ExternalTrustListEntity)>;
+    entities: Array<InternalTrustListEntity | ExternalTrustListEntity>;
     id?: string;
     keyChainId?: string;
 };
@@ -2110,6 +2205,12 @@ type ResolveSchemaMetadataDto = {
      */
     schemaMetadataUrl: string;
 };
+type ResolveSchemaMetadataJwtDto = {
+    /**
+     * Signed schema metadata JWT to resolve server-side. The JWT will be verified, resolved, and converted to DCQL.
+     */
+    signedJwt: string;
+};
 type PresentationConfigCreateDto = {
     /**
      * Unique identifier for the VP request.
@@ -2334,53 +2435,137 @@ type NotificationRequestDto = {
     notification_id: string;
     event: 'credential_accepted' | 'credential_failure' | 'credential_deleted';
 };
-type Object$1 = {
-    [key: string]: unknown;
-};
-type ParResponseDto = {
+type OfferResponse = {
+    uri: string;
     /**
-     * The request URI for the Pushed Authorization Request.
+     * URI for cross-device flows (no redirect after completion)
      */
-    request_uri: string;
+    crossDeviceUri?: string;
+    session: string;
+};
+type CompleteDeferredDto = {
     /**
-     * The expiration time for the request URI in seconds.
+     * Claims to include in the credential. The structure should match the credential configuration's expected claims.
      */
-    expires_in: number;
+    claims: {
+        [key: string]: unknown;
+    };
 };
-type InteractiveAuthorizationRequestDto = {
+type DeferredOperationResponse = {
     /**
-     * Response type (for initial request)
+     * The transaction ID
      */
-    response_type?: string;
+    transactionId: string;
     /**
-     * Client identifier (for initial request)
+     * The new status of the transaction
      */
-    client_id?: string;
+    status: 'pending' | 'ready' | 'retrieved' | 'expired' | 'failed';
     /**
-     * Comma-separated list of supported interaction types (for initial request)
+     * Optional message
      */
-    interaction_types_supported?: string;
+    message?: string;
+};
+type FailDeferredDto = {
     /**
-     * Redirect URI (for initial request)
+     * Optional error message explaining why the issuance failed
      */
-    redirect_uri?: string;
+    error?: string;
+};
+type EcPublic = {
     /**
-     * OAuth scope
+     * The key type, which is always 'EC' for Elliptic Curve keys.
      */
-    scope?: string;
+    kty: string;
     /**
-     * PKCE code challenge
+     * The algorithm intended for use with the key, such as 'ES256'.
      */
-    code_challenge?: string;
+    crv: string;
     /**
-     * PKCE code challenge method
+     * The x coordinate of the EC public key.
      */
-    code_challenge_method?: string;
+    x: string;
     /**
-     * Authorization details
+     * The y coordinate of the EC public key.
      */
-    authorization_details?: {
-        [key: string]: unknown;
+    y: string;
+};
+type JwksResponseDto = {
+    /**
+     * An array of EC public keys in JWK format.
+     */
+    keys: Array<EcPublic>;
+};
+type AuthorizationResponse = {
+    /**
+     * The response string containing the authorization details (JWE-encrypted VP token).
+     * Required for success responses, absent for error responses.
+     */
+    response?: string;
+    /**
+     * When set to true, the authorization response will be sent to the client.
+     */
+    sendResponse?: boolean;
+    error?: string;
+    /**
+     * Human-readable description of the error.
+     */
+    error_description?: string;
+    /**
+     * URI with additional information about the error.
+     */
+    error_uri?: string;
+    /**
+     * State value from the authorization request (for correlation).
+     */
+    state?: string;
+};
+type Object$1 = {
+    [key: string]: unknown;
+};
+type ParResponseDto = {
+    /**
+     * The request URI for the Pushed Authorization Request.
+     */
+    request_uri: string;
+    /**
+     * The expiration time for the request URI in seconds.
+     */
+    expires_in: number;
+};
+type InteractiveAuthorizationRequestDto = {
+    /**
+     * Response type (for initial request)
+     */
+    response_type?: string;
+    /**
+     * Client identifier (for initial request)
+     */
+    client_id?: string;
+    /**
+     * Comma-separated list of supported interaction types (for initial request)
+     */
+    interaction_types_supported?: string;
+    /**
+     * Redirect URI (for initial request)
+     */
+    redirect_uri?: string;
+    /**
+     * OAuth scope
+     */
+    scope?: string;
+    /**
+     * PKCE code challenge
+     */
+    code_challenge?: string;
+    /**
+     * PKCE code challenge method
+     */
+    code_challenge_method?: string;
+    /**
+     * Authorization details
+     */
+    authorization_details?: {
+        [key: string]: unknown;
     };
     /**
      * State parameter
@@ -2513,139 +2698,285 @@ type ChainedAsTokenResponseDto = {
      */
     refresh_token?: string;
 };
-type OfferResponse = {
-    uri: string;
+type KmsProviderCapabilitiesDto = {
     /**
-     * URI for cross-device flows (no redirect after completion)
+     * Whether the provider supports importing existing keys.
      */
-    crossDeviceUri?: string;
-    session: string;
-};
-type CompleteDeferredDto = {
+    canImport: boolean;
     /**
-     * Claims to include in the credential. The structure should match the credential configuration's expected claims.
+     * Whether the provider supports generating new keys.
      */
-    claims: {
-        [key: string]: unknown;
-    };
+    canCreate: boolean;
+    /**
+     * Whether the provider supports deleting keys.
+     */
+    canDelete: boolean;
+    /**
+     * Signing algorithms supported by the provider.
+     */
+    supportedAlgs: Array<string>;
+    /**
+     * Default signing algorithm used when caller does not specify one.
+     */
+    defaultAlg: string;
 };
-type DeferredOperationResponse = {
+type KmsProviderInfoDto = {
     /**
-     * The transaction ID
+     * Unique provider ID (matches the id in kms.json).
      */
-    transactionId: string;
+    name: string;
     /**
-     * The new status of the transaction
+     * Type of the KMS provider (db, vault, aws-kms).
      */
-    status: 'pending' | 'ready' | 'retrieved' | 'expired' | 'failed';
+    type: string;
     /**
-     * Optional message
+     * Human-readable description of this provider instance.
      */
-    message?: string;
+    description?: string;
+    /**
+     * Capabilities of this provider.
+     */
+    capabilities: KmsProviderCapabilitiesDto;
 };
-type FailDeferredDto = {
+type KmsProvidersResponseDto = {
     /**
-     * Optional error message explaining why the issuance failed
+     * Detailed info for each registered KMS provider.
      */
-    error?: string;
+    providers: Array<KmsProviderInfoDto>;
+    /**
+     * The default KMS provider name.
+     */
+    default: string;
 };
-type EcPublic = {
+type DbKmsConfigDto = {
     /**
-     * The key type, which is always 'EC' for Elliptic Curve keys.
+     * Unique identifier for this provider instance. Used when generating keys to specify which provider to use.
      */
-    kty: string;
+    id: string;
     /**
-     * The algorithm intended for use with the key, such as 'ES256'.
+     * Type of the KMS provider.
      */
-    crv: string;
+    type: 'db';
     /**
-     * The x coordinate of the EC public key.
+     * Human-readable description of this provider instance.
      */
-    x: string;
+    description?: string;
+};
+type VaultKmsConfigDto = {
     /**
-     * The y coordinate of the EC public key.
+     * Unique identifier for this provider instance. Used when generating keys to specify which provider to use.
      */
-    y: string;
+    id: string;
+    /**
+     * Type of the KMS provider.
+     */
+    type: 'vault';
+    /**
+     * Human-readable description of this provider instance.
+     */
+    description?: string;
+    /**
+     * URL of the HashiCorp Vault instance. Supports ${ENV_VAR} placeholders.
+     */
+    vaultUrl: string;
+    /**
+     * Authentication token for HashiCorp Vault. Supports ${ENV_VAR} placeholders.
+     */
+    vaultToken: string;
 };
-type JwksResponseDto = {
+type AwsKmsConfigDto = {
     /**
-     * An array of EC public keys in JWK format.
+     * Unique identifier for this provider instance. Used when generating keys to specify which provider to use.
      */
-    keys: Array<EcPublic>;
+    id: string;
+    /**
+     * Type of the KMS provider.
+     */
+    type: 'aws-kms';
+    /**
+     * Human-readable description of this provider instance.
+     */
+    description?: string;
+    /**
+     * AWS region for KMS. Supports ${ENV_VAR} placeholders.
+     */
+    region: string;
+    /**
+     * AWS access key ID. Optional — uses SDK credential chain if not provided. Supports ${ENV_VAR} placeholders.
+     */
+    accessKeyId?: string;
+    /**
+     * AWS secret access key. Optional — uses SDK credential chain if not provided. Supports ${ENV_VAR} placeholders.
+     */
+    secretAccessKey?: string;
 };
-type AuthorizationResponse = {
+type Pkcs11KmsConfigDto = {
     /**
-     * The response string containing the authorization details (JWE-encrypted VP token).
-     * Required for success responses, absent for error responses.
+     * Unique identifier for this provider instance. Used when generating keys to specify which provider to use.
      */
-    response?: string;
+    id: string;
     /**
-     * When set to true, the authorization response will be sent to the client.
+     * Type of the KMS provider.
      */
-    sendResponse?: boolean;
-    error?: string;
+    type: 'pkcs11';
     /**
-     * Human-readable description of the error.
+     * Human-readable description of this provider instance.
      */
-    error_description?: string;
+    description?: string;
     /**
-     * URI with additional information about the error.
+     * Absolute path to the PKCS#11 module library (.so/.dll/.dylib). Supports ${ENV_VAR} placeholders.
      */
-    error_uri?: string;
+    library: string;
     /**
-     * State value from the authorization request (for correlation).
+     * Slot selection. Either the numeric slot index (as a string for ENV interpolation, or a number) or the token label. Supports ${ENV_VAR} placeholders.
      */
-    state?: string;
+    slot: {
+        [key: string]: unknown;
+    };
+    /**
+     * User PIN used for C_Login. Supports ${ENV_VAR} placeholders.
+     */
+    pin: string;
+    /**
+     * Open the PKCS#11 session in read-only mode. Defaults to false.
+     */
+    readOnly?: boolean;
 };
-type KmsProviderCapabilitiesDto = {
+type HttpAuthBaseConfigDto = {
     /**
-     * Whether the provider supports importing existing keys.
+     * Authentication method for the remote KMS service.
      */
-    canImport: boolean;
+    type: 'none' | 'bearer' | 'oauth2-client-credentials' | 'mtls';
+};
+type HttpKmsConfigDto = {
     /**
-     * Whether the provider supports generating new keys.
+     * Unique identifier for this provider instance. Used when generating keys to specify which provider to use.
      */
-    canCreate: boolean;
+    id: string;
     /**
-     * Whether the provider supports deleting keys.
+     * Type of the KMS provider.
      */
-    canDelete: boolean;
+    type: 'http';
     /**
-     * Signing algorithms supported by the provider.
+     * Human-readable description of this provider instance.
      */
-    supportedAlgs: Array<string>;
+    description?: string;
     /**
-     * Default signing algorithm used when caller does not specify one.
+     * Base URL of the remote KMS microservice (no trailing slash). Supports ${ENV_VAR} placeholders.
      */
-    defaultAlg: string;
+    baseUrl: string;
+    /**
+     * Authentication method for the remote KMS service. Supports bearer token, OAuth 2.0 client credentials, and mutual TLS. Omit (or set type to "none") for unauthenticated services.
+     */
+    auth?: HttpAuthBaseConfigDto;
+    /**
+     * Path prefix for key endpoints on the remote service. Defaults to /keys.
+     */
+    keysPath?: string;
+    /**
+     * Path for the health check endpoint on the remote service. Defaults to /health.
+     */
+    healthPath?: string;
+    /**
+     * Whether the remote service supports key import via POST {keysPath}/{kid}/import. Defaults to false.
+     */
+    canImport?: boolean;
 };
-type KmsProviderInfoDto = {
+type CscAuthorizeAuthDataDto = {
     /**
-     * Unique provider ID (matches the id in kms.json).
+     * Authentication factor identifier expected by the CSC provider (e.g., PIN, OTP).
      */
-    name: string;
+    id: string;
     /**
-     * Type of the KMS provider (db, vault, aws-kms).
+     * Authentication factor value sent to CSC credentials/authorize.
      */
-    type: string;
+    value: string;
+};
+type CscKmsConfigDto = {
+    /**
+     * Unique identifier for this provider instance. Used when generating keys to specify which provider to use.
+     */
+    id: string;
+    /**
+     * Type of the KMS provider.
+     */
+    type: 'csc';
     /**
      * Human-readable description of this provider instance.
      */
     description?: string;
     /**
-     * Capabilities of this provider.
+     * Base URL of the CSC service (without trailing slash). Supports ${ENV_VAR} placeholders.
      */
-    capabilities: KmsProviderCapabilitiesDto;
+    baseUrl: string;
+    /**
+     * OAuth2 token endpoint URL for client-credentials flow. Supports ${ENV_VAR} placeholders.
+     */
+    tokenUrl: string;
+    /**
+     * OAuth2 client ID. Supports ${ENV_VAR} placeholders.
+     */
+    clientId: string;
+    /**
+     * OAuth2 client secret. Supports ${ENV_VAR} placeholders.
+     */
+    clientSecret: string;
+    /**
+     * OAuth2 scope to request during token acquisition.
+     */
+    scope?: string;
+    /**
+     * Default CSC credential ID. If omitted, the adapter calls credentials/list and picks the first entry.
+     */
+    credentialId?: string;
+    /**
+     * Optional CSC user ID used in credentials/list requests.
+     */
+    userId?: string;
+    /**
+     * CSC API path prefix appended to baseUrl. Defaults to /csc/v2.
+     */
+    apiPath?: string;
+    /**
+     * Hash algorithm OID for signatures/signHash and credentials/authorize. Defaults to SHA-256 OID.
+     */
+    hashAlgorithmOid?: string;
+    /**
+     * Signature algorithm OID for signatures/signHash. Defaults to ecdsa-with-SHA256 OID.
+     */
+    signAlgorithmOid?: string;
+    /**
+     * Static SAD token. If set, the adapter sends it directly in signatures/signHash requests.
+     */
+    sad?: string;
+    /**
+     * When true and no static SAD is provided, the adapter calls credentials/authorize to obtain SAD before signatures/signHash.
+     */
+    useAuthorizeEndpoint?: boolean;
+    /**
+     * Optional authData array passed to credentials/authorize (e.g., PIN/OTP factors).
+     */
+    authorizeAuthData?: Array<CscAuthorizeAuthDataDto>;
 };
-type KmsProvidersResponseDto = {
+type KmsConfigDto = {
     /**
-     * Detailed info for each registered KMS provider.
+     * ID of the default KMS provider. Defaults to "db" if not set.
      */
-    providers: Array<KmsProviderInfoDto>;
+    defaultProvider?: string;
     /**
-     * The default KMS provider name.
+     * List of KMS provider configurations. Each provider must have a unique id and a type.
      */
-    default: string;
+    providers: Array<DbKmsConfigDto | VaultKmsConfigDto | AwsKmsConfigDto | Pkcs11KmsConfigDto | HttpKmsConfigDto | CscKmsConfigDto>;
+};
+type KmsTenantConfigResponseDto = {
+    /**
+     * Tenant-specific KMS configuration from <CONFIG_FOLDER>/<tenantId>/kms.json. Null when no tenant file exists.
+     */
+    tenantConfig?: KmsConfigDto;
+    /**
+     * Effective configuration used at runtime for the tenant (global + tenant merge).
+     */
+    effectiveConfig: KmsConfigDto;
 };
 type CertificateInfoDto = {
     /**
@@ -2918,7 +3249,7 @@ type KeyChainImportDto = {
      */
     usageType: 'access' | 'attestation' | 'trustList' | 'statusList' | 'encrypt';
     /**
-     * Certificate chain in PEM format (leaf first, then intermediates/CA).
+     * Certificate chain (leaf first). Each entry may be PEM or base64-encoded DER; values are normalized to PEM during import.
      */
     crt?: Array<string>;
     /**
@@ -2962,7 +3293,7 @@ type PresentationRequest = {
     /**
      * The type of response expected from the presentation request.
      */
-    response_type: 'uri' | 'dc-api';
+    response_type: 'uri' | 'dc-api' | 'iso-18013-7';
     /**
      * Identifier of the presentation configuration
      */
@@ -2973,23 +3304,143 @@ type PresentationRequest = {
      */
     webhook?: WebhookConfig;
     /**
-     * Optional redirect URI to which the user-agent should be redirected after the presentation is completed.
-     * You can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID.
+     * Optional redirect URI to which the user-agent should be redirected after the presentation is completed.
+     * You can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID.
+     */
+    redirectUri?: string;
+    /**
+     * Optional expected browser origin for DC API key-binding audience.
+     * Example: "http://localhost:8080"
+     */
+    expected_origin?: string;
+    /**
+     * Optional transaction data to include in the OID4VP request.
+     * If provided, this will override the transaction_data from the presentation configuration.
+     */
+    transaction_data?: Array<TransactionData>;
+};
+type FileUploadDto = {
+    file: Blob | File;
+};
+type IssuanceConfigWritable = {
+    /**
+     * Key ID for signing access tokens. If unset, the default signing key is used.
+     */
+    signingKeyId?: string;
+    /**
+     * Dedicated managed authorization servers hosted by this issuer. At least one entry is required.
+     */
+    authorizationServers: Array<ExternalAuthorizationServerConfig | Oid4VpAuthorizationServerConfig | ChainedAuthorizationServerConfig | BuiltInAuthorizationServerConfig>;
+    /**
+     * Optional OpenID Federation configuration used for trust evaluation.
+     * When omitted, trust checks rely on existing LoTE trust-list behavior.
+     */
+    federation?: FederationConfig;
+    /**
+     * Optional registration certificate configuration for issuer metadata (`issuer_info`).
+     * Supports importing an existing JWT or generating one via registrar.
+     */
+    registrationCertificate?: IssuerRegistrationCertificateConfig;
+    /**
+     * Whether `credential_response_encryption` should be advertised in the credential issuer metadata.
+     */
+    credentialResponseEncryption?: boolean;
+    /**
+     * Whether `credential_request_encryption` should be advertised in the credential issuer metadata.
+     */
+    credentialRequestEncryption?: boolean;
+    /**
+     * Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5.
+     */
+    txCodeMaxAttempts?: number;
+    /**
+     * The tenant that owns this object.
+     */
+    tenant: TenantEntity;
+    /**
+     * Value to determine the amount of credentials that are issued in a batch.
+     * Default is 1.
+     */
+    batchSize?: number;
+    /**
+     * Indicates whether DPoP is required for the issuance process. Default value is true.
+     */
+    dPopRequired?: boolean;
+    /**
+     * Indicates whether wallet attestation is required for the token endpoint.
+     * When enabled, wallets must provide OAuth-Client-Attestation headers.
+     * Default value is false.
+     */
+    walletAttestationRequired?: boolean;
+    /**
+     * URLs of trust lists containing trusted wallet providers.
+     * The wallet attestation's X.509 certificate will be validated against these trust lists.
+     * If empty and walletAttestationRequired is true, all wallet providers are rejected.
+     */
+    walletProviderTrustLists?: Array<string>;
+    display: Array<DisplayInfo>;
+    /**
+     * The timestamp when the VP request was created.
+     */
+    createdAt: string;
+    /**
+     * The timestamp when the VP request was last updated.
+     */
+    updatedAt: string;
+};
+type UpdateIssuanceDtoWritable = {
+    /**
+     * Key ID for signing access tokens. If unset, the default signing key is used.
+     */
+    signingKeyId?: string;
+    /**
+     * Dedicated managed authorization servers hosted by this issuer. At least one entry is required.
+     */
+    authorizationServers?: Array<ExternalAuthorizationServerConfig | Oid4VpAuthorizationServerConfig | ChainedAuthorizationServerConfig | BuiltInAuthorizationServerConfig>;
+    /**
+     * Optional OpenID Federation configuration used for trust evaluation.
+     * When omitted, trust checks rely on existing LoTE trust-list behavior.
+     */
+    federation?: FederationConfig;
+    /**
+     * Optional registration certificate configuration for issuer metadata (`issuer_info`).
+     * Supports importing an existing JWT or generating one via registrar.
+     */
+    registrationCertificate?: IssuerRegistrationCertificateConfig;
+    /**
+     * Whether `credential_response_encryption` should be advertised in the credential issuer metadata.
+     */
+    credentialResponseEncryption?: boolean;
+    /**
+     * Whether `credential_request_encryption` should be advertised in the credential issuer metadata.
+     */
+    credentialRequestEncryption?: boolean;
+    /**
+     * Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5.
+     */
+    txCodeMaxAttempts?: number;
+    /**
+     * Value to determine the amount of credentials that are issued in a batch.
+     * Default is 1.
+     */
+    batchSize?: number;
+    /**
+     * Indicates whether DPoP is required for the issuance process. Default value is true.
      */
-    redirectUri?: string;
+    dPopRequired?: boolean;
     /**
-     * Optional expected browser origin for DC API key-binding audience.
-     * Example: "http://localhost:8080"
+     * Indicates whether wallet attestation is required for the token endpoint.
+     * When enabled, wallets must provide OAuth-Client-Attestation headers.
+     * Default value is false.
      */
-    expected_origin?: string;
+    walletAttestationRequired?: boolean;
     /**
-     * Optional transaction data to include in the OID4VP request.
-     * If provided, this will override the transaction_data from the presentation configuration.
+     * URLs of trust lists containing trusted wallet providers.
+     * The wallet attestation's X.509 certificate will be validated against these trust lists.
+     * If empty and walletAttestationRequired is true, all wallet providers are rejected.
      */
-    transaction_data?: Array<TransactionData>;
-};
-type FileUploadDto = {
-    file: Blob | File;
+    walletProviderTrustLists?: Array<string>;
+    display?: Array<DisplayInfo>;
 };
 type PresentationConfigWritable = {
     /**
@@ -3584,7 +4035,7 @@ type IssuanceConfigControllerGetIssuanceConfigurationsResponses = {
 };
 type IssuanceConfigControllerGetIssuanceConfigurationsResponse = IssuanceConfigControllerGetIssuanceConfigurationsResponses[keyof IssuanceConfigControllerGetIssuanceConfigurationsResponses];
 type IssuanceConfigControllerStoreIssuanceConfigurationData = {
-    body: IssuanceDto;
+    body: UpdateIssuanceDtoWritable;
     path?: never;
     query?: never;
     url: '/api/issuer/config';
@@ -3657,36 +4108,60 @@ type CredentialConfigControllerUpdateCredentialConfigurationResponses = {
     };
 };
 type CredentialConfigControllerUpdateCredentialConfigurationResponse = CredentialConfigControllerUpdateCredentialConfigurationResponses[keyof CredentialConfigControllerUpdateCredentialConfigurationResponses];
-type SchemaMetadataControllerSignSchemaMetaConfigData = {
+type SchemaMetadataControllerPublishSchemaMetadataData = {
     body: SignSchemaMetaConfigDto;
     path?: never;
     query?: never;
-    url: '/api/schema-metadata/sign';
+    url: '/api/schema-metadata/publish';
 };
-type SchemaMetadataControllerSignSchemaMetaConfigErrors = {
+type SchemaMetadataControllerPublishSchemaMetadataErrors = {
     /**
-     * Invalid schema metadata or missing certificate for signing
+     * Invalid schema metadata input or file mapping
      */
     400: unknown;
 };
+type SchemaMetadataControllerPublishSchemaMetadataResponses = {
+    /**
+     * Registrar metadata entry for the freshly submitted schema metadata.
+     */
+    201: unknown;
+};
+type SchemaMetadataControllerSignSchemaMetaConfigData = {
+    body: SignSchemaMetaConfigDto;
+    path?: never;
+    query?: never;
+    url: '/api/schema-metadata/sign';
+};
 type SchemaMetadataControllerSignSchemaMetaConfigResponses = {
     /**
      * Registrar metadata entry for the freshly submitted schema metadata.
      */
     201: unknown;
 };
-type SchemaMetadataControllerSignVersionSchemaMetaConfigData = {
+type SchemaMetadataControllerPublishSchemaMetadataVersionData = {
     body: SignVersionSchemaMetaConfigDto;
     path?: never;
     query?: never;
-    url: '/api/schema-metadata/sign-version';
+    url: '/api/schema-metadata/publish-version';
 };
-type SchemaMetadataControllerSignVersionSchemaMetaConfigErrors = {
+type SchemaMetadataControllerPublishSchemaMetadataVersionErrors = {
     /**
      * config.id is required; or invalid schema metadata
      */
     400: unknown;
 };
+type SchemaMetadataControllerPublishSchemaMetadataVersionResponses = {
+    /**
+     * Registrar metadata entry for the newly submitted version.
+     */
+    201: unknown;
+};
+type SchemaMetadataControllerSignVersionSchemaMetaConfigData = {
+    body: SignVersionSchemaMetaConfigDto;
+    path?: never;
+    query?: never;
+    url: '/api/schema-metadata/sign-version';
+};
 type SchemaMetadataControllerSignVersionSchemaMetaConfigResponses = {
     /**
      * Registrar metadata entry for the newly submitted version.
@@ -3806,24 +4281,6 @@ type SchemaMetadataControllerGetJwtResponses = {
     200: string;
 };
 type SchemaMetadataControllerGetJwtResponse = SchemaMetadataControllerGetJwtResponses[keyof SchemaMetadataControllerGetJwtResponses];
-type SchemaMetadataControllerExportData = {
-    body?: never;
-    path: {
-        id: string;
-        version: string;
-    };
-    query?: never;
-    url: '/api/schema-metadata/{id}/versions/{version}/export';
-};
-type SchemaMetadataControllerExportResponses = {
-    /**
-     * Registrar-defined catalog document
-     */
-    200: {
-        [key: string]: unknown;
-    };
-};
-type SchemaMetadataControllerExportResponse = SchemaMetadataControllerExportResponses[keyof SchemaMetadataControllerExportResponses];
 type SchemaMetadataControllerGetSchemaData = {
     body?: never;
     path: {
@@ -4224,6 +4681,24 @@ type PresentationManagementControllerResolveSchemaMetadataResponses = {
      */
     200: unknown;
 };
+type PresentationManagementControllerResolveSchemaMetadataJwtData = {
+    body: ResolveSchemaMetadataJwtDto;
+    path?: never;
+    query?: never;
+    url: '/api/verifier/config/schema-metadata/resolve-jwt';
+};
+type PresentationManagementControllerResolveSchemaMetadataJwtErrors = {
+    /**
+     * Invalid JWT or invalid schema metadata
+     */
+    400: unknown;
+};
+type PresentationManagementControllerResolveSchemaMetadataJwtResponses = {
+    /**
+     * Resolved schema metadata import payload
+     */
+    200: unknown;
+};
 type PresentationManagementControllerListSchemaMetadataCatalogData = {
     body?: never;
     path?: never;
@@ -4405,116 +4880,61 @@ type RegistrarControllerCreateAccessCertificateResponses = {
     };
 };
 type RegistrarControllerCreateAccessCertificateResponse = RegistrarControllerCreateAccessCertificateResponses[keyof RegistrarControllerCreateAccessCertificateResponses];
-type AuthorizationServersControllerParData = {
-    body?: never;
-    headers?: {
-        /**
-         * DPoP proof JWT
-         */
-        DPoP?: string;
-        /**
-         * Wallet attestation JWT
-         */
-        'OAuth-Client-Attestation'?: string;
-        /**
-         * Wallet attestation proof-of-possession JWT
-         */
-        'OAuth-Client-Attestation-PoP'?: string;
-    };
-    path: {
-        /**
-         * Tenant identifier
-         */
-        tenantId: string;
-        /**
-         * Authorization server identifier
-         */
-        authorizationServerId: string;
-    };
+type CredentialOfferControllerGetOfferData = {
+    body: OfferRequestDto;
+    path?: never;
     query?: never;
-    url: '/api/issuers/{tenantId}/authorization-servers/{authorizationServerId}/par';
-};
-type AuthorizationServersControllerParErrors = {
-    400: ChainedAsErrorResponseDto;
+    url: '/api/issuer/offer';
 };
-type AuthorizationServersControllerParError = AuthorizationServersControllerParErrors[keyof AuthorizationServersControllerParErrors];
-type AuthorizationServersControllerParResponses = {
-    201: ChainedAsParResponseDto;
+type CredentialOfferControllerGetOfferResponses = {
+    /**
+     * JSON response
+     */
+    201: OfferResponse;
 };
-type AuthorizationServersControllerParResponse = AuthorizationServersControllerParResponses[keyof AuthorizationServersControllerParResponses];
-type AuthorizationServersControllerAuthorizeData = {
-    body?: never;
+type CredentialOfferControllerGetOfferResponse = CredentialOfferControllerGetOfferResponses[keyof CredentialOfferControllerGetOfferResponses];
+type DeferredControllerCompleteDeferredData = {
+    body: CompleteDeferredDto;
     path: {
-        /**
-         * Tenant identifier
-         */
-        tenantId: string;
-        /**
-         * Authorization server identifier
-         */
-        authorizationServerId: string;
-    };
-    query: {
-        /**
-         * Client identifier
-         */
-        client_id: string;
-        /**
-         * Request URI from PAR response
-         */
-        request_uri: string;
+        transactionId: string;
     };
-    url: '/api/issuers/{tenantId}/authorization-servers/{authorizationServerId}/authorize';
+    query?: never;
+    url: '/api/issuer/deferred/{transactionId}/complete';
 };
-type AuthorizationServersControllerVpCallbackData = {
-    body?: never;
-    path: {
-        /**
-         * Tenant identifier
-         */
-        tenantId: string;
-        /**
-         * Authorization server identifier
-         */
-        authorizationServerId: string;
-    };
-    query: {
-        cas: string;
-        response_code?: string;
-        error?: string;
-        error_description?: string;
-    };
-    url: '/api/issuers/{tenantId}/authorization-servers/{authorizationServerId}/vp-callback';
+type DeferredControllerCompleteDeferredErrors = {
+    /**
+     * Transaction not found
+     */
+    404: unknown;
 };
-type AuthorizationServersControllerTokenData = {
-    body: ChainedAsTokenRequestDto;
-    headers?: {
-        /**
-         * DPoP proof JWT
-         */
-        DPoP?: string;
-    };
+type DeferredControllerCompleteDeferredResponses = {
+    /**
+     * Transaction completed successfully
+     */
+    200: DeferredOperationResponse;
+};
+type DeferredControllerCompleteDeferredResponse = DeferredControllerCompleteDeferredResponses[keyof DeferredControllerCompleteDeferredResponses];
+type DeferredControllerFailDeferredData = {
+    body?: FailDeferredDto;
     path: {
-        /**
-         * Tenant identifier
-         */
-        tenantId: string;
-        /**
-         * Authorization server identifier
-         */
-        authorizationServerId: string;
+        transactionId: string;
     };
     query?: never;
-    url: '/api/issuers/{tenantId}/authorization-servers/{authorizationServerId}/token';
+    url: '/api/issuer/deferred/{transactionId}/fail';
 };
-type AuthorizationServersControllerTokenErrors = {
-    400: ChainedAsErrorResponseDto;
+type DeferredControllerFailDeferredErrors = {
+    /**
+     * Transaction not found
+     */
+    404: unknown;
 };
-type AuthorizationServersControllerTokenError = AuthorizationServersControllerTokenErrors[keyof AuthorizationServersControllerTokenErrors];
-type AuthorizationServersControllerTokenResponses = {
-    200: ChainedAsTokenResponseDto;
+type DeferredControllerFailDeferredResponses = {
+    /**
+     * Transaction marked as failed
+     */
+    200: DeferredOperationResponse;
 };
-type AuthorizationServersControllerTokenResponse = AuthorizationServersControllerTokenResponses[keyof AuthorizationServersControllerTokenResponses];
+type DeferredControllerFailDeferredResponse = DeferredControllerFailDeferredResponses[keyof DeferredControllerFailDeferredResponses];
 type ChainedAsVpControllerParData = {
     body?: never;
     headers?: {
@@ -4617,86 +5037,69 @@ type ChainedAsVpControllerTokenResponses = {
     200: ChainedAsTokenResponseDto;
 };
 type ChainedAsVpControllerTokenResponse = ChainedAsVpControllerTokenResponses[keyof ChainedAsVpControllerTokenResponses];
-type CredentialOfferControllerGetOfferData = {
-    body: OfferRequestDto;
+type KeyChainControllerGetProvidersData = {
+    body?: never;
     path?: never;
     query?: never;
-    url: '/api/issuer/offer';
+    url: '/api/key-chain/providers';
 };
-type CredentialOfferControllerGetOfferResponses = {
+type KeyChainControllerGetProvidersResponses = {
     /**
-     * JSON response
+     * List of available KMS providers with capabilities
      */
-    201: OfferResponse;
+    200: KmsProvidersResponseDto;
 };
-type CredentialOfferControllerGetOfferResponse = CredentialOfferControllerGetOfferResponses[keyof CredentialOfferControllerGetOfferResponses];
-type DeferredControllerCompleteDeferredData = {
-    body: CompleteDeferredDto;
-    path: {
-        transactionId: string;
-    };
+type KeyChainControllerGetProvidersResponse = KeyChainControllerGetProvidersResponses[keyof KeyChainControllerGetProvidersResponses];
+type KeyChainControllerGetProvidersHealthData = {
+    body?: never;
+    path?: never;
     query?: never;
-    url: '/api/issuer/deferred/{transactionId}/complete';
-};
-type DeferredControllerCompleteDeferredErrors = {
-    /**
-     * Transaction not found
-     */
-    404: unknown;
+    url: '/api/key-chain/providers/health';
 };
-type DeferredControllerCompleteDeferredResponses = {
+type KeyChainControllerGetProvidersHealthResponses = {
     /**
-     * Transaction completed successfully
+     * Per-provider health result (ok, latencyMs, optional error).
      */
-    200: DeferredOperationResponse;
+    200: unknown;
 };
-type DeferredControllerCompleteDeferredResponse = DeferredControllerCompleteDeferredResponses[keyof DeferredControllerCompleteDeferredResponses];
-type DeferredControllerFailDeferredData = {
-    body?: FailDeferredDto;
-    path: {
-        transactionId: string;
-    };
+type KeyChainControllerDeleteTenantKmsConfigData = {
+    body?: never;
+    path?: never;
     query?: never;
-    url: '/api/issuer/deferred/{transactionId}/fail';
-};
-type DeferredControllerFailDeferredErrors = {
-    /**
-     * Transaction not found
-     */
-    404: unknown;
+    url: '/api/key-chain/providers/config';
 };
-type DeferredControllerFailDeferredResponses = {
+type KeyChainControllerDeleteTenantKmsConfigResponses = {
     /**
-     * Transaction marked as failed
+     * Tenant-specific KMS config removed.
      */
-    200: DeferredOperationResponse;
+    200: unknown;
 };
-type DeferredControllerFailDeferredResponse = DeferredControllerFailDeferredResponses[keyof DeferredControllerFailDeferredResponses];
-type KeyChainControllerGetProvidersData = {
+type KeyChainControllerGetTenantKmsConfigData = {
     body?: never;
     path?: never;
     query?: never;
-    url: '/api/key-chain/providers';
+    url: '/api/key-chain/providers/config';
 };
-type KeyChainControllerGetProvidersResponses = {
+type KeyChainControllerGetTenantKmsConfigResponses = {
     /**
-     * List of available KMS providers with capabilities
+     * Tenant and effective KMS configuration.
      */
-    200: KmsProvidersResponseDto;
+    200: KmsTenantConfigResponseDto;
 };
-type KeyChainControllerGetProvidersResponse = KeyChainControllerGetProvidersResponses[keyof KeyChainControllerGetProvidersResponses];
-type KeyChainControllerGetProvidersHealthData = {
-    body?: never;
+type KeyChainControllerGetTenantKmsConfigResponse = KeyChainControllerGetTenantKmsConfigResponses[keyof KeyChainControllerGetTenantKmsConfigResponses];
+type KeyChainControllerUpdateTenantKmsConfigData = {
+    body: KmsConfigDto;
     path?: never;
     query?: never;
-    url: '/api/key-chain/providers/health';
+    url: '/api/key-chain/providers/config';
 };
-type KeyChainControllerGetProvidersHealthResponses = {
+type KeyChainControllerUpdateTenantKmsConfigResponses = {
     /**
-     * Per-provider health result (ok, latencyMs, optional error).
+     * Updated tenant KMS config.
      */
-    200: unknown;
+    200: KmsTenantConfigResponseDto;
 };
+type KeyChainControllerUpdateTenantKmsConfigResponse = KeyChainControllerUpdateTenantKmsConfigResponses[keyof KeyChainControllerUpdateTenantKmsConfigResponses];
 type KeyChainControllerGetAllData = {
     body?: never;
     path?: never;
@@ -4867,4 +5270,4 @@ type StorageControllerUploadResponses = {
 };
 type StorageControllerUploadResponse = StorageControllerUploadResponses[keyof StorageControllerUploadResponses];
 
-export type { CacheControllerClearAllCachesResponses as $, AccessCertificateRefDto as A, AuthControllerGetOAuth2TokenData as B, ClientOptions as C, AuthControllerGetOAuth2TokenErrors as D, AuthControllerGetOAuth2TokenResponse as E, AuthControllerGetOAuth2TokenResponses as F, AuthenticationMethodAuth as G, AuthenticationMethodNone as H, AuthenticationMethodPresentation as I, AuthenticationUrlConfig as J, AuthorizationResponse as K, AuthorizationServersControllerAuthorizeData as L, AuthorizationServersControllerParData as M, AuthorizationServersControllerParError as N, AuthorizationServersControllerParErrors as O, AuthorizationServersControllerParResponse as P, AuthorizationServersControllerParResponses as Q, AuthorizationServersControllerTokenData as R, Session as S, AuthorizationServersControllerTokenError as T, AuthorizationServersControllerTokenErrors as U, AuthorizationServersControllerTokenResponse as V, AuthorizationServersControllerTokenResponses as W, AuthorizationServersControllerVpCallbackData as X, AuthorizeQueries as Y, CacheControllerClearAllCachesData as Z, CacheControllerClearAllCachesResponse as _, AllowListPolicy as a, CreateTenantDto as a$, CacheControllerClearStatusListCacheData as a0, CacheControllerClearStatusListCacheResponse as a1, CacheControllerClearStatusListCacheResponses as a2, CacheControllerClearTrustListCacheData as a3, CacheControllerClearTrustListCacheResponse as a4, CacheControllerClearTrustListCacheResponses as a5, CacheControllerGetStatsData as a6, CacheControllerGetStatsResponses as a7, CertificateInfoDto as a8, ChainedAsConfig as a9, ClientControllerCreateClientResponses as aA, ClientControllerDeleteClientData as aB, ClientControllerDeleteClientResponses as aC, ClientControllerGetClientData as aD, ClientControllerGetClientResponse as aE, ClientControllerGetClientResponses as aF, ClientControllerGetClientSecretData as aG, ClientControllerGetClientSecretResponse as aH, ClientControllerGetClientSecretResponses as aI, ClientControllerGetClientsData as aJ, ClientControllerGetClientsResponse as aK, ClientControllerGetClientsResponses as aL, ClientControllerRotateClientSecretData as aM, ClientControllerRotateClientSecretResponse as aN, ClientControllerRotateClientSecretResponses as aO, ClientControllerUpdateClientData as aP, ClientControllerUpdateClientResponse as aQ, ClientControllerUpdateClientResponses as aR, ClientCredentialsDto as aS, ClientEntity as aT, ClientSecretResponseDto as aU, CompleteDeferredDto as aV, CreateAccessCertificateDto as aW, CreateAttributeProviderDto as aX, CreateClientDto as aY, CreateRegistrarConfigDto as aZ, CreateStatusListDto as a_, ChainedAsErrorResponseDto as aa, ChainedAsParResponseDto as ab, ChainedAsTokenConfig as ac, ChainedAsTokenRequestDto as ad, ChainedAsTokenResponseDto as ae, ChainedAsVpConfig as af, ChainedAsVpControllerAuthorizeData as ag, ChainedAsVpControllerAuthorizeError as ah, ChainedAsVpControllerAuthorizeErrors as ai, ChainedAsVpControllerParData as aj, ChainedAsVpControllerParError as ak, ChainedAsVpControllerParErrors as al, ChainedAsVpControllerParResponse as am, ChainedAsVpControllerParResponses as an, ChainedAsVpControllerTokenData as ao, ChainedAsVpControllerTokenError as ap, ChainedAsVpControllerTokenErrors as aq, ChainedAsVpControllerTokenResponse as ar, ChainedAsVpControllerTokenResponses as as, ChainedAsVpControllerVpCallbackData as at, ChainedAsVpControllerVpCallbackError as au, ChainedAsVpControllerVpCallbackErrors as av, ClaimFieldDefinitionDto as aw, ClaimsQuery as ax, ClientControllerCreateClientData as ay, ClientControllerCreateClientResponse as az, ApiKeyConfig as b, IssuanceConfigControllerGetIssuanceConfigurationsResponse as b$, CreateUserDto as b0, CreateWebhookEndpointDto as b1, CredentialConfig as b2, CredentialConfigControllerDeleteIssuanceConfigurationData as b3, CredentialConfigControllerDeleteIssuanceConfigurationResponse as b4, CredentialConfigControllerDeleteIssuanceConfigurationResponses as b5, CredentialConfigControllerGetConfigByIdData as b6, CredentialConfigControllerGetConfigByIdResponse as b7, CredentialConfigControllerGetConfigByIdResponses as b8, CredentialConfigControllerGetConfigsData as b9, DeprecateSchemaMetadataDto as bA, Display as bB, DisplayImage as bC, DisplayInfo as bD, DisplayLogo as bE, EcJwk as bF, EcPublic as bG, EmbeddedDisclosurePolicy as bH, ExportEcJwk as bI, ExportRotationPolicyDto as bJ, ExternalTrustListEntity as bK, FailDeferredDto as bL, FederationConfig as bM, FederationTrustAnchorConfig as bN, FieldDisplayDto as bO, FileUploadDto as bP, FrontendConfigResponseDto as bQ, GrafanaConfigDto as bR, IaeActionOpenid4VpPresentation as bS, IaeActionRedirectToWeb as bT, ImportTenantDto as bU, InteractiveAuthorizationCodeResponseDto as bV, InteractiveAuthorizationErrorResponseDto as bW, InteractiveAuthorizationRequestDto as bX, InternalTrustListEntity as bY, IssuanceConfig as bZ, IssuanceConfigControllerGetIssuanceConfigurationsData as b_, CredentialConfigControllerGetConfigsResponse as ba, CredentialConfigControllerGetConfigsResponses as bb, CredentialConfigControllerStoreCredentialConfigurationData as bc, CredentialConfigControllerStoreCredentialConfigurationResponse as bd, CredentialConfigControllerStoreCredentialConfigurationResponses as be, CredentialConfigControllerUpdateCredentialConfigurationData as bf, CredentialConfigControllerUpdateCredentialConfigurationResponse as bg, CredentialConfigControllerUpdateCredentialConfigurationResponses as bh, CredentialConfigCreate as bi, CredentialConfigUpdate as bj, CredentialOfferControllerGetOfferData as bk, CredentialOfferControllerGetOfferResponse as bl, CredentialOfferControllerGetOfferResponses as bm, CredentialQuery as bn, CredentialSetQuery as bo, Dcql as bp, DeferredControllerCompleteDeferredData as bq, DeferredControllerCompleteDeferredErrors as br, DeferredControllerCompleteDeferredResponse as bs, DeferredControllerCompleteDeferredResponses as bt, DeferredControllerFailDeferredData as bu, DeferredControllerFailDeferredErrors as bv, DeferredControllerFailDeferredResponse as bw, DeferredControllerFailDeferredResponses as bx, DeferredCredentialRequestDto as by, DeferredOperationResponse as bz, AppControllerGetFrontendConfigData as c, PresentationDuringIssuanceConfig as c$, IssuanceConfigControllerGetIssuanceConfigurationsResponses as c0, IssuanceConfigControllerStoreIssuanceConfigurationData as c1, IssuanceConfigControllerStoreIssuanceConfigurationResponse as c2, IssuanceConfigControllerStoreIssuanceConfigurationResponses as c3, IssuanceDto as c4, IssuerMetadataCredentialConfig as c5, JwksResponseDto as c6, KeyAttestationsRequired as c7, KeyChainControllerCreateData as c8, KeyChainControllerCreateResponses as c9, KeyChainControllerUpdateResponses as cA, KeyChainCreateDto as cB, KeyChainEntity as cC, KeyChainExportDto as cD, KeyChainImportDto as cE, KeyChainResponseDto as cF, KeyChainUpdateDto as cG, KmsProviderCapabilitiesDto as cH, KmsProviderInfoDto as cI, KmsProvidersResponseDto as cJ, ManagedAuthorizationServerConfig as cK, ManagedUserDto as cL, MetadataSchemaDto as cM, NoneTrustPolicy as cN, NotificationRequestDto as cO, Object$1 as cP, ObjectWritable as cQ, OfferRequestDto as cR, OfferResponse as cS, PaginatedSessionResponseDto as cT, ParResponseDto as cU, PolicyCredential as cV, PresentationAttachment as cW, PresentationConfig as cX, PresentationConfigCreateDto as cY, PresentationConfigUpdateDto as cZ, PresentationConfigWritable as c_, KeyChainControllerDeleteData as ca, KeyChainControllerDeleteErrors as cb, KeyChainControllerDeleteResponses as cc, KeyChainControllerExportData as cd, KeyChainControllerExportErrors as ce, KeyChainControllerExportResponse as cf, KeyChainControllerExportResponses as cg, KeyChainControllerGetAllData as ch, KeyChainControllerGetAllResponse as ci, KeyChainControllerGetAllResponses as cj, KeyChainControllerGetByIdData as ck, KeyChainControllerGetByIdErrors as cl, KeyChainControllerGetByIdResponse as cm, KeyChainControllerGetByIdResponses as cn, KeyChainControllerGetProvidersData as co, KeyChainControllerGetProvidersHealthData as cp, KeyChainControllerGetProvidersHealthResponses as cq, KeyChainControllerGetProvidersResponse as cr, KeyChainControllerGetProvidersResponses as cs, KeyChainControllerImportData as ct, KeyChainControllerImportResponses as cu, KeyChainControllerRotateData as cv, KeyChainControllerRotateErrors as cw, KeyChainControllerRotateResponses as cx, KeyChainControllerUpdateData as cy, KeyChainControllerUpdateErrors as cz, AppControllerGetFrontendConfigResponse as d, SchemaMetadataControllerDeprecateVersionResponses as d$, PresentationManagementControllerConfigurationData as d0, PresentationManagementControllerConfigurationResponse as d1, PresentationManagementControllerConfigurationResponses as d2, PresentationManagementControllerDeleteConfigurationData as d3, PresentationManagementControllerDeleteConfigurationResponses as d4, PresentationManagementControllerGetConfigurationData as d5, PresentationManagementControllerGetConfigurationResponse as d6, PresentationManagementControllerGetConfigurationResponses as d7, PresentationManagementControllerListSchemaMetadataCatalogData as d8, PresentationManagementControllerListSchemaMetadataCatalogResponses as d9, RegistrarControllerCreateConfigResponses as dA, RegistrarControllerDeleteConfigData as dB, RegistrarControllerDeleteConfigResponse as dC, RegistrarControllerDeleteConfigResponses as dD, RegistrarControllerGetConfigData as dE, RegistrarControllerGetConfigErrors as dF, RegistrarControllerGetConfigResponse as dG, RegistrarControllerGetConfigResponses as dH, RegistrarControllerUpdateConfigData as dI, RegistrarControllerUpdateConfigErrors as dJ, RegistrarControllerUpdateConfigResponse as dK, RegistrarControllerUpdateConfigResponses as dL, RegistrationCertificateBody as dM, RegistrationCertificateDefaults as dN, RegistrationCertificatePurpose as dO, RegistrationCertificateRequest as dP, ResolveIssuerMetadataDto as dQ, ResolveSchemaMetadataDto as dR, RoleDto as dS, RootOfTrustPolicy as dT, RotationPolicyCreateDto as dU, RotationPolicyImportDto as dV, RotationPolicyResponseDto as dW, RotationPolicyUpdateDto as dX, SchemaMetaConfig as dY, SchemaMetadataControllerDeprecateVersionData as dZ, SchemaMetadataControllerDeprecateVersionResponse as d_, PresentationManagementControllerReissueRegistrationCertificateData as da, PresentationManagementControllerReissueRegistrationCertificateErrors as db, PresentationManagementControllerReissueRegistrationCertificateResponses as dc, PresentationManagementControllerResolveIssuerMetadataData as dd, PresentationManagementControllerResolveIssuerMetadataErrors as de, PresentationManagementControllerResolveIssuerMetadataResponses as df, PresentationManagementControllerResolveSchemaMetadataData as dg, PresentationManagementControllerResolveSchemaMetadataErrors as dh, PresentationManagementControllerResolveSchemaMetadataResponses as di, PresentationManagementControllerStorePresentationConfigData as dj, PresentationManagementControllerStorePresentationConfigResponse as dk, PresentationManagementControllerStorePresentationConfigResponses as dl, PresentationManagementControllerUpdateConfigurationData as dm, PresentationManagementControllerUpdateConfigurationResponse as dn, PresentationManagementControllerUpdateConfigurationResponses as dp, PresentationRequest as dq, PublicKeyInfoDto as dr, RegistrarConfigResponseDto as ds, RegistrarControllerCreateAccessCertificateData as dt, RegistrarControllerCreateAccessCertificateErrors as du, RegistrarControllerCreateAccessCertificateResponse as dv, RegistrarControllerCreateAccessCertificateResponses as dw, RegistrarControllerCreateConfigData as dx, RegistrarControllerCreateConfigErrors as dy, RegistrarControllerCreateConfigResponse as dz, AppControllerGetFrontendConfigResponses as e, SessionEventsControllerSubscribeToSessionEventsResponses as e$, SchemaMetadataControllerExportData as e0, SchemaMetadataControllerExportResponse as e1, SchemaMetadataControllerExportResponses as e2, SchemaMetadataControllerFindAllData as e3, SchemaMetadataControllerFindAllResponse as e4, SchemaMetadataControllerFindAllResponses as e5, SchemaMetadataControllerFindOneData as e6, SchemaMetadataControllerFindOneResponse as e7, SchemaMetadataControllerFindOneResponses as e8, SchemaMetadataControllerGetJwtData as e9, SchemaMetadataControllerUpdateResponse as eA, SchemaMetadataControllerUpdateResponses as eB, SchemaMetadataResponseDto as eC, SchemaMetadataVocabulariesDto as eD, SchemaUriEntry as eE, SessionConfigControllerGetConfigData as eF, SessionConfigControllerGetConfigResponse as eG, SessionConfigControllerGetConfigResponses as eH, SessionConfigControllerResetConfigData as eI, SessionConfigControllerResetConfigResponses as eJ, SessionConfigControllerUpdateConfigData as eK, SessionConfigControllerUpdateConfigResponse as eL, SessionConfigControllerUpdateConfigResponses as eM, SessionControllerDeleteSessionData as eN, SessionControllerDeleteSessionResponses as eO, SessionControllerGetAllSessionsData as eP, SessionControllerGetAllSessionsResponse as eQ, SessionControllerGetAllSessionsResponses as eR, SessionControllerGetSessionData as eS, SessionControllerGetSessionLogsData as eT, SessionControllerGetSessionLogsResponse as eU, SessionControllerGetSessionLogsResponses as eV, SessionControllerGetSessionResponse as eW, SessionControllerGetSessionResponses as eX, SessionControllerRevokeAllData as eY, SessionControllerRevokeAllResponses as eZ, SessionEventsControllerSubscribeToSessionEventsData as e_, SchemaMetadataControllerGetJwtResponse as ea, SchemaMetadataControllerGetJwtResponses as eb, SchemaMetadataControllerGetLatestData as ec, SchemaMetadataControllerGetLatestResponse as ed, SchemaMetadataControllerGetLatestResponses as ee, SchemaMetadataControllerGetMineData as ef, SchemaMetadataControllerGetMineResponse as eg, SchemaMetadataControllerGetMineResponses as eh, SchemaMetadataControllerGetSchemaData as ei, SchemaMetadataControllerGetSchemaResponse as ej, SchemaMetadataControllerGetSchemaResponses as ek, SchemaMetadataControllerGetVersionsData as el, SchemaMetadataControllerGetVersionsResponse as em, SchemaMetadataControllerGetVersionsResponses as en, SchemaMetadataControllerGetVocabulariesData as eo, SchemaMetadataControllerGetVocabulariesResponse as ep, SchemaMetadataControllerGetVocabulariesResponses as eq, SchemaMetadataControllerRemoveData as er, SchemaMetadataControllerRemoveResponses as es, SchemaMetadataControllerSignSchemaMetaConfigData as et, SchemaMetadataControllerSignSchemaMetaConfigErrors as eu, SchemaMetadataControllerSignSchemaMetaConfigResponses as ev, SchemaMetadataControllerSignVersionSchemaMetaConfigData as ew, SchemaMetadataControllerSignVersionSchemaMetaConfigErrors as ex, SchemaMetadataControllerSignVersionSchemaMetaConfigResponses as ey, SchemaMetadataControllerUpdateData as ez, AppControllerGetVersionData as f, TrustListControllerExportTrustListResponses as f$, SessionLogEntryResponseDto as f0, SessionStorageConfig as f1, SignSchemaMetaConfigDto as f2, SignVersionSchemaMetaConfigDto as f3, StatusListAggregationDto as f4, StatusListConfig as f5, StatusListConfigControllerGetConfigData as f6, StatusListConfigControllerGetConfigResponse as f7, StatusListConfigControllerGetConfigResponses as f8, StatusListConfigControllerResetConfigData as f9, TenantControllerDeleteTenantData as fA, TenantControllerDeleteTenantResponses as fB, TenantControllerGetTenantData as fC, TenantControllerGetTenantResponse as fD, TenantControllerGetTenantResponses as fE, TenantControllerGetTenantsData as fF, TenantControllerGetTenantsResponse as fG, TenantControllerGetTenantsResponses as fH, TenantControllerInitTenantData as fI, TenantControllerInitTenantResponse as fJ, TenantControllerInitTenantResponses as fK, TenantControllerUpdateTenantData as fL, TenantControllerUpdateTenantResponse as fM, TenantControllerUpdateTenantResponses as fN, TenantEntity as fO, TokenResponse as fP, TransactionData as fQ, TrustAuthorityDto as fR, TrustAuthorityEntry as fS, TrustList as fT, TrustListControllerCreateTrustListData as fU, TrustListControllerCreateTrustListResponse as fV, TrustListControllerCreateTrustListResponses as fW, TrustListControllerDeleteTrustListData as fX, TrustListControllerDeleteTrustListResponses as fY, TrustListControllerExportTrustListData as fZ, TrustListControllerExportTrustListResponse as f_, StatusListConfigControllerResetConfigResponse as fa, StatusListConfigControllerResetConfigResponses as fb, StatusListConfigControllerUpdateConfigData as fc, StatusListConfigControllerUpdateConfigResponse as fd, StatusListConfigControllerUpdateConfigResponses as fe, StatusListImportDto as ff, StatusListManagementControllerCreateListData as fg, StatusListManagementControllerCreateListResponse as fh, StatusListManagementControllerCreateListResponses as fi, StatusListManagementControllerDeleteListData as fj, StatusListManagementControllerDeleteListResponse as fk, StatusListManagementControllerDeleteListResponses as fl, StatusListManagementControllerGetListData as fm, StatusListManagementControllerGetListResponse as fn, StatusListManagementControllerGetListResponses as fo, StatusListManagementControllerGetListsData as fp, StatusListManagementControllerGetListsResponse as fq, StatusListManagementControllerGetListsResponses as fr, StatusListManagementControllerUpdateListData as fs, StatusListManagementControllerUpdateListResponse as ft, StatusListManagementControllerUpdateListResponses as fu, StatusListResponseDto as fv, StatusUpdateDto as fw, StorageControllerUploadData as fx, StorageControllerUploadResponse as fy, StorageControllerUploadResponses as fz, AppControllerGetVersionResponses as g, WebhookEndpointControllerUpdateData as g$, TrustListControllerGetAllTrustListsData as g0, TrustListControllerGetAllTrustListsResponse as g1, TrustListControllerGetAllTrustListsResponses as g2, TrustListControllerGetTrustListData as g3, TrustListControllerGetTrustListResponse as g4, TrustListControllerGetTrustListResponses as g5, TrustListControllerGetTrustListVersionData as g6, TrustListControllerGetTrustListVersionResponse as g7, TrustListControllerGetTrustListVersionResponses as g8, TrustListControllerGetTrustListVersionsData as g9, UserControllerGetUserResponse as gA, UserControllerGetUserResponses as gB, UserControllerGetUsersData as gC, UserControllerGetUsersResponse as gD, UserControllerGetUsersResponses as gE, UserControllerUpdateUserData as gF, UserControllerUpdateUserResponse as gG, UserControllerUpdateUserResponses as gH, Vct as gI, VerifierOfferControllerGetOfferData as gJ, VerifierOfferControllerGetOfferResponse as gK, VerifierOfferControllerGetOfferResponses as gL, VocabularyEntryDto as gM, WebHookAuthConfigHeader as gN, WebHookAuthConfigNone as gO, WebhookConfig as gP, WebhookEndpointControllerCreateData as gQ, WebhookEndpointControllerCreateResponses as gR, WebhookEndpointControllerDeleteData as gS, WebhookEndpointControllerDeleteErrors as gT, WebhookEndpointControllerDeleteResponses as gU, WebhookEndpointControllerGetAllData as gV, WebhookEndpointControllerGetAllResponse as gW, WebhookEndpointControllerGetAllResponses as gX, WebhookEndpointControllerGetByIdData as gY, WebhookEndpointControllerGetByIdErrors as gZ, WebhookEndpointControllerGetByIdResponses as g_, TrustListControllerGetTrustListVersionsResponse as ga, TrustListControllerGetTrustListVersionsResponses as gb, TrustListControllerUpdateTrustListData as gc, TrustListControllerUpdateTrustListResponse as gd, TrustListControllerUpdateTrustListResponses as ge, TrustListCreateDto as gf, TrustListEntityInfo as gg, TrustListVersion as gh, TrustedAuthorityQuery as gi, UpdateAttributeProviderDto as gj, UpdateClientDto as gk, UpdateRegistrarConfigDto as gl, UpdateSchemaMetadataDto as gm, UpdateSessionConfigDto as gn, UpdateStatusListConfigDto as go, UpdateStatusListDto as gp, UpdateTenantDto as gq, UpdateUserDto as gr, UpdateWebhookEndpointDto as gs, UpstreamOidcConfig as gt, UserControllerCreateUserData as gu, UserControllerCreateUserResponse as gv, UserControllerCreateUserResponses as gw, UserControllerDeleteUserData as gx, UserControllerDeleteUserResponses as gy, UserControllerGetUserData as gz, AttestationBasedPolicy as h, WebhookEndpointControllerUpdateErrors as h0, WebhookEndpointControllerUpdateResponses as h1, WebhookEndpointEntity as h2, AttributeProviderControllerCreateData as i, AttributeProviderControllerCreateResponses as j, AttributeProviderControllerDeleteData as k, AttributeProviderControllerDeleteErrors as l, AttributeProviderControllerDeleteResponses as m, AttributeProviderControllerGetAllData as n, AttributeProviderControllerGetAllResponses as o, AttributeProviderControllerGetByIdData as p, AttributeProviderControllerGetByIdErrors as q, AttributeProviderControllerGetByIdResponses as r, AttributeProviderControllerUpdateData as s, AttributeProviderControllerUpdateErrors as t, AttributeProviderControllerUpdateResponses as u, AttributeProviderEntity as v, AuditLogControllerGetAuditLogsData as w, AuditLogControllerGetAuditLogsResponse as x, AuditLogControllerGetAuditLogsResponses as y, AuditLogResponseDto as z };
+export type { ChainedAsErrorResponseDto as $, AccessCertificateRefDto as A, AuthControllerGetOAuth2TokenData as B, ClientOptions as C, AuthControllerGetOAuth2TokenErrors as D, AuthControllerGetOAuth2TokenResponse as E, AuthControllerGetOAuth2TokenResponses as F, AuthenticationMethodAuth as G, AuthenticationMethodNone as H, AuthenticationMethodPresentation as I, AuthenticationUrlConfig as J, AuthorizationResponse as K, AuthorizeQueries as L, AwsKmsConfigDto as M, BuiltInAuthorizationServerConfig as N, CacheControllerClearAllCachesData as O, CacheControllerClearAllCachesResponse as P, CacheControllerClearAllCachesResponses as Q, CacheControllerClearStatusListCacheData as R, Session as S, CacheControllerClearStatusListCacheResponse as T, CacheControllerClearStatusListCacheResponses as U, CacheControllerClearTrustListCacheData as V, CacheControllerClearTrustListCacheResponse as W, CacheControllerClearTrustListCacheResponses as X, CacheControllerGetStatsData as Y, CacheControllerGetStatsResponses as Z, CertificateInfoDto as _, AllowListPolicy as a, CredentialConfigControllerGetConfigsResponse as a$, ChainedAsParResponseDto as a0, ChainedAsTokenConfig as a1, ChainedAsTokenRequestDto as a2, ChainedAsTokenResponseDto as a3, ChainedAsVpControllerAuthorizeData as a4, ChainedAsVpControllerAuthorizeError as a5, ChainedAsVpControllerAuthorizeErrors as a6, ChainedAsVpControllerParData as a7, ChainedAsVpControllerParError as a8, ChainedAsVpControllerParErrors as a9, ClientControllerGetClientsResponses as aA, ClientControllerRotateClientSecretData as aB, ClientControllerRotateClientSecretResponse as aC, ClientControllerRotateClientSecretResponses as aD, ClientControllerUpdateClientData as aE, ClientControllerUpdateClientResponse as aF, ClientControllerUpdateClientResponses as aG, ClientCredentialsDto as aH, ClientEntity as aI, ClientSecretResponseDto as aJ, CompleteDeferredDto as aK, CreateAccessCertificateDto as aL, CreateAttributeProviderDto as aM, CreateClientDto as aN, CreateRegistrarConfigDto as aO, CreateStatusListDto as aP, CreateTenantDto as aQ, CreateUserDto as aR, CreateWebhookEndpointDto as aS, CredentialConfig as aT, CredentialConfigControllerDeleteIssuanceConfigurationData as aU, CredentialConfigControllerDeleteIssuanceConfigurationResponse as aV, CredentialConfigControllerDeleteIssuanceConfigurationResponses as aW, CredentialConfigControllerGetConfigByIdData as aX, CredentialConfigControllerGetConfigByIdResponse as aY, CredentialConfigControllerGetConfigByIdResponses as aZ, CredentialConfigControllerGetConfigsData as a_, ChainedAsVpControllerParResponse as aa, ChainedAsVpControllerParResponses as ab, ChainedAsVpControllerTokenData as ac, ChainedAsVpControllerTokenError as ad, ChainedAsVpControllerTokenErrors as ae, ChainedAsVpControllerTokenResponse as af, ChainedAsVpControllerTokenResponses as ag, ChainedAsVpControllerVpCallbackData as ah, ChainedAsVpControllerVpCallbackError as ai, ChainedAsVpControllerVpCallbackErrors as aj, ChainedAuthorizationServerConfig as ak, ClaimFieldDefinitionDto as al, ClaimsQuery as am, ClientControllerCreateClientData as an, ClientControllerCreateClientResponse as ao, ClientControllerCreateClientResponses as ap, ClientControllerDeleteClientData as aq, ClientControllerDeleteClientResponses as ar, ClientControllerGetClientData as as, ClientControllerGetClientResponse as at, ClientControllerGetClientResponses as au, ClientControllerGetClientSecretData as av, ClientControllerGetClientSecretResponse as aw, ClientControllerGetClientSecretResponses as ax, ClientControllerGetClientsData as ay, ClientControllerGetClientsResponse as az, ApiKeyConfig as b, IssuanceConfigWritable as b$, CredentialConfigControllerGetConfigsResponses as b0, CredentialConfigControllerStoreCredentialConfigurationData as b1, CredentialConfigControllerStoreCredentialConfigurationResponse as b2, CredentialConfigControllerStoreCredentialConfigurationResponses as b3, CredentialConfigControllerUpdateCredentialConfigurationData as b4, CredentialConfigControllerUpdateCredentialConfigurationResponse as b5, CredentialConfigControllerUpdateCredentialConfigurationResponses as b6, CredentialConfigCreate as b7, CredentialConfigUpdate as b8, CredentialOfferControllerGetOfferData as b9, ExportEcJwk as bA, ExportRotationPolicyDto as bB, ExternalAuthorizationServerConfig as bC, ExternalTrustListEntity as bD, FailDeferredDto as bE, FederationConfig as bF, FederationTrustAnchorConfig as bG, FieldDisplayDto as bH, FileUploadDto as bI, FrontendConfigResponseDto as bJ, GrafanaConfigDto as bK, HttpAuthBaseConfigDto as bL, HttpKmsConfigDto as bM, IaeActionOpenid4VpPresentation as bN, IaeActionRedirectToWeb as bO, ImportTenantDto as bP, InteractiveAuthorizationCodeResponseDto as bQ, InteractiveAuthorizationErrorResponseDto as bR, InteractiveAuthorizationRequestDto as bS, InternalTrustListEntity as bT, IssuanceConfig as bU, IssuanceConfigControllerGetIssuanceConfigurationsData as bV, IssuanceConfigControllerGetIssuanceConfigurationsResponse as bW, IssuanceConfigControllerGetIssuanceConfigurationsResponses as bX, IssuanceConfigControllerStoreIssuanceConfigurationData as bY, IssuanceConfigControllerStoreIssuanceConfigurationResponse as bZ, IssuanceConfigControllerStoreIssuanceConfigurationResponses as b_, CredentialOfferControllerGetOfferResponse as ba, CredentialOfferControllerGetOfferResponses as bb, CredentialQuery as bc, CredentialSetQuery as bd, CscAuthorizeAuthDataDto as be, CscKmsConfigDto as bf, DbKmsConfigDto as bg, Dcql as bh, DeferredControllerCompleteDeferredData as bi, DeferredControllerCompleteDeferredErrors as bj, DeferredControllerCompleteDeferredResponse as bk, DeferredControllerCompleteDeferredResponses as bl, DeferredControllerFailDeferredData as bm, DeferredControllerFailDeferredErrors as bn, DeferredControllerFailDeferredResponse as bo, DeferredControllerFailDeferredResponses as bp, DeferredCredentialRequestDto as bq, DeferredOperationResponse as br, DeprecateSchemaMetadataDto as bs, Display as bt, DisplayImage as bu, DisplayInfo as bv, DisplayLogo as bw, EcJwk as bx, EcPublic as by, EmbeddedDisclosurePolicy as bz, AppControllerGetFrontendConfigData as c, Oid4VpAuthorizationServerConfig as c$, IssuerMetadataCredentialConfig as c0, IssuerProvidedAttestation as c1, IssuerRegistrationCertificateCache as c2, IssuerRegistrationCertificateConfig as c3, JwksResponseDto as c4, KeyAttestationsRequired as c5, KeyChainControllerCreateData as c6, KeyChainControllerCreateResponses as c7, KeyChainControllerDeleteData as c8, KeyChainControllerDeleteErrors as c9, KeyChainControllerRotateResponses as cA, KeyChainControllerUpdateData as cB, KeyChainControllerUpdateErrors as cC, KeyChainControllerUpdateResponses as cD, KeyChainControllerUpdateTenantKmsConfigData as cE, KeyChainControllerUpdateTenantKmsConfigResponse as cF, KeyChainControllerUpdateTenantKmsConfigResponses as cG, KeyChainCreateDto as cH, KeyChainEntity as cI, KeyChainExportDto as cJ, KeyChainImportDto as cK, KeyChainResponseDto as cL, KeyChainUpdateDto as cM, KmsConfigDto as cN, KmsProviderCapabilitiesDto as cO, KmsProviderInfoDto as cP, KmsProvidersResponseDto as cQ, KmsTenantConfigResponseDto as cR, ManagedAuthorizationServerConfig as cS, ManagedUserDto as cT, MetadataSchemaDto as cU, NoneTrustPolicy as cV, NotificationRequestDto as cW, Object$1 as cX, ObjectWritable as cY, OfferRequestDto as cZ, OfferResponse as c_, KeyChainControllerDeleteResponses as ca, KeyChainControllerDeleteTenantKmsConfigData as cb, KeyChainControllerDeleteTenantKmsConfigResponses as cc, KeyChainControllerExportData as cd, KeyChainControllerExportErrors as ce, KeyChainControllerExportResponse as cf, KeyChainControllerExportResponses as cg, KeyChainControllerGetAllData as ch, KeyChainControllerGetAllResponse as ci, KeyChainControllerGetAllResponses as cj, KeyChainControllerGetByIdData as ck, KeyChainControllerGetByIdErrors as cl, KeyChainControllerGetByIdResponse as cm, KeyChainControllerGetByIdResponses as cn, KeyChainControllerGetProvidersData as co, KeyChainControllerGetProvidersHealthData as cp, KeyChainControllerGetProvidersHealthResponses as cq, KeyChainControllerGetProvidersResponse as cr, KeyChainControllerGetProvidersResponses as cs, KeyChainControllerGetTenantKmsConfigData as ct, KeyChainControllerGetTenantKmsConfigResponse as cu, KeyChainControllerGetTenantKmsConfigResponses as cv, KeyChainControllerImportData as cw, KeyChainControllerImportResponses as cx, KeyChainControllerRotateData as cy, KeyChainControllerRotateErrors as cz, AppControllerGetFrontendConfigResponse as d, RegistrationCertificatePurpose as d$, PaginatedSessionResponseDto as d0, ParResponseDto as d1, Pkcs11KmsConfigDto as d2, PolicyCredential as d3, PresentationAttachment as d4, PresentationConfig as d5, PresentationConfigCreateDto as d6, PresentationConfigUpdateDto as d7, PresentationConfigWritable as d8, PresentationDuringIssuanceConfig as d9, PresentationManagementControllerUpdateConfigurationData as dA, PresentationManagementControllerUpdateConfigurationResponse as dB, PresentationManagementControllerUpdateConfigurationResponses as dC, PresentationRequest as dD, PublicKeyInfoDto as dE, RegistrarConfigResponseDto as dF, RegistrarControllerCreateAccessCertificateData as dG, RegistrarControllerCreateAccessCertificateErrors as dH, RegistrarControllerCreateAccessCertificateResponse as dI, RegistrarControllerCreateAccessCertificateResponses as dJ, RegistrarControllerCreateConfigData as dK, RegistrarControllerCreateConfigErrors as dL, RegistrarControllerCreateConfigResponse as dM, RegistrarControllerCreateConfigResponses as dN, RegistrarControllerDeleteConfigData as dO, RegistrarControllerDeleteConfigResponse as dP, RegistrarControllerDeleteConfigResponses as dQ, RegistrarControllerGetConfigData as dR, RegistrarControllerGetConfigErrors as dS, RegistrarControllerGetConfigResponse as dT, RegistrarControllerGetConfigResponses as dU, RegistrarControllerUpdateConfigData as dV, RegistrarControllerUpdateConfigErrors as dW, RegistrarControllerUpdateConfigResponse as dX, RegistrarControllerUpdateConfigResponses as dY, RegistrationCertificateBody as dZ, RegistrationCertificateDefaults as d_, PresentationManagementControllerConfigurationData as da, PresentationManagementControllerConfigurationResponse as db, PresentationManagementControllerConfigurationResponses as dc, PresentationManagementControllerDeleteConfigurationData as dd, PresentationManagementControllerDeleteConfigurationResponses as de, PresentationManagementControllerGetConfigurationData as df, PresentationManagementControllerGetConfigurationResponse as dg, PresentationManagementControllerGetConfigurationResponses as dh, PresentationManagementControllerListSchemaMetadataCatalogData as di, PresentationManagementControllerListSchemaMetadataCatalogResponses as dj, PresentationManagementControllerReissueRegistrationCertificateData as dk, PresentationManagementControllerReissueRegistrationCertificateErrors as dl, PresentationManagementControllerReissueRegistrationCertificateResponses as dm, PresentationManagementControllerResolveIssuerMetadataData as dn, PresentationManagementControllerResolveIssuerMetadataErrors as dp, PresentationManagementControllerResolveIssuerMetadataResponses as dq, PresentationManagementControllerResolveSchemaMetadataData as dr, PresentationManagementControllerResolveSchemaMetadataErrors as ds, PresentationManagementControllerResolveSchemaMetadataJwtData as dt, PresentationManagementControllerResolveSchemaMetadataJwtErrors as du, PresentationManagementControllerResolveSchemaMetadataJwtResponses as dv, PresentationManagementControllerResolveSchemaMetadataResponses as dw, PresentationManagementControllerStorePresentationConfigData as dx, PresentationManagementControllerStorePresentationConfigResponse as dy, PresentationManagementControllerStorePresentationConfigResponses as dz, AppControllerGetFrontendConfigResponses as e, SessionConfigControllerUpdateConfigResponses as e$, RegistrationCertificateRequest as e0, ResolveIssuerMetadataDto as e1, ResolveSchemaMetadataDto as e2, ResolveSchemaMetadataJwtDto as e3, RoleDto as e4, RootOfTrustPolicy as e5, RotationPolicyCreateDto as e6, RotationPolicyImportDto as e7, RotationPolicyResponseDto as e8, RotationPolicyUpdateDto as e9, SchemaMetadataControllerGetVocabulariesResponse as eA, SchemaMetadataControllerGetVocabulariesResponses as eB, SchemaMetadataControllerPublishSchemaMetadataData as eC, SchemaMetadataControllerPublishSchemaMetadataErrors as eD, SchemaMetadataControllerPublishSchemaMetadataResponses as eE, SchemaMetadataControllerPublishSchemaMetadataVersionData as eF, SchemaMetadataControllerPublishSchemaMetadataVersionErrors as eG, SchemaMetadataControllerPublishSchemaMetadataVersionResponses as eH, SchemaMetadataControllerRemoveData as eI, SchemaMetadataControllerRemoveResponses as eJ, SchemaMetadataControllerSignSchemaMetaConfigData as eK, SchemaMetadataControllerSignSchemaMetaConfigResponses as eL, SchemaMetadataControllerSignVersionSchemaMetaConfigData as eM, SchemaMetadataControllerSignVersionSchemaMetaConfigResponses as eN, SchemaMetadataControllerUpdateData as eO, SchemaMetadataControllerUpdateResponse as eP, SchemaMetadataControllerUpdateResponses as eQ, SchemaMetadataResponseDto as eR, SchemaMetadataVocabulariesDto as eS, SchemaUriEntry as eT, SessionConfigControllerGetConfigData as eU, SessionConfigControllerGetConfigResponse as eV, SessionConfigControllerGetConfigResponses as eW, SessionConfigControllerResetConfigData as eX, SessionConfigControllerResetConfigResponses as eY, SessionConfigControllerUpdateConfigData as eZ, SessionConfigControllerUpdateConfigResponse as e_, SchemaMetaConfig as ea, SchemaMetadataControllerDeprecateVersionData as eb, SchemaMetadataControllerDeprecateVersionResponse as ec, SchemaMetadataControllerDeprecateVersionResponses as ed, SchemaMetadataControllerFindAllData as ee, SchemaMetadataControllerFindAllResponse as ef, SchemaMetadataControllerFindAllResponses as eg, SchemaMetadataControllerFindOneData as eh, SchemaMetadataControllerFindOneResponse as ei, SchemaMetadataControllerFindOneResponses as ej, SchemaMetadataControllerGetJwtData as ek, SchemaMetadataControllerGetJwtResponse as el, SchemaMetadataControllerGetJwtResponses as em, SchemaMetadataControllerGetLatestData as en, SchemaMetadataControllerGetLatestResponse as eo, SchemaMetadataControllerGetLatestResponses as ep, SchemaMetadataControllerGetMineData as eq, SchemaMetadataControllerGetMineResponse as er, SchemaMetadataControllerGetMineResponses as es, SchemaMetadataControllerGetSchemaData as et, SchemaMetadataControllerGetSchemaResponse as eu, SchemaMetadataControllerGetSchemaResponses as ev, SchemaMetadataControllerGetVersionsData as ew, SchemaMetadataControllerGetVersionsResponse as ex, SchemaMetadataControllerGetVersionsResponses as ey, SchemaMetadataControllerGetVocabulariesData as ez, AppControllerGetVersionData as f, TenantControllerUpdateTenantResponse as f$, SessionControllerDeleteSessionData as f0, SessionControllerDeleteSessionResponses as f1, SessionControllerGetAllSessionsData as f2, SessionControllerGetAllSessionsResponse as f3, SessionControllerGetAllSessionsResponses as f4, SessionControllerGetSessionData as f5, SessionControllerGetSessionLogsData as f6, SessionControllerGetSessionLogsResponse as f7, SessionControllerGetSessionLogsResponses as f8, SessionControllerGetSessionResponse as f9, StatusListManagementControllerDeleteListResponses as fA, StatusListManagementControllerGetListData as fB, StatusListManagementControllerGetListResponse as fC, StatusListManagementControllerGetListResponses as fD, StatusListManagementControllerGetListsData as fE, StatusListManagementControllerGetListsResponse as fF, StatusListManagementControllerGetListsResponses as fG, StatusListManagementControllerUpdateListData as fH, StatusListManagementControllerUpdateListResponse as fI, StatusListManagementControllerUpdateListResponses as fJ, StatusListResponseDto as fK, StatusUpdateDto as fL, StorageControllerUploadData as fM, StorageControllerUploadResponse as fN, StorageControllerUploadResponses as fO, TenantControllerDeleteTenantData as fP, TenantControllerDeleteTenantResponses as fQ, TenantControllerGetTenantData as fR, TenantControllerGetTenantResponse as fS, TenantControllerGetTenantResponses as fT, TenantControllerGetTenantsData as fU, TenantControllerGetTenantsResponse as fV, TenantControllerGetTenantsResponses as fW, TenantControllerInitTenantData as fX, TenantControllerInitTenantResponse as fY, TenantControllerInitTenantResponses as fZ, TenantControllerUpdateTenantData as f_, SessionControllerGetSessionResponses as fa, SessionControllerRevokeAllData as fb, SessionControllerRevokeAllResponses as fc, SessionEventsControllerSubscribeToSessionEventsData as fd, SessionEventsControllerSubscribeToSessionEventsResponses as fe, SessionLogEntryResponseDto as ff, SessionStorageConfig as fg, SignSchemaMetaConfigDto as fh, SignVersionSchemaMetaConfigDto as fi, StatusListAggregationDto as fj, StatusListConfig as fk, StatusListConfigControllerGetConfigData as fl, StatusListConfigControllerGetConfigResponse as fm, StatusListConfigControllerGetConfigResponses as fn, StatusListConfigControllerResetConfigData as fo, StatusListConfigControllerResetConfigResponse as fp, StatusListConfigControllerResetConfigResponses as fq, StatusListConfigControllerUpdateConfigData as fr, StatusListConfigControllerUpdateConfigResponse as fs, StatusListConfigControllerUpdateConfigResponses as ft, StatusListImportDto as fu, StatusListManagementControllerCreateListData as fv, StatusListManagementControllerCreateListResponse as fw, StatusListManagementControllerCreateListResponses as fx, StatusListManagementControllerDeleteListData as fy, StatusListManagementControllerDeleteListResponse as fz, AppControllerGetVersionResponses as g, VerifierOfferControllerGetOfferData as g$, TenantControllerUpdateTenantResponses as g0, TenantEntity as g1, TokenResponse as g2, TransactionData as g3, TrustAuthorityDto as g4, TrustAuthorityEntry as g5, TrustList as g6, TrustListControllerCreateTrustListData as g7, TrustListControllerCreateTrustListResponse as g8, TrustListControllerCreateTrustListResponses as g9, UpdateIssuanceDto as gA, UpdateIssuanceDtoWritable as gB, UpdateRegistrarConfigDto as gC, UpdateSchemaMetadataDto as gD, UpdateSessionConfigDto as gE, UpdateStatusListConfigDto as gF, UpdateStatusListDto as gG, UpdateTenantDto as gH, UpdateUserDto as gI, UpdateWebhookEndpointDto as gJ, UpstreamOidcConfig as gK, UserControllerCreateUserData as gL, UserControllerCreateUserResponse as gM, UserControllerCreateUserResponses as gN, UserControllerDeleteUserData as gO, UserControllerDeleteUserResponses as gP, UserControllerGetUserData as gQ, UserControllerGetUserResponse as gR, UserControllerGetUserResponses as gS, UserControllerGetUsersData as gT, UserControllerGetUsersResponse as gU, UserControllerGetUsersResponses as gV, UserControllerUpdateUserData as gW, UserControllerUpdateUserResponse as gX, UserControllerUpdateUserResponses as gY, VaultKmsConfigDto as gZ, Vct as g_, TrustListControllerDeleteTrustListData as ga, TrustListControllerDeleteTrustListResponses as gb, TrustListControllerExportTrustListData as gc, TrustListControllerExportTrustListResponse as gd, TrustListControllerExportTrustListResponses as ge, TrustListControllerGetAllTrustListsData as gf, TrustListControllerGetAllTrustListsResponse as gg, TrustListControllerGetAllTrustListsResponses as gh, TrustListControllerGetTrustListData as gi, TrustListControllerGetTrustListResponse as gj, TrustListControllerGetTrustListResponses as gk, TrustListControllerGetTrustListVersionData as gl, TrustListControllerGetTrustListVersionResponse as gm, TrustListControllerGetTrustListVersionResponses as gn, TrustListControllerGetTrustListVersionsData as go, TrustListControllerGetTrustListVersionsResponse as gp, TrustListControllerGetTrustListVersionsResponses as gq, TrustListControllerUpdateTrustListData as gr, TrustListControllerUpdateTrustListResponse as gs, TrustListControllerUpdateTrustListResponses as gt, TrustListCreateDto as gu, TrustListEntityInfo as gv, TrustListVersion as gw, TrustedAuthorityQuery as gx, UpdateAttributeProviderDto as gy, UpdateClientDto as gz, AttestationBasedPolicy as h, VerifierOfferControllerGetOfferResponse as h0, VerifierOfferControllerGetOfferResponses as h1, VocabularyEntryDto as h2, WebHookAuthConfigHeader as h3, WebHookAuthConfigNone as h4, WebhookConfig as h5, WebhookEndpointControllerCreateData as h6, WebhookEndpointControllerCreateResponses as h7, WebhookEndpointControllerDeleteData as h8, WebhookEndpointControllerDeleteErrors as h9, WebhookEndpointControllerDeleteResponses as ha, WebhookEndpointControllerGetAllData as hb, WebhookEndpointControllerGetAllResponse as hc, WebhookEndpointControllerGetAllResponses as hd, WebhookEndpointControllerGetByIdData as he, WebhookEndpointControllerGetByIdErrors as hf, WebhookEndpointControllerGetByIdResponses as hg, WebhookEndpointControllerUpdateData as hh, WebhookEndpointControllerUpdateErrors as hi, WebhookEndpointControllerUpdateResponses as hj, WebhookEndpointEntity as hk, AttributeProviderControllerCreateData as i, AttributeProviderControllerCreateResponses as j, AttributeProviderControllerDeleteData as k, AttributeProviderControllerDeleteErrors as l, AttributeProviderControllerDeleteResponses as m, AttributeProviderControllerGetAllData as n, AttributeProviderControllerGetAllResponses as o, AttributeProviderControllerGetByIdData as p, AttributeProviderControllerGetByIdErrors as q, AttributeProviderControllerGetByIdResponses as r, AttributeProviderControllerUpdateData as s, AttributeProviderControllerUpdateErrors as t, AttributeProviderControllerUpdateResponses as u, AttributeProviderEntity as v, AuditLogControllerGetAuditLogsData as w, AuditLogControllerGetAuditLogsResponse as x, AuditLogControllerGetAuditLogsResponses as y, AuditLogResponseDto as z };