@openid4vc/oauth2 0.2.0-alpha-20250109205223

package/dist/index.d.ts

@@ -0,0 +1,2276 @@
+import * as v from 'valibot';
+import { HttpMethod, FetchHeaders, ContentType, OrPromise, Fetch, BaseSchema, FetchResponse, FetchRequestInit, StringWithAutoCompletion } from '@openid4vc/utils';
+export { HttpMethod, InvalidFetchResponseError, Oid4vcTsConfig, getGlobalConfig, setGlobalConfig } from '@openid4vc/utils';
+
+declare enum Oauth2ErrorCodes {
+    ServerError = "server_error",
+    InvalidTarget = "invalid_target",
+    InvalidRequest = "invalid_request",
+    InvalidToken = "invalid_token",
+    InsufficientScope = "insufficient_scope",
+    InvalidGrant = "invalid_grant",
+    InvalidClient = "invalid_client",
+    UnauthorizedClient = "unauthorized_client",
+    UnsupportedGrantType = "unsupported_grant_type",
+    InvalidScope = "invalid_scope",
+    InvalidDpopProof = "invalid_dpop_proof",
+    UseDpopNonce = "use_dpop_nonce",
+    RedirectToWeb = "redirect_to_web",
+    InvalidSession = "invalid_session",
+    InsufficientAuthorization = "insufficient_authorization",
+    InvalidCredentialRequest = "invalid_credential_request",
+    CredentialRequestDenied = "credential_request_denied",
+    UnsupportedCredentialType = "unsupported_credential_type",
+    UnsupportedCredentialFormat = "unsupported_credential_format",
+    InvalidProof = "invalid_proof",
+    InvalidNonce = "invalid_nonce",
+    InvalidEncryptionParameters = "invalid_encryption_parameters"
+}
+declare const vOauth2ErrorResponse: v.LooseObjectSchema<{
+    readonly error: v.UnionSchema<[v.EnumSchema<typeof Oauth2ErrorCodes, undefined>, v.StringSchema<undefined>], undefined>;
+    readonly error_description: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly error_uri: v.OptionalSchema<v.StringSchema<undefined>, never>;
+}, undefined>;
+type Oauth2ErrorResponse = v.InferOutput<typeof vOauth2ErrorResponse>;
+
+declare const vAccessTokenRequest: v.IntersectSchema<[v.LooseObjectSchema<{
+    readonly 'pre-authorized_code': v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly code: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly redirect_uri: v.OptionalSchema<v.SchemaWithPipe<[v.StringSchema<undefined>, v.UrlAction<string, undefined>]>, never>;
+    readonly refresh_token: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly resource: v.OptionalSchema<v.SchemaWithPipe<[v.StringSchema<undefined>, v.UrlAction<string, undefined>, v.CheckAction<string, "url must be an https:// url">]>, never>;
+    readonly code_verifier: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly grant_type: v.UnionSchema<[v.LiteralSchema<"urn:ietf:params:oauth:grant-type:pre-authorized_code", undefined>, v.LiteralSchema<"authorization_code", undefined>, v.LiteralSchema<"refresh_token", undefined>, v.StringSchema<undefined>], undefined>;
+}, undefined>, v.SchemaWithPipe<[v.LooseObjectSchema<{
+    readonly tx_code: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly user_pin: v.OptionalSchema<v.StringSchema<undefined>, never>;
+}, undefined>, v.CheckAction<{
+    tx_code?: string | undefined;
+    user_pin?: string | undefined;
+} & {
+    [key: string]: unknown;
+}, "If both 'tx_code' and 'user_pin' are present they must match">, v.TransformAction<{
+    tx_code?: string | undefined;
+    user_pin?: string | undefined;
+} & {
+    [key: string]: unknown;
+}, {
+    tx_code?: string | undefined;
+}>]>], undefined>;
+type AccessTokenRequest = v.InferOutput<typeof vAccessTokenRequest>;
+declare const vAccessTokenResponse: v.LooseObjectSchema<{
+    readonly access_token: v.StringSchema<undefined>;
+    readonly token_type: v.StringSchema<undefined>;
+    readonly expires_in: v.OptionalSchema<v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>, never>;
+    readonly scope: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly state: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly refresh_token: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly c_nonce: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly c_nonce_expires_in: v.OptionalSchema<v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>, never>;
+    readonly authorization_details: v.OptionalSchema<v.ArraySchema<v.LooseObjectSchema<{}, undefined>, undefined>, never>;
+}, undefined>;
+type AccessTokenResponse = v.InferOutput<typeof vAccessTokenResponse>;
+declare const vAccessTokenErrorResponse: v.LooseObjectSchema<{
+    readonly error: v.UnionSchema<[v.EnumSchema<typeof Oauth2ErrorCodes, undefined>, v.StringSchema<undefined>], undefined>;
+    readonly error_description: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly error_uri: v.OptionalSchema<v.StringSchema<undefined>, never>;
+}, undefined>;
+type AccessTokenErrorResponse = v.InferOutput<typeof vAccessTokenErrorResponse>;
+
+declare const vAuthorizationServerMetadata: v.SchemaWithPipe<[v.LooseObjectSchema<{
+    readonly issuer: v.SchemaWithPipe<[v.StringSchema<undefined>, v.UrlAction<string, undefined>, v.CheckAction<string, "url must be an https:// url">]>;
+    readonly token_endpoint: v.SchemaWithPipe<[v.StringSchema<undefined>, v.UrlAction<string, undefined>, v.CheckAction<string, "url must be an https:// url">]>;
+    readonly token_endpoint_auth_methods_supported: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, never>;
+    readonly authorization_endpoint: v.OptionalSchema<v.SchemaWithPipe<[v.StringSchema<undefined>, v.UrlAction<string, undefined>, v.CheckAction<string, "url must be an https:// url">]>, never>;
+    readonly jwks_uri: v.OptionalSchema<v.SchemaWithPipe<[v.StringSchema<undefined>, v.UrlAction<string, undefined>, v.CheckAction<string, "url must be an https:// url">]>, never>;
+    readonly code_challenge_methods_supported: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, never>;
+    readonly dpop_signing_alg_values_supported: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, never>;
+    readonly require_pushed_authorization_requests: v.OptionalSchema<v.BooleanSchema<undefined>, never>;
+    readonly pushed_authorization_request_endpoint: v.OptionalSchema<v.SchemaWithPipe<[v.StringSchema<undefined>, v.UrlAction<string, undefined>, v.CheckAction<string, "url must be an https:// url">]>, never>;
+    readonly introspection_endpoint: v.OptionalSchema<v.SchemaWithPipe<[v.StringSchema<undefined>, v.UrlAction<string, undefined>, v.CheckAction<string, "url must be an https:// url">]>, never>;
+    readonly introspection_endpoint_auth_methods_supported: v.OptionalSchema<v.ArraySchema<v.UnionSchema<[v.LiteralSchema<"client_secret_jwt", undefined>, v.LiteralSchema<"private_key_jwt", undefined>, v.StringSchema<undefined>], undefined>, undefined>, never>;
+    readonly introspection_endpoint_auth_signing_alg_values_supported: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<[v.StringSchema<undefined>, v.CheckAction<string, "alg value may not be 'none'">]>, undefined>, never>;
+    readonly authorization_challenge_endpoint: v.OptionalSchema<v.SchemaWithPipe<[v.StringSchema<undefined>, v.UrlAction<string, undefined>, v.CheckAction<string, "url must be an https:// url">]>, never>;
+    readonly 'pre-authorized_grant_anonymous_access_supported': v.OptionalSchema<v.BooleanSchema<undefined>, never>;
+}, undefined>, v.CheckAction<{
+    issuer: string;
+    token_endpoint: string;
+    token_endpoint_auth_methods_supported?: string[] | undefined;
+    authorization_endpoint?: string | undefined;
+    jwks_uri?: string | undefined;
+    code_challenge_methods_supported?: string[] | undefined;
+    dpop_signing_alg_values_supported?: string[] | undefined;
+    require_pushed_authorization_requests?: boolean | undefined;
+    pushed_authorization_request_endpoint?: string | undefined;
+    introspection_endpoint?: string | undefined;
+    introspection_endpoint_auth_methods_supported?: string[] | undefined;
+    introspection_endpoint_auth_signing_alg_values_supported?: string[] | undefined;
+    authorization_challenge_endpoint?: string | undefined;
+    'pre-authorized_grant_anonymous_access_supported'?: boolean | undefined;
+} & {
+    [key: string]: unknown;
+}, "Metadata value 'introspection_endpoint_auth_signing_alg_values_supported' must be defined if metadata 'introspection_endpoint_auth_methods_supported' value contains values 'private_key_jwt' or 'client_secret_jwt'">]>;
+type AuthorizationServerMetadata = v.InferOutput<typeof vAuthorizationServerMetadata>;
+
+interface ClientAuthenticationDynamicOptions {
+    clientId: string;
+    clientSecret: string;
+}
+/**
+ * Dynamicaly get the client authentication method based on endpoint type and authorization server.
+ * Only `client_secret_post` and `client_secret_basic` supported.
+ */
+declare function clientAuthenticationDynamic(options: ClientAuthenticationDynamicOptions): ClientAuthenticationCallback;
+/**
+ * Options for client authentication
+ */
+interface ClientAuthenticationCallbackOptions {
+    /**
+     * Metadata of the authorization server
+     */
+    authorizationServerMetata: AuthorizationServerMetadata;
+    /**
+     * URL to which the request will be made
+     */
+    url: string;
+    /**
+     * http method that will be used
+     */
+    method: HttpMethod;
+    /**
+     * Headers for the request. You can modify this object
+     */
+    headers: FetchHeaders;
+    contentType: ContentType;
+    /**
+     * The body as a JSON object. If content type `x-www-form-urlencoded`
+     * is used, it will be encoded after this call.
+     *
+     * You can modify this object
+     */
+    body: Record<string, unknown>;
+}
+/**
+ * Callback method to determine the client authentication for a request.
+ */
+type ClientAuthenticationCallback = (options: ClientAuthenticationCallbackOptions) => Promise<void> | void;
+interface ClientAuthenticationClientSecretPostOptions {
+    clientId: string;
+    clientSecret: string;
+}
+/**
+ * Client authentication using `client_secret_post` option
+ */
+declare function clientAuthenticationClientSecretPost(options: ClientAuthenticationClientSecretPostOptions): ClientAuthenticationCallback;
+interface ClientAuthenticationClientSecretBasicOptions {
+    clientId: string;
+    clientSecret: string;
+}
+/**
+ * Client authentication using `client_secret_basic` option
+ */
+declare function clientAuthenticationClientSecretBasic(options: ClientAuthenticationClientSecretBasicOptions): ClientAuthenticationCallback;
+/**
+ * No client authentication
+ */
+declare function clientAuthenticationNone(): () => void;
+
+declare const vJwk: v.LooseObjectSchema<{
+    readonly kty: v.StringSchema<undefined>;
+    readonly crv: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly x: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly y: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly e: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly n: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly alg: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly dp: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly dq: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly ext: v.OptionalSchema<v.BooleanSchema<undefined>, never>;
+    readonly k: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly key_ops: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly kid: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly oth: v.OptionalSchema<v.ArraySchema<v.LooseObjectSchema<{
+        readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly r: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    }, undefined>, undefined>, never>;
+    readonly p: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly q: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly qi: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly use: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly x5c: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly x5t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly 'x5t#S256': v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly x5u: v.OptionalSchema<v.StringSchema<undefined>, never>;
+}, undefined>;
+type Jwk = v.InferOutput<typeof vJwk>;
+declare const vJwkSet: v.LooseObjectSchema<{
+    readonly keys: v.ArraySchema<v.LooseObjectSchema<{
+        readonly kty: v.StringSchema<undefined>;
+        readonly crv: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly y: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly e: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly n: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly alg: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly dp: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly dq: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly ext: v.OptionalSchema<v.BooleanSchema<undefined>, never>;
+        readonly k: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly key_ops: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly kid: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly oth: v.OptionalSchema<v.ArraySchema<v.LooseObjectSchema<{
+            readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly r: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        }, undefined>, undefined>, never>;
+        readonly p: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly q: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly qi: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly use: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x5c: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x5t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly 'x5t#S256': v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x5u: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    }, undefined>, undefined>;
+}, undefined>;
+type JwkSet = v.InferOutput<typeof vJwkSet>;
+
+type JwtSignerDid = {
+    method: 'did';
+    didUrl: string;
+    alg: string;
+};
+type JwtSignerJwk = {
+    method: 'jwk';
+    publicJwk: Jwk;
+    alg: string;
+};
+type JwtSignerX5c = {
+    method: 'x5c';
+    x5c: string[];
+    alg: string;
+};
+type JwtSignerTrustChain = {
+    method: 'trustChain';
+    trustChain: string[];
+    alg: string;
+    kid: string;
+};
+type JwtSignerCustom = {
+    method: 'custom';
+    alg: string;
+};
+type JwtSigner = JwtSignerDid | JwtSignerJwk | JwtSignerX5c | JwtSignerTrustChain | JwtSignerCustom;
+type JwtSignerWithJwk = JwtSigner & {
+    publicJwk: Jwk;
+};
+declare const vCompactJwt: v.SchemaWithPipe<[v.StringSchema<undefined>, v.RegexAction<string, "Not a valid compact jwt">]>;
+declare const vJwtPayload: v.LooseObjectSchema<{
+    readonly iss: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly aud: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly iat: v.OptionalSchema<v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>, never>;
+    readonly exp: v.OptionalSchema<v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>, never>;
+    readonly nbf: v.OptionalSchema<v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>, never>;
+    readonly nonce: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly jti: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly cnf: v.OptionalSchema<v.LooseObjectSchema<{
+        readonly jwk: v.OptionalSchema<v.LooseObjectSchema<{
+            readonly kty: v.StringSchema<undefined>;
+            readonly crv: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly y: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly e: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly n: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly alg: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly dp: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly dq: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly ext: v.OptionalSchema<v.BooleanSchema<undefined>, never>;
+            readonly k: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly key_ops: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly kid: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly oth: v.OptionalSchema<v.ArraySchema<v.LooseObjectSchema<{
+                readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+                readonly r: v.OptionalSchema<v.StringSchema<undefined>, never>;
+                readonly t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            }, undefined>, undefined>, never>;
+            readonly p: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly q: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly qi: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly use: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5c: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly 'x5t#S256': v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5u: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        }, undefined>, never>;
+        readonly jkt: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    }, undefined>, never>;
+    readonly status: v.OptionalSchema<v.LooseObjectSchema<{}, undefined>, never>;
+}, undefined>;
+type JwtPayload = v.InferOutput<typeof vJwtPayload>;
+declare const vJwtHeader: v.LooseObjectSchema<{
+    readonly alg: v.SchemaWithPipe<[v.StringSchema<undefined>, v.CheckAction<string, "alg value may not be 'none'">]>;
+    readonly typ: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly kid: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly jwk: v.OptionalSchema<v.LooseObjectSchema<{
+        readonly kty: v.StringSchema<undefined>;
+        readonly crv: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly y: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly e: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly n: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly alg: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly dp: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly dq: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly ext: v.OptionalSchema<v.BooleanSchema<undefined>, never>;
+        readonly k: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly key_ops: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly kid: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly oth: v.OptionalSchema<v.ArraySchema<v.LooseObjectSchema<{
+            readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly r: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        }, undefined>, undefined>, never>;
+        readonly p: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly q: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly qi: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly use: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x5c: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x5t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly 'x5t#S256': v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x5u: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    }, undefined>, never>;
+    readonly x5c: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, never>;
+    readonly trust_chain: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, never>;
+}, undefined>;
+type JwtHeader = v.InferOutput<typeof vJwtHeader>;
+
+/**
+ * Supported hashing algorithms
+ */
+declare enum HashAlgorithm {
+    Sha256 = "SHA-256"
+}
+/**
+ * Callback used for operations that require hashing
+ */
+type HashCallback = (data: Uint8Array, alg: HashAlgorithm) => OrPromise<Uint8Array>;
+type GenerateRandomCallback = (byteLength: number) => OrPromise<Uint8Array>;
+type SignJwtCallback = (jwtSigner: JwtSigner, jwt: {
+    header: JwtHeader;
+    payload: JwtPayload;
+}) => OrPromise<{
+    jwt: string;
+    signerJwk: Jwk;
+}>;
+type VerifyJwtCallback = (jwtSigner: JwtSigner, jwt: {
+    header: JwtHeader;
+    payload: JwtPayload;
+    compact: string;
+}) => OrPromise<{
+    verified: true;
+    signerJwk: Jwk;
+} | {
+    verified: false;
+    signerJwk?: Jwk;
+}>;
+/**
+ * Callback context provides the callbacks that are required for the oid4vc library
+ */
+interface CallbackContext {
+    /**
+     * Custom fetch implementation to use
+     */
+    fetch?: Fetch;
+    /**
+     * Hash callback used for e.g. dpop and pkce
+     */
+    hash: HashCallback;
+    /**
+     * Sign jwt callback for signing of Json Web Tokens
+     */
+    signJwt: SignJwtCallback;
+    /**
+     * Verify jwt callback for verification of Json Web Tokens
+     */
+    verifyJwt: VerifyJwtCallback;
+    /**
+     * Generate random callback to generate random bytes. Used for
+     * e.g. the 'jti' value in a dpop jwt, and 'code_verifier' in pkce.
+     */
+    generateRandom: GenerateRandomCallback;
+    /**
+     * Extend a request to the authorization server with client authentication
+     * parameters. If you're not using client authentication, you can set this
+     * to `clientAuthenticationNone()`
+     *
+     * There are three default client authentication methods provided:
+     * - `clientAuthenticationClientSecretPost`
+     * - `clientAuthenticationClientSecretBasic`
+     * - `clientAuthenticationNone`
+     *
+     * A custom implementation can be made for other methods, or allowing complex
+     * scenarios where multiple authorization servers are supported.
+     */
+    clientAuthentication: ClientAuthenticationCallback;
+}
+
+interface CalculateJwkThumbprintOptions {
+    /**
+     * The jwk to calcualte the thumbprint for.
+     */
+    jwk: Jwk;
+    /**
+     * The hashing algorithm to use for calculating the thumbprint
+     */
+    hashAlgorithm: HashAlgorithm;
+    /**
+     * The hash callback to calculate the digest
+     */
+    hashCallback: HashCallback;
+}
+declare function calculateJwkThumbprint(options: CalculateJwkThumbprintOptions): Promise<string>;
+
+declare function isJwkInSet({ jwk, jwks, callbacks, }: {
+    jwk: Jwk;
+    jwks: Jwk[];
+    callbacks: Pick<CallbackContext, 'hash'>;
+}): Promise<boolean>;
+
+declare const vAccessTokenProfileJwtPayload: v.LooseObjectSchema<{
+    readonly iss: v.StringSchema<undefined>;
+    readonly exp: v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>;
+    readonly iat: v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>;
+    readonly aud: v.StringSchema<undefined>;
+    readonly sub: v.StringSchema<undefined>;
+    readonly client_id: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly jti: v.StringSchema<undefined>;
+    readonly scope: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly nbf: v.OptionalSchema<v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>, never>;
+    readonly nonce: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly cnf: v.OptionalSchema<v.LooseObjectSchema<{
+        readonly jwk: v.OptionalSchema<v.LooseObjectSchema<{
+            readonly kty: v.StringSchema<undefined>;
+            readonly crv: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly y: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly e: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly n: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly alg: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly dp: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly dq: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly ext: v.OptionalSchema<v.BooleanSchema<undefined>, never>;
+            readonly k: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly key_ops: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly kid: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly oth: v.OptionalSchema<v.ArraySchema<v.LooseObjectSchema<{
+                readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+                readonly r: v.OptionalSchema<v.StringSchema<undefined>, never>;
+                readonly t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            }, undefined>, undefined>, never>;
+            readonly p: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly q: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly qi: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly use: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5c: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly 'x5t#S256': v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5u: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        }, undefined>, never>;
+        readonly jkt: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    }, undefined>, never>;
+    readonly status: v.OptionalSchema<v.LooseObjectSchema<{}, undefined>, never>;
+}, undefined>;
+type AccessTokenProfileJwtPayload = v.InferOutput<typeof vAccessTokenProfileJwtPayload>;
+
+interface VerifyJwtOptions {
+    /**
+     * Compact jwt
+     */
+    compact: string;
+    /**
+     * Header of the jwt
+     */
+    header: JwtHeader;
+    /**
+     * Payload of the jwt.
+     */
+    payload: JwtPayload;
+    /**
+     * If not provided current time will be used.
+     *
+     * @default new Date()
+     */
+    now?: Date;
+    /**
+     * Whether to skip time based validation of `nbf` and `exp`.
+     * @default false
+     */
+    skipTimeBasedValidation?: boolean;
+    /**
+     * Callback to verify jwt signature
+     */
+    verifyJwtCallback: VerifyJwtCallback;
+    /**
+     * Signer of the jwt
+     */
+    signer: JwtSigner;
+    /**
+     * Custom error message
+     */
+    errorMessage?: string;
+    /**
+     * Allowed skew time in seconds for validity of token. Used for `exp` and `nbf`
+     * verification.
+     *
+     * @default 0
+     */
+    allowedSkewInSeconds?: number;
+    /**
+     * Expected value for the 'aud' claim
+     */
+    expectedAudience?: string;
+    /**
+     * Expected value for the 'iss' claim
+     */
+    expectedIssuer?: string;
+    /**
+     * Expected value for the 'nonce' claim
+     */
+    expectedNonce?: string;
+    /**
+     * Expected value for the 'sub' claim
+     */
+    expectedSubject?: string;
+}
+interface VerifyJwtReturn {
+    signer: JwtSignerWithJwk;
+}
+declare function verifyJwt(options: VerifyJwtOptions): Promise<VerifyJwtReturn>;
+
+interface DecodeJwtOptions<HeaderSchema extends BaseSchema | undefined, PayloadSchema extends BaseSchema | undefined> {
+    /**
+     * The comapct encoded jwt
+     */
+    jwt: string;
+    /**
+     * Schema to use for validating the header. If not provided the
+     * default `vJwtHeader` schema will be used
+     */
+    headerSchema?: HeaderSchema;
+    /**
+     * Schema to use for validating the payload. If not provided the
+     * default `vJwtPayload` schema will be used
+     */
+    payloadSchema?: PayloadSchema;
+}
+type DecodeJwtResult<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined> = {
+    header: InferSchemaOutput<HeaderSchema, typeof vJwtHeader>;
+    payload: InferSchemaOutput<PayloadSchema, typeof vJwtPayload>;
+    signature: string;
+};
+declare function decodeJwt<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined>(options: DecodeJwtOptions<HeaderSchema, PayloadSchema>): DecodeJwtResult<HeaderSchema, PayloadSchema>;
+declare function jwtHeaderFromJwtSigner(signer: JwtSigner): {
+    readonly alg: string;
+    readonly kid: string;
+    readonly trust_chain?: undefined;
+    readonly jwk?: undefined;
+    readonly x5c?: undefined;
+} | {
+    readonly alg: string;
+    readonly kid: string;
+    readonly trust_chain: string[];
+    readonly jwk?: undefined;
+    readonly x5c?: undefined;
+} | {
+    readonly alg: string;
+    readonly jwk: {
+        kty: string;
+        crv?: string | undefined;
+        x?: string | undefined;
+        y?: string | undefined;
+        e?: string | undefined;
+        n?: string | undefined;
+        alg?: string | undefined;
+        d?: string | undefined;
+        dp?: string | undefined;
+        dq?: string | undefined;
+        ext?: boolean | undefined;
+        k?: string | undefined;
+        key_ops?: string | undefined;
+        kid?: string | undefined;
+        oth?: ({
+            d?: string | undefined;
+            r?: string | undefined;
+            t?: string | undefined;
+        } & {
+            [key: string]: unknown;
+        })[] | undefined;
+        p?: string | undefined;
+        q?: string | undefined;
+        qi?: string | undefined;
+        use?: string | undefined;
+        x5c?: string | undefined;
+        x5t?: string | undefined;
+        'x5t#S256'?: string | undefined;
+        x5u?: string | undefined;
+    } & {
+        [key: string]: unknown;
+    };
+    readonly kid: string | undefined;
+    readonly trust_chain?: undefined;
+    readonly x5c?: undefined;
+} | {
+    readonly alg: string;
+    readonly x5c: string[];
+    readonly kid?: undefined;
+    readonly trust_chain?: undefined;
+    readonly jwk?: undefined;
+} | {
+    alg: string;
+    readonly kid?: undefined;
+    readonly trust_chain?: undefined;
+    readonly jwk?: undefined;
+    readonly x5c?: undefined;
+};
+declare function jwtSignerFromJwt({ header, payload }: Pick<DecodeJwtResult, 'header' | 'payload'>): JwtSigner;
+type IsSchemaProvided<T> = T extends undefined ? false : true;
+type InferSchemaOutput<ProvidedSchema extends BaseSchema | undefined, DefaultSchema extends BaseSchema> = IsSchemaProvided<ProvidedSchema> extends true ? ProvidedSchema extends BaseSchema ? v.InferOutput<ProvidedSchema> : never : v.InferOutput<DefaultSchema>;
+
+interface RequestLike {
+    headers: FetchHeaders;
+    method: HttpMethod;
+    url: string;
+}
+
+interface RequestDpopOptions {
+    /**
+     * Dpop nonce to use for constructing the dpop jwt
+     */
+    nonce?: string;
+    /**
+     * The signer of the dpop jwt
+     */
+    signer: JwtSignerJwk;
+}
+
+declare const vClientAttestationJwtPayload: v.LooseObjectSchema<{
+    readonly iss: v.StringSchema<undefined>;
+    readonly sub: v.StringSchema<undefined>;
+    readonly exp: v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>;
+    readonly cnf: v.LooseObjectSchema<{
+        readonly jwk: v.LooseObjectSchema<{
+            readonly kty: v.StringSchema<undefined>;
+            readonly crv: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly y: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly e: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly n: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly alg: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly dp: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly dq: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly ext: v.OptionalSchema<v.BooleanSchema<undefined>, never>;
+            readonly k: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly key_ops: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly kid: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly oth: v.OptionalSchema<v.ArraySchema<v.LooseObjectSchema<{
+                readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+                readonly r: v.OptionalSchema<v.StringSchema<undefined>, never>;
+                readonly t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            }, undefined>, undefined>, never>;
+            readonly p: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly q: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly qi: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly use: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5c: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly 'x5t#S256': v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5u: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        }, undefined>;
+        readonly key_type: v.OptionalSchema<v.UnionSchema<[v.PicklistSchema<["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"], undefined>, v.StringSchema<undefined>], undefined>, never>;
+        readonly user_authentication: v.OptionalSchema<v.UnionSchema<[v.PicklistSchema<["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"], undefined>, v.StringSchema<undefined>], undefined>, never>;
+    }, undefined>;
+    readonly aal: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly aud: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly iat: v.OptionalSchema<v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>, never>;
+    readonly nbf: v.OptionalSchema<v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>, never>;
+    readonly nonce: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly jti: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly status: v.OptionalSchema<v.LooseObjectSchema<{}, undefined>, never>;
+}, undefined>;
+type ClientAttestationJwtPayload = v.InferOutput<typeof vClientAttestationJwtPayload>;
+declare const vClientAttestationJwtHeader: v.LooseObjectSchema<{
+    readonly typ: v.LiteralSchema<"oauth-client-attestation+jwt", undefined>;
+    readonly alg: v.SchemaWithPipe<[v.StringSchema<undefined>, v.CheckAction<string, "alg value may not be 'none'">]>;
+    readonly kid: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly jwk: v.OptionalSchema<v.LooseObjectSchema<{
+        readonly kty: v.StringSchema<undefined>;
+        readonly crv: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly y: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly e: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly n: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly alg: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly dp: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly dq: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly ext: v.OptionalSchema<v.BooleanSchema<undefined>, never>;
+        readonly k: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly key_ops: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly kid: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly oth: v.OptionalSchema<v.ArraySchema<v.LooseObjectSchema<{
+            readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly r: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        }, undefined>, undefined>, never>;
+        readonly p: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly q: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly qi: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly use: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x5c: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x5t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly 'x5t#S256': v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x5u: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    }, undefined>, never>;
+    readonly x5c: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, never>;
+    readonly trust_chain: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, never>;
+}, undefined>;
+type ClientAttestationJwtHeader = v.InferOutput<typeof vClientAttestationJwtHeader>;
+declare const vClientAttestationPopJwtPayload: v.LooseObjectSchema<{
+    readonly iss: v.StringSchema<undefined>;
+    readonly exp: v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>;
+    readonly aud: v.SchemaWithPipe<[v.StringSchema<undefined>, v.UrlAction<string, undefined>, v.CheckAction<string, "url must be an https:// url">]>;
+    readonly jti: v.StringSchema<undefined>;
+    readonly nonce: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly iat: v.OptionalSchema<v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>, never>;
+    readonly nbf: v.OptionalSchema<v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>, never>;
+    readonly cnf: v.OptionalSchema<v.LooseObjectSchema<{
+        readonly jwk: v.OptionalSchema<v.LooseObjectSchema<{
+            readonly kty: v.StringSchema<undefined>;
+            readonly crv: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly y: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly e: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly n: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly alg: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly dp: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly dq: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly ext: v.OptionalSchema<v.BooleanSchema<undefined>, never>;
+            readonly k: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly key_ops: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly kid: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly oth: v.OptionalSchema<v.ArraySchema<v.LooseObjectSchema<{
+                readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+                readonly r: v.OptionalSchema<v.StringSchema<undefined>, never>;
+                readonly t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            }, undefined>, undefined>, never>;
+            readonly p: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly q: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly qi: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly use: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5c: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly 'x5t#S256': v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5u: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        }, undefined>, never>;
+        readonly jkt: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    }, undefined>, never>;
+    readonly status: v.OptionalSchema<v.LooseObjectSchema<{}, undefined>, never>;
+}, undefined>;
+type ClientAttestationPopJwtPayload = v.InferOutput<typeof vClientAttestationPopJwtPayload>;
+declare const vClientAttestationPopJwtHeader: v.LooseObjectSchema<{
+    readonly typ: v.LiteralSchema<"oauth-client-attestation-pop+jwt", undefined>;
+    readonly alg: v.SchemaWithPipe<[v.StringSchema<undefined>, v.CheckAction<string, "alg value may not be 'none'">]>;
+    readonly kid: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly jwk: v.OptionalSchema<v.LooseObjectSchema<{
+        readonly kty: v.StringSchema<undefined>;
+        readonly crv: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly y: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly e: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly n: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly alg: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly dp: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly dq: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly ext: v.OptionalSchema<v.BooleanSchema<undefined>, never>;
+        readonly k: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly key_ops: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly kid: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly oth: v.OptionalSchema<v.ArraySchema<v.LooseObjectSchema<{
+            readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly r: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        }, undefined>, undefined>, never>;
+        readonly p: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly q: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly qi: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly use: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x5c: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x5t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly 'x5t#S256': v.OptionalSchema<v.StringSchema<undefined>, never>;
+        readonly x5u: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    }, undefined>, never>;
+    readonly x5c: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, never>;
+    readonly trust_chain: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, never>;
+}, undefined>;
+type ClientAttestationPopJwtHeader = v.InferOutput<typeof vClientAttestationPopJwtHeader>;
+
+interface RequestClientAttestationOptions {
+    /**
+     * Dpop nonce to use for constructing the client attestation pop jwt
+     */
+    nonce?: string;
+    /**
+     * Expiration time of the client attestation pop jwt.
+     *
+     * @default 5 minutes after issuance date
+     */
+    expiresAt?: Date;
+    /**
+     * The client attestation jwt to create the pop for.
+     */
+    jwt: string;
+    /**
+     * The signer of the client attestation pop jwt
+     */
+    signer: JwtSignerJwk;
+    /**
+     * Whether to include the legacy draft 2 `client_assertion` and `client_assertion_type` properties
+     * IN ADDITION to the new header syntax
+     *
+     * @default false
+     */
+    includeLegacyDraft2ClientAssertion?: boolean;
+}
+
+interface Oauth2ErrorOptions {
+    cause?: unknown;
+}
+declare class Oauth2Error extends Error {
+    readonly cause?: unknown;
+    constructor(message?: string, options?: Oauth2ErrorOptions);
+}
+
+declare class Oauth2JwtVerificationError extends Oauth2Error {
+    constructor(message?: string, options?: Oauth2ErrorOptions);
+}
+
+declare class Oauth2JwtParseError extends Oauth2Error {
+    constructor(message?: string);
+}
+
+declare enum SupportedAuthenticationScheme {
+    Bearer = "Bearer",
+    DPoP = "DPoP"
+}
+
+interface WwwAuthenticateHeaderChallenge {
+    scheme: SupportedAuthenticationScheme | (string & {});
+    /**
+     * Space delimited scope value that lists scopes required
+     * to access this resource.
+     */
+    scope?: string;
+    /**
+     * Error should only be undefined if no access token was provided at all
+     */
+    error?: Oauth2ErrorCodes | string;
+    error_description?: string;
+    /**
+     * Additional payload items to include in the Www-Authenticate
+     * header response.
+     */
+    additionalPayload?: Record<string, string>;
+}
+declare class Oauth2ResourceUnauthorizedError extends Oauth2Error {
+    readonly wwwAuthenticateHeaders: WwwAuthenticateHeaderChallenge[];
+    constructor(internalMessage: string | undefined, wwwAuthenticateHeaders: WwwAuthenticateHeaderChallenge | Array<WwwAuthenticateHeaderChallenge>);
+    static fromHeaderValue(value: string): Oauth2ResourceUnauthorizedError;
+    toHeaderValue(): string;
+}
+
+declare class Oauth2ClientErrorResponseError extends Oauth2Error {
+    readonly errorResponse: Oauth2ErrorResponse;
+    readonly response: FetchResponse;
+    constructor(message: string, errorResponse: Oauth2ErrorResponse, response: FetchResponse);
+}
+
+declare const vAuthorizationChallengeRequest: v.LooseObjectSchema<{
+    readonly client_id: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly auth_session: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly presentation_during_issuance_session: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly redirect_uri: v.OptionalSchema<v.SchemaWithPipe<[v.StringSchema<undefined>, v.UrlAction<string, undefined>]>, never>;
+    readonly resource: v.OptionalSchema<v.SchemaWithPipe<[v.StringSchema<undefined>, v.UrlAction<string, undefined>, v.CheckAction<string, "url must be an https:// url">]>, never>;
+    readonly scope: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly issuer_state: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly dpop_jkt: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly code_challenge: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly code_challenge_method: v.OptionalSchema<v.StringSchema<undefined>, never>;
+}, undefined>;
+type AuthorizationChallengeRequest = v.InferOutput<typeof vAuthorizationChallengeRequest>;
+declare const vAuthorizationChallengeResponse: v.LooseObjectSchema<{
+    readonly authorization_code: v.StringSchema<undefined>;
+}, undefined>;
+type AuthorizationChallengeResponse = v.InferOutput<typeof vAuthorizationChallengeResponse>;
+declare const vAuthorizationChallengeErrorResponse: v.LooseObjectSchema<{
+    readonly auth_session: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly request_uri: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly expires_in: v.OptionalSchema<v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>, never>;
+    readonly presentation: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly error: v.UnionSchema<[v.EnumSchema<typeof Oauth2ErrorCodes, undefined>, v.StringSchema<undefined>], undefined>;
+    readonly error_description: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly error_uri: v.OptionalSchema<v.StringSchema<undefined>, never>;
+}, undefined>;
+type AuthorizationChallengeErrorResponse = v.InferOutput<typeof vAuthorizationChallengeErrorResponse>;
+
+declare class Oauth2ClientAuthorizationChallengeError extends Oauth2ClientErrorResponseError {
+    readonly errorResponse: AuthorizationChallengeErrorResponse;
+    constructor(message: string, errorResponse: AuthorizationChallengeErrorResponse, response: FetchResponse);
+}
+
+interface Oauth2ServerErrorResponseErrorOptions extends Oauth2ErrorOptions {
+    internalMessage?: string;
+    /**
+     * @default 400
+     */
+    status?: number;
+}
+declare class Oauth2ServerErrorResponseError extends Oauth2Error {
+    readonly errorResponse: Oauth2ErrorResponse;
+    readonly status: number;
+    constructor(errorResponse: Oauth2ErrorResponse, options?: Oauth2ServerErrorResponseErrorOptions);
+}
+
+/**
+ * fetch authorization server metadata. It first tries to fetch the openid configuration. If that reutrns
+ *  a 404, the oauth authorization server metadata will be tries.
+ */
+declare function fetchAuthorizationServerMetadata(issuer: string, fetch?: Fetch): Promise<AuthorizationServerMetadata | null>;
+declare function getAuthorizationServerMetadataFromList(authorizationServersMetadata: AuthorizationServerMetadata[], issuer: string): {
+    issuer: string;
+    token_endpoint: string;
+    token_endpoint_auth_methods_supported?: string[] | undefined;
+    authorization_endpoint?: string | undefined;
+    jwks_uri?: string | undefined;
+    code_challenge_methods_supported?: string[] | undefined;
+    dpop_signing_alg_values_supported?: string[] | undefined;
+    require_pushed_authorization_requests?: boolean | undefined;
+    pushed_authorization_request_endpoint?: string | undefined;
+    introspection_endpoint?: string | undefined;
+    introspection_endpoint_auth_methods_supported?: string[] | undefined;
+    introspection_endpoint_auth_signing_alg_values_supported?: string[] | undefined;
+    authorization_challenge_endpoint?: string | undefined;
+    'pre-authorized_grant_anonymous_access_supported'?: boolean | undefined;
+} & {
+    [key: string]: unknown;
+};
+
+/**
+ * Fetch JWKs from jwks_uri in authorization server metadata
+ *
+ * Returns null if 404 is returned
+ * Returns validated metadata if successfull response
+ * Throws error otherwise
+ *
+ * @throws {ValidationError} if successfull response but validation of response failed
+ * @throws {InvalidFetchResponseError} if unsuccesful response
+ * @throws {Oauth2Error} if authorization server does not have a jwks_uri
+ */
+declare function fetchJwks(authorizationServer: AuthorizationServerMetadata, fetch?: Fetch): Promise<JwkSet>;
+
+/**
+ * Fetch well known metadata and validate the response.
+ *
+ * Returns null if 404 is returned
+ * Returns validated metadata if successfull response
+ * Throws error otherwise
+ *
+ * @throws {ValidationError} if successfull response but validation of response failed
+ * @throws {InvalidFetchResponseError} if no successfull or 404 response
+ * @throws {Error} if parsing json from response fails
+ */
+declare function fetchWellKnownMetadata<Schema extends BaseSchema>(wellKnownMetadataUrl: string, schema: Schema, fetch?: Fetch): Promise<v.InferOutput<Schema> | null>;
+
+declare const vTokenIntrospectionResponse: v.LooseObjectSchema<{
+    readonly active: v.BooleanSchema<undefined>;
+    readonly scope: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly client_id: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly username: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly token_type: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly exp: v.OptionalSchema<v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>, never>;
+    readonly iat: v.OptionalSchema<v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>, never>;
+    readonly nbf: v.OptionalSchema<v.SchemaWithPipe<[v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>, never>;
+    readonly sub: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly aud: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly iss: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly jti: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    readonly cnf: v.OptionalSchema<v.LooseObjectSchema<{
+        readonly jwk: v.OptionalSchema<v.LooseObjectSchema<{
+            readonly kty: v.StringSchema<undefined>;
+            readonly crv: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly y: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly e: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly n: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly alg: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly dp: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly dq: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly ext: v.OptionalSchema<v.BooleanSchema<undefined>, never>;
+            readonly k: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly key_ops: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly kid: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly oth: v.OptionalSchema<v.ArraySchema<v.LooseObjectSchema<{
+                readonly d: v.OptionalSchema<v.StringSchema<undefined>, never>;
+                readonly r: v.OptionalSchema<v.StringSchema<undefined>, never>;
+                readonly t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            }, undefined>, undefined>, never>;
+            readonly p: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly q: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly qi: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly use: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5c: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5t: v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly 'x5t#S256': v.OptionalSchema<v.StringSchema<undefined>, never>;
+            readonly x5u: v.OptionalSchema<v.StringSchema<undefined>, never>;
+        }, undefined>, never>;
+        readonly jkt: v.OptionalSchema<v.StringSchema<undefined>, never>;
+    }, undefined>, never>;
+}, undefined>;
+type TokenIntrospectionResponse = v.InferOutput<typeof vTokenIntrospectionResponse>;
+
+declare enum PkceCodeChallengeMethod {
+    Plain = "plain",
+    S256 = "S256"
+}
+interface CreatePkceReturn {
+    codeVerifier: string;
+    codeChallenge: string;
+    codeChallengeMethod: PkceCodeChallengeMethod;
+}
+
+declare const vPreAuthorizedCodeGrantIdentifier: v.LiteralSchema<"urn:ietf:params:oauth:grant-type:pre-authorized_code", undefined>;
+declare const preAuthorizedCodeGrantIdentifier: "urn:ietf:params:oauth:grant-type:pre-authorized_code";
+type PreAuthorizedCodeGrantIdentifier = v.InferOutput<typeof vPreAuthorizedCodeGrantIdentifier>;
+declare const vAuthorizationCodeGrantIdentifier: v.LiteralSchema<"authorization_code", undefined>;
+declare const authorizationCodeGrantIdentifier: "authorization_code";
+type AuthorizationCodeGrantIdentifier = v.InferOutput<typeof vAuthorizationCodeGrantIdentifier>;
+declare const vRefreshTokenGrantIdentifier: v.LiteralSchema<"refresh_token", undefined>;
+declare const refreshTokenGrantIdentifier: "refresh_token";
+type RefreshTokenGrantIdentifier = v.InferOutput<typeof vRefreshTokenGrantIdentifier>;
+
+interface ParsedAccessTokenPreAuthorizedCodeRequestGrant {
+    grantType: PreAuthorizedCodeGrantIdentifier;
+    preAuthorizedCode: string;
+    txCode?: string;
+}
+interface ParsedAccessTokenAuthorizationCodeRequestGrant {
+    grantType: AuthorizationCodeGrantIdentifier;
+    code: string;
+}
+type ParsedAccessTokenRequestGrant = ParsedAccessTokenPreAuthorizedCodeRequestGrant | ParsedAccessTokenAuthorizationCodeRequestGrant;
+interface ParseAccessTokenRequestResult {
+    accessTokenRequest: AccessTokenRequest;
+    grant: ParsedAccessTokenRequestGrant;
+    /**
+     * The dpop jwt from the access token request headers
+     */
+    dpopJwt?: string;
+    /**
+     * The pkce code verifier from the access token request
+     */
+    pkceCodeVerifier?: string;
+}
+interface ParseAccessTokenRequestOptions {
+    request: RequestLike;
+    /**
+     * The access token request as a JSON object. Your server should decode the
+     * `x-www-url-form-urlencoded` body into an object (e.g. using `bodyParser.urlEncoed()` in express)
+     */
+    accessTokenRequest: Record<string, unknown>;
+}
+
+interface VerifyAccessTokenRequestDpop {
+    /**
+     * Whether dpop is required
+     */
+    required?: boolean;
+    /**
+     * The dpop jwt from the access token request
+     */
+    jwt?: string;
+    /**
+     * Allowed dpop signing alg values. If not provided
+     * any alg values are allowed and it's up to the `verifyJwtCallback`
+     * to handle the alg.
+     */
+    allowedSigningAlgs?: string[];
+}
+interface VerifyAccessTokenRequestPkce {
+    codeVerifier?: string;
+    codeChallenge: string;
+    codeChallengeMethod: PkceCodeChallengeMethod;
+}
+interface VerifyAccessTokenRequestReturn {
+    dpopJwk?: Jwk;
+}
+interface VerifyPreAuthorizedCodeAccessTokenRequestOptions {
+    grant: ParsedAccessTokenPreAuthorizedCodeRequestGrant;
+    accessTokenRequest: AccessTokenRequest;
+    request: RequestLike;
+    expectedPreAuthorizedCode: string;
+    expectedTxCode?: string;
+    dpop?: VerifyAccessTokenRequestDpop;
+    pkce?: VerifyAccessTokenRequestPkce;
+    preAuthorizedCodeExpiresAt?: Date;
+    now?: Date;
+    callbacks: Pick<CallbackContext, 'hash' | 'verifyJwt'>;
+}
+interface VerifyAuthorizationCodeAccessTokenRequestOptions {
+    grant: ParsedAccessTokenAuthorizationCodeRequestGrant;
+    accessTokenRequest: AccessTokenRequest;
+    request: RequestLike;
+    expectedCode: string;
+    dpop?: VerifyAccessTokenRequestDpop;
+    pkce?: VerifyAccessTokenRequestPkce;
+    codeExpiresAt?: Date;
+    now?: Date;
+    callbacks: Pick<CallbackContext, 'hash' | 'verifyJwt'>;
+}
+
+interface RetrieveAccessTokenReturn {
+    accessTokenResponse: AccessTokenResponse;
+    dpop?: RequestDpopOptions;
+}
+interface RetrieveAccessTokenBaseOptions {
+    /**
+     * Authorization server to request the access token from
+     */
+    authorizationServerMetadata: AuthorizationServerMetadata;
+    /**
+     * Callbacks to use for requesting access token
+     */
+    callbacks: Pick<CallbackContext, 'fetch' | 'generateRandom' | 'hash' | 'signJwt'>;
+    /**
+     * The resource to which access is being requested. This can help the authorization
+     * server in determining the resource server to handle the authorization request for
+     */
+    resource?: string;
+    /**
+     * Dpop parameters for including a dpop in the access token request. The request will automatically
+     * be retried if the server responds with a 'use_dpop_nonce' header.
+     *
+     * If provided but 'dpop_signing_alg_values_supported' is not available in the authorization server
+     * metadata, or the 'alg' value does not match an error will be thrown.
+     */
+    dpop?: RequestDpopOptions;
+    /**
+     * If client attestation needs to be included in the request.
+     */
+    clientAttestation?: RequestClientAttestationOptions;
+}
+interface RetrievePreAuthorizedCodeAccessTokenOptions extends RetrieveAccessTokenBaseOptions {
+    preAuthorizedCode: string;
+    txCode?: string;
+    /**
+     * Additional payload to include in the access token request. Items will be encoded and sent
+     * using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded.
+     */
+    additionalRequestPayload?: Record<string, unknown>;
+}
+interface RetrieveAuthorizationCodeAccessTokenOptions extends RetrieveAccessTokenBaseOptions {
+    /**
+     * PKCE Code verifier that was used in the authorization request.
+     */
+    pkceCodeVerifier?: string;
+    /**
+     * The authorization code
+     */
+    authorizationCode: string;
+    /**
+     * Redirect uri to include in the access token request. Only required
+     * if the redirect uri was present in the authorization request.
+     */
+    redirectUri?: string;
+    /**
+     * Additional payload to include in the access token request. Items will be encoded and sent
+     * using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded.
+     */
+    additionalRequestPayload?: Record<string, unknown>;
+}
+interface RetrieveRefreshTokenAccessTokenOptions extends RetrieveAccessTokenBaseOptions {
+    /**
+     * The refresh token
+     */
+    refreshToken: string;
+    /**
+     * Additional payload to include in the access token request. Items will be encoded and sent
+     * using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded.
+     */
+    additionalRequestPayload?: Record<string, unknown>;
+}
+
+interface CreateAuthorizationRequestUrlOptions {
+    /**
+     * Callback context mostly for crypto related functionality
+     */
+    callbacks: Pick<CallbackContext, 'fetch' | 'hash' | 'generateRandom' | 'signJwt'>;
+    /**
+     * Metadata of the authorization server for which to create the authorization request url
+     */
+    authorizationServerMetadata: AuthorizationServerMetadata;
+    /**
+     * The client id to use for the authorization request
+     */
+    clientId: string;
+    /**
+     * Scope to request for the authorization request
+     */
+    scope?: string;
+    /**
+     * The resource to which access is being requested. This can help the authorization
+     * server in determining the resource server to handle the authorization request for
+     */
+    resource?: string;
+    /**
+     * Redirect uri to include in the authorization request
+     */
+    redirectUri?: string;
+    /**
+     * Additional payload to include in the authorization request. Items will be encoded and sent
+     * using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded.
+     */
+    additionalRequestPayload?: Record<string, unknown>;
+    /**
+     * Code verifier to use for pkce. If not provided a value will generated when pkce is supported
+     */
+    pkceCodeVerifier?: string;
+    /**
+     * If client attestation needs to be included in the request.
+     *
+     * Will ONLY be used if PAR is used.
+     */
+    clientAttestation?: RequestClientAttestationOptions;
+    /**
+     * DPoP options
+     *
+     * If PAR is not used only the `dpop_jkt` property will be included in the request
+     */
+    dpop?: RequestDpopOptions;
+}
+
+interface ResourceRequestOptions {
+    /**
+     * DPoP options
+     */
+    dpop?: RequestDpopOptions & {
+        /**
+         * Whether to retry the request if the server responds with an error indicating
+         * the request should be retried with a server provided dpop nonce
+         *
+         * @default true
+         */
+        retryWithNonce?: boolean;
+    };
+    /**
+     * Callbacks
+     */
+    callbacks: Pick<CallbackContext, 'fetch' | 'generateRandom' | 'signJwt' | 'hash'>;
+    /**
+     * Access token
+     */
+    accessToken: string;
+    url: string;
+    requestOptions: FetchRequestInit;
+}
+interface ResourceRequestResponseBase {
+    ok: boolean;
+    response: FetchResponse;
+    /**
+     * If the response included a dpop nonce to be used in subsequent requests
+     */
+    dpop?: {
+        nonce: string;
+    };
+}
+interface ResourceRequestResponseOk extends ResourceRequestResponseBase {
+    ok: true;
+}
+interface ResourceRequestResponseNotOk extends ResourceRequestResponseBase {
+    ok: false;
+    /**
+     * If a WWW-Authenticate was included in the headers of the response
+     * they will be parsed and added here.
+     */
+    wwwAuthenticate?: WwwAuthenticateHeaderChallenge[];
+}
+declare function resourceRequest(options: ResourceRequestOptions): Promise<ResourceRequestResponseOk | ResourceRequestResponseNotOk>;
+
+interface VerifyResourceRequestOptions {
+    /**
+     * The incoming request
+     */
+    request: RequestLike;
+    /**
+     * Identifier for the resource server, will be matched with the `aud` value of the access token.
+     */
+    resourceServer: string;
+    /**
+     * Callbacks for verification of the access token.
+     */
+    callbacks: Pick<CallbackContext, 'verifyJwt' | 'hash' | 'clientAuthentication' | 'fetch'>;
+    /**
+     * allowed auth schems for the access token. If not provided
+     * all supported authentication schemes are allowed.
+     */
+    allowedAuthenticationSchemes?: SupportedAuthenticationScheme[];
+    /**
+     * List of authorization servers that this resource endpoint supports
+     */
+    authorizationServers: AuthorizationServerMetadata[];
+    now?: Date;
+}
+declare function verifyResourceRequest(options: VerifyResourceRequestOptions): Promise<{
+    tokenPayload: ({
+        sub: string;
+        iss: string;
+        aud: string;
+        iat: number;
+        exp: number;
+        jti: string;
+        scope?: string | undefined;
+        client_id?: string | undefined;
+        nbf?: number | undefined;
+        nonce?: string | undefined;
+        cnf?: ({
+            jwk?: ({
+                kty: string;
+                crv?: string | undefined;
+                x?: string | undefined;
+                y?: string | undefined;
+                e?: string | undefined;
+                n?: string | undefined;
+                alg?: string | undefined;
+                d?: string | undefined;
+                dp?: string | undefined;
+                dq?: string | undefined;
+                ext?: boolean | undefined;
+                k?: string | undefined;
+                key_ops?: string | undefined;
+                kid?: string | undefined;
+                oth?: ({
+                    d?: string | undefined;
+                    r?: string | undefined;
+                    t?: string | undefined;
+                } & {
+                    [key: string]: unknown;
+                })[] | undefined;
+                p?: string | undefined;
+                q?: string | undefined;
+                qi?: string | undefined;
+                use?: string | undefined;
+                x5c?: string | undefined;
+                x5t?: string | undefined;
+                'x5t#S256'?: string | undefined;
+                x5u?: string | undefined;
+            } & {
+                [key: string]: unknown;
+            }) | undefined;
+            jkt?: string | undefined;
+        } & {
+            [key: string]: unknown;
+        }) | undefined;
+        status?: ({} & {
+            [key: string]: unknown;
+        }) | undefined;
+    } & {
+        [key: string]: unknown;
+    }) | ({
+        active: boolean;
+        sub?: string | undefined;
+        scope?: string | undefined;
+        token_type?: string | undefined;
+        client_id?: string | undefined;
+        iss?: string | undefined;
+        aud?: string | undefined;
+        iat?: number | undefined;
+        exp?: number | undefined;
+        nbf?: number | undefined;
+        jti?: string | undefined;
+        cnf?: ({
+            jwk?: ({
+                kty: string;
+                crv?: string | undefined;
+                x?: string | undefined;
+                y?: string | undefined;
+                e?: string | undefined;
+                n?: string | undefined;
+                alg?: string | undefined;
+                d?: string | undefined;
+                dp?: string | undefined;
+                dq?: string | undefined;
+                ext?: boolean | undefined;
+                k?: string | undefined;
+                key_ops?: string | undefined;
+                kid?: string | undefined;
+                oth?: ({
+                    d?: string | undefined;
+                    r?: string | undefined;
+                    t?: string | undefined;
+                } & {
+                    [key: string]: unknown;
+                })[] | undefined;
+                p?: string | undefined;
+                q?: string | undefined;
+                qi?: string | undefined;
+                use?: string | undefined;
+                x5c?: string | undefined;
+                x5t?: string | undefined;
+                'x5t#S256'?: string | undefined;
+                x5u?: string | undefined;
+            } & {
+                [key: string]: unknown;
+            }) | undefined;
+            jkt?: string | undefined;
+        } & {
+            [key: string]: unknown;
+        }) | undefined;
+        username?: string | undefined;
+    } & {
+        [key: string]: unknown;
+    });
+    dpopJwk: ({
+        kty: string;
+        crv?: string | undefined;
+        x?: string | undefined;
+        y?: string | undefined;
+        e?: string | undefined;
+        n?: string | undefined;
+        alg?: string | undefined;
+        d?: string | undefined;
+        dp?: string | undefined;
+        dq?: string | undefined;
+        ext?: boolean | undefined;
+        k?: string | undefined;
+        key_ops?: string | undefined;
+        kid?: string | undefined;
+        oth?: ({
+            d?: string | undefined;
+            r?: string | undefined;
+            t?: string | undefined;
+        } & {
+            [key: string]: unknown;
+        })[] | undefined;
+        p?: string | undefined;
+        q?: string | undefined;
+        qi?: string | undefined;
+        use?: string | undefined;
+        x5c?: string | undefined;
+        x5t?: string | undefined;
+        'x5t#S256'?: string | undefined;
+        x5u?: string | undefined;
+    } & {
+        [key: string]: unknown;
+    }) | undefined;
+    scheme: any;
+    accessToken: any;
+    authorizationServer: string;
+}>;
+
+interface CreateAccessTokenOptions {
+    callbacks: Pick<CallbackContext, 'signJwt' | 'generateRandom' | 'hash'>;
+    /**
+     * public dpop jwk key. Will be encoded as jwk thubmprint in the `cnf.jkt` claim.
+     */
+    dpopJwk?: Jwk;
+    /**
+     * scope of the access token. If the authorization request included scopes
+     * they should be added to the access token as well
+     */
+    scope?: string;
+    /**
+     * Client id to which the access token is bound.
+     * Can be undefined in case of anonymous access using pre authorized code flow
+     */
+    clientId?: string;
+    /**
+     * The authorization server that issues the access token
+     */
+    authorizationServer: string;
+    /**
+     * Signer of the access token
+     */
+    signer: JwtSigner;
+    /**
+     * Number of seconds after which the token will expire
+     */
+    expiresInSeconds: number;
+    /**
+     * The audience of the access token. Should be the `resource` if included in the authorization request
+     */
+    audience: string;
+    /**
+     * The subject of the access token. When a resource owner is involved,
+     * it should be an identifier for the resource owner.
+     */
+    subject: string;
+    /**
+     * Date that should be used as now. If not provided current date will be used.
+     */
+    now?: Date;
+    /**
+     * Additional payload claims to include in the access token JWT.
+     * Will override existing claims so you can override default behaviour, but be careful.
+     */
+    additionalPayload?: Record<string, unknown>;
+}
+
+interface CreateAccessTokenResponseOptions {
+    callbacks: Pick<CallbackContext, 'signJwt' | 'generateRandom' | 'hash'>;
+    /**
+     * The access token
+     */
+    accessToken: string;
+    /**
+     * The type of token. Should be DPoP if the access token
+     * is bound to a dpop key
+     */
+    tokenType: 'DPoP' | 'Bearer' | (string & {});
+    /**
+     * Number of seconds after which the access tokens expires.
+     */
+    expiresInSeconds: number;
+    /**
+     * New cNonce value
+     */
+    cNonce?: string;
+    cNonceExpiresIn?: number;
+    /**
+     * Additional payload to include in the access token response.
+     *
+     * Will be applied after default payload to allow overriding over values, but be careful.
+     */
+    additionalPayload?: Record<string, unknown>;
+}
+
+interface CreateAuthorizationChallengeResponseOptions {
+    /**
+     * The authorization code
+     */
+    authorizationCode: string;
+    /**
+     * Additional payload to include in the authorization challenge response.
+     */
+    additionalPayload?: Record<string, unknown>;
+}
+interface CreateAuthorizationChallengeErrorResponseOptions {
+    /**
+     * Auth session identifier for the authorization challenge. The client MUST include this
+     * in subsequent requests to the authorization challenge endpoint.
+     */
+    authSession?: string;
+    /**
+     * The presentation during issuance error.
+     *
+     * Error codes specific to authorization challenge are:
+     *  - @see Oauth2ErrorCodes.RedirectToWeb
+     *  - @see Oauth2ErrorCodes.InvalidSession
+     *  - @see Oauth2ErrorCodes.InsufficientAuthorization
+     *
+     * If you want to require presentation of a
+     */
+    error: StringWithAutoCompletion<Oauth2ErrorCodes>;
+    /**
+     * Optional error description
+     */
+    errorDescription?: string;
+    /**
+     * OpenID4VP authorization request url that must be completed before authorization
+     * can be granted
+     *
+     * Should be combined with `error` @see Oauth2ErrorCodes.InsufficientAuthorization
+     */
+    presentation?: string;
+    /**
+     * Optional PAR request uri, allowing the authorization challenge request to be treated
+     * as a succesfull pushed authorization request.
+     *
+     * Should be combined with `error` @see Oauth2ErrorCodes.RedirectToWeb
+     */
+    requestUri?: string;
+    /**
+     * Duration is seconds after which the `requestUri` parameter will expire. Should only be included
+     * if the `requestUri` is also included, and has no meaning otherwise
+     */
+    expiresIn?: number;
+    /**
+     * Additional payload to include in the authorization challenge error response.
+     */
+    additionalPayload?: Record<string, unknown>;
+}
+
+interface ParseAuthorizationChallengeRequestOptions {
+    authorizationChallengeRequest: unknown;
+}
+
+interface Oauth2AuthorizationServerOptions {
+    /**
+     * Callbacks required for the oauth2 authorization server
+     */
+    callbacks: CallbackContext;
+}
+declare class Oauth2AuthorizationServer {
+    private options;
+    constructor(options: Oauth2AuthorizationServerOptions);
+    createAuthorizationServerMetadata(authorizationServerMetadata: AuthorizationServerMetadata): {
+        issuer: string;
+        token_endpoint: string;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        authorization_endpoint?: string | undefined;
+        jwks_uri?: string | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        dpop_signing_alg_values_supported?: string[] | undefined;
+        require_pushed_authorization_requests?: boolean | undefined;
+        pushed_authorization_request_endpoint?: string | undefined;
+        introspection_endpoint?: string | undefined;
+        introspection_endpoint_auth_methods_supported?: string[] | undefined;
+        introspection_endpoint_auth_signing_alg_values_supported?: string[] | undefined;
+        authorization_challenge_endpoint?: string | undefined;
+        'pre-authorized_grant_anonymous_access_supported'?: boolean | undefined;
+    } & {
+        [key: string]: unknown;
+    };
+    /**
+     * Parse access token request and extract the grant specific properties.
+     *
+     * If something goes wrong, such as the grant is not supported, missing parameters, etc,
+     * it will throw `Oauth2ServerErrorResponseError` containing an error response object
+     * that can be returned to the client.
+     */
+    parseAccessTokenRequest(options: ParseAccessTokenRequestOptions): ParseAccessTokenRequestResult;
+    verifyPreAuthorizedCodeAccessTokenRequest(options: Omit<VerifyPreAuthorizedCodeAccessTokenRequestOptions, 'callbacks'>): Promise<VerifyAccessTokenRequestReturn>;
+    verifyAuthorizationCodeAccessTokenRequest(options: Omit<VerifyAuthorizationCodeAccessTokenRequestOptions, 'callbacks'>): Promise<VerifyAccessTokenRequestReturn>;
+    /**
+     * Create an access token response.
+     *
+     * The `sub` claim can be used to identify the resource owner is subsequent requests.
+     * For pre-auth flow this can be the pre-authorized_code but there are no requirements
+     * on the value.
+     */
+    createAccessTokenResponse(options: Pick<CreateAccessTokenOptions, 'expiresInSeconds' | 'scope' | 'clientId' | 'audience' | 'signer' | 'dpopJwk' | 'authorizationServer' | 'now' | 'subject'> & Pick<CreateAccessTokenResponseOptions, 'cNonce' | 'cNonceExpiresIn'> & {
+        additionalAccessTokenPayload?: CreateAccessTokenOptions['additionalPayload'];
+        additionalAccessTokenResponsePayload?: CreateAccessTokenResponseOptions['additionalPayload'];
+    }): Promise<{
+        access_token: string;
+        token_type: string;
+        refresh_token?: string | undefined;
+        expires_in?: number | undefined;
+        scope?: string | undefined;
+        state?: string | undefined;
+        c_nonce?: string | undefined;
+        c_nonce_expires_in?: number | undefined;
+        authorization_details?: ({} & {
+            [key: string]: unknown;
+        })[] | undefined;
+    } & {
+        [key: string]: unknown;
+    }>;
+    /**
+     * Parse an authorization challenge request
+     */
+    parseAuthorizationChallengeRequest(options: ParseAuthorizationChallengeRequestOptions): {
+        authorizationChallengeRequest: {
+            redirect_uri?: string | undefined;
+            resource?: string | undefined;
+            scope?: string | undefined;
+            client_id?: string | undefined;
+            issuer_state?: string | undefined;
+            dpop_jkt?: string | undefined;
+            code_challenge?: string | undefined;
+            code_challenge_method?: string | undefined;
+            auth_session?: string | undefined;
+            presentation_during_issuance_session?: string | undefined;
+        } & {
+            [key: string]: unknown;
+        };
+    };
+    createAuthorizationChallengeResponse(options: CreateAuthorizationChallengeResponseOptions): {
+        authorizationChallengeResponse: {
+            authorization_code: string;
+        } & {
+            [key: string]: unknown;
+        };
+    };
+    /**
+     * Create an authorization challenge error response indicating presentation of credenitals
+     * using OpenID4VP is required before authorization can be granted.
+     *
+     * The `presentation` parameter should be an OpenID4VP authorization request url.
+     * The `authSession` should be used to track the session
+     */
+    createAuthorizationChallengePresentationErrorResponse(options: Pick<CreateAuthorizationChallengeErrorResponseOptions, 'errorDescription' | 'additionalPayload'> & Required<Pick<CreateAuthorizationChallengeErrorResponseOptions, 'authSession' | 'presentation'>>): {
+        error: string;
+        error_description?: string | undefined;
+        error_uri?: string | undefined;
+        expires_in?: number | undefined;
+        request_uri?: string | undefined;
+        auth_session?: string | undefined;
+        presentation?: string | undefined;
+    } & {
+        [key: string]: unknown;
+    };
+    createAuthorizationChallengeErrorResponse(options: CreateAuthorizationChallengeErrorResponseOptions): {
+        error: string;
+        error_description?: string | undefined;
+        error_uri?: string | undefined;
+        expires_in?: number | undefined;
+        request_uri?: string | undefined;
+        auth_session?: string | undefined;
+        presentation?: string | undefined;
+    } & {
+        [key: string]: unknown;
+    };
+    verifyClientAttestation({ authorizationServer, headers, }: {
+        authorizationServer: string;
+        headers: FetchHeaders;
+    }): Promise<{
+        clientAttestation: {
+            header: {
+                alg: string;
+                typ: "oauth-client-attestation+jwt";
+                kid?: string | undefined;
+                x5c?: string[] | undefined;
+                jwk?: ({
+                    kty: string;
+                    crv?: string | undefined;
+                    x?: string | undefined;
+                    y?: string | undefined;
+                    e?: string | undefined;
+                    n?: string | undefined;
+                    alg?: string | undefined;
+                    d?: string | undefined;
+                    dp?: string | undefined;
+                    dq?: string | undefined;
+                    ext?: boolean | undefined;
+                    k?: string | undefined;
+                    key_ops?: string | undefined;
+                    kid?: string | undefined;
+                    oth?: ({
+                        d?: string | undefined;
+                        r?: string | undefined;
+                        t?: string | undefined;
+                    } & {
+                        [key: string]: unknown;
+                    })[] | undefined;
+                    p?: string | undefined;
+                    q?: string | undefined;
+                    qi?: string | undefined;
+                    use?: string | undefined;
+                    x5c?: string | undefined;
+                    x5t?: string | undefined;
+                    'x5t#S256'?: string | undefined;
+                    x5u?: string | undefined;
+                } & {
+                    [key: string]: unknown;
+                }) | undefined;
+                trust_chain?: string[] | undefined;
+            } & {
+                [key: string]: unknown;
+            };
+            payload: {
+                sub: string;
+                iss: string;
+                exp: number;
+                cnf: {
+                    jwk: {
+                        kty: string;
+                        crv?: string | undefined;
+                        x?: string | undefined;
+                        y?: string | undefined;
+                        e?: string | undefined;
+                        n?: string | undefined;
+                        alg?: string | undefined;
+                        d?: string | undefined;
+                        dp?: string | undefined;
+                        dq?: string | undefined;
+                        ext?: boolean | undefined;
+                        k?: string | undefined;
+                        key_ops?: string | undefined;
+                        kid?: string | undefined;
+                        oth?: ({
+                            d?: string | undefined;
+                            r?: string | undefined;
+                            t?: string | undefined;
+                        } & {
+                            [key: string]: unknown;
+                        })[] | undefined;
+                        p?: string | undefined;
+                        q?: string | undefined;
+                        qi?: string | undefined;
+                        use?: string | undefined;
+                        x5c?: string | undefined;
+                        x5t?: string | undefined;
+                        'x5t#S256'?: string | undefined;
+                        x5u?: string | undefined;
+                    } & {
+                        [key: string]: unknown;
+                    };
+                    key_type?: string | undefined;
+                    user_authentication?: string | undefined;
+                } & {
+                    [key: string]: unknown;
+                };
+                aud?: string | undefined;
+                iat?: number | undefined;
+                nbf?: number | undefined;
+                nonce?: string | undefined;
+                jti?: string | undefined;
+                status?: ({} & {
+                    [key: string]: unknown;
+                }) | undefined;
+                aal?: string | undefined;
+            } & {
+                [key: string]: unknown;
+            };
+            signer: JwtSignerWithJwk;
+        };
+        clientAttestationPop: {
+            header: {
+                alg: string;
+                typ: "oauth-client-attestation-pop+jwt";
+                kid?: string | undefined;
+                x5c?: string[] | undefined;
+                jwk?: ({
+                    kty: string;
+                    crv?: string | undefined;
+                    x?: string | undefined;
+                    y?: string | undefined;
+                    e?: string | undefined;
+                    n?: string | undefined;
+                    alg?: string | undefined;
+                    d?: string | undefined;
+                    dp?: string | undefined;
+                    dq?: string | undefined;
+                    ext?: boolean | undefined;
+                    k?: string | undefined;
+                    key_ops?: string | undefined;
+                    kid?: string | undefined;
+                    oth?: ({
+                        d?: string | undefined;
+                        r?: string | undefined;
+                        t?: string | undefined;
+                    } & {
+                        [key: string]: unknown;
+                    })[] | undefined;
+                    p?: string | undefined;
+                    q?: string | undefined;
+                    qi?: string | undefined;
+                    use?: string | undefined;
+                    x5c?: string | undefined;
+                    x5t?: string | undefined;
+                    'x5t#S256'?: string | undefined;
+                    x5u?: string | undefined;
+                } & {
+                    [key: string]: unknown;
+                }) | undefined;
+                trust_chain?: string[] | undefined;
+            } & {
+                [key: string]: unknown;
+            };
+            payload: {
+                iss: string;
+                aud: string;
+                exp: number;
+                jti: string;
+                iat?: number | undefined;
+                nbf?: number | undefined;
+                nonce?: string | undefined;
+                cnf?: ({
+                    jwk?: ({
+                        kty: string;
+                        crv?: string | undefined;
+                        x?: string | undefined;
+                        y?: string | undefined;
+                        e?: string | undefined;
+                        n?: string | undefined;
+                        alg?: string | undefined;
+                        d?: string | undefined;
+                        dp?: string | undefined;
+                        dq?: string | undefined;
+                        ext?: boolean | undefined;
+                        k?: string | undefined;
+                        key_ops?: string | undefined;
+                        kid?: string | undefined;
+                        oth?: ({
+                            d?: string | undefined;
+                            r?: string | undefined;
+                            t?: string | undefined;
+                        } & {
+                            [key: string]: unknown;
+                        })[] | undefined;
+                        p?: string | undefined;
+                        q?: string | undefined;
+                        qi?: string | undefined;
+                        use?: string | undefined;
+                        x5c?: string | undefined;
+                        x5t?: string | undefined;
+                        'x5t#S256'?: string | undefined;
+                        x5u?: string | undefined;
+                    } & {
+                        [key: string]: unknown;
+                    }) | undefined;
+                    jkt?: string | undefined;
+                } & {
+                    [key: string]: unknown;
+                }) | undefined;
+                status?: ({} & {
+                    [key: string]: unknown;
+                }) | undefined;
+            } & {
+                [key: string]: unknown;
+            };
+            signer: JwtSignerWithJwk;
+        };
+    }>;
+}
+
+interface Oauth2ResourceServerOptions {
+    /**
+     * Callbacks required for the oauth2 resource server
+     */
+    callbacks: Pick<CallbackContext, 'verifyJwt' | 'hash' | 'clientAuthentication' | 'fetch'>;
+}
+declare class Oauth2ResourceServer {
+    private options;
+    constructor(options: Oauth2ResourceServerOptions);
+    verifyResourceRequest(options: Omit<VerifyResourceRequestOptions, 'callbacks'>): Promise<{
+        tokenPayload: ({
+            sub: string;
+            iss: string;
+            aud: string;
+            iat: number;
+            exp: number;
+            jti: string;
+            scope?: string | undefined;
+            client_id?: string | undefined;
+            nbf?: number | undefined;
+            nonce?: string | undefined;
+            cnf?: ({
+                jwk?: ({
+                    kty: string;
+                    crv?: string | undefined;
+                    x?: string | undefined;
+                    y?: string | undefined;
+                    e?: string | undefined;
+                    n?: string | undefined;
+                    alg?: string | undefined;
+                    d?: string | undefined;
+                    dp?: string | undefined;
+                    dq?: string | undefined;
+                    ext?: boolean | undefined;
+                    k?: string | undefined;
+                    key_ops?: string | undefined;
+                    kid?: string | undefined;
+                    oth?: ({
+                        d?: string | undefined;
+                        r?: string | undefined;
+                        t?: string | undefined;
+                    } & {
+                        [key: string]: unknown;
+                    })[] | undefined;
+                    p?: string | undefined;
+                    q?: string | undefined;
+                    qi?: string | undefined;
+                    use?: string | undefined;
+                    x5c?: string | undefined;
+                    x5t?: string | undefined;
+                    'x5t#S256'?: string | undefined;
+                    x5u?: string | undefined;
+                } & {
+                    [key: string]: unknown;
+                }) | undefined;
+                jkt?: string | undefined;
+            } & {
+                [key: string]: unknown;
+            }) | undefined;
+            status?: ({} & {
+                [key: string]: unknown;
+            }) | undefined;
+        } & {
+            [key: string]: unknown;
+        }) | ({
+            active: boolean;
+            sub?: string | undefined;
+            scope?: string | undefined;
+            token_type?: string | undefined;
+            client_id?: string | undefined;
+            iss?: string | undefined;
+            aud?: string | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            jti?: string | undefined;
+            cnf?: ({
+                jwk?: ({
+                    kty: string;
+                    crv?: string | undefined;
+                    x?: string | undefined;
+                    y?: string | undefined;
+                    e?: string | undefined;
+                    n?: string | undefined;
+                    alg?: string | undefined;
+                    d?: string | undefined;
+                    dp?: string | undefined;
+                    dq?: string | undefined;
+                    ext?: boolean | undefined;
+                    k?: string | undefined;
+                    key_ops?: string | undefined;
+                    kid?: string | undefined;
+                    oth?: ({
+                        d?: string | undefined;
+                        r?: string | undefined;
+                        t?: string | undefined;
+                    } & {
+                        [key: string]: unknown;
+                    })[] | undefined;
+                    p?: string | undefined;
+                    q?: string | undefined;
+                    qi?: string | undefined;
+                    use?: string | undefined;
+                    x5c?: string | undefined;
+                    x5t?: string | undefined;
+                    'x5t#S256'?: string | undefined;
+                    x5u?: string | undefined;
+                } & {
+                    [key: string]: unknown;
+                }) | undefined;
+                jkt?: string | undefined;
+            } & {
+                [key: string]: unknown;
+            }) | undefined;
+            username?: string | undefined;
+        } & {
+            [key: string]: unknown;
+        });
+        dpopJwk: ({
+            kty: string;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            alg?: string | undefined;
+            d?: string | undefined;
+            dp?: string | undefined;
+            dq?: string | undefined;
+            ext?: boolean | undefined;
+            k?: string | undefined;
+            key_ops?: string | undefined;
+            kid?: string | undefined;
+            oth?: ({
+                d?: string | undefined;
+                r?: string | undefined;
+                t?: string | undefined;
+            } & {
+                [key: string]: unknown;
+            })[] | undefined;
+            p?: string | undefined;
+            q?: string | undefined;
+            qi?: string | undefined;
+            use?: string | undefined;
+            x5c?: string | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+        } & {
+            [key: string]: unknown;
+        }) | undefined;
+        scheme: any;
+        accessToken: any;
+        authorizationServer: string;
+    }>;
+}
+
+interface SendAuthorizationChallengeRequestOptions {
+    /**
+     * Callback context
+     */
+    callbacks: Pick<CallbackContext, 'fetch' | 'hash' | 'generateRandom' | 'signJwt'>;
+    /**
+     * Metadata of the authorization server where to perform the authorization challenge
+     */
+    authorizationServerMetadata: AuthorizationServerMetadata;
+    /**
+     * Previously established auth session
+     */
+    authSession?: string;
+    /**
+     * The client id to use for the authorization challenge request
+     */
+    clientId?: string;
+    /**
+     * Scope to request for the authorization challenge request
+     */
+    scope?: string;
+    /**
+     * The resource to which access is being requested. This can help the authorization
+     * server in determining the resource server to handle the authorization request for
+     */
+    resource?: string;
+    /**
+     * Presentation during issuance sessios if credentials were presented
+     * as part of an issuance session
+     */
+    presentationDuringIssuanceSession?: string;
+    /**
+     * Additional payload to include in the authorization challenge request. Items will be encoded and sent
+     * using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded.
+     */
+    additionalRequestPayload?: Record<string, unknown>;
+    /**
+     * Code verifier to use for pkce. If not provided a value will generated when pkce is supported
+     */
+    pkceCodeVerifier?: string;
+    /**
+     * If client attestation needs to be included in the request.
+     */
+    clientAttestation?: RequestClientAttestationOptions;
+    /**
+     * DPoP options
+     */
+    dpop?: RequestDpopOptions;
+}
+
+interface CreateClientAttestationJwtOptions {
+    /**
+     * Creation time of the JWT. If not provided the current date will be used
+     */
+    issuedAt?: Date;
+    /**
+     * Expiration time of the JWT.
+     */
+    expiresAt: Date;
+    /**
+     * Issuer of the client attestation, usually identifier of the client backend
+     */
+    issuer: string;
+    /**
+     * The client id of the client instance.
+     */
+    clientId: string;
+    /**
+     * The confirmation payload for the client, attesting the `jwk`, `key_type` and `user_authentication`
+     */
+    confirmation: ClientAttestationJwtPayload['cnf'];
+    /**
+     * Additional payload to include in the client attestation jwt payload. Will be applied after
+     * any default claims that are included, so add claims with caution.
+     */
+    additionalPayload?: Record<string, unknown>;
+    /**
+     * Callback used for client attestation
+     */
+    callbacks: Pick<CallbackContext, 'signJwt'>;
+    /**
+     * The signer of the client attestation jwt.
+     */
+    signer: JwtSigner;
+}
+
+interface Oauth2ClientOptions {
+    /**
+     * Callbacks required for the oauth2 client
+     */
+    callbacks: Omit<CallbackContext, 'verifyJwt' | 'clientAuthentication'>;
+}
+declare class Oauth2Client {
+    private options;
+    constructor(options: Oauth2ClientOptions);
+    isDpopSupported(options: {
+        authorizationServerMetadata: AuthorizationServerMetadata;
+    }): {
+        readonly supported: false;
+        readonly dpopSigningAlgValuesSupported?: undefined;
+    } | {
+        readonly supported: true;
+        readonly dpopSigningAlgValuesSupported: string[];
+    };
+    fetchAuthorizationServerMetadata(issuer: string): Promise<({
+        issuer: string;
+        token_endpoint: string;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        authorization_endpoint?: string | undefined;
+        jwks_uri?: string | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        dpop_signing_alg_values_supported?: string[] | undefined;
+        require_pushed_authorization_requests?: boolean | undefined;
+        pushed_authorization_request_endpoint?: string | undefined;
+        introspection_endpoint?: string | undefined;
+        introspection_endpoint_auth_methods_supported?: string[] | undefined;
+        introspection_endpoint_auth_signing_alg_values_supported?: string[] | undefined;
+        authorization_challenge_endpoint?: string | undefined;
+        'pre-authorized_grant_anonymous_access_supported'?: boolean | undefined;
+    } & {
+        [key: string]: unknown;
+    }) | null>;
+    /**
+     * Initiate authorization.
+     *
+     * It will take the followings steps:
+     * - if `authorization_challenge_endpoint` is defined, send an authorization challenge request
+     * - if authorization challenge request returns a `redirect_to_web` error code with `request_uri`
+     *   then construct the authorization request url based on the `request_uri`
+     * - if the `authorization_challenge_endpoint` is not defined, or authorization challenge request reuturns a `redirect_to_web` error code without `request_uri`
+     *   then the authorization request url will be constructed as usual (optionally using PAR).
+     *
+     * @throws {Oauth2ClientAuthorizationChallengeError} in case of an error response. If `error` is
+     * `insufficient_authorization` possible extra steps can be taken.
+     */
+    initiateAuthorization(options: Omit<CreateAuthorizationRequestUrlOptions, 'callbacks'>): Promise<{
+        authorizationRequestUrl: string;
+        pkce: CreatePkceReturn | undefined;
+        dpop: RequestDpopOptions | undefined;
+    } | {
+        dpop: {
+            nonce: any;
+            signer: JwtSignerJwk;
+        } | undefined;
+        authorizationRequestUrl: string;
+        pkce: CreatePkceReturn | undefined;
+    }>;
+    sendAuthorizationChallengeRequest(options: Omit<SendAuthorizationChallengeRequestOptions, 'callbacks'>): Promise<{
+        pkce: CreatePkceReturn | undefined;
+        dpop: {
+            nonce: any;
+            signer: JwtSignerJwk;
+        } | undefined;
+        authorizationChallengeResponse: {
+            authorization_code: string;
+        } & {
+            [key: string]: unknown;
+        };
+    }>;
+    createAuthorizationRequestUrl(options: Omit<CreateAuthorizationRequestUrlOptions, 'callbacks'>): Promise<{
+        authorizationRequestUrl: string;
+        pkce: CreatePkceReturn | undefined;
+        dpop: RequestDpopOptions | undefined;
+    }>;
+    retrievePreAuthorizedCodeAccessToken({ authorizationServerMetadata, preAuthorizedCode, additionalRequestPayload, txCode, dpop, resource, clientAttestation, }: Omit<RetrievePreAuthorizedCodeAccessTokenOptions, 'callbacks'>): Promise<RetrieveAccessTokenReturn>;
+    retrieveAuthorizationCodeAccessToken({ authorizationServerMetadata, additionalRequestPayload, authorizationCode, pkceCodeVerifier, redirectUri, resource, dpop, clientAttestation, }: Omit<RetrieveAuthorizationCodeAccessTokenOptions, 'callbacks'>): Promise<RetrieveAccessTokenReturn>;
+    retrieveRefreshTokenAccessToken({ authorizationServerMetadata, additionalRequestPayload, refreshToken, resource, dpop, clientAttestation, }: Omit<RetrieveRefreshTokenAccessTokenOptions, 'callbacks'>): Promise<RetrieveAccessTokenReturn>;
+    resourceRequest(options: ResourceRequestOptions): Promise<ResourceRequestResponseOk | ResourceRequestResponseNotOk>;
+    /**
+     * @todo move this to another class?
+     */
+    createClientAttestationJwt(options: Omit<CreateClientAttestationJwtOptions, 'callbacks'>): Promise<string>;
+}
+
+export { type AccessTokenErrorResponse, type AccessTokenProfileJwtPayload, type AccessTokenResponse, type AuthorizationChallengeErrorResponse, type AuthorizationChallengeRequest, type AuthorizationChallengeResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationServerMetadata, type CalculateJwkThumbprintOptions, type CallbackContext, type ClientAttestationJwtHeader, type ClientAttestationJwtPayload, type ClientAttestationPopJwtHeader, type ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationClientSecretBasicOptions, type ClientAuthenticationClientSecretPostOptions, type ClientAuthenticationDynamicOptions, type CreateAuthorizationRequestUrlOptions, type CreatePkceReturn, type DecodeJwtOptions, type DecodeJwtResult, type GenerateRandomCallback, HashAlgorithm, type HashCallback, type Jwk, type JwkSet, type JwtSigner, type JwtSignerCustom, type JwtSignerDid, type JwtSignerJwk, type JwtSignerWithJwk, type JwtSignerX5c, Oauth2AuthorizationServer, type Oauth2AuthorizationServerOptions, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, type Oauth2ClientOptions, Oauth2Error, Oauth2ErrorCodes, type Oauth2ErrorOptions, type Oauth2ErrorResponse, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, type Oauth2ResourceServerOptions, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, PkceCodeChallengeMethod, type PreAuthorizedCodeGrantIdentifier, type RefreshTokenGrantIdentifier, type RequestClientAttestationOptions, type RequestDpopOptions, type ResourceRequestOptions, type ResourceRequestResponseNotOk, type ResourceRequestResponseOk, type RetrieveAuthorizationCodeAccessTokenOptions, type RetrievePreAuthorizedCodeAccessTokenOptions, type SignJwtCallback, SupportedAuthenticationScheme, type TokenIntrospectionResponse, type VerifyAccessTokenRequestReturn, type VerifyJwtCallback, type VerifyJwtOptions, type VerifyResourceRequestOptions, type WwwAuthenticateHeaderChallenge, authorizationCodeGrantIdentifier, calculateJwkThumbprint, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, decodeJwt, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, getAuthorizationServerMetadataFromList, isJwkInSet, jwtHeaderFromJwtSigner, jwtSignerFromJwt, preAuthorizedCodeGrantIdentifier, refreshTokenGrantIdentifier, resourceRequest, vAuthorizationCodeGrantIdentifier, vAuthorizationServerMetadata, vCompactJwt, vJwk, vJwtHeader, vJwtPayload, vOauth2ErrorResponse, vPreAuthorizedCodeGrantIdentifier, vRefreshTokenGrantIdentifier, verifyJwt, verifyResourceRequest };