@openid4vc/oauth2 0.3.0-alpha-20250324183425 → 0.3.0-alpha-20250328112257

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/index.d.mts +2220 -492
  2. package/dist/index.d.ts +2220 -492
  3. package/dist/index.js +1105 -728
  4. package/dist/index.js.map +1 -1
  5. package/dist/index.mjs +1021 -647
  6. package/dist/index.mjs.map +1 -1
  7. package/package.json +2 -2
package/dist/index.d.mts CHANGED
@@ -1,6 +1,6 @@
1
1
  import * as z from 'zod';
2
2
  import z__default, { z as z$1 } from 'zod';
3
- import { HttpMethod, FetchHeaders, ContentType, OrPromise, Fetch, BaseSchema, FetchResponse, FetchRequestInit, StringWithAutoCompletion } from '@openid4vc/utils';
3
+ import { HttpMethod, FetchHeaders, ContentType, OrPromise, Fetch, BaseSchema, FetchResponse, StringWithAutoCompletion, FetchRequestInit } from '@openid4vc/utils';
4
4
  export { HttpMethod, InvalidFetchResponseError, Oid4vcTsConfig, getGlobalConfig, setGlobalConfig } from '@openid4vc/utils';
5
5
 
6
6
  declare enum Oauth2ErrorCodes {
@@ -149,7 +149,7 @@ type AccessTokenErrorResponse = z__default.infer<typeof zAccessTokenErrorRespons
149
149
  declare const zAuthorizationServerMetadata: z__default.ZodEffects<z__default.ZodObject<{
150
150
  issuer: z__default.ZodEffects<z__default.ZodString, string, string>;
151
151
  token_endpoint: z__default.ZodEffects<z__default.ZodString, string, string>;
152
- token_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodString, "many">>;
152
+ token_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z__default.ZodString]>, "many">>;
153
153
  authorization_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
154
154
  jwks_uri: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
155
155
  code_challenge_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodString, "many">>;
@@ -157,14 +157,15 @@ declare const zAuthorizationServerMetadata: z__default.ZodEffects<z__default.Zod
157
157
  require_pushed_authorization_requests: z__default.ZodOptional<z__default.ZodBoolean>;
158
158
  pushed_authorization_request_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
159
159
  introspection_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
160
- introspection_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodLiteral<"client_secret_jwt">, z__default.ZodLiteral<"private_key_jwt">, z__default.ZodString]>, "many">>;
160
+ introspection_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z__default.ZodString]>, "many">>;
161
161
  introspection_endpoint_auth_signing_alg_values_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodEffects<z__default.ZodString, string, string>, "many">>;
162
162
  authorization_challenge_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
163
163
  pre_authorized_grant_anonymous_access_supported: z__default.ZodOptional<z__default.ZodBoolean>;
164
+ client_attestation_pop_nonce_required: z__default.ZodOptional<z__default.ZodBoolean>;
164
165
  }, "passthrough", z__default.ZodTypeAny, z__default.objectOutputType<{
165
166
  issuer: z__default.ZodEffects<z__default.ZodString, string, string>;
166
167
  token_endpoint: z__default.ZodEffects<z__default.ZodString, string, string>;
167
- token_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodString, "many">>;
168
+ token_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z__default.ZodString]>, "many">>;
168
169
  authorization_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
169
170
  jwks_uri: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
170
171
  code_challenge_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodString, "many">>;
@@ -172,14 +173,15 @@ declare const zAuthorizationServerMetadata: z__default.ZodEffects<z__default.Zod
172
173
  require_pushed_authorization_requests: z__default.ZodOptional<z__default.ZodBoolean>;
173
174
  pushed_authorization_request_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
174
175
  introspection_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
175
- introspection_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodLiteral<"client_secret_jwt">, z__default.ZodLiteral<"private_key_jwt">, z__default.ZodString]>, "many">>;
176
+ introspection_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z__default.ZodString]>, "many">>;
176
177
  introspection_endpoint_auth_signing_alg_values_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodEffects<z__default.ZodString, string, string>, "many">>;
177
178
  authorization_challenge_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
178
179
  pre_authorized_grant_anonymous_access_supported: z__default.ZodOptional<z__default.ZodBoolean>;
180
+ client_attestation_pop_nonce_required: z__default.ZodOptional<z__default.ZodBoolean>;
179
181
  }, z__default.ZodTypeAny, "passthrough">, z__default.objectInputType<{
180
182
  issuer: z__default.ZodEffects<z__default.ZodString, string, string>;
181
183
  token_endpoint: z__default.ZodEffects<z__default.ZodString, string, string>;
182
- token_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodString, "many">>;
184
+ token_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z__default.ZodString]>, "many">>;
183
185
  authorization_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
184
186
  jwks_uri: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
185
187
  code_challenge_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodString, "many">>;
@@ -187,14 +189,15 @@ declare const zAuthorizationServerMetadata: z__default.ZodEffects<z__default.Zod
187
189
  require_pushed_authorization_requests: z__default.ZodOptional<z__default.ZodBoolean>;
188
190
  pushed_authorization_request_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
189
191
  introspection_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
190
- introspection_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodLiteral<"client_secret_jwt">, z__default.ZodLiteral<"private_key_jwt">, z__default.ZodString]>, "many">>;
192
+ introspection_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z__default.ZodString]>, "many">>;
191
193
  introspection_endpoint_auth_signing_alg_values_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodEffects<z__default.ZodString, string, string>, "many">>;
192
194
  authorization_challenge_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
193
195
  pre_authorized_grant_anonymous_access_supported: z__default.ZodOptional<z__default.ZodBoolean>;
196
+ client_attestation_pop_nonce_required: z__default.ZodOptional<z__default.ZodBoolean>;
194
197
  }, z__default.ZodTypeAny, "passthrough">>, z__default.objectOutputType<{
195
198
  issuer: z__default.ZodEffects<z__default.ZodString, string, string>;
196
199
  token_endpoint: z__default.ZodEffects<z__default.ZodString, string, string>;
197
- token_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodString, "many">>;
200
+ token_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z__default.ZodString]>, "many">>;
198
201
  authorization_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
199
202
  jwks_uri: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
200
203
  code_challenge_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodString, "many">>;
@@ -202,14 +205,15 @@ declare const zAuthorizationServerMetadata: z__default.ZodEffects<z__default.Zod
202
205
  require_pushed_authorization_requests: z__default.ZodOptional<z__default.ZodBoolean>;
203
206
  pushed_authorization_request_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
204
207
  introspection_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
205
- introspection_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodLiteral<"client_secret_jwt">, z__default.ZodLiteral<"private_key_jwt">, z__default.ZodString]>, "many">>;
208
+ introspection_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z__default.ZodString]>, "many">>;
206
209
  introspection_endpoint_auth_signing_alg_values_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodEffects<z__default.ZodString, string, string>, "many">>;
207
210
  authorization_challenge_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
208
211
  pre_authorized_grant_anonymous_access_supported: z__default.ZodOptional<z__default.ZodBoolean>;
212
+ client_attestation_pop_nonce_required: z__default.ZodOptional<z__default.ZodBoolean>;
209
213
  }, z__default.ZodTypeAny, "passthrough">, z__default.objectInputType<{
210
214
  issuer: z__default.ZodEffects<z__default.ZodString, string, string>;
211
215
  token_endpoint: z__default.ZodEffects<z__default.ZodString, string, string>;
212
- token_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodString, "many">>;
216
+ token_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z__default.ZodString]>, "many">>;
213
217
  authorization_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
214
218
  jwks_uri: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
215
219
  code_challenge_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodString, "many">>;
@@ -217,20 +221,30 @@ declare const zAuthorizationServerMetadata: z__default.ZodEffects<z__default.Zod
217
221
  require_pushed_authorization_requests: z__default.ZodOptional<z__default.ZodBoolean>;
218
222
  pushed_authorization_request_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
219
223
  introspection_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
220
- introspection_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodLiteral<"client_secret_jwt">, z__default.ZodLiteral<"private_key_jwt">, z__default.ZodString]>, "many">>;
224
+ introspection_endpoint_auth_methods_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodUnion<[z__default.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z__default.ZodString]>, "many">>;
221
225
  introspection_endpoint_auth_signing_alg_values_supported: z__default.ZodOptional<z__default.ZodArray<z__default.ZodEffects<z__default.ZodString, string, string>, "many">>;
222
226
  authorization_challenge_endpoint: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
223
227
  pre_authorized_grant_anonymous_access_supported: z__default.ZodOptional<z__default.ZodBoolean>;
228
+ client_attestation_pop_nonce_required: z__default.ZodOptional<z__default.ZodBoolean>;
224
229
  }, z__default.ZodTypeAny, "passthrough">>;
225
230
  type AuthorizationServerMetadata = z__default.infer<typeof zAuthorizationServerMetadata>;
226
231
 
232
+ declare enum SupportedClientAuthenticationMethod {
233
+ ClientSecretBasic = "client_secret_basic",
234
+ ClientSecretPost = "client_secret_post",
235
+ ClientAttestationJwt = "attest_jwt_client_auth",
236
+ None = "none"
237
+ }
227
238
  interface ClientAuthenticationDynamicOptions {
228
239
  clientId: string;
229
240
  clientSecret: string;
230
241
  }
231
242
  /**
232
243
  * Dynamicaly get the client authentication method based on endpoint type and authorization server.
233
- * Only `client_secret_post` and `client_secret_basic` supported.
244
+ * Only `client_secret_post`, `client_secret_basic`, and `none` supported.
245
+ *
246
+ * It also supports anonymous access to the token endpoint for pre-authorized code flow
247
+ * if the authorization server has enabled `pre_authorized_grant_anonymous_access_supported`
234
248
  */
235
249
  declare function clientAuthenticationDynamic(options: ClientAuthenticationDynamicOptions): ClientAuthenticationCallback;
236
250
  /**
@@ -240,7 +254,7 @@ interface ClientAuthenticationCallbackOptions {
240
254
  /**
241
255
  * Metadata of the authorization server
242
256
  */
243
- authorizationServerMetata: AuthorizationServerMetadata;
257
+ authorizationServerMetadata: AuthorizationServerMetadata;
244
258
  /**
245
259
  * URL to which the request will be made
246
260
  */
@@ -282,10 +296,25 @@ interface ClientAuthenticationClientSecretBasicOptions {
282
296
  * Client authentication using `client_secret_basic` option
283
297
  */
284
298
  declare function clientAuthenticationClientSecretBasic(options: ClientAuthenticationClientSecretBasicOptions): ClientAuthenticationCallback;
299
+ interface ClientAuthenticationNoneOptions {
300
+ clientId: string;
301
+ }
302
+ /**
303
+ * Client authentication using `none` option
304
+ */
305
+ declare function clientAuthenticationNone(options: ClientAuthenticationNoneOptions): ClientAuthenticationCallback;
306
+ /**
307
+ * Anonymous client authentication
308
+ */
309
+ declare function clientAuthenticationAnonymous(): ClientAuthenticationCallback;
310
+ interface ClientAuthenticationClientAttestationJwtOptions {
311
+ clientAttestationJwt: string;
312
+ callbacks: Pick<CallbackContext, 'signJwt' | 'generateRandom'>;
313
+ }
285
314
  /**
286
- * No client authentication
315
+ * Client authentication using `attest_jwt_client_auth` option.
287
316
  */
288
- declare function clientAuthenticationNone(): () => void;
317
+ declare function clientAuthenticationClientAttestationJwt(options: ClientAuthenticationClientAttestationJwtOptions): ClientAuthenticationCallback;
289
318
 
290
319
  declare const zJwk: z__default.ZodObject<{
291
320
  kty: z__default.ZodString;
@@ -2237,7 +2266,9 @@ interface CallbackContext {
2237
2266
  * There are three default client authentication methods provided:
2238
2267
  * - `clientAuthenticationClientSecretPost`
2239
2268
  * - `clientAuthenticationClientSecretBasic`
2269
+ * - `clientAuthenticationClientAttestationJwt`
2240
2270
  * - `clientAuthenticationNone`
2271
+ * - `clientAuthenticationAnonymous`
2241
2272
  *
2242
2273
  * A custom implementation can be made for other methods, or allowing complex
2243
2274
  * scenarios where multiple authorization servers are supported.
@@ -3529,8 +3560,6 @@ declare const zClientAttestationJwtPayload: z__default.ZodObject<{
3529
3560
  'x5t#S256': z__default.ZodOptional<z__default.ZodString>;
3530
3561
  x5u: z__default.ZodOptional<z__default.ZodString>;
3531
3562
  }, z__default.ZodTypeAny, "passthrough">>;
3532
- key_type: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]>, z__default.ZodString]>>;
3533
- user_authentication: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]>, z__default.ZodString]>>;
3534
3563
  }, "passthrough", z__default.ZodTypeAny, z__default.objectOutputType<{
3535
3564
  jwk: z__default.ZodObject<{
3536
3565
  kty: z__default.ZodString;
@@ -3641,8 +3670,6 @@ declare const zClientAttestationJwtPayload: z__default.ZodObject<{
3641
3670
  'x5t#S256': z__default.ZodOptional<z__default.ZodString>;
3642
3671
  x5u: z__default.ZodOptional<z__default.ZodString>;
3643
3672
  }, z__default.ZodTypeAny, "passthrough">>;
3644
- key_type: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]>, z__default.ZodString]>>;
3645
- user_authentication: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]>, z__default.ZodString]>>;
3646
3673
  }, z__default.ZodTypeAny, "passthrough">, z__default.objectInputType<{
3647
3674
  jwk: z__default.ZodObject<{
3648
3675
  kty: z__default.ZodString;
@@ -3753,10 +3780,9 @@ declare const zClientAttestationJwtPayload: z__default.ZodObject<{
3753
3780
  'x5t#S256': z__default.ZodOptional<z__default.ZodString>;
3754
3781
  x5u: z__default.ZodOptional<z__default.ZodString>;
3755
3782
  }, z__default.ZodTypeAny, "passthrough">>;
3756
- key_type: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]>, z__default.ZodString]>>;
3757
- user_authentication: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]>, z__default.ZodString]>>;
3758
3783
  }, z__default.ZodTypeAny, "passthrough">>;
3759
- aal: z__default.ZodOptional<z__default.ZodString>;
3784
+ wallet_name: z__default.ZodOptional<z__default.ZodString>;
3785
+ wallet_link: z__default.ZodOptional<z__default.ZodString>;
3760
3786
  aud: z__default.ZodOptional<z__default.ZodString>;
3761
3787
  iat: z__default.ZodOptional<z__default.ZodNumber>;
3762
3788
  nbf: z__default.ZodOptional<z__default.ZodNumber>;
@@ -3878,8 +3904,6 @@ declare const zClientAttestationJwtPayload: z__default.ZodObject<{
3878
3904
  'x5t#S256': z__default.ZodOptional<z__default.ZodString>;
3879
3905
  x5u: z__default.ZodOptional<z__default.ZodString>;
3880
3906
  }, z__default.ZodTypeAny, "passthrough">>;
3881
- key_type: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]>, z__default.ZodString]>>;
3882
- user_authentication: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]>, z__default.ZodString]>>;
3883
3907
  }, "passthrough", z__default.ZodTypeAny, z__default.objectOutputType<{
3884
3908
  jwk: z__default.ZodObject<{
3885
3909
  kty: z__default.ZodString;
@@ -3990,8 +4014,6 @@ declare const zClientAttestationJwtPayload: z__default.ZodObject<{
3990
4014
  'x5t#S256': z__default.ZodOptional<z__default.ZodString>;
3991
4015
  x5u: z__default.ZodOptional<z__default.ZodString>;
3992
4016
  }, z__default.ZodTypeAny, "passthrough">>;
3993
- key_type: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]>, z__default.ZodString]>>;
3994
- user_authentication: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]>, z__default.ZodString]>>;
3995
4017
  }, z__default.ZodTypeAny, "passthrough">, z__default.objectInputType<{
3996
4018
  jwk: z__default.ZodObject<{
3997
4019
  kty: z__default.ZodString;
@@ -4102,10 +4124,9 @@ declare const zClientAttestationJwtPayload: z__default.ZodObject<{
4102
4124
  'x5t#S256': z__default.ZodOptional<z__default.ZodString>;
4103
4125
  x5u: z__default.ZodOptional<z__default.ZodString>;
4104
4126
  }, z__default.ZodTypeAny, "passthrough">>;
4105
- key_type: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]>, z__default.ZodString]>>;
4106
- user_authentication: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]>, z__default.ZodString]>>;
4107
4127
  }, z__default.ZodTypeAny, "passthrough">>;
4108
- aal: z__default.ZodOptional<z__default.ZodString>;
4128
+ wallet_name: z__default.ZodOptional<z__default.ZodString>;
4129
+ wallet_link: z__default.ZodOptional<z__default.ZodString>;
4109
4130
  aud: z__default.ZodOptional<z__default.ZodString>;
4110
4131
  iat: z__default.ZodOptional<z__default.ZodNumber>;
4111
4132
  nbf: z__default.ZodOptional<z__default.ZodNumber>;
@@ -4227,8 +4248,6 @@ declare const zClientAttestationJwtPayload: z__default.ZodObject<{
4227
4248
  'x5t#S256': z__default.ZodOptional<z__default.ZodString>;
4228
4249
  x5u: z__default.ZodOptional<z__default.ZodString>;
4229
4250
  }, z__default.ZodTypeAny, "passthrough">>;
4230
- key_type: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]>, z__default.ZodString]>>;
4231
- user_authentication: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]>, z__default.ZodString]>>;
4232
4251
  }, "passthrough", z__default.ZodTypeAny, z__default.objectOutputType<{
4233
4252
  jwk: z__default.ZodObject<{
4234
4253
  kty: z__default.ZodString;
@@ -4339,8 +4358,6 @@ declare const zClientAttestationJwtPayload: z__default.ZodObject<{
4339
4358
  'x5t#S256': z__default.ZodOptional<z__default.ZodString>;
4340
4359
  x5u: z__default.ZodOptional<z__default.ZodString>;
4341
4360
  }, z__default.ZodTypeAny, "passthrough">>;
4342
- key_type: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]>, z__default.ZodString]>>;
4343
- user_authentication: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]>, z__default.ZodString]>>;
4344
4361
  }, z__default.ZodTypeAny, "passthrough">, z__default.objectInputType<{
4345
4362
  jwk: z__default.ZodObject<{
4346
4363
  kty: z__default.ZodString;
@@ -4451,10 +4468,9 @@ declare const zClientAttestationJwtPayload: z__default.ZodObject<{
4451
4468
  'x5t#S256': z__default.ZodOptional<z__default.ZodString>;
4452
4469
  x5u: z__default.ZodOptional<z__default.ZodString>;
4453
4470
  }, z__default.ZodTypeAny, "passthrough">>;
4454
- key_type: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]>, z__default.ZodString]>>;
4455
- user_authentication: z__default.ZodOptional<z__default.ZodUnion<[z__default.ZodEnum<["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]>, z__default.ZodString]>>;
4456
4471
  }, z__default.ZodTypeAny, "passthrough">>;
4457
- aal: z__default.ZodOptional<z__default.ZodString>;
4472
+ wallet_name: z__default.ZodOptional<z__default.ZodString>;
4473
+ wallet_link: z__default.ZodOptional<z__default.ZodString>;
4458
4474
  aud: z__default.ZodOptional<z__default.ZodString>;
4459
4475
  iat: z__default.ZodOptional<z__default.ZodNumber>;
4460
4476
  nbf: z__default.ZodOptional<z__default.ZodNumber>;
@@ -6209,270 +6225,1441 @@ interface RequestClientAttestationOptions {
6209
6225
  */
6210
6226
  jwt: string;
6211
6227
  /**
6212
- * The signer of the client attestation pop jwt
6213
- */
6214
- signer: JwtSignerJwk;
6215
- /**
6216
- * Whether to include the legacy draft 2 `client_assertion` and `client_assertion_type` properties
6217
- * IN ADDITION to the new header syntax
6228
+ * The signer of the client attestation pop jwt.
6218
6229
  *
6219
- * @default false
6230
+ * Will be extracted from the client attestation if not provided.
6220
6231
  */
6221
- includeLegacyDraft2ClientAssertion?: boolean;
6222
- }
6223
-
6224
- declare const zAlgValueNotNone: z__default.ZodEffects<z__default.ZodString, string, string>;
6225
- interface RequestLike {
6226
- headers: FetchHeaders;
6227
- method: HttpMethod;
6228
- url: string;
6232
+ signer?: JwtSignerJwk;
6229
6233
  }
6230
-
6231
- interface RequestDpopOptions {
6234
+ interface VerifyClientAttestationPopJwtOptions {
6232
6235
  /**
6233
- * Dpop nonce to use for constructing the dpop jwt
6236
+ * The compact client attestation pop jwt.
6234
6237
  */
6235
- nonce?: string;
6238
+ clientAttestationPopJwt: string;
6236
6239
  /**
6237
- * The signer of the dpop jwt
6240
+ * The issuer identifier of the authorization server handling the client attestation
6238
6241
  */
6239
- signer: JwtSignerJwk;
6240
- }
6241
-
6242
- declare const zAuthorizationChallengeRequest: z__default.ZodObject<{
6243
- client_id: z__default.ZodOptional<z__default.ZodString>;
6244
- auth_session: z__default.ZodOptional<z__default.ZodString>;
6245
- presentation_during_issuance_session: z__default.ZodOptional<z__default.ZodString>;
6246
- redirect_uri: z__default.ZodOptional<z__default.ZodString>;
6247
- resource: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
6248
- scope: z__default.ZodOptional<z__default.ZodString>;
6249
- issuer_state: z__default.ZodOptional<z__default.ZodString>;
6250
- dpop_jkt: z__default.ZodOptional<z__default.ZodString>;
6251
- code_challenge: z__default.ZodOptional<z__default.ZodString>;
6252
- code_challenge_method: z__default.ZodOptional<z__default.ZodString>;
6253
- }, "passthrough", z__default.ZodTypeAny, z__default.objectOutputType<{
6254
- client_id: z__default.ZodOptional<z__default.ZodString>;
6255
- auth_session: z__default.ZodOptional<z__default.ZodString>;
6256
- presentation_during_issuance_session: z__default.ZodOptional<z__default.ZodString>;
6257
- redirect_uri: z__default.ZodOptional<z__default.ZodString>;
6258
- resource: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
6259
- scope: z__default.ZodOptional<z__default.ZodString>;
6260
- issuer_state: z__default.ZodOptional<z__default.ZodString>;
6261
- dpop_jkt: z__default.ZodOptional<z__default.ZodString>;
6262
- code_challenge: z__default.ZodOptional<z__default.ZodString>;
6263
- code_challenge_method: z__default.ZodOptional<z__default.ZodString>;
6264
- }, z__default.ZodTypeAny, "passthrough">, z__default.objectInputType<{
6265
- client_id: z__default.ZodOptional<z__default.ZodString>;
6266
- auth_session: z__default.ZodOptional<z__default.ZodString>;
6267
- presentation_during_issuance_session: z__default.ZodOptional<z__default.ZodString>;
6268
- redirect_uri: z__default.ZodOptional<z__default.ZodString>;
6269
- resource: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
6270
- scope: z__default.ZodOptional<z__default.ZodString>;
6271
- issuer_state: z__default.ZodOptional<z__default.ZodString>;
6272
- dpop_jkt: z__default.ZodOptional<z__default.ZodString>;
6273
- code_challenge: z__default.ZodOptional<z__default.ZodString>;
6274
- code_challenge_method: z__default.ZodOptional<z__default.ZodString>;
6275
- }, z__default.ZodTypeAny, "passthrough">>;
6276
- type AuthorizationChallengeRequest = z__default.infer<typeof zAuthorizationChallengeRequest>;
6277
- declare const zAuthorizationChallengeResponse: z__default.ZodObject<{
6278
- authorization_code: z__default.ZodString;
6279
- }, "passthrough", z__default.ZodTypeAny, z__default.objectOutputType<{
6280
- authorization_code: z__default.ZodString;
6281
- }, z__default.ZodTypeAny, "passthrough">, z__default.objectInputType<{
6282
- authorization_code: z__default.ZodString;
6283
- }, z__default.ZodTypeAny, "passthrough">>;
6284
- type AuthorizationChallengeResponse = z__default.infer<typeof zAuthorizationChallengeResponse>;
6285
- declare const zAuthorizationChallengeErrorResponse: z__default.ZodObject<{
6286
- auth_session: z__default.ZodOptional<z__default.ZodString>;
6287
- request_uri: z__default.ZodOptional<z__default.ZodString>;
6288
- expires_in: z__default.ZodOptional<z__default.ZodNumber>;
6289
- presentation: z__default.ZodOptional<z__default.ZodString>;
6290
- error: z__default.ZodUnion<[z__default.ZodNativeEnum<typeof Oauth2ErrorCodes>, z__default.ZodString]>;
6291
- error_description: z__default.ZodOptional<z__default.ZodString>;
6292
- error_uri: z__default.ZodOptional<z__default.ZodString>;
6293
- }, "passthrough", z__default.ZodTypeAny, z__default.objectOutputType<{
6294
- auth_session: z__default.ZodOptional<z__default.ZodString>;
6295
- request_uri: z__default.ZodOptional<z__default.ZodString>;
6296
- expires_in: z__default.ZodOptional<z__default.ZodNumber>;
6297
- presentation: z__default.ZodOptional<z__default.ZodString>;
6298
- error: z__default.ZodUnion<[z__default.ZodNativeEnum<typeof Oauth2ErrorCodes>, z__default.ZodString]>;
6299
- error_description: z__default.ZodOptional<z__default.ZodString>;
6300
- error_uri: z__default.ZodOptional<z__default.ZodString>;
6301
- }, z__default.ZodTypeAny, "passthrough">, z__default.objectInputType<{
6302
- auth_session: z__default.ZodOptional<z__default.ZodString>;
6303
- request_uri: z__default.ZodOptional<z__default.ZodString>;
6304
- expires_in: z__default.ZodOptional<z__default.ZodNumber>;
6305
- presentation: z__default.ZodOptional<z__default.ZodString>;
6306
- error: z__default.ZodUnion<[z__default.ZodNativeEnum<typeof Oauth2ErrorCodes>, z__default.ZodString]>;
6307
- error_description: z__default.ZodOptional<z__default.ZodString>;
6308
- error_uri: z__default.ZodOptional<z__default.ZodString>;
6309
- }, z__default.ZodTypeAny, "passthrough">>;
6310
- type AuthorizationChallengeErrorResponse = z__default.infer<typeof zAuthorizationChallengeErrorResponse>;
6311
-
6312
- interface Oauth2ErrorOptions {
6313
- cause?: unknown;
6314
- }
6315
- declare class Oauth2Error extends Error {
6316
- readonly cause?: unknown;
6317
- constructor(message?: string, options?: Oauth2ErrorOptions);
6318
- }
6319
-
6320
- declare class Oauth2ClientErrorResponseError extends Oauth2Error {
6321
- readonly errorResponse: Oauth2ErrorResponse;
6322
- readonly response: FetchResponse;
6323
- constructor(message: string, errorResponse: Oauth2ErrorResponse, response: FetchResponse);
6324
- }
6325
-
6326
- declare class Oauth2ClientAuthorizationChallengeError extends Oauth2ClientErrorResponseError {
6327
- readonly errorResponse: AuthorizationChallengeErrorResponse;
6328
- constructor(message: string, errorResponse: AuthorizationChallengeErrorResponse, response: FetchResponse);
6329
- }
6330
-
6331
- declare class Oauth2JwtParseError extends Oauth2Error {
6332
- constructor(message?: string);
6333
- }
6334
-
6335
- declare class Oauth2JwtVerificationError extends Oauth2Error {
6336
- constructor(message?: string, options?: Oauth2ErrorOptions);
6337
- }
6338
-
6339
- declare enum SupportedAuthenticationScheme {
6340
- Bearer = "Bearer",
6341
- DPoP = "DPoP"
6342
- }
6343
-
6344
- interface WwwAuthenticateHeaderChallenge {
6345
- scheme: SupportedAuthenticationScheme | (string & {});
6242
+ authorizationServer: string;
6346
6243
  /**
6347
- * Space delimited scope value that lists scopes required
6348
- * to access this resource.
6244
+ * Expected nonce in the payload. If not provided the nonce won't be validated.
6349
6245
  */
6350
- scope?: string;
6246
+ expectedNonce?: string;
6351
6247
  /**
6352
- * Error should only be undefined if no access token was provided at all
6248
+ * Date to use for expiration. If not provided current date will be used.
6353
6249
  */
6354
- error?: Oauth2ErrorCodes | string;
6355
- error_description?: string;
6250
+ now?: Date;
6356
6251
  /**
6357
- * Additional payload items to include in the Www-Authenticate
6358
- * header response.
6252
+ * Callbacks used for verifying client attestation pop jwt.
6359
6253
  */
6360
- additionalPayload?: Record<string, string>;
6361
- }
6362
- declare class Oauth2ResourceUnauthorizedError extends Oauth2Error {
6363
- readonly wwwAuthenticateHeaders: WwwAuthenticateHeaderChallenge[];
6364
- constructor(internalMessage: string | undefined, wwwAuthenticateHeaders: WwwAuthenticateHeaderChallenge | Array<WwwAuthenticateHeaderChallenge>);
6365
- static fromHeaderValue(value: string): Oauth2ResourceUnauthorizedError;
6366
- toHeaderValue(): string;
6367
- }
6368
-
6369
- interface Oauth2ServerErrorResponseErrorOptions extends Oauth2ErrorOptions {
6370
- internalMessage?: string;
6254
+ callbacks: Pick<CallbackContext, 'verifyJwt'>;
6371
6255
  /**
6372
- * @default 400
6256
+ * The parsed and verified client attestation jwt
6373
6257
  */
6374
- status?: number;
6375
- }
6376
- declare class Oauth2ServerErrorResponseError extends Oauth2Error {
6377
- readonly errorResponse: Oauth2ErrorResponse;
6378
- readonly status: number;
6379
- constructor(errorResponse: Oauth2ErrorResponse, options?: Oauth2ServerErrorResponseErrorOptions);
6258
+ clientAttestation: {
6259
+ header: ClientAttestationJwtHeader;
6260
+ payload: ClientAttestationJwtPayload;
6261
+ };
6380
6262
  }
6381
-
6382
- /**
6383
- * fetch authorization server metadata. It first tries to fetch the oauth-authorization-server metadata. If that returns
6384
- * a 404, the openid-configuration metadata will be fetched.
6385
- */
6386
- declare function fetchAuthorizationServerMetadata(issuer: string, fetch?: Fetch): Promise<AuthorizationServerMetadata | null>;
6387
- declare function getAuthorizationServerMetadataFromList(authorizationServersMetadata: AuthorizationServerMetadata[], issuer: string): z.objectOutputType<{
6388
- issuer: z.ZodEffects<z.ZodString, string, string>;
6389
- token_endpoint: z.ZodEffects<z.ZodString, string, string>;
6390
- token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6391
- authorization_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
6392
- jwks_uri: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
6393
- code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6394
- dpop_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6395
- require_pushed_authorization_requests: z.ZodOptional<z.ZodBoolean>;
6396
- pushed_authorization_request_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
6397
- introspection_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
6398
- introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodLiteral<"client_secret_jwt">, z.ZodLiteral<"private_key_jwt">, z.ZodString]>, "many">>;
6399
- introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
6400
- authorization_challenge_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
6401
- pre_authorized_grant_anonymous_access_supported: z.ZodOptional<z.ZodBoolean>;
6402
- }, z.ZodTypeAny, "passthrough">;
6403
-
6404
- /**
6405
- * Fetch JWKs from a provided JWKs URI.
6406
- *
6407
- * Returns validated metadata if successfull response
6408
- * Throws error otherwise
6409
- *
6410
- * @throws {ValidationError} if successfull response but validation of response failed
6411
- * @throws {InvalidFetchResponseError} if unsuccesful response
6412
- */
6413
- declare function fetchJwks(jwksUrl: string, fetch?: Fetch): Promise<JwkSet>;
6414
-
6415
- /**
6416
- * Fetch well known metadata and validate the response.
6417
- *
6418
- * Returns null if 404 is returned
6419
- * Returns validated metadata if successfull response
6420
- * Throws error otherwise
6421
- *
6422
- * @throws {ValidationError} if successfull response but validation of response failed
6423
- * @throws {InvalidFetchResponseError} if no successfull or 404 response
6424
- * @throws {Error} if parsing json from response fails
6425
- */
6426
- declare function fetchWellKnownMetadata<Schema extends BaseSchema>(wellKnownMetadataUrl: string, schema: Schema, fetch?: Fetch): Promise<z__default.infer<Schema> | null>;
6427
-
6428
- declare const zTokenIntrospectionResponse: z__default.ZodObject<{
6429
- active: z__default.ZodBoolean;
6430
- scope: z__default.ZodOptional<z__default.ZodString>;
6431
- client_id: z__default.ZodOptional<z__default.ZodString>;
6432
- username: z__default.ZodOptional<z__default.ZodString>;
6433
- token_type: z__default.ZodOptional<z__default.ZodString>;
6434
- exp: z__default.ZodOptional<z__default.ZodNumber>;
6435
- iat: z__default.ZodOptional<z__default.ZodNumber>;
6436
- nbf: z__default.ZodOptional<z__default.ZodNumber>;
6437
- sub: z__default.ZodOptional<z__default.ZodString>;
6438
- aud: z__default.ZodOptional<z__default.ZodString>;
6439
- iss: z__default.ZodOptional<z__default.ZodString>;
6440
- jti: z__default.ZodOptional<z__default.ZodString>;
6441
- cnf: z__default.ZodOptional<z__default.ZodObject<{
6442
- jwk: z__default.ZodOptional<z__default.ZodObject<{
6443
- kty: z__default.ZodString;
6444
- crv: z__default.ZodOptional<z__default.ZodString>;
6445
- x: z__default.ZodOptional<z__default.ZodString>;
6446
- y: z__default.ZodOptional<z__default.ZodString>;
6447
- e: z__default.ZodOptional<z__default.ZodString>;
6448
- n: z__default.ZodOptional<z__default.ZodString>;
6449
- alg: z__default.ZodOptional<z__default.ZodString>;
6450
- d: z__default.ZodOptional<z__default.ZodString>;
6451
- dp: z__default.ZodOptional<z__default.ZodString>;
6452
- dq: z__default.ZodOptional<z__default.ZodString>;
6453
- ext: z__default.ZodOptional<z__default.ZodBoolean>;
6454
- k: z__default.ZodOptional<z__default.ZodString>;
6455
- key_ops: z__default.ZodOptional<z__default.ZodString>;
6456
- kid: z__default.ZodOptional<z__default.ZodString>;
6457
- oth: z__default.ZodOptional<z__default.ZodArray<z__default.ZodObject<{
6458
- d: z__default.ZodOptional<z__default.ZodString>;
6459
- r: z__default.ZodOptional<z__default.ZodString>;
6460
- t: z__default.ZodOptional<z__default.ZodString>;
6461
- }, "passthrough", z__default.ZodTypeAny, z__default.objectOutputType<{
6462
- d: z__default.ZodOptional<z__default.ZodString>;
6463
- r: z__default.ZodOptional<z__default.ZodString>;
6464
- t: z__default.ZodOptional<z__default.ZodString>;
6465
- }, z__default.ZodTypeAny, "passthrough">, z__default.objectInputType<{
6466
- d: z__default.ZodOptional<z__default.ZodString>;
6467
- r: z__default.ZodOptional<z__default.ZodString>;
6468
- t: z__default.ZodOptional<z__default.ZodString>;
6469
- }, z__default.ZodTypeAny, "passthrough">>, "many">>;
6470
- p: z__default.ZodOptional<z__default.ZodString>;
6471
- q: z__default.ZodOptional<z__default.ZodString>;
6472
- qi: z__default.ZodOptional<z__default.ZodString>;
6473
- use: z__default.ZodOptional<z__default.ZodString>;
6474
- x5c: z__default.ZodOptional<z__default.ZodArray<z__default.ZodString, "many">>;
6475
- x5t: z__default.ZodOptional<z__default.ZodString>;
6263
+ type VerifiedClientAttestationPopJwt = Awaited<ReturnType<typeof verifyClientAttestationPopJwt>>;
6264
+ declare function verifyClientAttestationPopJwt(options: VerifyClientAttestationPopJwtOptions): Promise<{
6265
+ header: z.objectOutputType<{
6266
+ typ: z.ZodLiteral<"oauth-client-attestation-pop+jwt">;
6267
+ alg: z.ZodEffects<z.ZodString, string, string>;
6268
+ kid: z.ZodOptional<z.ZodString>;
6269
+ jwk: z.ZodOptional<z.ZodObject<{
6270
+ kty: z.ZodString;
6271
+ crv: z.ZodOptional<z.ZodString>;
6272
+ x: z.ZodOptional<z.ZodString>;
6273
+ y: z.ZodOptional<z.ZodString>;
6274
+ e: z.ZodOptional<z.ZodString>;
6275
+ n: z.ZodOptional<z.ZodString>;
6276
+ alg: z.ZodOptional<z.ZodString>;
6277
+ d: z.ZodOptional<z.ZodString>;
6278
+ dp: z.ZodOptional<z.ZodString>;
6279
+ dq: z.ZodOptional<z.ZodString>;
6280
+ ext: z.ZodOptional<z.ZodBoolean>;
6281
+ k: z.ZodOptional<z.ZodString>;
6282
+ key_ops: z.ZodOptional<z.ZodString>;
6283
+ kid: z.ZodOptional<z.ZodString>;
6284
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6285
+ d: z.ZodOptional<z.ZodString>;
6286
+ r: z.ZodOptional<z.ZodString>;
6287
+ t: z.ZodOptional<z.ZodString>;
6288
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6289
+ d: z.ZodOptional<z.ZodString>;
6290
+ r: z.ZodOptional<z.ZodString>;
6291
+ t: z.ZodOptional<z.ZodString>;
6292
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6293
+ d: z.ZodOptional<z.ZodString>;
6294
+ r: z.ZodOptional<z.ZodString>;
6295
+ t: z.ZodOptional<z.ZodString>;
6296
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6297
+ p: z.ZodOptional<z.ZodString>;
6298
+ q: z.ZodOptional<z.ZodString>;
6299
+ qi: z.ZodOptional<z.ZodString>;
6300
+ use: z.ZodOptional<z.ZodString>;
6301
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6302
+ x5t: z.ZodOptional<z.ZodString>;
6303
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6304
+ x5u: z.ZodOptional<z.ZodString>;
6305
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6306
+ kty: z.ZodString;
6307
+ crv: z.ZodOptional<z.ZodString>;
6308
+ x: z.ZodOptional<z.ZodString>;
6309
+ y: z.ZodOptional<z.ZodString>;
6310
+ e: z.ZodOptional<z.ZodString>;
6311
+ n: z.ZodOptional<z.ZodString>;
6312
+ alg: z.ZodOptional<z.ZodString>;
6313
+ d: z.ZodOptional<z.ZodString>;
6314
+ dp: z.ZodOptional<z.ZodString>;
6315
+ dq: z.ZodOptional<z.ZodString>;
6316
+ ext: z.ZodOptional<z.ZodBoolean>;
6317
+ k: z.ZodOptional<z.ZodString>;
6318
+ key_ops: z.ZodOptional<z.ZodString>;
6319
+ kid: z.ZodOptional<z.ZodString>;
6320
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6321
+ d: z.ZodOptional<z.ZodString>;
6322
+ r: z.ZodOptional<z.ZodString>;
6323
+ t: z.ZodOptional<z.ZodString>;
6324
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6325
+ d: z.ZodOptional<z.ZodString>;
6326
+ r: z.ZodOptional<z.ZodString>;
6327
+ t: z.ZodOptional<z.ZodString>;
6328
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6329
+ d: z.ZodOptional<z.ZodString>;
6330
+ r: z.ZodOptional<z.ZodString>;
6331
+ t: z.ZodOptional<z.ZodString>;
6332
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6333
+ p: z.ZodOptional<z.ZodString>;
6334
+ q: z.ZodOptional<z.ZodString>;
6335
+ qi: z.ZodOptional<z.ZodString>;
6336
+ use: z.ZodOptional<z.ZodString>;
6337
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6338
+ x5t: z.ZodOptional<z.ZodString>;
6339
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6340
+ x5u: z.ZodOptional<z.ZodString>;
6341
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6342
+ kty: z.ZodString;
6343
+ crv: z.ZodOptional<z.ZodString>;
6344
+ x: z.ZodOptional<z.ZodString>;
6345
+ y: z.ZodOptional<z.ZodString>;
6346
+ e: z.ZodOptional<z.ZodString>;
6347
+ n: z.ZodOptional<z.ZodString>;
6348
+ alg: z.ZodOptional<z.ZodString>;
6349
+ d: z.ZodOptional<z.ZodString>;
6350
+ dp: z.ZodOptional<z.ZodString>;
6351
+ dq: z.ZodOptional<z.ZodString>;
6352
+ ext: z.ZodOptional<z.ZodBoolean>;
6353
+ k: z.ZodOptional<z.ZodString>;
6354
+ key_ops: z.ZodOptional<z.ZodString>;
6355
+ kid: z.ZodOptional<z.ZodString>;
6356
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6357
+ d: z.ZodOptional<z.ZodString>;
6358
+ r: z.ZodOptional<z.ZodString>;
6359
+ t: z.ZodOptional<z.ZodString>;
6360
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6361
+ d: z.ZodOptional<z.ZodString>;
6362
+ r: z.ZodOptional<z.ZodString>;
6363
+ t: z.ZodOptional<z.ZodString>;
6364
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6365
+ d: z.ZodOptional<z.ZodString>;
6366
+ r: z.ZodOptional<z.ZodString>;
6367
+ t: z.ZodOptional<z.ZodString>;
6368
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6369
+ p: z.ZodOptional<z.ZodString>;
6370
+ q: z.ZodOptional<z.ZodString>;
6371
+ qi: z.ZodOptional<z.ZodString>;
6372
+ use: z.ZodOptional<z.ZodString>;
6373
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6374
+ x5t: z.ZodOptional<z.ZodString>;
6375
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6376
+ x5u: z.ZodOptional<z.ZodString>;
6377
+ }, z.ZodTypeAny, "passthrough">>>;
6378
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6379
+ trust_chain: z.ZodOptional<z.ZodArray<z.ZodString, "atleastone">>;
6380
+ }, z.ZodTypeAny, "passthrough">;
6381
+ payload: z.objectOutputType<{
6382
+ iss: z.ZodString;
6383
+ exp: z.ZodNumber;
6384
+ aud: z.ZodEffects<z.ZodString, string, string>;
6385
+ jti: z.ZodString;
6386
+ nonce: z.ZodOptional<z.ZodString>;
6387
+ iat: z.ZodOptional<z.ZodNumber>;
6388
+ nbf: z.ZodOptional<z.ZodNumber>;
6389
+ cnf: z.ZodOptional<z.ZodObject<{
6390
+ jwk: z.ZodOptional<z.ZodObject<{
6391
+ kty: z.ZodString;
6392
+ crv: z.ZodOptional<z.ZodString>;
6393
+ x: z.ZodOptional<z.ZodString>;
6394
+ y: z.ZodOptional<z.ZodString>;
6395
+ e: z.ZodOptional<z.ZodString>;
6396
+ n: z.ZodOptional<z.ZodString>;
6397
+ alg: z.ZodOptional<z.ZodString>;
6398
+ d: z.ZodOptional<z.ZodString>;
6399
+ dp: z.ZodOptional<z.ZodString>;
6400
+ dq: z.ZodOptional<z.ZodString>;
6401
+ ext: z.ZodOptional<z.ZodBoolean>;
6402
+ k: z.ZodOptional<z.ZodString>;
6403
+ key_ops: z.ZodOptional<z.ZodString>;
6404
+ kid: z.ZodOptional<z.ZodString>;
6405
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6406
+ d: z.ZodOptional<z.ZodString>;
6407
+ r: z.ZodOptional<z.ZodString>;
6408
+ t: z.ZodOptional<z.ZodString>;
6409
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6410
+ d: z.ZodOptional<z.ZodString>;
6411
+ r: z.ZodOptional<z.ZodString>;
6412
+ t: z.ZodOptional<z.ZodString>;
6413
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6414
+ d: z.ZodOptional<z.ZodString>;
6415
+ r: z.ZodOptional<z.ZodString>;
6416
+ t: z.ZodOptional<z.ZodString>;
6417
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6418
+ p: z.ZodOptional<z.ZodString>;
6419
+ q: z.ZodOptional<z.ZodString>;
6420
+ qi: z.ZodOptional<z.ZodString>;
6421
+ use: z.ZodOptional<z.ZodString>;
6422
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6423
+ x5t: z.ZodOptional<z.ZodString>;
6424
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6425
+ x5u: z.ZodOptional<z.ZodString>;
6426
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6427
+ kty: z.ZodString;
6428
+ crv: z.ZodOptional<z.ZodString>;
6429
+ x: z.ZodOptional<z.ZodString>;
6430
+ y: z.ZodOptional<z.ZodString>;
6431
+ e: z.ZodOptional<z.ZodString>;
6432
+ n: z.ZodOptional<z.ZodString>;
6433
+ alg: z.ZodOptional<z.ZodString>;
6434
+ d: z.ZodOptional<z.ZodString>;
6435
+ dp: z.ZodOptional<z.ZodString>;
6436
+ dq: z.ZodOptional<z.ZodString>;
6437
+ ext: z.ZodOptional<z.ZodBoolean>;
6438
+ k: z.ZodOptional<z.ZodString>;
6439
+ key_ops: z.ZodOptional<z.ZodString>;
6440
+ kid: z.ZodOptional<z.ZodString>;
6441
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6442
+ d: z.ZodOptional<z.ZodString>;
6443
+ r: z.ZodOptional<z.ZodString>;
6444
+ t: z.ZodOptional<z.ZodString>;
6445
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6446
+ d: z.ZodOptional<z.ZodString>;
6447
+ r: z.ZodOptional<z.ZodString>;
6448
+ t: z.ZodOptional<z.ZodString>;
6449
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6450
+ d: z.ZodOptional<z.ZodString>;
6451
+ r: z.ZodOptional<z.ZodString>;
6452
+ t: z.ZodOptional<z.ZodString>;
6453
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6454
+ p: z.ZodOptional<z.ZodString>;
6455
+ q: z.ZodOptional<z.ZodString>;
6456
+ qi: z.ZodOptional<z.ZodString>;
6457
+ use: z.ZodOptional<z.ZodString>;
6458
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6459
+ x5t: z.ZodOptional<z.ZodString>;
6460
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6461
+ x5u: z.ZodOptional<z.ZodString>;
6462
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6463
+ kty: z.ZodString;
6464
+ crv: z.ZodOptional<z.ZodString>;
6465
+ x: z.ZodOptional<z.ZodString>;
6466
+ y: z.ZodOptional<z.ZodString>;
6467
+ e: z.ZodOptional<z.ZodString>;
6468
+ n: z.ZodOptional<z.ZodString>;
6469
+ alg: z.ZodOptional<z.ZodString>;
6470
+ d: z.ZodOptional<z.ZodString>;
6471
+ dp: z.ZodOptional<z.ZodString>;
6472
+ dq: z.ZodOptional<z.ZodString>;
6473
+ ext: z.ZodOptional<z.ZodBoolean>;
6474
+ k: z.ZodOptional<z.ZodString>;
6475
+ key_ops: z.ZodOptional<z.ZodString>;
6476
+ kid: z.ZodOptional<z.ZodString>;
6477
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6478
+ d: z.ZodOptional<z.ZodString>;
6479
+ r: z.ZodOptional<z.ZodString>;
6480
+ t: z.ZodOptional<z.ZodString>;
6481
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6482
+ d: z.ZodOptional<z.ZodString>;
6483
+ r: z.ZodOptional<z.ZodString>;
6484
+ t: z.ZodOptional<z.ZodString>;
6485
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6486
+ d: z.ZodOptional<z.ZodString>;
6487
+ r: z.ZodOptional<z.ZodString>;
6488
+ t: z.ZodOptional<z.ZodString>;
6489
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6490
+ p: z.ZodOptional<z.ZodString>;
6491
+ q: z.ZodOptional<z.ZodString>;
6492
+ qi: z.ZodOptional<z.ZodString>;
6493
+ use: z.ZodOptional<z.ZodString>;
6494
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6495
+ x5t: z.ZodOptional<z.ZodString>;
6496
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6497
+ x5u: z.ZodOptional<z.ZodString>;
6498
+ }, z.ZodTypeAny, "passthrough">>>;
6499
+ jkt: z.ZodOptional<z.ZodString>;
6500
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6501
+ jwk: z.ZodOptional<z.ZodObject<{
6502
+ kty: z.ZodString;
6503
+ crv: z.ZodOptional<z.ZodString>;
6504
+ x: z.ZodOptional<z.ZodString>;
6505
+ y: z.ZodOptional<z.ZodString>;
6506
+ e: z.ZodOptional<z.ZodString>;
6507
+ n: z.ZodOptional<z.ZodString>;
6508
+ alg: z.ZodOptional<z.ZodString>;
6509
+ d: z.ZodOptional<z.ZodString>;
6510
+ dp: z.ZodOptional<z.ZodString>;
6511
+ dq: z.ZodOptional<z.ZodString>;
6512
+ ext: z.ZodOptional<z.ZodBoolean>;
6513
+ k: z.ZodOptional<z.ZodString>;
6514
+ key_ops: z.ZodOptional<z.ZodString>;
6515
+ kid: z.ZodOptional<z.ZodString>;
6516
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6517
+ d: z.ZodOptional<z.ZodString>;
6518
+ r: z.ZodOptional<z.ZodString>;
6519
+ t: z.ZodOptional<z.ZodString>;
6520
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6521
+ d: z.ZodOptional<z.ZodString>;
6522
+ r: z.ZodOptional<z.ZodString>;
6523
+ t: z.ZodOptional<z.ZodString>;
6524
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6525
+ d: z.ZodOptional<z.ZodString>;
6526
+ r: z.ZodOptional<z.ZodString>;
6527
+ t: z.ZodOptional<z.ZodString>;
6528
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6529
+ p: z.ZodOptional<z.ZodString>;
6530
+ q: z.ZodOptional<z.ZodString>;
6531
+ qi: z.ZodOptional<z.ZodString>;
6532
+ use: z.ZodOptional<z.ZodString>;
6533
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6534
+ x5t: z.ZodOptional<z.ZodString>;
6535
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6536
+ x5u: z.ZodOptional<z.ZodString>;
6537
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6538
+ kty: z.ZodString;
6539
+ crv: z.ZodOptional<z.ZodString>;
6540
+ x: z.ZodOptional<z.ZodString>;
6541
+ y: z.ZodOptional<z.ZodString>;
6542
+ e: z.ZodOptional<z.ZodString>;
6543
+ n: z.ZodOptional<z.ZodString>;
6544
+ alg: z.ZodOptional<z.ZodString>;
6545
+ d: z.ZodOptional<z.ZodString>;
6546
+ dp: z.ZodOptional<z.ZodString>;
6547
+ dq: z.ZodOptional<z.ZodString>;
6548
+ ext: z.ZodOptional<z.ZodBoolean>;
6549
+ k: z.ZodOptional<z.ZodString>;
6550
+ key_ops: z.ZodOptional<z.ZodString>;
6551
+ kid: z.ZodOptional<z.ZodString>;
6552
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6553
+ d: z.ZodOptional<z.ZodString>;
6554
+ r: z.ZodOptional<z.ZodString>;
6555
+ t: z.ZodOptional<z.ZodString>;
6556
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6557
+ d: z.ZodOptional<z.ZodString>;
6558
+ r: z.ZodOptional<z.ZodString>;
6559
+ t: z.ZodOptional<z.ZodString>;
6560
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6561
+ d: z.ZodOptional<z.ZodString>;
6562
+ r: z.ZodOptional<z.ZodString>;
6563
+ t: z.ZodOptional<z.ZodString>;
6564
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6565
+ p: z.ZodOptional<z.ZodString>;
6566
+ q: z.ZodOptional<z.ZodString>;
6567
+ qi: z.ZodOptional<z.ZodString>;
6568
+ use: z.ZodOptional<z.ZodString>;
6569
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6570
+ x5t: z.ZodOptional<z.ZodString>;
6571
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6572
+ x5u: z.ZodOptional<z.ZodString>;
6573
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6574
+ kty: z.ZodString;
6575
+ crv: z.ZodOptional<z.ZodString>;
6576
+ x: z.ZodOptional<z.ZodString>;
6577
+ y: z.ZodOptional<z.ZodString>;
6578
+ e: z.ZodOptional<z.ZodString>;
6579
+ n: z.ZodOptional<z.ZodString>;
6580
+ alg: z.ZodOptional<z.ZodString>;
6581
+ d: z.ZodOptional<z.ZodString>;
6582
+ dp: z.ZodOptional<z.ZodString>;
6583
+ dq: z.ZodOptional<z.ZodString>;
6584
+ ext: z.ZodOptional<z.ZodBoolean>;
6585
+ k: z.ZodOptional<z.ZodString>;
6586
+ key_ops: z.ZodOptional<z.ZodString>;
6587
+ kid: z.ZodOptional<z.ZodString>;
6588
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6589
+ d: z.ZodOptional<z.ZodString>;
6590
+ r: z.ZodOptional<z.ZodString>;
6591
+ t: z.ZodOptional<z.ZodString>;
6592
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6593
+ d: z.ZodOptional<z.ZodString>;
6594
+ r: z.ZodOptional<z.ZodString>;
6595
+ t: z.ZodOptional<z.ZodString>;
6596
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6597
+ d: z.ZodOptional<z.ZodString>;
6598
+ r: z.ZodOptional<z.ZodString>;
6599
+ t: z.ZodOptional<z.ZodString>;
6600
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6601
+ p: z.ZodOptional<z.ZodString>;
6602
+ q: z.ZodOptional<z.ZodString>;
6603
+ qi: z.ZodOptional<z.ZodString>;
6604
+ use: z.ZodOptional<z.ZodString>;
6605
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6606
+ x5t: z.ZodOptional<z.ZodString>;
6607
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6608
+ x5u: z.ZodOptional<z.ZodString>;
6609
+ }, z.ZodTypeAny, "passthrough">>>;
6610
+ jkt: z.ZodOptional<z.ZodString>;
6611
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6612
+ jwk: z.ZodOptional<z.ZodObject<{
6613
+ kty: z.ZodString;
6614
+ crv: z.ZodOptional<z.ZodString>;
6615
+ x: z.ZodOptional<z.ZodString>;
6616
+ y: z.ZodOptional<z.ZodString>;
6617
+ e: z.ZodOptional<z.ZodString>;
6618
+ n: z.ZodOptional<z.ZodString>;
6619
+ alg: z.ZodOptional<z.ZodString>;
6620
+ d: z.ZodOptional<z.ZodString>;
6621
+ dp: z.ZodOptional<z.ZodString>;
6622
+ dq: z.ZodOptional<z.ZodString>;
6623
+ ext: z.ZodOptional<z.ZodBoolean>;
6624
+ k: z.ZodOptional<z.ZodString>;
6625
+ key_ops: z.ZodOptional<z.ZodString>;
6626
+ kid: z.ZodOptional<z.ZodString>;
6627
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6628
+ d: z.ZodOptional<z.ZodString>;
6629
+ r: z.ZodOptional<z.ZodString>;
6630
+ t: z.ZodOptional<z.ZodString>;
6631
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6632
+ d: z.ZodOptional<z.ZodString>;
6633
+ r: z.ZodOptional<z.ZodString>;
6634
+ t: z.ZodOptional<z.ZodString>;
6635
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6636
+ d: z.ZodOptional<z.ZodString>;
6637
+ r: z.ZodOptional<z.ZodString>;
6638
+ t: z.ZodOptional<z.ZodString>;
6639
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6640
+ p: z.ZodOptional<z.ZodString>;
6641
+ q: z.ZodOptional<z.ZodString>;
6642
+ qi: z.ZodOptional<z.ZodString>;
6643
+ use: z.ZodOptional<z.ZodString>;
6644
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6645
+ x5t: z.ZodOptional<z.ZodString>;
6646
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6647
+ x5u: z.ZodOptional<z.ZodString>;
6648
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6649
+ kty: z.ZodString;
6650
+ crv: z.ZodOptional<z.ZodString>;
6651
+ x: z.ZodOptional<z.ZodString>;
6652
+ y: z.ZodOptional<z.ZodString>;
6653
+ e: z.ZodOptional<z.ZodString>;
6654
+ n: z.ZodOptional<z.ZodString>;
6655
+ alg: z.ZodOptional<z.ZodString>;
6656
+ d: z.ZodOptional<z.ZodString>;
6657
+ dp: z.ZodOptional<z.ZodString>;
6658
+ dq: z.ZodOptional<z.ZodString>;
6659
+ ext: z.ZodOptional<z.ZodBoolean>;
6660
+ k: z.ZodOptional<z.ZodString>;
6661
+ key_ops: z.ZodOptional<z.ZodString>;
6662
+ kid: z.ZodOptional<z.ZodString>;
6663
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6664
+ d: z.ZodOptional<z.ZodString>;
6665
+ r: z.ZodOptional<z.ZodString>;
6666
+ t: z.ZodOptional<z.ZodString>;
6667
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6668
+ d: z.ZodOptional<z.ZodString>;
6669
+ r: z.ZodOptional<z.ZodString>;
6670
+ t: z.ZodOptional<z.ZodString>;
6671
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6672
+ d: z.ZodOptional<z.ZodString>;
6673
+ r: z.ZodOptional<z.ZodString>;
6674
+ t: z.ZodOptional<z.ZodString>;
6675
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6676
+ p: z.ZodOptional<z.ZodString>;
6677
+ q: z.ZodOptional<z.ZodString>;
6678
+ qi: z.ZodOptional<z.ZodString>;
6679
+ use: z.ZodOptional<z.ZodString>;
6680
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6681
+ x5t: z.ZodOptional<z.ZodString>;
6682
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6683
+ x5u: z.ZodOptional<z.ZodString>;
6684
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6685
+ kty: z.ZodString;
6686
+ crv: z.ZodOptional<z.ZodString>;
6687
+ x: z.ZodOptional<z.ZodString>;
6688
+ y: z.ZodOptional<z.ZodString>;
6689
+ e: z.ZodOptional<z.ZodString>;
6690
+ n: z.ZodOptional<z.ZodString>;
6691
+ alg: z.ZodOptional<z.ZodString>;
6692
+ d: z.ZodOptional<z.ZodString>;
6693
+ dp: z.ZodOptional<z.ZodString>;
6694
+ dq: z.ZodOptional<z.ZodString>;
6695
+ ext: z.ZodOptional<z.ZodBoolean>;
6696
+ k: z.ZodOptional<z.ZodString>;
6697
+ key_ops: z.ZodOptional<z.ZodString>;
6698
+ kid: z.ZodOptional<z.ZodString>;
6699
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6700
+ d: z.ZodOptional<z.ZodString>;
6701
+ r: z.ZodOptional<z.ZodString>;
6702
+ t: z.ZodOptional<z.ZodString>;
6703
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6704
+ d: z.ZodOptional<z.ZodString>;
6705
+ r: z.ZodOptional<z.ZodString>;
6706
+ t: z.ZodOptional<z.ZodString>;
6707
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6708
+ d: z.ZodOptional<z.ZodString>;
6709
+ r: z.ZodOptional<z.ZodString>;
6710
+ t: z.ZodOptional<z.ZodString>;
6711
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6712
+ p: z.ZodOptional<z.ZodString>;
6713
+ q: z.ZodOptional<z.ZodString>;
6714
+ qi: z.ZodOptional<z.ZodString>;
6715
+ use: z.ZodOptional<z.ZodString>;
6716
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6717
+ x5t: z.ZodOptional<z.ZodString>;
6718
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6719
+ x5u: z.ZodOptional<z.ZodString>;
6720
+ }, z.ZodTypeAny, "passthrough">>>;
6721
+ jkt: z.ZodOptional<z.ZodString>;
6722
+ }, z.ZodTypeAny, "passthrough">>>;
6723
+ status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
6724
+ trust_chain: z.ZodOptional<z.ZodArray<z.ZodString, "atleastone">>;
6725
+ }, z.ZodTypeAny, "passthrough">;
6726
+ signer: JwtSignerWithJwk;
6727
+ }>;
6728
+
6729
+ interface VerifyClientAttestationJwtOptions {
6730
+ /**
6731
+ * The compact client attestation jwt.
6732
+ */
6733
+ clientAttestationJwt: string;
6734
+ /**
6735
+ * Date to use for expiration. If not provided current date will be used.
6736
+ */
6737
+ now?: Date;
6738
+ /**
6739
+ * Callbacks used for verifying client attestation pop jwt.
6740
+ */
6741
+ callbacks: Pick<CallbackContext, 'verifyJwt'>;
6742
+ }
6743
+ type VerifiedClientAttestationJwt = Awaited<ReturnType<typeof verifyClientAttestationJwt>>;
6744
+ declare function verifyClientAttestationJwt(options: VerifyClientAttestationJwtOptions): Promise<{
6745
+ header: z.objectOutputType<{
6746
+ typ: z.ZodLiteral<"oauth-client-attestation+jwt">;
6747
+ alg: z.ZodEffects<z.ZodString, string, string>;
6748
+ kid: z.ZodOptional<z.ZodString>;
6749
+ jwk: z.ZodOptional<z.ZodObject<{
6750
+ kty: z.ZodString;
6751
+ crv: z.ZodOptional<z.ZodString>;
6752
+ x: z.ZodOptional<z.ZodString>;
6753
+ y: z.ZodOptional<z.ZodString>;
6754
+ e: z.ZodOptional<z.ZodString>;
6755
+ n: z.ZodOptional<z.ZodString>;
6756
+ alg: z.ZodOptional<z.ZodString>;
6757
+ d: z.ZodOptional<z.ZodString>;
6758
+ dp: z.ZodOptional<z.ZodString>;
6759
+ dq: z.ZodOptional<z.ZodString>;
6760
+ ext: z.ZodOptional<z.ZodBoolean>;
6761
+ k: z.ZodOptional<z.ZodString>;
6762
+ key_ops: z.ZodOptional<z.ZodString>;
6763
+ kid: z.ZodOptional<z.ZodString>;
6764
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6765
+ d: z.ZodOptional<z.ZodString>;
6766
+ r: z.ZodOptional<z.ZodString>;
6767
+ t: z.ZodOptional<z.ZodString>;
6768
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6769
+ d: z.ZodOptional<z.ZodString>;
6770
+ r: z.ZodOptional<z.ZodString>;
6771
+ t: z.ZodOptional<z.ZodString>;
6772
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6773
+ d: z.ZodOptional<z.ZodString>;
6774
+ r: z.ZodOptional<z.ZodString>;
6775
+ t: z.ZodOptional<z.ZodString>;
6776
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6777
+ p: z.ZodOptional<z.ZodString>;
6778
+ q: z.ZodOptional<z.ZodString>;
6779
+ qi: z.ZodOptional<z.ZodString>;
6780
+ use: z.ZodOptional<z.ZodString>;
6781
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6782
+ x5t: z.ZodOptional<z.ZodString>;
6783
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6784
+ x5u: z.ZodOptional<z.ZodString>;
6785
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6786
+ kty: z.ZodString;
6787
+ crv: z.ZodOptional<z.ZodString>;
6788
+ x: z.ZodOptional<z.ZodString>;
6789
+ y: z.ZodOptional<z.ZodString>;
6790
+ e: z.ZodOptional<z.ZodString>;
6791
+ n: z.ZodOptional<z.ZodString>;
6792
+ alg: z.ZodOptional<z.ZodString>;
6793
+ d: z.ZodOptional<z.ZodString>;
6794
+ dp: z.ZodOptional<z.ZodString>;
6795
+ dq: z.ZodOptional<z.ZodString>;
6796
+ ext: z.ZodOptional<z.ZodBoolean>;
6797
+ k: z.ZodOptional<z.ZodString>;
6798
+ key_ops: z.ZodOptional<z.ZodString>;
6799
+ kid: z.ZodOptional<z.ZodString>;
6800
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6801
+ d: z.ZodOptional<z.ZodString>;
6802
+ r: z.ZodOptional<z.ZodString>;
6803
+ t: z.ZodOptional<z.ZodString>;
6804
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6805
+ d: z.ZodOptional<z.ZodString>;
6806
+ r: z.ZodOptional<z.ZodString>;
6807
+ t: z.ZodOptional<z.ZodString>;
6808
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6809
+ d: z.ZodOptional<z.ZodString>;
6810
+ r: z.ZodOptional<z.ZodString>;
6811
+ t: z.ZodOptional<z.ZodString>;
6812
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6813
+ p: z.ZodOptional<z.ZodString>;
6814
+ q: z.ZodOptional<z.ZodString>;
6815
+ qi: z.ZodOptional<z.ZodString>;
6816
+ use: z.ZodOptional<z.ZodString>;
6817
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6818
+ x5t: z.ZodOptional<z.ZodString>;
6819
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6820
+ x5u: z.ZodOptional<z.ZodString>;
6821
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6822
+ kty: z.ZodString;
6823
+ crv: z.ZodOptional<z.ZodString>;
6824
+ x: z.ZodOptional<z.ZodString>;
6825
+ y: z.ZodOptional<z.ZodString>;
6826
+ e: z.ZodOptional<z.ZodString>;
6827
+ n: z.ZodOptional<z.ZodString>;
6828
+ alg: z.ZodOptional<z.ZodString>;
6829
+ d: z.ZodOptional<z.ZodString>;
6830
+ dp: z.ZodOptional<z.ZodString>;
6831
+ dq: z.ZodOptional<z.ZodString>;
6832
+ ext: z.ZodOptional<z.ZodBoolean>;
6833
+ k: z.ZodOptional<z.ZodString>;
6834
+ key_ops: z.ZodOptional<z.ZodString>;
6835
+ kid: z.ZodOptional<z.ZodString>;
6836
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6837
+ d: z.ZodOptional<z.ZodString>;
6838
+ r: z.ZodOptional<z.ZodString>;
6839
+ t: z.ZodOptional<z.ZodString>;
6840
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6841
+ d: z.ZodOptional<z.ZodString>;
6842
+ r: z.ZodOptional<z.ZodString>;
6843
+ t: z.ZodOptional<z.ZodString>;
6844
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6845
+ d: z.ZodOptional<z.ZodString>;
6846
+ r: z.ZodOptional<z.ZodString>;
6847
+ t: z.ZodOptional<z.ZodString>;
6848
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6849
+ p: z.ZodOptional<z.ZodString>;
6850
+ q: z.ZodOptional<z.ZodString>;
6851
+ qi: z.ZodOptional<z.ZodString>;
6852
+ use: z.ZodOptional<z.ZodString>;
6853
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6854
+ x5t: z.ZodOptional<z.ZodString>;
6855
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6856
+ x5u: z.ZodOptional<z.ZodString>;
6857
+ }, z.ZodTypeAny, "passthrough">>>;
6858
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6859
+ trust_chain: z.ZodOptional<z.ZodArray<z.ZodString, "atleastone">>;
6860
+ }, z.ZodTypeAny, "passthrough">;
6861
+ payload: z.objectOutputType<{
6862
+ iss: z.ZodString;
6863
+ sub: z.ZodString;
6864
+ exp: z.ZodNumber;
6865
+ cnf: z.ZodObject<{
6866
+ jwk: z.ZodObject<{
6867
+ kty: z.ZodString;
6868
+ crv: z.ZodOptional<z.ZodString>;
6869
+ x: z.ZodOptional<z.ZodString>;
6870
+ y: z.ZodOptional<z.ZodString>;
6871
+ e: z.ZodOptional<z.ZodString>;
6872
+ n: z.ZodOptional<z.ZodString>;
6873
+ alg: z.ZodOptional<z.ZodString>;
6874
+ d: z.ZodOptional<z.ZodString>;
6875
+ dp: z.ZodOptional<z.ZodString>;
6876
+ dq: z.ZodOptional<z.ZodString>;
6877
+ ext: z.ZodOptional<z.ZodBoolean>;
6878
+ k: z.ZodOptional<z.ZodString>;
6879
+ key_ops: z.ZodOptional<z.ZodString>;
6880
+ kid: z.ZodOptional<z.ZodString>;
6881
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6882
+ d: z.ZodOptional<z.ZodString>;
6883
+ r: z.ZodOptional<z.ZodString>;
6884
+ t: z.ZodOptional<z.ZodString>;
6885
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6886
+ d: z.ZodOptional<z.ZodString>;
6887
+ r: z.ZodOptional<z.ZodString>;
6888
+ t: z.ZodOptional<z.ZodString>;
6889
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6890
+ d: z.ZodOptional<z.ZodString>;
6891
+ r: z.ZodOptional<z.ZodString>;
6892
+ t: z.ZodOptional<z.ZodString>;
6893
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6894
+ p: z.ZodOptional<z.ZodString>;
6895
+ q: z.ZodOptional<z.ZodString>;
6896
+ qi: z.ZodOptional<z.ZodString>;
6897
+ use: z.ZodOptional<z.ZodString>;
6898
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6899
+ x5t: z.ZodOptional<z.ZodString>;
6900
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6901
+ x5u: z.ZodOptional<z.ZodString>;
6902
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6903
+ kty: z.ZodString;
6904
+ crv: z.ZodOptional<z.ZodString>;
6905
+ x: z.ZodOptional<z.ZodString>;
6906
+ y: z.ZodOptional<z.ZodString>;
6907
+ e: z.ZodOptional<z.ZodString>;
6908
+ n: z.ZodOptional<z.ZodString>;
6909
+ alg: z.ZodOptional<z.ZodString>;
6910
+ d: z.ZodOptional<z.ZodString>;
6911
+ dp: z.ZodOptional<z.ZodString>;
6912
+ dq: z.ZodOptional<z.ZodString>;
6913
+ ext: z.ZodOptional<z.ZodBoolean>;
6914
+ k: z.ZodOptional<z.ZodString>;
6915
+ key_ops: z.ZodOptional<z.ZodString>;
6916
+ kid: z.ZodOptional<z.ZodString>;
6917
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6918
+ d: z.ZodOptional<z.ZodString>;
6919
+ r: z.ZodOptional<z.ZodString>;
6920
+ t: z.ZodOptional<z.ZodString>;
6921
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6922
+ d: z.ZodOptional<z.ZodString>;
6923
+ r: z.ZodOptional<z.ZodString>;
6924
+ t: z.ZodOptional<z.ZodString>;
6925
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6926
+ d: z.ZodOptional<z.ZodString>;
6927
+ r: z.ZodOptional<z.ZodString>;
6928
+ t: z.ZodOptional<z.ZodString>;
6929
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6930
+ p: z.ZodOptional<z.ZodString>;
6931
+ q: z.ZodOptional<z.ZodString>;
6932
+ qi: z.ZodOptional<z.ZodString>;
6933
+ use: z.ZodOptional<z.ZodString>;
6934
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6935
+ x5t: z.ZodOptional<z.ZodString>;
6936
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6937
+ x5u: z.ZodOptional<z.ZodString>;
6938
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6939
+ kty: z.ZodString;
6940
+ crv: z.ZodOptional<z.ZodString>;
6941
+ x: z.ZodOptional<z.ZodString>;
6942
+ y: z.ZodOptional<z.ZodString>;
6943
+ e: z.ZodOptional<z.ZodString>;
6944
+ n: z.ZodOptional<z.ZodString>;
6945
+ alg: z.ZodOptional<z.ZodString>;
6946
+ d: z.ZodOptional<z.ZodString>;
6947
+ dp: z.ZodOptional<z.ZodString>;
6948
+ dq: z.ZodOptional<z.ZodString>;
6949
+ ext: z.ZodOptional<z.ZodBoolean>;
6950
+ k: z.ZodOptional<z.ZodString>;
6951
+ key_ops: z.ZodOptional<z.ZodString>;
6952
+ kid: z.ZodOptional<z.ZodString>;
6953
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6954
+ d: z.ZodOptional<z.ZodString>;
6955
+ r: z.ZodOptional<z.ZodString>;
6956
+ t: z.ZodOptional<z.ZodString>;
6957
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6958
+ d: z.ZodOptional<z.ZodString>;
6959
+ r: z.ZodOptional<z.ZodString>;
6960
+ t: z.ZodOptional<z.ZodString>;
6961
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
6962
+ d: z.ZodOptional<z.ZodString>;
6963
+ r: z.ZodOptional<z.ZodString>;
6964
+ t: z.ZodOptional<z.ZodString>;
6965
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
6966
+ p: z.ZodOptional<z.ZodString>;
6967
+ q: z.ZodOptional<z.ZodString>;
6968
+ qi: z.ZodOptional<z.ZodString>;
6969
+ use: z.ZodOptional<z.ZodString>;
6970
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
6971
+ x5t: z.ZodOptional<z.ZodString>;
6972
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
6973
+ x5u: z.ZodOptional<z.ZodString>;
6974
+ }, z.ZodTypeAny, "passthrough">>;
6975
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6976
+ jwk: z.ZodObject<{
6977
+ kty: z.ZodString;
6978
+ crv: z.ZodOptional<z.ZodString>;
6979
+ x: z.ZodOptional<z.ZodString>;
6980
+ y: z.ZodOptional<z.ZodString>;
6981
+ e: z.ZodOptional<z.ZodString>;
6982
+ n: z.ZodOptional<z.ZodString>;
6983
+ alg: z.ZodOptional<z.ZodString>;
6984
+ d: z.ZodOptional<z.ZodString>;
6985
+ dp: z.ZodOptional<z.ZodString>;
6986
+ dq: z.ZodOptional<z.ZodString>;
6987
+ ext: z.ZodOptional<z.ZodBoolean>;
6988
+ k: z.ZodOptional<z.ZodString>;
6989
+ key_ops: z.ZodOptional<z.ZodString>;
6990
+ kid: z.ZodOptional<z.ZodString>;
6991
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
6992
+ d: z.ZodOptional<z.ZodString>;
6993
+ r: z.ZodOptional<z.ZodString>;
6994
+ t: z.ZodOptional<z.ZodString>;
6995
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
6996
+ d: z.ZodOptional<z.ZodString>;
6997
+ r: z.ZodOptional<z.ZodString>;
6998
+ t: z.ZodOptional<z.ZodString>;
6999
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
7000
+ d: z.ZodOptional<z.ZodString>;
7001
+ r: z.ZodOptional<z.ZodString>;
7002
+ t: z.ZodOptional<z.ZodString>;
7003
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
7004
+ p: z.ZodOptional<z.ZodString>;
7005
+ q: z.ZodOptional<z.ZodString>;
7006
+ qi: z.ZodOptional<z.ZodString>;
7007
+ use: z.ZodOptional<z.ZodString>;
7008
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
7009
+ x5t: z.ZodOptional<z.ZodString>;
7010
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
7011
+ x5u: z.ZodOptional<z.ZodString>;
7012
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
7013
+ kty: z.ZodString;
7014
+ crv: z.ZodOptional<z.ZodString>;
7015
+ x: z.ZodOptional<z.ZodString>;
7016
+ y: z.ZodOptional<z.ZodString>;
7017
+ e: z.ZodOptional<z.ZodString>;
7018
+ n: z.ZodOptional<z.ZodString>;
7019
+ alg: z.ZodOptional<z.ZodString>;
7020
+ d: z.ZodOptional<z.ZodString>;
7021
+ dp: z.ZodOptional<z.ZodString>;
7022
+ dq: z.ZodOptional<z.ZodString>;
7023
+ ext: z.ZodOptional<z.ZodBoolean>;
7024
+ k: z.ZodOptional<z.ZodString>;
7025
+ key_ops: z.ZodOptional<z.ZodString>;
7026
+ kid: z.ZodOptional<z.ZodString>;
7027
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
7028
+ d: z.ZodOptional<z.ZodString>;
7029
+ r: z.ZodOptional<z.ZodString>;
7030
+ t: z.ZodOptional<z.ZodString>;
7031
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
7032
+ d: z.ZodOptional<z.ZodString>;
7033
+ r: z.ZodOptional<z.ZodString>;
7034
+ t: z.ZodOptional<z.ZodString>;
7035
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
7036
+ d: z.ZodOptional<z.ZodString>;
7037
+ r: z.ZodOptional<z.ZodString>;
7038
+ t: z.ZodOptional<z.ZodString>;
7039
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
7040
+ p: z.ZodOptional<z.ZodString>;
7041
+ q: z.ZodOptional<z.ZodString>;
7042
+ qi: z.ZodOptional<z.ZodString>;
7043
+ use: z.ZodOptional<z.ZodString>;
7044
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
7045
+ x5t: z.ZodOptional<z.ZodString>;
7046
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
7047
+ x5u: z.ZodOptional<z.ZodString>;
7048
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
7049
+ kty: z.ZodString;
7050
+ crv: z.ZodOptional<z.ZodString>;
7051
+ x: z.ZodOptional<z.ZodString>;
7052
+ y: z.ZodOptional<z.ZodString>;
7053
+ e: z.ZodOptional<z.ZodString>;
7054
+ n: z.ZodOptional<z.ZodString>;
7055
+ alg: z.ZodOptional<z.ZodString>;
7056
+ d: z.ZodOptional<z.ZodString>;
7057
+ dp: z.ZodOptional<z.ZodString>;
7058
+ dq: z.ZodOptional<z.ZodString>;
7059
+ ext: z.ZodOptional<z.ZodBoolean>;
7060
+ k: z.ZodOptional<z.ZodString>;
7061
+ key_ops: z.ZodOptional<z.ZodString>;
7062
+ kid: z.ZodOptional<z.ZodString>;
7063
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
7064
+ d: z.ZodOptional<z.ZodString>;
7065
+ r: z.ZodOptional<z.ZodString>;
7066
+ t: z.ZodOptional<z.ZodString>;
7067
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
7068
+ d: z.ZodOptional<z.ZodString>;
7069
+ r: z.ZodOptional<z.ZodString>;
7070
+ t: z.ZodOptional<z.ZodString>;
7071
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
7072
+ d: z.ZodOptional<z.ZodString>;
7073
+ r: z.ZodOptional<z.ZodString>;
7074
+ t: z.ZodOptional<z.ZodString>;
7075
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
7076
+ p: z.ZodOptional<z.ZodString>;
7077
+ q: z.ZodOptional<z.ZodString>;
7078
+ qi: z.ZodOptional<z.ZodString>;
7079
+ use: z.ZodOptional<z.ZodString>;
7080
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
7081
+ x5t: z.ZodOptional<z.ZodString>;
7082
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
7083
+ x5u: z.ZodOptional<z.ZodString>;
7084
+ }, z.ZodTypeAny, "passthrough">>;
7085
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
7086
+ jwk: z.ZodObject<{
7087
+ kty: z.ZodString;
7088
+ crv: z.ZodOptional<z.ZodString>;
7089
+ x: z.ZodOptional<z.ZodString>;
7090
+ y: z.ZodOptional<z.ZodString>;
7091
+ e: z.ZodOptional<z.ZodString>;
7092
+ n: z.ZodOptional<z.ZodString>;
7093
+ alg: z.ZodOptional<z.ZodString>;
7094
+ d: z.ZodOptional<z.ZodString>;
7095
+ dp: z.ZodOptional<z.ZodString>;
7096
+ dq: z.ZodOptional<z.ZodString>;
7097
+ ext: z.ZodOptional<z.ZodBoolean>;
7098
+ k: z.ZodOptional<z.ZodString>;
7099
+ key_ops: z.ZodOptional<z.ZodString>;
7100
+ kid: z.ZodOptional<z.ZodString>;
7101
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
7102
+ d: z.ZodOptional<z.ZodString>;
7103
+ r: z.ZodOptional<z.ZodString>;
7104
+ t: z.ZodOptional<z.ZodString>;
7105
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
7106
+ d: z.ZodOptional<z.ZodString>;
7107
+ r: z.ZodOptional<z.ZodString>;
7108
+ t: z.ZodOptional<z.ZodString>;
7109
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
7110
+ d: z.ZodOptional<z.ZodString>;
7111
+ r: z.ZodOptional<z.ZodString>;
7112
+ t: z.ZodOptional<z.ZodString>;
7113
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
7114
+ p: z.ZodOptional<z.ZodString>;
7115
+ q: z.ZodOptional<z.ZodString>;
7116
+ qi: z.ZodOptional<z.ZodString>;
7117
+ use: z.ZodOptional<z.ZodString>;
7118
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
7119
+ x5t: z.ZodOptional<z.ZodString>;
7120
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
7121
+ x5u: z.ZodOptional<z.ZodString>;
7122
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
7123
+ kty: z.ZodString;
7124
+ crv: z.ZodOptional<z.ZodString>;
7125
+ x: z.ZodOptional<z.ZodString>;
7126
+ y: z.ZodOptional<z.ZodString>;
7127
+ e: z.ZodOptional<z.ZodString>;
7128
+ n: z.ZodOptional<z.ZodString>;
7129
+ alg: z.ZodOptional<z.ZodString>;
7130
+ d: z.ZodOptional<z.ZodString>;
7131
+ dp: z.ZodOptional<z.ZodString>;
7132
+ dq: z.ZodOptional<z.ZodString>;
7133
+ ext: z.ZodOptional<z.ZodBoolean>;
7134
+ k: z.ZodOptional<z.ZodString>;
7135
+ key_ops: z.ZodOptional<z.ZodString>;
7136
+ kid: z.ZodOptional<z.ZodString>;
7137
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
7138
+ d: z.ZodOptional<z.ZodString>;
7139
+ r: z.ZodOptional<z.ZodString>;
7140
+ t: z.ZodOptional<z.ZodString>;
7141
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
7142
+ d: z.ZodOptional<z.ZodString>;
7143
+ r: z.ZodOptional<z.ZodString>;
7144
+ t: z.ZodOptional<z.ZodString>;
7145
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
7146
+ d: z.ZodOptional<z.ZodString>;
7147
+ r: z.ZodOptional<z.ZodString>;
7148
+ t: z.ZodOptional<z.ZodString>;
7149
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
7150
+ p: z.ZodOptional<z.ZodString>;
7151
+ q: z.ZodOptional<z.ZodString>;
7152
+ qi: z.ZodOptional<z.ZodString>;
7153
+ use: z.ZodOptional<z.ZodString>;
7154
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
7155
+ x5t: z.ZodOptional<z.ZodString>;
7156
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
7157
+ x5u: z.ZodOptional<z.ZodString>;
7158
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
7159
+ kty: z.ZodString;
7160
+ crv: z.ZodOptional<z.ZodString>;
7161
+ x: z.ZodOptional<z.ZodString>;
7162
+ y: z.ZodOptional<z.ZodString>;
7163
+ e: z.ZodOptional<z.ZodString>;
7164
+ n: z.ZodOptional<z.ZodString>;
7165
+ alg: z.ZodOptional<z.ZodString>;
7166
+ d: z.ZodOptional<z.ZodString>;
7167
+ dp: z.ZodOptional<z.ZodString>;
7168
+ dq: z.ZodOptional<z.ZodString>;
7169
+ ext: z.ZodOptional<z.ZodBoolean>;
7170
+ k: z.ZodOptional<z.ZodString>;
7171
+ key_ops: z.ZodOptional<z.ZodString>;
7172
+ kid: z.ZodOptional<z.ZodString>;
7173
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
7174
+ d: z.ZodOptional<z.ZodString>;
7175
+ r: z.ZodOptional<z.ZodString>;
7176
+ t: z.ZodOptional<z.ZodString>;
7177
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
7178
+ d: z.ZodOptional<z.ZodString>;
7179
+ r: z.ZodOptional<z.ZodString>;
7180
+ t: z.ZodOptional<z.ZodString>;
7181
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
7182
+ d: z.ZodOptional<z.ZodString>;
7183
+ r: z.ZodOptional<z.ZodString>;
7184
+ t: z.ZodOptional<z.ZodString>;
7185
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
7186
+ p: z.ZodOptional<z.ZodString>;
7187
+ q: z.ZodOptional<z.ZodString>;
7188
+ qi: z.ZodOptional<z.ZodString>;
7189
+ use: z.ZodOptional<z.ZodString>;
7190
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
7191
+ x5t: z.ZodOptional<z.ZodString>;
7192
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
7193
+ x5u: z.ZodOptional<z.ZodString>;
7194
+ }, z.ZodTypeAny, "passthrough">>;
7195
+ }, z.ZodTypeAny, "passthrough">>;
7196
+ wallet_name: z.ZodOptional<z.ZodString>;
7197
+ wallet_link: z.ZodOptional<z.ZodString>;
7198
+ aud: z.ZodOptional<z.ZodString>;
7199
+ iat: z.ZodOptional<z.ZodNumber>;
7200
+ nbf: z.ZodOptional<z.ZodNumber>;
7201
+ nonce: z.ZodOptional<z.ZodString>;
7202
+ jti: z.ZodOptional<z.ZodString>;
7203
+ status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
7204
+ trust_chain: z.ZodOptional<z.ZodArray<z.ZodString, "atleastone">>;
7205
+ }, z.ZodTypeAny, "passthrough">;
7206
+ signer: JwtSignerWithJwk;
7207
+ }>;
7208
+ interface CreateClientAttestationJwtOptions {
7209
+ /**
7210
+ * Creation time of the JWT. If not provided the current date will be used
7211
+ */
7212
+ issuedAt?: Date;
7213
+ /**
7214
+ * Expiration time of the JWT.
7215
+ */
7216
+ expiresAt: Date;
7217
+ /**
7218
+ * Issuer of the client attestation, usually identifier of the client backend
7219
+ */
7220
+ issuer: string;
7221
+ /**
7222
+ * The client id of the client instance.
7223
+ */
7224
+ clientId: string;
7225
+ /**
7226
+ * The confirmation payload for the client, attesting the `jwk`, `key_type` and `user_authentication`
7227
+ */
7228
+ confirmation: ClientAttestationJwtPayload['cnf'];
7229
+ /**
7230
+ * Additional payload to include in the client attestation jwt payload. Will be applied after
7231
+ * any default claims that are included, so add claims with caution.
7232
+ */
7233
+ additionalPayload?: Record<string, unknown>;
7234
+ /**
7235
+ * Callback used for client attestation
7236
+ */
7237
+ callbacks: Pick<CallbackContext, 'signJwt'>;
7238
+ /**
7239
+ * The signer of the client attestation jwt.
7240
+ */
7241
+ signer: JwtSigner;
7242
+ }
7243
+ declare function createClientAttestationJwt(options: CreateClientAttestationJwtOptions): Promise<string>;
7244
+ interface VerifyClientAttestationOptions {
7245
+ authorizationServer: string;
7246
+ clientAttestationJwt: string;
7247
+ clientAttestationPopJwt: string;
7248
+ callbacks: Pick<CallbackContext, 'verifyJwt'>;
7249
+ /**
7250
+ * Date to use for expiration. If not provided current date will be used.
7251
+ */
7252
+ now?: Date;
7253
+ }
7254
+
7255
+ declare const zAlgValueNotNone: z__default.ZodEffects<z__default.ZodString, string, string>;
7256
+ interface RequestLike {
7257
+ headers: FetchHeaders;
7258
+ method: HttpMethod;
7259
+ url: string;
7260
+ }
7261
+
7262
+ interface RequestDpopOptions {
7263
+ /**
7264
+ * Dpop nonce to use for constructing the dpop jwt
7265
+ */
7266
+ nonce?: string;
7267
+ /**
7268
+ * The signer of the dpop jwt
7269
+ */
7270
+ signer: JwtSignerJwk;
7271
+ }
7272
+ interface VerifyDpopJwtOptions {
7273
+ /**
7274
+ * The compact dpop jwt.
7275
+ */
7276
+ dpopJwt: string;
7277
+ /**
7278
+ * The requet for which to verify the dpop jwt
7279
+ */
7280
+ request: RequestLike;
7281
+ /**
7282
+ * Allowed dpop signing alg values. If not provided
7283
+ * any alg values are allowed and it's up to the `verifyJwtCallback`
7284
+ * to handle the alg.
7285
+ */
7286
+ allowedSigningAlgs?: string[];
7287
+ /**
7288
+ * Expected nonce in the payload. If not provided the nonce won't be validated.
7289
+ */
7290
+ expectedNonce?: string;
7291
+ /**
7292
+ * Access token to which the dpop jwt is bound. If provided the sha-256 hash of the
7293
+ * access token needs to match the 'ath' claim.
7294
+ */
7295
+ accessToken?: string;
7296
+ /**
7297
+ * The expected jwk thumprint 'jti' confirmation method. If provided the thumprint of the
7298
+ * jwk used to sign the dpop jwt must match this provided thumbprint value. The 'jti' value
7299
+ * can be extracted from the access token payload, or if opaque tokens are used can be retrieved
7300
+ * using token introspection.
7301
+ */
7302
+ expectedJwkThumbprint?: string;
7303
+ /**
7304
+ * Callbacks used for verifying dpop jwt
7305
+ */
7306
+ callbacks: Pick<CallbackContext, 'verifyJwt' | 'hash'>;
7307
+ now?: Date;
7308
+ }
7309
+
7310
+ declare const zAuthorizationChallengeRequest: z__default.ZodObject<{
7311
+ client_id: z__default.ZodOptional<z__default.ZodString>;
7312
+ auth_session: z__default.ZodOptional<z__default.ZodString>;
7313
+ presentation_during_issuance_session: z__default.ZodOptional<z__default.ZodString>;
7314
+ redirect_uri: z__default.ZodOptional<z__default.ZodString>;
7315
+ resource: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
7316
+ scope: z__default.ZodOptional<z__default.ZodString>;
7317
+ issuer_state: z__default.ZodOptional<z__default.ZodString>;
7318
+ dpop_jkt: z__default.ZodOptional<z__default.ZodString>;
7319
+ code_challenge: z__default.ZodOptional<z__default.ZodString>;
7320
+ code_challenge_method: z__default.ZodOptional<z__default.ZodString>;
7321
+ }, "passthrough", z__default.ZodTypeAny, z__default.objectOutputType<{
7322
+ client_id: z__default.ZodOptional<z__default.ZodString>;
7323
+ auth_session: z__default.ZodOptional<z__default.ZodString>;
7324
+ presentation_during_issuance_session: z__default.ZodOptional<z__default.ZodString>;
7325
+ redirect_uri: z__default.ZodOptional<z__default.ZodString>;
7326
+ resource: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
7327
+ scope: z__default.ZodOptional<z__default.ZodString>;
7328
+ issuer_state: z__default.ZodOptional<z__default.ZodString>;
7329
+ dpop_jkt: z__default.ZodOptional<z__default.ZodString>;
7330
+ code_challenge: z__default.ZodOptional<z__default.ZodString>;
7331
+ code_challenge_method: z__default.ZodOptional<z__default.ZodString>;
7332
+ }, z__default.ZodTypeAny, "passthrough">, z__default.objectInputType<{
7333
+ client_id: z__default.ZodOptional<z__default.ZodString>;
7334
+ auth_session: z__default.ZodOptional<z__default.ZodString>;
7335
+ presentation_during_issuance_session: z__default.ZodOptional<z__default.ZodString>;
7336
+ redirect_uri: z__default.ZodOptional<z__default.ZodString>;
7337
+ resource: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
7338
+ scope: z__default.ZodOptional<z__default.ZodString>;
7339
+ issuer_state: z__default.ZodOptional<z__default.ZodString>;
7340
+ dpop_jkt: z__default.ZodOptional<z__default.ZodString>;
7341
+ code_challenge: z__default.ZodOptional<z__default.ZodString>;
7342
+ code_challenge_method: z__default.ZodOptional<z__default.ZodString>;
7343
+ }, z__default.ZodTypeAny, "passthrough">>;
7344
+ type AuthorizationChallengeRequest = z__default.infer<typeof zAuthorizationChallengeRequest>;
7345
+ declare const zAuthorizationChallengeResponse: z__default.ZodObject<{
7346
+ authorization_code: z__default.ZodString;
7347
+ }, "passthrough", z__default.ZodTypeAny, z__default.objectOutputType<{
7348
+ authorization_code: z__default.ZodString;
7349
+ }, z__default.ZodTypeAny, "passthrough">, z__default.objectInputType<{
7350
+ authorization_code: z__default.ZodString;
7351
+ }, z__default.ZodTypeAny, "passthrough">>;
7352
+ type AuthorizationChallengeResponse = z__default.infer<typeof zAuthorizationChallengeResponse>;
7353
+ declare const zAuthorizationChallengeErrorResponse: z__default.ZodObject<{
7354
+ auth_session: z__default.ZodOptional<z__default.ZodString>;
7355
+ request_uri: z__default.ZodOptional<z__default.ZodString>;
7356
+ expires_in: z__default.ZodOptional<z__default.ZodNumber>;
7357
+ presentation: z__default.ZodOptional<z__default.ZodString>;
7358
+ error: z__default.ZodUnion<[z__default.ZodNativeEnum<typeof Oauth2ErrorCodes>, z__default.ZodString]>;
7359
+ error_description: z__default.ZodOptional<z__default.ZodString>;
7360
+ error_uri: z__default.ZodOptional<z__default.ZodString>;
7361
+ }, "passthrough", z__default.ZodTypeAny, z__default.objectOutputType<{
7362
+ auth_session: z__default.ZodOptional<z__default.ZodString>;
7363
+ request_uri: z__default.ZodOptional<z__default.ZodString>;
7364
+ expires_in: z__default.ZodOptional<z__default.ZodNumber>;
7365
+ presentation: z__default.ZodOptional<z__default.ZodString>;
7366
+ error: z__default.ZodUnion<[z__default.ZodNativeEnum<typeof Oauth2ErrorCodes>, z__default.ZodString]>;
7367
+ error_description: z__default.ZodOptional<z__default.ZodString>;
7368
+ error_uri: z__default.ZodOptional<z__default.ZodString>;
7369
+ }, z__default.ZodTypeAny, "passthrough">, z__default.objectInputType<{
7370
+ auth_session: z__default.ZodOptional<z__default.ZodString>;
7371
+ request_uri: z__default.ZodOptional<z__default.ZodString>;
7372
+ expires_in: z__default.ZodOptional<z__default.ZodNumber>;
7373
+ presentation: z__default.ZodOptional<z__default.ZodString>;
7374
+ error: z__default.ZodUnion<[z__default.ZodNativeEnum<typeof Oauth2ErrorCodes>, z__default.ZodString]>;
7375
+ error_description: z__default.ZodOptional<z__default.ZodString>;
7376
+ error_uri: z__default.ZodOptional<z__default.ZodString>;
7377
+ }, z__default.ZodTypeAny, "passthrough">>;
7378
+ type AuthorizationChallengeErrorResponse = z__default.infer<typeof zAuthorizationChallengeErrorResponse>;
7379
+
7380
+ interface Oauth2ErrorOptions {
7381
+ cause?: unknown;
7382
+ }
7383
+ declare class Oauth2Error extends Error {
7384
+ readonly cause?: unknown;
7385
+ constructor(message?: string, options?: Oauth2ErrorOptions);
7386
+ }
7387
+
7388
+ declare class Oauth2ClientErrorResponseError extends Oauth2Error {
7389
+ readonly errorResponse: Oauth2ErrorResponse;
7390
+ readonly response: FetchResponse;
7391
+ constructor(message: string, errorResponse: Oauth2ErrorResponse, response: FetchResponse);
7392
+ }
7393
+
7394
+ declare class Oauth2ClientAuthorizationChallengeError extends Oauth2ClientErrorResponseError {
7395
+ readonly errorResponse: AuthorizationChallengeErrorResponse;
7396
+ constructor(message: string, errorResponse: AuthorizationChallengeErrorResponse, response: FetchResponse);
7397
+ }
7398
+
7399
+ declare class Oauth2JwtParseError extends Oauth2Error {
7400
+ constructor(message?: string);
7401
+ }
7402
+
7403
+ declare class Oauth2JwtVerificationError extends Oauth2Error {
7404
+ constructor(message?: string, options?: Oauth2ErrorOptions);
7405
+ }
7406
+
7407
+ declare enum SupportedAuthenticationScheme {
7408
+ Bearer = "Bearer",
7409
+ DPoP = "DPoP"
7410
+ }
7411
+
7412
+ interface WwwAuthenticateHeaderChallenge {
7413
+ scheme: SupportedAuthenticationScheme | (string & {});
7414
+ /**
7415
+ * Space delimited scope value that lists scopes required
7416
+ * to access this resource.
7417
+ */
7418
+ scope?: string;
7419
+ /**
7420
+ * Error should only be undefined if no access token was provided at all
7421
+ */
7422
+ error?: Oauth2ErrorCodes | string;
7423
+ error_description?: string;
7424
+ /**
7425
+ * Additional payload items to include in the Www-Authenticate
7426
+ * header response.
7427
+ */
7428
+ additionalPayload?: Record<string, string>;
7429
+ }
7430
+ declare class Oauth2ResourceUnauthorizedError extends Oauth2Error {
7431
+ readonly wwwAuthenticateHeaders: WwwAuthenticateHeaderChallenge[];
7432
+ constructor(internalMessage: string | undefined, wwwAuthenticateHeaders: WwwAuthenticateHeaderChallenge | Array<WwwAuthenticateHeaderChallenge>);
7433
+ static fromHeaderValue(value: string): Oauth2ResourceUnauthorizedError;
7434
+ toHeaderValue(): string;
7435
+ }
7436
+
7437
+ interface Oauth2ServerErrorResponseErrorOptions extends Oauth2ErrorOptions {
7438
+ internalMessage?: string;
7439
+ /**
7440
+ * @default 400
7441
+ */
7442
+ status?: number;
7443
+ }
7444
+ declare class Oauth2ServerErrorResponseError extends Oauth2Error {
7445
+ readonly errorResponse: Oauth2ErrorResponse;
7446
+ readonly status: number;
7447
+ constructor(errorResponse: Oauth2ErrorResponse, options?: Oauth2ServerErrorResponseErrorOptions);
7448
+ }
7449
+
7450
+ interface VerifyAuthorizationRequestDpop {
7451
+ /**
7452
+ * Whether dpop is required.
7453
+ */
7454
+ required?: boolean;
7455
+ /**
7456
+ * The dpop jwt from the pushed authorization request.
7457
+ *
7458
+ * If dpop is required, at least one of `jwt` or `jwkThumbprint` MUST
7459
+ * be provided. If both are provided, the jwk thubmprints are matched
7460
+ */
7461
+ jwt?: string;
7462
+ /**
7463
+ * The jwk thumbprint as provided in the `dpop_jkt` parameter.
7464
+ *
7465
+ * If dpop is required, at least one of `jwt` or `jwkThumbprint` MUST
7466
+ * be provided. If both are provided, the jwk thubmprints are matched
7467
+ */
7468
+ jwkThumbprint?: string;
7469
+ /**
7470
+ * Allowed dpop signing alg values. If not provided
7471
+ * any alg values are allowed and it's up to the `verifyJwtCallback`
7472
+ * to handle the alg.
7473
+ */
7474
+ allowedSigningAlgs?: string[];
7475
+ }
7476
+ interface VerifyAuthorizationRequestClientAttestation {
7477
+ /**
7478
+ * Whether client attestation is required.
7479
+ */
7480
+ required?: boolean;
7481
+ /**
7482
+ * Whether to ensure that the key used in client attestation confirmation
7483
+ * is the same key used for DPoP. This only has effect if both DPoP and client
7484
+ * attestations are present.
7485
+ *
7486
+ * @default false
7487
+ */
7488
+ ensureConfirmationKeyMatchesDpopKey?: boolean;
7489
+ clientAttestationJwt?: string;
7490
+ clientAttestationPopJwt?: string;
7491
+ }
7492
+ interface VerifyAuthorizationRequestReturn {
7493
+ dpop?: {
7494
+ /**
7495
+ * base64url encoding of the JWK SHA-256 Thumbprint (according to [RFC7638])
7496
+ * of the DPoP public key (in JWK format).
7497
+ *
7498
+ * This will always be returned if dpop is used for the PAR endpoint
7499
+ */
7500
+ jwkThumbprint: string;
7501
+ /**
7502
+ * The JWK will be returend if a DPoP proof was provided in the header.
7503
+ */
7504
+ jwk?: Jwk;
7505
+ };
7506
+ /**
7507
+ * The verified client attestation if any were provided.
7508
+ */
7509
+ clientAttestation?: {
7510
+ clientAttestation: VerifiedClientAttestationJwt;
7511
+ clientAttestationPop: VerifiedClientAttestationPopJwt;
7512
+ };
7513
+ }
7514
+ interface VerifyAuthorizationRequestOptions {
7515
+ authorizationServerMetadata: AuthorizationServerMetadata;
7516
+ authorizationRequest: {
7517
+ client_id?: string;
7518
+ };
7519
+ request: RequestLike;
7520
+ dpop?: VerifyAuthorizationRequestDpop;
7521
+ clientAttestation?: VerifyAuthorizationRequestClientAttestation;
7522
+ /**
7523
+ * Date to use for expiration. If not provided current date will be used.
7524
+ */
7525
+ now?: Date;
7526
+ callbacks: Pick<CallbackContext, 'hash' | 'verifyJwt'>;
7527
+ }
7528
+
7529
+ type VerifyAuthorizationChallengeRequestReturn = VerifyAuthorizationRequestReturn;
7530
+ interface VerifyAuthorizationChallengeRequestOptions extends Omit<VerifyAuthorizationRequestOptions, 'authorizationRequest'> {
7531
+ authorizationChallengeRequest: AuthorizationChallengeRequest;
7532
+ }
7533
+
7534
+ interface ParseAuthorizationRequestResult {
7535
+ /**
7536
+ * The dpop params from the authorization request.
7537
+ *
7538
+ * Both `dpop_jkt` and DPoP header can be included in the request.
7539
+ *
7540
+ * The jkt and the signer of the jwt have not been verified against
7541
+ * each other yet, this only happens during verification
7542
+ */
7543
+ dpop?: {
7544
+ jwkThumbprint: string;
7545
+ jwt?: string;
7546
+ } | {
7547
+ jwkThumbprint?: string;
7548
+ jwt: string;
7549
+ };
7550
+ /**
7551
+ * The client attestation jwts from the authorization request headers.
7552
+ * These have not been verified yet.
7553
+ */
7554
+ clientAttestation?: {
7555
+ clientAttestationJwt: string;
7556
+ clientAttestationPopJwt: string;
7557
+ };
7558
+ }
7559
+
7560
+ interface ParseAuthorizationChallengeRequestOptions {
7561
+ request: RequestLike;
7562
+ authorizationChallengeRequest: unknown;
7563
+ }
7564
+ interface ParseAuthorizationChallengeRequestResult extends ParseAuthorizationRequestResult {
7565
+ authorizationChallengeRequest: AuthorizationChallengeRequest;
7566
+ }
7567
+
7568
+ /**
7569
+ * fetch authorization server metadata. It first tries to fetch the oauth-authorization-server metadata. If that returns
7570
+ * a 404, the openid-configuration metadata will be fetched.
7571
+ */
7572
+ declare function fetchAuthorizationServerMetadata(issuer: string, fetch?: Fetch): Promise<AuthorizationServerMetadata | null>;
7573
+ declare function getAuthorizationServerMetadataFromList(authorizationServersMetadata: AuthorizationServerMetadata[], issuer: string): z.objectOutputType<{
7574
+ issuer: z.ZodEffects<z.ZodString, string, string>;
7575
+ token_endpoint: z.ZodEffects<z.ZodString, string, string>;
7576
+ token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z.ZodString]>, "many">>;
7577
+ authorization_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
7578
+ jwks_uri: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
7579
+ code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
7580
+ dpop_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
7581
+ require_pushed_authorization_requests: z.ZodOptional<z.ZodBoolean>;
7582
+ pushed_authorization_request_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
7583
+ introspection_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
7584
+ introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z.ZodString]>, "many">>;
7585
+ introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
7586
+ authorization_challenge_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
7587
+ pre_authorized_grant_anonymous_access_supported: z.ZodOptional<z.ZodBoolean>;
7588
+ client_attestation_pop_nonce_required: z.ZodOptional<z.ZodBoolean>;
7589
+ }, z.ZodTypeAny, "passthrough">;
7590
+
7591
+ /**
7592
+ * Fetch JWKs from a provided JWKs URI.
7593
+ *
7594
+ * Returns validated metadata if successfull response
7595
+ * Throws error otherwise
7596
+ *
7597
+ * @throws {ValidationError} if successfull response but validation of response failed
7598
+ * @throws {InvalidFetchResponseError} if unsuccesful response
7599
+ */
7600
+ declare function fetchJwks(jwksUrl: string, fetch?: Fetch): Promise<JwkSet>;
7601
+
7602
+ /**
7603
+ * Fetch well known metadata and validate the response.
7604
+ *
7605
+ * Returns null if 404 is returned
7606
+ * Returns validated metadata if successfull response
7607
+ * Throws error otherwise
7608
+ *
7609
+ * @throws {ValidationError} if successfull response but validation of response failed
7610
+ * @throws {InvalidFetchResponseError} if no successfull or 404 response
7611
+ * @throws {Error} if parsing json from response fails
7612
+ */
7613
+ declare function fetchWellKnownMetadata<Schema extends BaseSchema>(wellKnownMetadataUrl: string, schema: Schema, fetch?: Fetch): Promise<z__default.infer<Schema> | null>;
7614
+
7615
+ declare const zTokenIntrospectionResponse: z__default.ZodObject<{
7616
+ active: z__default.ZodBoolean;
7617
+ scope: z__default.ZodOptional<z__default.ZodString>;
7618
+ client_id: z__default.ZodOptional<z__default.ZodString>;
7619
+ username: z__default.ZodOptional<z__default.ZodString>;
7620
+ token_type: z__default.ZodOptional<z__default.ZodString>;
7621
+ exp: z__default.ZodOptional<z__default.ZodNumber>;
7622
+ iat: z__default.ZodOptional<z__default.ZodNumber>;
7623
+ nbf: z__default.ZodOptional<z__default.ZodNumber>;
7624
+ sub: z__default.ZodOptional<z__default.ZodString>;
7625
+ aud: z__default.ZodOptional<z__default.ZodString>;
7626
+ iss: z__default.ZodOptional<z__default.ZodString>;
7627
+ jti: z__default.ZodOptional<z__default.ZodString>;
7628
+ cnf: z__default.ZodOptional<z__default.ZodObject<{
7629
+ jwk: z__default.ZodOptional<z__default.ZodObject<{
7630
+ kty: z__default.ZodString;
7631
+ crv: z__default.ZodOptional<z__default.ZodString>;
7632
+ x: z__default.ZodOptional<z__default.ZodString>;
7633
+ y: z__default.ZodOptional<z__default.ZodString>;
7634
+ e: z__default.ZodOptional<z__default.ZodString>;
7635
+ n: z__default.ZodOptional<z__default.ZodString>;
7636
+ alg: z__default.ZodOptional<z__default.ZodString>;
7637
+ d: z__default.ZodOptional<z__default.ZodString>;
7638
+ dp: z__default.ZodOptional<z__default.ZodString>;
7639
+ dq: z__default.ZodOptional<z__default.ZodString>;
7640
+ ext: z__default.ZodOptional<z__default.ZodBoolean>;
7641
+ k: z__default.ZodOptional<z__default.ZodString>;
7642
+ key_ops: z__default.ZodOptional<z__default.ZodString>;
7643
+ kid: z__default.ZodOptional<z__default.ZodString>;
7644
+ oth: z__default.ZodOptional<z__default.ZodArray<z__default.ZodObject<{
7645
+ d: z__default.ZodOptional<z__default.ZodString>;
7646
+ r: z__default.ZodOptional<z__default.ZodString>;
7647
+ t: z__default.ZodOptional<z__default.ZodString>;
7648
+ }, "passthrough", z__default.ZodTypeAny, z__default.objectOutputType<{
7649
+ d: z__default.ZodOptional<z__default.ZodString>;
7650
+ r: z__default.ZodOptional<z__default.ZodString>;
7651
+ t: z__default.ZodOptional<z__default.ZodString>;
7652
+ }, z__default.ZodTypeAny, "passthrough">, z__default.objectInputType<{
7653
+ d: z__default.ZodOptional<z__default.ZodString>;
7654
+ r: z__default.ZodOptional<z__default.ZodString>;
7655
+ t: z__default.ZodOptional<z__default.ZodString>;
7656
+ }, z__default.ZodTypeAny, "passthrough">>, "many">>;
7657
+ p: z__default.ZodOptional<z__default.ZodString>;
7658
+ q: z__default.ZodOptional<z__default.ZodString>;
7659
+ qi: z__default.ZodOptional<z__default.ZodString>;
7660
+ use: z__default.ZodOptional<z__default.ZodString>;
7661
+ x5c: z__default.ZodOptional<z__default.ZodArray<z__default.ZodString, "many">>;
7662
+ x5t: z__default.ZodOptional<z__default.ZodString>;
6476
7663
  'x5t#S256': z__default.ZodOptional<z__default.ZodString>;
6477
7664
  x5u: z__default.ZodOptional<z__default.ZodString>;
6478
7665
  }, "passthrough", z__default.ZodTypeAny, z__default.objectOutputType<{
@@ -7481,7 +8668,7 @@ interface RetrieveAccessTokenBaseOptions {
7481
8668
  /**
7482
8669
  * Callbacks to use for requesting access token
7483
8670
  */
7484
- callbacks: Pick<CallbackContext, 'fetch' | 'generateRandom' | 'hash' | 'signJwt'>;
8671
+ callbacks: Pick<CallbackContext, 'fetch' | 'generateRandom' | 'hash' | 'signJwt' | 'clientAuthentication'>;
7485
8672
  /**
7486
8673
  * The resource to which access is being requested. This can help the authorization
7487
8674
  * server in determining the resource server to handle the authorization request for
@@ -7495,10 +8682,6 @@ interface RetrieveAccessTokenBaseOptions {
7495
8682
  * metadata, or the 'alg' value does not match an error will be thrown.
7496
8683
  */
7497
8684
  dpop?: RequestDpopOptions;
7498
- /**
7499
- * If client attestation needs to be included in the request.
7500
- */
7501
- clientAttestation?: RequestClientAttestationOptions;
7502
8685
  }
7503
8686
  interface RetrievePreAuthorizedCodeAccessTokenOptions extends RetrieveAccessTokenBaseOptions {
7504
8687
  preAuthorizedCode: string;
@@ -7577,7 +8760,16 @@ interface ParseAccessTokenRequestResult {
7577
8760
  /**
7578
8761
  * The dpop jwt from the access token request headers
7579
8762
  */
7580
- dpopJwt?: string;
8763
+ dpop?: {
8764
+ jwt: string;
8765
+ };
8766
+ /**
8767
+ * The client attestation jwts from the access token request headers
8768
+ */
8769
+ clientAttestation?: {
8770
+ clientAttestationJwt: string;
8771
+ clientAttestationPopJwt: string;
8772
+ };
7581
8773
  /**
7582
8774
  * The pkce code verifier from the access token request
7583
8775
  */
@@ -7601,6 +8793,11 @@ interface VerifyAccessTokenRequestDpop {
7601
8793
  * The dpop jwt from the access token request
7602
8794
  */
7603
8795
  jwt?: string;
8796
+ /**
8797
+ * The expected jwk thumbprint, and can be used to match a dpop provided in the authorization
8798
+ * request to the dpop key used for the access token request.
8799
+ */
8800
+ expectedJwkThumbprint?: string;
7604
8801
  /**
7605
8802
  * Allowed dpop signing alg values. If not provided
7606
8803
  * any alg values are allowed and it's up to the `verifyJwtCallback`
@@ -7608,20 +8805,54 @@ interface VerifyAccessTokenRequestDpop {
7608
8805
  */
7609
8806
  allowedSigningAlgs?: string[];
7610
8807
  }
8808
+ interface VerifyAccessTokenRequestClientAttestation {
8809
+ /**
8810
+ * Whether client attestation is required.
8811
+ */
8812
+ required?: boolean;
8813
+ /**
8814
+ * Whether to ensure that the key used in client attestation confirmation
8815
+ * is the same key used for DPoP. This only has effect if both DPoP and client
8816
+ * attestations are present.
8817
+ *
8818
+ * @default false
8819
+ */
8820
+ ensureConfirmationKeyMatchesDpopKey?: boolean;
8821
+ clientAttestationJwt?: string;
8822
+ clientAttestationPopJwt?: string;
8823
+ /**
8824
+ * The expected client id that is bound to the authorization session, and can be used to match the client id
8825
+ * provided in the authorization request to the client used for the access token request.
8826
+ */
8827
+ expectedClientId?: string;
8828
+ }
7611
8829
  interface VerifyAccessTokenRequestPkce {
7612
8830
  codeVerifier?: string;
7613
8831
  codeChallenge: string;
7614
8832
  codeChallengeMethod: PkceCodeChallengeMethod;
7615
8833
  }
7616
8834
  interface VerifyAccessTokenRequestReturn {
7617
- dpopJwk?: Jwk;
8835
+ dpop?: {
8836
+ /**
8837
+ * base64url encoding of the JWK SHA-256 Thumbprint (according to [RFC7638])
8838
+ * of the DPoP public key (in JWK format)
8839
+ */
8840
+ jwkThumbprint: string;
8841
+ jwk: Jwk;
8842
+ };
8843
+ clientAttestation?: {
8844
+ clientAttestation: VerifiedClientAttestationJwt;
8845
+ clientAttestationPop: VerifiedClientAttestationPopJwt;
8846
+ };
7618
8847
  }
7619
8848
  interface VerifyPreAuthorizedCodeAccessTokenRequestOptions {
8849
+ authorizationServerMetadata: AuthorizationServerMetadata;
7620
8850
  grant: ParsedAccessTokenPreAuthorizedCodeRequestGrant;
7621
8851
  accessTokenRequest: AccessTokenRequest;
7622
8852
  request: RequestLike;
7623
8853
  expectedPreAuthorizedCode: string;
7624
8854
  expectedTxCode?: string;
8855
+ clientAttestation?: VerifyAccessTokenRequestClientAttestation;
7625
8856
  dpop?: VerifyAccessTokenRequestDpop;
7626
8857
  pkce?: VerifyAccessTokenRequestPkce;
7627
8858
  preAuthorizedCodeExpiresAt?: Date;
@@ -7629,10 +8860,12 @@ interface VerifyPreAuthorizedCodeAccessTokenRequestOptions {
7629
8860
  callbacks: Pick<CallbackContext, 'hash' | 'verifyJwt'>;
7630
8861
  }
7631
8862
  interface VerifyAuthorizationCodeAccessTokenRequestOptions {
8863
+ authorizationServerMetadata: AuthorizationServerMetadata;
7632
8864
  grant: ParsedAccessTokenAuthorizationCodeRequestGrant;
7633
8865
  accessTokenRequest: AccessTokenRequest;
7634
8866
  request: RequestLike;
7635
8867
  expectedCode: string;
8868
+ clientAttestation?: VerifyAccessTokenRequestClientAttestation;
7636
8869
  dpop?: VerifyAccessTokenRequestDpop;
7637
8870
  pkce?: VerifyAccessTokenRequestPkce;
7638
8871
  codeExpiresAt?: Date;
@@ -7644,13 +8877,17 @@ interface CreateAuthorizationRequestUrlOptions {
7644
8877
  /**
7645
8878
  * Callback context mostly for crypto related functionality
7646
8879
  */
7647
- callbacks: Pick<CallbackContext, 'fetch' | 'hash' | 'generateRandom' | 'signJwt'>;
8880
+ callbacks: Pick<CallbackContext, 'fetch' | 'hash' | 'generateRandom' | 'signJwt' | 'clientAuthentication'>;
7648
8881
  /**
7649
8882
  * Metadata of the authorization server for which to create the authorization request url
7650
8883
  */
7651
8884
  authorizationServerMetadata: AuthorizationServerMetadata;
7652
8885
  /**
7653
- * The client id to use for the authorization request
8886
+ * The client id to use for the authorization request.
8887
+ *
8888
+ * For authorization requests the `client_id` is ALWAYS required, even if client authentication is used
8889
+ * (which differs from the token endpoint). This should match with the client_id that will be used for
8890
+ * client authentication
7654
8891
  */
7655
8892
  clientId: string;
7656
8893
  /**
@@ -7675,12 +8912,6 @@ interface CreateAuthorizationRequestUrlOptions {
7675
8912
  * Code verifier to use for pkce. If not provided a value will generated when pkce is supported
7676
8913
  */
7677
8914
  pkceCodeVerifier?: string;
7678
- /**
7679
- * If client attestation needs to be included in the request.
7680
- *
7681
- * Will ONLY be used if PAR is used.
7682
- */
7683
- clientAttestation?: RequestClientAttestationOptions;
7684
8915
  /**
7685
8916
  * DPoP options
7686
8917
  *
@@ -7689,6 +8920,81 @@ interface CreateAuthorizationRequestUrlOptions {
7689
8920
  dpop?: RequestDpopOptions;
7690
8921
  }
7691
8922
 
8923
+ interface CreatePushedAuthorizationResponseOptions {
8924
+ /**
8925
+ * The request uri where the client should redirect to
8926
+ */
8927
+ requestUri: string;
8928
+ /**
8929
+ * Number of seconds after which the `requestUri` will expire.
8930
+ */
8931
+ expiresInSeconds: number;
8932
+ /**
8933
+ * Additional payload to include in the pushed authorization response.
8934
+ */
8935
+ additionalPayload?: Record<string, unknown>;
8936
+ }
8937
+ interface CreatePushedAuthorizationErrorResponseOptions {
8938
+ /**
8939
+ * The pushed authorization error
8940
+ */
8941
+ error: StringWithAutoCompletion<Oauth2ErrorCodes>;
8942
+ /**
8943
+ * Optional error description
8944
+ */
8945
+ errorDescription?: string;
8946
+ /**
8947
+ * Additional payload to include in the pushed authorization error response.
8948
+ */
8949
+ additionalPayload?: Record<string, unknown>;
8950
+ }
8951
+
8952
+ declare const zAuthorizationRequest: z__default.ZodObject<{
8953
+ response_type: z__default.ZodString;
8954
+ client_id: z__default.ZodString;
8955
+ issuer_state: z__default.ZodOptional<z__default.ZodString>;
8956
+ redirect_uri: z__default.ZodOptional<z__default.ZodString>;
8957
+ resource: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
8958
+ scope: z__default.ZodOptional<z__default.ZodString>;
8959
+ dpop_jkt: z__default.ZodOptional<z__default.ZodString>;
8960
+ code_challenge: z__default.ZodOptional<z__default.ZodString>;
8961
+ code_challenge_method: z__default.ZodOptional<z__default.ZodString>;
8962
+ }, "passthrough", z__default.ZodTypeAny, z__default.objectOutputType<{
8963
+ response_type: z__default.ZodString;
8964
+ client_id: z__default.ZodString;
8965
+ issuer_state: z__default.ZodOptional<z__default.ZodString>;
8966
+ redirect_uri: z__default.ZodOptional<z__default.ZodString>;
8967
+ resource: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
8968
+ scope: z__default.ZodOptional<z__default.ZodString>;
8969
+ dpop_jkt: z__default.ZodOptional<z__default.ZodString>;
8970
+ code_challenge: z__default.ZodOptional<z__default.ZodString>;
8971
+ code_challenge_method: z__default.ZodOptional<z__default.ZodString>;
8972
+ }, z__default.ZodTypeAny, "passthrough">, z__default.objectInputType<{
8973
+ response_type: z__default.ZodString;
8974
+ client_id: z__default.ZodString;
8975
+ issuer_state: z__default.ZodOptional<z__default.ZodString>;
8976
+ redirect_uri: z__default.ZodOptional<z__default.ZodString>;
8977
+ resource: z__default.ZodOptional<z__default.ZodEffects<z__default.ZodString, string, string>>;
8978
+ scope: z__default.ZodOptional<z__default.ZodString>;
8979
+ dpop_jkt: z__default.ZodOptional<z__default.ZodString>;
8980
+ code_challenge: z__default.ZodOptional<z__default.ZodString>;
8981
+ code_challenge_method: z__default.ZodOptional<z__default.ZodString>;
8982
+ }, z__default.ZodTypeAny, "passthrough">>;
8983
+ type AuthorizationRequest = z__default.infer<typeof zAuthorizationRequest>;
8984
+
8985
+ interface ParsePushedAuthorizationRequestOptions {
8986
+ request: RequestLike;
8987
+ authorizationRequest: unknown;
8988
+ }
8989
+ interface ParsePushedAuthorizationRequestResult extends ParseAuthorizationRequestResult {
8990
+ authorizationRequest: AuthorizationRequest;
8991
+ }
8992
+
8993
+ type VerifyPushedAuthorizationRequestReturn = VerifyAuthorizationRequestReturn;
8994
+ interface VerifyPushedAuthorizationRequestOptions extends VerifyAuthorizationRequestOptions {
8995
+ authorizationRequest: AuthorizationRequest;
8996
+ }
8997
+
7692
8998
  interface ResourceRequestOptions {
7693
8999
  /**
7694
9000
  * DPoP options
@@ -8456,43 +9762,45 @@ declare function verifyResourceRequest(options: VerifyResourceRequestOptions): P
8456
9762
  jkt: z.ZodOptional<z.ZodString>;
8457
9763
  }, z.ZodTypeAny, "passthrough">>>;
8458
9764
  }, z.ZodTypeAny, "passthrough">;
8459
- dpopJwk: z.objectOutputType<{
8460
- kty: z.ZodString;
8461
- crv: z.ZodOptional<z.ZodString>;
8462
- x: z.ZodOptional<z.ZodString>;
8463
- y: z.ZodOptional<z.ZodString>;
8464
- e: z.ZodOptional<z.ZodString>;
8465
- n: z.ZodOptional<z.ZodString>;
8466
- alg: z.ZodOptional<z.ZodString>;
8467
- d: z.ZodOptional<z.ZodString>;
8468
- dp: z.ZodOptional<z.ZodString>;
8469
- dq: z.ZodOptional<z.ZodString>;
8470
- ext: z.ZodOptional<z.ZodBoolean>;
8471
- k: z.ZodOptional<z.ZodString>;
8472
- key_ops: z.ZodOptional<z.ZodString>;
8473
- kid: z.ZodOptional<z.ZodString>;
8474
- oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
8475
- d: z.ZodOptional<z.ZodString>;
8476
- r: z.ZodOptional<z.ZodString>;
8477
- t: z.ZodOptional<z.ZodString>;
8478
- }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
8479
- d: z.ZodOptional<z.ZodString>;
8480
- r: z.ZodOptional<z.ZodString>;
8481
- t: z.ZodOptional<z.ZodString>;
8482
- }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
9765
+ dpop: {
9766
+ jwk: z.objectOutputType<{
9767
+ kty: z.ZodString;
9768
+ crv: z.ZodOptional<z.ZodString>;
9769
+ x: z.ZodOptional<z.ZodString>;
9770
+ y: z.ZodOptional<z.ZodString>;
9771
+ e: z.ZodOptional<z.ZodString>;
9772
+ n: z.ZodOptional<z.ZodString>;
9773
+ alg: z.ZodOptional<z.ZodString>;
8483
9774
  d: z.ZodOptional<z.ZodString>;
8484
- r: z.ZodOptional<z.ZodString>;
8485
- t: z.ZodOptional<z.ZodString>;
8486
- }, z.ZodTypeAny, "passthrough">>, "many">>;
8487
- p: z.ZodOptional<z.ZodString>;
8488
- q: z.ZodOptional<z.ZodString>;
8489
- qi: z.ZodOptional<z.ZodString>;
8490
- use: z.ZodOptional<z.ZodString>;
8491
- x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
8492
- x5t: z.ZodOptional<z.ZodString>;
8493
- 'x5t#S256': z.ZodOptional<z.ZodString>;
8494
- x5u: z.ZodOptional<z.ZodString>;
8495
- }, z.ZodTypeAny, "passthrough"> | undefined;
9775
+ dp: z.ZodOptional<z.ZodString>;
9776
+ dq: z.ZodOptional<z.ZodString>;
9777
+ ext: z.ZodOptional<z.ZodBoolean>;
9778
+ k: z.ZodOptional<z.ZodString>;
9779
+ key_ops: z.ZodOptional<z.ZodString>;
9780
+ kid: z.ZodOptional<z.ZodString>;
9781
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
9782
+ d: z.ZodOptional<z.ZodString>;
9783
+ r: z.ZodOptional<z.ZodString>;
9784
+ t: z.ZodOptional<z.ZodString>;
9785
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
9786
+ d: z.ZodOptional<z.ZodString>;
9787
+ r: z.ZodOptional<z.ZodString>;
9788
+ t: z.ZodOptional<z.ZodString>;
9789
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
9790
+ d: z.ZodOptional<z.ZodString>;
9791
+ r: z.ZodOptional<z.ZodString>;
9792
+ t: z.ZodOptional<z.ZodString>;
9793
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
9794
+ p: z.ZodOptional<z.ZodString>;
9795
+ q: z.ZodOptional<z.ZodString>;
9796
+ qi: z.ZodOptional<z.ZodString>;
9797
+ use: z.ZodOptional<z.ZodString>;
9798
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
9799
+ x5t: z.ZodOptional<z.ZodString>;
9800
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
9801
+ x5u: z.ZodOptional<z.ZodString>;
9802
+ }, z.ZodTypeAny, "passthrough">;
9803
+ } | undefined;
8496
9804
  scheme: SupportedAuthenticationScheme;
8497
9805
  accessToken: string;
8498
9806
  authorizationServer: string;
@@ -8503,7 +9811,9 @@ interface CreateAccessTokenOptions {
8503
9811
  /**
8504
9812
  * public dpop jwk key. Will be encoded as jwk thubmprint in the `cnf.jkt` claim.
8505
9813
  */
8506
- dpopJwk?: Jwk;
9814
+ dpop?: {
9815
+ jwk: Jwk;
9816
+ };
8507
9817
  /**
8508
9818
  * scope of the access token. If the authorization request included scopes
8509
9819
  * they should be added to the access token as well
@@ -8591,14 +9901,10 @@ interface CreateAuthorizationChallengeErrorResponseOptions {
8591
9901
  */
8592
9902
  authSession?: string;
8593
9903
  /**
8594
- * The presentation during issuance error.
8595
- *
8596
9904
  * Error codes specific to authorization challenge are:
8597
9905
  * - @see Oauth2ErrorCodes.RedirectToWeb
8598
9906
  * - @see Oauth2ErrorCodes.InvalidSession
8599
9907
  * - @see Oauth2ErrorCodes.InsufficientAuthorization
8600
- *
8601
- * If you want to require presentation of a
8602
9908
  */
8603
9909
  error: StringWithAutoCompletion<Oauth2ErrorCodes>;
8604
9910
  /**
@@ -8630,10 +9936,6 @@ interface CreateAuthorizationChallengeErrorResponseOptions {
8630
9936
  additionalPayload?: Record<string, unknown>;
8631
9937
  }
8632
9938
 
8633
- interface ParseAuthorizationChallengeRequestOptions {
8634
- authorizationChallengeRequest: unknown;
8635
- }
8636
-
8637
9939
  interface Oauth2AuthorizationServerOptions {
8638
9940
  /**
8639
9941
  * Callbacks required for the oauth2 authorization server
@@ -8646,7 +9948,7 @@ declare class Oauth2AuthorizationServer {
8646
9948
  createAuthorizationServerMetadata(authorizationServerMetadata: AuthorizationServerMetadata): z.objectOutputType<{
8647
9949
  issuer: z.ZodEffects<z.ZodString, string, string>;
8648
9950
  token_endpoint: z.ZodEffects<z.ZodString, string, string>;
8649
- token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
9951
+ token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z.ZodString]>, "many">>;
8650
9952
  authorization_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
8651
9953
  jwks_uri: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
8652
9954
  code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -8654,10 +9956,11 @@ declare class Oauth2AuthorizationServer {
8654
9956
  require_pushed_authorization_requests: z.ZodOptional<z.ZodBoolean>;
8655
9957
  pushed_authorization_request_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
8656
9958
  introspection_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
8657
- introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodLiteral<"client_secret_jwt">, z.ZodLiteral<"private_key_jwt">, z.ZodString]>, "many">>;
9959
+ introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z.ZodString]>, "many">>;
8658
9960
  introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
8659
9961
  authorization_challenge_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
8660
9962
  pre_authorized_grant_anonymous_access_supported: z.ZodOptional<z.ZodBoolean>;
9963
+ client_attestation_pop_nonce_required: z.ZodOptional<z.ZodBoolean>;
8661
9964
  }, z.ZodTypeAny, "passthrough">;
8662
9965
  /**
8663
9966
  * Parse access token request and extract the grant specific properties.
@@ -8676,7 +9979,7 @@ declare class Oauth2AuthorizationServer {
8676
9979
  * For pre-auth flow this can be the pre-authorized_code but there are no requirements
8677
9980
  * on the value.
8678
9981
  */
8679
- createAccessTokenResponse(options: Pick<CreateAccessTokenOptions, 'expiresInSeconds' | 'scope' | 'clientId' | 'audience' | 'signer' | 'dpopJwk' | 'authorizationServer' | 'now' | 'subject'> & Pick<CreateAccessTokenResponseOptions, 'cNonce' | 'cNonceExpiresIn'> & {
9982
+ createAccessTokenResponse(options: Pick<CreateAccessTokenOptions, 'expiresInSeconds' | 'scope' | 'clientId' | 'audience' | 'signer' | 'dpop' | 'authorizationServer' | 'now' | 'subject'> & Pick<CreateAccessTokenResponseOptions, 'cNonce' | 'cNonceExpiresIn'> & {
8680
9983
  additionalAccessTokenPayload?: CreateAccessTokenOptions['additionalPayload'];
8681
9984
  additionalAccessTokenResponsePayload?: CreateAccessTokenResponseOptions['additionalPayload'];
8682
9985
  }): Promise<z.objectOutputType<{
@@ -8690,57 +9993,525 @@ declare class Oauth2AuthorizationServer {
8690
9993
  c_nonce_expires_in: z.ZodOptional<z.ZodNumber>;
8691
9994
  authorization_details: z.ZodOptional<z.ZodArray<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>, "many">>;
8692
9995
  }, z.ZodTypeAny, "passthrough">>;
9996
+ /**
9997
+ * Parse a pushed authorization request
9998
+ */
9999
+ parsePushedAuthorizationRequest(options: ParsePushedAuthorizationRequestOptions): ParsePushedAuthorizationRequestResult;
10000
+ verifyPushedAuthorizationRequest(options: Omit<VerifyPushedAuthorizationRequestOptions, 'callbacks'>): Promise<VerifyAuthorizationRequestReturn>;
10001
+ createPushedAuthorizationResponse(options: CreatePushedAuthorizationResponseOptions): {
10002
+ pushedAuthorizationResponse: z.objectOutputType<{
10003
+ request_uri: z.ZodString;
10004
+ expires_in: z.ZodNumber;
10005
+ }, z.ZodTypeAny, "passthrough">;
10006
+ };
10007
+ createPushedAuthorizationErrorResponse(options: CreatePushedAuthorizationErrorResponseOptions): z.objectOutputType<{
10008
+ error: z.ZodUnion<[z.ZodNativeEnum<typeof Oauth2ErrorCodes>, z.ZodString]>;
10009
+ error_description: z.ZodOptional<z.ZodString>;
10010
+ error_uri: z.ZodOptional<z.ZodString>;
10011
+ }, z.ZodTypeAny, "passthrough">;
8693
10012
  /**
8694
10013
  * Parse an authorization challenge request
8695
10014
  */
8696
- parseAuthorizationChallengeRequest(options: ParseAuthorizationChallengeRequestOptions): {
8697
- authorizationChallengeRequest: z.objectOutputType<{
8698
- client_id: z.ZodOptional<z.ZodString>;
8699
- auth_session: z.ZodOptional<z.ZodString>;
8700
- presentation_during_issuance_session: z.ZodOptional<z.ZodString>;
8701
- redirect_uri: z.ZodOptional<z.ZodString>;
8702
- resource: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
8703
- scope: z.ZodOptional<z.ZodString>;
8704
- issuer_state: z.ZodOptional<z.ZodString>;
8705
- dpop_jkt: z.ZodOptional<z.ZodString>;
8706
- code_challenge: z.ZodOptional<z.ZodString>;
8707
- code_challenge_method: z.ZodOptional<z.ZodString>;
10015
+ parseAuthorizationChallengeRequest(options: ParseAuthorizationChallengeRequestOptions): ParseAuthorizationChallengeRequestResult;
10016
+ verifyAuthorizationChallengeRequest(options: Omit<VerifyAuthorizationChallengeRequestOptions, 'callbacks'>): Promise<VerifyAuthorizationRequestReturn>;
10017
+ createAuthorizationChallengeResponse(options: CreateAuthorizationChallengeResponseOptions): {
10018
+ authorizationChallengeResponse: z.objectOutputType<{
10019
+ authorization_code: z.ZodString;
10020
+ }, z.ZodTypeAny, "passthrough">;
10021
+ };
10022
+ /**
10023
+ * Create an authorization challenge error response indicating presentation of credentials
10024
+ * using OpenID4VP is required before authorization can be granted.
10025
+ *
10026
+ * The `presentation` parameter should be an OpenID4VP authorization request url.
10027
+ * The `authSession` should be used to track the session
10028
+ */
10029
+ createAuthorizationChallengePresentationErrorResponse(options: Pick<CreateAuthorizationChallengeErrorResponseOptions, 'errorDescription' | 'additionalPayload'> & Required<Pick<CreateAuthorizationChallengeErrorResponseOptions, 'authSession' | 'presentation'>>): z.objectOutputType<{
10030
+ auth_session: z.ZodOptional<z.ZodString>;
10031
+ request_uri: z.ZodOptional<z.ZodString>;
10032
+ expires_in: z.ZodOptional<z.ZodNumber>;
10033
+ presentation: z.ZodOptional<z.ZodString>;
10034
+ error: z.ZodUnion<[z.ZodNativeEnum<typeof Oauth2ErrorCodes>, z.ZodString]>;
10035
+ error_description: z.ZodOptional<z.ZodString>;
10036
+ error_uri: z.ZodOptional<z.ZodString>;
10037
+ }, z.ZodTypeAny, "passthrough">;
10038
+ createAuthorizationChallengeErrorResponse(options: CreateAuthorizationChallengeErrorResponseOptions): z.objectOutputType<{
10039
+ auth_session: z.ZodOptional<z.ZodString>;
10040
+ request_uri: z.ZodOptional<z.ZodString>;
10041
+ expires_in: z.ZodOptional<z.ZodNumber>;
10042
+ presentation: z.ZodOptional<z.ZodString>;
10043
+ error: z.ZodUnion<[z.ZodNativeEnum<typeof Oauth2ErrorCodes>, z.ZodString]>;
10044
+ error_description: z.ZodOptional<z.ZodString>;
10045
+ error_uri: z.ZodOptional<z.ZodString>;
10046
+ }, z.ZodTypeAny, "passthrough">;
10047
+ verifyDpopJwt(options: Omit<VerifyDpopJwtOptions, 'callbacks'>): Promise<{
10048
+ header: z.objectOutputType<{
10049
+ typ: z.ZodLiteral<"dpop+jwt">;
10050
+ jwk: z.ZodObject<{
10051
+ kty: z.ZodString;
10052
+ crv: z.ZodOptional<z.ZodString>;
10053
+ x: z.ZodOptional<z.ZodString>;
10054
+ y: z.ZodOptional<z.ZodString>;
10055
+ e: z.ZodOptional<z.ZodString>;
10056
+ n: z.ZodOptional<z.ZodString>;
10057
+ alg: z.ZodOptional<z.ZodString>;
10058
+ d: z.ZodOptional<z.ZodString>;
10059
+ dp: z.ZodOptional<z.ZodString>;
10060
+ dq: z.ZodOptional<z.ZodString>;
10061
+ ext: z.ZodOptional<z.ZodBoolean>;
10062
+ k: z.ZodOptional<z.ZodString>;
10063
+ key_ops: z.ZodOptional<z.ZodString>;
10064
+ kid: z.ZodOptional<z.ZodString>;
10065
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
10066
+ d: z.ZodOptional<z.ZodString>;
10067
+ r: z.ZodOptional<z.ZodString>;
10068
+ t: z.ZodOptional<z.ZodString>;
10069
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10070
+ d: z.ZodOptional<z.ZodString>;
10071
+ r: z.ZodOptional<z.ZodString>;
10072
+ t: z.ZodOptional<z.ZodString>;
10073
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10074
+ d: z.ZodOptional<z.ZodString>;
10075
+ r: z.ZodOptional<z.ZodString>;
10076
+ t: z.ZodOptional<z.ZodString>;
10077
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
10078
+ p: z.ZodOptional<z.ZodString>;
10079
+ q: z.ZodOptional<z.ZodString>;
10080
+ qi: z.ZodOptional<z.ZodString>;
10081
+ use: z.ZodOptional<z.ZodString>;
10082
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
10083
+ x5t: z.ZodOptional<z.ZodString>;
10084
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
10085
+ x5u: z.ZodOptional<z.ZodString>;
10086
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10087
+ kty: z.ZodString;
10088
+ crv: z.ZodOptional<z.ZodString>;
10089
+ x: z.ZodOptional<z.ZodString>;
10090
+ y: z.ZodOptional<z.ZodString>;
10091
+ e: z.ZodOptional<z.ZodString>;
10092
+ n: z.ZodOptional<z.ZodString>;
10093
+ alg: z.ZodOptional<z.ZodString>;
10094
+ d: z.ZodOptional<z.ZodString>;
10095
+ dp: z.ZodOptional<z.ZodString>;
10096
+ dq: z.ZodOptional<z.ZodString>;
10097
+ ext: z.ZodOptional<z.ZodBoolean>;
10098
+ k: z.ZodOptional<z.ZodString>;
10099
+ key_ops: z.ZodOptional<z.ZodString>;
10100
+ kid: z.ZodOptional<z.ZodString>;
10101
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
10102
+ d: z.ZodOptional<z.ZodString>;
10103
+ r: z.ZodOptional<z.ZodString>;
10104
+ t: z.ZodOptional<z.ZodString>;
10105
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10106
+ d: z.ZodOptional<z.ZodString>;
10107
+ r: z.ZodOptional<z.ZodString>;
10108
+ t: z.ZodOptional<z.ZodString>;
10109
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10110
+ d: z.ZodOptional<z.ZodString>;
10111
+ r: z.ZodOptional<z.ZodString>;
10112
+ t: z.ZodOptional<z.ZodString>;
10113
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
10114
+ p: z.ZodOptional<z.ZodString>;
10115
+ q: z.ZodOptional<z.ZodString>;
10116
+ qi: z.ZodOptional<z.ZodString>;
10117
+ use: z.ZodOptional<z.ZodString>;
10118
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
10119
+ x5t: z.ZodOptional<z.ZodString>;
10120
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
10121
+ x5u: z.ZodOptional<z.ZodString>;
10122
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10123
+ kty: z.ZodString;
10124
+ crv: z.ZodOptional<z.ZodString>;
10125
+ x: z.ZodOptional<z.ZodString>;
10126
+ y: z.ZodOptional<z.ZodString>;
10127
+ e: z.ZodOptional<z.ZodString>;
10128
+ n: z.ZodOptional<z.ZodString>;
10129
+ alg: z.ZodOptional<z.ZodString>;
10130
+ d: z.ZodOptional<z.ZodString>;
10131
+ dp: z.ZodOptional<z.ZodString>;
10132
+ dq: z.ZodOptional<z.ZodString>;
10133
+ ext: z.ZodOptional<z.ZodBoolean>;
10134
+ k: z.ZodOptional<z.ZodString>;
10135
+ key_ops: z.ZodOptional<z.ZodString>;
10136
+ kid: z.ZodOptional<z.ZodString>;
10137
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
10138
+ d: z.ZodOptional<z.ZodString>;
10139
+ r: z.ZodOptional<z.ZodString>;
10140
+ t: z.ZodOptional<z.ZodString>;
10141
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10142
+ d: z.ZodOptional<z.ZodString>;
10143
+ r: z.ZodOptional<z.ZodString>;
10144
+ t: z.ZodOptional<z.ZodString>;
10145
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10146
+ d: z.ZodOptional<z.ZodString>;
10147
+ r: z.ZodOptional<z.ZodString>;
10148
+ t: z.ZodOptional<z.ZodString>;
10149
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
10150
+ p: z.ZodOptional<z.ZodString>;
10151
+ q: z.ZodOptional<z.ZodString>;
10152
+ qi: z.ZodOptional<z.ZodString>;
10153
+ use: z.ZodOptional<z.ZodString>;
10154
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
10155
+ x5t: z.ZodOptional<z.ZodString>;
10156
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
10157
+ x5u: z.ZodOptional<z.ZodString>;
10158
+ }, z.ZodTypeAny, "passthrough">>;
10159
+ alg: z.ZodEffects<z.ZodString, string, string>;
10160
+ kid: z.ZodOptional<z.ZodString>;
10161
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
10162
+ trust_chain: z.ZodOptional<z.ZodArray<z.ZodString, "atleastone">>;
8708
10163
  }, z.ZodTypeAny, "passthrough">;
8709
- };
8710
- createAuthorizationChallengeResponse(options: CreateAuthorizationChallengeResponseOptions): {
8711
- authorizationChallengeResponse: z.objectOutputType<{
8712
- authorization_code: z.ZodString;
10164
+ payload: z.objectOutputType<{
10165
+ iat: z.ZodNumber;
10166
+ htu: z.ZodEffects<z.ZodString, string, string>;
10167
+ htm: z.ZodEnum<["GET", "POST", "PUT", "DELETE", "HEAD", "OPTIONS", "TRACE", "CONNECT", "PATCH"]>;
10168
+ jti: z.ZodString;
10169
+ ath: z.ZodOptional<z.ZodString>;
10170
+ iss: z.ZodOptional<z.ZodString>;
10171
+ aud: z.ZodOptional<z.ZodString>;
10172
+ exp: z.ZodOptional<z.ZodNumber>;
10173
+ nbf: z.ZodOptional<z.ZodNumber>;
10174
+ nonce: z.ZodOptional<z.ZodString>;
10175
+ cnf: z.ZodOptional<z.ZodObject<{
10176
+ jwk: z.ZodOptional<z.ZodObject<{
10177
+ kty: z.ZodString;
10178
+ crv: z.ZodOptional<z.ZodString>;
10179
+ x: z.ZodOptional<z.ZodString>;
10180
+ y: z.ZodOptional<z.ZodString>;
10181
+ e: z.ZodOptional<z.ZodString>;
10182
+ n: z.ZodOptional<z.ZodString>;
10183
+ alg: z.ZodOptional<z.ZodString>;
10184
+ d: z.ZodOptional<z.ZodString>;
10185
+ dp: z.ZodOptional<z.ZodString>;
10186
+ dq: z.ZodOptional<z.ZodString>;
10187
+ ext: z.ZodOptional<z.ZodBoolean>;
10188
+ k: z.ZodOptional<z.ZodString>;
10189
+ key_ops: z.ZodOptional<z.ZodString>;
10190
+ kid: z.ZodOptional<z.ZodString>;
10191
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
10192
+ d: z.ZodOptional<z.ZodString>;
10193
+ r: z.ZodOptional<z.ZodString>;
10194
+ t: z.ZodOptional<z.ZodString>;
10195
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10196
+ d: z.ZodOptional<z.ZodString>;
10197
+ r: z.ZodOptional<z.ZodString>;
10198
+ t: z.ZodOptional<z.ZodString>;
10199
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10200
+ d: z.ZodOptional<z.ZodString>;
10201
+ r: z.ZodOptional<z.ZodString>;
10202
+ t: z.ZodOptional<z.ZodString>;
10203
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
10204
+ p: z.ZodOptional<z.ZodString>;
10205
+ q: z.ZodOptional<z.ZodString>;
10206
+ qi: z.ZodOptional<z.ZodString>;
10207
+ use: z.ZodOptional<z.ZodString>;
10208
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
10209
+ x5t: z.ZodOptional<z.ZodString>;
10210
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
10211
+ x5u: z.ZodOptional<z.ZodString>;
10212
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10213
+ kty: z.ZodString;
10214
+ crv: z.ZodOptional<z.ZodString>;
10215
+ x: z.ZodOptional<z.ZodString>;
10216
+ y: z.ZodOptional<z.ZodString>;
10217
+ e: z.ZodOptional<z.ZodString>;
10218
+ n: z.ZodOptional<z.ZodString>;
10219
+ alg: z.ZodOptional<z.ZodString>;
10220
+ d: z.ZodOptional<z.ZodString>;
10221
+ dp: z.ZodOptional<z.ZodString>;
10222
+ dq: z.ZodOptional<z.ZodString>;
10223
+ ext: z.ZodOptional<z.ZodBoolean>;
10224
+ k: z.ZodOptional<z.ZodString>;
10225
+ key_ops: z.ZodOptional<z.ZodString>;
10226
+ kid: z.ZodOptional<z.ZodString>;
10227
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
10228
+ d: z.ZodOptional<z.ZodString>;
10229
+ r: z.ZodOptional<z.ZodString>;
10230
+ t: z.ZodOptional<z.ZodString>;
10231
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10232
+ d: z.ZodOptional<z.ZodString>;
10233
+ r: z.ZodOptional<z.ZodString>;
10234
+ t: z.ZodOptional<z.ZodString>;
10235
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10236
+ d: z.ZodOptional<z.ZodString>;
10237
+ r: z.ZodOptional<z.ZodString>;
10238
+ t: z.ZodOptional<z.ZodString>;
10239
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
10240
+ p: z.ZodOptional<z.ZodString>;
10241
+ q: z.ZodOptional<z.ZodString>;
10242
+ qi: z.ZodOptional<z.ZodString>;
10243
+ use: z.ZodOptional<z.ZodString>;
10244
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
10245
+ x5t: z.ZodOptional<z.ZodString>;
10246
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
10247
+ x5u: z.ZodOptional<z.ZodString>;
10248
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10249
+ kty: z.ZodString;
10250
+ crv: z.ZodOptional<z.ZodString>;
10251
+ x: z.ZodOptional<z.ZodString>;
10252
+ y: z.ZodOptional<z.ZodString>;
10253
+ e: z.ZodOptional<z.ZodString>;
10254
+ n: z.ZodOptional<z.ZodString>;
10255
+ alg: z.ZodOptional<z.ZodString>;
10256
+ d: z.ZodOptional<z.ZodString>;
10257
+ dp: z.ZodOptional<z.ZodString>;
10258
+ dq: z.ZodOptional<z.ZodString>;
10259
+ ext: z.ZodOptional<z.ZodBoolean>;
10260
+ k: z.ZodOptional<z.ZodString>;
10261
+ key_ops: z.ZodOptional<z.ZodString>;
10262
+ kid: z.ZodOptional<z.ZodString>;
10263
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
10264
+ d: z.ZodOptional<z.ZodString>;
10265
+ r: z.ZodOptional<z.ZodString>;
10266
+ t: z.ZodOptional<z.ZodString>;
10267
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10268
+ d: z.ZodOptional<z.ZodString>;
10269
+ r: z.ZodOptional<z.ZodString>;
10270
+ t: z.ZodOptional<z.ZodString>;
10271
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10272
+ d: z.ZodOptional<z.ZodString>;
10273
+ r: z.ZodOptional<z.ZodString>;
10274
+ t: z.ZodOptional<z.ZodString>;
10275
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
10276
+ p: z.ZodOptional<z.ZodString>;
10277
+ q: z.ZodOptional<z.ZodString>;
10278
+ qi: z.ZodOptional<z.ZodString>;
10279
+ use: z.ZodOptional<z.ZodString>;
10280
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
10281
+ x5t: z.ZodOptional<z.ZodString>;
10282
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
10283
+ x5u: z.ZodOptional<z.ZodString>;
10284
+ }, z.ZodTypeAny, "passthrough">>>;
10285
+ jkt: z.ZodOptional<z.ZodString>;
10286
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10287
+ jwk: z.ZodOptional<z.ZodObject<{
10288
+ kty: z.ZodString;
10289
+ crv: z.ZodOptional<z.ZodString>;
10290
+ x: z.ZodOptional<z.ZodString>;
10291
+ y: z.ZodOptional<z.ZodString>;
10292
+ e: z.ZodOptional<z.ZodString>;
10293
+ n: z.ZodOptional<z.ZodString>;
10294
+ alg: z.ZodOptional<z.ZodString>;
10295
+ d: z.ZodOptional<z.ZodString>;
10296
+ dp: z.ZodOptional<z.ZodString>;
10297
+ dq: z.ZodOptional<z.ZodString>;
10298
+ ext: z.ZodOptional<z.ZodBoolean>;
10299
+ k: z.ZodOptional<z.ZodString>;
10300
+ key_ops: z.ZodOptional<z.ZodString>;
10301
+ kid: z.ZodOptional<z.ZodString>;
10302
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
10303
+ d: z.ZodOptional<z.ZodString>;
10304
+ r: z.ZodOptional<z.ZodString>;
10305
+ t: z.ZodOptional<z.ZodString>;
10306
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10307
+ d: z.ZodOptional<z.ZodString>;
10308
+ r: z.ZodOptional<z.ZodString>;
10309
+ t: z.ZodOptional<z.ZodString>;
10310
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10311
+ d: z.ZodOptional<z.ZodString>;
10312
+ r: z.ZodOptional<z.ZodString>;
10313
+ t: z.ZodOptional<z.ZodString>;
10314
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
10315
+ p: z.ZodOptional<z.ZodString>;
10316
+ q: z.ZodOptional<z.ZodString>;
10317
+ qi: z.ZodOptional<z.ZodString>;
10318
+ use: z.ZodOptional<z.ZodString>;
10319
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
10320
+ x5t: z.ZodOptional<z.ZodString>;
10321
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
10322
+ x5u: z.ZodOptional<z.ZodString>;
10323
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10324
+ kty: z.ZodString;
10325
+ crv: z.ZodOptional<z.ZodString>;
10326
+ x: z.ZodOptional<z.ZodString>;
10327
+ y: z.ZodOptional<z.ZodString>;
10328
+ e: z.ZodOptional<z.ZodString>;
10329
+ n: z.ZodOptional<z.ZodString>;
10330
+ alg: z.ZodOptional<z.ZodString>;
10331
+ d: z.ZodOptional<z.ZodString>;
10332
+ dp: z.ZodOptional<z.ZodString>;
10333
+ dq: z.ZodOptional<z.ZodString>;
10334
+ ext: z.ZodOptional<z.ZodBoolean>;
10335
+ k: z.ZodOptional<z.ZodString>;
10336
+ key_ops: z.ZodOptional<z.ZodString>;
10337
+ kid: z.ZodOptional<z.ZodString>;
10338
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
10339
+ d: z.ZodOptional<z.ZodString>;
10340
+ r: z.ZodOptional<z.ZodString>;
10341
+ t: z.ZodOptional<z.ZodString>;
10342
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10343
+ d: z.ZodOptional<z.ZodString>;
10344
+ r: z.ZodOptional<z.ZodString>;
10345
+ t: z.ZodOptional<z.ZodString>;
10346
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10347
+ d: z.ZodOptional<z.ZodString>;
10348
+ r: z.ZodOptional<z.ZodString>;
10349
+ t: z.ZodOptional<z.ZodString>;
10350
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
10351
+ p: z.ZodOptional<z.ZodString>;
10352
+ q: z.ZodOptional<z.ZodString>;
10353
+ qi: z.ZodOptional<z.ZodString>;
10354
+ use: z.ZodOptional<z.ZodString>;
10355
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
10356
+ x5t: z.ZodOptional<z.ZodString>;
10357
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
10358
+ x5u: z.ZodOptional<z.ZodString>;
10359
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10360
+ kty: z.ZodString;
10361
+ crv: z.ZodOptional<z.ZodString>;
10362
+ x: z.ZodOptional<z.ZodString>;
10363
+ y: z.ZodOptional<z.ZodString>;
10364
+ e: z.ZodOptional<z.ZodString>;
10365
+ n: z.ZodOptional<z.ZodString>;
10366
+ alg: z.ZodOptional<z.ZodString>;
10367
+ d: z.ZodOptional<z.ZodString>;
10368
+ dp: z.ZodOptional<z.ZodString>;
10369
+ dq: z.ZodOptional<z.ZodString>;
10370
+ ext: z.ZodOptional<z.ZodBoolean>;
10371
+ k: z.ZodOptional<z.ZodString>;
10372
+ key_ops: z.ZodOptional<z.ZodString>;
10373
+ kid: z.ZodOptional<z.ZodString>;
10374
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
10375
+ d: z.ZodOptional<z.ZodString>;
10376
+ r: z.ZodOptional<z.ZodString>;
10377
+ t: z.ZodOptional<z.ZodString>;
10378
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10379
+ d: z.ZodOptional<z.ZodString>;
10380
+ r: z.ZodOptional<z.ZodString>;
10381
+ t: z.ZodOptional<z.ZodString>;
10382
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10383
+ d: z.ZodOptional<z.ZodString>;
10384
+ r: z.ZodOptional<z.ZodString>;
10385
+ t: z.ZodOptional<z.ZodString>;
10386
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
10387
+ p: z.ZodOptional<z.ZodString>;
10388
+ q: z.ZodOptional<z.ZodString>;
10389
+ qi: z.ZodOptional<z.ZodString>;
10390
+ use: z.ZodOptional<z.ZodString>;
10391
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
10392
+ x5t: z.ZodOptional<z.ZodString>;
10393
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
10394
+ x5u: z.ZodOptional<z.ZodString>;
10395
+ }, z.ZodTypeAny, "passthrough">>>;
10396
+ jkt: z.ZodOptional<z.ZodString>;
10397
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10398
+ jwk: z.ZodOptional<z.ZodObject<{
10399
+ kty: z.ZodString;
10400
+ crv: z.ZodOptional<z.ZodString>;
10401
+ x: z.ZodOptional<z.ZodString>;
10402
+ y: z.ZodOptional<z.ZodString>;
10403
+ e: z.ZodOptional<z.ZodString>;
10404
+ n: z.ZodOptional<z.ZodString>;
10405
+ alg: z.ZodOptional<z.ZodString>;
10406
+ d: z.ZodOptional<z.ZodString>;
10407
+ dp: z.ZodOptional<z.ZodString>;
10408
+ dq: z.ZodOptional<z.ZodString>;
10409
+ ext: z.ZodOptional<z.ZodBoolean>;
10410
+ k: z.ZodOptional<z.ZodString>;
10411
+ key_ops: z.ZodOptional<z.ZodString>;
10412
+ kid: z.ZodOptional<z.ZodString>;
10413
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
10414
+ d: z.ZodOptional<z.ZodString>;
10415
+ r: z.ZodOptional<z.ZodString>;
10416
+ t: z.ZodOptional<z.ZodString>;
10417
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10418
+ d: z.ZodOptional<z.ZodString>;
10419
+ r: z.ZodOptional<z.ZodString>;
10420
+ t: z.ZodOptional<z.ZodString>;
10421
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10422
+ d: z.ZodOptional<z.ZodString>;
10423
+ r: z.ZodOptional<z.ZodString>;
10424
+ t: z.ZodOptional<z.ZodString>;
10425
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
10426
+ p: z.ZodOptional<z.ZodString>;
10427
+ q: z.ZodOptional<z.ZodString>;
10428
+ qi: z.ZodOptional<z.ZodString>;
10429
+ use: z.ZodOptional<z.ZodString>;
10430
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
10431
+ x5t: z.ZodOptional<z.ZodString>;
10432
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
10433
+ x5u: z.ZodOptional<z.ZodString>;
10434
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10435
+ kty: z.ZodString;
10436
+ crv: z.ZodOptional<z.ZodString>;
10437
+ x: z.ZodOptional<z.ZodString>;
10438
+ y: z.ZodOptional<z.ZodString>;
10439
+ e: z.ZodOptional<z.ZodString>;
10440
+ n: z.ZodOptional<z.ZodString>;
10441
+ alg: z.ZodOptional<z.ZodString>;
10442
+ d: z.ZodOptional<z.ZodString>;
10443
+ dp: z.ZodOptional<z.ZodString>;
10444
+ dq: z.ZodOptional<z.ZodString>;
10445
+ ext: z.ZodOptional<z.ZodBoolean>;
10446
+ k: z.ZodOptional<z.ZodString>;
10447
+ key_ops: z.ZodOptional<z.ZodString>;
10448
+ kid: z.ZodOptional<z.ZodString>;
10449
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
10450
+ d: z.ZodOptional<z.ZodString>;
10451
+ r: z.ZodOptional<z.ZodString>;
10452
+ t: z.ZodOptional<z.ZodString>;
10453
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10454
+ d: z.ZodOptional<z.ZodString>;
10455
+ r: z.ZodOptional<z.ZodString>;
10456
+ t: z.ZodOptional<z.ZodString>;
10457
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10458
+ d: z.ZodOptional<z.ZodString>;
10459
+ r: z.ZodOptional<z.ZodString>;
10460
+ t: z.ZodOptional<z.ZodString>;
10461
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
10462
+ p: z.ZodOptional<z.ZodString>;
10463
+ q: z.ZodOptional<z.ZodString>;
10464
+ qi: z.ZodOptional<z.ZodString>;
10465
+ use: z.ZodOptional<z.ZodString>;
10466
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
10467
+ x5t: z.ZodOptional<z.ZodString>;
10468
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
10469
+ x5u: z.ZodOptional<z.ZodString>;
10470
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10471
+ kty: z.ZodString;
10472
+ crv: z.ZodOptional<z.ZodString>;
10473
+ x: z.ZodOptional<z.ZodString>;
10474
+ y: z.ZodOptional<z.ZodString>;
10475
+ e: z.ZodOptional<z.ZodString>;
10476
+ n: z.ZodOptional<z.ZodString>;
10477
+ alg: z.ZodOptional<z.ZodString>;
10478
+ d: z.ZodOptional<z.ZodString>;
10479
+ dp: z.ZodOptional<z.ZodString>;
10480
+ dq: z.ZodOptional<z.ZodString>;
10481
+ ext: z.ZodOptional<z.ZodBoolean>;
10482
+ k: z.ZodOptional<z.ZodString>;
10483
+ key_ops: z.ZodOptional<z.ZodString>;
10484
+ kid: z.ZodOptional<z.ZodString>;
10485
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
10486
+ d: z.ZodOptional<z.ZodString>;
10487
+ r: z.ZodOptional<z.ZodString>;
10488
+ t: z.ZodOptional<z.ZodString>;
10489
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10490
+ d: z.ZodOptional<z.ZodString>;
10491
+ r: z.ZodOptional<z.ZodString>;
10492
+ t: z.ZodOptional<z.ZodString>;
10493
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
10494
+ d: z.ZodOptional<z.ZodString>;
10495
+ r: z.ZodOptional<z.ZodString>;
10496
+ t: z.ZodOptional<z.ZodString>;
10497
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
10498
+ p: z.ZodOptional<z.ZodString>;
10499
+ q: z.ZodOptional<z.ZodString>;
10500
+ qi: z.ZodOptional<z.ZodString>;
10501
+ use: z.ZodOptional<z.ZodString>;
10502
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
10503
+ x5t: z.ZodOptional<z.ZodString>;
10504
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
10505
+ x5u: z.ZodOptional<z.ZodString>;
10506
+ }, z.ZodTypeAny, "passthrough">>>;
10507
+ jkt: z.ZodOptional<z.ZodString>;
10508
+ }, z.ZodTypeAny, "passthrough">>>;
10509
+ status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
10510
+ trust_chain: z.ZodOptional<z.ZodArray<z.ZodString, "atleastone">>;
8713
10511
  }, z.ZodTypeAny, "passthrough">;
8714
- };
8715
- /**
8716
- * Create an authorization challenge error response indicating presentation of credenitals
8717
- * using OpenID4VP is required before authorization can be granted.
8718
- *
8719
- * The `presentation` parameter should be an OpenID4VP authorization request url.
8720
- * The `authSession` should be used to track the session
8721
- */
8722
- createAuthorizationChallengePresentationErrorResponse(options: Pick<CreateAuthorizationChallengeErrorResponseOptions, 'errorDescription' | 'additionalPayload'> & Required<Pick<CreateAuthorizationChallengeErrorResponseOptions, 'authSession' | 'presentation'>>): z.objectOutputType<{
8723
- auth_session: z.ZodOptional<z.ZodString>;
8724
- request_uri: z.ZodOptional<z.ZodString>;
8725
- expires_in: z.ZodOptional<z.ZodNumber>;
8726
- presentation: z.ZodOptional<z.ZodString>;
8727
- error: z.ZodUnion<[z.ZodNativeEnum<typeof Oauth2ErrorCodes>, z.ZodString]>;
8728
- error_description: z.ZodOptional<z.ZodString>;
8729
- error_uri: z.ZodOptional<z.ZodString>;
8730
- }, z.ZodTypeAny, "passthrough">;
8731
- createAuthorizationChallengeErrorResponse(options: CreateAuthorizationChallengeErrorResponseOptions): z.objectOutputType<{
8732
- auth_session: z.ZodOptional<z.ZodString>;
8733
- request_uri: z.ZodOptional<z.ZodString>;
8734
- expires_in: z.ZodOptional<z.ZodNumber>;
8735
- presentation: z.ZodOptional<z.ZodString>;
8736
- error: z.ZodUnion<[z.ZodNativeEnum<typeof Oauth2ErrorCodes>, z.ZodString]>;
8737
- error_description: z.ZodOptional<z.ZodString>;
8738
- error_uri: z.ZodOptional<z.ZodString>;
8739
- }, z.ZodTypeAny, "passthrough">;
8740
- verifyClientAttestation({ authorizationServer, headers, }: {
8741
- authorizationServer: string;
8742
- headers: FetchHeaders;
8743
- }): Promise<{
10512
+ jwkThumbprint: string;
10513
+ }>;
10514
+ verifyClientAttestation(options: Omit<VerifyClientAttestationOptions, 'callbacks'>): Promise<{
8744
10515
  clientAttestation: {
8745
10516
  header: z.objectOutputType<{
8746
10517
  typ: z.ZodLiteral<"oauth-client-attestation+jwt">;
@@ -8972,8 +10743,6 @@ declare class Oauth2AuthorizationServer {
8972
10743
  'x5t#S256': z.ZodOptional<z.ZodString>;
8973
10744
  x5u: z.ZodOptional<z.ZodString>;
8974
10745
  }, z.ZodTypeAny, "passthrough">>;
8975
- key_type: z.ZodOptional<z.ZodUnion<[z.ZodEnum<["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]>, z.ZodString]>>;
8976
- user_authentication: z.ZodOptional<z.ZodUnion<[z.ZodEnum<["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]>, z.ZodString]>>;
8977
10746
  }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
8978
10747
  jwk: z.ZodObject<{
8979
10748
  kty: z.ZodString;
@@ -9084,8 +10853,6 @@ declare class Oauth2AuthorizationServer {
9084
10853
  'x5t#S256': z.ZodOptional<z.ZodString>;
9085
10854
  x5u: z.ZodOptional<z.ZodString>;
9086
10855
  }, z.ZodTypeAny, "passthrough">>;
9087
- key_type: z.ZodOptional<z.ZodUnion<[z.ZodEnum<["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]>, z.ZodString]>>;
9088
- user_authentication: z.ZodOptional<z.ZodUnion<[z.ZodEnum<["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]>, z.ZodString]>>;
9089
10856
  }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
9090
10857
  jwk: z.ZodObject<{
9091
10858
  kty: z.ZodString;
@@ -9196,10 +10963,9 @@ declare class Oauth2AuthorizationServer {
9196
10963
  'x5t#S256': z.ZodOptional<z.ZodString>;
9197
10964
  x5u: z.ZodOptional<z.ZodString>;
9198
10965
  }, z.ZodTypeAny, "passthrough">>;
9199
- key_type: z.ZodOptional<z.ZodUnion<[z.ZodEnum<["software", "hardware", "tee", "secure_enclave", "strong_box", "secure_element", "hsm"]>, z.ZodString]>>;
9200
- user_authentication: z.ZodOptional<z.ZodUnion<[z.ZodEnum<["system_biometry", "system_pin", "internal_biometry", "internal_pin", "secure_element_pin"]>, z.ZodString]>>;
9201
10966
  }, z.ZodTypeAny, "passthrough">>;
9202
- aal: z.ZodOptional<z.ZodString>;
10967
+ wallet_name: z.ZodOptional<z.ZodString>;
10968
+ wallet_link: z.ZodOptional<z.ZodString>;
9203
10969
  aud: z.ZodOptional<z.ZodString>;
9204
10970
  iat: z.ZodOptional<z.ZodNumber>;
9205
10971
  nbf: z.ZodOptional<z.ZodNumber>;
@@ -9681,7 +11447,7 @@ interface SendAuthorizationChallengeRequestOptions {
9681
11447
  /**
9682
11448
  * Callback context
9683
11449
  */
9684
- callbacks: Pick<CallbackContext, 'fetch' | 'hash' | 'generateRandom' | 'signJwt'>;
11450
+ callbacks: Pick<CallbackContext, 'fetch' | 'hash' | 'generateRandom' | 'signJwt' | 'clientAuthentication'>;
9685
11451
  /**
9686
11452
  * Metadata of the authorization server where to perform the authorization challenge
9687
11453
  */
@@ -9690,10 +11456,6 @@ interface SendAuthorizationChallengeRequestOptions {
9690
11456
  * Previously established auth session
9691
11457
  */
9692
11458
  authSession?: string;
9693
- /**
9694
- * The client id to use for the authorization challenge request
9695
- */
9696
- clientId?: string;
9697
11459
  /**
9698
11460
  * Scope to request for the authorization challenge request
9699
11461
  */
@@ -9717,57 +11479,17 @@ interface SendAuthorizationChallengeRequestOptions {
9717
11479
  * Code verifier to use for pkce. If not provided a value will generated when pkce is supported
9718
11480
  */
9719
11481
  pkceCodeVerifier?: string;
9720
- /**
9721
- * If client attestation needs to be included in the request.
9722
- */
9723
- clientAttestation?: RequestClientAttestationOptions;
9724
11482
  /**
9725
11483
  * DPoP options
9726
11484
  */
9727
11485
  dpop?: RequestDpopOptions;
9728
11486
  }
9729
11487
 
9730
- interface CreateClientAttestationJwtOptions {
9731
- /**
9732
- * Creation time of the JWT. If not provided the current date will be used
9733
- */
9734
- issuedAt?: Date;
9735
- /**
9736
- * Expiration time of the JWT.
9737
- */
9738
- expiresAt: Date;
9739
- /**
9740
- * Issuer of the client attestation, usually identifier of the client backend
9741
- */
9742
- issuer: string;
9743
- /**
9744
- * The client id of the client instance.
9745
- */
9746
- clientId: string;
9747
- /**
9748
- * The confirmation payload for the client, attesting the `jwk`, `key_type` and `user_authentication`
9749
- */
9750
- confirmation: ClientAttestationJwtPayload['cnf'];
9751
- /**
9752
- * Additional payload to include in the client attestation jwt payload. Will be applied after
9753
- * any default claims that are included, so add claims with caution.
9754
- */
9755
- additionalPayload?: Record<string, unknown>;
9756
- /**
9757
- * Callback used for client attestation
9758
- */
9759
- callbacks: Pick<CallbackContext, 'signJwt'>;
9760
- /**
9761
- * The signer of the client attestation jwt.
9762
- */
9763
- signer: JwtSigner;
9764
- }
9765
-
9766
11488
  interface Oauth2ClientOptions {
9767
11489
  /**
9768
11490
  * Callbacks required for the oauth2 client
9769
11491
  */
9770
- callbacks: Omit<CallbackContext, 'verifyJwt' | 'clientAuthentication' | 'decryptJwe' | 'encryptJwe'>;
11492
+ callbacks: Omit<CallbackContext, 'verifyJwt' | 'decryptJwe' | 'encryptJwe'>;
9771
11493
  }
9772
11494
  declare class Oauth2Client {
9773
11495
  private options;
@@ -9781,10 +11503,17 @@ declare class Oauth2Client {
9781
11503
  readonly supported: true;
9782
11504
  readonly dpopSigningAlgValuesSupported: string[];
9783
11505
  };
11506
+ isClientAttestationSupported(options: {
11507
+ authorizationServerMetadata: AuthorizationServerMetadata;
11508
+ }): {
11509
+ readonly supported: false;
11510
+ } | {
11511
+ readonly supported: true;
11512
+ };
9784
11513
  fetchAuthorizationServerMetadata(issuer: string): Promise<z.objectOutputType<{
9785
11514
  issuer: z.ZodEffects<z.ZodString, string, string>;
9786
11515
  token_endpoint: z.ZodEffects<z.ZodString, string, string>;
9787
- token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
11516
+ token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z.ZodString]>, "many">>;
9788
11517
  authorization_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
9789
11518
  jwks_uri: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
9790
11519
  code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -9792,10 +11521,11 @@ declare class Oauth2Client {
9792
11521
  require_pushed_authorization_requests: z.ZodOptional<z.ZodBoolean>;
9793
11522
  pushed_authorization_request_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
9794
11523
  introspection_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
9795
- introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodLiteral<"client_secret_jwt">, z.ZodLiteral<"private_key_jwt">, z.ZodString]>, "many">>;
11524
+ introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodEnum<["client_secret_basic", "client_secret_post", "attest_jwt_client_auth", "client_secret_jwt", "private_key_jwt"]>, z.ZodString]>, "many">>;
9796
11525
  introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
9797
11526
  authorization_challenge_endpoint: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
9798
11527
  pre_authorized_grant_anonymous_access_supported: z.ZodOptional<z.ZodBoolean>;
11528
+ client_attestation_pop_nonce_required: z.ZodOptional<z.ZodBoolean>;
9799
11529
  }, z.ZodTypeAny, "passthrough"> | null>;
9800
11530
  /**
9801
11531
  * Initiate authorization.
@@ -9837,14 +11567,10 @@ declare class Oauth2Client {
9837
11567
  pkce: CreatePkceReturn | undefined;
9838
11568
  dpop: RequestDpopOptions | undefined;
9839
11569
  }>;
9840
- retrievePreAuthorizedCodeAccessToken({ authorizationServerMetadata, preAuthorizedCode, additionalRequestPayload, txCode, dpop, resource, clientAttestation, }: Omit<RetrievePreAuthorizedCodeAccessTokenOptions, 'callbacks'>): Promise<RetrieveAccessTokenReturn>;
9841
- retrieveAuthorizationCodeAccessToken({ authorizationServerMetadata, additionalRequestPayload, authorizationCode, pkceCodeVerifier, redirectUri, resource, dpop, clientAttestation, }: Omit<RetrieveAuthorizationCodeAccessTokenOptions, 'callbacks'>): Promise<RetrieveAccessTokenReturn>;
9842
- retrieveRefreshTokenAccessToken({ authorizationServerMetadata, additionalRequestPayload, refreshToken, resource, dpop, clientAttestation, }: Omit<RetrieveRefreshTokenAccessTokenOptions, 'callbacks'>): Promise<RetrieveAccessTokenReturn>;
11570
+ retrievePreAuthorizedCodeAccessToken({ authorizationServerMetadata, preAuthorizedCode, additionalRequestPayload, txCode, dpop, resource, }: Omit<RetrievePreAuthorizedCodeAccessTokenOptions, 'callbacks'>): Promise<RetrieveAccessTokenReturn>;
11571
+ retrieveAuthorizationCodeAccessToken({ authorizationServerMetadata, additionalRequestPayload, authorizationCode, pkceCodeVerifier, redirectUri, resource, dpop, }: Omit<RetrieveAuthorizationCodeAccessTokenOptions, 'callbacks'>): Promise<RetrieveAccessTokenReturn>;
11572
+ retrieveRefreshTokenAccessToken({ authorizationServerMetadata, additionalRequestPayload, refreshToken, resource, dpop, }: Omit<RetrieveRefreshTokenAccessTokenOptions, 'callbacks'>): Promise<RetrieveAccessTokenReturn>;
9843
11573
  resourceRequest(options: ResourceRequestOptions): Promise<ResourceRequestResponseOk | ResourceRequestResponseNotOk>;
9844
- /**
9845
- * @todo move this to another class?
9846
- */
9847
- createClientAttestationJwt(options: Omit<CreateClientAttestationJwtOptions, 'callbacks'>): Promise<string>;
9848
11574
  }
9849
11575
 
9850
11576
  interface Oauth2ResourceServerOptions {
@@ -10552,43 +12278,45 @@ declare class Oauth2ResourceServer {
10552
12278
  jkt: z.ZodOptional<z.ZodString>;
10553
12279
  }, z.ZodTypeAny, "passthrough">>>;
10554
12280
  }, z.ZodTypeAny, "passthrough">;
10555
- dpopJwk: z.objectOutputType<{
10556
- kty: z.ZodString;
10557
- crv: z.ZodOptional<z.ZodString>;
10558
- x: z.ZodOptional<z.ZodString>;
10559
- y: z.ZodOptional<z.ZodString>;
10560
- e: z.ZodOptional<z.ZodString>;
10561
- n: z.ZodOptional<z.ZodString>;
10562
- alg: z.ZodOptional<z.ZodString>;
10563
- d: z.ZodOptional<z.ZodString>;
10564
- dp: z.ZodOptional<z.ZodString>;
10565
- dq: z.ZodOptional<z.ZodString>;
10566
- ext: z.ZodOptional<z.ZodBoolean>;
10567
- k: z.ZodOptional<z.ZodString>;
10568
- key_ops: z.ZodOptional<z.ZodString>;
10569
- kid: z.ZodOptional<z.ZodString>;
10570
- oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
10571
- d: z.ZodOptional<z.ZodString>;
10572
- r: z.ZodOptional<z.ZodString>;
10573
- t: z.ZodOptional<z.ZodString>;
10574
- }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
10575
- d: z.ZodOptional<z.ZodString>;
10576
- r: z.ZodOptional<z.ZodString>;
10577
- t: z.ZodOptional<z.ZodString>;
10578
- }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
12281
+ dpop: {
12282
+ jwk: z.objectOutputType<{
12283
+ kty: z.ZodString;
12284
+ crv: z.ZodOptional<z.ZodString>;
12285
+ x: z.ZodOptional<z.ZodString>;
12286
+ y: z.ZodOptional<z.ZodString>;
12287
+ e: z.ZodOptional<z.ZodString>;
12288
+ n: z.ZodOptional<z.ZodString>;
12289
+ alg: z.ZodOptional<z.ZodString>;
10579
12290
  d: z.ZodOptional<z.ZodString>;
10580
- r: z.ZodOptional<z.ZodString>;
10581
- t: z.ZodOptional<z.ZodString>;
10582
- }, z.ZodTypeAny, "passthrough">>, "many">>;
10583
- p: z.ZodOptional<z.ZodString>;
10584
- q: z.ZodOptional<z.ZodString>;
10585
- qi: z.ZodOptional<z.ZodString>;
10586
- use: z.ZodOptional<z.ZodString>;
10587
- x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
10588
- x5t: z.ZodOptional<z.ZodString>;
10589
- 'x5t#S256': z.ZodOptional<z.ZodString>;
10590
- x5u: z.ZodOptional<z.ZodString>;
10591
- }, z.ZodTypeAny, "passthrough"> | undefined;
12291
+ dp: z.ZodOptional<z.ZodString>;
12292
+ dq: z.ZodOptional<z.ZodString>;
12293
+ ext: z.ZodOptional<z.ZodBoolean>;
12294
+ k: z.ZodOptional<z.ZodString>;
12295
+ key_ops: z.ZodOptional<z.ZodString>;
12296
+ kid: z.ZodOptional<z.ZodString>;
12297
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
12298
+ d: z.ZodOptional<z.ZodString>;
12299
+ r: z.ZodOptional<z.ZodString>;
12300
+ t: z.ZodOptional<z.ZodString>;
12301
+ }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
12302
+ d: z.ZodOptional<z.ZodString>;
12303
+ r: z.ZodOptional<z.ZodString>;
12304
+ t: z.ZodOptional<z.ZodString>;
12305
+ }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
12306
+ d: z.ZodOptional<z.ZodString>;
12307
+ r: z.ZodOptional<z.ZodString>;
12308
+ t: z.ZodOptional<z.ZodString>;
12309
+ }, z.ZodTypeAny, "passthrough">>, "many">>;
12310
+ p: z.ZodOptional<z.ZodString>;
12311
+ q: z.ZodOptional<z.ZodString>;
12312
+ qi: z.ZodOptional<z.ZodString>;
12313
+ use: z.ZodOptional<z.ZodString>;
12314
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
12315
+ x5t: z.ZodOptional<z.ZodString>;
12316
+ 'x5t#S256': z.ZodOptional<z.ZodString>;
12317
+ x5u: z.ZodOptional<z.ZodString>;
12318
+ }, z.ZodTypeAny, "passthrough">;
12319
+ } | undefined;
10592
12320
  scheme: SupportedAuthenticationScheme;
10593
12321
  accessToken: string;
10594
12322
  authorizationServer: string;
@@ -10680,4 +12408,4 @@ type DecodeJwtHeaderResult<HeaderSchema extends BaseSchema | undefined = undefin
10680
12408
  };
10681
12409
  declare function decodeJwtHeader<HeaderSchema extends BaseSchema | undefined = undefined>(options: DecodeJwtHeaderOptions<HeaderSchema>): DecodeJwtHeaderResult<HeaderSchema>;
10682
12410
 
10683
- export { type AccessTokenErrorResponse, type AccessTokenProfileJwtPayload, type AccessTokenResponse, type AuthorizationChallengeErrorResponse, type AuthorizationChallengeRequest, type AuthorizationChallengeResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationServerMetadata, type CalculateJwkThumbprintOptions, type CallbackContext, type ClientAttestationJwtHeader, type ClientAttestationJwtPayload, type ClientAttestationPopJwtHeader, type ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationClientSecretBasicOptions, type ClientAuthenticationClientSecretPostOptions, type ClientAuthenticationDynamicOptions, type CreateAuthorizationRequestUrlOptions, type CreatePkceReturn, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DecryptJweCallback, type DecryptJweCallbackOptions, type EncryptJweCallback, type GenerateRandomCallback, HashAlgorithm, type HashCallback, type JweEncryptor, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSigner, type JwtSignerCustom, type JwtSignerDid, type JwtSignerJwk, type JwtSignerWithJwk, type JwtSignerX5c, Oauth2AuthorizationServer, type Oauth2AuthorizationServerOptions, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, type Oauth2ClientOptions, Oauth2Error, Oauth2ErrorCodes, type Oauth2ErrorOptions, type Oauth2ErrorResponse, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, type Oauth2ResourceServerOptions, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, PkceCodeChallengeMethod, type PreAuthorizedCodeGrantIdentifier, type RefreshTokenGrantIdentifier, type RequestClientAttestationOptions, type RequestDpopOptions, type ResourceRequestOptions, type ResourceRequestResponseNotOk, type ResourceRequestResponseOk, type RetrieveAuthorizationCodeAccessTokenOptions, type RetrievePreAuthorizedCodeAccessTokenOptions, type SignJwtCallback, SupportedAuthenticationScheme, type TokenIntrospectionResponse, type VerifyAccessTokenRequestReturn, type VerifyJwtCallback, type VerifyResourceRequestOptions, type WwwAuthenticateHeaderChallenge, authorizationCodeGrantIdentifier, calculateJwkThumbprint, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, decodeJwt, decodeJwtHeader, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, getAuthorizationServerMetadataFromList, isJwkInSet, jwtHeaderFromJwtSigner, jwtSignerFromJwt, preAuthorizedCodeGrantIdentifier, refreshTokenGrantIdentifier, resourceRequest, verifyJwt, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationServerMetadata, zCompactJwe, zCompactJwt, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zRefreshTokenGrantIdentifier };
12411
+ export { type AccessTokenErrorResponse, type AccessTokenProfileJwtPayload, type AccessTokenResponse, type AuthorizationChallengeErrorResponse, type AuthorizationChallengeRequest, type AuthorizationChallengeResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationServerMetadata, type CalculateJwkThumbprintOptions, type CallbackContext, type ClientAttestationJwtHeader, type ClientAttestationJwtPayload, type ClientAttestationPopJwtHeader, type ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationClientAttestationJwtOptions, type ClientAuthenticationClientSecretBasicOptions, type ClientAuthenticationClientSecretPostOptions, type ClientAuthenticationDynamicOptions, type ClientAuthenticationNoneOptions, type CreateAuthorizationRequestUrlOptions, type CreateClientAttestationJwtOptions, type CreatePkceReturn, type CreatePushedAuthorizationErrorResponseOptions, type CreatePushedAuthorizationResponseOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DecryptJweCallback, type DecryptJweCallbackOptions, type EncryptJweCallback, type GenerateRandomCallback, HashAlgorithm, type HashCallback, type JweEncryptor, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSigner, type JwtSignerCustom, type JwtSignerDid, type JwtSignerJwk, type JwtSignerWithJwk, type JwtSignerX5c, Oauth2AuthorizationServer, type Oauth2AuthorizationServerOptions, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, type Oauth2ClientOptions, Oauth2Error, Oauth2ErrorCodes, type Oauth2ErrorOptions, type Oauth2ErrorResponse, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, type Oauth2ResourceServerOptions, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, type ParseAuthorizationChallengeRequestOptions, type ParseAuthorizationChallengeRequestResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, PkceCodeChallengeMethod, type PreAuthorizedCodeGrantIdentifier, type RefreshTokenGrantIdentifier, type RequestClientAttestationOptions, type RequestDpopOptions, type ResourceRequestOptions, type ResourceRequestResponseNotOk, type ResourceRequestResponseOk, type RetrieveAuthorizationCodeAccessTokenOptions, type RetrievePreAuthorizedCodeAccessTokenOptions, type SignJwtCallback, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, type TokenIntrospectionResponse, type VerifyAccessTokenRequestReturn, type VerifyAuthorizationChallengeRequestOptions, type VerifyAuthorizationChallengeRequestReturn, type VerifyJwtCallback, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyResourceRequestOptions, type WwwAuthenticateHeaderChallenge, authorizationCodeGrantIdentifier, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, createClientAttestationJwt, decodeJwt, decodeJwtHeader, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, getAuthorizationServerMetadataFromList, isJwkInSet, jwtHeaderFromJwtSigner, jwtSignerFromJwt, preAuthorizedCodeGrantIdentifier, refreshTokenGrantIdentifier, resourceRequest, verifyJwt, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationServerMetadata, zCompactJwe, zCompactJwt, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zRefreshTokenGrantIdentifier };