@openid4vc/oauth2 0.3.0-alpha-20251030140425 → 0.3.0-alpha-20251031085020

package/dist/index.d.mts

@@ -256,7 +256,7 @@ type JweEncryptor = JwtSignerJwk & {
 declare const zCompactJwt: z$1.ZodString;
 declare const zJwtPayload: z$1.ZodObject<{
   iss: z$1.ZodOptional<z$1.ZodString>;
-  aud: z$1.ZodOptional<z$1.ZodString>;
+  aud: z$1.ZodOptional<z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>;
   iat: z$1.ZodOptional<z$1.ZodNumber>;
   exp: z$1.ZodOptional<z$1.ZodNumber>;
   nbf: z$1.ZodOptional<z$1.ZodNumber>;
@@ -700,7 +700,7 @@ declare const zClientAttestationJwtPayload: z$1.ZodObject<{
   }, z$1.core.$loose>;
   wallet_name: z$1.ZodOptional<z$1.ZodString>;
   wallet_link: z$1.ZodOptional<z$1.ZodURL>;
-  aud: z$1.ZodOptional<z$1.ZodString>;
+  aud: z$1.ZodOptional<z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>;
   iat: z$1.ZodOptional<z$1.ZodNumber>;
   nbf: z$1.ZodOptional<z$1.ZodNumber>;
   nonce: z$1.ZodOptional<z$1.ZodString>;
@@ -749,7 +749,7 @@ type ClientAttestationJwtHeader = z$1.infer<typeof zClientAttestationJwtHeader>;
 declare const zClientAttestationPopJwtPayload: z$1.ZodObject<{
   iss: z$1.ZodString;
   exp: z$1.ZodNumber;
-  aud: z$1.ZodString;
+  aud: z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>;
   jti: z$1.ZodString;
   nonce: z$1.ZodOptional<z$1.ZodString>;
   iat: z$1.ZodOptional<z$1.ZodNumber>;
@@ -926,7 +926,7 @@ declare function verifyClientAttestationJwt(options: VerifyClientAttestationJwtO
     };
     wallet_name?: string | undefined;
     wallet_link?: string | undefined;
-    aud?: string | undefined;
+    aud?: string | string[] | undefined;
     iat?: number | undefined;
     nbf?: number | undefined;
     nonce?: string | undefined;
@@ -1080,7 +1080,7 @@ declare function verifyClientAttestationPopJwt(options: VerifyClientAttestationP
     [x: string]: unknown;
     iss: string;
     exp: number;
-    aud: string;
+    aud: string | string[];
     jti: string;
     nonce?: string | undefined;
     iat?: number | undefined;
@@ -1302,7 +1302,7 @@ declare const zAccessTokenProfileJwtPayload: z$1.ZodObject<{
   iss: z$1.ZodString;
   exp: z$1.ZodNumber;
   iat: z$1.ZodNumber;
-  aud: z$1.ZodString;
+  aud: z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>;
   sub: z$1.ZodString;
   client_id: z$1.ZodOptional<z$1.ZodString>;
   jti: z$1.ZodString;
@@ -1357,7 +1357,7 @@ declare const zTokenIntrospectionResponse: z$1.ZodObject<{
   iat: z$1.ZodOptional<z$1.ZodNumber>;
   nbf: z$1.ZodOptional<z$1.ZodNumber>;
   sub: z$1.ZodOptional<z$1.ZodString>;
-  aud: z$1.ZodOptional<z$1.ZodString>;
+  aud: z$1.ZodOptional<z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>;
   iss: z$1.ZodOptional<z$1.ZodString>;
   jti: z$1.ZodOptional<z$1.ZodString>;
   cnf: z$1.ZodOptional<z$1.ZodObject<{
@@ -1427,9 +1427,9 @@ declare const zAuthorizationChallengeRequest: z$1.ZodObject<{
   client_id: z$1.ZodOptional<z$1.ZodString>;
   auth_session: z$1.ZodOptional<z$1.ZodString>;
   presentation_during_issuance_session: z$1.ZodOptional<z$1.ZodString>;
+  scope: z$1.ZodOptional<z$1.ZodString>;
   redirect_uri: z$1.ZodOptional<z$1.ZodURL>;
   resource: z$1.ZodOptional<z$1.ZodString>;
-  scope: z$1.ZodOptional<z$1.ZodString>;
   state: z$1.ZodOptional<z$1.ZodString>;
   issuer_state: z$1.ZodOptional<z$1.ZodString>;
   dpop_jkt: z$1.ZodOptional<z$1.ZodBase64URL>;
@@ -1945,7 +1945,7 @@ declare class Oauth2ServerErrorResponseError extends Oauth2Error {
 }
 //#endregion
 //#region src/id-token/verify-id-token.d.ts
-interface VerifyJwtIdTokenOptions {
+interface VerifyIdTokenJwtOptions {
   /**
    * The compact id token.
    */
@@ -1974,7 +1974,7 @@ interface VerifyJwtIdTokenOptions {
 /**
  * Verify an ID Token JWT.
  */
-declare function verifyJwtIdToken(options: VerifyJwtIdTokenOptions): Promise<{
+declare function verifyIdTokenJwt(options: VerifyIdTokenJwtOptions): Promise<{
   header: {
     [x: string]: unknown;
     alg: string;
@@ -2018,7 +2018,7 @@ declare function verifyJwtIdToken(options: VerifyJwtIdTokenOptions): Promise<{
     [x: string]: unknown;
     iss: string;
     sub: string;
-    aud: string;
+    aud: string | string[];
     exp: number;
     iat: number;
     auth_time?: number | undefined;
@@ -2136,7 +2136,7 @@ type IdTokenJwtHeader = z$1.infer<typeof zIdTokenJwtHeader>;
 declare const zIdTokenJwtPayload: z$1.ZodObject<{
   iss: z$1.ZodString;
   sub: z$1.ZodString;
-  aud: z$1.ZodString;
+  aud: z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>;
   exp: z$1.ZodNumber;
   iat: z$1.ZodNumber;
   auth_time: z$1.ZodOptional<z$1.ZodNumber>;
@@ -2585,7 +2585,7 @@ declare class Oauth2AuthorizationServer {
       jti: string;
       ath?: string | undefined;
       iss?: string | undefined;
-      aud?: string | undefined;
+      aud?: string | string[] | undefined;
       exp?: number | undefined;
       nbf?: number | undefined;
       nonce?: string | undefined;
@@ -2712,7 +2712,7 @@ declare class Oauth2AuthorizationServer {
         };
         wallet_name?: string | undefined;
         wallet_link?: string | undefined;
-        aud?: string | undefined;
+        aud?: string | string[] | undefined;
         iat?: number | undefined;
         nbf?: number | undefined;
         nonce?: string | undefined;
@@ -2766,7 +2766,7 @@ declare class Oauth2AuthorizationServer {
         [x: string]: unknown;
         iss: string;
         exp: number;
-        aud: string;
+        aud: string | string[];
         jti: string;
         nonce?: string | undefined;
         iat?: number | undefined;
@@ -3044,7 +3044,7 @@ declare class Oauth2ResourceServer {
       iss: string;
       exp: number;
       iat: number;
-      aud: string;
+      aud: string | string[];
       sub: string;
       jti: string;
       client_id?: string | undefined;
@@ -3099,7 +3099,7 @@ declare class Oauth2ResourceServer {
       iat?: number | undefined;
       nbf?: number | undefined;
       sub?: string | undefined;
-      aud?: string | undefined;
+      aud?: string | string[] | undefined;
       iss?: string | undefined;
       jti?: string | undefined;
       cnf?: {
@@ -3208,7 +3208,7 @@ declare function verifyResourceRequest(options: VerifyResourceRequestOptions): P
     iss: string;
     exp: number;
     iat: number;
-    aud: string;
+    aud: string | string[];
     sub: string;
     jti: string;
     client_id?: string | undefined;
@@ -3263,7 +3263,7 @@ declare function verifyResourceRequest(options: VerifyResourceRequestOptions): P
     iat?: number | undefined;
     nbf?: number | undefined;
     sub?: string | undefined;
-    aud?: string | undefined;
+    aud?: string | string[] | undefined;
     iss?: string | undefined;
     jti?: string | undefined;
     cnf?: {
@@ -3340,5 +3340,5 @@ declare function verifyResourceRequest(options: VerifyResourceRequestOptions): P
   authorizationServer: string;
 }>;
 //#endregion
-export { type AccessTokenErrorResponse, type AccessTokenProfileJwtPayload, type AccessTokenResponse, type AuthorizationChallengeErrorResponse, type AuthorizationChallengeRequest, type AuthorizationChallengeResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationServerMetadata, type CalculateJwkThumbprintOptions, type CallbackContext, type ClientAttestationJwtHeader, type ClientAttestationJwtPayload, type ClientAttestationPopJwtHeader, type ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationClientAttestationJwtOptions, type ClientAuthenticationClientSecretBasicOptions, type ClientAuthenticationClientSecretPostOptions, type ClientAuthenticationDynamicOptions, type ClientAuthenticationNoneOptions, type CreateAuthorizationRequestUrlOptions, type CreateClientAttestationJwtOptions, type CreatePkceReturn, type CreatePushedAuthorizationErrorResponseOptions, type CreatePushedAuthorizationResponseOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DecryptJweCallback, type DecryptJweCallbackOptions, type EncryptJweCallback, type GenerateRandomCallback, HashAlgorithm, type HashCallback, type HttpMethod, IdTokenJwtHeader, IdTokenJwtPayload, InvalidFetchResponseError, type JweEncryptor, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSigner, type JwtSignerCustom, type JwtSignerDid, type JwtSignerJwk, type JwtSignerWithJwk, type JwtSignerX5c, Oauth2AuthorizationServer, type Oauth2AuthorizationServerOptions, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, type Oauth2ClientOptions, Oauth2Error, Oauth2ErrorCodes, type Oauth2ErrorOptions, type Oauth2ErrorResponse, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, type Oauth2ResourceServerOptions, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, type Oid4vcTsConfig, type ParseAuthorizationChallengeRequestOptions, type ParseAuthorizationChallengeRequestResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, PkceCodeChallengeMethod, type PreAuthorizedCodeGrantIdentifier, type RefreshTokenGrantIdentifier, type RequestClientAttestationOptions, type RequestDpopOptions, type RequestLike, type ResourceRequestOptions, type ResourceRequestResponseNotOk, type ResourceRequestResponseOk, type RetrieveAuthorizationCodeAccessTokenOptions, type RetrievePreAuthorizedCodeAccessTokenOptions, type SignJwtCallback, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, type TokenIntrospectionResponse, VerifiedClientAttestationJwt, type VerifyAccessTokenRequestReturn, type VerifyAuthorizationChallengeRequestOptions, type VerifyAuthorizationChallengeRequestReturn, type VerifyJwtCallback, VerifyJwtIdTokenOptions, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyResourceRequestOptions, type WwwAuthenticateHeaderChallenge, authorizationCodeGrantIdentifier, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, createClientAttestationJwt, decodeJwt, decodeJwtHeader, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, getAuthorizationServerMetadataFromList, getGlobalConfig, isJwkInSet, jwtHeaderFromJwtSigner, jwtSignerFromJwt, preAuthorizedCodeGrantIdentifier, refreshTokenGrantIdentifier, resourceRequest, setGlobalConfig, verifyClientAttestationJwt, verifyJwt, verifyJwtIdToken, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationServerMetadata, zCompactJwe, zCompactJwt, zIdTokenJwtHeader, zIdTokenJwtPayload, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zRefreshTokenGrantIdentifier };
+export { type AccessTokenErrorResponse, type AccessTokenProfileJwtPayload, type AccessTokenResponse, type AuthorizationChallengeErrorResponse, type AuthorizationChallengeRequest, type AuthorizationChallengeResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationServerMetadata, type CalculateJwkThumbprintOptions, type CallbackContext, type ClientAttestationJwtHeader, type ClientAttestationJwtPayload, type ClientAttestationPopJwtHeader, type ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationClientAttestationJwtOptions, type ClientAuthenticationClientSecretBasicOptions, type ClientAuthenticationClientSecretPostOptions, type ClientAuthenticationDynamicOptions, type ClientAuthenticationNoneOptions, type CreateAuthorizationRequestUrlOptions, type CreateClientAttestationJwtOptions, type CreatePkceReturn, type CreatePushedAuthorizationErrorResponseOptions, type CreatePushedAuthorizationResponseOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DecryptJweCallback, type DecryptJweCallbackOptions, type EncryptJweCallback, type GenerateRandomCallback, HashAlgorithm, type HashCallback, type HttpMethod, IdTokenJwtHeader, IdTokenJwtPayload, InvalidFetchResponseError, type JweEncryptor, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSigner, type JwtSignerCustom, type JwtSignerDid, type JwtSignerJwk, type JwtSignerWithJwk, type JwtSignerX5c, Oauth2AuthorizationServer, type Oauth2AuthorizationServerOptions, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, type Oauth2ClientOptions, Oauth2Error, Oauth2ErrorCodes, type Oauth2ErrorOptions, type Oauth2ErrorResponse, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, type Oauth2ResourceServerOptions, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, type Oid4vcTsConfig, type ParseAuthorizationChallengeRequestOptions, type ParseAuthorizationChallengeRequestResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, PkceCodeChallengeMethod, type PreAuthorizedCodeGrantIdentifier, type RefreshTokenGrantIdentifier, type RequestClientAttestationOptions, type RequestDpopOptions, type RequestLike, type ResourceRequestOptions, type ResourceRequestResponseNotOk, type ResourceRequestResponseOk, type RetrieveAuthorizationCodeAccessTokenOptions, type RetrievePreAuthorizedCodeAccessTokenOptions, type SignJwtCallback, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, type TokenIntrospectionResponse, type VerifiedClientAttestationJwt, type VerifyAccessTokenRequestReturn, type VerifyAuthorizationChallengeRequestOptions, type VerifyAuthorizationChallengeRequestReturn, VerifyIdTokenJwtOptions, type VerifyJwtCallback, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyResourceRequestOptions, type WwwAuthenticateHeaderChallenge, authorizationCodeGrantIdentifier, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, createClientAttestationJwt, decodeJwt, decodeJwtHeader, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, getAuthorizationServerMetadataFromList, getGlobalConfig, isJwkInSet, jwtHeaderFromJwtSigner, jwtSignerFromJwt, preAuthorizedCodeGrantIdentifier, refreshTokenGrantIdentifier, resourceRequest, setGlobalConfig, verifyClientAttestationJwt, verifyIdTokenJwt, verifyJwt, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationServerMetadata, zCompactJwe, zCompactJwt, zIdTokenJwtHeader, zIdTokenJwtPayload, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zRefreshTokenGrantIdentifier };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.ts

@@ -256,7 +256,7 @@ type JweEncryptor = JwtSignerJwk & {
 declare const zCompactJwt: z$1.ZodString;
 declare const zJwtPayload: z$1.ZodObject<{
   iss: z$1.ZodOptional<z$1.ZodString>;
-  aud: z$1.ZodOptional<z$1.ZodString>;
+  aud: z$1.ZodOptional<z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>;
   iat: z$1.ZodOptional<z$1.ZodNumber>;
   exp: z$1.ZodOptional<z$1.ZodNumber>;
   nbf: z$1.ZodOptional<z$1.ZodNumber>;
@@ -700,7 +700,7 @@ declare const zClientAttestationJwtPayload: z$1.ZodObject<{
   }, z$1.core.$loose>;
   wallet_name: z$1.ZodOptional<z$1.ZodString>;
   wallet_link: z$1.ZodOptional<z$1.ZodURL>;
-  aud: z$1.ZodOptional<z$1.ZodString>;
+  aud: z$1.ZodOptional<z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>;
   iat: z$1.ZodOptional<z$1.ZodNumber>;
   nbf: z$1.ZodOptional<z$1.ZodNumber>;
   nonce: z$1.ZodOptional<z$1.ZodString>;
@@ -749,7 +749,7 @@ type ClientAttestationJwtHeader = z$1.infer<typeof zClientAttestationJwtHeader>;
 declare const zClientAttestationPopJwtPayload: z$1.ZodObject<{
   iss: z$1.ZodString;
   exp: z$1.ZodNumber;
-  aud: z$1.ZodString;
+  aud: z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>;
   jti: z$1.ZodString;
   nonce: z$1.ZodOptional<z$1.ZodString>;
   iat: z$1.ZodOptional<z$1.ZodNumber>;
@@ -926,7 +926,7 @@ declare function verifyClientAttestationJwt(options: VerifyClientAttestationJwtO
     };
     wallet_name?: string | undefined;
     wallet_link?: string | undefined;
-    aud?: string | undefined;
+    aud?: string | string[] | undefined;
     iat?: number | undefined;
     nbf?: number | undefined;
     nonce?: string | undefined;
@@ -1080,7 +1080,7 @@ declare function verifyClientAttestationPopJwt(options: VerifyClientAttestationP
     [x: string]: unknown;
     iss: string;
     exp: number;
-    aud: string;
+    aud: string | string[];
     jti: string;
     nonce?: string | undefined;
     iat?: number | undefined;
@@ -1302,7 +1302,7 @@ declare const zAccessTokenProfileJwtPayload: z$1.ZodObject<{
   iss: z$1.ZodString;
   exp: z$1.ZodNumber;
   iat: z$1.ZodNumber;
-  aud: z$1.ZodString;
+  aud: z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>;
   sub: z$1.ZodString;
   client_id: z$1.ZodOptional<z$1.ZodString>;
   jti: z$1.ZodString;
@@ -1357,7 +1357,7 @@ declare const zTokenIntrospectionResponse: z$1.ZodObject<{
   iat: z$1.ZodOptional<z$1.ZodNumber>;
   nbf: z$1.ZodOptional<z$1.ZodNumber>;
   sub: z$1.ZodOptional<z$1.ZodString>;
-  aud: z$1.ZodOptional<z$1.ZodString>;
+  aud: z$1.ZodOptional<z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>;
   iss: z$1.ZodOptional<z$1.ZodString>;
   jti: z$1.ZodOptional<z$1.ZodString>;
   cnf: z$1.ZodOptional<z$1.ZodObject<{
@@ -1427,9 +1427,9 @@ declare const zAuthorizationChallengeRequest: z$1.ZodObject<{
   client_id: z$1.ZodOptional<z$1.ZodString>;
   auth_session: z$1.ZodOptional<z$1.ZodString>;
   presentation_during_issuance_session: z$1.ZodOptional<z$1.ZodString>;
+  scope: z$1.ZodOptional<z$1.ZodString>;
   redirect_uri: z$1.ZodOptional<z$1.ZodURL>;
   resource: z$1.ZodOptional<z$1.ZodString>;
-  scope: z$1.ZodOptional<z$1.ZodString>;
   state: z$1.ZodOptional<z$1.ZodString>;
   issuer_state: z$1.ZodOptional<z$1.ZodString>;
   dpop_jkt: z$1.ZodOptional<z$1.ZodBase64URL>;
@@ -1945,7 +1945,7 @@ declare class Oauth2ServerErrorResponseError extends Oauth2Error {
 }
 //#endregion
 //#region src/id-token/verify-id-token.d.ts
-interface VerifyJwtIdTokenOptions {
+interface VerifyIdTokenJwtOptions {
   /**
    * The compact id token.
    */
@@ -1974,7 +1974,7 @@ interface VerifyJwtIdTokenOptions {
 /**
  * Verify an ID Token JWT.
  */
-declare function verifyJwtIdToken(options: VerifyJwtIdTokenOptions): Promise<{
+declare function verifyIdTokenJwt(options: VerifyIdTokenJwtOptions): Promise<{
   header: {
     [x: string]: unknown;
     alg: string;
@@ -2018,7 +2018,7 @@ declare function verifyJwtIdToken(options: VerifyJwtIdTokenOptions): Promise<{
     [x: string]: unknown;
     iss: string;
     sub: string;
-    aud: string;
+    aud: string | string[];
     exp: number;
     iat: number;
     auth_time?: number | undefined;
@@ -2136,7 +2136,7 @@ type IdTokenJwtHeader = z$1.infer<typeof zIdTokenJwtHeader>;
 declare const zIdTokenJwtPayload: z$1.ZodObject<{
   iss: z$1.ZodString;
   sub: z$1.ZodString;
-  aud: z$1.ZodString;
+  aud: z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>;
   exp: z$1.ZodNumber;
   iat: z$1.ZodNumber;
   auth_time: z$1.ZodOptional<z$1.ZodNumber>;
@@ -2585,7 +2585,7 @@ declare class Oauth2AuthorizationServer {
       jti: string;
       ath?: string | undefined;
       iss?: string | undefined;
-      aud?: string | undefined;
+      aud?: string | string[] | undefined;
       exp?: number | undefined;
       nbf?: number | undefined;
       nonce?: string | undefined;
@@ -2712,7 +2712,7 @@ declare class Oauth2AuthorizationServer {
         };
         wallet_name?: string | undefined;
         wallet_link?: string | undefined;
-        aud?: string | undefined;
+        aud?: string | string[] | undefined;
         iat?: number | undefined;
         nbf?: number | undefined;
         nonce?: string | undefined;
@@ -2766,7 +2766,7 @@ declare class Oauth2AuthorizationServer {
         [x: string]: unknown;
         iss: string;
         exp: number;
-        aud: string;
+        aud: string | string[];
         jti: string;
         nonce?: string | undefined;
         iat?: number | undefined;
@@ -3044,7 +3044,7 @@ declare class Oauth2ResourceServer {
       iss: string;
       exp: number;
       iat: number;
-      aud: string;
+      aud: string | string[];
       sub: string;
       jti: string;
       client_id?: string | undefined;
@@ -3099,7 +3099,7 @@ declare class Oauth2ResourceServer {
       iat?: number | undefined;
       nbf?: number | undefined;
       sub?: string | undefined;
-      aud?: string | undefined;
+      aud?: string | string[] | undefined;
       iss?: string | undefined;
       jti?: string | undefined;
       cnf?: {
@@ -3208,7 +3208,7 @@ declare function verifyResourceRequest(options: VerifyResourceRequestOptions): P
     iss: string;
     exp: number;
     iat: number;
-    aud: string;
+    aud: string | string[];
     sub: string;
     jti: string;
     client_id?: string | undefined;
@@ -3263,7 +3263,7 @@ declare function verifyResourceRequest(options: VerifyResourceRequestOptions): P
     iat?: number | undefined;
     nbf?: number | undefined;
     sub?: string | undefined;
-    aud?: string | undefined;
+    aud?: string | string[] | undefined;
     iss?: string | undefined;
     jti?: string | undefined;
     cnf?: {
@@ -3340,5 +3340,5 @@ declare function verifyResourceRequest(options: VerifyResourceRequestOptions): P
   authorizationServer: string;
 }>;
 //#endregion
-export { type AccessTokenErrorResponse, type AccessTokenProfileJwtPayload, type AccessTokenResponse, type AuthorizationChallengeErrorResponse, type AuthorizationChallengeRequest, type AuthorizationChallengeResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationServerMetadata, type CalculateJwkThumbprintOptions, type CallbackContext, type ClientAttestationJwtHeader, type ClientAttestationJwtPayload, type ClientAttestationPopJwtHeader, type ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationClientAttestationJwtOptions, type ClientAuthenticationClientSecretBasicOptions, type ClientAuthenticationClientSecretPostOptions, type ClientAuthenticationDynamicOptions, type ClientAuthenticationNoneOptions, type CreateAuthorizationRequestUrlOptions, type CreateClientAttestationJwtOptions, type CreatePkceReturn, type CreatePushedAuthorizationErrorResponseOptions, type CreatePushedAuthorizationResponseOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DecryptJweCallback, type DecryptJweCallbackOptions, type EncryptJweCallback, type GenerateRandomCallback, HashAlgorithm, type HashCallback, type HttpMethod, IdTokenJwtHeader, IdTokenJwtPayload, InvalidFetchResponseError, type JweEncryptor, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSigner, type JwtSignerCustom, type JwtSignerDid, type JwtSignerJwk, type JwtSignerWithJwk, type JwtSignerX5c, Oauth2AuthorizationServer, type Oauth2AuthorizationServerOptions, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, type Oauth2ClientOptions, Oauth2Error, Oauth2ErrorCodes, type Oauth2ErrorOptions, type Oauth2ErrorResponse, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, type Oauth2ResourceServerOptions, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, type Oid4vcTsConfig, type ParseAuthorizationChallengeRequestOptions, type ParseAuthorizationChallengeRequestResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, PkceCodeChallengeMethod, type PreAuthorizedCodeGrantIdentifier, type RefreshTokenGrantIdentifier, type RequestClientAttestationOptions, type RequestDpopOptions, type RequestLike, type ResourceRequestOptions, type ResourceRequestResponseNotOk, type ResourceRequestResponseOk, type RetrieveAuthorizationCodeAccessTokenOptions, type RetrievePreAuthorizedCodeAccessTokenOptions, type SignJwtCallback, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, type TokenIntrospectionResponse, VerifiedClientAttestationJwt, type VerifyAccessTokenRequestReturn, type VerifyAuthorizationChallengeRequestOptions, type VerifyAuthorizationChallengeRequestReturn, type VerifyJwtCallback, VerifyJwtIdTokenOptions, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyResourceRequestOptions, type WwwAuthenticateHeaderChallenge, authorizationCodeGrantIdentifier, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, createClientAttestationJwt, decodeJwt, decodeJwtHeader, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, getAuthorizationServerMetadataFromList, getGlobalConfig, isJwkInSet, jwtHeaderFromJwtSigner, jwtSignerFromJwt, preAuthorizedCodeGrantIdentifier, refreshTokenGrantIdentifier, resourceRequest, setGlobalConfig, verifyClientAttestationJwt, verifyJwt, verifyJwtIdToken, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationServerMetadata, zCompactJwe, zCompactJwt, zIdTokenJwtHeader, zIdTokenJwtPayload, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zRefreshTokenGrantIdentifier };
+export { type AccessTokenErrorResponse, type AccessTokenProfileJwtPayload, type AccessTokenResponse, type AuthorizationChallengeErrorResponse, type AuthorizationChallengeRequest, type AuthorizationChallengeResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationServerMetadata, type CalculateJwkThumbprintOptions, type CallbackContext, type ClientAttestationJwtHeader, type ClientAttestationJwtPayload, type ClientAttestationPopJwtHeader, type ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationClientAttestationJwtOptions, type ClientAuthenticationClientSecretBasicOptions, type ClientAuthenticationClientSecretPostOptions, type ClientAuthenticationDynamicOptions, type ClientAuthenticationNoneOptions, type CreateAuthorizationRequestUrlOptions, type CreateClientAttestationJwtOptions, type CreatePkceReturn, type CreatePushedAuthorizationErrorResponseOptions, type CreatePushedAuthorizationResponseOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DecryptJweCallback, type DecryptJweCallbackOptions, type EncryptJweCallback, type GenerateRandomCallback, HashAlgorithm, type HashCallback, type HttpMethod, IdTokenJwtHeader, IdTokenJwtPayload, InvalidFetchResponseError, type JweEncryptor, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSigner, type JwtSignerCustom, type JwtSignerDid, type JwtSignerJwk, type JwtSignerWithJwk, type JwtSignerX5c, Oauth2AuthorizationServer, type Oauth2AuthorizationServerOptions, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, type Oauth2ClientOptions, Oauth2Error, Oauth2ErrorCodes, type Oauth2ErrorOptions, type Oauth2ErrorResponse, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, type Oauth2ResourceServerOptions, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, type Oid4vcTsConfig, type ParseAuthorizationChallengeRequestOptions, type ParseAuthorizationChallengeRequestResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, PkceCodeChallengeMethod, type PreAuthorizedCodeGrantIdentifier, type RefreshTokenGrantIdentifier, type RequestClientAttestationOptions, type RequestDpopOptions, type RequestLike, type ResourceRequestOptions, type ResourceRequestResponseNotOk, type ResourceRequestResponseOk, type RetrieveAuthorizationCodeAccessTokenOptions, type RetrievePreAuthorizedCodeAccessTokenOptions, type SignJwtCallback, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, type TokenIntrospectionResponse, type VerifiedClientAttestationJwt, type VerifyAccessTokenRequestReturn, type VerifyAuthorizationChallengeRequestOptions, type VerifyAuthorizationChallengeRequestReturn, VerifyIdTokenJwtOptions, type VerifyJwtCallback, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyResourceRequestOptions, type WwwAuthenticateHeaderChallenge, authorizationCodeGrantIdentifier, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, createClientAttestationJwt, decodeJwt, decodeJwtHeader, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, getAuthorizationServerMetadataFromList, getGlobalConfig, isJwkInSet, jwtHeaderFromJwtSigner, jwtSignerFromJwt, preAuthorizedCodeGrantIdentifier, refreshTokenGrantIdentifier, resourceRequest, setGlobalConfig, verifyClientAttestationJwt, verifyIdTokenJwt, verifyJwt, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationServerMetadata, zCompactJwe, zCompactJwt, zIdTokenJwtHeader, zIdTokenJwtPayload, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zRefreshTokenGrantIdentifier };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -183,7 +183,7 @@ const zJwtConfirmationPayload = zod.default.object({
 }).loose();
 const zJwtPayload = zod.default.object({
 	iss: zod.default.string().optional(),
-	aud: zod.default.string().optional(),
+	aud: zod.default.union([zod.default.string(), zod.default.array(zod.default.string())]).optional(),
 	iat: __openid4vc_utils.zInteger.optional(),
 	exp: __openid4vc_utils.zInteger.optional(),
 	nbf: __openid4vc_utils.zInteger.optional(),
@@ -357,7 +357,9 @@ async function verifyJwt(options) {
 	const timeBasedValidation = options.skipTimeBasedValidation !== void 0 ? !options.skipTimeBasedValidation : true;
 	if (timeBasedValidation && options.payload.nbf && nowInSeconds < options.payload.nbf - skewInSeconds) throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'nbf' is in the future`);
 	if (timeBasedValidation && options.payload.exp && nowInSeconds > options.payload.exp + skewInSeconds) throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'exp' is in the past`);
-	if (options.expectedAudience && options.expectedAudience !== options.payload.aud) throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'aud' does not match expected value.`);
+	if (options.expectedAudience) {
+		if (Array.isArray(options.payload.aud) && !options.payload.aud.includes(options.expectedAudience) || typeof options.payload.aud === "string" && options.payload.aud !== options.expectedAudience) throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'aud' does not match expected value.`);
+	}
 	if (options.expectedIssuer && options.expectedIssuer !== options.payload.iss) throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'iss' does not match expected value.`);
 	if (options.expectedNonce && options.expectedNonce !== options.payload.nonce) throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'nonce' does not match expected value.`);
 	if (options.expectedSubject && options.expectedSubject !== options.payload.sub) throw new Oauth2JwtVerificationError(`${errorMessage} jwt 'sub' does not match expected value.`);
@@ -413,7 +415,7 @@ const zAccessTokenProfileJwtPayload = zod.default.object({
 	iss: zod.default.string(),
 	exp: __openid4vc_utils.zInteger,
 	iat: __openid4vc_utils.zInteger,
-	aud: zod.default.string(),
+	aud: zod.default.union([zod.default.string(), zod.default.array(zod.default.string())]),
 	sub: zod.default.string(),
 	client_id: zod.default.optional(zod.default.string()),
 	jti: zod.default.string(),
@@ -552,7 +554,7 @@ const zClientAttestationPopJwtPayload = zod.default.object({
 	...zJwtPayload.shape,
 	iss: zod.default.string(),
 	exp: __openid4vc_utils.zInteger,
-	aud: __openid4vc_utils.zHttpsUrl,
+	aud: zod.default.union([__openid4vc_utils.zHttpsUrl, zod.default.array(__openid4vc_utils.zHttpsUrl)]),
 	jti: zod.default.string(),
 	nonce: zod.default.optional(zod.default.string())
 }).loose();
@@ -570,7 +572,6 @@ async function verifyClientAttestationPopJwt(options) {
 		payloadSchema: zClientAttestationPopJwtPayload
 	});
 	if (payload.iss !== options.clientAttestation.payload.sub) throw new Oauth2Error(`Client Attestation Pop jwt contains 'iss' (client_id) value '${payload.iss}', but expected 'sub' value from client attestation '${options.clientAttestation.payload.sub}'`);
-	if (payload.aud !== options.authorizationServer) throw new Oauth2Error(`Client Attestation Pop jwt contains 'aud' value '${payload.aud}', but expected authorization server identifier '${options.authorizationServer}'`);
 	const { signer } = await verifyJwt({
 		signer: {
 			alg: header.alg,
@@ -581,6 +582,7 @@ async function verifyClientAttestationPopJwt(options) {
 		header,
 		expectedNonce: options.expectedNonce,
 		payload,
+		expectedAudience: options.authorizationServer,
 		compact: options.clientAttestationPopJwt,
 		verifyJwtCallback: options.callbacks.verifyJwt,
 		errorMessage: "client attestation pop jwt verification failed"
@@ -876,7 +878,7 @@ const zIdTokenJwtPayload = zod.default.object({
 	...zJwtPayload.shape,
 	iss: zod.default.string(),
 	sub: zod.default.string(),
-	aud: zod.default.string(),
+	aud: zod.default.union([zod.default.string(), zod.default.array(zod.default.string())]),
 	exp: __openid4vc_utils.zInteger,
 	iat: __openid4vc_utils.zInteger,
 	auth_time: __openid4vc_utils.zInteger.optional(),
@@ -916,7 +918,7 @@ const zIdTokenJwtPayload = zod.default.object({
 /**
 * Verify an ID Token JWT.
 */
-async function verifyJwtIdToken(options) {
+async function verifyIdTokenJwt(options) {
 	const { header, payload } = decodeJwt({
 		jwt: options.idToken,
 		headerSchema: zIdTokenJwtHeader,
@@ -2443,7 +2445,7 @@ const zTokenIntrospectionResponse = zod.default.object({
 	iat: zod.default.optional(__openid4vc_utils.zInteger),
 	nbf: zod.default.optional(__openid4vc_utils.zInteger),
 	sub: zod.default.optional(zod.default.string()),
-	aud: zod.default.optional(zod.default.string()),
+	aud: zod.default.optional(zod.default.union([zod.default.string(), zod.default.array(zod.default.string())])),
 	iss: zod.default.optional(zod.default.string()),
 	jti: zod.default.optional(zod.default.string()),
 	cnf: zod.default.optional(zJwtConfirmationPayload)
@@ -2588,12 +2590,6 @@ exports.Oauth2ServerErrorResponseError = Oauth2ServerErrorResponseError;
 exports.PkceCodeChallengeMethod = PkceCodeChallengeMethod;
 exports.SupportedAuthenticationScheme = SupportedAuthenticationScheme;
 exports.SupportedClientAuthenticationMethod = SupportedClientAuthenticationMethod;
-Object.defineProperty(exports, 'VerifiedClientAttestationJwt', {
-  enumerable: true,
-  get: function () {
-    return VerifiedClientAttestationJwt;
-  }
-});
 exports.authorizationCodeGrantIdentifier = authorizationCodeGrantIdentifier;
 exports.calculateJwkThumbprint = calculateJwkThumbprint;
 exports.clientAuthenticationAnonymous = clientAuthenticationAnonymous;
@@ -2628,8 +2624,8 @@ Object.defineProperty(exports, 'setGlobalConfig', {
   }
 });
 exports.verifyClientAttestationJwt = verifyClientAttestationJwt;
+exports.verifyIdTokenJwt = verifyIdTokenJwt;
 exports.verifyJwt = verifyJwt;
-exports.verifyJwtIdToken = verifyJwtIdToken;
 exports.verifyResourceRequest = verifyResourceRequest;
 exports.zAlgValueNotNone = zAlgValueNotNone;
 exports.zAuthorizationCodeGrantIdentifier = zAuthorizationCodeGrantIdentifier;