@openid4vc/oauth2 0.4.4-alpha-20260106125931 → 0.4.4-alpha-20260106132628

package/dist/index.d.mts

@@ -31,6 +31,7 @@ declare const zAuthorizationServerMetadata: z$1.ZodObject<{
   authorization_challenge_endpoint: z$1.ZodOptional<z$1.ZodURL>;
   'pre-authorized_grant_anonymous_access_supported': z$1.ZodOptional<z$1.ZodBoolean>;
   client_attestation_pop_nonce_required: z$1.ZodOptional<z$1.ZodBoolean>;
+  authorization_response_iss_parameter_supported: z$1.ZodOptional<z$1.ZodBoolean>;
 }, z$1.core.$loose>;
 type AuthorizationServerMetadata = z$1.infer<typeof zAuthorizationServerMetadata>;
 //#endregion
@@ -1863,16 +1864,19 @@ interface VerifyPushedAuthorizationRequestOptions extends VerifyAuthorizationReq
 declare const zAuthorizationResponse: z$1.ZodObject<{
   state: z$1.ZodOptional<z$1.ZodString>;
   code: z$1.ZodString;
+  iss: z$1.ZodOptional<z$1.ZodURL>;
   error: z$1.ZodOptional<z$1.ZodNever>;
 }, z$1.core.$loose>;
 declare const zAuthorizationResponseFromUriParams: z$1.ZodPipe<z$1.ZodPipe<z$1.ZodURL, z$1.ZodTransform<unknown, string>>, z$1.ZodObject<{
   state: z$1.ZodOptional<z$1.ZodString>;
   code: z$1.ZodString;
+  iss: z$1.ZodOptional<z$1.ZodURL>;
   error: z$1.ZodOptional<z$1.ZodNever>;
 }, z$1.core.$loose>>;
 type AuthorizationResponse = z$1.infer<typeof zAuthorizationResponse>;
 declare const zAuthorizationErrorResponse: z$1.ZodObject<{
   state: z$1.ZodOptional<z$1.ZodString>;
+  iss: z$1.ZodOptional<z$1.ZodURL>;
   code: z$1.ZodOptional<z$1.ZodNever>;
   error: z$1.ZodUnion<readonly [z$1.ZodEnum<typeof Oauth2ErrorCodes>, z$1.ZodString]>;
   error_description: z$1.ZodOptional<z$1.ZodString>;
@@ -1881,7 +1885,7 @@ declare const zAuthorizationErrorResponse: z$1.ZodObject<{
 type AuthorizationErrorResponse = z$1.infer<typeof zAuthorizationErrorResponse>;
 //#endregion
 //#region src/authorization-response/parse-authorization-response.d.ts
-interface ParseAuthorizationRequestOptions {
+interface ParseAuthorizationResponseOptions {
   url: string;
 }
 /**
@@ -1889,7 +1893,26 @@ interface ParseAuthorizationRequestOptions {
  *
  * @throws {Oauth2ServerErrorResponseError}
  */
-declare function parseAuthorizationResponseRedirectUrl(options: ParseAuthorizationRequestOptions): AuthorizationResponse | AuthorizationErrorResponse;
+declare function parseAuthorizationResponseRedirectUrl(options: ParseAuthorizationResponseOptions): AuthorizationResponse | AuthorizationErrorResponse;
+//#endregion
+//#region src/authorization-response/verify-authorization-response.d.ts
+interface VerifyAuthorizationResponseOptions {
+  authorizationServerMetadata: AuthorizationServerMetadata;
+  authorizationResponse: AuthorizationResponse | AuthorizationErrorResponse;
+}
+/**
+ * Verifies an authorization (error) response.
+ *
+ * Currently it only verifies that the 'iss' value in an authorization (error) response matches the 'issuer' value of the authorization server metadata
+ * according to RFC 9207.
+ *
+ * You can call this method after calling `parseAuthorizationResponse` and having fetched the associated session/authorization server
+ * for the authorization response, to be able to verify the issuer
+ */
+declare function verifyAuthorizationResponse({
+  authorizationResponse,
+  authorizationServerMetadata
+}: VerifyAuthorizationResponseOptions): void;
 //#endregion
 //#region src/common/algorithm/algorithm-transform.d.ts
 /**
@@ -2592,6 +2615,7 @@ declare function getAuthorizationServerMetadataFromList(authorizationServersMeta
   authorization_challenge_endpoint?: string | undefined;
   'pre-authorized_grant_anonymous_access_supported'?: boolean | undefined;
   client_attestation_pop_nonce_required?: boolean | undefined;
+  authorization_response_iss_parameter_supported?: boolean | undefined;
 };
 //#endregion
 //#region src/metadata/fetch-jwks-uri.d.ts
@@ -2797,6 +2821,7 @@ declare class Oauth2AuthorizationServer {
     authorization_challenge_endpoint?: string | undefined;
     'pre-authorized_grant_anonymous_access_supported'?: boolean | undefined;
     client_attestation_pop_nonce_required?: boolean | undefined;
+    authorization_response_iss_parameter_supported?: boolean | undefined;
   };
   /**
    * Parse access token request and extract the grant specific properties.
@@ -3320,6 +3345,7 @@ declare class Oauth2Client {
     authorization_challenge_endpoint?: string | undefined;
     'pre-authorized_grant_anonymous_access_supported'?: boolean | undefined;
     client_attestation_pop_nonce_required?: boolean | undefined;
+    authorization_response_iss_parameter_supported?: boolean | undefined;
   } | null>;
   /**
    * Initiate authorization.
@@ -3387,6 +3413,28 @@ declare class Oauth2Client {
     dpop
   }: Omit<RetrieveRefreshTokenAccessTokenOptions, 'callbacks'>): Promise<RetrieveAccessTokenReturn>;
   resourceRequest(options: ResourceRequestOptions): Promise<ResourceRequestResponseOk | ResourceRequestResponseNotOk>;
+  /**
+   * Parses an authorization response redirect URL into an authorization (error) response.
+   *
+   * Make sure to call `Oauth2Client.verifyAuthorizationResponse` after fetching the session
+   * based on the parsed response, to ensure the authorization response `iss` value is verified.
+   */
+  parseAuthorizationResponseRedirectUrl(options: ParseAuthorizationResponseOptions): {
+    [x: string]: unknown;
+    code: string;
+    state?: string | undefined;
+    iss?: string | undefined;
+    error?: undefined;
+  } | {
+    [x: string]: unknown;
+    error: string;
+    state?: string | undefined;
+    iss?: string | undefined;
+    code?: undefined;
+    error_description?: string | undefined;
+    error_uri?: string | undefined;
+  };
+  verifyAuthorizationResponse(options: VerifyAuthorizationResponseOptions): void;
 }
 //#endregion
 //#region src/Oauth2ResourceServer.d.ts
@@ -3701,5 +3749,5 @@ declare function verifyResourceRequest(options: VerifyResourceRequestOptions): P
   authorizationServer: string;
 }>;
 //#endregion
-export { type AccessTokenErrorResponse, type AccessTokenProfileJwtPayload, type AccessTokenResponse, type AuthorizationChallengeErrorResponse, type AuthorizationChallengeRequest, type AuthorizationChallengeResponse, type AuthorizationCodeGrantIdentifier, AuthorizationErrorResponse, AuthorizationResponse, type AuthorizationServerMetadata, type CalculateJwkThumbprintOptions, type CallbackContext, type ClientAttestationJwtHeader, type ClientAttestationJwtPayload, type ClientAttestationPopJwtHeader, type ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationClientAttestationJwtOptions, type ClientAuthenticationClientSecretBasicOptions, type ClientAuthenticationClientSecretPostOptions, type ClientAuthenticationDynamicOptions, type ClientAuthenticationNoneOptions, type CreateAuthorizationRequestUrlOptions, type CreateClientAttestationJwtOptions, type CreateJarAuthorizationRequestOptions, type CreatePkceReturn, type CreatePushedAuthorizationErrorResponseOptions, type CreatePushedAuthorizationResponseOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DecryptJweCallback, type DecryptJweCallbackOptions, type EncryptJweCallback, type GenerateRandomCallback, HashAlgorithm, type HashCallback, type HttpMethod, IdTokenJwtHeader, IdTokenJwtPayload, InvalidFetchResponseError, type JarAuthorizationRequest, type JarRequestObjectPayload, type JweEncryptor, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSigner, type JwtSignerCustom, type JwtSignerDid, type JwtSignerJwk, type JwtSignerWithJwk, type JwtSignerX5c, Oauth2AuthorizationServer, type Oauth2AuthorizationServerOptions, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, type Oauth2ClientOptions, Oauth2Error, Oauth2ErrorCodes, type Oauth2ErrorOptions, type Oauth2ErrorResponse, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, type Oauth2ResourceServerOptions, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, type Oid4vcTsConfig, type ParseAuthorizationChallengeRequestOptions, type ParseAuthorizationChallengeRequestResult, ParseAuthorizationRequestOptions, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, PkceCodeChallengeMethod, type PreAuthorizedCodeGrantIdentifier, type PushedAuthorizationRequestUriPrefix, type RefreshTokenGrantIdentifier, type RequestClientAttestationOptions, type RequestDpopOptions, type RequestLike, type ResourceRequestOptions, type ResourceRequestResponseNotOk, type ResourceRequestResponseOk, type RetrieveAuthorizationCodeAccessTokenOptions, type RetrievePreAuthorizedCodeAccessTokenOptions, type SignJwtCallback, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, type TokenIntrospectionResponse, type VerifiedClientAttestationJwt, type VerifyAccessTokenRequestReturn, type VerifyAuthorizationChallengeRequestOptions, type VerifyAuthorizationChallengeRequestReturn, VerifyIdTokenJwtOptions, type VerifyJwtCallback, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyResourceRequestOptions, type WwwAuthenticateHeaderChallenge, authorizationCodeGrantIdentifier, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, createClientAttestationJwt, createJarAuthorizationRequest, decodeJwt, decodeJwtHeader, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, fullySpecifiedCoseAlgorithmArrayToJwaSignatureAlgorithmArray, fullySpecifiedCoseAlgorithmToJwaSignatureAlgorithm, getAuthorizationServerMetadataFromList, getGlobalConfig, isJwkInSet, jwaSignatureAlgorithmArrayToFullySpecifiedCoseAlgorithmArray, jwaSignatureAlgorithmToFullySpecifiedCoseAlgorithm, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, jwtSignerFromJwt, parseAuthorizationResponseRedirectUrl, parsePushedAuthorizationRequestUriReferenceValue, preAuthorizedCodeGrantIdentifier, pushedAuthorizationRequestUriPrefix, refreshTokenGrantIdentifier, resourceRequest, setGlobalConfig, signedAuthorizationRequestJwtHeaderTyp, validateJarRequestParams, verifyClientAttestationJwt, verifyIdTokenJwt, verifyJwt, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationErrorResponse, zAuthorizationResponse, zAuthorizationResponseFromUriParams, zAuthorizationServerMetadata, zCompactJwe, zCompactJwt, zIdTokenJwtHeader, zIdTokenJwtPayload, zJarAuthorizationRequest, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zPushedAuthorizationRequestUriPrefix, zRefreshTokenGrantIdentifier };
+export { type AccessTokenErrorResponse, type AccessTokenProfileJwtPayload, type AccessTokenResponse, type AuthorizationChallengeErrorResponse, type AuthorizationChallengeRequest, type AuthorizationChallengeResponse, type AuthorizationCodeGrantIdentifier, AuthorizationErrorResponse, AuthorizationResponse, type AuthorizationServerMetadata, type CalculateJwkThumbprintOptions, type CallbackContext, type ClientAttestationJwtHeader, type ClientAttestationJwtPayload, type ClientAttestationPopJwtHeader, type ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationClientAttestationJwtOptions, type ClientAuthenticationClientSecretBasicOptions, type ClientAuthenticationClientSecretPostOptions, type ClientAuthenticationDynamicOptions, type ClientAuthenticationNoneOptions, type CreateAuthorizationRequestUrlOptions, type CreateClientAttestationJwtOptions, type CreateJarAuthorizationRequestOptions, type CreatePkceReturn, type CreatePushedAuthorizationErrorResponseOptions, type CreatePushedAuthorizationResponseOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DecryptJweCallback, type DecryptJweCallbackOptions, type EncryptJweCallback, type GenerateRandomCallback, HashAlgorithm, type HashCallback, type HttpMethod, IdTokenJwtHeader, IdTokenJwtPayload, InvalidFetchResponseError, type JarAuthorizationRequest, type JarRequestObjectPayload, type JweEncryptor, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSigner, type JwtSignerCustom, type JwtSignerDid, type JwtSignerJwk, type JwtSignerWithJwk, type JwtSignerX5c, Oauth2AuthorizationServer, type Oauth2AuthorizationServerOptions, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, type Oauth2ClientOptions, Oauth2Error, Oauth2ErrorCodes, type Oauth2ErrorOptions, type Oauth2ErrorResponse, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, type Oauth2ResourceServerOptions, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, type Oid4vcTsConfig, type ParseAuthorizationChallengeRequestOptions, type ParseAuthorizationChallengeRequestResult, ParseAuthorizationResponseOptions, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, PkceCodeChallengeMethod, type PreAuthorizedCodeGrantIdentifier, type PushedAuthorizationRequestUriPrefix, type RefreshTokenGrantIdentifier, type RequestClientAttestationOptions, type RequestDpopOptions, type RequestLike, type ResourceRequestOptions, type ResourceRequestResponseNotOk, type ResourceRequestResponseOk, type RetrieveAuthorizationCodeAccessTokenOptions, type RetrievePreAuthorizedCodeAccessTokenOptions, type SignJwtCallback, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, type TokenIntrospectionResponse, type VerifiedClientAttestationJwt, type VerifyAccessTokenRequestReturn, type VerifyAuthorizationChallengeRequestOptions, type VerifyAuthorizationChallengeRequestReturn, VerifyAuthorizationResponseOptions, VerifyIdTokenJwtOptions, type VerifyJwtCallback, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyResourceRequestOptions, type WwwAuthenticateHeaderChallenge, authorizationCodeGrantIdentifier, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, createClientAttestationJwt, createJarAuthorizationRequest, decodeJwt, decodeJwtHeader, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, fullySpecifiedCoseAlgorithmArrayToJwaSignatureAlgorithmArray, fullySpecifiedCoseAlgorithmToJwaSignatureAlgorithm, getAuthorizationServerMetadataFromList, getGlobalConfig, isJwkInSet, jwaSignatureAlgorithmArrayToFullySpecifiedCoseAlgorithmArray, jwaSignatureAlgorithmToFullySpecifiedCoseAlgorithm, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, jwtSignerFromJwt, parseAuthorizationResponseRedirectUrl, parsePushedAuthorizationRequestUriReferenceValue, preAuthorizedCodeGrantIdentifier, pushedAuthorizationRequestUriPrefix, refreshTokenGrantIdentifier, resourceRequest, setGlobalConfig, signedAuthorizationRequestJwtHeaderTyp, validateJarRequestParams, verifyAuthorizationResponse, verifyClientAttestationJwt, verifyIdTokenJwt, verifyJwt, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationErrorResponse, zAuthorizationResponse, zAuthorizationResponseFromUriParams, zAuthorizationServerMetadata, zCompactJwe, zCompactJwt, zIdTokenJwtHeader, zIdTokenJwtPayload, zJarAuthorizationRequest, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zPushedAuthorizationRequestUriPrefix, zRefreshTokenGrantIdentifier };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -1602,12 +1602,14 @@ function parsePushedAuthorizationRequestUriReferenceValue(options) {
 const zAuthorizationResponse = z$1.object({
 	state: z$1.string().optional(),
 	code: z$1.string().nonempty(),
+	iss: zHttpsUrl.optional(),
 	error: z$1.optional(z$1.never())
 }).loose();
 const zAuthorizationResponseFromUriParams = z$1.url().transform((url) => Object.fromEntries(new URL(url).searchParams)).pipe(zAuthorizationResponse);
 const zAuthorizationErrorResponse = z$1.object({
 	...zOauth2ErrorResponse.shape,
 	state: z$1.string().optional(),
+	iss: zHttpsUrl.optional(),
 	code: z$1.optional(z$1.never())
 }).loose();
 
@@ -1628,6 +1630,30 @@ function parseAuthorizationResponseRedirectUrl(options) {
 	return parsedAuthorizationResponse.data;
 }
 
+//#endregion
+//#region src/authorization-response/verify-authorization-response.ts
+/**
+* Verifies an authorization (error) response.
+*
+* Currently it only verifies that the 'iss' value in an authorization (error) response matches the 'issuer' value of the authorization server metadata
+* according to RFC 9207.
+*
+* You can call this method after calling `parseAuthorizationResponse` and having fetched the associated session/authorization server
+* for the authorization response, to be able to verify the issuer
+*/
+function verifyAuthorizationResponse({ authorizationResponse, authorizationServerMetadata }) {
+	const expectedIssuer = authorizationServerMetadata.issuer;
+	const responseIssuer = authorizationResponse.iss;
+	if (authorizationServerMetadata.authorization_response_iss_parameter_supported && !responseIssuer) throw new Oauth2ServerErrorResponseError({
+		error: Oauth2ErrorCodes.InvalidRequest,
+		error_description: "Authorization server requires 'iss' parameter in authorization response (authorization_response_iss_parameter_supported), but no 'iss' parameter is present in the authorization response."
+	});
+	if (responseIssuer && responseIssuer !== expectedIssuer) throw new Oauth2ServerErrorResponseError({
+		error: Oauth2ErrorCodes.InvalidRequest,
+		error_description: "The 'iss' value in the authorization response does not match the expected 'issuer' value from the authorization server metadata."
+	});
+}
+
 //#endregion
 //#region src/z-grant-type.ts
 const zPreAuthorizedCodeGrantIdentifier = z$1.literal("urn:ietf:params:oauth:grant-type:pre-authorized_code");
@@ -2118,7 +2144,8 @@ const zAuthorizationServerMetadata = z$1.object({
 	introspection_endpoint_auth_signing_alg_values_supported: z$1.optional(z$1.array(zAlgValueNotNone)),
 	authorization_challenge_endpoint: z$1.optional(zHttpsUrl),
 	"pre-authorized_grant_anonymous_access_supported": z$1.optional(z$1.boolean()),
-	client_attestation_pop_nonce_required: z$1.boolean().optional()
+	client_attestation_pop_nonce_required: z$1.boolean().optional(),
+	authorization_response_iss_parameter_supported: z$1.boolean().optional()
 }).loose().refine(({ introspection_endpoint_auth_methods_supported: methodsSupported, introspection_endpoint_auth_signing_alg_values_supported: algValuesSupported }) => {
 	if (!methodsSupported) return true;
 	if (!methodsSupported.includes("private_key_jwt") && !methodsSupported.includes("client_secret_jwt")) return true;
@@ -3358,6 +3385,18 @@ var Oauth2Client = class {
 	async resourceRequest(options) {
 		return resourceRequest(options);
 	}
+	/**
+	* Parses an authorization response redirect URL into an authorization (error) response.
+	*
+	* Make sure to call `Oauth2Client.verifyAuthorizationResponse` after fetching the session
+	* based on the parsed response, to ensure the authorization response `iss` value is verified.
+	*/
+	parseAuthorizationResponseRedirectUrl(options) {
+		return parseAuthorizationResponseRedirectUrl(options);
+	}
+	verifyAuthorizationResponse(options) {
+		return verifyAuthorizationResponse(options);
+	}
 };
 
 //#endregion
@@ -3514,5 +3553,5 @@ async function verifyResourceRequest(options) {
 }
 
 //#endregion
-export { HashAlgorithm, InvalidFetchResponseError, Oauth2AuthorizationServer, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, Oauth2Error, Oauth2ErrorCodes, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, PkceCodeChallengeMethod, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, authorizationCodeGrantIdentifier, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, createClientAttestationJwt, createJarAuthorizationRequest, decodeJwt, decodeJwtHeader, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, fullySpecifiedCoseAlgorithmArrayToJwaSignatureAlgorithmArray, fullySpecifiedCoseAlgorithmToJwaSignatureAlgorithm, getAuthorizationServerMetadataFromList, getGlobalConfig, isJwkInSet, jwaSignatureAlgorithmArrayToFullySpecifiedCoseAlgorithmArray, jwaSignatureAlgorithmToFullySpecifiedCoseAlgorithm, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, jwtSignerFromJwt, parseAuthorizationResponseRedirectUrl, parsePushedAuthorizationRequestUriReferenceValue, preAuthorizedCodeGrantIdentifier, pushedAuthorizationRequestUriPrefix, refreshTokenGrantIdentifier, resourceRequest, setGlobalConfig, signedAuthorizationRequestJwtHeaderTyp, validateJarRequestParams, verifyClientAttestationJwt, verifyIdTokenJwt, verifyJwt, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationErrorResponse, zAuthorizationResponse, zAuthorizationResponseFromUriParams, zAuthorizationServerMetadata, zCompactJwe, zCompactJwt, zIdTokenJwtHeader, zIdTokenJwtPayload, zJarAuthorizationRequest, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zPushedAuthorizationRequestUriPrefix, zRefreshTokenGrantIdentifier };
+export { HashAlgorithm, InvalidFetchResponseError, Oauth2AuthorizationServer, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, Oauth2Error, Oauth2ErrorCodes, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, PkceCodeChallengeMethod, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, authorizationCodeGrantIdentifier, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, createClientAttestationJwt, createJarAuthorizationRequest, decodeJwt, decodeJwtHeader, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, fullySpecifiedCoseAlgorithmArrayToJwaSignatureAlgorithmArray, fullySpecifiedCoseAlgorithmToJwaSignatureAlgorithm, getAuthorizationServerMetadataFromList, getGlobalConfig, isJwkInSet, jwaSignatureAlgorithmArrayToFullySpecifiedCoseAlgorithmArray, jwaSignatureAlgorithmToFullySpecifiedCoseAlgorithm, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, jwtSignerFromJwt, parseAuthorizationResponseRedirectUrl, parsePushedAuthorizationRequestUriReferenceValue, preAuthorizedCodeGrantIdentifier, pushedAuthorizationRequestUriPrefix, refreshTokenGrantIdentifier, resourceRequest, setGlobalConfig, signedAuthorizationRequestJwtHeaderTyp, validateJarRequestParams, verifyAuthorizationResponse, verifyClientAttestationJwt, verifyIdTokenJwt, verifyJwt, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationErrorResponse, zAuthorizationResponse, zAuthorizationResponseFromUriParams, zAuthorizationServerMetadata, zCompactJwe, zCompactJwt, zIdTokenJwtHeader, zIdTokenJwtPayload, zJarAuthorizationRequest, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zPushedAuthorizationRequestUriPrefix, zRefreshTokenGrantIdentifier };
 //# sourceMappingURL=index.mjs.map