@openid4vc/oauth2 0.5.4-alpha-20260703092624 → 0.5.4

package/dist/index.d.mts

@@ -1,148 +1,6 @@
 import { BaseSchema, ContentType, Fetch, FetchHeaders, FetchRequestInit, FetchResponse, HttpMethod, HttpMethod as HttpMethod$1, InvalidFetchResponseError, Oid4vcTsConfig, OrPromise, StringWithAutoCompletion, getGlobalConfig, setGlobalConfig } from "@openid4vc/utils";
 import z, { z as z$1 } from "zod";
 
-//#region src/metadata/authorization-server/z-authorization-server-metadata.d.ts
-declare const zAuthorizationServerMetadata: z.ZodObject<{
-  issuer: z.ZodURL;
-  token_endpoint: z.ZodURL;
-  token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<{
-    client_secret_basic: "client_secret_basic";
-    client_secret_post: "client_secret_post";
-    attest_jwt_client_auth: "attest_jwt_client_auth";
-    attest_jwt_client_auth_dpop: "attest_jwt_client_auth_dpop";
-    client_secret_jwt: "client_secret_jwt";
-    private_key_jwt: "private_key_jwt";
-  }>, z.ZodString]>>>;
-  authorization_endpoint: z.ZodOptional<z.ZodURL>;
-  jwks_uri: z.ZodOptional<z.ZodURL>;
-  grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
-  code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
-  dpop_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
-  require_pushed_authorization_requests: z.ZodOptional<z.ZodBoolean>;
-  pushed_authorization_request_endpoint: z.ZodOptional<z.ZodURL>;
-  introspection_endpoint: z.ZodOptional<z.ZodURL>;
-  introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<{
-    client_secret_basic: "client_secret_basic";
-    client_secret_post: "client_secret_post";
-    attest_jwt_client_auth: "attest_jwt_client_auth";
-    attest_jwt_client_auth_dpop: "attest_jwt_client_auth_dpop";
-    client_secret_jwt: "client_secret_jwt";
-    private_key_jwt: "private_key_jwt";
-  }>, z.ZodString]>>>;
-  introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
-  authorization_challenge_endpoint: z.ZodOptional<z.ZodURL>;
-  interactive_authorization_endpoint: z.ZodOptional<z.ZodURL>;
-  require_interactive_authorization_request: z.ZodOptional<z.ZodBoolean>;
-  'pre-authorized_grant_anonymous_access_supported': z.ZodOptional<z.ZodBoolean>;
-  client_attestation_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
-  client_attestation_pop_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
-  challenge_endpoint: z.ZodOptional<z.ZodURL>;
-  client_attestation_pop_nonce_required: z.ZodOptional<z.ZodBoolean>;
-  authorization_response_iss_parameter_supported: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$loose>;
-type AuthorizationServerMetadata = z.infer<typeof zAuthorizationServerMetadata>;
-//#endregion
-//#region src/client-authentication.d.ts
-declare enum SupportedClientAuthenticationMethod {
-  ClientSecretBasic = "client_secret_basic",
-  ClientSecretPost = "client_secret_post",
-  ClientAttestationJwt = "attest_jwt_client_auth",
-  ClientAttestationJwtDpop = "attest_jwt_client_auth_dpop",
-  None = "none"
-}
-interface ClientAuthenticationDynamicOptions {
-  clientId: string;
-  clientSecret: string;
-}
-/**
- * Dynamicaly get the client authentication method based on endpoint type and authorization server.
- * Only `client_secret_post`, `client_secret_basic`, and `none` supported.
- *
- * It also supports anonymous access to the token endpoint for pre-authorized code flow
- * if the authorization server has enabled `pre-authorized_grant_anonymous_access_supported`
- */
-declare function clientAuthenticationDynamic(options: ClientAuthenticationDynamicOptions): ClientAuthenticationCallback;
-/**
- * Options for client authentication
- */
-interface ClientAuthenticationCallbackOptions {
-  /**
-   * Metadata of the authorization server
-   */
-  authorizationServerMetadata: AuthorizationServerMetadata;
-  /**
-   * URL to which the request will be made
-   */
-  url: string;
-  /**
-   * http method that will be used
-   */
-  method: HttpMethod$1;
-  /**
-   * Headers for the request. You can modify this object
-   */
-  headers: FetchHeaders;
-  contentType: ContentType;
-  /**
-   * The body as a JSON object. If content type `x-www-form-urlencoded`
-   * is used, it will be encoded after this call.
-   *
-   * You can modify this object
-   */
-  body: Record<string, unknown>;
-  /**
-   * A fresh Client Attestation challenge provided by the authorization server (draft 09), e.g.
-   * obtained from the `OAuth-Client-Attestation-Challenge` response header when retrying after a
-   * `use_attestation_challenge` error. When set it takes precedence over any statically configured
-   * challenge for methods that include a Client Attestation PoP.
-   */
-  attestationChallenge?: string;
-}
-/**
- * Callback method to determine the client authentication for a request.
- */
-type ClientAuthenticationCallback = (options: ClientAuthenticationCallbackOptions) => Promise<void> | void;
-interface ClientAuthenticationClientSecretPostOptions {
-  clientId: string;
-  clientSecret: string;
-}
-/**
- * Client authentication using `client_secret_post` option
- */
-declare function clientAuthenticationClientSecretPost(options: ClientAuthenticationClientSecretPostOptions): ClientAuthenticationCallback;
-interface ClientAuthenticationClientSecretBasicOptions {
-  clientId: string;
-  clientSecret: string;
-}
-/**
- * Client authentication using `client_secret_basic` option
- */
-declare function clientAuthenticationClientSecretBasic(options: ClientAuthenticationClientSecretBasicOptions): ClientAuthenticationCallback;
-interface ClientAuthenticationNoneOptions {
-  clientId: string;
-}
-/**
- * Client authentication using `none` option
- */
-declare function clientAuthenticationNone(options: ClientAuthenticationNoneOptions): ClientAuthenticationCallback;
-/**
- * Anonymous client authentication
- */
-declare function clientAuthenticationAnonymous(): ClientAuthenticationCallback;
-interface ClientAuthenticationClientAttestationJwtOptions {
-  clientAttestationJwt: string;
-  callbacks: Pick<CallbackContext, 'signJwt' | 'generateRandom'>;
-  /**
-   * Challenge provided by the authorization server (e.g. obtained from its `challenge_endpoint`)
-   * to include in the Client Attestation PoP JWT.
-   */
-  challenge?: string;
-}
-/**
- * Client authentication using `attest_jwt_client_auth` option.
- */
-declare function clientAuthenticationClientAttestationJwt(options: ClientAuthenticationClientAttestationJwtOptions): ClientAuthenticationCallback;
-//#endregion
 //#region src/common/jwk/z-jwk.d.ts
 declare const zJwk: z.ZodObject<{
   kty: z.ZodString;
@@ -358,6 +216,172 @@ declare const zJwtHeader: z.ZodObject<{
 }, z.core.$loose>;
 type JwtHeader = z.infer<typeof zJwtHeader>;
 //#endregion
+//#region src/metadata/authorization-server/z-authorization-server-metadata.d.ts
+declare const zAuthorizationServerMetadata: z.ZodObject<{
+  issuer: z.ZodURL;
+  token_endpoint: z.ZodURL;
+  token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<{
+    client_secret_basic: "client_secret_basic";
+    client_secret_post: "client_secret_post";
+    attest_jwt_client_auth: "attest_jwt_client_auth";
+    attest_jwt_client_auth_dpop: "attest_jwt_client_auth_dpop";
+    client_secret_jwt: "client_secret_jwt";
+    private_key_jwt: "private_key_jwt";
+  }>, z.ZodString]>>>;
+  authorization_endpoint: z.ZodOptional<z.ZodURL>;
+  jwks_uri: z.ZodOptional<z.ZodURL>;
+  grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  dpop_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  require_pushed_authorization_requests: z.ZodOptional<z.ZodBoolean>;
+  pushed_authorization_request_endpoint: z.ZodOptional<z.ZodURL>;
+  introspection_endpoint: z.ZodOptional<z.ZodURL>;
+  introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<{
+    client_secret_basic: "client_secret_basic";
+    client_secret_post: "client_secret_post";
+    attest_jwt_client_auth: "attest_jwt_client_auth";
+    attest_jwt_client_auth_dpop: "attest_jwt_client_auth_dpop";
+    client_secret_jwt: "client_secret_jwt";
+    private_key_jwt: "private_key_jwt";
+  }>, z.ZodString]>>>;
+  introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  authorization_challenge_endpoint: z.ZodOptional<z.ZodURL>;
+  interactive_authorization_endpoint: z.ZodOptional<z.ZodURL>;
+  require_interactive_authorization_request: z.ZodOptional<z.ZodBoolean>;
+  'pre-authorized_grant_anonymous_access_supported': z.ZodOptional<z.ZodBoolean>;
+  client_attestation_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  client_attestation_pop_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  challenge_endpoint: z.ZodOptional<z.ZodURL>;
+  client_attestation_pop_nonce_required: z.ZodOptional<z.ZodBoolean>;
+  authorization_response_iss_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>;
+type AuthorizationServerMetadata = z.infer<typeof zAuthorizationServerMetadata>;
+//#endregion
+//#region src/client-authentication.d.ts
+declare enum SupportedClientAuthenticationMethod {
+  ClientSecretBasic = "client_secret_basic",
+  ClientSecretPost = "client_secret_post",
+  ClientAttestationJwt = "attest_jwt_client_auth",
+  ClientAttestationJwtDpop = "attest_jwt_client_auth_dpop",
+  None = "none"
+}
+interface ClientAuthenticationDynamicOptions {
+  clientId: string;
+  clientSecret: string;
+}
+/**
+ * Dynamicaly get the client authentication method based on endpoint type and authorization server.
+ * Only `client_secret_post`, `client_secret_basic`, and `none` supported.
+ *
+ * It also supports anonymous access to the token endpoint for pre-authorized code flow
+ * if the authorization server has enabled `pre-authorized_grant_anonymous_access_supported`
+ */
+declare function clientAuthenticationDynamic(options: ClientAuthenticationDynamicOptions): ClientAuthenticationCallback;
+/**
+ * Options for client authentication
+ */
+interface ClientAuthenticationCallbackOptions {
+  /**
+   * Metadata of the authorization server
+   */
+  authorizationServerMetadata: AuthorizationServerMetadata;
+  /**
+   * URL to which the request will be made
+   */
+  url: string;
+  /**
+   * http method that will be used
+   */
+  method: HttpMethod$1;
+  /**
+   * Headers for the request. You can modify this object
+   */
+  headers: FetchHeaders;
+  contentType: ContentType;
+  /**
+   * The body as a JSON object. If content type `x-www-form-urlencoded`
+   * is used, it will be encoded after this call.
+   *
+   * You can modify this object
+   */
+  body: Record<string, unknown>;
+  /**
+   * A fresh Client Attestation challenge provided by the authorization server (draft 09), e.g.
+   * obtained from the `OAuth-Client-Attestation-Challenge` response header when retrying after a
+   * `use_attestation_challenge` error. When set it takes precedence over any statically configured
+   * challenge for methods that include a Client Attestation PoP.
+   */
+  attestationChallenge?: string;
+}
+/**
+ * Callback method to determine the client authentication for a request.
+ */
+type ClientAuthenticationCallback = (options: ClientAuthenticationCallbackOptions) => Promise<void> | void;
+interface ClientAuthenticationClientSecretPostOptions {
+  clientId: string;
+  clientSecret: string;
+}
+/**
+ * Client authentication using `client_secret_post` option
+ */
+declare function clientAuthenticationClientSecretPost(options: ClientAuthenticationClientSecretPostOptions): ClientAuthenticationCallback;
+interface ClientAuthenticationClientSecretBasicOptions {
+  clientId: string;
+  clientSecret: string;
+}
+/**
+ * Client authentication using `client_secret_basic` option
+ */
+declare function clientAuthenticationClientSecretBasic(options: ClientAuthenticationClientSecretBasicOptions): ClientAuthenticationCallback;
+interface ClientAuthenticationNoneOptions {
+  clientId: string;
+}
+/**
+ * Client authentication using `none` option
+ */
+declare function clientAuthenticationNone(options: ClientAuthenticationNoneOptions): ClientAuthenticationCallback;
+/**
+ * Anonymous client authentication
+ */
+declare function clientAuthenticationAnonymous(): ClientAuthenticationCallback;
+interface ClientAuthenticationClientAttestationJwtOptions {
+  clientAttestationJwt: string;
+  callbacks: Pick<CallbackContext, 'signJwt' | 'generateRandom'>;
+  /**
+   * Challenge provided by the authorization server (e.g. obtained from its `challenge_endpoint`)
+   * to include in the Client Attestation PoP JWT.
+   */
+  challenge?: string;
+}
+/**
+ * Client authentication using `attest_jwt_client_auth` option.
+ */
+declare function clientAuthenticationClientAttestationJwt(options: ClientAuthenticationClientAttestationJwtOptions): ClientAuthenticationCallback;
+interface ClientAuthenticationClientAttestationJwtDpopOptions {
+  clientAttestationJwt: string;
+  callbacks: Pick<CallbackContext, 'signJwt' | 'generateRandom' | 'hash'>;
+  /**
+   * The DPoP (client instance) key signer. In the DPoP-bound method the client instance key and the
+   * DPoP key are the same key. If not provided, the signer is derived from the `cnf.jwk` of the client
+   * attestation.
+   */
+  signer?: JwtSignerJwk;
+  /**
+   * Challenge provided by the authorization server (e.g. obtained from its `challenge_endpoint`) to
+   * include in the DPoP proof. A server-provided challenge threaded through the client authentication
+   * callback takes precedence. The challenge is placed in the DPoP `nonce` claim.
+   */
+  challenge?: string;
+}
+/**
+ * Client authentication using the `attest_jwt_client_auth_dpop` option (draft 09 §5.2).
+ *
+ * In this DPoP-bound variant the client instance key and the DPoP key are the same key, and a single
+ * DPoP proof serves as both the DPoP proof and the Client Attestation PoP. The request carries the
+ * `OAuth-Client-Attestation` and `DPoP` headers, but no separate `OAuth-Client-Attestation-PoP` header.
+ */
+declare function clientAuthenticationClientAttestationJwtDpop(options: ClientAuthenticationClientAttestationJwtDpopOptions): ClientAuthenticationCallback;
+//#endregion
 //#region src/callbacks.d.ts
 /**
  * Supported hashing algorithms
@@ -1287,7 +1311,11 @@ interface ParseAccessTokenRequestResult {
    */
   clientAttestation?: {
     clientAttestationJwt: string;
-    clientAttestationPopJwt: string;
+    /**
+     * Absent for the DPoP-bound `attest_jwt_client_auth_dpop` method (draft 09), where the DPoP proof
+     * serves as the Client Attestation PoP.
+     */
+    clientAttestationPopJwt?: string;
   };
   /**
    * The pkce code verifier from the access token request
@@ -1330,6 +1358,14 @@ interface VerifyAccessTokenRequestDpop {
    * to handle the alg.
    */
   allowedSigningAlgs?: string[];
+  /**
+   * Expected nonce in the dpop proof. If not provided the nonce won't be validated.
+   *
+   * For the DPoP-bound `attest_jwt_client_auth_dpop` method (draft 09) the server-provided client
+   * attestation challenge is carried in the dpop `nonce` claim, so this can be set to the issued
+   * challenge to enforce it.
+   */
+  expectedNonce?: string;
 }
 interface VerifyAccessTokenRequestClientAttestation {
   /**
@@ -1368,7 +1404,11 @@ interface VerifyAccessTokenRequestReturn {
   };
   clientAttestation?: {
     clientAttestation: VerifiedClientAttestationJwt;
-    clientAttestationPop: VerifiedClientAttestationPopJwt;
+    /**
+     * Absent for the DPoP-bound `attest_jwt_client_auth_dpop` method (draft 09), where the verified
+     * DPoP proof serves as the Client Attestation PoP.
+     */
+    clientAttestationPop?: VerifiedClientAttestationPopJwt;
   };
 }
 interface VerifyPreAuthorizedCodeAccessTokenRequestOptions {
@@ -1539,7 +1579,11 @@ interface ParseAuthorizationRequestResult {
    */
   clientAttestation?: {
     clientAttestationJwt: string;
-    clientAttestationPopJwt: string;
+    /**
+     * Absent for the DPoP-bound `attest_jwt_client_auth_dpop` method (draft 09), where the DPoP proof
+     * serves as the Client Attestation PoP.
+     */
+    clientAttestationPopJwt?: string;
   };
 }
 /**
@@ -4049,5 +4093,5 @@ declare function verifyResourceRequest(options: VerifyResourceRequestOptions): P
   authorizationServer: string;
 }>;
 //#endregion
-export { type AccessTokenErrorResponse, type AccessTokenProfileJwtPayload, type AccessTokenResponse, type AuthorizationChallengeErrorResponse, type AuthorizationChallengeRequest, type AuthorizationChallengeResponse, type AuthorizationCodeGrantIdentifier, AuthorizationErrorResponse, type AuthorizationRequest, AuthorizationResponse, type AuthorizationServerMetadata, type CalculateJwkThumbprintOptions, type CallbackContext, type ClientAttestationChallengeResponse, type ClientAttestationJwtHeader, type ClientAttestationJwtPayload, type ClientAttestationPopJwtHeader, type ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationClientAttestationJwtOptions, type ClientAuthenticationClientSecretBasicOptions, type ClientAuthenticationClientSecretPostOptions, type ClientAuthenticationDynamicOptions, type ClientAuthenticationNoneOptions, type ClientCredentialsGrantIdentifier, type CreateAuthorizationRequestUrlOptions, type CreateClientAttestationJwtOptions, type CreateJarAuthorizationRequestOptions, type CreatePkceReturn, type CreatePushedAuthorizationErrorResponseOptions, type CreatePushedAuthorizationResponseOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DecryptJweCallback, type DecryptJweCallbackOptions, type EncryptJweCallback, type GenerateRandomCallback, HashAlgorithm, type HashCallback, type HttpMethod, IdTokenJwtHeader, IdTokenJwtPayload, InvalidFetchResponseError, type JarAuthorizationRequest, type JarRequestObjectPayload, type JweEncryptor, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSigner, type JwtSignerCustom, type JwtSignerDid, type JwtSignerJwk, type JwtSignerWithJwk, type JwtSignerX5c, Oauth2AuthorizationServer, type Oauth2AuthorizationServerOptions, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, type Oauth2ClientOptions, Oauth2Error, Oauth2ErrorCodes, type Oauth2ErrorOptions, type Oauth2ErrorResponse, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, type Oauth2ResourceServerOptions, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, type Oid4vcTsConfig, type ParseAuthorizationChallengeRequestOptions, type ParseAuthorizationChallengeRequestResult, type ParseAuthorizationRequestOptions, type ParseAuthorizationRequestResult, ParseAuthorizationResponseOptions, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, type ParsedJarRequest, type ParsedJarRequestOptions, PkceCodeChallengeMethod, type PreAuthorizedCodeGrantIdentifier, type PushedAuthorizationRequestUriPrefix, type RefreshTokenGrantIdentifier, type RequestClientAttestationChallengeOptions, type RequestClientAttestationOptions, type RequestDpopOptions, type RequestLike, type ResourceRequestOptions, type ResourceRequestResponseNotOk, type ResourceRequestResponseOk, type RetrieveAuthorizationCodeAccessTokenOptions, type RetrieveClientCredentialsAccessTokenOptions, type RetrievePreAuthorizedCodeAccessTokenOptions, type ShouldRetryAuthorizationServerRequestWithClientAttestationChallengeOptions, type SignJwtCallback, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, type TokenIntrospectionResponse, type VerifiedClientAttestationJwt, type VerifiedJarRequest, type VerifyAccessTokenRequestReturn, type VerifyAuthorizationChallengeRequestOptions, type VerifyAuthorizationChallengeRequestReturn, type VerifyAuthorizationRequestOptions, type VerifyAuthorizationRequestReturn, VerifyAuthorizationResponseOptions, type VerifyDataIntegrityProofCallback, VerifyIdTokenJwtOptions, type VerifyJarRequestOptions, type VerifyJwtCallback, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyResourceRequestOptions, type WwwAuthenticateHeaderChallenge, authorizationCodeGrantIdentifier, authorizationServerRequestWithClientAttestationChallengeRetry, authorizationServerRequestWithDpopRetry, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, clientCredentialsGrantIdentifier, createClientAttestationJwt, createDpopHeadersForRequest, createJarAuthorizationRequest, createPkce, decodeJwt, decodeJwtHeader, defaultGrantTypesSupported, extractClientAttestationChallengeFromHeaders, extractDpopNonceFromHeaders, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, fullySpecifiedCoseAlgorithmArrayToJwaSignatureAlgorithmArray, fullySpecifiedCoseAlgorithmToJwaSignatureAlgorithm, getAuthorizationServerMetadataFromList, getGlobalConfig, getGrantTypesSupported, isJarAuthorizationRequest, isJwkInSet, jwaSignatureAlgorithmArrayToFullySpecifiedCoseAlgorithmArray, jwaSignatureAlgorithmToFullySpecifiedCoseAlgorithm, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, jwtSignerFromJwt, parseAuthorizationRequest, parseAuthorizationResponseRedirectUrl, parseJarRequest, parsePushedAuthorizationRequestUriReferenceValue, preAuthorizedCodeGrantIdentifier, pushedAuthorizationRequestUriPrefix, refreshTokenGrantIdentifier, requestClientAttestationChallenge, resourceRequest, setGlobalConfig, shouldRetryAuthorizationServerRequestWithClientAttestationChallenge, signedAuthorizationRequestJwtHeaderTyp, validateJarRequestParams, verifyAuthorizationRequest, verifyAuthorizationResponse, verifyClientAttestationJwt, verifyIdTokenJwt, verifyJarRequest, verifyJwt, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationErrorResponse, zAuthorizationRequest, zAuthorizationResponse, zAuthorizationResponseFromUriParams, zAuthorizationServerMetadata, zClientAttestationChallengeResponse, zClientCredentialsGrantIdentifier, zCompactJwe, zCompactJwt, zIdTokenJwtHeader, zIdTokenJwtPayload, zJarAuthorizationRequest, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zPushedAuthorizationRequestUriPrefix, zRefreshTokenGrantIdentifier };
+export { type AccessTokenErrorResponse, type AccessTokenProfileJwtPayload, type AccessTokenResponse, type AuthorizationChallengeErrorResponse, type AuthorizationChallengeRequest, type AuthorizationChallengeResponse, type AuthorizationCodeGrantIdentifier, AuthorizationErrorResponse, type AuthorizationRequest, AuthorizationResponse, type AuthorizationServerMetadata, type CalculateJwkThumbprintOptions, type CallbackContext, type ClientAttestationChallengeResponse, type ClientAttestationJwtHeader, type ClientAttestationJwtPayload, type ClientAttestationPopJwtHeader, type ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationClientAttestationJwtDpopOptions, type ClientAuthenticationClientAttestationJwtOptions, type ClientAuthenticationClientSecretBasicOptions, type ClientAuthenticationClientSecretPostOptions, type ClientAuthenticationDynamicOptions, type ClientAuthenticationNoneOptions, type ClientCredentialsGrantIdentifier, type CreateAuthorizationRequestUrlOptions, type CreateClientAttestationJwtOptions, type CreateJarAuthorizationRequestOptions, type CreatePkceReturn, type CreatePushedAuthorizationErrorResponseOptions, type CreatePushedAuthorizationResponseOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DecryptJweCallback, type DecryptJweCallbackOptions, type EncryptJweCallback, type GenerateRandomCallback, HashAlgorithm, type HashCallback, type HttpMethod, IdTokenJwtHeader, IdTokenJwtPayload, InvalidFetchResponseError, type JarAuthorizationRequest, type JarRequestObjectPayload, type JweEncryptor, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSigner, type JwtSignerCustom, type JwtSignerDid, type JwtSignerJwk, type JwtSignerWithJwk, type JwtSignerX5c, Oauth2AuthorizationServer, type Oauth2AuthorizationServerOptions, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, type Oauth2ClientOptions, Oauth2Error, Oauth2ErrorCodes, type Oauth2ErrorOptions, type Oauth2ErrorResponse, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, type Oauth2ResourceServerOptions, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, type Oid4vcTsConfig, type ParseAuthorizationChallengeRequestOptions, type ParseAuthorizationChallengeRequestResult, type ParseAuthorizationRequestOptions, type ParseAuthorizationRequestResult, ParseAuthorizationResponseOptions, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, type ParsedJarRequest, type ParsedJarRequestOptions, PkceCodeChallengeMethod, type PreAuthorizedCodeGrantIdentifier, type PushedAuthorizationRequestUriPrefix, type RefreshTokenGrantIdentifier, type RequestClientAttestationChallengeOptions, type RequestClientAttestationOptions, type RequestDpopOptions, type RequestLike, type ResourceRequestOptions, type ResourceRequestResponseNotOk, type ResourceRequestResponseOk, type RetrieveAuthorizationCodeAccessTokenOptions, type RetrieveClientCredentialsAccessTokenOptions, type RetrievePreAuthorizedCodeAccessTokenOptions, type ShouldRetryAuthorizationServerRequestWithClientAttestationChallengeOptions, type SignJwtCallback, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, type TokenIntrospectionResponse, type VerifiedClientAttestationJwt, type VerifiedJarRequest, type VerifyAccessTokenRequestReturn, type VerifyAuthorizationChallengeRequestOptions, type VerifyAuthorizationChallengeRequestReturn, type VerifyAuthorizationRequestOptions, type VerifyAuthorizationRequestReturn, VerifyAuthorizationResponseOptions, type VerifyDataIntegrityProofCallback, VerifyIdTokenJwtOptions, type VerifyJarRequestOptions, type VerifyJwtCallback, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyResourceRequestOptions, type WwwAuthenticateHeaderChallenge, authorizationCodeGrantIdentifier, authorizationServerRequestWithClientAttestationChallengeRetry, authorizationServerRequestWithDpopRetry, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientAttestationJwtDpop, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, clientCredentialsGrantIdentifier, createClientAttestationJwt, createDpopHeadersForRequest, createJarAuthorizationRequest, createPkce, decodeJwt, decodeJwtHeader, defaultGrantTypesSupported, extractClientAttestationChallengeFromHeaders, extractDpopNonceFromHeaders, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, fullySpecifiedCoseAlgorithmArrayToJwaSignatureAlgorithmArray, fullySpecifiedCoseAlgorithmToJwaSignatureAlgorithm, getAuthorizationServerMetadataFromList, getGlobalConfig, getGrantTypesSupported, isJarAuthorizationRequest, isJwkInSet, jwaSignatureAlgorithmArrayToFullySpecifiedCoseAlgorithmArray, jwaSignatureAlgorithmToFullySpecifiedCoseAlgorithm, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, jwtSignerFromJwt, parseAuthorizationRequest, parseAuthorizationResponseRedirectUrl, parseJarRequest, parsePushedAuthorizationRequestUriReferenceValue, preAuthorizedCodeGrantIdentifier, pushedAuthorizationRequestUriPrefix, refreshTokenGrantIdentifier, requestClientAttestationChallenge, resourceRequest, setGlobalConfig, shouldRetryAuthorizationServerRequestWithClientAttestationChallenge, signedAuthorizationRequestJwtHeaderTyp, validateJarRequestParams, verifyAuthorizationRequest, verifyAuthorizationResponse, verifyClientAttestationJwt, verifyIdTokenJwt, verifyJarRequest, verifyJwt, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationErrorResponse, zAuthorizationRequest, zAuthorizationResponse, zAuthorizationResponseFromUriParams, zAuthorizationServerMetadata, zClientAttestationChallengeResponse, zClientCredentialsGrantIdentifier, zCompactJwe, zCompactJwt, zIdTokenJwtHeader, zIdTokenJwtPayload, zJarAuthorizationRequest, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zPushedAuthorizationRequestUriPrefix, zRefreshTokenGrantIdentifier };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -1155,8 +1155,13 @@ function extractClientAttestationJwtsFromHeaders(headers) {
 	const clientAttestationHeader = headers.get(oauthClientAttestationHeader);
 	const clientAttestationPopHeader = headers.get(oauthClientAttestationPopHeader);
 	if (!clientAttestationHeader && !clientAttestationPopHeader) return { valid: true };
-	if (!clientAttestationHeader || !clientAttestationPopHeader) return { valid: false };
-	if (!zCompactJwt.safeParse(clientAttestationHeader).success || !zCompactJwt.safeParse(clientAttestationPopHeader).success) return { valid: false };
+	if (!clientAttestationHeader) return { valid: false };
+	if (!zCompactJwt.safeParse(clientAttestationHeader).success) return { valid: false };
+	if (!clientAttestationPopHeader) return {
+		valid: true,
+		clientAttestationHeader
+	};
+	if (!zCompactJwt.safeParse(clientAttestationPopHeader).success) return { valid: false };
 	return {
 		valid: true,
 		clientAttestationPopHeader,
@@ -1859,6 +1864,38 @@ function clientAuthenticationClientAttestationJwt(options) {
 		headers.set(oauthClientAttestationPopHeader, clientAttestationPop);
 	};
 }
+/**
+* Client authentication using the `attest_jwt_client_auth_dpop` option (draft 09 §5.2).
+*
+* In this DPoP-bound variant the client instance key and the DPoP key are the same key, and a single
+* DPoP proof serves as both the DPoP proof and the Client Attestation PoP. The request carries the
+* `OAuth-Client-Attestation` and `DPoP` headers, but no separate `OAuth-Client-Attestation-PoP` header.
+*/
+function clientAuthenticationClientAttestationJwtDpop(options) {
+	return async ({ headers, url, method, attestationChallenge }) => {
+		const clientAttestation = decodeJwt({
+			jwt: options.clientAttestationJwt,
+			headerSchema: zClientAttestationJwtHeader,
+			payloadSchema: zClientAttestationJwtPayload
+		});
+		const signer = options.signer ?? {
+			method: "jwk",
+			alg: clientAttestation.header.alg,
+			publicJwk: clientAttestation.payload.cnf.jwk
+		};
+		const dpopJwt = await createDpopJwt({
+			request: {
+				url,
+				method
+			},
+			signer,
+			nonce: attestationChallenge ?? options.challenge,
+			callbacks: options.callbacks
+		});
+		headers.set(oauthClientAttestationHeader, options.clientAttestationJwt);
+		headers.set("DPoP", dpopJwt);
+	};
+}
 //#endregion
 //#region src/common/algorithm/algorithm-transform.ts
 /**
@@ -2567,13 +2604,17 @@ async function verifyRefreshTokenAccessTokenRequest(options) {
 	};
 }
 async function verifyAccessTokenRequestClientAttestation(options, authorizationServerMetadata, callbacks, dpopJwkThumbprint, now) {
-	if (!options.clientAttestationJwt || !options.clientAttestationPopJwt) {
-		if (!options.required && !options.clientAttestationJwt && !options.clientAttestationPopJwt) return;
+	if (!options.clientAttestationJwt) {
+		if (!options.required && !options.clientAttestationPopJwt) return;
 		throw new Oauth2ServerErrorResponseError({
 			error: "invalid_client",
 			error_description: `Missing required client attestation parameters in access token request. Make sure to provide the '${oauthClientAttestationHeader}' and '${oauthClientAttestationPopHeader}' header values.`
 		});
 	}
+	if (!options.clientAttestationPopJwt) return verifyAccessTokenRequestClientAttestationDpop({
+		...options,
+		clientAttestationJwt: options.clientAttestationJwt
+	}, authorizationServerMetadata, callbacks, dpopJwkThumbprint, now);
 	const verifiedClientAttestation = await verifyClientAttestation({
 		authorizationServer: authorizationServerMetadata.issuer,
 		callbacks,
@@ -2581,21 +2622,56 @@ async function verifyAccessTokenRequestClientAttestation(options, authorizationS
 		clientAttestationPopJwt: options.clientAttestationPopJwt,
 		now
 	});
-	if (options.expectedClientId && options.expectedClientId !== verifiedClientAttestation.clientAttestation.payload.sub) throw new Oauth2ServerErrorResponseError({
+	assertExpectedClientId(options.expectedClientId, verifiedClientAttestation.clientAttestation.payload.sub);
+	if (options.ensureConfirmationKeyMatchesDpopKey && dpopJwkThumbprint) await assertConfirmationKeyMatchesDpopKey(verifiedClientAttestation.clientAttestation.payload.cnf.jwk, dpopJwkThumbprint, callbacks);
+	return verifiedClientAttestation;
+}
+async function verifyAccessTokenRequestClientAttestationDpop(options, authorizationServerMetadata, callbacks, dpopJwkThumbprint, now) {
+	const supportedMethods = authorizationServerMetadata.token_endpoint_auth_methods_supported;
+	if (supportedMethods && !supportedMethods.includes("attest_jwt_client_auth_dpop")) throw new Oauth2ServerErrorResponseError({
 		error: "invalid_client",
-		error_description: `The client id '${verifiedClientAttestation.clientAttestation.payload.sub}' in the client attestation does not match the client id for the authorization.`
-	}, { status: 401 });
-	if (options.ensureConfirmationKeyMatchesDpopKey && dpopJwkThumbprint) {
-		if (await calculateJwkThumbprint({
-			hashAlgorithm: "sha-256",
-			hashCallback: callbacks.hash,
-			jwk: verifiedClientAttestation.clientAttestation.payload.cnf.jwk
-		}) !== dpopJwkThumbprint) throw new Oauth2ServerErrorResponseError({
-			error: "invalid_request",
-			error_description: "Expected the DPoP JWK thumbprint value to match the JWK thumbprint of the client attestation confirmation JWK. Ensure both DPoP and client attestation use the same key."
-		}, { status: 401 });
+		error_description: `The authorization server does not support the 'attest_jwt_client_auth_dpop' client authentication method.`
+	});
+	if (!dpopJwkThumbprint) throw new Oauth2ServerErrorResponseError({
+		error: "invalid_client",
+		error_description: `Client attestation provided without an '${oauthClientAttestationPopHeader}' header, but no valid DPoP proof is present. The 'attest_jwt_client_auth_dpop' method requires a DPoP proof.`
+	});
+	let clientAttestation;
+	try {
+		clientAttestation = await verifyClientAttestationJwt({
+			callbacks,
+			clientAttestationJwt: options.clientAttestationJwt,
+			now
+		});
+	} catch (error) {
+		if (error instanceof Oauth2Error) throw new Oauth2ServerErrorResponseError({
+			error: "invalid_client",
+			error_description: `Error verifying client attestation. ${error.message}`
+		}, {
+			status: 401,
+			cause: error
+		});
+		throw error;
 	}
-	return verifiedClientAttestation;
+	assertExpectedClientId(options.expectedClientId, clientAttestation.payload.sub);
+	await assertConfirmationKeyMatchesDpopKey(clientAttestation.payload.cnf.jwk, dpopJwkThumbprint, callbacks);
+	return { clientAttestation };
+}
+function assertExpectedClientId(expectedClientId, sub) {
+	if (expectedClientId && expectedClientId !== sub) throw new Oauth2ServerErrorResponseError({
+		error: "invalid_client",
+		error_description: `The client id '${sub}' in the client attestation does not match the client id for the authorization.`
+	}, { status: 401 });
+}
+async function assertConfirmationKeyMatchesDpopKey(confirmationJwk, dpopJwkThumbprint, callbacks) {
+	if (await calculateJwkThumbprint({
+		hashAlgorithm: "sha-256",
+		hashCallback: callbacks.hash,
+		jwk: confirmationJwk
+	}) !== dpopJwkThumbprint) throw new Oauth2ServerErrorResponseError({
+		error: "invalid_request",
+		error_description: "Expected the DPoP JWK thumbprint value to match the JWK thumbprint of the client attestation confirmation JWK. Ensure both DPoP and client attestation use the same key."
+	}, { status: 401 });
 }
 async function verifyAccessTokenRequestDpop(options, request, callbacks) {
 	if (options.required && !options.jwt) throw new Oauth2ServerErrorResponseError({
@@ -2608,7 +2684,8 @@ async function verifyAccessTokenRequestDpop(options, request, callbacks) {
 		dpopJwt: options.jwt,
 		request,
 		allowedSigningAlgs: options.allowedSigningAlgs,
-		expectedJwkThumbprint: options.expectedJwkThumbprint
+		expectedJwkThumbprint: options.expectedJwkThumbprint,
+		expectedNonce: options.expectedNonce
 	});
 	return {
 		jwk: header.jwk,
@@ -3582,6 +3659,6 @@ async function verifyResourceRequest(options) {
 	};
 }
 //#endregion
-export { HashAlgorithm, InvalidFetchResponseError, Oauth2AuthorizationServer, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, Oauth2Error, Oauth2ErrorCodes, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, PkceCodeChallengeMethod, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, authorizationCodeGrantIdentifier, authorizationServerRequestWithClientAttestationChallengeRetry, authorizationServerRequestWithDpopRetry, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, clientCredentialsGrantIdentifier, createClientAttestationJwt, createDpopHeadersForRequest, createJarAuthorizationRequest, createPkce, decodeJwt, decodeJwtHeader, defaultGrantTypesSupported, extractClientAttestationChallengeFromHeaders, extractDpopNonceFromHeaders, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, fullySpecifiedCoseAlgorithmArrayToJwaSignatureAlgorithmArray, fullySpecifiedCoseAlgorithmToJwaSignatureAlgorithm, getAuthorizationServerMetadataFromList, getGlobalConfig, getGrantTypesSupported, isJarAuthorizationRequest, isJwkInSet, jwaSignatureAlgorithmArrayToFullySpecifiedCoseAlgorithmArray, jwaSignatureAlgorithmToFullySpecifiedCoseAlgorithm, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, jwtSignerFromJwt, parseAuthorizationRequest, parseAuthorizationResponseRedirectUrl, parseJarRequest, parsePushedAuthorizationRequestUriReferenceValue, preAuthorizedCodeGrantIdentifier, pushedAuthorizationRequestUriPrefix, refreshTokenGrantIdentifier, requestClientAttestationChallenge, resourceRequest, setGlobalConfig, shouldRetryAuthorizationServerRequestWithClientAttestationChallenge, signedAuthorizationRequestJwtHeaderTyp, validateJarRequestParams, verifyAuthorizationRequest, verifyAuthorizationResponse, verifyClientAttestationJwt, verifyIdTokenJwt, verifyJarRequest, verifyJwt, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationErrorResponse, zAuthorizationRequest, zAuthorizationResponse, zAuthorizationResponseFromUriParams, zAuthorizationServerMetadata, zClientAttestationChallengeResponse, zClientCredentialsGrantIdentifier, zCompactJwe, zCompactJwt, zIdTokenJwtHeader, zIdTokenJwtPayload, zJarAuthorizationRequest, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zPushedAuthorizationRequestUriPrefix, zRefreshTokenGrantIdentifier };
+export { HashAlgorithm, InvalidFetchResponseError, Oauth2AuthorizationServer, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, Oauth2Error, Oauth2ErrorCodes, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, PkceCodeChallengeMethod, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, authorizationCodeGrantIdentifier, authorizationServerRequestWithClientAttestationChallengeRetry, authorizationServerRequestWithDpopRetry, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientAttestationJwtDpop, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, clientCredentialsGrantIdentifier, createClientAttestationJwt, createDpopHeadersForRequest, createJarAuthorizationRequest, createPkce, decodeJwt, decodeJwtHeader, defaultGrantTypesSupported, extractClientAttestationChallengeFromHeaders, extractDpopNonceFromHeaders, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, fullySpecifiedCoseAlgorithmArrayToJwaSignatureAlgorithmArray, fullySpecifiedCoseAlgorithmToJwaSignatureAlgorithm, getAuthorizationServerMetadataFromList, getGlobalConfig, getGrantTypesSupported, isJarAuthorizationRequest, isJwkInSet, jwaSignatureAlgorithmArrayToFullySpecifiedCoseAlgorithmArray, jwaSignatureAlgorithmToFullySpecifiedCoseAlgorithm, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, jwtSignerFromJwt, parseAuthorizationRequest, parseAuthorizationResponseRedirectUrl, parseJarRequest, parsePushedAuthorizationRequestUriReferenceValue, preAuthorizedCodeGrantIdentifier, pushedAuthorizationRequestUriPrefix, refreshTokenGrantIdentifier, requestClientAttestationChallenge, resourceRequest, setGlobalConfig, shouldRetryAuthorizationServerRequestWithClientAttestationChallenge, signedAuthorizationRequestJwtHeaderTyp, validateJarRequestParams, verifyAuthorizationRequest, verifyAuthorizationResponse, verifyClientAttestationJwt, verifyIdTokenJwt, verifyJarRequest, verifyJwt, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationErrorResponse, zAuthorizationRequest, zAuthorizationResponse, zAuthorizationResponseFromUriParams, zAuthorizationServerMetadata, zClientAttestationChallengeResponse, zClientCredentialsGrantIdentifier, zCompactJwe, zCompactJwt, zIdTokenJwtHeader, zIdTokenJwtPayload, zJarAuthorizationRequest, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zPushedAuthorizationRequestUriPrefix, zRefreshTokenGrantIdentifier };
 
 //# sourceMappingURL=index.mjs.map