@openid4vc/openid4vci 0.4.4-alpha-20260105092906 → 0.4.4-alpha-20260106132628

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { ContentType, Fetch, FetchHeaders, HttpMethod, InferOutputUnion, Oid4vcTsConfig, OrPromise, StringWithAutoCompletion, getGlobalConfig, setGlobalConfig } from "@openid4vc/utils";
 import * as _openid4vc_oauth20 from "@openid4vc/oauth2";
-import { AuthorizationCodeGrantIdentifier, AuthorizationServerMetadata, CallbackContext, CreateAuthorizationRequestUrlOptions, CreateClientAttestationJwtOptions, CreatePkceReturn, DecodeJwtResult, Jwk, JwtSigner, JwtSignerWithJwk, PreAuthorizedCodeGrantIdentifier, RequestDpopOptions, ResourceRequestResponseNotOk, ResourceRequestResponseOk, RetrieveAuthorizationCodeAccessTokenOptions, RetrievePreAuthorizedCodeAccessTokenOptions, authorizationCodeGrantIdentifier, preAuthorizedCodeGrantIdentifier } from "@openid4vc/oauth2";
+import { AuthorizationCodeGrantIdentifier, AuthorizationServerMetadata, CallbackContext, CreateAuthorizationRequestUrlOptions, CreateClientAttestationJwtOptions, CreatePkceReturn, DecodeJwtResult, Jwk, JwtSigner, JwtSignerWithJwk, ParseAuthorizationResponseOptions, PreAuthorizedCodeGrantIdentifier, RequestDpopOptions, ResourceRequestResponseNotOk, ResourceRequestResponseOk, RetrieveAuthorizationCodeAccessTokenOptions, RetrievePreAuthorizedCodeAccessTokenOptions, VerifyAuthorizationResponseOptions, authorizationCodeGrantIdentifier, preAuthorizedCodeGrantIdentifier } from "@openid4vc/oauth2";
 import * as zod0 from "zod";
 import z from "zod";
 import * as zod_v4_core0 from "zod/v4/core";
@@ -3181,7 +3181,30 @@ declare class Openid4vciClient {
     dpop?: RequestDpopOptions;
   }>;
   /**
-   * Convenience method around {@link Oauth2Client.retrieveAuthorizationCodeAccessTokenFrom}
+   * Parses the authorization (error) response redirect url, and verifies the
+   * 'iss' value based on the authorization server metadata.
+   *
+   * If you need values from the authorization response (e.g. state) to retrieve the
+   * authorization server metadata, you can manually import and call `parseAuthorizationResponseRedirectUrl` and
+   * `verifyAuthorizationResponse`.
+   */
+  parseAndVerifyAuthorizationResponseRedirectUrl(options: ParseAuthorizationResponseOptions & Omit<VerifyAuthorizationResponseOptions, 'authorizationResponse'>): {
+    [x: string]: unknown;
+    code: string;
+    state?: string | undefined;
+    iss?: string | undefined;
+    error?: undefined;
+  } | {
+    [x: string]: unknown;
+    error: string;
+    state?: string | undefined;
+    iss?: string | undefined;
+    code?: undefined;
+    error_description?: string | undefined;
+    error_uri?: string | undefined;
+  };
+  /**
+   * Convenience method around {@link Oauth2Client.retrieveAuthorizationCodeAccessToken}
    * but specifically focused on a credential offer
    */
   retrieveAuthorizationCodeAccessTokenFromOffer({
@@ -3464,6 +3487,7 @@ declare const zAuthorizationServerMetadata$1: z.ZodObject<{
   authorization_challenge_endpoint: z.ZodOptional<z.ZodURL>;
   'pre-authorized_grant_anonymous_access_supported': z.ZodOptional<z.ZodBoolean>;
   client_attestation_pop_nonce_required: z.ZodOptional<z.ZodBoolean>;
+  authorization_response_iss_parameter_supported: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$loose>;
 type AuthorizationServerMetadata$1 = z.infer<typeof zAuthorizationServerMetadata$1>;
 //#endregion

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { ContentType, OpenId4VcBaseError, URL, URLSearchParams, ValidationError, arrayEqualsIgnoreOrder, createZodFetcher, dateToSeconds, encodeToBase64Url, formatZodError, getGlobalConfig, getQueryParams, isResponseContentType, joinUriParts, objectToQueryParams, parseWithErrorHandling, setGlobalConfig, zDataUrl, zHttpsUrl, zInteger, zIs } from "@openid4vc/utils";
-import { InvalidFetchResponseError, Oauth2AuthorizationServer, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2Error, Oauth2ErrorCodes, Oauth2JwtVerificationError, Oauth2ServerErrorResponseError, authorizationCodeGrantIdentifier, createClientAttestationJwt, decodeJwt, fetchAuthorizationServerMetadata, fetchWellKnownMetadata, fullySpecifiedCoseAlgorithmArrayToJwaSignatureAlgorithmArray, getAuthorizationServerMetadataFromList, isJwkInSet, jwaSignatureAlgorithmArrayToFullySpecifiedCoseAlgorithmArray, jwtHeaderFromJwtSigner, jwtSignerFromJwt, preAuthorizedCodeGrantIdentifier, resourceRequest, verifyJwt, zAuthorizationServerMetadata, zCompactJwt, zJwk, zJwtHeader, zJwtPayload } from "@openid4vc/oauth2";
+import { InvalidFetchResponseError, Oauth2AuthorizationServer, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2Error, Oauth2ErrorCodes, Oauth2JwtVerificationError, Oauth2ServerErrorResponseError, authorizationCodeGrantIdentifier, createClientAttestationJwt, decodeJwt, fetchAuthorizationServerMetadata, fetchWellKnownMetadata, fullySpecifiedCoseAlgorithmArrayToJwaSignatureAlgorithmArray, getAuthorizationServerMetadataFromList, isJwkInSet, jwaSignatureAlgorithmArrayToFullySpecifiedCoseAlgorithmArray, jwtHeaderFromJwtSigner, jwtSignerFromJwt, parseAuthorizationResponseRedirectUrl, preAuthorizedCodeGrantIdentifier, resourceRequest, verifyAuthorizationResponse, verifyJwt, zAuthorizationServerMetadata, zCompactJwt, zJwk, zJwtHeader, zJwtPayload } from "@openid4vc/oauth2";
 import z from "zod";
 
 //#region src/version.ts
@@ -973,6 +973,7 @@ async function fetchCredentialIssuerMetadata(credentialIssuer, options) {
 	} catch (error) {
 		throw firstError ?? error;
 	}
+	if (!result && firstError) throw firstError;
 	let issuerMetadataWithVersion = null;
 	if (typeof result === "string") {
 		if (!options?.callbacks?.verifyJwt) throw new Oauth2Error(`Unable to verify signed credential issuer metadata, no 'verifyJwt' callback provided to fetch credential issuer metadata method.`);
@@ -1766,7 +1767,23 @@ var Openid4vciClient = class {
 		};
 	}
 	/**
-	* Convenience method around {@link Oauth2Client.retrieveAuthorizationCodeAccessTokenFrom}
+	* Parses the authorization (error) response redirect url, and verifies the
+	* 'iss' value based on the authorization server metadata.
+	*
+	* If you need values from the authorization response (e.g. state) to retrieve the
+	* authorization server metadata, you can manually import and call `parseAuthorizationResponseRedirectUrl` and
+	* `verifyAuthorizationResponse`.
+	*/
+	parseAndVerifyAuthorizationResponseRedirectUrl(options) {
+		const authorizationResponse = parseAuthorizationResponseRedirectUrl(options);
+		verifyAuthorizationResponse({
+			...options,
+			authorizationResponse
+		});
+		return authorizationResponse;
+	}
+	/**
+	* Convenience method around {@link Oauth2Client.retrieveAuthorizationCodeAccessToken}
 	* but specifically focused on a credential offer
 	*/
 	async retrieveAuthorizationCodeAccessTokenFromOffer({ issuerMetadata, additionalRequestPayload, credentialOffer, authorizationCode, pkceCodeVerifier, redirectUri, dpop }) {