@pagopa/io-wallet-oauth2 1.5.8 → 2.0.0-launchpad

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/index.d.mts +962 -1340
  2. package/dist/index.d.ts +962 -1340
  3. package/dist/index.js +407 -670
  4. package/dist/index.js.map +1 -1
  5. package/dist/index.mjs +361 -571
  6. package/dist/index.mjs.map +1 -1
  7. package/package.json +3 -6
package/dist/index.d.mts CHANGED
@@ -1,9 +1,6 @@
1
- import * as _openid4vc_oauth2 from '@openid4vc/oauth2';
2
- import { CallbackContext, JwtSigner as JwtSigner$1, JwtSignerJwk as JwtSignerJwk$1, ClientAttestationJwtPayload, RequestDpopOptions, JwtSignerWithJwk as JwtSignerWithJwk$1, HttpMethod as HttpMethod$1 } from '@openid4vc/oauth2';
3
- export { CallbackContext, ClientAttestationPopJwtHeader, ClientAttestationPopJwtPayload, DecryptJweCallback, EncryptJweCallback, GenerateRandomCallback, HashAlgorithm, JweEncryptor, JwtSigner, JwtSignerJwk, Oauth2JwtParseError, RequestDpopOptions, SignJwtCallback, VerifyJwtCallback, verifyJwt } from '@openid4vc/oauth2';
4
- import z, { z as z$1 } from 'zod';
5
- import { RequestLike as RequestLike$1, ItWalletSpecsVersion, IoWalletSdkConfig, FetchHeaders, HttpMethod, BaseSchema, ContentType, Fetch } from '@pagopa/io-wallet-utils';
6
- import { ItWalletAuthorizationServerMetadata } from '@pagopa/io-wallet-oid-federation';
1
+ import * as _pagopa_io_wallet_utils from '@pagopa/io-wallet-utils';
2
+ import { CallbackContext, Jwk, JwtSigner, RequestLike, ItWalletSpecsVersion, IoWalletSdkConfig, JwtSignerJwk, JwtPayload, FetchHeaders, RequestDpopOptions, decodeJwt, JwtSignerWithJwk, ClientAuthenticationCallback as ClientAuthenticationCallback$1, ClientAuthenticationCallbackOptions as ClientAuthenticationCallbackOptions$1, JweEncryptor, Fetch, DecodeJwtResult, HttpMethod } from '@pagopa/io-wallet-utils';
3
+ import z$1, { z } from 'zod';
7
4
 
8
5
  interface RetrieveAuthorizationCodeAccessTokenOptions {
9
6
  /**
@@ -46,69 +43,6 @@ declare const createTokenRequest: (options: RetrieveAuthorizationCodeAccessToken
46
43
  redirect_uri: string;
47
44
  }>;
48
45
 
49
- declare const zJwk: z.ZodObject<{
50
- alg: z.ZodOptional<z.ZodString>;
51
- crv: z.ZodOptional<z.ZodString>;
52
- d: z.ZodOptional<z.ZodString>;
53
- dp: z.ZodOptional<z.ZodString>;
54
- dq: z.ZodOptional<z.ZodString>;
55
- e: z.ZodOptional<z.ZodString>;
56
- ext: z.ZodOptional<z.ZodBoolean>;
57
- k: z.ZodOptional<z.ZodString>;
58
- key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
59
- kid: z.ZodOptional<z.ZodString>;
60
- kty: z.ZodString;
61
- n: z.ZodOptional<z.ZodString>;
62
- oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
63
- d: z.ZodOptional<z.ZodString>;
64
- r: z.ZodOptional<z.ZodString>;
65
- t: z.ZodOptional<z.ZodString>;
66
- }, z.core.$loose>>>;
67
- p: z.ZodOptional<z.ZodString>;
68
- q: z.ZodOptional<z.ZodString>;
69
- qi: z.ZodOptional<z.ZodString>;
70
- use: z.ZodOptional<z.ZodString>;
71
- x: z.ZodOptional<z.ZodString>;
72
- x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
73
- x5t: z.ZodOptional<z.ZodString>;
74
- "x5t#S256": z.ZodOptional<z.ZodString>;
75
- x5u: z.ZodOptional<z.ZodString>;
76
- y: z.ZodOptional<z.ZodString>;
77
- }, z.core.$loose>;
78
- type Jwk = z.infer<typeof zJwk>;
79
- declare const zJwkSet: z.ZodObject<{
80
- keys: z.ZodArray<z.ZodObject<{
81
- alg: z.ZodOptional<z.ZodString>;
82
- crv: z.ZodOptional<z.ZodString>;
83
- d: z.ZodOptional<z.ZodString>;
84
- dp: z.ZodOptional<z.ZodString>;
85
- dq: z.ZodOptional<z.ZodString>;
86
- e: z.ZodOptional<z.ZodString>;
87
- ext: z.ZodOptional<z.ZodBoolean>;
88
- k: z.ZodOptional<z.ZodString>;
89
- key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
90
- kid: z.ZodOptional<z.ZodString>;
91
- kty: z.ZodString;
92
- n: z.ZodOptional<z.ZodString>;
93
- oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
94
- d: z.ZodOptional<z.ZodString>;
95
- r: z.ZodOptional<z.ZodString>;
96
- t: z.ZodOptional<z.ZodString>;
97
- }, z.core.$loose>>>;
98
- p: z.ZodOptional<z.ZodString>;
99
- q: z.ZodOptional<z.ZodString>;
100
- qi: z.ZodOptional<z.ZodString>;
101
- use: z.ZodOptional<z.ZodString>;
102
- x: z.ZodOptional<z.ZodString>;
103
- x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
104
- x5t: z.ZodOptional<z.ZodString>;
105
- "x5t#S256": z.ZodOptional<z.ZodString>;
106
- x5u: z.ZodOptional<z.ZodString>;
107
- y: z.ZodOptional<z.ZodString>;
108
- }, z.core.$loose>>;
109
- }, z.core.$loose>;
110
- type JwkSet = z.infer<typeof zJwkSet>;
111
-
112
46
  interface CreateAccessTokenResponseOptions {
113
47
  /**
114
48
  * Additional claims copied into both the access token JWT payload and token
@@ -169,7 +103,7 @@ interface CreateAccessTokenResponseOptions {
169
103
  /**
170
104
  * Signer used to produce the access token JWT.
171
105
  */
172
- signer: JwtSigner$1;
106
+ signer: JwtSigner;
173
107
  /**
174
108
  * Subject identifier represented by the access token (`sub` claim).
175
109
  */
@@ -213,147 +147,147 @@ declare function createAccessTokenResponse(options: CreateAccessTokenResponseOpt
213
147
  refresh_token?: string | undefined;
214
148
  }>;
215
149
 
216
- declare const zAccessTokenRequest: z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
217
- code: z$1.ZodString;
218
- code_verifier: z$1.ZodString;
219
- grant_type: z$1.ZodLiteral<"authorization_code">;
220
- redirect_uri: z$1.ZodString;
221
- }, z$1.core.$strip>, z$1.ZodObject<{
222
- grant_type: z$1.ZodLiteral<"refresh_token">;
223
- refresh_token: z$1.ZodString;
224
- scope: z$1.ZodOptional<z$1.ZodString>;
225
- }, z$1.core.$strip>], "grant_type">;
226
- type AccessTokenRequest = z$1.infer<typeof zAccessTokenRequest>;
150
+ declare const zAccessTokenRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
151
+ code: z.ZodString;
152
+ code_verifier: z.ZodString;
153
+ grant_type: z.ZodLiteral<"authorization_code">;
154
+ redirect_uri: z.ZodString;
155
+ }, z.core.$strip>, z.ZodObject<{
156
+ grant_type: z.ZodLiteral<"refresh_token">;
157
+ refresh_token: z.ZodString;
158
+ scope: z.ZodOptional<z.ZodString>;
159
+ }, z.core.$strip>], "grant_type">;
160
+ type AccessTokenRequest = z.infer<typeof zAccessTokenRequest>;
227
161
  type AuthorizationCodeGrantType = Extract<AccessTokenRequest, {
228
162
  grant_type: "authorization_code";
229
163
  }>;
230
164
  type RefreshTokenGrantType = Extract<AccessTokenRequest, {
231
165
  grant_type: "refresh_token";
232
166
  }>;
233
- declare const zAccessTokenResponse: z$1.ZodObject<{
234
- access_token: z$1.ZodString;
235
- authorization_details: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
236
- credential_configuration_id: z$1.ZodOptional<z$1.ZodString>;
237
- credential_identifiers: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
238
- type: z$1.ZodLiteral<"openid_credential">;
239
- }, z$1.core.$loose>>>;
240
- expires_in: z$1.ZodOptional<z$1.ZodNumber>;
241
- refresh_token: z$1.ZodOptional<z$1.ZodString>;
242
- token_type: z$1.ZodUnion<readonly [z$1.ZodLiteral<"Bearer">, z$1.ZodLiteral<"DPoP">]>;
243
- }, z$1.core.$loose>;
244
- type AccessTokenResponse = z$1.infer<typeof zAccessTokenResponse>;
245
- declare const zAccessTokenProfileJwtHeader: z$1.ZodObject<{
246
- typ: z$1.ZodEnum<{
167
+ declare const zAccessTokenResponse: z.ZodObject<{
168
+ access_token: z.ZodString;
169
+ authorization_details: z.ZodOptional<z.ZodArray<z.ZodObject<{
170
+ credential_configuration_id: z.ZodOptional<z.ZodString>;
171
+ credential_identifiers: z.ZodOptional<z.ZodArray<z.ZodString>>;
172
+ type: z.ZodLiteral<"openid_credential">;
173
+ }, z.core.$loose>>>;
174
+ expires_in: z.ZodOptional<z.ZodNumber>;
175
+ refresh_token: z.ZodOptional<z.ZodString>;
176
+ token_type: z.ZodUnion<readonly [z.ZodLiteral<"Bearer">, z.ZodLiteral<"DPoP">]>;
177
+ }, z.core.$loose>;
178
+ type AccessTokenResponse = z.infer<typeof zAccessTokenResponse>;
179
+ declare const zAccessTokenProfileJwtHeader: z.ZodObject<{
180
+ typ: z.ZodEnum<{
247
181
  "application/at+jwt": "application/at+jwt";
248
182
  "at+jwt": "at+jwt";
249
183
  }>;
250
- alg: z$1.ZodString;
251
- jwk: z$1.ZodOptional<z$1.ZodObject<{
252
- alg: z$1.ZodOptional<z$1.ZodString>;
253
- crv: z$1.ZodOptional<z$1.ZodString>;
254
- d: z$1.ZodOptional<z$1.ZodString>;
255
- dp: z$1.ZodOptional<z$1.ZodString>;
256
- dq: z$1.ZodOptional<z$1.ZodString>;
257
- e: z$1.ZodOptional<z$1.ZodString>;
258
- ext: z$1.ZodOptional<z$1.ZodBoolean>;
259
- k: z$1.ZodOptional<z$1.ZodString>;
260
- key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
261
- kid: z$1.ZodOptional<z$1.ZodString>;
262
- kty: z$1.ZodString;
263
- n: z$1.ZodOptional<z$1.ZodString>;
264
- oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
265
- d: z$1.ZodOptional<z$1.ZodString>;
266
- r: z$1.ZodOptional<z$1.ZodString>;
267
- t: z$1.ZodOptional<z$1.ZodString>;
268
- }, z$1.core.$loose>>>;
269
- p: z$1.ZodOptional<z$1.ZodString>;
270
- q: z$1.ZodOptional<z$1.ZodString>;
271
- qi: z$1.ZodOptional<z$1.ZodString>;
272
- use: z$1.ZodOptional<z$1.ZodString>;
273
- x: z$1.ZodOptional<z$1.ZodString>;
274
- x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
275
- x5t: z$1.ZodOptional<z$1.ZodString>;
276
- "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
277
- x5u: z$1.ZodOptional<z$1.ZodString>;
278
- y: z$1.ZodOptional<z$1.ZodString>;
279
- }, z$1.core.$loose>>;
280
- kid: z$1.ZodOptional<z$1.ZodString>;
281
- trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
282
- x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
283
- }, z$1.core.$loose>;
284
- type AccessTokenProfileJwtHeader = z$1.infer<typeof zAccessTokenProfileJwtHeader>;
285
- declare const zAccessTokenProfileJwtPayload: z$1.ZodObject<{
286
- aud: z$1.ZodString;
287
- client_id: z$1.ZodString;
288
- cnf: z$1.ZodOptional<z$1.ZodObject<{
289
- jkt: z$1.ZodString;
290
- }, z$1.core.$strip>>;
291
- exp: z$1.ZodNumber;
292
- iat: z$1.ZodNumber;
293
- iss: z$1.ZodString;
294
- jti: z$1.ZodString;
295
- nbf: z$1.ZodOptional<z$1.ZodNumber>;
296
- scope: z$1.ZodOptional<z$1.ZodString>;
297
- sub: z$1.ZodString;
298
- nonce: z$1.ZodOptional<z$1.ZodString>;
299
- status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
300
- trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
301
- }, z$1.core.$loose>;
302
- type AccessTokenProfileJwtPayload = z$1.infer<typeof zAccessTokenProfileJwtPayload>;
303
- declare const zRefreshTokenProfileJwtHeader: z$1.ZodObject<{
304
- kid: z$1.ZodString;
305
- typ: z$1.ZodLiteral<"rt+jwt">;
306
- alg: z$1.ZodString;
307
- jwk: z$1.ZodOptional<z$1.ZodObject<{
308
- alg: z$1.ZodOptional<z$1.ZodString>;
309
- crv: z$1.ZodOptional<z$1.ZodString>;
310
- d: z$1.ZodOptional<z$1.ZodString>;
311
- dp: z$1.ZodOptional<z$1.ZodString>;
312
- dq: z$1.ZodOptional<z$1.ZodString>;
313
- e: z$1.ZodOptional<z$1.ZodString>;
314
- ext: z$1.ZodOptional<z$1.ZodBoolean>;
315
- k: z$1.ZodOptional<z$1.ZodString>;
316
- key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
317
- kid: z$1.ZodOptional<z$1.ZodString>;
318
- kty: z$1.ZodString;
319
- n: z$1.ZodOptional<z$1.ZodString>;
320
- oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
321
- d: z$1.ZodOptional<z$1.ZodString>;
322
- r: z$1.ZodOptional<z$1.ZodString>;
323
- t: z$1.ZodOptional<z$1.ZodString>;
324
- }, z$1.core.$loose>>>;
325
- p: z$1.ZodOptional<z$1.ZodString>;
326
- q: z$1.ZodOptional<z$1.ZodString>;
327
- qi: z$1.ZodOptional<z$1.ZodString>;
328
- use: z$1.ZodOptional<z$1.ZodString>;
329
- x: z$1.ZodOptional<z$1.ZodString>;
330
- x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
331
- x5t: z$1.ZodOptional<z$1.ZodString>;
332
- "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
333
- x5u: z$1.ZodOptional<z$1.ZodString>;
334
- y: z$1.ZodOptional<z$1.ZodString>;
335
- }, z$1.core.$loose>>;
336
- trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
337
- x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
338
- }, z$1.core.$loose>;
339
- type RefreshTokenProfileJwtHeader = z$1.infer<typeof zRefreshTokenProfileJwtHeader>;
340
- declare const zRefreshTokenProfileJwtPayload: z$1.ZodObject<{
341
- aud: z$1.ZodString;
342
- client_id: z$1.ZodString;
343
- cnf: z$1.ZodObject<{
344
- jkt: z$1.ZodString;
345
- }, z$1.core.$strip>;
346
- exp: z$1.ZodNumber;
347
- iat: z$1.ZodNumber;
348
- iss: z$1.ZodString;
349
- jti: z$1.ZodString;
350
- nbf: z$1.ZodNumber;
351
- sub: z$1.ZodString;
352
- nonce: z$1.ZodOptional<z$1.ZodString>;
353
- status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
354
- trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
355
- }, z$1.core.$loose>;
356
- type RefreshTokenProfileJwtPayload = z$1.infer<typeof zRefreshTokenProfileJwtPayload>;
184
+ alg: z.ZodString;
185
+ jwk: z.ZodOptional<z.ZodObject<{
186
+ alg: z.ZodOptional<z.ZodString>;
187
+ crv: z.ZodOptional<z.ZodString>;
188
+ d: z.ZodOptional<z.ZodString>;
189
+ dp: z.ZodOptional<z.ZodString>;
190
+ dq: z.ZodOptional<z.ZodString>;
191
+ e: z.ZodOptional<z.ZodString>;
192
+ ext: z.ZodOptional<z.ZodBoolean>;
193
+ k: z.ZodOptional<z.ZodString>;
194
+ key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
195
+ kid: z.ZodOptional<z.ZodString>;
196
+ kty: z.ZodString;
197
+ n: z.ZodOptional<z.ZodString>;
198
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
199
+ d: z.ZodOptional<z.ZodString>;
200
+ r: z.ZodOptional<z.ZodString>;
201
+ t: z.ZodOptional<z.ZodString>;
202
+ }, z.core.$loose>>>;
203
+ p: z.ZodOptional<z.ZodString>;
204
+ q: z.ZodOptional<z.ZodString>;
205
+ qi: z.ZodOptional<z.ZodString>;
206
+ use: z.ZodOptional<z.ZodString>;
207
+ x: z.ZodOptional<z.ZodString>;
208
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
209
+ x5t: z.ZodOptional<z.ZodString>;
210
+ "x5t#S256": z.ZodOptional<z.ZodString>;
211
+ x5u: z.ZodOptional<z.ZodString>;
212
+ y: z.ZodOptional<z.ZodString>;
213
+ }, z.core.$loose>>;
214
+ kid: z.ZodOptional<z.ZodString>;
215
+ trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
216
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
217
+ }, z.core.$loose>;
218
+ type AccessTokenProfileJwtHeader = z.infer<typeof zAccessTokenProfileJwtHeader>;
219
+ declare const zAccessTokenProfileJwtPayload: z.ZodObject<{
220
+ aud: z.ZodString;
221
+ client_id: z.ZodString;
222
+ cnf: z.ZodOptional<z.ZodObject<{
223
+ jkt: z.ZodString;
224
+ }, z.core.$strip>>;
225
+ exp: z.ZodNumber;
226
+ iat: z.ZodNumber;
227
+ iss: z.ZodString;
228
+ jti: z.ZodString;
229
+ nbf: z.ZodOptional<z.ZodNumber>;
230
+ scope: z.ZodOptional<z.ZodString>;
231
+ sub: z.ZodString;
232
+ nonce: z.ZodOptional<z.ZodString>;
233
+ status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
234
+ trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
235
+ }, z.core.$loose>;
236
+ type AccessTokenProfileJwtPayload = z.infer<typeof zAccessTokenProfileJwtPayload>;
237
+ declare const zRefreshTokenProfileJwtHeader: z.ZodObject<{
238
+ kid: z.ZodString;
239
+ typ: z.ZodLiteral<"rt+jwt">;
240
+ alg: z.ZodString;
241
+ jwk: z.ZodOptional<z.ZodObject<{
242
+ alg: z.ZodOptional<z.ZodString>;
243
+ crv: z.ZodOptional<z.ZodString>;
244
+ d: z.ZodOptional<z.ZodString>;
245
+ dp: z.ZodOptional<z.ZodString>;
246
+ dq: z.ZodOptional<z.ZodString>;
247
+ e: z.ZodOptional<z.ZodString>;
248
+ ext: z.ZodOptional<z.ZodBoolean>;
249
+ k: z.ZodOptional<z.ZodString>;
250
+ key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
251
+ kid: z.ZodOptional<z.ZodString>;
252
+ kty: z.ZodString;
253
+ n: z.ZodOptional<z.ZodString>;
254
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
255
+ d: z.ZodOptional<z.ZodString>;
256
+ r: z.ZodOptional<z.ZodString>;
257
+ t: z.ZodOptional<z.ZodString>;
258
+ }, z.core.$loose>>>;
259
+ p: z.ZodOptional<z.ZodString>;
260
+ q: z.ZodOptional<z.ZodString>;
261
+ qi: z.ZodOptional<z.ZodString>;
262
+ use: z.ZodOptional<z.ZodString>;
263
+ x: z.ZodOptional<z.ZodString>;
264
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
265
+ x5t: z.ZodOptional<z.ZodString>;
266
+ "x5t#S256": z.ZodOptional<z.ZodString>;
267
+ x5u: z.ZodOptional<z.ZodString>;
268
+ y: z.ZodOptional<z.ZodString>;
269
+ }, z.core.$loose>>;
270
+ trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
271
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
272
+ }, z.core.$loose>;
273
+ type RefreshTokenProfileJwtHeader = z.infer<typeof zRefreshTokenProfileJwtHeader>;
274
+ declare const zRefreshTokenProfileJwtPayload: z.ZodObject<{
275
+ aud: z.ZodString;
276
+ client_id: z.ZodString;
277
+ cnf: z.ZodObject<{
278
+ jkt: z.ZodString;
279
+ }, z.core.$strip>;
280
+ exp: z.ZodNumber;
281
+ iat: z.ZodNumber;
282
+ iss: z.ZodString;
283
+ jti: z.ZodString;
284
+ nbf: z.ZodNumber;
285
+ sub: z.ZodString;
286
+ nonce: z.ZodOptional<z.ZodString>;
287
+ status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
288
+ trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
289
+ }, z.core.$loose>;
290
+ type RefreshTokenProfileJwtPayload = z.infer<typeof zRefreshTokenProfileJwtPayload>;
357
291
 
358
292
  interface FetchTokenResponseOptions {
359
293
  /**
@@ -405,12 +339,12 @@ declare function fetchTokenResponse(options: FetchTokenResponseOptions): Promise
405
339
  */
406
340
  declare function toURLSearchParams(data: AccessTokenRequest): URLSearchParams;
407
341
 
408
- declare const zAuthorizationCodeGrantIdentifier: z$1.ZodLiteral<"authorization_code">;
342
+ declare const zAuthorizationCodeGrantIdentifier: z.ZodLiteral<"authorization_code">;
409
343
  declare const authorizationCodeGrantIdentifier: "authorization_code";
410
- type AuthorizationCodeGrantIdentifier = z$1.infer<typeof zAuthorizationCodeGrantIdentifier>;
411
- declare const zRefreshTokenGrantIdentifier: z$1.ZodLiteral<"refresh_token">;
344
+ type AuthorizationCodeGrantIdentifier = z.infer<typeof zAuthorizationCodeGrantIdentifier>;
345
+ declare const zRefreshTokenGrantIdentifier: z.ZodLiteral<"refresh_token">;
412
346
  declare const refreshTokenGrantIdentifier: "refresh_token";
413
- type RefreshTokenGrantIdentifier = z$1.infer<typeof zRefreshTokenGrantIdentifier>;
347
+ type RefreshTokenGrantIdentifier = z.infer<typeof zRefreshTokenGrantIdentifier>;
414
348
 
415
349
  interface ParsedAccessTokenAuthorizationCodeRequestGrant {
416
350
  code: string;
@@ -448,7 +382,7 @@ interface ParseAccessTokenRequestOptions {
448
382
  * `x-www-url-form-urlencoded` body into an object (e.g. using `bodyParser.urlEncoded()` in express)
449
383
  */
450
384
  accessTokenRequest: Record<string, unknown>;
451
- request: RequestLike$1;
385
+ request: RequestLike;
452
386
  }
453
387
  /**
454
388
  * Parses and validates an OAuth 2.0 access token request.
@@ -481,6 +415,58 @@ interface ParseAccessTokenRequestOptions {
481
415
  */
482
416
  declare function parseAccessTokenRequest(options: ParseAccessTokenRequestOptions): ParseAccessTokenRequestResult;
483
417
 
418
+ /**
419
+ * Lean Authorization Server Metadata interface consumed by the oauth2 package.
420
+ *
421
+ * This interface captures only the fields that this package actually reads,
422
+ * keeping it free of any dependency on the `oid-federation` package and preventing
423
+ * a circular build dependency between the two packages.
424
+ *
425
+ * In practice callers pass the richer types produced by `@pagopa/io-wallet-oid-federation`
426
+ * (e.g. `ItWalletAuthorizationServerMetadataV1_3`); those types satisfy this interface
427
+ * structurally, so no explicit cast is required at call sites.
428
+ *
429
+ * @see {@link https://www.rfc-editor.org/rfc/rfc8414 RFC 8414 – OAuth 2.0 Authorization Server Metadata}
430
+ */
431
+ interface BaseAuthorizationServerMetadata {
432
+ /**
433
+ * List of PKCE code-challenge transformation methods supported by the server.
434
+ *
435
+ * IT-Wallet mandates that `"S256"` be present.
436
+ *
437
+ * @see {@link https://www.rfc-editor.org/rfc/rfc7636#section-4.3 RFC 7636 §4.3}
438
+ */
439
+ code_challenge_methods_supported: string[];
440
+ /**
441
+ * URL that uniquely identifies the Authorization Server.
442
+ *
443
+ * Used as the expected `aud` claim when verifying JAR request objects and as the
444
+ * `authorization_server` value when creating Client Attestation PoP JWTs.
445
+ *
446
+ * @see {@link https://www.rfc-editor.org/rfc/rfc8414#section-2 RFC 8414 §2}
447
+ */
448
+ issuer: string;
449
+ /**
450
+ * When `true` the server mandates that every authorization request be sent as a
451
+ * signed JWT (JAR). Unsigned PAR bodies are rejected in that case.
452
+ *
453
+ * Defaults to `false` when absent (permissive mode).
454
+ *
455
+ * @default false
456
+ * @see {@link https://www.rfc-editor.org/rfc/rfc9101#section-10.5 RFC 9101 §10.5}
457
+ */
458
+ require_signed_request_object?: boolean;
459
+ /**
460
+ * Client authentication methods supported by the token endpoint.
461
+ *
462
+ * The oauth2 package inspects this array for the `"attest_jwt_client_auth"` value
463
+ * to determine whether Wallet Attestation–based client authentication is available.
464
+ *
465
+ * @see {@link https://www.rfc-editor.org/rfc/rfc8414#section-2 RFC 8414 §2}
466
+ */
467
+ token_endpoint_auth_methods_supported?: string[];
468
+ }
469
+
484
470
  interface VerifyClientAttestationPopJwtOptions {
485
471
  /**
486
472
  * The issuer identifier of the authorization server handling the client attestation
@@ -609,9 +595,10 @@ declare function verifyClientAttestationPopJwt(options: VerifyClientAttestationP
609
595
  } | undefined;
610
596
  nbf?: number | undefined;
611
597
  status?: Record<string, any> | undefined;
598
+ sub?: string | undefined;
612
599
  trust_chain?: [string, ...string[]] | undefined;
613
600
  };
614
- signer: _openid4vc_oauth2.JwtSignerWithJwk;
601
+ signer: _pagopa_io_wallet_utils.JwtSignerWithJwk;
615
602
  }>;
616
603
  interface BaseCreateClientAttestationPopJwtOptions<V extends ItWalletSpecsVersion> {
617
604
  /**
@@ -646,7 +633,7 @@ interface BaseCreateClientAttestationPopJwtOptions<V extends ItWalletSpecsVersio
646
633
  * If not provided, the signer will be derived based on the
647
634
  * `cnf.jwk` and `alg` in the client attestation.
648
635
  */
649
- signer?: JwtSignerJwk$1;
636
+ signer?: JwtSignerJwk;
650
637
  }
651
638
  type NoClientAttestationPopJwtExtraOptions = Record<never, never>;
652
639
  interface CreateClientAttestationPopJwtVersionOptions {
@@ -703,7 +690,7 @@ interface VerifyClientAttestationOptions {
703
690
  /**
704
691
  * The authorization server metadata.
705
692
  */
706
- authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
693
+ authorizationServerMetadata: BaseAuthorizationServerMetadata;
707
694
  /**
708
695
  * Callbacks for hashing and JWT verification.
709
696
  */
@@ -834,14 +821,14 @@ declare function verifyClientAttestation(options: VerifyClientAttestationOptions
834
821
  sub: string;
835
822
  wallet_link?: string | undefined;
836
823
  wallet_name?: string | undefined;
837
- aud?: string | undefined;
824
+ aud?: string | string[] | undefined;
838
825
  jti?: string | undefined;
839
826
  nbf?: number | undefined;
840
827
  nonce?: string | undefined;
841
828
  status?: Record<string, any> | undefined;
842
829
  trust_chain?: [string, ...string[]] | undefined;
843
830
  };
844
- signer: _openid4vc_oauth2.JwtSignerWithJwk;
831
+ signer: _pagopa_io_wallet_utils.JwtSignerWithJwk;
845
832
  };
846
833
  clientAttestationPop: {
847
834
  header: {
@@ -928,9 +915,10 @@ declare function verifyClientAttestation(options: VerifyClientAttestationOptions
928
915
  } | undefined;
929
916
  nbf?: number | undefined;
930
917
  status?: Record<string, any> | undefined;
918
+ sub?: string | undefined;
931
919
  trust_chain?: [string, ...string[]] | undefined;
932
920
  };
933
- signer: _openid4vc_oauth2.JwtSignerWithJwk;
921
+ signer: _pagopa_io_wallet_utils.JwtSignerWithJwk;
934
922
  };
935
923
  }>;
936
924
 
@@ -944,15 +932,15 @@ interface BaseVerifyWalletAttestationJwtOptions {
944
932
  */
945
933
  interface BaseWalletAttestationOptions {
946
934
  callbacks: Pick<CallbackContext, "hash" | "signJwt">;
947
- dpopJwkPublic: ClientAttestationJwtPayload["cnf"]["jwk"];
935
+ dpopJwkPublic: NonNullable<NonNullable<JwtPayload["cnf"]>["jwk"]>;
948
936
  expiresAt?: Date;
949
937
  issuer: string;
950
938
  walletLink?: string;
951
939
  walletName?: string;
952
940
  }
953
- declare const zOauthClientAttestationHeader: z.ZodLiteral<"OAuth-Client-Attestation">;
941
+ declare const zOauthClientAttestationHeader: z$1.ZodLiteral<"OAuth-Client-Attestation">;
954
942
  declare const oauthClientAttestationHeader: "OAuth-Client-Attestation";
955
- declare const zOauthClientAttestationPopHeader: z.ZodLiteral<"OAuth-Client-Attestation-PoP">;
943
+ declare const zOauthClientAttestationPopHeader: z$1.ZodLiteral<"OAuth-Client-Attestation-PoP">;
956
944
  declare const oauthClientAttestationPopHeader: "OAuth-Client-Attestation-PoP";
957
945
 
958
946
  interface VerifyWalletAttestationJwtOptionsV1_0 extends BaseVerifyWalletAttestationJwtOptions {
@@ -965,7 +953,7 @@ type VerifiedWalletAttestationJwtV1_0 = Awaited<ReturnType<typeof verifyWalletAt
965
953
  * @param options - v1.0 verification options.
966
954
  * @returns Decoded and verified wallet attestation JWT data.
967
955
  * @throws {ValidationError} If the JWT header or payload does not satisfy the v1.0 schema.
968
- * @throws {Oauth2JwtParseError} If the JWT cannot be decoded.
956
+ * @throws {JwtParseError} If the JWT cannot be decoded.
969
957
  * @throws {Oauth2JwtVerificationError} If signature verification fails.
970
958
  */
971
959
  declare function verifyWalletAttestationJwt$3(options: VerifyWalletAttestationJwtOptionsV1_0): Promise<{
@@ -1050,14 +1038,14 @@ declare function verifyWalletAttestationJwt$3(options: VerifyWalletAttestationJw
1050
1038
  sub: string;
1051
1039
  wallet_link?: string | undefined;
1052
1040
  wallet_name?: string | undefined;
1053
- aud?: string | undefined;
1041
+ aud?: string | string[] | undefined;
1054
1042
  jti?: string | undefined;
1055
1043
  nbf?: number | undefined;
1056
1044
  nonce?: string | undefined;
1057
1045
  status?: Record<string, any> | undefined;
1058
1046
  trust_chain?: [string, ...string[]] | undefined;
1059
1047
  };
1060
- signer: _openid4vc_oauth2.JwtSignerWithJwk;
1048
+ signer: _pagopa_io_wallet_utils.JwtSignerWithJwk;
1061
1049
  }>;
1062
1050
 
1063
1051
  interface VerifyWalletAttestationJwtOptionsV1_3 extends BaseVerifyWalletAttestationJwtOptions {
@@ -1070,7 +1058,7 @@ type VerifiedWalletAttestationJwtV1_3 = Awaited<ReturnType<typeof verifyWalletAt
1070
1058
  * @param options - v1.3 verification options.
1071
1059
  * @returns Decoded and verified wallet attestation JWT data.
1072
1060
  * @throws {ValidationError} If the JWT header or payload does not satisfy the v1.3 schema.
1073
- * @throws {Oauth2JwtParseError} If the JWT cannot be decoded.
1061
+ * @throws {JwtParseError} If the JWT cannot be decoded.
1074
1062
  * @throws {Oauth2JwtVerificationError} If signature verification fails.
1075
1063
  */
1076
1064
  declare function verifyWalletAttestationJwt$2(options: VerifyWalletAttestationJwtOptionsV1_3): Promise<{
@@ -1161,12 +1149,12 @@ declare function verifyWalletAttestationJwt$2(options: VerifyWalletAttestationJw
1161
1149
  } | undefined;
1162
1150
  wallet_link?: string | undefined;
1163
1151
  wallet_name?: string | undefined;
1164
- aud?: string | undefined;
1152
+ aud?: string | string[] | undefined;
1165
1153
  jti?: string | undefined;
1166
1154
  nonce?: string | undefined;
1167
1155
  trust_chain?: [string, ...string[]] | undefined;
1168
1156
  };
1169
- signer: _openid4vc_oauth2.JwtSignerWithJwk;
1157
+ signer: _pagopa_io_wallet_utils.JwtSignerWithJwk;
1170
1158
  }>;
1171
1159
 
1172
1160
  interface VerifyWalletAttestationJwtOptionsV1_4 extends BaseVerifyWalletAttestationJwtOptions {
@@ -1179,7 +1167,7 @@ type VerifiedWalletAttestationJwtV1_4 = Awaited<ReturnType<typeof verifyWalletAt
1179
1167
  * @param options - v1.4 verification options.
1180
1168
  * @returns Decoded and verified wallet attestation JWT data.
1181
1169
  * @throws {ValidationError} If the JWT header or payload does not satisfy the v1.4 schema.
1182
- * @throws {Oauth2JwtParseError} If the JWT cannot be decoded.
1170
+ * @throws {JwtParseError} If the JWT cannot be decoded.
1183
1171
  * @throws {Oauth2JwtVerificationError} If signature verification fails.
1184
1172
  */
1185
1173
  declare function verifyWalletAttestationJwt$1(options: VerifyWalletAttestationJwtOptionsV1_4): Promise<{
@@ -1264,13 +1252,13 @@ declare function verifyWalletAttestationJwt$1(options: VerifyWalletAttestationJw
1264
1252
  wallet_link: string;
1265
1253
  wallet_name: string;
1266
1254
  nbf?: number | undefined;
1267
- aud?: string | undefined;
1255
+ aud?: string | string[] | undefined;
1268
1256
  jti?: string | undefined;
1269
1257
  nonce?: string | undefined;
1270
1258
  status?: Record<string, any> | undefined;
1271
1259
  trust_chain?: [string, ...string[]] | undefined;
1272
1260
  };
1273
- signer: _openid4vc_oauth2.JwtSignerWithJwk;
1261
+ signer: _pagopa_io_wallet_utils.JwtSignerWithJwk;
1274
1262
  }>;
1275
1263
 
1276
1264
  type VerifiedWalletAttestationJwt = VerifiedWalletAttestationJwtV1_0 | VerifiedWalletAttestationJwtV1_3 | VerifiedWalletAttestationJwtV1_4;
@@ -1281,7 +1269,7 @@ type VerifyWalletAttestationJwtOptions = VerifyWalletAttestationJwtOptionsV1_0 |
1281
1269
  * @param options - Version-specific wallet attestation verification options.
1282
1270
  * @returns Decoded and verified wallet attestation data for the configured version.
1283
1271
  * @throws {ValidationError} If JWT header or payload validation fails.
1284
- * @throws {Oauth2JwtParseError} If the attestation JWT cannot be decoded.
1272
+ * @throws {JwtParseError} If the attestation JWT cannot be decoded.
1285
1273
  * @throws {Oauth2JwtVerificationError} If signature verification fails.
1286
1274
  * @throws {ItWalletSpecsVersionError} If the configured version is unsupported.
1287
1275
  */
@@ -1397,7 +1385,7 @@ interface VerifyAccessTokenRequestOptions {
1397
1385
  /**
1398
1386
  * The authorization server metadata
1399
1387
  */
1400
- authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
1388
+ authorizationServerMetadata: BaseAuthorizationServerMetadata;
1401
1389
  /**
1402
1390
  * Callbacks used during verification
1403
1391
  */
@@ -1437,7 +1425,7 @@ interface VerifyAccessTokenRequestOptions {
1437
1425
  /**
1438
1426
  * The HTTP request information
1439
1427
  */
1440
- request: RequestLike$1;
1428
+ request: RequestLike;
1441
1429
  }
1442
1430
  interface VerifyAccessTokenRequestResult {
1443
1431
  clientAttestation: {
@@ -1492,106 +1480,106 @@ interface VerifyAccessTokenRequestResult {
1492
1480
  */
1493
1481
  declare function verifyAccessTokenRequest(options: VerifyAccessTokenRequestOptions): Promise<VerifyAccessTokenRequestResult>;
1494
1482
 
1495
- declare const zAuthorizationRequestV1_0: z.ZodObject<{
1496
- authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
1497
- credential_configuration_id: z.ZodString;
1498
- type: z.ZodLiteral<"openid_credential">;
1499
- }, z.core.$strip>, z.ZodObject<{
1500
- challenge_method: z.ZodLiteral<"mrtd+ias">;
1501
- challenge_redirect_uri: z.ZodURL;
1502
- idphinting: z.ZodURL;
1503
- type: z.ZodLiteral<"it_l2+document_proof">;
1504
- }, z.core.$strip>], "type">>>;
1505
- client_id: z.ZodString;
1506
- code_challenge: z.ZodString;
1507
- code_challenge_method: z.ZodString;
1508
- issuer_state: z.ZodOptional<z.ZodString>;
1509
- jti: z.ZodString;
1510
- redirect_uri: z.ZodURL;
1511
- response_type: z.ZodString;
1512
- scope: z.ZodOptional<z.ZodString>;
1513
- state: z.ZodString;
1514
- response_mode: z.ZodString;
1515
- }, z.core.$loose>;
1516
- type AuthorizationRequestV1_0 = z.infer<typeof zAuthorizationRequestV1_0>;
1517
- declare const zAuthorizationRequestV1_3: z.ZodObject<{
1518
- authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
1519
- credential_configuration_id: z.ZodString;
1520
- type: z.ZodLiteral<"openid_credential">;
1521
- }, z.core.$strip>, z.ZodObject<{
1522
- challenge_method: z.ZodLiteral<"mrtd+ias">;
1523
- challenge_redirect_uri: z.ZodURL;
1524
- idphinting: z.ZodURL;
1525
- type: z.ZodLiteral<"it_l2+document_proof">;
1526
- }, z.core.$strip>], "type">>>;
1527
- client_id: z.ZodString;
1528
- code_challenge: z.ZodString;
1529
- code_challenge_method: z.ZodString;
1530
- issuer_state: z.ZodOptional<z.ZodString>;
1531
- jti: z.ZodString;
1532
- redirect_uri: z.ZodURL;
1533
- response_type: z.ZodString;
1534
- scope: z.ZodOptional<z.ZodString>;
1535
- state: z.ZodString;
1536
- }, z.core.$loose>;
1537
- type AuthorizationRequestV1_3 = z.infer<typeof zAuthorizationRequestV1_3>;
1538
- declare const zPushedAuthorizationRequestSigned: z.ZodObject<{
1539
- client_id: z.ZodString;
1540
- pkceCodeVerifier: z.ZodString;
1541
- request: z.ZodString;
1542
- }, z.core.$loose>;
1543
- type PushedAuthorizationRequestSigned = z.infer<typeof zPushedAuthorizationRequestSigned>;
1544
- declare const zPushedAuthorizationRequestUnsignedV1_0: z.ZodObject<{
1545
- authorizationRequest: z.ZodObject<{
1546
- authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
1547
- credential_configuration_id: z.ZodString;
1548
- type: z.ZodLiteral<"openid_credential">;
1549
- }, z.core.$strip>, z.ZodObject<{
1550
- challenge_method: z.ZodLiteral<"mrtd+ias">;
1551
- challenge_redirect_uri: z.ZodURL;
1552
- idphinting: z.ZodURL;
1553
- type: z.ZodLiteral<"it_l2+document_proof">;
1554
- }, z.core.$strip>], "type">>>;
1555
- client_id: z.ZodString;
1556
- code_challenge: z.ZodString;
1557
- code_challenge_method: z.ZodString;
1558
- issuer_state: z.ZodOptional<z.ZodString>;
1559
- jti: z.ZodString;
1560
- redirect_uri: z.ZodURL;
1561
- response_type: z.ZodString;
1562
- scope: z.ZodOptional<z.ZodString>;
1563
- state: z.ZodString;
1564
- response_mode: z.ZodString;
1565
- }, z.core.$loose>;
1566
- client_id: z.ZodString;
1567
- pkceCodeVerifier: z.ZodString;
1568
- }, z.core.$loose>;
1569
- type PushedAuthorizationRequestUnsignedV1_0 = z.infer<typeof zPushedAuthorizationRequestUnsignedV1_0>;
1570
- declare const zPushedAuthorizationRequestUnsignedV1_3: z.ZodObject<{
1571
- authorizationRequest: z.ZodObject<{
1572
- authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
1573
- credential_configuration_id: z.ZodString;
1574
- type: z.ZodLiteral<"openid_credential">;
1575
- }, z.core.$strip>, z.ZodObject<{
1576
- challenge_method: z.ZodLiteral<"mrtd+ias">;
1577
- challenge_redirect_uri: z.ZodURL;
1578
- idphinting: z.ZodURL;
1579
- type: z.ZodLiteral<"it_l2+document_proof">;
1580
- }, z.core.$strip>], "type">>>;
1581
- client_id: z.ZodString;
1582
- code_challenge: z.ZodString;
1583
- code_challenge_method: z.ZodString;
1584
- issuer_state: z.ZodOptional<z.ZodString>;
1585
- jti: z.ZodString;
1586
- redirect_uri: z.ZodURL;
1587
- response_type: z.ZodString;
1588
- scope: z.ZodOptional<z.ZodString>;
1589
- state: z.ZodString;
1590
- }, z.core.$loose>;
1591
- client_id: z.ZodString;
1592
- pkceCodeVerifier: z.ZodString;
1593
- }, z.core.$loose>;
1594
- type PushedAuthorizationRequestUnsignedV1_3 = z.infer<typeof zPushedAuthorizationRequestUnsignedV1_3>;
1483
+ declare const zAuthorizationRequestV1_0: z$1.ZodObject<{
1484
+ authorization_details: z$1.ZodOptional<z$1.ZodArray<z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
1485
+ credential_configuration_id: z$1.ZodString;
1486
+ type: z$1.ZodLiteral<"openid_credential">;
1487
+ }, z$1.core.$strip>, z$1.ZodObject<{
1488
+ challenge_method: z$1.ZodLiteral<"mrtd+ias">;
1489
+ challenge_redirect_uri: z$1.ZodURL;
1490
+ idphinting: z$1.ZodURL;
1491
+ type: z$1.ZodLiteral<"it_l2+document_proof">;
1492
+ }, z$1.core.$strip>], "type">>>;
1493
+ client_id: z$1.ZodString;
1494
+ code_challenge: z$1.ZodString;
1495
+ code_challenge_method: z$1.ZodString;
1496
+ issuer_state: z$1.ZodOptional<z$1.ZodString>;
1497
+ jti: z$1.ZodString;
1498
+ redirect_uri: z$1.ZodURL;
1499
+ response_type: z$1.ZodString;
1500
+ scope: z$1.ZodOptional<z$1.ZodString>;
1501
+ state: z$1.ZodString;
1502
+ response_mode: z$1.ZodString;
1503
+ }, z$1.core.$loose>;
1504
+ type AuthorizationRequestV1_0 = z$1.infer<typeof zAuthorizationRequestV1_0>;
1505
+ declare const zAuthorizationRequestV1_3: z$1.ZodObject<{
1506
+ authorization_details: z$1.ZodOptional<z$1.ZodArray<z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
1507
+ credential_configuration_id: z$1.ZodString;
1508
+ type: z$1.ZodLiteral<"openid_credential">;
1509
+ }, z$1.core.$strip>, z$1.ZodObject<{
1510
+ challenge_method: z$1.ZodLiteral<"mrtd+ias">;
1511
+ challenge_redirect_uri: z$1.ZodURL;
1512
+ idphinting: z$1.ZodURL;
1513
+ type: z$1.ZodLiteral<"it_l2+document_proof">;
1514
+ }, z$1.core.$strip>], "type">>>;
1515
+ client_id: z$1.ZodString;
1516
+ code_challenge: z$1.ZodString;
1517
+ code_challenge_method: z$1.ZodString;
1518
+ issuer_state: z$1.ZodOptional<z$1.ZodString>;
1519
+ jti: z$1.ZodString;
1520
+ redirect_uri: z$1.ZodURL;
1521
+ response_type: z$1.ZodString;
1522
+ scope: z$1.ZodOptional<z$1.ZodString>;
1523
+ state: z$1.ZodString;
1524
+ }, z$1.core.$loose>;
1525
+ type AuthorizationRequestV1_3 = z$1.infer<typeof zAuthorizationRequestV1_3>;
1526
+ declare const zPushedAuthorizationRequestSigned: z$1.ZodObject<{
1527
+ client_id: z$1.ZodString;
1528
+ pkceCodeVerifier: z$1.ZodString;
1529
+ request: z$1.ZodString;
1530
+ }, z$1.core.$loose>;
1531
+ type PushedAuthorizationRequestSigned = z$1.infer<typeof zPushedAuthorizationRequestSigned>;
1532
+ declare const zPushedAuthorizationRequestUnsignedV1_0: z$1.ZodObject<{
1533
+ authorizationRequest: z$1.ZodObject<{
1534
+ authorization_details: z$1.ZodOptional<z$1.ZodArray<z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
1535
+ credential_configuration_id: z$1.ZodString;
1536
+ type: z$1.ZodLiteral<"openid_credential">;
1537
+ }, z$1.core.$strip>, z$1.ZodObject<{
1538
+ challenge_method: z$1.ZodLiteral<"mrtd+ias">;
1539
+ challenge_redirect_uri: z$1.ZodURL;
1540
+ idphinting: z$1.ZodURL;
1541
+ type: z$1.ZodLiteral<"it_l2+document_proof">;
1542
+ }, z$1.core.$strip>], "type">>>;
1543
+ client_id: z$1.ZodString;
1544
+ code_challenge: z$1.ZodString;
1545
+ code_challenge_method: z$1.ZodString;
1546
+ issuer_state: z$1.ZodOptional<z$1.ZodString>;
1547
+ jti: z$1.ZodString;
1548
+ redirect_uri: z$1.ZodURL;
1549
+ response_type: z$1.ZodString;
1550
+ scope: z$1.ZodOptional<z$1.ZodString>;
1551
+ state: z$1.ZodString;
1552
+ response_mode: z$1.ZodString;
1553
+ }, z$1.core.$loose>;
1554
+ client_id: z$1.ZodString;
1555
+ pkceCodeVerifier: z$1.ZodString;
1556
+ }, z$1.core.$loose>;
1557
+ type PushedAuthorizationRequestUnsignedV1_0 = z$1.infer<typeof zPushedAuthorizationRequestUnsignedV1_0>;
1558
+ declare const zPushedAuthorizationRequestUnsignedV1_3: z$1.ZodObject<{
1559
+ authorizationRequest: z$1.ZodObject<{
1560
+ authorization_details: z$1.ZodOptional<z$1.ZodArray<z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
1561
+ credential_configuration_id: z$1.ZodString;
1562
+ type: z$1.ZodLiteral<"openid_credential">;
1563
+ }, z$1.core.$strip>, z$1.ZodObject<{
1564
+ challenge_method: z$1.ZodLiteral<"mrtd+ias">;
1565
+ challenge_redirect_uri: z$1.ZodURL;
1566
+ idphinting: z$1.ZodURL;
1567
+ type: z$1.ZodLiteral<"it_l2+document_proof">;
1568
+ }, z$1.core.$strip>], "type">>>;
1569
+ client_id: z$1.ZodString;
1570
+ code_challenge: z$1.ZodString;
1571
+ code_challenge_method: z$1.ZodString;
1572
+ issuer_state: z$1.ZodOptional<z$1.ZodString>;
1573
+ jti: z$1.ZodString;
1574
+ redirect_uri: z$1.ZodURL;
1575
+ response_type: z$1.ZodString;
1576
+ scope: z$1.ZodOptional<z$1.ZodString>;
1577
+ state: z$1.ZodString;
1578
+ }, z$1.core.$loose>;
1579
+ client_id: z$1.ZodString;
1580
+ pkceCodeVerifier: z$1.ZodString;
1581
+ }, z$1.core.$loose>;
1582
+ type PushedAuthorizationRequestUnsignedV1_3 = z$1.infer<typeof zPushedAuthorizationRequestUnsignedV1_3>;
1595
1583
  /**
1596
1584
  * Union type for Pushed Authorization Request - can be either signed (JAR) or unsigned.
1597
1585
  * The variant depends on the Authorization Server's require_signed_request_object metadata.
@@ -1611,11 +1599,11 @@ declare function isPushedAuthorizationRequestSigned(par: PushedAuthorizationRequ
1611
1599
  * @returns True when the request contains version-specific `authorizationRequest` data.
1612
1600
  */
1613
1601
  declare function isPushedAuthorizationRequestUnsigned(par: PushedAuthorizationRequest): par is PushedAuthorizationRequestUnsignedV1_0 | PushedAuthorizationRequestUnsignedV1_3;
1614
- declare const zPushedAuthorizationResponse: z.ZodObject<{
1615
- expires_in: z.ZodNumber;
1616
- request_uri: z.ZodString;
1617
- }, z.core.$loose>;
1618
- type PushedAuthorizationResponse = z.infer<typeof zPushedAuthorizationResponse>;
1602
+ declare const zPushedAuthorizationResponse: z$1.ZodObject<{
1603
+ expires_in: z$1.ZodNumber;
1604
+ request_uri: z$1.ZodString;
1605
+ }, z$1.core.$loose>;
1606
+ type PushedAuthorizationResponse = z$1.infer<typeof zPushedAuthorizationResponse>;
1619
1607
 
1620
1608
  type AuthorizationRequest$1 = AuthorizationRequestV1_0 | AuthorizationRequestV1_3;
1621
1609
  interface BaseCreatePushedAuthorizationRequestOptions<V extends ItWalletSpecsVersion> {
@@ -1646,7 +1634,7 @@ interface BaseCreatePushedAuthorizationRequestOptions<V extends ItWalletSpecsVer
1646
1634
  * MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Attestation.
1647
1635
  */
1648
1636
  clientId: string;
1649
- codeChallengeMethodsSupported: ItWalletAuthorizationServerMetadata["code_challenge_methods_supported"];
1637
+ codeChallengeMethodsSupported: BaseAuthorizationServerMetadata["code_challenge_methods_supported"];
1650
1638
  config: IoWalletSdkConfig<V>;
1651
1639
  /**
1652
1640
  * DPoP options. Required when `require_signed_request_object` is `true`
@@ -1877,7 +1865,7 @@ interface fetchPushedAuthorizationResponseOptions {
1877
1865
  declare function fetchPushedAuthorizationResponse(options: fetchPushedAuthorizationResponseOptions): Promise<PushedAuthorizationResponse>;
1878
1866
 
1879
1867
  interface ParseAuthorizationRequestOptions {
1880
- request: RequestLike$1;
1868
+ request: RequestLike;
1881
1869
  }
1882
1870
  interface ParseAuthorizationRequestResult {
1883
1871
  /**
@@ -1920,7 +1908,7 @@ interface ParsePushedAuthorizationRequestOptions {
1920
1908
  authorizationRequest: unknown;
1921
1909
  callbacks: Pick<CallbackContext, "fetch">;
1922
1910
  config: IoWalletSdkConfig;
1923
- request: RequestLike$1;
1911
+ request: RequestLike;
1924
1912
  }
1925
1913
  interface ParsePushedAuthorizationRequestResult extends ParseAuthorizationRequestResult {
1926
1914
  authorizationRequest: AuthorizationRequest;
@@ -1990,7 +1978,7 @@ interface VerifyAuthorizationRequestOptions {
1990
1978
  authorizationRequest: {
1991
1979
  client_id?: string;
1992
1980
  };
1993
- authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
1981
+ authorizationServerMetadata: BaseAuthorizationServerMetadata;
1994
1982
  callbacks: Pick<CallbackContext, "hash" | "verifyJwt">;
1995
1983
  clientAttestation: ClientAttestationOptions;
1996
1984
  config: IoWalletSdkConfig;
@@ -2002,7 +1990,7 @@ interface VerifyAuthorizationRequestOptions {
2002
1990
  * @default new Date()
2003
1991
  */
2004
1992
  now?: Date;
2005
- request: RequestLike$1;
1993
+ request: RequestLike;
2006
1994
  }
2007
1995
  /**
2008
1996
  * Verifies an authorization request by validating DPoP and client attestation credentials.
@@ -2060,387 +2048,151 @@ interface VerifyAuthorizationRequestOptions {
2060
2048
  */
2061
2049
  declare function verifyAuthorizationRequest(options: VerifyAuthorizationRequestOptions): Promise<VerifyAuthorizationRequestResult>;
2062
2050
 
2063
- declare const zTrustChain: z.ZodTuple<[z.ZodString], z.ZodString>;
2064
- type TrustChain = z.infer<typeof zTrustChain>;
2065
- declare const zCertificateChain: z.ZodArray<z.ZodString>;
2066
- type CertificateChain = z.infer<typeof zCertificateChain>;
2067
- declare const zAlgValueNotNone: z.ZodString;
2068
- interface RequestLike {
2069
- headers: FetchHeaders;
2070
- method: HttpMethod;
2071
- url: string;
2072
- }
2051
+ declare const zJarAuthorizationRequest: z$1.ZodObject<{
2052
+ client_id: z$1.ZodOptional<z$1.ZodString>;
2053
+ request: z$1.ZodOptional<z$1.ZodString>;
2054
+ request_uri: z$1.ZodOptional<z$1.ZodURL>;
2055
+ }, z$1.core.$loose>;
2056
+ type JarAuthorizationRequest = z$1.infer<typeof zJarAuthorizationRequest>;
2057
+ declare const zJarRequestObjectPayload: z$1.ZodObject<{
2058
+ client_id: z$1.ZodString;
2059
+ aud: z$1.ZodOptional<z$1.ZodUnion<[z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>;
2060
+ cnf: z$1.ZodOptional<z$1.ZodObject<{
2061
+ jkt: z$1.ZodOptional<z$1.ZodString>;
2062
+ jwk: z$1.ZodOptional<z$1.ZodObject<{
2063
+ alg: z$1.ZodOptional<z$1.ZodString>;
2064
+ crv: z$1.ZodOptional<z$1.ZodString>;
2065
+ d: z$1.ZodOptional<z$1.ZodString>;
2066
+ dp: z$1.ZodOptional<z$1.ZodString>;
2067
+ dq: z$1.ZodOptional<z$1.ZodString>;
2068
+ e: z$1.ZodOptional<z$1.ZodString>;
2069
+ ext: z$1.ZodOptional<z$1.ZodBoolean>;
2070
+ k: z$1.ZodOptional<z$1.ZodString>;
2071
+ key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2072
+ kid: z$1.ZodOptional<z$1.ZodString>;
2073
+ kty: z$1.ZodString;
2074
+ n: z$1.ZodOptional<z$1.ZodString>;
2075
+ oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
2076
+ d: z$1.ZodOptional<z$1.ZodString>;
2077
+ r: z$1.ZodOptional<z$1.ZodString>;
2078
+ t: z$1.ZodOptional<z$1.ZodString>;
2079
+ }, z$1.core.$loose>>>;
2080
+ p: z$1.ZodOptional<z$1.ZodString>;
2081
+ q: z$1.ZodOptional<z$1.ZodString>;
2082
+ qi: z$1.ZodOptional<z$1.ZodString>;
2083
+ use: z$1.ZodOptional<z$1.ZodString>;
2084
+ x: z$1.ZodOptional<z$1.ZodString>;
2085
+ x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2086
+ x5t: z$1.ZodOptional<z$1.ZodString>;
2087
+ "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
2088
+ x5u: z$1.ZodOptional<z$1.ZodString>;
2089
+ y: z$1.ZodOptional<z$1.ZodString>;
2090
+ }, z$1.core.$loose>>;
2091
+ }, z$1.core.$loose>>;
2092
+ exp: z$1.ZodOptional<z$1.ZodNumber>;
2093
+ iat: z$1.ZodOptional<z$1.ZodNumber>;
2094
+ iss: z$1.ZodOptional<z$1.ZodString>;
2095
+ jti: z$1.ZodOptional<z$1.ZodString>;
2096
+ nbf: z$1.ZodOptional<z$1.ZodNumber>;
2097
+ nonce: z$1.ZodOptional<z$1.ZodString>;
2098
+ status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
2099
+ sub: z$1.ZodOptional<z$1.ZodString>;
2100
+ trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
2101
+ }, z$1.core.$loose>;
2102
+ type JarRequestObjectPayload = z$1.infer<typeof zJarRequestObjectPayload>;
2103
+ declare const zSignedAuthorizationRequestJwtHeaderTyp: z$1.ZodLiteral<"oauth-authz-req+jwt">;
2104
+ declare const zJarRequestObjectHeader: z$1.ZodObject<{
2105
+ typ: z$1.ZodLiteral<"oauth-authz-req+jwt">;
2106
+ alg: z$1.ZodString;
2107
+ jwk: z$1.ZodOptional<z$1.ZodObject<{
2108
+ alg: z$1.ZodOptional<z$1.ZodString>;
2109
+ crv: z$1.ZodOptional<z$1.ZodString>;
2110
+ d: z$1.ZodOptional<z$1.ZodString>;
2111
+ dp: z$1.ZodOptional<z$1.ZodString>;
2112
+ dq: z$1.ZodOptional<z$1.ZodString>;
2113
+ e: z$1.ZodOptional<z$1.ZodString>;
2114
+ ext: z$1.ZodOptional<z$1.ZodBoolean>;
2115
+ k: z$1.ZodOptional<z$1.ZodString>;
2116
+ key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2117
+ kid: z$1.ZodOptional<z$1.ZodString>;
2118
+ kty: z$1.ZodString;
2119
+ n: z$1.ZodOptional<z$1.ZodString>;
2120
+ oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
2121
+ d: z$1.ZodOptional<z$1.ZodString>;
2122
+ r: z$1.ZodOptional<z$1.ZodString>;
2123
+ t: z$1.ZodOptional<z$1.ZodString>;
2124
+ }, z$1.core.$loose>>>;
2125
+ p: z$1.ZodOptional<z$1.ZodString>;
2126
+ q: z$1.ZodOptional<z$1.ZodString>;
2127
+ qi: z$1.ZodOptional<z$1.ZodString>;
2128
+ use: z$1.ZodOptional<z$1.ZodString>;
2129
+ x: z$1.ZodOptional<z$1.ZodString>;
2130
+ x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2131
+ x5t: z$1.ZodOptional<z$1.ZodString>;
2132
+ "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
2133
+ x5u: z$1.ZodOptional<z$1.ZodString>;
2134
+ y: z$1.ZodOptional<z$1.ZodString>;
2135
+ }, z$1.core.$loose>>;
2136
+ kid: z$1.ZodOptional<z$1.ZodString>;
2137
+ trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
2138
+ x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2139
+ }, z$1.core.$loose>;
2140
+ type JarRequestObjectHeader = z$1.infer<typeof zJarRequestObjectHeader>;
2141
+ declare const signedAuthorizationRequestJwtHeaderTyp: "oauth-authz-req+jwt";
2142
+ declare const jwtAuthorizationRequestJwtHeaderTyp: "jwt";
2073
2143
 
2074
- declare const MAX_JTI_LENGTH = 256;
2075
- interface JwtSignerDid {
2076
- alg: string;
2077
- didUrl: string;
2078
- /**
2079
- * The key id that should be used for signing. You need to make sure the kid actually matches
2080
- * with the key associated with the didUrl.
2081
- */
2082
- kid?: string;
2083
- method: "did";
2144
+ interface VerifyJarRequestOptions {
2145
+ authorizationRequestJwt: string;
2146
+ callbacks: Pick<CallbackContext, "verifyJwt">;
2147
+ jarRequestParams: {
2148
+ client_id?: string;
2149
+ };
2150
+ jwtSigner: JwtSigner;
2151
+ now?: Date;
2084
2152
  }
2085
- interface JwtSignerJwk {
2086
- alg: string;
2087
- /**
2088
- * The key id that should be used for signing. You need to make sure the kid actually matches
2089
- * with the key associated with the jwk.
2090
- *
2091
- * If not provided the kid can also be extracted from the `publicJwk`. Providing it here means the `kid` won't
2092
- * be included in the JWT header.
2093
- */
2094
- kid?: string;
2095
- method: "jwk";
2096
- publicJwk: Jwk;
2153
+ interface VerifiedJarRequest {
2154
+ authorizationRequestPayload: JarRequestObjectPayload;
2155
+ jwt: {
2156
+ payload: JarRequestObjectPayload;
2157
+ } & Omit<ReturnType<typeof decodeJwt>, "payload">;
2158
+ signer: JwtSignerWithJwk;
2097
2159
  }
2098
- interface JwtSignerX5c {
2099
- alg: string;
2160
+ /**
2161
+ * Verifies a JAR (JWT Secured Authorization Request) request by validating and verifying signatures.
2162
+ *
2163
+ * @param options - The input parameters
2164
+ * @param options.jarRequestParams - The JAR authorization request parameters
2165
+ * @param options.callbacks - Context containing the relevant Jose crypto operations
2166
+ * @returns The verified authorization request parameters and metadata
2167
+ */
2168
+ declare function verifyJarRequest(options: VerifyJarRequestOptions): Promise<VerifiedJarRequest>;
2169
+
2170
+ interface VerifyPushedAuthorizationRequestReturn extends VerifyAuthorizationRequestResult {
2100
2171
  /**
2101
- * The key id that should be used for signing. You need to make sure the kid actually matches
2102
- * with the key associated with the leaf certificate.
2172
+ * The verified JAR request, if `authorizationRequestJwt` was provided
2103
2173
  */
2104
- kid?: string;
2105
- method: "x5c";
2106
- trustChain?: TrustChain;
2107
- x5c: string[];
2174
+ jar?: VerifiedJarRequest;
2108
2175
  }
2109
- interface JwtSignerFederation {
2110
- alg: string;
2176
+ interface VerifyPushedAuthorizationRequestOptions extends Omit<VerifyAuthorizationRequestOptions, "authorizationServerMetadata"> {
2111
2177
  /**
2112
- * The key id that should be used for signing. You need to make sure the kid actually matches
2113
- * with a key present in the federation.
2178
+ * The authorization request JWT to verify. If this value was returned from `parsePushedAuthorizationRequest`
2179
+ * you MUST provide this value to ensure the JWT is verified.
2114
2180
  */
2115
- kid: string;
2116
- method: "federation";
2117
- trustChain?: TrustChain;
2118
- }
2119
- interface JwtSignerCustom {
2120
- alg: string;
2181
+ authorizationRequestJwt?: {
2182
+ jwt: string;
2183
+ signer: JwtSigner;
2184
+ };
2121
2185
  /**
2122
- * The key id that should be used for signing.
2186
+ * Authorization Server metadata for enforcing JAR signing policy.
2187
+ * Includes standard Authorization Server metadata plus require_signed_request_object.
2188
+ * When require_signed_request_object is true, the server will reject unsigned requests.
2189
+ * Defaults to false (permissive) if not provided.
2190
+ *
2191
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.5 RFC 9101 Section 10.5}
2123
2192
  */
2124
- kid?: string;
2125
- method: "custom";
2126
- }
2127
- type JwtSigner = JwtSignerCustom | JwtSignerDid | JwtSignerFederation | JwtSignerJwk | JwtSignerX5c;
2128
- type JwtSignerWithJwk = {
2129
- publicJwk: Jwk;
2130
- } & JwtSigner;
2131
- type JweEncryptor = {
2132
- /**
2133
- * base64-url encoded apu
2134
- */
2135
- apu?: string;
2136
- /**
2137
- * base64-url encoded apv
2138
- */
2139
- apv?: string;
2140
- enc: string;
2141
- } & JwtSignerJwk;
2142
- declare const zCompactJwt: z.ZodString;
2143
- declare const zJwtConfirmationPayload: z.ZodObject<{
2144
- jkt: z.ZodOptional<z.ZodString>;
2145
- jwk: z.ZodOptional<z.ZodObject<{
2146
- alg: z.ZodOptional<z.ZodString>;
2147
- crv: z.ZodOptional<z.ZodString>;
2148
- d: z.ZodOptional<z.ZodString>;
2149
- dp: z.ZodOptional<z.ZodString>;
2150
- dq: z.ZodOptional<z.ZodString>;
2151
- e: z.ZodOptional<z.ZodString>;
2152
- ext: z.ZodOptional<z.ZodBoolean>;
2153
- k: z.ZodOptional<z.ZodString>;
2154
- key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
2155
- kid: z.ZodOptional<z.ZodString>;
2156
- kty: z.ZodString;
2157
- n: z.ZodOptional<z.ZodString>;
2158
- oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
2159
- d: z.ZodOptional<z.ZodString>;
2160
- r: z.ZodOptional<z.ZodString>;
2161
- t: z.ZodOptional<z.ZodString>;
2162
- }, z.core.$loose>>>;
2163
- p: z.ZodOptional<z.ZodString>;
2164
- q: z.ZodOptional<z.ZodString>;
2165
- qi: z.ZodOptional<z.ZodString>;
2166
- use: z.ZodOptional<z.ZodString>;
2167
- x: z.ZodOptional<z.ZodString>;
2168
- x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
2169
- x5t: z.ZodOptional<z.ZodString>;
2170
- "x5t#S256": z.ZodOptional<z.ZodString>;
2171
- x5u: z.ZodOptional<z.ZodString>;
2172
- y: z.ZodOptional<z.ZodString>;
2173
- }, z.core.$loose>>;
2174
- }, z.core.$loose>;
2175
- declare const zJwtPayload: z.ZodObject<{
2176
- aud: z.ZodOptional<z.ZodString>;
2177
- cnf: z.ZodOptional<z.ZodObject<{
2178
- jkt: z.ZodOptional<z.ZodString>;
2179
- jwk: z.ZodOptional<z.ZodObject<{
2180
- alg: z.ZodOptional<z.ZodString>;
2181
- crv: z.ZodOptional<z.ZodString>;
2182
- d: z.ZodOptional<z.ZodString>;
2183
- dp: z.ZodOptional<z.ZodString>;
2184
- dq: z.ZodOptional<z.ZodString>;
2185
- e: z.ZodOptional<z.ZodString>;
2186
- ext: z.ZodOptional<z.ZodBoolean>;
2187
- k: z.ZodOptional<z.ZodString>;
2188
- key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
2189
- kid: z.ZodOptional<z.ZodString>;
2190
- kty: z.ZodString;
2191
- n: z.ZodOptional<z.ZodString>;
2192
- oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
2193
- d: z.ZodOptional<z.ZodString>;
2194
- r: z.ZodOptional<z.ZodString>;
2195
- t: z.ZodOptional<z.ZodString>;
2196
- }, z.core.$loose>>>;
2197
- p: z.ZodOptional<z.ZodString>;
2198
- q: z.ZodOptional<z.ZodString>;
2199
- qi: z.ZodOptional<z.ZodString>;
2200
- use: z.ZodOptional<z.ZodString>;
2201
- x: z.ZodOptional<z.ZodString>;
2202
- x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
2203
- x5t: z.ZodOptional<z.ZodString>;
2204
- "x5t#S256": z.ZodOptional<z.ZodString>;
2205
- x5u: z.ZodOptional<z.ZodString>;
2206
- y: z.ZodOptional<z.ZodString>;
2207
- }, z.core.$loose>>;
2208
- }, z.core.$loose>>;
2209
- exp: z.ZodOptional<z.ZodNumber>;
2210
- iat: z.ZodOptional<z.ZodNumber>;
2211
- iss: z.ZodOptional<z.ZodString>;
2212
- jti: z.ZodOptional<z.ZodString>;
2213
- nbf: z.ZodOptional<z.ZodNumber>;
2214
- nonce: z.ZodOptional<z.ZodString>;
2215
- status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
2216
- trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
2217
- }, z.core.$loose>;
2218
- type JwtPayload = z.infer<typeof zJwtPayload>;
2219
- declare const zJwtHeader: z.ZodObject<{
2220
- alg: z.ZodString;
2221
- jwk: z.ZodOptional<z.ZodObject<{
2222
- alg: z.ZodOptional<z.ZodString>;
2223
- crv: z.ZodOptional<z.ZodString>;
2224
- d: z.ZodOptional<z.ZodString>;
2225
- dp: z.ZodOptional<z.ZodString>;
2226
- dq: z.ZodOptional<z.ZodString>;
2227
- e: z.ZodOptional<z.ZodString>;
2228
- ext: z.ZodOptional<z.ZodBoolean>;
2229
- k: z.ZodOptional<z.ZodString>;
2230
- key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
2231
- kid: z.ZodOptional<z.ZodString>;
2232
- kty: z.ZodString;
2233
- n: z.ZodOptional<z.ZodString>;
2234
- oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
2235
- d: z.ZodOptional<z.ZodString>;
2236
- r: z.ZodOptional<z.ZodString>;
2237
- t: z.ZodOptional<z.ZodString>;
2238
- }, z.core.$loose>>>;
2239
- p: z.ZodOptional<z.ZodString>;
2240
- q: z.ZodOptional<z.ZodString>;
2241
- qi: z.ZodOptional<z.ZodString>;
2242
- use: z.ZodOptional<z.ZodString>;
2243
- x: z.ZodOptional<z.ZodString>;
2244
- x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
2245
- x5t: z.ZodOptional<z.ZodString>;
2246
- "x5t#S256": z.ZodOptional<z.ZodString>;
2247
- x5u: z.ZodOptional<z.ZodString>;
2248
- y: z.ZodOptional<z.ZodString>;
2249
- }, z.core.$loose>>;
2250
- kid: z.ZodOptional<z.ZodString>;
2251
- trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
2252
- typ: z.ZodOptional<z.ZodString>;
2253
- x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
2254
- }, z.core.$loose>;
2255
- type JwtHeader = z.infer<typeof zJwtHeader>;
2256
-
2257
- interface DecodeJwtOptions<HeaderSchema extends BaseSchema | undefined, PayloadSchema extends BaseSchema | undefined> {
2258
- /**
2259
- * Optional prefix for error messages thrown during decoding, to provide more context on where the error occurred
2260
- */
2261
- errorMessagePrefix?: string;
2262
- /**
2263
- * Schema to use for validating the header. If not provided the
2264
- * default `zJwtHeader` schema will be used
2265
- */
2266
- headerSchema?: HeaderSchema;
2267
- /**
2268
- * The compact encoded jwt
2269
- */
2270
- jwt: string;
2271
- /**
2272
- * Schema to use for validating the payload. If not provided the
2273
- * default `zJwtPayload` schema will be used
2274
- */
2275
- payloadSchema?: PayloadSchema;
2276
- }
2277
- interface DecodeJwtResult<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined> {
2278
- header: InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;
2279
- payload: InferSchemaOrDefaultOutput<PayloadSchema, typeof zJwtPayload>;
2280
- signature: string;
2281
- }
2282
- /**
2283
- * Decodes a compact JWT and validates its header and payload with Zod schemas.
2284
- *
2285
- * This helper does not verify the JWT signature.
2286
- *
2287
- * @param options - Decode options.
2288
- * @param options.errorMessagePrefix - Optional context prefix for thrown parse/validation errors.
2289
- * @param options.headerSchema - Optional schema for the JWT header; defaults to `zJwtHeader`.
2290
- * @param options.jwt - Compact JWT to decode.
2291
- * @param options.payloadSchema - Optional schema for the JWT payload; defaults to `zJwtPayload`.
2292
- * @returns Decoded and schema-validated JWT header, payload, and signature segment.
2293
- * @throws {Oauth2JwtParseError} If the JWT shape or base64url JSON segments are invalid.
2294
- * @throws {ValidationError} If header or payload schema validation fails.
2295
- */
2296
- declare function decodeJwt<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined>(options: DecodeJwtOptions<HeaderSchema, PayloadSchema>): DecodeJwtResult<HeaderSchema, PayloadSchema>;
2297
- type IsSchemaProvided<T> = T extends undefined ? false : true;
2298
- type InferSchemaOrDefaultOutput<ProvidedSchema extends BaseSchema | undefined, DefaultSchema extends BaseSchema> = IsSchemaProvided<ProvidedSchema> extends true ? ProvidedSchema extends BaseSchema ? z.infer<ProvidedSchema> : never : z.infer<DefaultSchema>;
2299
-
2300
- declare const zJarAuthorizationRequest: z.ZodObject<{
2301
- client_id: z.ZodOptional<z.ZodString>;
2302
- request: z.ZodOptional<z.ZodString>;
2303
- request_uri: z.ZodOptional<z.ZodURL>;
2304
- }, z.core.$loose>;
2305
- type JarAuthorizationRequest = z.infer<typeof zJarAuthorizationRequest>;
2306
- declare const zJarRequestObjectPayload: z.ZodObject<{
2307
- client_id: z.ZodString;
2308
- aud: z.ZodOptional<z.ZodString>;
2309
- cnf: z.ZodOptional<z.ZodObject<{
2310
- jkt: z.ZodOptional<z.ZodString>;
2311
- jwk: z.ZodOptional<z.ZodObject<{
2312
- alg: z.ZodOptional<z.ZodString>;
2313
- crv: z.ZodOptional<z.ZodString>;
2314
- d: z.ZodOptional<z.ZodString>;
2315
- dp: z.ZodOptional<z.ZodString>;
2316
- dq: z.ZodOptional<z.ZodString>;
2317
- e: z.ZodOptional<z.ZodString>;
2318
- ext: z.ZodOptional<z.ZodBoolean>;
2319
- k: z.ZodOptional<z.ZodString>;
2320
- key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
2321
- kid: z.ZodOptional<z.ZodString>;
2322
- kty: z.ZodString;
2323
- n: z.ZodOptional<z.ZodString>;
2324
- oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
2325
- d: z.ZodOptional<z.ZodString>;
2326
- r: z.ZodOptional<z.ZodString>;
2327
- t: z.ZodOptional<z.ZodString>;
2328
- }, z.core.$loose>>>;
2329
- p: z.ZodOptional<z.ZodString>;
2330
- q: z.ZodOptional<z.ZodString>;
2331
- qi: z.ZodOptional<z.ZodString>;
2332
- use: z.ZodOptional<z.ZodString>;
2333
- x: z.ZodOptional<z.ZodString>;
2334
- x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
2335
- x5t: z.ZodOptional<z.ZodString>;
2336
- "x5t#S256": z.ZodOptional<z.ZodString>;
2337
- x5u: z.ZodOptional<z.ZodString>;
2338
- y: z.ZodOptional<z.ZodString>;
2339
- }, z.core.$loose>>;
2340
- }, z.core.$loose>>;
2341
- exp: z.ZodOptional<z.ZodNumber>;
2342
- iat: z.ZodOptional<z.ZodNumber>;
2343
- iss: z.ZodOptional<z.ZodString>;
2344
- jti: z.ZodOptional<z.ZodString>;
2345
- nbf: z.ZodOptional<z.ZodNumber>;
2346
- nonce: z.ZodOptional<z.ZodString>;
2347
- status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
2348
- trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
2349
- }, z.core.$loose>;
2350
- type JarRequestObjectPayload = z.infer<typeof zJarRequestObjectPayload>;
2351
- declare const zSignedAuthorizationRequestJwtHeaderTyp: z.ZodLiteral<"oauth-authz-req+jwt">;
2352
- declare const zJarRequestObjectHeader: z.ZodObject<{
2353
- typ: z.ZodLiteral<"oauth-authz-req+jwt">;
2354
- alg: z.ZodString;
2355
- jwk: z.ZodOptional<z.ZodObject<{
2356
- alg: z.ZodOptional<z.ZodString>;
2357
- crv: z.ZodOptional<z.ZodString>;
2358
- d: z.ZodOptional<z.ZodString>;
2359
- dp: z.ZodOptional<z.ZodString>;
2360
- dq: z.ZodOptional<z.ZodString>;
2361
- e: z.ZodOptional<z.ZodString>;
2362
- ext: z.ZodOptional<z.ZodBoolean>;
2363
- k: z.ZodOptional<z.ZodString>;
2364
- key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
2365
- kid: z.ZodOptional<z.ZodString>;
2366
- kty: z.ZodString;
2367
- n: z.ZodOptional<z.ZodString>;
2368
- oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
2369
- d: z.ZodOptional<z.ZodString>;
2370
- r: z.ZodOptional<z.ZodString>;
2371
- t: z.ZodOptional<z.ZodString>;
2372
- }, z.core.$loose>>>;
2373
- p: z.ZodOptional<z.ZodString>;
2374
- q: z.ZodOptional<z.ZodString>;
2375
- qi: z.ZodOptional<z.ZodString>;
2376
- use: z.ZodOptional<z.ZodString>;
2377
- x: z.ZodOptional<z.ZodString>;
2378
- x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
2379
- x5t: z.ZodOptional<z.ZodString>;
2380
- "x5t#S256": z.ZodOptional<z.ZodString>;
2381
- x5u: z.ZodOptional<z.ZodString>;
2382
- y: z.ZodOptional<z.ZodString>;
2383
- }, z.core.$loose>>;
2384
- kid: z.ZodOptional<z.ZodString>;
2385
- trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
2386
- x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
2387
- }, z.core.$loose>;
2388
- type JarRequestObjectHeader = z.infer<typeof zJarRequestObjectHeader>;
2389
- declare const signedAuthorizationRequestJwtHeaderTyp: "oauth-authz-req+jwt";
2390
- declare const jwtAuthorizationRequestJwtHeaderTyp: "jwt";
2391
-
2392
- interface VerifyJarRequestOptions {
2393
- authorizationRequestJwt: string;
2394
- callbacks: Pick<CallbackContext, "verifyJwt">;
2395
- jarRequestParams: {
2396
- client_id?: string;
2397
- };
2398
- jwtSigner: JwtSigner$1;
2399
- now?: Date;
2400
- }
2401
- interface VerifiedJarRequest {
2402
- authorizationRequestPayload: JarRequestObjectPayload;
2403
- jwt: {
2404
- payload: JarRequestObjectPayload;
2405
- } & Omit<ReturnType<typeof decodeJwt>, "payload">;
2406
- signer: JwtSignerWithJwk$1;
2407
- }
2408
- /**
2409
- * Verifies a JAR (JWT Secured Authorization Request) request by validating and verifying signatures.
2410
- *
2411
- * @param options - The input parameters
2412
- * @param options.jarRequestParams - The JAR authorization request parameters
2413
- * @param options.callbacks - Context containing the relevant Jose crypto operations
2414
- * @returns The verified authorization request parameters and metadata
2415
- */
2416
- declare function verifyJarRequest(options: VerifyJarRequestOptions): Promise<VerifiedJarRequest>;
2417
-
2418
- interface VerifyPushedAuthorizationRequestReturn extends VerifyAuthorizationRequestResult {
2419
- /**
2420
- * The verified JAR request, if `authorizationRequestJwt` was provided
2421
- */
2422
- jar?: VerifiedJarRequest;
2423
- }
2424
- interface VerifyPushedAuthorizationRequestOptions extends Omit<VerifyAuthorizationRequestOptions, "authorizationServerMetadata"> {
2425
- /**
2426
- * The authorization request JWT to verify. If this value was returned from `parsePushedAuthorizationRequest`
2427
- * you MUST provide this value to ensure the JWT is verified.
2428
- */
2429
- authorizationRequestJwt?: {
2430
- jwt: string;
2431
- signer: JwtSigner$1;
2432
- };
2433
- /**
2434
- * Authorization Server metadata for enforcing JAR signing policy.
2435
- * Includes standard Authorization Server metadata plus require_signed_request_object.
2436
- * When require_signed_request_object is true, the server will reject unsigned requests.
2437
- * Defaults to false (permissive) if not provided.
2438
- *
2439
- * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.5 RFC 9101 Section 10.5}
2440
- */
2441
- authorizationServerMetadata: {
2442
- require_signed_request_object?: boolean;
2443
- } & VerifyAuthorizationRequestOptions["authorizationServerMetadata"];
2193
+ authorizationServerMetadata: {
2194
+ require_signed_request_object?: boolean;
2195
+ } & VerifyAuthorizationRequestOptions["authorizationServerMetadata"];
2444
2196
  }
2445
2197
  /**
2446
2198
  * Verifies a pushed authorization request (PAR) including JAR, DPoP, and client attestation.
@@ -2555,7 +2307,7 @@ type SupportedClientAuthenticationMethod = (typeof SupportedClientAuthentication
2555
2307
  */
2556
2308
  interface IsClientAttestationSupportedOptions {
2557
2309
  /** Authorization server metadata containing supported authentication methods. */
2558
- authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
2310
+ authorizationServerMetadata: BaseAuthorizationServerMetadata;
2559
2311
  }
2560
2312
  /**
2561
2313
  * Checks whether the authorization server supports client attestation authentication.
@@ -2566,39 +2318,8 @@ interface IsClientAttestationSupportedOptions {
2566
2318
  declare function isClientAttestationSupported(options: IsClientAttestationSupportedOptions): {
2567
2319
  supported: boolean;
2568
2320
  };
2569
- /**
2570
- * Options for client authentication
2571
- */
2572
- interface ClientAuthenticationCallbackOptions {
2573
- /**
2574
- * Metadata of the authorization server
2575
- */
2576
- authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
2577
- /**
2578
- * The body as a JSON object. If content type `x-www-form-urlencoded`
2579
- * is used, it will be encoded after this call.
2580
- *
2581
- * You can modify this object
2582
- */
2583
- body: Record<string, unknown>;
2584
- contentType: ContentType;
2585
- /**
2586
- * Headers for the request. You can modify this object
2587
- */
2588
- headers: FetchHeaders;
2589
- /**
2590
- * http method that will be used
2591
- */
2592
- method: HttpMethod;
2593
- /**
2594
- * URL to which the request will be made
2595
- */
2596
- url: string;
2597
- }
2598
- /**
2599
- * Callback method to determine the client authentication for a request.
2600
- */
2601
- type ClientAuthenticationCallback = (options: ClientAuthenticationCallbackOptions) => Promise<void> | void;
2321
+ type ClientAuthenticationCallbackOptions = ClientAuthenticationCallbackOptions$1<BaseAuthorizationServerMetadata>;
2322
+ type ClientAuthenticationCallback = ClientAuthenticationCallback$1<ClientAuthenticationCallbackOptions>;
2602
2323
  /**
2603
2324
  * Creates a client authentication callback that leaves the request unchanged.
2604
2325
  *
@@ -2630,42 +2351,42 @@ declare function clientAuthenticationWalletAttestationJwt<V extends ItWalletSpec
2630
2351
  * - trust_chain is REQUIRED
2631
2352
  * - x5c is NOT supported
2632
2353
  */
2633
- declare const zWalletAttestationJwtHeaderV1_0: z$1.ZodObject<{
2634
- trust_chain: z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>;
2635
- typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
2636
- alg: z$1.ZodString;
2637
- jwk: z$1.ZodOptional<z$1.ZodObject<{
2638
- alg: z$1.ZodOptional<z$1.ZodString>;
2639
- crv: z$1.ZodOptional<z$1.ZodString>;
2640
- d: z$1.ZodOptional<z$1.ZodString>;
2641
- dp: z$1.ZodOptional<z$1.ZodString>;
2642
- dq: z$1.ZodOptional<z$1.ZodString>;
2643
- e: z$1.ZodOptional<z$1.ZodString>;
2644
- ext: z$1.ZodOptional<z$1.ZodBoolean>;
2645
- k: z$1.ZodOptional<z$1.ZodString>;
2646
- key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2647
- kid: z$1.ZodOptional<z$1.ZodString>;
2648
- kty: z$1.ZodString;
2649
- n: z$1.ZodOptional<z$1.ZodString>;
2650
- oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
2651
- d: z$1.ZodOptional<z$1.ZodString>;
2652
- r: z$1.ZodOptional<z$1.ZodString>;
2653
- t: z$1.ZodOptional<z$1.ZodString>;
2654
- }, z$1.core.$loose>>>;
2655
- p: z$1.ZodOptional<z$1.ZodString>;
2656
- q: z$1.ZodOptional<z$1.ZodString>;
2657
- qi: z$1.ZodOptional<z$1.ZodString>;
2658
- use: z$1.ZodOptional<z$1.ZodString>;
2659
- x: z$1.ZodOptional<z$1.ZodString>;
2660
- x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2661
- x5t: z$1.ZodOptional<z$1.ZodString>;
2662
- "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
2663
- x5u: z$1.ZodOptional<z$1.ZodString>;
2664
- y: z$1.ZodOptional<z$1.ZodString>;
2665
- }, z$1.core.$loose>>;
2666
- kid: z$1.ZodOptional<z$1.ZodString>;
2667
- x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2668
- }, z$1.core.$loose>;
2354
+ declare const zWalletAttestationJwtHeaderV1_0: z.ZodObject<{
2355
+ trust_chain: z.ZodTuple<[z.ZodString], z.ZodString>;
2356
+ typ: z.ZodLiteral<"oauth-client-attestation+jwt">;
2357
+ alg: z.ZodString;
2358
+ jwk: z.ZodOptional<z.ZodObject<{
2359
+ alg: z.ZodOptional<z.ZodString>;
2360
+ crv: z.ZodOptional<z.ZodString>;
2361
+ d: z.ZodOptional<z.ZodString>;
2362
+ dp: z.ZodOptional<z.ZodString>;
2363
+ dq: z.ZodOptional<z.ZodString>;
2364
+ e: z.ZodOptional<z.ZodString>;
2365
+ ext: z.ZodOptional<z.ZodBoolean>;
2366
+ k: z.ZodOptional<z.ZodString>;
2367
+ key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
2368
+ kid: z.ZodOptional<z.ZodString>;
2369
+ kty: z.ZodString;
2370
+ n: z.ZodOptional<z.ZodString>;
2371
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
2372
+ d: z.ZodOptional<z.ZodString>;
2373
+ r: z.ZodOptional<z.ZodString>;
2374
+ t: z.ZodOptional<z.ZodString>;
2375
+ }, z.core.$loose>>>;
2376
+ p: z.ZodOptional<z.ZodString>;
2377
+ q: z.ZodOptional<z.ZodString>;
2378
+ qi: z.ZodOptional<z.ZodString>;
2379
+ use: z.ZodOptional<z.ZodString>;
2380
+ x: z.ZodOptional<z.ZodString>;
2381
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
2382
+ x5t: z.ZodOptional<z.ZodString>;
2383
+ "x5t#S256": z.ZodOptional<z.ZodString>;
2384
+ x5u: z.ZodOptional<z.ZodString>;
2385
+ y: z.ZodOptional<z.ZodString>;
2386
+ }, z.core.$loose>>;
2387
+ kid: z.ZodOptional<z.ZodString>;
2388
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
2389
+ }, z.core.$loose>;
2669
2390
  /**
2670
2391
  * JWT Payload schema for IT-Wallet v1.0 Wallet Attestation
2671
2392
  *
@@ -2673,54 +2394,54 @@ declare const zWalletAttestationJwtHeaderV1_0: z$1.ZodObject<{
2673
2394
  * - Standard claims only
2674
2395
  * - No nbf or status support
2675
2396
  */
2676
- declare const zWalletAttestationJwtPayloadV1_0: z$1.ZodObject<{
2677
- aal: z$1.ZodString;
2678
- cnf: z$1.ZodObject<{
2679
- jwk: z$1.ZodObject<{
2680
- alg: z$1.ZodOptional<z$1.ZodString>;
2681
- crv: z$1.ZodOptional<z$1.ZodString>;
2682
- d: z$1.ZodOptional<z$1.ZodString>;
2683
- dp: z$1.ZodOptional<z$1.ZodString>;
2684
- dq: z$1.ZodOptional<z$1.ZodString>;
2685
- e: z$1.ZodOptional<z$1.ZodString>;
2686
- ext: z$1.ZodOptional<z$1.ZodBoolean>;
2687
- k: z$1.ZodOptional<z$1.ZodString>;
2688
- key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2689
- kid: z$1.ZodOptional<z$1.ZodString>;
2690
- kty: z$1.ZodString;
2691
- n: z$1.ZodOptional<z$1.ZodString>;
2692
- oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
2693
- d: z$1.ZodOptional<z$1.ZodString>;
2694
- r: z$1.ZodOptional<z$1.ZodString>;
2695
- t: z$1.ZodOptional<z$1.ZodString>;
2696
- }, z$1.core.$loose>>>;
2697
- p: z$1.ZodOptional<z$1.ZodString>;
2698
- q: z$1.ZodOptional<z$1.ZodString>;
2699
- qi: z$1.ZodOptional<z$1.ZodString>;
2700
- use: z$1.ZodOptional<z$1.ZodString>;
2701
- x: z$1.ZodOptional<z$1.ZodString>;
2702
- x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2703
- x5t: z$1.ZodOptional<z$1.ZodString>;
2704
- "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
2705
- x5u: z$1.ZodOptional<z$1.ZodString>;
2706
- y: z$1.ZodOptional<z$1.ZodString>;
2707
- }, z$1.core.$loose>;
2708
- }, z$1.core.$strip>;
2709
- exp: z$1.ZodNumber;
2710
- iat: z$1.ZodNumber;
2711
- iss: z$1.ZodString;
2712
- sub: z$1.ZodString;
2713
- wallet_link: z$1.ZodOptional<z$1.ZodURL>;
2714
- wallet_name: z$1.ZodOptional<z$1.ZodString>;
2715
- aud: z$1.ZodOptional<z$1.ZodString>;
2716
- jti: z$1.ZodOptional<z$1.ZodString>;
2717
- nbf: z$1.ZodOptional<z$1.ZodNumber>;
2718
- nonce: z$1.ZodOptional<z$1.ZodString>;
2719
- status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
2720
- trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
2721
- }, z$1.core.$loose>;
2722
- /**
2723
- * Wallet Attestation JWT type for v1.0
2397
+ declare const zWalletAttestationJwtPayloadV1_0: z.ZodObject<{
2398
+ aal: z.ZodString;
2399
+ cnf: z.ZodObject<{
2400
+ jwk: z.ZodObject<{
2401
+ alg: z.ZodOptional<z.ZodString>;
2402
+ crv: z.ZodOptional<z.ZodString>;
2403
+ d: z.ZodOptional<z.ZodString>;
2404
+ dp: z.ZodOptional<z.ZodString>;
2405
+ dq: z.ZodOptional<z.ZodString>;
2406
+ e: z.ZodOptional<z.ZodString>;
2407
+ ext: z.ZodOptional<z.ZodBoolean>;
2408
+ k: z.ZodOptional<z.ZodString>;
2409
+ key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
2410
+ kid: z.ZodOptional<z.ZodString>;
2411
+ kty: z.ZodString;
2412
+ n: z.ZodOptional<z.ZodString>;
2413
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
2414
+ d: z.ZodOptional<z.ZodString>;
2415
+ r: z.ZodOptional<z.ZodString>;
2416
+ t: z.ZodOptional<z.ZodString>;
2417
+ }, z.core.$loose>>>;
2418
+ p: z.ZodOptional<z.ZodString>;
2419
+ q: z.ZodOptional<z.ZodString>;
2420
+ qi: z.ZodOptional<z.ZodString>;
2421
+ use: z.ZodOptional<z.ZodString>;
2422
+ x: z.ZodOptional<z.ZodString>;
2423
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
2424
+ x5t: z.ZodOptional<z.ZodString>;
2425
+ "x5t#S256": z.ZodOptional<z.ZodString>;
2426
+ x5u: z.ZodOptional<z.ZodString>;
2427
+ y: z.ZodOptional<z.ZodString>;
2428
+ }, z.core.$loose>;
2429
+ }, z.core.$strip>;
2430
+ exp: z.ZodNumber;
2431
+ iat: z.ZodNumber;
2432
+ iss: z.ZodString;
2433
+ sub: z.ZodString;
2434
+ wallet_link: z.ZodOptional<z.ZodURL>;
2435
+ wallet_name: z.ZodOptional<z.ZodString>;
2436
+ aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString>]>>;
2437
+ jti: z.ZodOptional<z.ZodString>;
2438
+ nbf: z.ZodOptional<z.ZodNumber>;
2439
+ nonce: z.ZodOptional<z.ZodString>;
2440
+ status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
2441
+ trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
2442
+ }, z.core.$loose>;
2443
+ /**
2444
+ * Wallet Attestation JWT type for v1.0
2724
2445
  * The JWT is returned as a compact string
2725
2446
  */
2726
2447
  type WalletAttestationJwtV1_0 = string;
@@ -2728,7 +2449,7 @@ type WalletAttestationJwtV1_0 = string;
2728
2449
  * Zod schema for wallet attestation JWT validation (v1.0)
2729
2450
  * Validates that the result is a non-empty string
2730
2451
  */
2731
- declare const zWalletAttestationJwtV1_0: z$1.ZodString;
2452
+ declare const zWalletAttestationJwtV1_0: z.ZodString;
2732
2453
 
2733
2454
  /**
2734
2455
  * Options for creating a wallet attestation with v1.0
@@ -2767,42 +2488,42 @@ declare const createWalletAttestationJwt$2: (options: WalletAttestationOptionsV1
2767
2488
  * - x5c is REQUIRED
2768
2489
  * - trust_chain is OPTIONAL
2769
2490
  */
2770
- declare const zWalletAttestationJwtHeaderV1_3: z$1.ZodObject<{
2771
- trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
2772
- typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
2773
- x5c: z$1.ZodArray<z$1.ZodString>;
2774
- alg: z$1.ZodString;
2775
- jwk: z$1.ZodOptional<z$1.ZodObject<{
2776
- alg: z$1.ZodOptional<z$1.ZodString>;
2777
- crv: z$1.ZodOptional<z$1.ZodString>;
2778
- d: z$1.ZodOptional<z$1.ZodString>;
2779
- dp: z$1.ZodOptional<z$1.ZodString>;
2780
- dq: z$1.ZodOptional<z$1.ZodString>;
2781
- e: z$1.ZodOptional<z$1.ZodString>;
2782
- ext: z$1.ZodOptional<z$1.ZodBoolean>;
2783
- k: z$1.ZodOptional<z$1.ZodString>;
2784
- key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2785
- kid: z$1.ZodOptional<z$1.ZodString>;
2786
- kty: z$1.ZodString;
2787
- n: z$1.ZodOptional<z$1.ZodString>;
2788
- oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
2789
- d: z$1.ZodOptional<z$1.ZodString>;
2790
- r: z$1.ZodOptional<z$1.ZodString>;
2791
- t: z$1.ZodOptional<z$1.ZodString>;
2792
- }, z$1.core.$loose>>>;
2793
- p: z$1.ZodOptional<z$1.ZodString>;
2794
- q: z$1.ZodOptional<z$1.ZodString>;
2795
- qi: z$1.ZodOptional<z$1.ZodString>;
2796
- use: z$1.ZodOptional<z$1.ZodString>;
2797
- x: z$1.ZodOptional<z$1.ZodString>;
2798
- x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2799
- x5t: z$1.ZodOptional<z$1.ZodString>;
2800
- "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
2801
- x5u: z$1.ZodOptional<z$1.ZodString>;
2802
- y: z$1.ZodOptional<z$1.ZodString>;
2803
- }, z$1.core.$loose>>;
2804
- kid: z$1.ZodOptional<z$1.ZodString>;
2805
- }, z$1.core.$loose>;
2491
+ declare const zWalletAttestationJwtHeaderV1_3: z.ZodObject<{
2492
+ trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
2493
+ typ: z.ZodLiteral<"oauth-client-attestation+jwt">;
2494
+ x5c: z.ZodArray<z.ZodString>;
2495
+ alg: z.ZodString;
2496
+ jwk: z.ZodOptional<z.ZodObject<{
2497
+ alg: z.ZodOptional<z.ZodString>;
2498
+ crv: z.ZodOptional<z.ZodString>;
2499
+ d: z.ZodOptional<z.ZodString>;
2500
+ dp: z.ZodOptional<z.ZodString>;
2501
+ dq: z.ZodOptional<z.ZodString>;
2502
+ e: z.ZodOptional<z.ZodString>;
2503
+ ext: z.ZodOptional<z.ZodBoolean>;
2504
+ k: z.ZodOptional<z.ZodString>;
2505
+ key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
2506
+ kid: z.ZodOptional<z.ZodString>;
2507
+ kty: z.ZodString;
2508
+ n: z.ZodOptional<z.ZodString>;
2509
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
2510
+ d: z.ZodOptional<z.ZodString>;
2511
+ r: z.ZodOptional<z.ZodString>;
2512
+ t: z.ZodOptional<z.ZodString>;
2513
+ }, z.core.$loose>>>;
2514
+ p: z.ZodOptional<z.ZodString>;
2515
+ q: z.ZodOptional<z.ZodString>;
2516
+ qi: z.ZodOptional<z.ZodString>;
2517
+ use: z.ZodOptional<z.ZodString>;
2518
+ x: z.ZodOptional<z.ZodString>;
2519
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
2520
+ x5t: z.ZodOptional<z.ZodString>;
2521
+ "x5t#S256": z.ZodOptional<z.ZodString>;
2522
+ x5u: z.ZodOptional<z.ZodString>;
2523
+ y: z.ZodOptional<z.ZodString>;
2524
+ }, z.core.$loose>>;
2525
+ kid: z.ZodOptional<z.ZodString>;
2526
+ }, z.core.$loose>;
2806
2527
  /**
2807
2528
  * JWT Payload schema for IT-Wallet v1.3 Wallet Attestation
2808
2529
  *
@@ -2810,56 +2531,56 @@ declare const zWalletAttestationJwtHeaderV1_3: z$1.ZodObject<{
2810
2531
  * - Supports nbf (not before) claim
2811
2532
  * - Supports status claim for revocation mechanisms
2812
2533
  */
2813
- declare const zWalletAttestationJwtPayloadV1_3: z$1.ZodObject<{
2814
- cnf: z$1.ZodObject<{
2815
- jwk: z$1.ZodObject<{
2816
- alg: z$1.ZodOptional<z$1.ZodString>;
2817
- crv: z$1.ZodOptional<z$1.ZodString>;
2818
- d: z$1.ZodOptional<z$1.ZodString>;
2819
- dp: z$1.ZodOptional<z$1.ZodString>;
2820
- dq: z$1.ZodOptional<z$1.ZodString>;
2821
- e: z$1.ZodOptional<z$1.ZodString>;
2822
- ext: z$1.ZodOptional<z$1.ZodBoolean>;
2823
- k: z$1.ZodOptional<z$1.ZodString>;
2824
- key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2825
- kid: z$1.ZodOptional<z$1.ZodString>;
2826
- kty: z$1.ZodString;
2827
- n: z$1.ZodOptional<z$1.ZodString>;
2828
- oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
2829
- d: z$1.ZodOptional<z$1.ZodString>;
2830
- r: z$1.ZodOptional<z$1.ZodString>;
2831
- t: z$1.ZodOptional<z$1.ZodString>;
2832
- }, z$1.core.$loose>>>;
2833
- p: z$1.ZodOptional<z$1.ZodString>;
2834
- q: z$1.ZodOptional<z$1.ZodString>;
2835
- qi: z$1.ZodOptional<z$1.ZodString>;
2836
- use: z$1.ZodOptional<z$1.ZodString>;
2837
- x: z$1.ZodOptional<z$1.ZodString>;
2838
- x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2839
- x5t: z$1.ZodOptional<z$1.ZodString>;
2840
- "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
2841
- x5u: z$1.ZodOptional<z$1.ZodString>;
2842
- y: z$1.ZodOptional<z$1.ZodString>;
2843
- }, z$1.core.$loose>;
2844
- }, z$1.core.$strip>;
2845
- exp: z$1.ZodNumber;
2846
- iat: z$1.ZodNumber;
2847
- iss: z$1.ZodString;
2848
- nbf: z$1.ZodOptional<z$1.ZodNumber>;
2849
- status: z$1.ZodOptional<z$1.ZodObject<{
2850
- status_list: z$1.ZodObject<{
2851
- idx: z$1.ZodNumber;
2852
- uri: z$1.ZodString;
2853
- }, z$1.core.$strip>;
2854
- }, z$1.core.$strip>>;
2855
- sub: z$1.ZodString;
2856
- wallet_link: z$1.ZodOptional<z$1.ZodURL>;
2857
- wallet_name: z$1.ZodOptional<z$1.ZodString>;
2858
- aud: z$1.ZodOptional<z$1.ZodString>;
2859
- jti: z$1.ZodOptional<z$1.ZodString>;
2860
- nonce: z$1.ZodOptional<z$1.ZodString>;
2861
- trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
2862
- }, z$1.core.$loose>;
2534
+ declare const zWalletAttestationJwtPayloadV1_3: z.ZodObject<{
2535
+ cnf: z.ZodObject<{
2536
+ jwk: z.ZodObject<{
2537
+ alg: z.ZodOptional<z.ZodString>;
2538
+ crv: z.ZodOptional<z.ZodString>;
2539
+ d: z.ZodOptional<z.ZodString>;
2540
+ dp: z.ZodOptional<z.ZodString>;
2541
+ dq: z.ZodOptional<z.ZodString>;
2542
+ e: z.ZodOptional<z.ZodString>;
2543
+ ext: z.ZodOptional<z.ZodBoolean>;
2544
+ k: z.ZodOptional<z.ZodString>;
2545
+ key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
2546
+ kid: z.ZodOptional<z.ZodString>;
2547
+ kty: z.ZodString;
2548
+ n: z.ZodOptional<z.ZodString>;
2549
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
2550
+ d: z.ZodOptional<z.ZodString>;
2551
+ r: z.ZodOptional<z.ZodString>;
2552
+ t: z.ZodOptional<z.ZodString>;
2553
+ }, z.core.$loose>>>;
2554
+ p: z.ZodOptional<z.ZodString>;
2555
+ q: z.ZodOptional<z.ZodString>;
2556
+ qi: z.ZodOptional<z.ZodString>;
2557
+ use: z.ZodOptional<z.ZodString>;
2558
+ x: z.ZodOptional<z.ZodString>;
2559
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
2560
+ x5t: z.ZodOptional<z.ZodString>;
2561
+ "x5t#S256": z.ZodOptional<z.ZodString>;
2562
+ x5u: z.ZodOptional<z.ZodString>;
2563
+ y: z.ZodOptional<z.ZodString>;
2564
+ }, z.core.$loose>;
2565
+ }, z.core.$strip>;
2566
+ exp: z.ZodNumber;
2567
+ iat: z.ZodNumber;
2568
+ iss: z.ZodString;
2569
+ nbf: z.ZodOptional<z.ZodNumber>;
2570
+ status: z.ZodOptional<z.ZodObject<{
2571
+ status_list: z.ZodObject<{
2572
+ idx: z.ZodNumber;
2573
+ uri: z.ZodString;
2574
+ }, z.core.$strip>;
2575
+ }, z.core.$strip>>;
2576
+ sub: z.ZodString;
2577
+ wallet_link: z.ZodOptional<z.ZodURL>;
2578
+ wallet_name: z.ZodOptional<z.ZodString>;
2579
+ aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString>]>>;
2580
+ jti: z.ZodOptional<z.ZodString>;
2581
+ nonce: z.ZodOptional<z.ZodString>;
2582
+ trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
2583
+ }, z.core.$loose>;
2863
2584
  /**
2864
2585
  * Wallet Attestation JWT type for v1.3
2865
2586
  * The JWT is returned as a compact string
@@ -2869,7 +2590,7 @@ type WalletAttestationJwtV1_3 = string;
2869
2590
  * Zod schema for wallet attestation JWT validation (v1.3)
2870
2591
  * Validates that the result is a non-empty string
2871
2592
  */
2872
- declare const zWalletAttestationJwtV1_3: z$1.ZodString;
2593
+ declare const zWalletAttestationJwtV1_3: z.ZodString;
2873
2594
 
2874
2595
  /**
2875
2596
  * Options for creating a wallet attestation with v1.3
@@ -2907,166 +2628,11 @@ interface WalletAttestationOptionsV1_3 extends BaseWalletAttestationOptions {
2907
2628
  */
2908
2629
  declare const createWalletAttestationJwt$1: (options: WalletAttestationOptionsV1_3) => Promise<WalletAttestationJwtV1_3>;
2909
2630
 
2910
- declare const zWalletAttestationJwtHeaderV1_4: z$1.ZodObject<{
2911
- kid: z$1.ZodString;
2912
- trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
2913
- typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
2914
- x5c: z$1.ZodArray<z$1.ZodString>;
2915
- alg: z$1.ZodString;
2916
- jwk: z$1.ZodOptional<z$1.ZodObject<{
2917
- alg: z$1.ZodOptional<z$1.ZodString>;
2918
- crv: z$1.ZodOptional<z$1.ZodString>;
2919
- d: z$1.ZodOptional<z$1.ZodString>;
2920
- dp: z$1.ZodOptional<z$1.ZodString>;
2921
- dq: z$1.ZodOptional<z$1.ZodString>;
2922
- e: z$1.ZodOptional<z$1.ZodString>;
2923
- ext: z$1.ZodOptional<z$1.ZodBoolean>;
2924
- k: z$1.ZodOptional<z$1.ZodString>;
2925
- key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2926
- kid: z$1.ZodOptional<z$1.ZodString>;
2927
- kty: z$1.ZodString;
2928
- n: z$1.ZodOptional<z$1.ZodString>;
2929
- oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
2930
- d: z$1.ZodOptional<z$1.ZodString>;
2931
- r: z$1.ZodOptional<z$1.ZodString>;
2932
- t: z$1.ZodOptional<z$1.ZodString>;
2933
- }, z$1.core.$loose>>>;
2934
- p: z$1.ZodOptional<z$1.ZodString>;
2935
- q: z$1.ZodOptional<z$1.ZodString>;
2936
- qi: z$1.ZodOptional<z$1.ZodString>;
2937
- use: z$1.ZodOptional<z$1.ZodString>;
2938
- x: z$1.ZodOptional<z$1.ZodString>;
2939
- x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2940
- x5t: z$1.ZodOptional<z$1.ZodString>;
2941
- "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
2942
- x5u: z$1.ZodOptional<z$1.ZodString>;
2943
- y: z$1.ZodOptional<z$1.ZodString>;
2944
- }, z$1.core.$loose>>;
2945
- }, z$1.core.$loose>;
2946
- declare const zWalletAttestationJwtPayloadV1_4: z$1.ZodObject<{
2947
- cnf: z$1.ZodObject<{
2948
- jwk: z$1.ZodObject<{
2949
- alg: z$1.ZodOptional<z$1.ZodString>;
2950
- crv: z$1.ZodOptional<z$1.ZodString>;
2951
- d: z$1.ZodOptional<z$1.ZodString>;
2952
- dp: z$1.ZodOptional<z$1.ZodString>;
2953
- dq: z$1.ZodOptional<z$1.ZodString>;
2954
- e: z$1.ZodOptional<z$1.ZodString>;
2955
- ext: z$1.ZodOptional<z$1.ZodBoolean>;
2956
- k: z$1.ZodOptional<z$1.ZodString>;
2957
- key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2958
- kid: z$1.ZodOptional<z$1.ZodString>;
2959
- kty: z$1.ZodString;
2960
- n: z$1.ZodOptional<z$1.ZodString>;
2961
- oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
2962
- d: z$1.ZodOptional<z$1.ZodString>;
2963
- r: z$1.ZodOptional<z$1.ZodString>;
2964
- t: z$1.ZodOptional<z$1.ZodString>;
2965
- }, z$1.core.$loose>>>;
2966
- p: z$1.ZodOptional<z$1.ZodString>;
2967
- q: z$1.ZodOptional<z$1.ZodString>;
2968
- qi: z$1.ZodOptional<z$1.ZodString>;
2969
- use: z$1.ZodOptional<z$1.ZodString>;
2970
- x: z$1.ZodOptional<z$1.ZodString>;
2971
- x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2972
- x5t: z$1.ZodOptional<z$1.ZodString>;
2973
- "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
2974
- x5u: z$1.ZodOptional<z$1.ZodString>;
2975
- y: z$1.ZodOptional<z$1.ZodString>;
2976
- }, z$1.core.$loose>;
2977
- }, z$1.core.$strip>;
2978
- exp: z$1.ZodNumber;
2979
- iat: z$1.ZodNumber;
2980
- iss: z$1.ZodString;
2981
- nbf: z$1.ZodOptional<z$1.ZodNumber>;
2982
- sub: z$1.ZodString;
2983
- wallet_link: z$1.ZodURL;
2984
- wallet_name: z$1.ZodString;
2985
- aud: z$1.ZodOptional<z$1.ZodString>;
2986
- jti: z$1.ZodOptional<z$1.ZodString>;
2987
- nonce: z$1.ZodOptional<z$1.ZodString>;
2988
- status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
2989
- trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
2990
- }, z$1.core.$loose>;
2991
- type WalletAttestationJwtV1_4 = string;
2992
- declare const zWalletAttestationJwtV1_4: z$1.ZodString;
2993
-
2994
- interface WalletAttestationOptionsV1_4 extends Omit<BaseWalletAttestationOptions, "walletLink" | "walletName"> {
2995
- nbf?: Date;
2996
- signer: {
2997
- alg: string;
2998
- kid: string;
2999
- method: "x5c";
3000
- trustChain?: [string, ...string[]];
3001
- x5c: [string, ...string[]];
3002
- };
3003
- walletLink: string;
3004
- walletName: string;
3005
- }
3006
- /**
3007
- * Creates a wallet attestation JWT for IT-Wallet v1.4.
3008
- *
3009
- * @param options - v1.4 wallet attestation creation options.
3010
- * @returns Signed wallet attestation JWT.
3011
- * @throws {ValidationError} If temporal constraints or generated JWT validation fail.
3012
- * @throws {ClientAttestationError} For unexpected errors during attestation creation.
3013
- */
3014
- declare const createWalletAttestationJwt: (options: WalletAttestationOptionsV1_4) => Promise<WalletAttestationJwtV1_4>;
3015
-
3016
- declare const IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES: readonly ["ES256", "ES384", "ES512"];
3017
- declare const zItWalletClientAttestationPopJwtAlg: z.ZodEnum<{
3018
- ES256: "ES256";
3019
- ES384: "ES384";
3020
- ES512: "ES512";
3021
- }>;
3022
- type ItWalletClientAttestationPopJwtAlg = z.infer<typeof zItWalletClientAttestationPopJwtAlg>;
3023
- declare const zItWalletClientAttestationPopJwtPayload: z.ZodObject<{
3024
- aud: z.ZodString;
3025
- exp: z.ZodOptional<z.ZodNumber>;
3026
- iat: z.ZodNumber;
3027
- iss: z.ZodString;
3028
- jti: z.ZodString;
3029
- nonce: z.ZodOptional<z.ZodString>;
3030
- cnf: z.ZodOptional<z.ZodObject<{
3031
- jkt: z.ZodOptional<z.ZodString>;
3032
- jwk: z.ZodOptional<z.ZodObject<{
3033
- alg: z.ZodOptional<z.ZodString>;
3034
- crv: z.ZodOptional<z.ZodString>;
3035
- d: z.ZodOptional<z.ZodString>;
3036
- dp: z.ZodOptional<z.ZodString>;
3037
- dq: z.ZodOptional<z.ZodString>;
3038
- e: z.ZodOptional<z.ZodString>;
3039
- ext: z.ZodOptional<z.ZodBoolean>;
3040
- k: z.ZodOptional<z.ZodString>;
3041
- key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
3042
- kid: z.ZodOptional<z.ZodString>;
3043
- kty: z.ZodString;
3044
- n: z.ZodOptional<z.ZodString>;
3045
- oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
3046
- d: z.ZodOptional<z.ZodString>;
3047
- r: z.ZodOptional<z.ZodString>;
3048
- t: z.ZodOptional<z.ZodString>;
3049
- }, z.core.$loose>>>;
3050
- p: z.ZodOptional<z.ZodString>;
3051
- q: z.ZodOptional<z.ZodString>;
3052
- qi: z.ZodOptional<z.ZodString>;
3053
- use: z.ZodOptional<z.ZodString>;
3054
- x: z.ZodOptional<z.ZodString>;
3055
- x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
3056
- x5t: z.ZodOptional<z.ZodString>;
3057
- "x5t#S256": z.ZodOptional<z.ZodString>;
3058
- x5u: z.ZodOptional<z.ZodString>;
3059
- y: z.ZodOptional<z.ZodString>;
3060
- }, z.core.$loose>>;
3061
- }, z.core.$loose>>;
3062
- nbf: z.ZodOptional<z.ZodNumber>;
3063
- status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
2631
+ declare const zWalletAttestationJwtHeaderV1_4: z.ZodObject<{
2632
+ kid: z.ZodString;
3064
2633
  trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
3065
- }, z.core.$loose>;
3066
- type ItWalletClientAttestationPopJwtPayload = z.infer<typeof zItWalletClientAttestationPopJwtPayload>;
3067
- declare const zItWalletClientAttestationPopJwtTyp: z.ZodLiteral<"oauth-client-attestation-pop+jwt">;
3068
- declare const zItWalletClientAttestationPopJwtHeader: z.ZodObject<{
3069
- typ: z.ZodLiteral<"oauth-client-attestation-pop+jwt">;
2634
+ typ: z.ZodLiteral<"oauth-client-attestation+jwt">;
2635
+ x5c: z.ZodArray<z.ZodString>;
3070
2636
  alg: z.ZodString;
3071
2637
  jwk: z.ZodOptional<z.ZodObject<{
3072
2638
  alg: z.ZodOptional<z.ZodString>;
@@ -3097,113 +2663,167 @@ declare const zItWalletClientAttestationPopJwtHeader: z.ZodObject<{
3097
2663
  x5u: z.ZodOptional<z.ZodString>;
3098
2664
  y: z.ZodOptional<z.ZodString>;
3099
2665
  }, z.core.$loose>>;
3100
- kid: z.ZodOptional<z.ZodString>;
2666
+ }, z.core.$loose>;
2667
+ declare const zWalletAttestationJwtPayloadV1_4: z.ZodObject<{
2668
+ cnf: z.ZodObject<{
2669
+ jwk: z.ZodObject<{
2670
+ alg: z.ZodOptional<z.ZodString>;
2671
+ crv: z.ZodOptional<z.ZodString>;
2672
+ d: z.ZodOptional<z.ZodString>;
2673
+ dp: z.ZodOptional<z.ZodString>;
2674
+ dq: z.ZodOptional<z.ZodString>;
2675
+ e: z.ZodOptional<z.ZodString>;
2676
+ ext: z.ZodOptional<z.ZodBoolean>;
2677
+ k: z.ZodOptional<z.ZodString>;
2678
+ key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
2679
+ kid: z.ZodOptional<z.ZodString>;
2680
+ kty: z.ZodString;
2681
+ n: z.ZodOptional<z.ZodString>;
2682
+ oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
2683
+ d: z.ZodOptional<z.ZodString>;
2684
+ r: z.ZodOptional<z.ZodString>;
2685
+ t: z.ZodOptional<z.ZodString>;
2686
+ }, z.core.$loose>>>;
2687
+ p: z.ZodOptional<z.ZodString>;
2688
+ q: z.ZodOptional<z.ZodString>;
2689
+ qi: z.ZodOptional<z.ZodString>;
2690
+ use: z.ZodOptional<z.ZodString>;
2691
+ x: z.ZodOptional<z.ZodString>;
2692
+ x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
2693
+ x5t: z.ZodOptional<z.ZodString>;
2694
+ "x5t#S256": z.ZodOptional<z.ZodString>;
2695
+ x5u: z.ZodOptional<z.ZodString>;
2696
+ y: z.ZodOptional<z.ZodString>;
2697
+ }, z.core.$loose>;
2698
+ }, z.core.$strip>;
2699
+ exp: z.ZodNumber;
2700
+ iat: z.ZodNumber;
2701
+ iss: z.ZodString;
2702
+ nbf: z.ZodOptional<z.ZodNumber>;
2703
+ sub: z.ZodString;
2704
+ wallet_link: z.ZodURL;
2705
+ wallet_name: z.ZodString;
2706
+ aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString>]>>;
2707
+ jti: z.ZodOptional<z.ZodString>;
2708
+ nonce: z.ZodOptional<z.ZodString>;
2709
+ status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
3101
2710
  trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
3102
- x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
3103
2711
  }, z.core.$loose>;
3104
- type ItWalletClientAttestationPopJwtHeader = z.infer<typeof zItWalletClientAttestationPopJwtHeader>;
2712
+ type WalletAttestationJwtV1_4 = string;
2713
+ declare const zWalletAttestationJwtV1_4: z.ZodString;
3105
2714
 
3106
- interface DecodeJwtHeaderOptions<HeaderSchema extends BaseSchema | undefined> {
3107
- /**
3108
- * Optional prefix for error messages thrown during decoding, to provide more context on where the error occurred
3109
- */
3110
- errorMessagePrefix?: string;
3111
- /**
3112
- * Schema to use for validating the header. If not provided the
3113
- * default `zJwtHeader` schema will be used
3114
- */
3115
- headerSchema?: HeaderSchema;
3116
- /**
3117
- * The compact encoded jwt
3118
- */
3119
- jwt: string;
3120
- }
3121
- interface DecodeJwtHeaderResult<HeaderSchema extends BaseSchema | undefined = undefined> {
3122
- header: InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;
2715
+ interface WalletAttestationOptionsV1_4 extends Omit<BaseWalletAttestationOptions, "walletLink" | "walletName"> {
2716
+ nbf?: Date;
2717
+ signer: {
2718
+ alg: string;
2719
+ kid: string;
2720
+ method: "x5c";
2721
+ trustChain?: [string, ...string[]];
2722
+ x5c: [string, ...string[]];
2723
+ };
2724
+ walletLink: string;
2725
+ walletName: string;
3123
2726
  }
3124
2727
  /**
3125
- * Decodes and validates the header of a compact JWT.
3126
- *
3127
- * This helper does not verify the JWT signature or parse the payload.
3128
- *
3129
- * @param options - Header decode options.
3130
- * @param options.errorMessagePrefix - Optional context prefix for thrown parse/validation errors.
3131
- * @param options.headerSchema - Optional schema for the JWT header; defaults to `zJwtHeader`.
3132
- * @param options.jwt - Compact JWT to decode.
3133
- * @returns Decoded and schema-validated JWT header.
3134
- * @throws {Oauth2JwtParseError} If the JWT shape or header JSON is invalid.
3135
- * @throws {ValidationError} If header schema validation fails.
3136
- */
3137
- declare function decodeJwtHeader<HeaderSchema extends BaseSchema | undefined = undefined>(options: DecodeJwtHeaderOptions<HeaderSchema>): DecodeJwtHeaderResult<HeaderSchema>;
3138
- /**
3139
- * Builds a JWT header from an SDK signer descriptor.
2728
+ * Creates a wallet attestation JWT for IT-Wallet v1.4.
3140
2729
  *
3141
- * @param signer - Signer descriptor used by SDK signing callbacks.
3142
- * @returns Header fields required by the signer method.
2730
+ * @param options - v1.4 wallet attestation creation options.
2731
+ * @returns Signed wallet attestation JWT.
2732
+ * @throws {ValidationError} If temporal constraints or generated JWT validation fail.
2733
+ * @throws {ClientAttestationError} For unexpected errors during attestation creation.
3143
2734
  */
3144
- declare function jwtHeaderFromJwtSigner(signer: JwtSigner): {
3145
- alg: string;
3146
- kid: string;
3147
- trust_chain?: undefined;
3148
- jwk?: undefined;
3149
- x5c?: undefined;
3150
- } | {
3151
- alg: string;
3152
- kid: string;
3153
- trust_chain: [string, ...string[]] | undefined;
3154
- jwk?: undefined;
3155
- x5c?: undefined;
3156
- } | {
3157
- alg: string;
3158
- jwk: {
3159
- [x: string]: unknown;
3160
- kty: string;
3161
- alg?: string | undefined;
3162
- crv?: string | undefined;
3163
- d?: string | undefined;
3164
- dp?: string | undefined;
3165
- dq?: string | undefined;
3166
- e?: string | undefined;
3167
- ext?: boolean | undefined;
3168
- k?: string | undefined;
3169
- key_ops?: string[] | undefined;
3170
- kid?: string | undefined;
3171
- n?: string | undefined;
3172
- oth?: {
3173
- [x: string]: unknown;
3174
- d?: string | undefined;
3175
- r?: string | undefined;
3176
- t?: string | undefined;
3177
- }[] | undefined;
3178
- p?: string | undefined;
3179
- q?: string | undefined;
3180
- qi?: string | undefined;
3181
- use?: string | undefined;
3182
- x?: string | undefined;
3183
- x5c?: string[] | undefined;
3184
- x5t?: string | undefined;
3185
- "x5t#S256"?: string | undefined;
3186
- x5u?: string | undefined;
3187
- y?: string | undefined;
3188
- };
3189
- kid?: undefined;
3190
- trust_chain?: undefined;
3191
- x5c?: undefined;
3192
- } | {
3193
- alg: string;
3194
- kid: string | undefined;
3195
- trust_chain: [string, ...string[]] | undefined;
3196
- x5c: string[];
3197
- jwk?: undefined;
3198
- } | {
3199
- alg: string;
3200
- kid?: undefined;
3201
- trust_chain?: undefined;
3202
- jwk?: undefined;
3203
- x5c?: undefined;
3204
- };
2735
+ declare const createWalletAttestationJwt: (options: WalletAttestationOptionsV1_4) => Promise<WalletAttestationJwtV1_4>;
3205
2736
 
3206
- declare const zCompactJwe: z$1.ZodString;
2737
+ declare const IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES: readonly ["ES256", "ES384", "ES512"];
2738
+ declare const zItWalletClientAttestationPopJwtAlg: z$1.ZodEnum<{
2739
+ ES256: "ES256";
2740
+ ES384: "ES384";
2741
+ ES512: "ES512";
2742
+ }>;
2743
+ type ItWalletClientAttestationPopJwtAlg = z$1.infer<typeof zItWalletClientAttestationPopJwtAlg>;
2744
+ declare const zItWalletClientAttestationPopJwtPayload: z$1.ZodObject<{
2745
+ aud: z$1.ZodString;
2746
+ exp: z$1.ZodOptional<z$1.ZodNumber>;
2747
+ iat: z$1.ZodNumber;
2748
+ iss: z$1.ZodString;
2749
+ jti: z$1.ZodString;
2750
+ nonce: z$1.ZodOptional<z$1.ZodString>;
2751
+ cnf: z$1.ZodOptional<z$1.ZodObject<{
2752
+ jkt: z$1.ZodOptional<z$1.ZodString>;
2753
+ jwk: z$1.ZodOptional<z$1.ZodObject<{
2754
+ alg: z$1.ZodOptional<z$1.ZodString>;
2755
+ crv: z$1.ZodOptional<z$1.ZodString>;
2756
+ d: z$1.ZodOptional<z$1.ZodString>;
2757
+ dp: z$1.ZodOptional<z$1.ZodString>;
2758
+ dq: z$1.ZodOptional<z$1.ZodString>;
2759
+ e: z$1.ZodOptional<z$1.ZodString>;
2760
+ ext: z$1.ZodOptional<z$1.ZodBoolean>;
2761
+ k: z$1.ZodOptional<z$1.ZodString>;
2762
+ key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2763
+ kid: z$1.ZodOptional<z$1.ZodString>;
2764
+ kty: z$1.ZodString;
2765
+ n: z$1.ZodOptional<z$1.ZodString>;
2766
+ oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
2767
+ d: z$1.ZodOptional<z$1.ZodString>;
2768
+ r: z$1.ZodOptional<z$1.ZodString>;
2769
+ t: z$1.ZodOptional<z$1.ZodString>;
2770
+ }, z$1.core.$loose>>>;
2771
+ p: z$1.ZodOptional<z$1.ZodString>;
2772
+ q: z$1.ZodOptional<z$1.ZodString>;
2773
+ qi: z$1.ZodOptional<z$1.ZodString>;
2774
+ use: z$1.ZodOptional<z$1.ZodString>;
2775
+ x: z$1.ZodOptional<z$1.ZodString>;
2776
+ x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2777
+ x5t: z$1.ZodOptional<z$1.ZodString>;
2778
+ "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
2779
+ x5u: z$1.ZodOptional<z$1.ZodString>;
2780
+ y: z$1.ZodOptional<z$1.ZodString>;
2781
+ }, z$1.core.$loose>>;
2782
+ }, z$1.core.$loose>>;
2783
+ nbf: z$1.ZodOptional<z$1.ZodNumber>;
2784
+ status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
2785
+ sub: z$1.ZodOptional<z$1.ZodString>;
2786
+ trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
2787
+ }, z$1.core.$loose>;
2788
+ type ItWalletClientAttestationPopJwtPayload = z$1.infer<typeof zItWalletClientAttestationPopJwtPayload>;
2789
+ declare const zItWalletClientAttestationPopJwtTyp: z$1.ZodLiteral<"oauth-client-attestation-pop+jwt">;
2790
+ declare const zItWalletClientAttestationPopJwtHeader: z$1.ZodObject<{
2791
+ typ: z$1.ZodLiteral<"oauth-client-attestation-pop+jwt">;
2792
+ alg: z$1.ZodString;
2793
+ jwk: z$1.ZodOptional<z$1.ZodObject<{
2794
+ alg: z$1.ZodOptional<z$1.ZodString>;
2795
+ crv: z$1.ZodOptional<z$1.ZodString>;
2796
+ d: z$1.ZodOptional<z$1.ZodString>;
2797
+ dp: z$1.ZodOptional<z$1.ZodString>;
2798
+ dq: z$1.ZodOptional<z$1.ZodString>;
2799
+ e: z$1.ZodOptional<z$1.ZodString>;
2800
+ ext: z$1.ZodOptional<z$1.ZodBoolean>;
2801
+ k: z$1.ZodOptional<z$1.ZodString>;
2802
+ key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2803
+ kid: z$1.ZodOptional<z$1.ZodString>;
2804
+ kty: z$1.ZodString;
2805
+ n: z$1.ZodOptional<z$1.ZodString>;
2806
+ oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
2807
+ d: z$1.ZodOptional<z$1.ZodString>;
2808
+ r: z$1.ZodOptional<z$1.ZodString>;
2809
+ t: z$1.ZodOptional<z$1.ZodString>;
2810
+ }, z$1.core.$loose>>>;
2811
+ p: z$1.ZodOptional<z$1.ZodString>;
2812
+ q: z$1.ZodOptional<z$1.ZodString>;
2813
+ qi: z$1.ZodOptional<z$1.ZodString>;
2814
+ use: z$1.ZodOptional<z$1.ZodString>;
2815
+ x: z$1.ZodOptional<z$1.ZodString>;
2816
+ x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2817
+ x5t: z$1.ZodOptional<z$1.ZodString>;
2818
+ "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
2819
+ x5u: z$1.ZodOptional<z$1.ZodString>;
2820
+ y: z$1.ZodOptional<z$1.ZodString>;
2821
+ }, z$1.core.$loose>>;
2822
+ kid: z$1.ZodOptional<z$1.ZodString>;
2823
+ trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
2824
+ x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
2825
+ }, z$1.core.$loose>;
2826
+ type ItWalletClientAttestationPopJwtHeader = z$1.infer<typeof zItWalletClientAttestationPopJwtHeader>;
3207
2827
 
3208
2828
  /**
3209
2829
  * Generic error thrown on OAuth2 operations
@@ -3419,7 +3039,7 @@ interface GetJwtFromFormPostOptions<T> {
3419
3039
  /**
3420
3040
  * Schema for parsing and validating
3421
3041
  */
3422
- schema: z.ZodSchema<T>;
3042
+ schema: z$1.ZodSchema<T>;
3423
3043
  }
3424
3044
  /**
3425
3045
  * Decode a form_post.jwt and return the final JWT.
@@ -3460,7 +3080,7 @@ interface GetJwtFromFormPostOptions<T> {
3460
3080
  * ```
3461
3081
  */
3462
3082
  declare const getJwtFromFormPost: <T>(options: GetJwtFromFormPostOptions<T>) => Promise<{
3463
- decodedJwt: DecodeJwtResult<undefined, z.ZodSchema<T>>;
3083
+ decodedJwt: DecodeJwtResult<undefined, z$1.ZodSchema<T>>;
3464
3084
  jwt: string;
3465
3085
  }>;
3466
3086
 
@@ -3496,7 +3116,7 @@ interface CreateMrtdValidationJwtOptions {
3496
3116
  /** NFC-read document evidence */
3497
3117
  documentData: MrtdDocumentData;
3498
3118
  issuedAt?: Date;
3499
- signer: JwtSignerJwk$1;
3119
+ signer: JwtSignerJwk;
3500
3120
  }
3501
3121
  /**
3502
3122
  * Creates a signed JWT containing MRTD validation data for Phase 3 of L2+ flow.
@@ -3527,7 +3147,7 @@ interface FetchMrtdPopInitOptions {
3527
3147
  * Optional custom signer for verifying the MRTD PoP init response JWT.
3528
3148
  * If not provided, the library will attempt to verify using JWT header.
3529
3149
  */
3530
- signer?: JwtSigner$1;
3150
+ signer?: JwtSigner;
3531
3151
  /**
3532
3152
  * Attestation header value for the wallet's own attestation, to be included in the request.
3533
3153
  */
@@ -3539,7 +3159,7 @@ interface FetchMrtdPopInitResult {
3539
3159
  mrz?: string;
3540
3160
  /** htu from the init response — the verify endpoint */
3541
3161
  popVerifyEndpoint: string;
3542
- signer: JwtSigner$1;
3162
+ signer: JwtSigner;
3543
3163
  }
3544
3164
  /**
3545
3165
  * Initiates MRTD Proof of Possession validation (Phase 3.2 of L2+ flow).
@@ -3598,81 +3218,81 @@ declare function fetchMrtdPopVerify(options: FetchMrtdPopVerifyOptions): Promise
3598
3218
  * @see IT-Wallet L2+ specification Section 12.1.3 (eID Substantial Authentication with MRTD Verification)
3599
3219
  */
3600
3220
  /** JWT header for MRTD challenge (Phase 3.1) */
3601
- declare const zMrtdChallengeJwtHeader: z.ZodObject<{
3602
- alg: z.ZodString;
3603
- kid: z.ZodString;
3604
- typ: z.ZodLiteral<"mrtd-ias+jwt">;
3605
- }, z.core.$loose>;
3606
- type MrtdChallengeJwtHeader = z.infer<typeof zMrtdChallengeJwtHeader>;
3221
+ declare const zMrtdChallengeJwtHeader: z$1.ZodObject<{
3222
+ alg: z$1.ZodString;
3223
+ kid: z$1.ZodString;
3224
+ typ: z$1.ZodLiteral<"mrtd-ias+jwt">;
3225
+ }, z$1.core.$loose>;
3226
+ type MrtdChallengeJwtHeader = z$1.infer<typeof zMrtdChallengeJwtHeader>;
3607
3227
  /** JWT payload for MRTD challenge containing session correlation and endpoint parameters */
3608
- declare const zMrtdChallengeJwtPayload: z.ZodObject<{
3609
- aud: z.ZodString;
3610
- exp: z.ZodNumber;
3611
- htm: z.ZodLiteral<"POST">;
3612
- htu: z.ZodURL;
3613
- iat: z.ZodNumber;
3614
- iss: z.ZodString;
3615
- mrtd_auth_session: z.ZodString;
3616
- mrtd_pop_jwt_nonce: z.ZodString;
3617
- state: z.ZodString;
3618
- status: z.ZodLiteral<"require_interaction">;
3619
- type: z.ZodLiteral<"mrtd+ias">;
3620
- }, z.core.$loose>;
3621
- type MrtdChallengeJwtPayload = z.infer<typeof zMrtdChallengeJwtPayload>;
3228
+ declare const zMrtdChallengeJwtPayload: z$1.ZodObject<{
3229
+ aud: z$1.ZodString;
3230
+ exp: z$1.ZodNumber;
3231
+ htm: z$1.ZodLiteral<"POST">;
3232
+ htu: z$1.ZodURL;
3233
+ iat: z$1.ZodNumber;
3234
+ iss: z$1.ZodString;
3235
+ mrtd_auth_session: z$1.ZodString;
3236
+ mrtd_pop_jwt_nonce: z$1.ZodString;
3237
+ state: z$1.ZodString;
3238
+ status: z$1.ZodLiteral<"require_interaction">;
3239
+ type: z$1.ZodLiteral<"mrtd+ias">;
3240
+ }, z$1.core.$loose>;
3241
+ type MrtdChallengeJwtPayload = z$1.infer<typeof zMrtdChallengeJwtPayload>;
3622
3242
  /** JWT header for MRTD PoP initialization response (Phase 3.3) */
3623
- declare const zMrtdPopInitResponseJwtHeader: z.ZodObject<{
3624
- alg: z.ZodString;
3625
- kid: z.ZodString;
3626
- typ: z.ZodLiteral<"mrtd-ias-pop+jwt">;
3627
- }, z.core.$loose>;
3628
- type MrtdPopInitResponseJwtHeader = z.infer<typeof zMrtdPopInitResponseJwtHeader>;
3243
+ declare const zMrtdPopInitResponseJwtHeader: z$1.ZodObject<{
3244
+ alg: z$1.ZodString;
3245
+ kid: z$1.ZodString;
3246
+ typ: z$1.ZodLiteral<"mrtd-ias-pop+jwt">;
3247
+ }, z$1.core.$loose>;
3248
+ type MrtdPopInitResponseJwtHeader = z$1.infer<typeof zMrtdPopInitResponseJwtHeader>;
3629
3249
  /** JWT payload for MRTD PoP initialization response containing challenge and nonce */
3630
- declare const zMrtdPopInitResponseJwtPayload: z.ZodObject<{
3631
- aud: z.ZodString;
3632
- challenge: z.ZodString;
3633
- exp: z.ZodNumber;
3634
- htm: z.ZodLiteral<"POST">;
3635
- htu: z.ZodURL;
3636
- iat: z.ZodNumber;
3637
- iss: z.ZodString;
3638
- mrtd_pop_nonce: z.ZodString;
3639
- mrz: z.ZodOptional<z.ZodString>;
3640
- }, z.core.$loose>;
3641
- type MrtdPopInitResponseJwtPayload = z.infer<typeof zMrtdPopInitResponseJwtPayload>;
3250
+ declare const zMrtdPopInitResponseJwtPayload: z$1.ZodObject<{
3251
+ aud: z$1.ZodString;
3252
+ challenge: z$1.ZodString;
3253
+ exp: z$1.ZodNumber;
3254
+ htm: z$1.ZodLiteral<"POST">;
3255
+ htu: z$1.ZodURL;
3256
+ iat: z$1.ZodNumber;
3257
+ iss: z$1.ZodString;
3258
+ mrtd_pop_nonce: z$1.ZodString;
3259
+ mrz: z$1.ZodOptional<z$1.ZodString>;
3260
+ }, z$1.core.$loose>;
3261
+ type MrtdPopInitResponseJwtPayload = z$1.infer<typeof zMrtdPopInitResponseJwtPayload>;
3642
3262
  /** JWT header for MRTD validation (signed by Wallet Instance) */
3643
- declare const zMrtdValidationJwtHeader: z.ZodObject<{
3644
- alg: z.ZodString;
3645
- kid: z.ZodString;
3646
- typ: z.ZodLiteral<"mrtd-ias+jwt">;
3647
- }, z.core.$loose>;
3648
- type MrtdValidationJwtHeader = z.infer<typeof zMrtdValidationJwtHeader>;
3263
+ declare const zMrtdValidationJwtHeader: z$1.ZodObject<{
3264
+ alg: z$1.ZodString;
3265
+ kid: z$1.ZodString;
3266
+ typ: z$1.ZodLiteral<"mrtd-ias+jwt">;
3267
+ }, z$1.core.$loose>;
3268
+ type MrtdValidationJwtHeader = z$1.infer<typeof zMrtdValidationJwtHeader>;
3649
3269
  /** JWT payload for MRTD validation containing NFC-read document evidence */
3650
- declare const zMrtdValidationJwtPayload: z.ZodObject<{
3651
- aud: z.ZodString;
3652
- document_type: z.ZodLiteral<"cie">;
3653
- exp: z.ZodNumber;
3654
- ias: z.ZodObject<{
3655
- challenge_signed: z.ZodString;
3656
- ias_pk: z.ZodString;
3657
- sod_ias: z.ZodString;
3658
- }, z.core.$loose>;
3659
- iat: z.ZodNumber;
3660
- iss: z.ZodString;
3661
- mrtd: z.ZodObject<{
3662
- dg1: z.ZodString;
3663
- dg11: z.ZodString;
3664
- sod_mrtd: z.ZodString;
3665
- }, z.core.$loose>;
3666
- }, z.core.$loose>;
3667
- type MrtdValidationJwtPayload = z.infer<typeof zMrtdValidationJwtPayload>;
3270
+ declare const zMrtdValidationJwtPayload: z$1.ZodObject<{
3271
+ aud: z$1.ZodString;
3272
+ document_type: z$1.ZodLiteral<"cie">;
3273
+ exp: z$1.ZodNumber;
3274
+ ias: z$1.ZodObject<{
3275
+ challenge_signed: z$1.ZodString;
3276
+ ias_pk: z$1.ZodString;
3277
+ sod_ias: z$1.ZodString;
3278
+ }, z$1.core.$loose>;
3279
+ iat: z$1.ZodNumber;
3280
+ iss: z$1.ZodString;
3281
+ mrtd: z$1.ZodObject<{
3282
+ dg1: z$1.ZodString;
3283
+ dg11: z$1.ZodString;
3284
+ sod_mrtd: z$1.ZodString;
3285
+ }, z$1.core.$loose>;
3286
+ }, z$1.core.$loose>;
3287
+ type MrtdValidationJwtPayload = z$1.infer<typeof zMrtdValidationJwtPayload>;
3668
3288
  /** Response from MRTD PoP verification endpoint (Phase 3.8) */
3669
- declare const zMrtdPopVerifyResponse: z.ZodObject<{
3670
- mrtd_val_pop_nonce: z.ZodString;
3671
- redirect_uri: z.ZodURL;
3672
- status: z.ZodLiteral<"require_interaction">;
3673
- type: z.ZodLiteral<"redirect_to_web">;
3674
- }, z.core.$loose>;
3675
- type MrtdPopVerifyResponse = z.infer<typeof zMrtdPopVerifyResponse>;
3289
+ declare const zMrtdPopVerifyResponse: z$1.ZodObject<{
3290
+ mrtd_val_pop_nonce: z$1.ZodString;
3291
+ redirect_uri: z$1.ZodURL;
3292
+ status: z$1.ZodLiteral<"require_interaction">;
3293
+ type: z$1.ZodLiteral<"redirect_to_web">;
3294
+ }, z$1.core.$loose>;
3295
+ type MrtdPopVerifyResponse = z$1.infer<typeof zMrtdPopVerifyResponse>;
3676
3296
 
3677
3297
  interface ParseMrtdChallengeOptions {
3678
3298
  /** The full redirect URL containing ?challenge_info=<jwt> */
@@ -3707,12 +3327,12 @@ interface VerifyMrtdChallengeOptions {
3707
3327
  * Optional custom signer for verifying the MRTD challenge JWT.
3708
3328
  * If not provided, the library will attempt to verify using JWT header.
3709
3329
  */
3710
- signer?: JwtSigner$1;
3330
+ signer?: JwtSigner;
3711
3331
  }
3712
3332
  interface VerifyMrtdChallengeResult {
3713
3333
  header: MrtdChallengeJwtHeader;
3714
3334
  payload: MrtdChallengeJwtPayload;
3715
- signer: JwtSigner$1;
3335
+ signer: JwtSigner;
3716
3336
  }
3717
3337
  /**
3718
3338
  * Verifies the MRTD challenge JWT signature and validates claims.
@@ -3755,12 +3375,12 @@ interface CreateTokenDPoPOptions {
3755
3375
  /**
3756
3376
  * The signer of the dpop jwt. Only jwk signer allowed.
3757
3377
  */
3758
- signer: JwtSignerJwk$1;
3378
+ signer: JwtSignerJwk;
3759
3379
  /**
3760
3380
  * The request for which to create the dpop jwt
3761
3381
  */
3762
3382
  tokenRequest: {
3763
- method: HttpMethod$1;
3383
+ method: HttpMethod;
3764
3384
  url: string;
3765
3385
  };
3766
3386
  }
@@ -3775,7 +3395,7 @@ interface CreateTokenDPoPOptions {
3775
3395
  */
3776
3396
  declare function createTokenDPoP(options: CreateTokenDPoPOptions): Promise<{
3777
3397
  jwt: string;
3778
- signerJwk: _openid4vc_oauth2.Jwk;
3398
+ signerJwk: _pagopa_io_wallet_utils.Jwk;
3779
3399
  }>;
3780
3400
  /**
3781
3401
  * Extracts and validates the DPoP JWT from request headers.
@@ -3840,7 +3460,7 @@ interface VerifyTokenDPoPOptions {
3840
3460
  /**
3841
3461
  * The request for which to verify the dpop jwt
3842
3462
  */
3843
- request: RequestLike$1;
3463
+ request: RequestLike;
3844
3464
  }
3845
3465
  /**
3846
3466
  * Verifies a DPoP proof JWT against an HTTP request and optional token binding data.
@@ -3900,12 +3520,12 @@ declare function verifyTokenDPoP(options: VerifyTokenDPoPOptions): Promise<{
3900
3520
  jwkThumbprint: string;
3901
3521
  payload: {
3902
3522
  [x: string]: unknown;
3903
- htm: "GET" | "POST" | "PUT" | "DELETE" | "HEAD" | "OPTIONS" | "TRACE" | "CONNECT" | "PATCH";
3523
+ htm: "POST" | "GET" | "PUT" | "DELETE" | "HEAD" | "OPTIONS" | "TRACE" | "CONNECT" | "PATCH";
3904
3524
  htu: string;
3905
3525
  iat: number;
3906
3526
  jti: string;
3907
3527
  ath?: string | undefined;
3908
- aud?: string | undefined;
3528
+ aud?: string | string[] | undefined;
3909
3529
  cnf?: {
3910
3530
  [x: string]: unknown;
3911
3531
  jkt?: string | undefined;
@@ -3946,13 +3566,14 @@ declare function verifyTokenDPoP(options: VerifyTokenDPoPOptions): Promise<{
3946
3566
  nbf?: number | undefined;
3947
3567
  nonce?: string | undefined;
3948
3568
  status?: Record<string, any> | undefined;
3569
+ sub?: string | undefined;
3949
3570
  trust_chain?: [string, ...string[]] | undefined;
3950
3571
  };
3951
3572
  }>;
3952
3573
 
3953
- declare const zDpopJwtPayload: z.ZodObject<{
3954
- ath: z.ZodOptional<z.ZodString>;
3955
- htm: z.ZodEnum<{
3574
+ declare const zDpopJwtPayload: z$1.ZodObject<{
3575
+ ath: z$1.ZodOptional<z$1.ZodString>;
3576
+ htm: z$1.ZodEnum<{
3956
3577
  GET: "GET";
3957
3578
  POST: "POST";
3958
3579
  PUT: "PUT";
@@ -3963,86 +3584,87 @@ declare const zDpopJwtPayload: z.ZodObject<{
3963
3584
  CONNECT: "CONNECT";
3964
3585
  PATCH: "PATCH";
3965
3586
  }>;
3966
- htu: z.ZodURL;
3967
- iat: z.ZodNumber;
3968
- jti: z.ZodString;
3969
- aud: z.ZodOptional<z.ZodString>;
3970
- cnf: z.ZodOptional<z.ZodObject<{
3971
- jkt: z.ZodOptional<z.ZodString>;
3972
- jwk: z.ZodOptional<z.ZodObject<{
3973
- alg: z.ZodOptional<z.ZodString>;
3974
- crv: z.ZodOptional<z.ZodString>;
3975
- d: z.ZodOptional<z.ZodString>;
3976
- dp: z.ZodOptional<z.ZodString>;
3977
- dq: z.ZodOptional<z.ZodString>;
3978
- e: z.ZodOptional<z.ZodString>;
3979
- ext: z.ZodOptional<z.ZodBoolean>;
3980
- k: z.ZodOptional<z.ZodString>;
3981
- key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
3982
- kid: z.ZodOptional<z.ZodString>;
3983
- kty: z.ZodString;
3984
- n: z.ZodOptional<z.ZodString>;
3985
- oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
3986
- d: z.ZodOptional<z.ZodString>;
3987
- r: z.ZodOptional<z.ZodString>;
3988
- t: z.ZodOptional<z.ZodString>;
3989
- }, z.core.$loose>>>;
3990
- p: z.ZodOptional<z.ZodString>;
3991
- q: z.ZodOptional<z.ZodString>;
3992
- qi: z.ZodOptional<z.ZodString>;
3993
- use: z.ZodOptional<z.ZodString>;
3994
- x: z.ZodOptional<z.ZodString>;
3995
- x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
3996
- x5t: z.ZodOptional<z.ZodString>;
3997
- "x5t#S256": z.ZodOptional<z.ZodString>;
3998
- x5u: z.ZodOptional<z.ZodString>;
3999
- y: z.ZodOptional<z.ZodString>;
4000
- }, z.core.$loose>>;
4001
- }, z.core.$loose>>;
4002
- exp: z.ZodOptional<z.ZodNumber>;
4003
- iss: z.ZodOptional<z.ZodString>;
4004
- nbf: z.ZodOptional<z.ZodNumber>;
4005
- nonce: z.ZodOptional<z.ZodString>;
4006
- status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
4007
- trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
4008
- }, z.core.$loose>;
4009
- type DpopJwtPayload = z.infer<typeof zDpopJwtPayload>;
4010
- declare const zDpopJwtHeader: z.ZodObject<{
4011
- jwk: z.ZodObject<{
4012
- alg: z.ZodOptional<z.ZodString>;
4013
- crv: z.ZodOptional<z.ZodString>;
4014
- d: z.ZodOptional<z.ZodString>;
4015
- dp: z.ZodOptional<z.ZodString>;
4016
- dq: z.ZodOptional<z.ZodString>;
4017
- e: z.ZodOptional<z.ZodString>;
4018
- ext: z.ZodOptional<z.ZodBoolean>;
4019
- k: z.ZodOptional<z.ZodString>;
4020
- key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
4021
- kid: z.ZodOptional<z.ZodString>;
4022
- kty: z.ZodString;
4023
- n: z.ZodOptional<z.ZodString>;
4024
- oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
4025
- d: z.ZodOptional<z.ZodString>;
4026
- r: z.ZodOptional<z.ZodString>;
4027
- t: z.ZodOptional<z.ZodString>;
4028
- }, z.core.$loose>>>;
4029
- p: z.ZodOptional<z.ZodString>;
4030
- q: z.ZodOptional<z.ZodString>;
4031
- qi: z.ZodOptional<z.ZodString>;
4032
- use: z.ZodOptional<z.ZodString>;
4033
- x: z.ZodOptional<z.ZodString>;
4034
- x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
4035
- x5t: z.ZodOptional<z.ZodString>;
4036
- "x5t#S256": z.ZodOptional<z.ZodString>;
4037
- x5u: z.ZodOptional<z.ZodString>;
4038
- y: z.ZodOptional<z.ZodString>;
4039
- }, z.core.$loose>;
4040
- typ: z.ZodLiteral<"dpop+jwt">;
4041
- alg: z.ZodString;
4042
- kid: z.ZodOptional<z.ZodString>;
4043
- trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
4044
- x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
4045
- }, z.core.$loose>;
4046
- type DpopJwtHeader = z.infer<typeof zDpopJwtHeader>;
3587
+ htu: z$1.ZodURL;
3588
+ iat: z$1.ZodNumber;
3589
+ jti: z$1.ZodString;
3590
+ aud: z$1.ZodOptional<z$1.ZodUnion<[z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>;
3591
+ cnf: z$1.ZodOptional<z$1.ZodObject<{
3592
+ jkt: z$1.ZodOptional<z$1.ZodString>;
3593
+ jwk: z$1.ZodOptional<z$1.ZodObject<{
3594
+ alg: z$1.ZodOptional<z$1.ZodString>;
3595
+ crv: z$1.ZodOptional<z$1.ZodString>;
3596
+ d: z$1.ZodOptional<z$1.ZodString>;
3597
+ dp: z$1.ZodOptional<z$1.ZodString>;
3598
+ dq: z$1.ZodOptional<z$1.ZodString>;
3599
+ e: z$1.ZodOptional<z$1.ZodString>;
3600
+ ext: z$1.ZodOptional<z$1.ZodBoolean>;
3601
+ k: z$1.ZodOptional<z$1.ZodString>;
3602
+ key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
3603
+ kid: z$1.ZodOptional<z$1.ZodString>;
3604
+ kty: z$1.ZodString;
3605
+ n: z$1.ZodOptional<z$1.ZodString>;
3606
+ oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
3607
+ d: z$1.ZodOptional<z$1.ZodString>;
3608
+ r: z$1.ZodOptional<z$1.ZodString>;
3609
+ t: z$1.ZodOptional<z$1.ZodString>;
3610
+ }, z$1.core.$loose>>>;
3611
+ p: z$1.ZodOptional<z$1.ZodString>;
3612
+ q: z$1.ZodOptional<z$1.ZodString>;
3613
+ qi: z$1.ZodOptional<z$1.ZodString>;
3614
+ use: z$1.ZodOptional<z$1.ZodString>;
3615
+ x: z$1.ZodOptional<z$1.ZodString>;
3616
+ x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
3617
+ x5t: z$1.ZodOptional<z$1.ZodString>;
3618
+ "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
3619
+ x5u: z$1.ZodOptional<z$1.ZodString>;
3620
+ y: z$1.ZodOptional<z$1.ZodString>;
3621
+ }, z$1.core.$loose>>;
3622
+ }, z$1.core.$loose>>;
3623
+ exp: z$1.ZodOptional<z$1.ZodNumber>;
3624
+ iss: z$1.ZodOptional<z$1.ZodString>;
3625
+ nbf: z$1.ZodOptional<z$1.ZodNumber>;
3626
+ nonce: z$1.ZodOptional<z$1.ZodString>;
3627
+ status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
3628
+ sub: z$1.ZodOptional<z$1.ZodString>;
3629
+ trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
3630
+ }, z$1.core.$loose>;
3631
+ type DpopJwtPayload = z$1.infer<typeof zDpopJwtPayload>;
3632
+ declare const zDpopJwtHeader: z$1.ZodObject<{
3633
+ jwk: z$1.ZodObject<{
3634
+ alg: z$1.ZodOptional<z$1.ZodString>;
3635
+ crv: z$1.ZodOptional<z$1.ZodString>;
3636
+ d: z$1.ZodOptional<z$1.ZodString>;
3637
+ dp: z$1.ZodOptional<z$1.ZodString>;
3638
+ dq: z$1.ZodOptional<z$1.ZodString>;
3639
+ e: z$1.ZodOptional<z$1.ZodString>;
3640
+ ext: z$1.ZodOptional<z$1.ZodBoolean>;
3641
+ k: z$1.ZodOptional<z$1.ZodString>;
3642
+ key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
3643
+ kid: z$1.ZodOptional<z$1.ZodString>;
3644
+ kty: z$1.ZodString;
3645
+ n: z$1.ZodOptional<z$1.ZodString>;
3646
+ oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
3647
+ d: z$1.ZodOptional<z$1.ZodString>;
3648
+ r: z$1.ZodOptional<z$1.ZodString>;
3649
+ t: z$1.ZodOptional<z$1.ZodString>;
3650
+ }, z$1.core.$loose>>>;
3651
+ p: z$1.ZodOptional<z$1.ZodString>;
3652
+ q: z$1.ZodOptional<z$1.ZodString>;
3653
+ qi: z$1.ZodOptional<z$1.ZodString>;
3654
+ use: z$1.ZodOptional<z$1.ZodString>;
3655
+ x: z$1.ZodOptional<z$1.ZodString>;
3656
+ x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
3657
+ x5t: z$1.ZodOptional<z$1.ZodString>;
3658
+ "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
3659
+ x5u: z$1.ZodOptional<z$1.ZodString>;
3660
+ y: z$1.ZodOptional<z$1.ZodString>;
3661
+ }, z$1.core.$loose>;
3662
+ typ: z$1.ZodLiteral<"dpop+jwt">;
3663
+ alg: z$1.ZodString;
3664
+ kid: z$1.ZodOptional<z$1.ZodString>;
3665
+ trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
3666
+ x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
3667
+ }, z$1.core.$loose>;
3668
+ type DpopJwtHeader = z$1.infer<typeof zDpopJwtHeader>;
4047
3669
 
4048
- export { type AccessTokenProfileJwtHeader, type AccessTokenProfileJwtPayload, type AccessTokenRequest, type AccessTokenResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationCodeGrantType, type AuthorizationRequestV1_0, type AuthorizationRequestV1_3, type BaseVerifyWalletAttestationJwtOptions, type BaseWalletAttestationOptions, type CertificateChain, ClientAttestationError, type ClientAttestationOptions, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationWalletAttestationJwtOptions, type CreateAccessTokenResponseOptions, type CreateClientAttestationPopJwtOptions, type CreateClientAttestationPopJwtOptionsForVersion, type CreateClientAttestationPopJwtOptionsV1_0, type CreateClientAttestationPopJwtOptionsV1_3, type CreateClientAttestationPopJwtOptionsV1_4, type CreateJarRequestOptions, type CreateJarRequestResult, type CreateMrtdValidationJwtOptions, type CreatePkceOptions, type CreatePkceReturn, type CreatePushedAuthorizationRequestOptions, type CreatePushedAuthorizationRequestOptionsV1_0, type CreatePushedAuthorizationRequestOptionsV1_3, type CreatePushedAuthorizationRequestOptionsV1_4, CreateTokenDPoPError, type CreateTokenDPoPOptions, CreateTokenResponseError, type DecodeJwtHeaderOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DpopJwtHeader, type DpopJwtPayload, type FetchMrtdPopInitOptions, type FetchMrtdPopInitResult, type FetchMrtdPopVerifyOptions, type FetchMrtdPopVerifyResult, FetchTokenResponseError, type FetchTokenResponseOptions, type GetJwtFromFormPostOptions, IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES, type InferSchemaOrDefaultOutput, type IsClientAttestationSupportedOptions, type ItWalletClientAttestationPopJwtAlg, type ItWalletClientAttestationPopJwtHeader, type ItWalletClientAttestationPopJwtPayload, type JarAuthorizationRequest, type JarRequestObjectHeader, type JarRequestObjectPayload, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSignerCustom, type JwtSignerDid, type JwtSignerFederation, type JwtSignerWithJwk, type JwtSignerX5c, MAX_JTI_LENGTH, type MrtdChallengeJwtHeader, type MrtdChallengeJwtPayload, type MrtdDocumentData, MrtdPopError, type MrtdPopInitResponseJwtHeader, type MrtdPopInitResponseJwtPayload, type MrtdPopVerifyResponse, type MrtdValidationJwtHeader, type MrtdValidationJwtPayload, Oauth2Error, type ParseAccessTokenRequestOptions, type ParseAccessTokenRequestResult, type ParseAuthorizationRequestOptions, type ParseAuthorizationRequestResult, type ParseMrtdChallengeOptions, type ParseMrtdChallengeResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, type ParsedAccessTokenAuthorizationCodeRequestGrant, type ParsedAccessTokenRefreshTokenRequestGrant, type ParsedJarRequest, type ParsedJarRequestOptions, PkceCodeChallengeMethod, type PushedAuthorizationRequest, PushedAuthorizationRequestError, type PushedAuthorizationRequestSigned, type PushedAuthorizationRequestUnsignedV1_0, type PushedAuthorizationRequestUnsignedV1_3, type PushedAuthorizationResponse, type RefreshTokenGrantIdentifier, type RefreshTokenGrantType, type RefreshTokenProfileJwtHeader, type RefreshTokenProfileJwtPayload, type RequestLike, type RetrieveAuthorizationCodeAccessTokenOptions, SupportedClientAuthenticationMethod, type TrustChain, type VerifiedClientAttestationPopJwt, type VerifiedJarRequest, type VerifiedWalletAttestationJwt, type VerifiedWalletAttestationJwtV1_0, type VerifiedWalletAttestationJwtV1_3, type VerifiedWalletAttestationJwtV1_4, type VerifyAccessTokenRequestDpop, type VerifyAccessTokenRequestOptions, type VerifyAccessTokenRequestPkce, type VerifyAccessTokenRequestResult, type VerifyAuthorizationRequestDPoP, type VerifyAuthorizationRequestOptions, type VerifyAuthorizationRequestResult, type VerifyClientAttestationOptions, type VerifyClientAttestationPopJwtOptions, type VerifyJarRequestOptions, type VerifyMrtdChallengeOptions, type VerifyMrtdChallengeResult, type VerifyPkceOptions, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyTokenDPoPOptions, type VerifyWalletAttestationJwtOptions, type VerifyWalletAttestationJwtOptionsV1_0, type VerifyWalletAttestationJwtOptionsV1_3, type VerifyWalletAttestationJwtOptionsV1_4, type WalletAttestationJwtV1_0, type WalletAttestationJwtV1_3, type WalletAttestationJwtV1_4, type WalletAttestationOptionsV1_0, type WalletAttestationOptionsV1_3, type WalletAttestationOptionsV1_4, authorizationCodeGrantIdentifier, clientAuthenticationAnonymous, clientAuthenticationWalletAttestationJwt, createAccessTokenResponse, createClientAttestationPopJwt, createJarRequest, createMrtdValidationJwt, createPkce, createPushedAuthorizationRequest, createTokenDPoP, createTokenRequest, createWalletAttestationJwt$2 as createWalletAttestationJwtV1_0, createWalletAttestationJwt$1 as createWalletAttestationJwtV1_3, createWalletAttestationJwt as createWalletAttestationJwtV1_4, decodeJwt, decodeJwtHeader, extractClientAttestationJwtsFromHeaders, extractDpopJwtFromHeaders, fetchJarRequestObject, fetchMrtdPopInit, fetchMrtdPopVerify, fetchPushedAuthorizationResponse, type fetchPushedAuthorizationResponseOptions, fetchTokenResponse, getJwtFromFormPost, htuFromRequestUrl, isClientAttestationSupported, isJarAuthorizationRequest, isPushedAuthorizationRequestSigned, isPushedAuthorizationRequestUnsigned, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, oauthClientAttestationHeader, oauthClientAttestationPopHeader, parseAccessTokenRequest, parseAuthorizationRequest, parseJarRequest, parseMrtdChallenge, parsePushedAuthorizationRequest, refreshTokenGrantIdentifier, signedAuthorizationRequestJwtHeaderTyp, toURLSearchParams, validateJarRequestParams, verifyAccessTokenRequest, verifyAuthorizationRequest, verifyClientAttestation, verifyClientAttestationPopJwt, verifyJarRequest, verifyMrtdChallenge, verifyPkce, verifyPushedAuthorizationRequest, verifyTokenDPoP, verifyWalletAttestationJwt, verifyWalletAttestationJwt$3 as verifyWalletAttestationJwtV1_0, verifyWalletAttestationJwt$2 as verifyWalletAttestationJwtV1_3, verifyWalletAttestationJwt$1 as verifyWalletAttestationJwtV1_4, zAccessTokenProfileJwtHeader, zAccessTokenProfileJwtPayload, zAccessTokenRequest, zAccessTokenResponse, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationRequestV1_0, zAuthorizationRequestV1_3, zCertificateChain, zCompactJwe, zCompactJwt, zDpopJwtHeader, zDpopJwtPayload, zItWalletClientAttestationPopJwtAlg, zItWalletClientAttestationPopJwtHeader, zItWalletClientAttestationPopJwtPayload, zItWalletClientAttestationPopJwtTyp, zJarAuthorizationRequest, zJarRequestObjectHeader, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtConfirmationPayload, zJwtHeader, zJwtPayload, zMrtdChallengeJwtHeader, zMrtdChallengeJwtPayload, zMrtdPopInitResponseJwtHeader, zMrtdPopInitResponseJwtPayload, zMrtdPopVerifyResponse, zMrtdValidationJwtHeader, zMrtdValidationJwtPayload, zOauthClientAttestationHeader, zOauthClientAttestationPopHeader, zPushedAuthorizationRequestSigned, zPushedAuthorizationRequestUnsignedV1_0, zPushedAuthorizationRequestUnsignedV1_3, zPushedAuthorizationResponse, zRefreshTokenGrantIdentifier, zRefreshTokenProfileJwtHeader, zRefreshTokenProfileJwtPayload, zSignedAuthorizationRequestJwtHeaderTyp, zTrustChain, zWalletAttestationJwtHeaderV1_0, zWalletAttestationJwtHeaderV1_3, zWalletAttestationJwtHeaderV1_4, zWalletAttestationJwtPayloadV1_0, zWalletAttestationJwtPayloadV1_3, zWalletAttestationJwtPayloadV1_4, zWalletAttestationJwtV1_0, zWalletAttestationJwtV1_3, zWalletAttestationJwtV1_4 };
3670
+ export { type AccessTokenProfileJwtHeader, type AccessTokenProfileJwtPayload, type AccessTokenRequest, type AccessTokenResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationCodeGrantType, type AuthorizationRequestV1_0, type AuthorizationRequestV1_3, type BaseAuthorizationServerMetadata, type BaseVerifyWalletAttestationJwtOptions, type BaseWalletAttestationOptions, ClientAttestationError, type ClientAttestationOptions, type ItWalletClientAttestationPopJwtHeader as ClientAttestationPopJwtHeader, type ItWalletClientAttestationPopJwtPayload as ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationWalletAttestationJwtOptions, type CreateAccessTokenResponseOptions, type CreateClientAttestationPopJwtOptions, type CreateClientAttestationPopJwtOptionsForVersion, type CreateClientAttestationPopJwtOptionsV1_0, type CreateClientAttestationPopJwtOptionsV1_3, type CreateClientAttestationPopJwtOptionsV1_4, type CreateJarRequestOptions, type CreateJarRequestResult, type CreateMrtdValidationJwtOptions, type CreatePkceOptions, type CreatePkceReturn, type CreatePushedAuthorizationRequestOptions, type CreatePushedAuthorizationRequestOptionsV1_0, type CreatePushedAuthorizationRequestOptionsV1_3, type CreatePushedAuthorizationRequestOptionsV1_4, CreateTokenDPoPError, type CreateTokenDPoPOptions, CreateTokenResponseError, type DpopJwtHeader, type DpopJwtPayload, type FetchMrtdPopInitOptions, type FetchMrtdPopInitResult, type FetchMrtdPopVerifyOptions, type FetchMrtdPopVerifyResult, FetchTokenResponseError, type FetchTokenResponseOptions, type GetJwtFromFormPostOptions, IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES, type IsClientAttestationSupportedOptions, type ItWalletClientAttestationPopJwtAlg, type ItWalletClientAttestationPopJwtHeader, type ItWalletClientAttestationPopJwtPayload, type JarAuthorizationRequest, type JarRequestObjectHeader, type JarRequestObjectPayload, type MrtdChallengeJwtHeader, type MrtdChallengeJwtPayload, type MrtdDocumentData, MrtdPopError, type MrtdPopInitResponseJwtHeader, type MrtdPopInitResponseJwtPayload, type MrtdPopVerifyResponse, type MrtdValidationJwtHeader, type MrtdValidationJwtPayload, Oauth2Error, type ParseAccessTokenRequestOptions, type ParseAccessTokenRequestResult, type ParseAuthorizationRequestOptions, type ParseAuthorizationRequestResult, type ParseMrtdChallengeOptions, type ParseMrtdChallengeResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, type ParsedAccessTokenAuthorizationCodeRequestGrant, type ParsedAccessTokenRefreshTokenRequestGrant, type ParsedJarRequest, type ParsedJarRequestOptions, PkceCodeChallengeMethod, type PushedAuthorizationRequest, PushedAuthorizationRequestError, type PushedAuthorizationRequestSigned, type PushedAuthorizationRequestUnsignedV1_0, type PushedAuthorizationRequestUnsignedV1_3, type PushedAuthorizationResponse, type RefreshTokenGrantIdentifier, type RefreshTokenGrantType, type RefreshTokenProfileJwtHeader, type RefreshTokenProfileJwtPayload, type RetrieveAuthorizationCodeAccessTokenOptions, SupportedClientAuthenticationMethod, type VerifiedClientAttestationPopJwt, type VerifiedJarRequest, type VerifiedWalletAttestationJwt, type VerifiedWalletAttestationJwtV1_0, type VerifiedWalletAttestationJwtV1_3, type VerifiedWalletAttestationJwtV1_4, type VerifyAccessTokenRequestDpop, type VerifyAccessTokenRequestOptions, type VerifyAccessTokenRequestPkce, type VerifyAccessTokenRequestResult, type VerifyAuthorizationRequestDPoP, type VerifyAuthorizationRequestOptions, type VerifyAuthorizationRequestResult, type VerifyClientAttestationOptions, type VerifyClientAttestationPopJwtOptions, type VerifyJarRequestOptions, type VerifyMrtdChallengeOptions, type VerifyMrtdChallengeResult, type VerifyPkceOptions, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyTokenDPoPOptions, type VerifyWalletAttestationJwtOptions, type VerifyWalletAttestationJwtOptionsV1_0, type VerifyWalletAttestationJwtOptionsV1_3, type VerifyWalletAttestationJwtOptionsV1_4, type WalletAttestationJwtV1_0, type WalletAttestationJwtV1_3, type WalletAttestationJwtV1_4, type WalletAttestationOptionsV1_0, type WalletAttestationOptionsV1_3, type WalletAttestationOptionsV1_4, authorizationCodeGrantIdentifier, clientAuthenticationAnonymous, clientAuthenticationWalletAttestationJwt, createAccessTokenResponse, createClientAttestationPopJwt, createJarRequest, createMrtdValidationJwt, createPkce, createPushedAuthorizationRequest, createTokenDPoP, createTokenRequest, createWalletAttestationJwt$2 as createWalletAttestationJwtV1_0, createWalletAttestationJwt$1 as createWalletAttestationJwtV1_3, createWalletAttestationJwt as createWalletAttestationJwtV1_4, extractClientAttestationJwtsFromHeaders, extractDpopJwtFromHeaders, fetchJarRequestObject, fetchMrtdPopInit, fetchMrtdPopVerify, fetchPushedAuthorizationResponse, type fetchPushedAuthorizationResponseOptions, fetchTokenResponse, getJwtFromFormPost, htuFromRequestUrl, isClientAttestationSupported, isJarAuthorizationRequest, isPushedAuthorizationRequestSigned, isPushedAuthorizationRequestUnsigned, jwtAuthorizationRequestJwtHeaderTyp, oauthClientAttestationHeader, oauthClientAttestationPopHeader, parseAccessTokenRequest, parseAuthorizationRequest, parseJarRequest, parseMrtdChallenge, parsePushedAuthorizationRequest, refreshTokenGrantIdentifier, signedAuthorizationRequestJwtHeaderTyp, toURLSearchParams, validateJarRequestParams, verifyAccessTokenRequest, verifyAuthorizationRequest, verifyClientAttestation, verifyClientAttestationPopJwt, verifyJarRequest, verifyMrtdChallenge, verifyPkce, verifyPushedAuthorizationRequest, verifyTokenDPoP, verifyWalletAttestationJwt, verifyWalletAttestationJwt$3 as verifyWalletAttestationJwtV1_0, verifyWalletAttestationJwt$2 as verifyWalletAttestationJwtV1_3, verifyWalletAttestationJwt$1 as verifyWalletAttestationJwtV1_4, zAccessTokenProfileJwtHeader, zAccessTokenProfileJwtPayload, zAccessTokenRequest, zAccessTokenResponse, zAuthorizationCodeGrantIdentifier, zAuthorizationRequestV1_0, zAuthorizationRequestV1_3, zDpopJwtHeader, zDpopJwtPayload, zItWalletClientAttestationPopJwtAlg, zItWalletClientAttestationPopJwtHeader, zItWalletClientAttestationPopJwtPayload, zItWalletClientAttestationPopJwtTyp, zJarAuthorizationRequest, zJarRequestObjectHeader, zJarRequestObjectPayload, zMrtdChallengeJwtHeader, zMrtdChallengeJwtPayload, zMrtdPopInitResponseJwtHeader, zMrtdPopInitResponseJwtPayload, zMrtdPopVerifyResponse, zMrtdValidationJwtHeader, zMrtdValidationJwtPayload, zOauthClientAttestationHeader, zOauthClientAttestationPopHeader, zPushedAuthorizationRequestSigned, zPushedAuthorizationRequestUnsignedV1_0, zPushedAuthorizationRequestUnsignedV1_3, zPushedAuthorizationResponse, zRefreshTokenGrantIdentifier, zRefreshTokenProfileJwtHeader, zRefreshTokenProfileJwtPayload, zSignedAuthorizationRequestJwtHeaderTyp, zWalletAttestationJwtHeaderV1_0, zWalletAttestationJwtHeaderV1_3, zWalletAttestationJwtHeaderV1_4, zWalletAttestationJwtPayloadV1_0, zWalletAttestationJwtPayloadV1_3, zWalletAttestationJwtPayloadV1_4, zWalletAttestationJwtV1_0, zWalletAttestationJwtV1_3, zWalletAttestationJwtV1_4 };