import { BaseSchema, ContentType, Fetch, FetchHeaders, FetchRequestInit, FetchResponse, HttpMethod, HttpMethod as HttpMethod$1, InvalidFetchResponseError, Oid4vcTsConfig, OrPromise, StringWithAutoCompletion, getGlobalConfig, setGlobalConfig } from "@openid4vc/utils"; import z, { z as z$1 } from "zod"; //#region src/common/jwk/z-jwk.d.ts declare const zJwk: z.ZodObject<{ kty: z.ZodString; crv: z.ZodOptional; x: z.ZodOptional; y: z.ZodOptional; e: z.ZodOptional; n: z.ZodOptional; alg: z.ZodOptional; d: z.ZodOptional; dp: z.ZodOptional; dq: z.ZodOptional; ext: z.ZodOptional; k: z.ZodOptional; key_ops: z.ZodOptional>; kid: z.ZodOptional; oth: z.ZodOptional; r: z.ZodOptional; t: z.ZodOptional; }, z.core.$loose>>>; p: z.ZodOptional; q: z.ZodOptional; qi: z.ZodOptional; use: z.ZodOptional; x5c: z.ZodOptional>; x5t: z.ZodOptional; 'x5t#S256': z.ZodOptional; x5u: z.ZodOptional; }, z.core.$loose>; type Jwk = z.infer; declare const zJwkSet: z.ZodObject<{ keys: z.ZodArray; x: z.ZodOptional; y: z.ZodOptional; e: z.ZodOptional; n: z.ZodOptional; alg: z.ZodOptional; d: z.ZodOptional; dp: z.ZodOptional; dq: z.ZodOptional; ext: z.ZodOptional; k: z.ZodOptional; key_ops: z.ZodOptional>; kid: z.ZodOptional; oth: z.ZodOptional; r: z.ZodOptional; t: z.ZodOptional; }, z.core.$loose>>>; p: z.ZodOptional; q: z.ZodOptional; qi: z.ZodOptional; use: z.ZodOptional; x5c: z.ZodOptional>; x5t: z.ZodOptional; 'x5t#S256': z.ZodOptional; x5u: z.ZodOptional; }, z.core.$loose>>; }, z.core.$loose>; type JwkSet = z.infer; //#endregion //#region src/common/jwt/z-jwt.d.ts type JwtSignerDid = { method: 'did'; didUrl: string; alg: string; /** * The key id that should be used for signing. You need to make sure the kid actuall matches * with the key associated with the didUrl. */ kid?: string; }; type JwtSignerJwk = { method: 'jwk'; publicJwk: Jwk; alg: string; /** * The key id that should be used for signing. You need to make sure the kid actuall matches * with the key associated with the jwk. * * If not provided the kid can also be extracted from the `publicJwk`. Providing it here means the `kid` won't * be included in the JWT header. */ kid?: string; }; type JwtSignerX5c = { method: 'x5c'; x5c: string[]; alg: string; /** * The key id that should be used for signing. You need to make sure the kid actuall matches * with the key associated with the leaf certificate. */ kid?: string; }; type JwtSignerFederation = { method: 'federation'; trustChain?: [string, ...string[]]; alg: string; /** * The key id that should be used for signing. You need to make sure the kid actuall matches * with a key present in the federation. */ kid: string; }; type JwtSignerCustom = { method: 'custom'; alg: string; /** * The key id that should be used for signing. */ kid?: string; }; type JwtSigner = JwtSignerDid | JwtSignerJwk | JwtSignerX5c | JwtSignerFederation | JwtSignerCustom; type JwtSignerWithJwk = JwtSigner & { publicJwk: Jwk; }; type JweEncryptor = JwtSignerJwk & { enc: string; /** * base64-url encoded apu */ apu?: string; /** * base64-url encoded apv */ apv?: string; }; declare const zCompactJwt: z.ZodString; declare const zJwtPayload: z.ZodObject<{ iss: z.ZodOptional; aud: z.ZodOptional]>>; iat: z.ZodOptional; exp: z.ZodOptional; nbf: z.ZodOptional; nonce: z.ZodOptional; jti: z.ZodOptional; sub: z.ZodOptional; cnf: z.ZodOptional; x: z.ZodOptional; y: z.ZodOptional; e: z.ZodOptional; n: z.ZodOptional; alg: z.ZodOptional; d: z.ZodOptional; dp: z.ZodOptional; dq: z.ZodOptional; ext: z.ZodOptional; k: z.ZodOptional; key_ops: z.ZodOptional>; kid: z.ZodOptional; oth: z.ZodOptional; r: z.ZodOptional; t: z.ZodOptional; }, z.core.$loose>>>; p: z.ZodOptional; q: z.ZodOptional; qi: z.ZodOptional; use: z.ZodOptional; x5c: z.ZodOptional>; x5t: z.ZodOptional; 'x5t#S256': z.ZodOptional; x5u: z.ZodOptional; }, z.core.$loose>>; jkt: z.ZodOptional; }, z.core.$loose>>; status: z.ZodOptional>; trust_chain: z.ZodOptional>; }, z.core.$loose>; type JwtPayload = z.infer; declare const zJwtHeader: z.ZodObject<{ alg: z.ZodString; typ: z.ZodOptional; kid: z.ZodOptional; jwk: z.ZodOptional; x: z.ZodOptional; y: z.ZodOptional; e: z.ZodOptional; n: z.ZodOptional; alg: z.ZodOptional; d: z.ZodOptional; dp: z.ZodOptional; dq: z.ZodOptional; ext: z.ZodOptional; k: z.ZodOptional; key_ops: z.ZodOptional>; kid: z.ZodOptional; oth: z.ZodOptional; r: z.ZodOptional; t: z.ZodOptional; }, z.core.$loose>>>; p: z.ZodOptional; q: z.ZodOptional; qi: z.ZodOptional; use: z.ZodOptional; x5c: z.ZodOptional>; x5t: z.ZodOptional; 'x5t#S256': z.ZodOptional; x5u: z.ZodOptional; }, z.core.$loose>>; x5c: z.ZodOptional>; trust_chain: z.ZodOptional>; }, z.core.$loose>; type JwtHeader = z.infer; //#endregion //#region src/metadata/authorization-server/z-authorization-server-metadata.d.ts declare const zAuthorizationServerMetadata: z.ZodObject<{ issuer: z.ZodURL; token_endpoint: z.ZodURL; token_endpoint_auth_methods_supported: z.ZodOptional, z.ZodString]>>>; authorization_endpoint: z.ZodOptional; jwks_uri: z.ZodOptional; grant_types_supported: z.ZodOptional>; code_challenge_methods_supported: z.ZodOptional>; dpop_signing_alg_values_supported: z.ZodOptional>; require_pushed_authorization_requests: z.ZodOptional; pushed_authorization_request_endpoint: z.ZodOptional; introspection_endpoint: z.ZodOptional; introspection_endpoint_auth_methods_supported: z.ZodOptional, z.ZodString]>>>; introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional>; authorization_challenge_endpoint: z.ZodOptional; interactive_authorization_endpoint: z.ZodOptional; require_interactive_authorization_request: z.ZodOptional; 'pre-authorized_grant_anonymous_access_supported': z.ZodOptional; client_attestation_signing_alg_values_supported: z.ZodOptional>; client_attestation_pop_signing_alg_values_supported: z.ZodOptional>; challenge_endpoint: z.ZodOptional; client_attestation_pop_nonce_required: z.ZodOptional; authorization_response_iss_parameter_supported: z.ZodOptional; }, z.core.$loose>; type AuthorizationServerMetadata = z.infer; //#endregion //#region src/client-authentication.d.ts declare enum SupportedClientAuthenticationMethod { ClientSecretBasic = "client_secret_basic", ClientSecretPost = "client_secret_post", ClientAttestationJwt = "attest_jwt_client_auth", ClientAttestationJwtDpop = "attest_jwt_client_auth_dpop", None = "none" } interface ClientAuthenticationDynamicOptions { clientId: string; clientSecret: string; } /** * Dynamicaly get the client authentication method based on endpoint type and authorization server. * Only `client_secret_post`, `client_secret_basic`, and `none` supported. * * It also supports anonymous access to the token endpoint for pre-authorized code flow * if the authorization server has enabled `pre-authorized_grant_anonymous_access_supported` */ declare function clientAuthenticationDynamic(options: ClientAuthenticationDynamicOptions): ClientAuthenticationCallback; /** * Options for client authentication */ interface ClientAuthenticationCallbackOptions { /** * Metadata of the authorization server */ authorizationServerMetadata: AuthorizationServerMetadata; /** * URL to which the request will be made */ url: string; /** * http method that will be used */ method: HttpMethod$1; /** * Headers for the request. You can modify this object */ headers: FetchHeaders; contentType: ContentType; /** * The body as a JSON object. If content type `x-www-form-urlencoded` * is used, it will be encoded after this call. * * You can modify this object */ body: Record; /** * A fresh Client Attestation challenge provided by the authorization server (draft 09), e.g. * obtained from the `OAuth-Client-Attestation-Challenge` response header when retrying after a * `use_attestation_challenge` error. When set it takes precedence over any statically configured * challenge for methods that include a Client Attestation PoP. */ attestationChallenge?: string; } /** * Callback method to determine the client authentication for a request. */ type ClientAuthenticationCallback = (options: ClientAuthenticationCallbackOptions) => Promise | void; interface ClientAuthenticationClientSecretPostOptions { clientId: string; clientSecret: string; } /** * Client authentication using `client_secret_post` option */ declare function clientAuthenticationClientSecretPost(options: ClientAuthenticationClientSecretPostOptions): ClientAuthenticationCallback; interface ClientAuthenticationClientSecretBasicOptions { clientId: string; clientSecret: string; } /** * Client authentication using `client_secret_basic` option */ declare function clientAuthenticationClientSecretBasic(options: ClientAuthenticationClientSecretBasicOptions): ClientAuthenticationCallback; interface ClientAuthenticationNoneOptions { clientId: string; } /** * Client authentication using `none` option */ declare function clientAuthenticationNone(options: ClientAuthenticationNoneOptions): ClientAuthenticationCallback; /** * Anonymous client authentication */ declare function clientAuthenticationAnonymous(): ClientAuthenticationCallback; interface ClientAuthenticationClientAttestationJwtOptions { clientAttestationJwt: string; callbacks: Pick; /** * Challenge provided by the authorization server (e.g. obtained from its `challenge_endpoint`) * to include in the Client Attestation PoP JWT. */ challenge?: string; } /** * Client authentication using `attest_jwt_client_auth` option. */ declare function clientAuthenticationClientAttestationJwt(options: ClientAuthenticationClientAttestationJwtOptions): ClientAuthenticationCallback; interface ClientAuthenticationClientAttestationJwtDpopOptions { clientAttestationJwt: string; callbacks: Pick; /** * The DPoP (client instance) key signer. In the DPoP-bound method the client instance key and the * DPoP key are the same key. If not provided, the signer is derived from the `cnf.jwk` of the client * attestation. */ signer?: JwtSignerJwk; /** * Challenge provided by the authorization server (e.g. obtained from its `challenge_endpoint`) to * include in the DPoP proof. A server-provided challenge threaded through the client authentication * callback takes precedence. The challenge is placed in the DPoP `nonce` claim. */ challenge?: string; } /** * Client authentication using the `attest_jwt_client_auth_dpop` option (draft 09 §5.2). * * In this DPoP-bound variant the client instance key and the DPoP key are the same key, and a single * DPoP proof serves as both the DPoP proof and the Client Attestation PoP. The request carries the * `OAuth-Client-Attestation` and `DPoP` headers, but no separate `OAuth-Client-Attestation-PoP` header. */ declare function clientAuthenticationClientAttestationJwtDpop(options: ClientAuthenticationClientAttestationJwtDpopOptions): ClientAuthenticationCallback; //#endregion //#region src/callbacks.d.ts /** * Supported hashing algorithms * * Based on https://www.iana.org/assignments/named-information/named-information.xhtml */ declare enum HashAlgorithm { Sha256 = "sha-256", Sha384 = "sha-384", Sha512 = "sha-512" } /** * Callback used for operations that require hashing */ type HashCallback = (data: Uint8Array, alg: HashAlgorithm) => OrPromise; type GenerateRandomCallback = (byteLength: number) => OrPromise; type SignJwtCallback = (jwtSigner: JwtSigner, jwt: { header: JwtHeader; payload: JwtPayload; }) => OrPromise<{ jwt: string; signerJwk: Jwk; }>; type VerifyJwtCallback = (jwtSigner: JwtSigner, jwt: { header: JwtHeader; payload: JwtPayload; compact: string; }) => OrPromise<{ verified: true; signerJwk: Jwk; } | { verified: false; signerJwk?: Jwk; }>; type VerifyDataIntegrityProofCallback = (dataIntegrityProof: Record, document: Record) => OrPromise<{ verified: true; signerJwk: Jwk; } | { verified: false; signerJwk?: Jwk; }>; interface DecryptJweCallbackOptions { jwk?: Jwk; } type DecryptJweCallback = (jwe: string, options?: DecryptJweCallbackOptions) => OrPromise<{ decrypted: true; decryptionJwk: Jwk; payload: string; } | { decrypted: false; decryptionJwk?: Jwk; payload?: string; }>; type EncryptJweCallback = (jweEncryptor: JweEncryptor, data: string) => OrPromise<{ encryptionJwk: Jwk; jwe: string; }>; /** * Callback context provides the callbacks that are required for the openid4vc library */ interface CallbackContext { /** * Custom fetch implementation to use */ fetch?: Fetch; /** * Hash callback used for e.g. dpop and pkce */ hash: HashCallback; /** * Sign jwt callback for signing of Json Web Tokens */ signJwt: SignJwtCallback; /** * Decrypt jwe callback for decrypting of Json Web Encryptions */ decryptJwe: DecryptJweCallback; /** * Encrypt jwt callback for encrypting of Json Web Encryptions */ encryptJwe: EncryptJweCallback; /** * Verify jwt callback for verification of Json Web Tokens */ verifyJwt: VerifyJwtCallback; /** * Verify a Data Integrity proof (e.g. the `proof` of a `di_vp` key proof's Verifiable * Presentation). Optional because most issuers won't support the `di_vp` proof type. */ verifyDataIntegrityProof?: VerifyDataIntegrityProofCallback; /** * Generate random callback to generate random bytes. Used for * e.g. the 'jti' value in a dpop jwt, and 'code_verifier' in pkce. */ generateRandom: GenerateRandomCallback; /** * Extend a request to the authorization server with client authentication * parameters. If you're not using client authentication, you can set this * to `clientAuthenticationNone()` * * There are three default client authentication methods provided: * - `clientAuthenticationClientSecretPost` * - `clientAuthenticationClientSecretBasic` * - `clientAuthenticationClientAttestationJwt` * - `clientAuthenticationNone` * - `clientAuthenticationAnonymous` * * A custom implementation can be made for other methods, or allowing complex * scenarios where multiple authorization servers are supported. */ clientAuthentication: ClientAuthenticationCallback; /** * Get the DNS names and URI names from a X.509 certificate */ getX509CertificateMetadata?: (certificate: string) => { sanDnsNames: string[]; sanUriNames: string[]; }; } //#endregion //#region src/common/z-common.d.ts declare const zAlgValueNotNone: z.ZodString; interface RequestLike { headers: FetchHeaders; method: HttpMethod$1; url: string; } //#endregion //#region src/dpop/dpop.d.ts interface RequestDpopOptions { /** * Dpop nonce to use for constructing the dpop jwt */ nonce?: string; /** * The signer of the dpop jwt */ signer: JwtSignerJwk; } declare function createDpopHeadersForRequest(options: CreateDpopJwtOptions): Promise<{ DPoP: string; }>; interface CreateDpopJwtOptions { request: Omit; /** * Dpop nonce value */ nonce?: string; /** * Creation time of the JWT. If not provided the current date will be used */ issuedAt?: Date; /** * Additional payload to include in the dpop jwt payload. Will be applied after * any default claims that are included, so add claims with caution. */ additionalPayload?: Record; /** * The access token to which the dpop jwt should be bound. Required * when the dpop will be sent along with an access token. * * If provided, the `hashCallback` parameter also needs to be provided */ accessToken?: string; /** * Callback used for dpop */ callbacks: Pick; /** * The signer of the dpop jwt. Only jwk signer allowed. */ signer: JwtSignerJwk; } interface VerifyDpopJwtOptions { /** * The compact dpop jwt. */ dpopJwt: string; /** * The requet for which to verify the dpop jwt */ request: RequestLike; /** * Allowed dpop signing alg values. If not provided * any alg values are allowed and it's up to the `verifyJwtCallback` * to handle the alg. */ allowedSigningAlgs?: string[]; /** * Expected nonce in the payload. If not provided the nonce won't be validated. */ expectedNonce?: string; /** * Access token to which the dpop jwt is bound. If provided the sha-256 hash of the * access token needs to match the 'ath' claim. */ accessToken?: string; /** * The expected jwk thumprint 'jti' confirmation method. If provided the thumprint of the * jwk used to sign the dpop jwt must match this provided thumbprint value. The 'jti' value * can be extracted from the access token payload, or if opaque tokens are used can be retrieved * using token introspection. */ expectedJwkThumbprint?: string; /** * Callbacks used for verifying dpop jwt */ callbacks: Pick; now?: Date; } declare function extractDpopNonceFromHeaders(headers: FetchHeaders): string | null; //#endregion //#region src/access-token/z-access-token.d.ts declare const zAccessTokenRequest: z.ZodIntersection; code: z.ZodOptional; redirect_uri: z.ZodOptional; refresh_token: z.ZodOptional; resource: z.ZodOptional; code_verifier: z.ZodOptional; grant_type: z.ZodUnion, z.ZodLiteral<"authorization_code">, z.ZodLiteral<"refresh_token">, z.ZodLiteral<"client_credentials">, z.ZodString]>; }, z.core.$loose>, z.ZodPipe; user_pin: z.ZodOptional; }, z.core.$loose>, z.ZodTransform<{ tx_code?: string | undefined; }, { [x: string]: unknown; tx_code?: string | undefined; user_pin?: string | undefined; }>>>; type AccessTokenRequest = z.infer; declare const zAccessTokenResponse: z.ZodObject<{ access_token: z.ZodString; token_type: z.ZodString; expires_in: z.ZodOptional; scope: z.ZodOptional; state: z.ZodOptional; refresh_token: z.ZodOptional; c_nonce: z.ZodOptional; c_nonce_expires_in: z.ZodOptional; authorization_details: z.ZodOptional>>; }, z.core.$loose>; type AccessTokenResponse = z.infer; declare const zAccessTokenErrorResponse: z.ZodObject<{ error: z.ZodUnion, z.ZodString]>; error_description: z.ZodOptional; error_uri: z.ZodOptional; }, z.core.$loose>; type AccessTokenErrorResponse = z.infer; //#endregion //#region src/access-token/retrieve-access-token.d.ts interface RetrieveAccessTokenReturn { accessTokenResponse: AccessTokenResponse; dpop?: RequestDpopOptions; /** * A fresh Client Attestation challenge provided by the authorization server in the * `OAuth-Client-Attestation-Challenge` response header (draft 09 §6.2). If present, the client * should use this challenge for the next Client Attestation PoP JWT. */ attestationChallenge?: string; } interface RetrieveAccessTokenBaseOptions { /** * Authorization server to request the access token from */ authorizationServerMetadata: AuthorizationServerMetadata; /** * Callbacks to use for requesting access token */ callbacks: Pick; /** * The resource to which access is being requested. This can help the authorization * server in determining the resource server to handle the authorization request for */ resource?: string; /** * Dpop parameters for including a dpop in the access token request. The request will automatically * be retried if the server responds with a 'use_dpop_nonce' header. * * If provided but 'dpop_signing_alg_values_supported' is not available in the authorization server * metadata, or the 'alg' value does not match an error will be thrown. */ dpop?: RequestDpopOptions; } interface RetrievePreAuthorizedCodeAccessTokenOptions extends RetrieveAccessTokenBaseOptions { preAuthorizedCode: string; txCode?: string; /** * Additional payload to include in the access token request. Items will be encoded and sent * using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded. */ additionalRequestPayload?: Record; } interface RetrieveAuthorizationCodeAccessTokenOptions extends RetrieveAccessTokenBaseOptions { /** * PKCE Code verifier that was used in the authorization request. */ pkceCodeVerifier?: string; /** * The authorization code */ authorizationCode: string; /** * Redirect uri to include in the access token request. Only required * if the redirect uri was present in the authorization request. */ redirectUri?: string; /** * Additional payload to include in the access token request. Items will be encoded and sent * using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded. */ additionalRequestPayload?: Record; } interface RetrieveRefreshTokenAccessTokenOptions extends RetrieveAccessTokenBaseOptions { /** * The refresh token */ refreshToken: string; /** * Additional payload to include in the access token request. Items will be encoded and sent * using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded. */ additionalRequestPayload?: Record; } interface RetrieveClientCredentialsAccessTokenOptions extends RetrieveAccessTokenBaseOptions { /** * The scope of the access request */ scope?: string; /** * Additional payload to include in the access token request. Items will be encoded and sent * using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded. */ additionalRequestPayload?: Record; } //#endregion //#region src/access-token/verify-access-token.d.ts declare enum SupportedAuthenticationScheme { Bearer = "Bearer", DPoP = "DPoP" } //#endregion //#region src/client-attestation/z-client-attestation.d.ts declare const zClientAttestationJwtPayload: z.ZodObject<{ sub: z.ZodString; exp: z.ZodNumber; cnf: z.ZodObject<{ jwk: z.ZodObject<{ kty: z.ZodString; crv: z.ZodOptional; x: z.ZodOptional; y: z.ZodOptional; e: z.ZodOptional; n: z.ZodOptional; alg: z.ZodOptional; d: z.ZodOptional; dp: z.ZodOptional; dq: z.ZodOptional; ext: z.ZodOptional; k: z.ZodOptional; key_ops: z.ZodOptional>; kid: z.ZodOptional; oth: z.ZodOptional; r: z.ZodOptional; t: z.ZodOptional; }, z.core.$loose>>>; p: z.ZodOptional; q: z.ZodOptional; qi: z.ZodOptional; use: z.ZodOptional; x5c: z.ZodOptional>; x5t: z.ZodOptional; 'x5t#S256': z.ZodOptional; x5u: z.ZodOptional; }, z.core.$loose>; }, z.core.$loose>; wallet_name: z.ZodOptional; wallet_link: z.ZodOptional; iss: z.ZodOptional; aud: z.ZodOptional]>>; iat: z.ZodOptional; nbf: z.ZodOptional; nonce: z.ZodOptional; jti: z.ZodOptional; status: z.ZodOptional>; trust_chain: z.ZodOptional>; }, z.core.$loose>; type ClientAttestationJwtPayload = z.infer; declare const zClientAttestationJwtHeader: z.ZodObject<{ typ: z.ZodLiteral<"oauth-client-attestation+jwt">; alg: z.ZodString; kid: z.ZodOptional; jwk: z.ZodOptional; x: z.ZodOptional; y: z.ZodOptional; e: z.ZodOptional; n: z.ZodOptional; alg: z.ZodOptional; d: z.ZodOptional; dp: z.ZodOptional; dq: z.ZodOptional; ext: z.ZodOptional; k: z.ZodOptional; key_ops: z.ZodOptional>; kid: z.ZodOptional; oth: z.ZodOptional; r: z.ZodOptional; t: z.ZodOptional; }, z.core.$loose>>>; p: z.ZodOptional; q: z.ZodOptional; qi: z.ZodOptional; use: z.ZodOptional; x5c: z.ZodOptional>; x5t: z.ZodOptional; 'x5t#S256': z.ZodOptional; x5u: z.ZodOptional; }, z.core.$loose>>; x5c: z.ZodOptional>; trust_chain: z.ZodOptional>; }, z.core.$loose>; type ClientAttestationJwtHeader = z.infer; declare const zClientAttestationChallengeResponse: z.ZodObject<{ attestation_challenge: z.ZodString; }, z.core.$loose>; type ClientAttestationChallengeResponse = z.infer; declare const zClientAttestationPopJwtPayload: z.ZodObject<{ aud: z.ZodUnion]>; jti: z.ZodString; challenge: z.ZodOptional; nonce: z.ZodOptional; iss: z.ZodOptional; iat: z.ZodOptional; exp: z.ZodOptional; nbf: z.ZodOptional; sub: z.ZodOptional; cnf: z.ZodOptional; x: z.ZodOptional; y: z.ZodOptional; e: z.ZodOptional; n: z.ZodOptional; alg: z.ZodOptional; d: z.ZodOptional; dp: z.ZodOptional; dq: z.ZodOptional; ext: z.ZodOptional; k: z.ZodOptional; key_ops: z.ZodOptional>; kid: z.ZodOptional; oth: z.ZodOptional; r: z.ZodOptional; t: z.ZodOptional; }, z.core.$loose>>>; p: z.ZodOptional; q: z.ZodOptional; qi: z.ZodOptional; use: z.ZodOptional; x5c: z.ZodOptional>; x5t: z.ZodOptional; 'x5t#S256': z.ZodOptional; x5u: z.ZodOptional; }, z.core.$loose>>; jkt: z.ZodOptional; }, z.core.$loose>>; status: z.ZodOptional>; trust_chain: z.ZodOptional>; }, z.core.$loose>; type ClientAttestationPopJwtPayload = z.infer; declare const zClientAttestationPopJwtHeader: z.ZodObject<{ typ: z.ZodLiteral<"oauth-client-attestation-pop+jwt">; alg: z.ZodString; kid: z.ZodOptional; jwk: z.ZodOptional; x: z.ZodOptional; y: z.ZodOptional; e: z.ZodOptional; n: z.ZodOptional; alg: z.ZodOptional; d: z.ZodOptional; dp: z.ZodOptional; dq: z.ZodOptional; ext: z.ZodOptional; k: z.ZodOptional; key_ops: z.ZodOptional>; kid: z.ZodOptional; oth: z.ZodOptional; r: z.ZodOptional; t: z.ZodOptional; }, z.core.$loose>>>; p: z.ZodOptional; q: z.ZodOptional; qi: z.ZodOptional; use: z.ZodOptional; x5c: z.ZodOptional>; x5t: z.ZodOptional; 'x5t#S256': z.ZodOptional; x5u: z.ZodOptional; }, z.core.$loose>>; x5c: z.ZodOptional>; trust_chain: z.ZodOptional>; }, z.core.$loose>; type ClientAttestationPopJwtHeader = z.infer; //#endregion //#region src/client-attestation/client-attestation.d.ts interface VerifyClientAttestationJwtOptions { /** * The compact client attestation jwt. */ clientAttestationJwt: string; /** * Date to use for expiration. If not provided current date will be used. */ now?: Date; /** * Allowed skew time in seconds for validity of token. Used for `exp` and `nbf` * verification. * * @default 0 */ allowedSkewInSeconds?: number; /** * Callbacks used for verifying client attestation pop jwt. */ callbacks: Pick; } type VerifiedClientAttestationJwt = Awaited>; declare function verifyClientAttestationJwt(options: VerifyClientAttestationJwtOptions): Promise<{ header: { [x: string]: unknown; typ: "oauth-client-attestation+jwt"; alg: string; kid?: string | undefined; jwk?: { [x: string]: unknown; kty: string; crv?: string | undefined; x?: string | undefined; y?: string | undefined; e?: string | undefined; n?: string | undefined; alg?: string | undefined; d?: string | undefined; dp?: string | undefined; dq?: string | undefined; ext?: boolean | undefined; k?: string | undefined; key_ops?: string[] | undefined; kid?: string | undefined; oth?: { [x: string]: unknown; d?: string | undefined; r?: string | undefined; t?: string | undefined; }[] | undefined; p?: string | undefined; q?: string | undefined; qi?: string | undefined; use?: string | undefined; x5c?: string[] | undefined; x5t?: string | undefined; 'x5t#S256'?: string | undefined; x5u?: string | undefined; } | undefined; x5c?: string[] | undefined; trust_chain?: [string, ...string[]] | undefined; }; payload: { [x: string]: unknown; sub: string; exp: number; cnf: { [x: string]: unknown; jwk: { [x: string]: unknown; kty: string; crv?: string | undefined; x?: string | undefined; y?: string | undefined; e?: string | undefined; n?: string | undefined; alg?: string | undefined; d?: string | undefined; dp?: string | undefined; dq?: string | undefined; ext?: boolean | undefined; k?: string | undefined; key_ops?: string[] | undefined; kid?: string | undefined; oth?: { [x: string]: unknown; d?: string | undefined; r?: string | undefined; t?: string | undefined; }[] | undefined; p?: string | undefined; q?: string | undefined; qi?: string | undefined; use?: string | undefined; x5c?: string[] | undefined; x5t?: string | undefined; 'x5t#S256'?: string | undefined; x5u?: string | undefined; }; }; wallet_name?: string | undefined; wallet_link?: string | undefined; iss?: string | undefined; aud?: string | string[] | undefined; iat?: number | undefined; nbf?: number | undefined; nonce?: string | undefined; jti?: string | undefined; status?: Record | undefined; trust_chain?: [string, ...string[]] | undefined; }; signer: JwtSignerWithJwk; }>; interface CreateClientAttestationJwtOptions { /** * Creation time of the JWT. If not provided the current date will be used */ issuedAt?: Date; /** * Expiration time of the JWT. */ expiresAt: Date; /** * Issuer of the client attestation, usually the identifier of the client backend (attester). * * The `iss` claim was removed from the Client Attestation JWT in draft 08, so it is only * included in the payload when this option is provided. It is also useful for interoperability * with <= draft 07 verifiers and when the KID is a relative DID URL to the issuer. */ issuer?: string; /** * The client id of the client instance. */ clientId: string; /** * The confirmation payload for the client, attesting the `jwk`, `key_type` and `user_authentication` */ confirmation: ClientAttestationJwtPayload['cnf']; /** * Additional payload to include in the client attestation jwt payload. Will be applied after * any default claims that are included, so add claims with caution. */ additionalPayload?: Record; /** * Callback used for client attestation */ callbacks: Pick; /** * The signer of the client attestation jwt. */ signer: JwtSigner; } declare function createClientAttestationJwt(options: CreateClientAttestationJwtOptions): Promise; interface VerifyClientAttestationOptions { authorizationServer: string; clientAttestationJwt: string; clientAttestationPopJwt: string; callbacks: Pick; /** * Date to use for expiration. If not provided current date will be used. */ now?: Date; /** * Allowed skew time in seconds for validity of token. Used for `exp` and `nbf` * verification. * * @default 0 */ allowedSkewInSeconds?: number; } //#endregion //#region src/client-attestation/client-attestation-pop.d.ts interface RequestClientAttestationOptions { /** * The challenge provided by the authorization server to include in the client attestation pop jwt. */ challenge?: string; /** * @deprecated Renamed to `challenge` in draft 06. If `challenge` is not set, this value is used. */ nonce?: string; /** * The client attestation jwt to create the pop for. */ jwt: string; /** * The signer of the client attestation pop jwt. * * Will be extracted from the client attestation if not provided. */ signer?: JwtSignerJwk; } interface VerifyClientAttestationPopJwtOptions { /** * The compact client attestation pop jwt. */ clientAttestationPopJwt: string; /** * The issuer identifier of the authorization server handling the client attestation. */ authorizationServer: string; /** * The expected value of the `aud` claim. Defaults to `authorizationServer`. * * draft 09 allows the audience to be a Resource Server identifier URL in addition to the * authorization server issuer URL; set this when verifying a PoP JWT at a resource server. */ expectedAudience?: string; /** * Expected challenge in the payload. If not provided the challenge won't be validated. * * Matched against the `challenge` claim (draft 06+) and, for backwards compatibility, * the legacy `nonce` claim. */ expectedChallenge?: string; /** * @deprecated Renamed to `expectedChallenge` in draft 06. If `expectedChallenge` is not set, * this value is used. */ expectedNonce?: string; /** * Date to use for expiration. If not provided current date will be used. */ now?: Date; /** * Allowed skew time in seconds for validity of token. Used for `exp` and `nbf` * verification. * * @default 0 */ allowedSkewInSeconds?: number; /** * Callbacks used for verifying client attestation pop jwt. */ callbacks: Pick; /** * The parsed and verified client attestation jwt */ clientAttestation: { header: ClientAttestationJwtHeader; payload: ClientAttestationJwtPayload; }; } type VerifiedClientAttestationPopJwt = Awaited>; declare function verifyClientAttestationPopJwt(options: VerifyClientAttestationPopJwtOptions): Promise<{ header: { [x: string]: unknown; typ: "oauth-client-attestation-pop+jwt"; alg: string; kid?: string | undefined; jwk?: { [x: string]: unknown; kty: string; crv?: string | undefined; x?: string | undefined; y?: string | undefined; e?: string | undefined; n?: string | undefined; alg?: string | undefined; d?: string | undefined; dp?: string | undefined; dq?: string | undefined; ext?: boolean | undefined; k?: string | undefined; key_ops?: string[] | undefined; kid?: string | undefined; oth?: { [x: string]: unknown; d?: string | undefined; r?: string | undefined; t?: string | undefined; }[] | undefined; p?: string | undefined; q?: string | undefined; qi?: string | undefined; use?: string | undefined; x5c?: string[] | undefined; x5t?: string | undefined; 'x5t#S256'?: string | undefined; x5u?: string | undefined; } | undefined; x5c?: string[] | undefined; trust_chain?: [string, ...string[]] | undefined; }; payload: { [x: string]: unknown; aud: string | string[]; jti: string; challenge?: string | undefined; nonce?: string | undefined; iss?: string | undefined; iat?: number | undefined; exp?: number | undefined; nbf?: number | undefined; sub?: string | undefined; cnf?: { [x: string]: unknown; jwk?: { [x: string]: unknown; kty: string; crv?: string | undefined; x?: string | undefined; y?: string | undefined; e?: string | undefined; n?: string | undefined; alg?: string | undefined; d?: string | undefined; dp?: string | undefined; dq?: string | undefined; ext?: boolean | undefined; k?: string | undefined; key_ops?: string[] | undefined; kid?: string | undefined; oth?: { [x: string]: unknown; d?: string | undefined; r?: string | undefined; t?: string | undefined; }[] | undefined; p?: string | undefined; q?: string | undefined; qi?: string | undefined; use?: string | undefined; x5c?: string[] | undefined; x5t?: string | undefined; 'x5t#S256'?: string | undefined; x5u?: string | undefined; } | undefined; jkt?: string | undefined; } | undefined; status?: Record | undefined; trust_chain?: [string, ...string[]] | undefined; }; signer: JwtSignerWithJwk; }>; //#endregion //#region src/pkce.d.ts declare enum PkceCodeChallengeMethod { Plain = "plain", S256 = "S256" } interface CreatePkceOptions { /** * Also allows string values so it can be directly passed from the * 'code_challenge_methods_supported' metadata parameter */ allowedCodeChallengeMethods?: Array; /** * Code verifier to use. If not provided a value will be generated. */ codeVerifier?: string; callbacks: Pick; } interface CreatePkceReturn { codeVerifier: string; codeChallenge: string; codeChallengeMethod: PkceCodeChallengeMethod; } declare function createPkce(options: CreatePkceOptions): Promise; //#endregion //#region src/z-grant-type.d.ts declare const zPreAuthorizedCodeGrantIdentifier: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:pre-authorized_code">; declare const preAuthorizedCodeGrantIdentifier: "urn:ietf:params:oauth:grant-type:pre-authorized_code"; type PreAuthorizedCodeGrantIdentifier = z.infer; declare const zAuthorizationCodeGrantIdentifier: z.ZodLiteral<"authorization_code">; declare const authorizationCodeGrantIdentifier: "authorization_code"; type AuthorizationCodeGrantIdentifier = z.infer; declare const zRefreshTokenGrantIdentifier: z.ZodLiteral<"refresh_token">; declare const refreshTokenGrantIdentifier: "refresh_token"; type RefreshTokenGrantIdentifier = z.infer; /** * Default value for `grant_types_supported` per RFC 8414 Section 2 * when not explicitly provided in authorization server metadata. */ declare const defaultGrantTypesSupported: readonly ["authorization_code", "implicit"]; /** * Get the supported grant types from authorization server metadata, * falling back to the RFC 8414 default of `["authorization_code", "implicit"]`. */ declare function getGrantTypesSupported(grantTypesSupported: string[] | undefined): readonly string[]; declare const zClientCredentialsGrantIdentifier: z.ZodLiteral<"client_credentials">; declare const clientCredentialsGrantIdentifier: "client_credentials"; type ClientCredentialsGrantIdentifier = z.infer; //#endregion //#region src/access-token/parse-access-token-request.d.ts interface ParsedAccessTokenPreAuthorizedCodeRequestGrant { grantType: PreAuthorizedCodeGrantIdentifier; preAuthorizedCode: string; txCode?: string; } interface ParsedAccessTokenAuthorizationCodeRequestGrant { grantType: AuthorizationCodeGrantIdentifier; code: string; } interface ParsedAccessTokenRefreshTokenRequestGrant { grantType: RefreshTokenGrantIdentifier; refreshToken: string; } type ParsedAccessTokenRequestGrant = ParsedAccessTokenPreAuthorizedCodeRequestGrant | ParsedAccessTokenAuthorizationCodeRequestGrant | ParsedAccessTokenRefreshTokenRequestGrant; interface ParseAccessTokenRequestResult { accessTokenRequest: AccessTokenRequest; grant: ParsedAccessTokenRequestGrant; /** * The dpop jwt from the access token request headers */ dpop?: { jwt: string; }; /** * The client attestation jwts from the access token request headers */ clientAttestation?: { clientAttestationJwt: string; /** * Absent for the DPoP-bound `attest_jwt_client_auth_dpop` method (draft 09), where the DPoP proof * serves as the Client Attestation PoP. */ clientAttestationPopJwt?: string; }; /** * The pkce code verifier from the access token request */ pkceCodeVerifier?: string; } interface ParseAccessTokenRequestOptions { request: RequestLike; /** * The access token request as a JSON object. Your server should decode the * `x-www-url-form-urlencoded` body into an object (e.g. using `bodyParser.urlEncoded()` in express) */ accessTokenRequest: Record; /** * Authorization server metadata. When provided, the grant type will be validated * against `grant_types_supported`. If `grant_types_supported` is not set in the metadata, * the default per RFC 8414 is `["authorization_code", "implicit"]`. */ authorizationServerMetadata?: AuthorizationServerMetadata; } //#endregion //#region src/access-token/verify-access-token-request.d.ts interface VerifyAccessTokenRequestDpop { /** * Whether dpop is required */ required?: boolean; /** * The dpop jwt from the access token request */ jwt?: string; /** * The expected jwk thumbprint, and can be used to match a dpop provided in the authorization * request to the dpop key used for the access token request. */ expectedJwkThumbprint?: string; /** * Allowed dpop signing alg values. If not provided * any alg values are allowed and it's up to the `verifyJwtCallback` * to handle the alg. */ allowedSigningAlgs?: string[]; /** * Expected nonce in the dpop proof. If not provided the nonce won't be validated. * * For the DPoP-bound `attest_jwt_client_auth_dpop` method (draft 09) the server-provided client * attestation challenge is carried in the dpop `nonce` claim, so this can be set to the issued * challenge to enforce it. */ expectedNonce?: string; } interface VerifyAccessTokenRequestClientAttestation { /** * Whether client attestation is required. */ required?: boolean; /** * Whether to ensure that the key used in client attestation confirmation * is the same key used for DPoP. This only has effect if both DPoP and client * attestations are present. * * @default false */ ensureConfirmationKeyMatchesDpopKey?: boolean; clientAttestationJwt?: string; clientAttestationPopJwt?: string; /** * The expected client id that is bound to the authorization session, and can be used to match the client id * provided in the authorization request to the client used for the access token request. */ expectedClientId?: string; } interface VerifyAccessTokenRequestPkce { codeVerifier?: string; codeChallenge: string; codeChallengeMethod: PkceCodeChallengeMethod; } interface VerifyAccessTokenRequestReturn { dpop?: { /** * base64url encoding of the JWK SHA-256 Thumbprint (according to [RFC7638]) * of the DPoP public key (in JWK format) */ jwkThumbprint: string; jwk: Jwk; }; clientAttestation?: { clientAttestation: VerifiedClientAttestationJwt; /** * Absent for the DPoP-bound `attest_jwt_client_auth_dpop` method (draft 09), where the verified * DPoP proof serves as the Client Attestation PoP. */ clientAttestationPop?: VerifiedClientAttestationPopJwt; }; } interface VerifyPreAuthorizedCodeAccessTokenRequestOptions { authorizationServerMetadata: AuthorizationServerMetadata; grant: ParsedAccessTokenPreAuthorizedCodeRequestGrant; accessTokenRequest: AccessTokenRequest; request: RequestLike; expectedPreAuthorizedCode: string; expectedTxCode?: string; clientAttestation?: VerifyAccessTokenRequestClientAttestation; dpop?: VerifyAccessTokenRequestDpop; pkce?: VerifyAccessTokenRequestPkce; preAuthorizedCodeExpiresAt?: Date; now?: Date; callbacks: Pick; } interface VerifyAuthorizationCodeAccessTokenRequestOptions { authorizationServerMetadata: AuthorizationServerMetadata; grant: ParsedAccessTokenAuthorizationCodeRequestGrant; accessTokenRequest: AccessTokenRequest; request: RequestLike; expectedCode: string; clientAttestation?: VerifyAccessTokenRequestClientAttestation; dpop?: VerifyAccessTokenRequestDpop; pkce?: VerifyAccessTokenRequestPkce; codeExpiresAt?: Date; now?: Date; callbacks: Pick; } interface VerifyRefreshTokenAccessTokenRequestOptions { authorizationServerMetadata: AuthorizationServerMetadata; grant: ParsedAccessTokenRefreshTokenRequestGrant; accessTokenRequest: AccessTokenRequest; request: RequestLike; expectedRefreshToken: string; clientAttestation?: VerifyAccessTokenRequestClientAttestation; dpop?: VerifyAccessTokenRequestDpop; pkce?: VerifyAccessTokenRequestPkce; refreshTokenExpiresAt?: Date; now?: Date; callbacks: Pick; } //#endregion //#region src/access-token/z-access-token-jwt.d.ts declare const zAccessTokenProfileJwtPayload: z.ZodObject<{ iss: z.ZodString; exp: z.ZodNumber; iat: z.ZodNumber; aud: z.ZodUnion]>; sub: z.ZodString; client_id: z.ZodOptional; jti: z.ZodString; scope: z.ZodOptional; nbf: z.ZodOptional; nonce: z.ZodOptional; cnf: z.ZodOptional; x: z.ZodOptional; y: z.ZodOptional; e: z.ZodOptional; n: z.ZodOptional; alg: z.ZodOptional; d: z.ZodOptional; dp: z.ZodOptional; dq: z.ZodOptional; ext: z.ZodOptional; k: z.ZodOptional; key_ops: z.ZodOptional>; kid: z.ZodOptional; oth: z.ZodOptional; r: z.ZodOptional; t: z.ZodOptional; }, z.core.$loose>>>; p: z.ZodOptional; q: z.ZodOptional; qi: z.ZodOptional; use: z.ZodOptional; x5c: z.ZodOptional>; x5t: z.ZodOptional; 'x5t#S256': z.ZodOptional; x5u: z.ZodOptional; }, z.core.$loose>>; jkt: z.ZodOptional; }, z.core.$loose>>; status: z.ZodOptional>; trust_chain: z.ZodOptional>; }, z.core.$loose>; type AccessTokenProfileJwtPayload = z.infer; //#endregion //#region src/access-token/z-token-introspection.d.ts declare const zTokenIntrospectionResponse: z.ZodObject<{ active: z.ZodBoolean; scope: z.ZodOptional; client_id: z.ZodOptional; username: z.ZodOptional; token_type: z.ZodOptional; exp: z.ZodOptional; iat: z.ZodOptional; nbf: z.ZodOptional; sub: z.ZodOptional; aud: z.ZodOptional]>>; iss: z.ZodOptional; jti: z.ZodOptional; cnf: z.ZodOptional; x: z.ZodOptional; y: z.ZodOptional; e: z.ZodOptional; n: z.ZodOptional; alg: z.ZodOptional; d: z.ZodOptional; dp: z.ZodOptional; dq: z.ZodOptional; ext: z.ZodOptional; k: z.ZodOptional; key_ops: z.ZodOptional>; kid: z.ZodOptional; oth: z.ZodOptional; r: z.ZodOptional; t: z.ZodOptional; }, z.core.$loose>>>; p: z.ZodOptional; q: z.ZodOptional; qi: z.ZodOptional; use: z.ZodOptional; x5c: z.ZodOptional>; x5t: z.ZodOptional; 'x5t#S256': z.ZodOptional; x5u: z.ZodOptional; }, z.core.$loose>>; jkt: z.ZodOptional; }, z.core.$loose>>; }, z.core.$loose>; type TokenIntrospectionResponse = z.infer; //#endregion //#region src/authorization-request/parse-authorization-request.d.ts interface ParseAuthorizationRequestOptions { request: RequestLike; authorizationRequest: { dpop_jkt?: string; }; } interface ParseAuthorizationRequestResult { /** * The dpop params from the authorization request. * * Both `dpop_jkt` and DPoP header can be included in the request. * * The jkt and the signer of the jwt have not been verified against * each other yet, this only happens during verification */ dpop?: { jwkThumbprint: string; jwt?: string; } | { jwkThumbprint?: string; jwt: string; }; /** * The client attestation jwts from the authorization request headers. * These have not been verified yet. */ clientAttestation?: { clientAttestationJwt: string; /** * Absent for the DPoP-bound `attest_jwt_client_auth_dpop` method (draft 09), where the DPoP proof * serves as the Client Attestation PoP. */ clientAttestationPopJwt?: string; }; } /** * Parse an authorization request. * * @throws {Oauth2ServerErrorResponseError} */ declare function parseAuthorizationRequest(options: ParseAuthorizationRequestOptions): ParseAuthorizationRequestResult; //#endregion //#region src/authorization-challenge/z-authorization-challenge.d.ts declare const zAuthorizationChallengeRequest: z.ZodObject<{ client_id: z.ZodOptional; auth_session: z.ZodOptional; presentation_during_issuance_session: z.ZodOptional; scope: z.ZodOptional; redirect_uri: z.ZodOptional; resource: z.ZodOptional; state: z.ZodOptional