@authrim/core 0.1.11 → 0.1.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.d.cts CHANGED
@@ -1607,6 +1607,251 @@ declare class PKCEHelper {
1607
1607
  generateCodeChallenge(verifier: string): Promise<string>;
1608
1608
  }
1609
1609
 
1610
+ /**
1611
+ * Debug Module Types
1612
+ *
1613
+ * Types for debugging and observability features.
1614
+ */
1615
+ /**
1616
+ * Debug options for SDK initialization
1617
+ */
1618
+ interface DebugOptions {
1619
+ /** Enable debug mode */
1620
+ enabled: boolean;
1621
+ /** Enable verbose logging */
1622
+ verbose?: boolean;
1623
+ /** Include timestamps in logs */
1624
+ logTimestamps?: boolean;
1625
+ /** Custom logger implementation */
1626
+ logger?: DebugLogger;
1627
+ /** Maximum events to keep in timeline (default: 100) */
1628
+ maxTimelineEvents?: number;
1629
+ /** Redaction level for sensitive data */
1630
+ redactLevel?: RedactLevel;
1631
+ }
1632
+ /**
1633
+ * Debug logger interface
1634
+ */
1635
+ interface DebugLogger {
1636
+ /** Log a message with optional data */
1637
+ log(level: DebugLogLevel, message: string, data?: unknown): void;
1638
+ }
1639
+ /**
1640
+ * Debug log levels
1641
+ */
1642
+ type DebugLogLevel = 'debug' | 'info' | 'warn' | 'error';
1643
+ /**
1644
+ * Redaction level for sensitive data
1645
+ *
1646
+ * - 'default': Mask token values, keep structure
1647
+ * - 'none': No redaction (only for development)
1648
+ * - 'aggressive': Mask tokens and URL parameters
1649
+ */
1650
+ type RedactLevel = 'default' | 'none' | 'aggressive';
1651
+
1652
+ /**
1653
+ * Diagnostic Logger for SDK
1654
+ *
1655
+ * Provides diagnostic logging capabilities for debugging, troubleshooting,
1656
+ * and OIDF conformance testing. Integrates with server-side diagnostic logs
1657
+ * via diagnosticSessionId.
1658
+ *
1659
+ * Features:
1660
+ * - ID Token validation step logging
1661
+ * - Authentication decision logging
1662
+ * - Session ID correlation with server logs
1663
+ * - Console output and optional collection
1664
+ */
1665
+
1666
+ /**
1667
+ * Diagnostic log level
1668
+ */
1669
+ type DiagnosticLogLevel = 'debug' | 'info' | 'warn' | 'error';
1670
+ /**
1671
+ * Token validation step
1672
+ */
1673
+ type TokenValidationStep = 'issuer-check' | 'audience-check' | 'expiry-check' | 'nonce-check' | 'signature-check' | 'hash-check';
1674
+ /**
1675
+ * Base diagnostic log entry
1676
+ */
1677
+ interface BaseDiagnosticLogEntry {
1678
+ /** Unique log entry ID */
1679
+ id: string;
1680
+ /** Diagnostic session ID (for correlation with server logs) */
1681
+ diagnosticSessionId: string;
1682
+ /** Log category */
1683
+ category: string;
1684
+ /** Log level */
1685
+ level: DiagnosticLogLevel;
1686
+ /** Timestamp (Unix epoch in milliseconds) */
1687
+ timestamp: number;
1688
+ /** Additional metadata */
1689
+ metadata?: Record<string, unknown>;
1690
+ }
1691
+ /**
1692
+ * Token Validation Log Entry
1693
+ */
1694
+ interface TokenValidationLogEntry extends BaseDiagnosticLogEntry {
1695
+ category: 'token-validation';
1696
+ /** Validation step */
1697
+ step: TokenValidationStep;
1698
+ /** Token type (id_token, access_token, etc.) */
1699
+ tokenType: string;
1700
+ /** Validation result */
1701
+ result: 'pass' | 'fail';
1702
+ /** Expected value (for validation) */
1703
+ expected?: unknown;
1704
+ /** Actual value (for validation) */
1705
+ actual?: unknown;
1706
+ /** Error message (if failed) */
1707
+ errorMessage?: string;
1708
+ /** Additional validation details */
1709
+ details?: Record<string, unknown>;
1710
+ }
1711
+ /**
1712
+ * Authentication Decision Log Entry
1713
+ */
1714
+ interface AuthDecisionLogEntry extends BaseDiagnosticLogEntry {
1715
+ category: 'auth-decision';
1716
+ /** Final authentication decision */
1717
+ decision: 'allow' | 'deny';
1718
+ /** Reason for the decision */
1719
+ reason: string;
1720
+ /** Authentication flow */
1721
+ flow?: string;
1722
+ /** Additional decision context */
1723
+ context?: Record<string, unknown>;
1724
+ }
1725
+ /**
1726
+ * Union type of all diagnostic log entries
1727
+ */
1728
+ type DiagnosticLogEntry = TokenValidationLogEntry | AuthDecisionLogEntry;
1729
+ /**
1730
+ * Common interface for diagnostic loggers
1731
+ *
1732
+ * This interface allows different diagnostic logger implementations
1733
+ * (Core SDK, Web SDK, Node SDK) to be used interchangeably.
1734
+ */
1735
+ interface IDiagnosticLogger {
1736
+ /**
1737
+ * Get diagnostic session ID
1738
+ */
1739
+ getDiagnosticSessionId(): string;
1740
+ /**
1741
+ * Check if diagnostic logging is enabled
1742
+ */
1743
+ isEnabled(): boolean;
1744
+ /**
1745
+ * Log token validation step
1746
+ */
1747
+ logTokenValidation(options: {
1748
+ step: TokenValidationStep;
1749
+ tokenType: string;
1750
+ result: 'pass' | 'fail';
1751
+ expected?: unknown;
1752
+ actual?: unknown;
1753
+ errorMessage?: string;
1754
+ details?: Record<string, unknown>;
1755
+ }): void;
1756
+ /**
1757
+ * Log authentication decision
1758
+ */
1759
+ logAuthDecision(options: {
1760
+ decision: 'allow' | 'deny';
1761
+ reason: string;
1762
+ flow?: string;
1763
+ context?: Record<string, unknown>;
1764
+ }): void;
1765
+ }
1766
+ /**
1767
+ * Diagnostic logger options
1768
+ */
1769
+ interface DiagnosticLoggerOptions {
1770
+ /** Enable diagnostic logging */
1771
+ enabled: boolean;
1772
+ /** Underlying debug logger */
1773
+ debugLogger?: DebugLogger;
1774
+ /** Collect logs in memory for export */
1775
+ collectLogs?: boolean;
1776
+ /** Maximum number of logs to collect (default: 1000) */
1777
+ maxLogs?: number;
1778
+ }
1779
+ /**
1780
+ * Diagnostic Logger for SDK
1781
+ */
1782
+ declare class DiagnosticLogger implements IDiagnosticLogger {
1783
+ private diagnosticSessionId;
1784
+ private enabled;
1785
+ private debugLogger?;
1786
+ private collectLogs;
1787
+ private maxLogs;
1788
+ private logs;
1789
+ constructor(options: DiagnosticLoggerOptions);
1790
+ /**
1791
+ * Get diagnostic session ID
1792
+ *
1793
+ * This ID should be sent to the server via X-Diagnostic-Session-Id header
1794
+ * to correlate SDK logs with server logs.
1795
+ */
1796
+ getDiagnosticSessionId(): string;
1797
+ /**
1798
+ * Check if diagnostic logging is enabled
1799
+ */
1800
+ isEnabled(): boolean;
1801
+ /**
1802
+ * Log token validation step
1803
+ */
1804
+ logTokenValidation(options: {
1805
+ step: TokenValidationStep;
1806
+ tokenType: string;
1807
+ result: 'pass' | 'fail';
1808
+ expected?: unknown;
1809
+ actual?: unknown;
1810
+ errorMessage?: string;
1811
+ details?: Record<string, unknown>;
1812
+ }): void;
1813
+ /**
1814
+ * Log authentication decision
1815
+ */
1816
+ logAuthDecision(options: {
1817
+ decision: 'allow' | 'deny';
1818
+ reason: string;
1819
+ flow?: string;
1820
+ context?: Record<string, unknown>;
1821
+ }): void;
1822
+ /**
1823
+ * Get all collected logs
1824
+ */
1825
+ getLogs(): DiagnosticLogEntry[];
1826
+ /**
1827
+ * Export logs as JSON string
1828
+ */
1829
+ exportLogs(): string;
1830
+ /**
1831
+ * Clear collected logs
1832
+ */
1833
+ clearLogs(): void;
1834
+ /**
1835
+ * Write log entry (internal)
1836
+ */
1837
+ private writeLog;
1838
+ /**
1839
+ * Generate diagnostic session ID
1840
+ */
1841
+ private generateSessionId;
1842
+ /**
1843
+ * Generate log entry ID
1844
+ */
1845
+ private generateEntryId;
1846
+ }
1847
+ /**
1848
+ * Create a diagnostic logger
1849
+ *
1850
+ * @param options - Logger options
1851
+ * @returns DiagnosticLogger instance or null if disabled
1852
+ */
1853
+ declare function createDiagnosticLogger(options: DiagnosticLoggerOptions): DiagnosticLogger | null;
1854
+
1610
1855
  /**
1611
1856
  * Authorization Code Flow
1612
1857
  *
@@ -1706,7 +1951,12 @@ interface ExchangeCodeOptions {
1706
1951
  declare class AuthorizationCodeFlow {
1707
1952
  private readonly http;
1708
1953
  private readonly clientId;
1954
+ private diagnosticLogger?;
1709
1955
  constructor(http: HttpClient, clientId: string);
1956
+ /**
1957
+ * Set diagnostic logger for this flow
1958
+ */
1959
+ setDiagnosticLogger(logger: IDiagnosticLogger | null | undefined): void;
1710
1960
  /**
1711
1961
  * Build authorization URL
1712
1962
  *
@@ -2060,6 +2310,8 @@ declare class AuthrimClient {
2060
2310
  private readonly normalizedIssuer;
2061
2311
  /** Whether the client has been initialized */
2062
2312
  private initialized;
2313
+ /** Diagnostic logger (optional, for OIDF conformance testing) */
2314
+ private diagnosticLogger;
2063
2315
  /**
2064
2316
  * Get the event emitter for subscribing to SDK events
2065
2317
  */
@@ -2333,6 +2585,24 @@ declare class AuthrimClient {
2333
2585
  * @returns Logout result
2334
2586
  */
2335
2587
  logout(options?: LogoutOptions): Promise<LogoutResult>;
2588
+ /**
2589
+ * Set diagnostic logger for OIDF conformance testing
2590
+ *
2591
+ * When a diagnostic logger is set, the SDK will log token validation steps,
2592
+ * authentication decisions, and other diagnostic information.
2593
+ *
2594
+ * @param logger - Diagnostic logger instance (or null to disable)
2595
+ */
2596
+ setDiagnosticLogger(logger: IDiagnosticLogger | null): void;
2597
+ /**
2598
+ * Get diagnostic session ID (if diagnostic logging is enabled)
2599
+ *
2600
+ * This ID should be sent to the server via X-Diagnostic-Session-Id header
2601
+ * to correlate SDK logs with server logs.
2602
+ *
2603
+ * @returns Diagnostic session ID or null if diagnostic logging is disabled
2604
+ */
2605
+ getDiagnosticSessionId(): string | null;
2336
2606
  /**
2337
2607
  * Subscribe to an event
2338
2608
  *
@@ -4012,48 +4282,6 @@ declare class FrontChannelLogoutUrlBuilder {
4012
4282
  validateRequest(url: string | URL, expected?: FrontChannelLogoutValidationOptions): FrontChannelLogoutValidationResult;
4013
4283
  }
4014
4284
 
4015
- /**
4016
- * Debug Module Types
4017
- *
4018
- * Types for debugging and observability features.
4019
- */
4020
- /**
4021
- * Debug options for SDK initialization
4022
- */
4023
- interface DebugOptions {
4024
- /** Enable debug mode */
4025
- enabled: boolean;
4026
- /** Enable verbose logging */
4027
- verbose?: boolean;
4028
- /** Include timestamps in logs */
4029
- logTimestamps?: boolean;
4030
- /** Custom logger implementation */
4031
- logger?: DebugLogger;
4032
- /** Maximum events to keep in timeline (default: 100) */
4033
- maxTimelineEvents?: number;
4034
- /** Redaction level for sensitive data */
4035
- redactLevel?: RedactLevel;
4036
- }
4037
- /**
4038
- * Debug logger interface
4039
- */
4040
- interface DebugLogger {
4041
- /** Log a message with optional data */
4042
- log(level: DebugLogLevel, message: string, data?: unknown): void;
4043
- }
4044
- /**
4045
- * Debug log levels
4046
- */
4047
- type DebugLogLevel = 'debug' | 'info' | 'warn' | 'error';
4048
- /**
4049
- * Redaction level for sensitive data
4050
- *
4051
- * - 'default': Mask token values, keep structure
4052
- * - 'none': No redaction (only for development)
4053
- * - 'aggressive': Mask tokens and URL parameters
4054
- */
4055
- type RedactLevel = 'default' | 'none' | 'aggressive';
4056
-
4057
4285
  /**
4058
4286
  * Event Timeline
4059
4287
  *
@@ -5117,4 +5345,4 @@ interface SilentLoginStateData {
5117
5345
  rt: string;
5118
5346
  }
5119
5347
 
5120
- export { type AddressClaim, type AttestationConveyancePreferenceType, type AuthCallbackCompleteEvent, type AuthCallbackEvent, type AuthCallbackProcessingEvent, type AuthFallbackEvent, type AuthInitEvent, type AuthLoginCompleteEvent, type AuthLogoutCompleteEvent, type AuthPopupBlockedEvent, type AuthRedirectingEvent, type AuthRequiredEvent, type AuthResult, type AuthState, type AuthStateSnapshot, type AuthState$1 as AuthStateType, type AuthenticationExtensionsClientInputsType, type AuthenticationResponseJSON, type AuthenticatorAssertionResponseJSON, type AuthenticatorAttachmentType, type AuthenticatorAttestationResponseJSON, type AuthenticatorSelectionCriteriaType, type AuthenticatorTransportType, AuthorizationCodeFlow, type AuthorizationContext, type AuthorizationUrlResult, AuthrimClient, type AuthrimClientConfig, AuthrimError, type AuthrimErrorCode, type AuthrimErrorMeta, type AuthrimErrorOptions, type AuthrimErrorRemediation, type AuthrimErrorSeverity, type AuthrimErrorUserAction, type AuthrimEventHandler, type AuthrimEventName, type AuthrimEvents, type AuthrimStorage, type AutoRefreshOptions, AutoRefreshScheduler, type BaseEventPayload, type BuildAuthorizationUrlOptions, type COSEAlgorithmIdentifier, type CheckSessionMessage, type CheckSessionResponse, type ClientAssertionClaims, type ClientAuthMethod, type ClientAuthResult, type ClientCredentials, ClientCredentialsClient, type ClientCredentialsClientOptions, type ClientCredentialsTokenOptions, type ClientSecretCredentials, type CodeChallengeMethod, type CoreEventName, type CryptoProvider, type DPoPCryptoProvider, type DPoPKeyPair, DPoPManager, type DPoPManagerConfig, type DPoPProofClaims, type DPoPProofHeader, type DPoPProofOptions, DebugContext, type DebugLogLevel, type DebugLogger, type DebugOptions, type DebugTimelineEvent, type DecodedJwt, type DeviceAuthorizationResponse, type DeviceFlowAccessDeniedResult, DeviceFlowClient, type DeviceFlowCompletedResult, type DeviceFlowExpiredResult, type DeviceFlowPendingResult, type DeviceFlowPollResult, type DeviceFlowSlowDownResult, type DeviceFlowStartOptions, type DeviceFlowState, type DirectAuthClient, type DirectAuthClientConfig, type DirectAuthError, type DirectAuthLogoutOptions, type DirectAuthTokenRequest, type DirectAuthTokenResponse, DiscoveryClient, type EmailCodeAuth, type EmailCodeSendOptions, type EmailCodeSendRequest, type EmailCodeSendResponse, type EmailCodeSendResult, type EmailCodeVerifyOptions, type EmailCodeVerifyRequest, type EmailCodeVerifyResponse, type EmitClassifiedErrorOptions, type EndpointOverrides, type ErrorClassification, type ErrorEvent, type ErrorEventEmitter, type ErrorEventPayload, type ErrorFatalEvent, type ErrorRecoverableEvent, type ErrorSeverity, EventEmitter, EventTimeline, type ExchangeCodeOptions, type FrontChannelLogoutBuildParams, type FrontChannelLogoutParams, FrontChannelLogoutUrlBuilder, type FrontChannelLogoutUrlOptions, type FrontChannelLogoutUrlResult, type FrontChannelLogoutValidationOptions, type FrontChannelLogoutValidationResult, type GenerateAuthStateOptions, type HashOptions, type HttpClient, type HttpOptions, type HttpResponse, type IntrospectTokenOptions, type IntrospectionResponse, type IntrospectionTokenTypeHint, JARBuilder, type JARBuilderConfig, type JARMResponseClaims, type JARMValidationOptions, type JARMValidationResult, JARMValidator, type JARMValidatorConfig, type JARRequestObjectClaims, type JARRequestOptions, type JWK, type JwtHeader, LogoutHandler, type LogoutHandlerOptions, type LogoutOptions, type LogoutResult, type LogoutTokenClaims, type MfaMethod, type NextAction, type NoClientCredentials, type OAuthErrorResponse, type OIDCDiscoveryDocument, PARClient, type PARClientOptions, type PARRequest, type PARResponse, type PARResult, PKCEHelper, type PKCEPair, type PasskeyAuth, type PasskeyCredential, type PasskeyLoginFinishRequest, type PasskeyLoginFinishResponse, type PasskeyLoginOptions, type PasskeyLoginStartRequest, type PasskeyLoginStartResponse, type PasskeyRegisterOptions, type PasskeySignUpOptions, type PasskeySignupFinishRequest, type PasskeySignupFinishResponse, type PasskeySignupStartRequest, type PasskeySignupStartResponse, type PrivateKeyJwtCredentials, type PublicKeyCredentialCreationOptionsJSON, type PublicKeyCredentialDescriptorJSON, type PublicKeyCredentialParametersType, type PublicKeyCredentialRequestOptionsJSON, type PublicKeyCredentialRpEntityType, type PublicKeyCredentialType, type PublicKeyCredentialUserEntityJSON, type RedactLevel, type RegistrationResponseJSON, type ResidentKeyRequirementType, type ResolvedConfig, type RetryOptions, type RevokeTokenOptions, STORAGE_KEYS, type Session, type SessionAuth, type SessionChangeEvent, type SessionChangedEvent, type SessionCheckResult, type SessionEndedEvent, type SessionLogoutBroadcastEvent, type SessionManagementConfig, SessionManager, type SessionManagerOptions, type SessionStartedEvent, type SessionState, SessionStateCalculator, type SessionStateCalculatorOptions, type SessionStateParams, type SessionStateResult, type SessionSyncEvent, SilentAuthHandler, type SilentAuthOptions, type SilentAuthResult, type SilentAuthUrlResult, type SilentLoginResult, type SilentLoginStateData, type SocialAuth, type SocialLoginOptions, type SocialProvider, type StandardClaims, type StateChangeEvent, StateManager, TOKEN_TYPE_URIS, type TimelineEntry, TokenApiClient, type TokenApiClientOptions, type TokenErrorEvent, type TokenExchangeRequest, type TokenExchangeResponse, type TokenExchangeResult, type TokenExchangedEvent, type TokenExpiredEvent, type TokenExpiringEvent, TokenIntrospector, type TokenIntrospectorOptions, TokenManager, type TokenManagerOptions, type TokenRefreshFailedEvent, type TokenRefreshedEvent, type TokenRefreshingEvent, type TokenResponse, TokenRevoker, type TokenRevokerOptions, type TokenSet, type TokenTypeHint, type TokenTypeUri, type TrySilentLoginOptions, type User, type UserInfo, type UserVerificationRequirementType, type WarningITPEvent, type WarningPrivateModeEvent, type WarningStorageFallbackEvent, type WebOnlyEventName, base64urlDecode, base64urlEncode, base64urlToString, buildClientAuthentication, calculateBackoffDelay, calculateDsHash, classifyError, createAuthrimClient, createCancellableOperation, createConsoleLogger, createDebugLogger, createRetryFunction, decodeIdToken, decodeJwt, emitClassifiedError, getErrorMeta, getIdTokenNonce, isCancellationError, isJarRequired, isJwtExpired, isRetryableError, noopLogger, normalizeIssuer, parseRetryAfterHeader, raceWithCancellation, resolveConfig, sleep, stringToBase64url, timingSafeEqual, withAbortSignal, withRetry };
5348
+ export { type AddressClaim, type AttestationConveyancePreferenceType, type AuthCallbackCompleteEvent, type AuthCallbackEvent, type AuthCallbackProcessingEvent, type AuthDecisionLogEntry, type AuthFallbackEvent, type AuthInitEvent, type AuthLoginCompleteEvent, type AuthLogoutCompleteEvent, type AuthPopupBlockedEvent, type AuthRedirectingEvent, type AuthRequiredEvent, type AuthResult, type AuthState, type AuthStateSnapshot, type AuthState$1 as AuthStateType, type AuthenticationExtensionsClientInputsType, type AuthenticationResponseJSON, type AuthenticatorAssertionResponseJSON, type AuthenticatorAttachmentType, type AuthenticatorAttestationResponseJSON, type AuthenticatorSelectionCriteriaType, type AuthenticatorTransportType, AuthorizationCodeFlow, type AuthorizationContext, type AuthorizationUrlResult, AuthrimClient, type AuthrimClientConfig, AuthrimError, type AuthrimErrorCode, type AuthrimErrorMeta, type AuthrimErrorOptions, type AuthrimErrorRemediation, type AuthrimErrorSeverity, type AuthrimErrorUserAction, type AuthrimEventHandler, type AuthrimEventName, type AuthrimEvents, type AuthrimStorage, type AutoRefreshOptions, AutoRefreshScheduler, type BaseDiagnosticLogEntry, type BaseEventPayload, type BuildAuthorizationUrlOptions, type COSEAlgorithmIdentifier, type CheckSessionMessage, type CheckSessionResponse, type ClientAssertionClaims, type ClientAuthMethod, type ClientAuthResult, type ClientCredentials, ClientCredentialsClient, type ClientCredentialsClientOptions, type ClientCredentialsTokenOptions, type ClientSecretCredentials, type CodeChallengeMethod, type CoreEventName, type CryptoProvider, type DPoPCryptoProvider, type DPoPKeyPair, DPoPManager, type DPoPManagerConfig, type DPoPProofClaims, type DPoPProofHeader, type DPoPProofOptions, DebugContext, type DebugLogLevel, type DebugLogger, type DebugOptions, type DebugTimelineEvent, type DecodedJwt, type DeviceAuthorizationResponse, type DeviceFlowAccessDeniedResult, DeviceFlowClient, type DeviceFlowCompletedResult, type DeviceFlowExpiredResult, type DeviceFlowPendingResult, type DeviceFlowPollResult, type DeviceFlowSlowDownResult, type DeviceFlowStartOptions, type DeviceFlowState, type DiagnosticLogEntry, type DiagnosticLogLevel, DiagnosticLogger, type DiagnosticLoggerOptions, type DirectAuthClient, type DirectAuthClientConfig, type DirectAuthError, type DirectAuthLogoutOptions, type DirectAuthTokenRequest, type DirectAuthTokenResponse, DiscoveryClient, type EmailCodeAuth, type EmailCodeSendOptions, type EmailCodeSendRequest, type EmailCodeSendResponse, type EmailCodeSendResult, type EmailCodeVerifyOptions, type EmailCodeVerifyRequest, type EmailCodeVerifyResponse, type EmitClassifiedErrorOptions, type EndpointOverrides, type ErrorClassification, type ErrorEvent, type ErrorEventEmitter, type ErrorEventPayload, type ErrorFatalEvent, type ErrorRecoverableEvent, type ErrorSeverity, EventEmitter, EventTimeline, type ExchangeCodeOptions, type FrontChannelLogoutBuildParams, type FrontChannelLogoutParams, FrontChannelLogoutUrlBuilder, type FrontChannelLogoutUrlOptions, type FrontChannelLogoutUrlResult, type FrontChannelLogoutValidationOptions, type FrontChannelLogoutValidationResult, type GenerateAuthStateOptions, type HashOptions, type HttpClient, type HttpOptions, type HttpResponse, type IDiagnosticLogger, type IntrospectTokenOptions, type IntrospectionResponse, type IntrospectionTokenTypeHint, JARBuilder, type JARBuilderConfig, type JARMResponseClaims, type JARMValidationOptions, type JARMValidationResult, JARMValidator, type JARMValidatorConfig, type JARRequestObjectClaims, type JARRequestOptions, type JWK, type JwtHeader, LogoutHandler, type LogoutHandlerOptions, type LogoutOptions, type LogoutResult, type LogoutTokenClaims, type MfaMethod, type NextAction, type NoClientCredentials, type OAuthErrorResponse, type OIDCDiscoveryDocument, PARClient, type PARClientOptions, type PARRequest, type PARResponse, type PARResult, PKCEHelper, type PKCEPair, type PasskeyAuth, type PasskeyCredential, type PasskeyLoginFinishRequest, type PasskeyLoginFinishResponse, type PasskeyLoginOptions, type PasskeyLoginStartRequest, type PasskeyLoginStartResponse, type PasskeyRegisterOptions, type PasskeySignUpOptions, type PasskeySignupFinishRequest, type PasskeySignupFinishResponse, type PasskeySignupStartRequest, type PasskeySignupStartResponse, type PrivateKeyJwtCredentials, type PublicKeyCredentialCreationOptionsJSON, type PublicKeyCredentialDescriptorJSON, type PublicKeyCredentialParametersType, type PublicKeyCredentialRequestOptionsJSON, type PublicKeyCredentialRpEntityType, type PublicKeyCredentialType, type PublicKeyCredentialUserEntityJSON, type RedactLevel, type RegistrationResponseJSON, type ResidentKeyRequirementType, type ResolvedConfig, type RetryOptions, type RevokeTokenOptions, STORAGE_KEYS, type Session, type SessionAuth, type SessionChangeEvent, type SessionChangedEvent, type SessionCheckResult, type SessionEndedEvent, type SessionLogoutBroadcastEvent, type SessionManagementConfig, SessionManager, type SessionManagerOptions, type SessionStartedEvent, type SessionState, SessionStateCalculator, type SessionStateCalculatorOptions, type SessionStateParams, type SessionStateResult, type SessionSyncEvent, SilentAuthHandler, type SilentAuthOptions, type SilentAuthResult, type SilentAuthUrlResult, type SilentLoginResult, type SilentLoginStateData, type SocialAuth, type SocialLoginOptions, type SocialProvider, type StandardClaims, type StateChangeEvent, StateManager, TOKEN_TYPE_URIS, type TimelineEntry, TokenApiClient, type TokenApiClientOptions, type TokenErrorEvent, type TokenExchangeRequest, type TokenExchangeResponse, type TokenExchangeResult, type TokenExchangedEvent, type TokenExpiredEvent, type TokenExpiringEvent, TokenIntrospector, type TokenIntrospectorOptions, TokenManager, type TokenManagerOptions, type TokenRefreshFailedEvent, type TokenRefreshedEvent, type TokenRefreshingEvent, type TokenResponse, TokenRevoker, type TokenRevokerOptions, type TokenSet, type TokenTypeHint, type TokenTypeUri, type TokenValidationLogEntry, type TokenValidationStep, type TrySilentLoginOptions, type User, type UserInfo, type UserVerificationRequirementType, type WarningITPEvent, type WarningPrivateModeEvent, type WarningStorageFallbackEvent, type WebOnlyEventName, base64urlDecode, base64urlEncode, base64urlToString, buildClientAuthentication, calculateBackoffDelay, calculateDsHash, classifyError, createAuthrimClient, createCancellableOperation, createConsoleLogger, createDebugLogger, createDiagnosticLogger, createRetryFunction, decodeIdToken, decodeJwt, emitClassifiedError, getErrorMeta, getIdTokenNonce, isCancellationError, isJarRequired, isJwtExpired, isRetryableError, noopLogger, normalizeIssuer, parseRetryAfterHeader, raceWithCancellation, resolveConfig, sleep, stringToBase64url, timingSafeEqual, withAbortSignal, withRetry };