@hyper.authio/client 0.0.0-stage → 0.7.0

package/dist/index.d.cts

@@ -0,0 +1,1627 @@
+import { JWK, CryptoKey, JWTPayload, JWTVerifyGetKey } from 'jose';
+
+/**
+ * Claim names Authio writes into its tokens.
+ */
+declare const AuthioClaimTypes: {
+    readonly Subject: "sub";
+    readonly JwtId: "jti";
+    readonly Issuer: "iss";
+    readonly Audience: "aud";
+    readonly Expiration: "exp";
+    readonly IssuedAt: "iat";
+    readonly NotBefore: "nbf";
+    readonly AuthTime: "auth_time";
+    readonly TokenType: "typ";
+    readonly AuthorizedParty: "azp";
+    readonly Scope: "scope";
+    readonly SessionId: "sid";
+    readonly AuthenticationContextClass: "acr";
+    readonly AuthenticationMethods: "amr";
+    readonly IdentityProvider: "idp";
+    readonly Nonce: "nonce";
+    readonly AccessTokenHash: "at_hash";
+    readonly Events: "events";
+    readonly OrganizationId: "org_id";
+    readonly OrganizationAlias: "org_alias";
+    readonly AccountId: "account_id";
+    readonly Actor: "act";
+    readonly DelegationId: "delegation_id";
+    readonly ClientId: "client_id";
+    readonly Name: "name";
+    readonly GivenName: "given_name";
+    readonly FamilyName: "family_name";
+    readonly UniqueName: "unique_name";
+    readonly PreferredUsername: "preferred_username";
+    readonly UpdatedAt: "updated_at";
+    readonly Email: "email";
+    readonly EmailVerified: "email_verified";
+    readonly PhoneNumber: "phone_number";
+    readonly PhoneNumberVerified: "phone_number_verified";
+    readonly ConsumerName: "consumer_name";
+    readonly CredentialId: "credential_id";
+    readonly CredentialType: "credential_type";
+    readonly CredentialName: "credential_name";
+    readonly CredentialRealm: "credential_realm";
+    readonly CredentialClient: "credential_client";
+    readonly ActorType: "actor_type";
+    readonly OwnerUserId: "owner_user_id";
+    readonly OwnerUsername: "owner_username";
+    readonly UserResourceAccess: "user_resource_access";
+    readonly RealmResourceAccess: "realm_resource_access";
+    readonly ClientResourceAccess: "client_resource_access";
+    readonly PlanResourceAccess: "plan_resource_access";
+    readonly ConsumerResourceAccess: "consumer_resource_access";
+    readonly SecretResourceAccess: "secret_resource_access";
+    readonly SystemResourceAccess: "system_resource_access";
+};
+/**
+ * Where a role in a `*_resource_access` claim was granted.
+ *
+ * - `user`: to the person, directly or through one of their groups.
+ * - `realm`: to everyone who signs in to the realm.
+ * - `client`: to everyone who signs in through the client.
+ * - `plan`: by the plan of an Authio platform account (platform users only).
+ * - `consumer`: to a machine consumer of the client.
+ * - `secret`: to an account credential (API key, client secret, personal access token).
+ * - `system`: to an Authio platform user (the console).
+ */
+type AuthioResourceAccessSource = "user" | "realm" | "client" | "plan" | "consumer" | "secret" | "system";
+/**
+ * The seven `*_resource_access` claim names, mapped to their source.
+ */
+declare const AuthioResourceAccessClaims: Readonly<Record<string, AuthioResourceAccessSource>>;
+/**
+ * Scopes Authio defines.
+ */
+declare const AuthioScopes: {
+    readonly OpenId: "openid";
+    readonly Profile: "profile";
+    readonly Email: "email";
+    readonly Phone: "phone";
+    readonly Roles: "roles";
+    readonly OfflineAccess: "offline_access";
+};
+/**
+ * Grant types Authio's token endpoint accepts.
+ */
+declare const AuthioGrantTypes: {
+    readonly AuthorizationCode: "authorization_code";
+    readonly RefreshToken: "refresh_token";
+    readonly ClientCredentials: "client_credentials";
+    readonly Password: "password";
+    readonly DeviceCode: "urn:ietf:params:oauth:grant-type:device_code";
+    readonly TokenExchange: "urn:ietf:params:oauth:grant-type:token-exchange";
+    readonly PersonalAccessToken: "personal_access_token";
+};
+/**
+ * Token type identifiers.
+ */
+declare const AuthioTokenTypes: {
+    readonly AccessTokenUrn: "urn:ietf:params:oauth:token-type:access_token";
+    readonly ConnectionAccessTokenUrn: "urn:authio:params:oauth:token-type:connection-access-token";
+    readonly AccessToken: "access_token";
+    readonly RefreshToken: "refresh_token";
+};
+/**
+ * OAuth error codes Authio answers with.
+ */
+declare const AuthioOAuthErrors: {
+    readonly InvalidRequest: "invalid_request";
+    readonly InvalidClient: "invalid_client";
+    readonly InvalidGrant: "invalid_grant";
+    readonly UnauthorizedClient: "unauthorized_client";
+    readonly UnsupportedGrantType: "unsupported_grant_type";
+    readonly InvalidScope: "invalid_scope";
+    readonly InvalidTarget: "invalid_target";
+    readonly AccessDenied: "access_denied";
+    readonly InvalidToken: "invalid_token";
+    readonly AuthorizationPending: "authorization_pending";
+    readonly SlowDown: "slow_down";
+    readonly ExpiredToken: "expired_token";
+    readonly ConnectionRequired: "connection_required";
+    readonly ConnectionSelectionRequired: "connection_selection_required";
+    readonly ConnectionPolicyViolation: "connection_policy_violation";
+    readonly ServerError: "server_error";
+    readonly TemporarilyUnavailable: "temporarily_unavailable";
+    readonly LoginRequired: "login_required";
+    readonly InteractionRequired: "interaction_required";
+    readonly ConsentRequired: "consent_required";
+    readonly AccountSelectionRequired: "account_selection_required";
+    readonly InsufficientScope: "insufficient_scope";
+    readonly InsufficientUserAuthentication: "insufficient_user_authentication";
+};
+/**
+ * Webhook event types.
+ */
+declare const AuthioWebhookEventTypes: {
+    readonly UserCreated: "user_created";
+    readonly UserUpdated: "user_updated";
+    readonly UserDeleted: "user_deleted";
+    readonly LoginSucceeded: "login_succeeded";
+    readonly LoginFailed: "login_failed";
+    readonly UserLockedOut: "user_locked_out";
+    readonly TokenRevoked: "token_revoked";
+    readonly KeysRotated: "keys_rotated";
+    readonly TokenReuseDetected: "token_reuse_detected";
+    readonly AdminResourceCreated: "admin_resource_created";
+    readonly AdminResourceUpdated: "admin_resource_updated";
+    readonly AdminResourceDeleted: "admin_resource_deleted";
+    readonly UserSuspended: "user_suspended";
+    readonly UserSuspensionEnded: "user_suspension_ended";
+    readonly AttackDetected: "attack_detected";
+    readonly CredentialCompromised: "credential_compromised";
+    readonly Ping: "ping";
+};
+/**
+ * Headers Authio sends with a webhook delivery.
+ */
+declare const AuthioWebhookHeaders: {
+    readonly Signature: "X-Authio-Signature";
+    readonly Event: "X-Authio-Event";
+    readonly EventId: "X-Authio-Event-Id";
+};
+/**
+ * Who called an API, read from the access token (see `conformance/callers.json`).
+ *
+ * - `user`: a person signed in (the token carries `auth_time`).
+ * - `client`: a client authenticated as itself.
+ * - `consumer`: a machine consumer of a client (`credential_type` `client_consumer`).
+ * - `account_credential`: a credential of an Authio account (`credential_type` `account_secret`).
+ */
+type AuthioCallerKind = "user" | "client" | "consumer" | "account_credential";
+/**
+ * How a machine caller proved who it is.
+ */
+type AuthioCredentialForm = "client_secret" | "personal_access_token" | "api_key" | "consumer_api_key";
+/**
+ * The caller kinds.
+ */
+declare const AuthioCallerKinds: readonly ["user", "client", "consumer", "account_credential"];
+/**
+ * The values of `prompt` Authio honours.
+ */
+declare const AuthioPrompts: readonly ["none", "login", "select_account", "consent"];
+/**
+ * A value of `prompt`.
+ */
+type AuthioPrompt = (typeof AuthioPrompts)[number];
+/**
+ * Asymmetric signing algorithms Authio issues tokens with and accepts in client assertions.
+ */
+declare const AuthioAsymmetricAlgorithms: readonly ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512"];
+/**
+ * Defaults shared by every Authio SDK.
+ */
+declare const AuthioDefaults: {
+    readonly DiscoveryPath: "/.well-known/openid-configuration";
+    readonly ProtectedResourceMetadataPath: "/.well-known/oauth-protected-resource";
+    readonly RedactedValue: "[redacted]";
+    readonly PlatformRealm: "authio";
+    readonly PlatformClientId: "authio";
+    readonly ApiKeyPrefix: "ak_";
+    readonly ClientSecretPrefix: "cs_";
+    readonly PersonalAccessTokenPrefix: "pat_";
+    /** The `client_id` an account credential's client secret is exchanged with: `cred_` and the credential id (format N). */
+    readonly CredentialClientIdPrefix: "cred_";
+    readonly ApiKeyHeader: "x-api-key";
+    readonly RequestIdHeader: "X-Request-Id";
+    /** The header `typ` of a back-channel logout token. */
+    readonly LogoutTokenType: "logout+jwt";
+    /** The event a back-channel logout token carries. */
+    readonly BackchannelLogoutEvent: "http://schemas.openid.net/event/backchannel-logout";
+    /** Seconds. */
+    readonly ClockSkew: 30;
+    /** Seconds. */
+    readonly ClientAssertionLifetime: 120;
+    /** Seconds. */
+    readonly MaxClientAssertionLifetime: 3600;
+    /** Seconds. */
+    readonly DeviceInterval: 5;
+    /** Seconds. */
+    readonly DeviceSlowDownIncrement: 5;
+    /** Seconds a token without `expires_in` is assumed to live. */
+    readonly AssumedTokenLifetime: 300;
+    /** Seconds. */
+    readonly DiscoveryCacheDuration: 3600;
+    /** Seconds. */
+    readonly HttpTimeout: 30;
+    /** Seconds. */
+    readonly TokenRefreshSkew: 60;
+    /** Seconds. */
+    readonly WebhookTolerance: 300;
+    /** Smallest RSA key Authio verifies a client assertion from, in bits. */
+    readonly MinimumRsaKeySize: 2048;
+    readonly CredentialHeaders: readonly ["authorization", "proxy-authorization", "x-api-key", "cookie", "set-cookie"];
+};
+
+/**
+ * Base class of every error the Authio SDKs throw on purpose.
+ */
+declare class AuthioError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * An OAuth error Authio answered with, or an answer the SDK could not read.
+ *
+ * `error` is the OAuth error code; `http_{status}` when the body carried none, and `invalid_response` when a success
+ * body could not be read.
+ */
+declare class AuthioProtocolError extends AuthioError {
+    /** The OAuth error code. */
+    readonly error: string;
+    /** The OAuth error description. */
+    readonly errorDescription: string | undefined;
+    /** Authio's own error code (`error_code`), more specific than `error`. */
+    readonly errorCode: string | undefined;
+    /** The HTTP status, when the error came from a response. */
+    readonly status: number | undefined;
+    constructor(error: string, errorDescription?: string, errorCode?: string, status?: number, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * The discovery document could not be read, or names another issuer.
+ */
+declare class AuthioDiscoveryError extends AuthioError {
+}
+/**
+ * The SDK was configured in a way it cannot work with.
+ */
+declare class AuthioConfigurationError extends AuthioError {
+}
+/**
+ * Why a token was refused, with the outcome names of `conformance/tokens.json`.
+ */
+type AuthioTokenFailure = "not_access_token" | "not_id_token" | "invalid_audience" | "invalid_issuer" | "expired" | "not_yet_valid" | "invalid_signature" | "invalid_algorithm" | "reference_token" | "malformed" | "decryption_failed" | "legacy_algorithm" | "invalid_nonce" | "invalid_at_hash" | "authentication_too_old" | "invalid_logout_token" | "signing_keys_unavailable";
+/**
+ * A token (ID token, logout token, signed UserInfo, encrypted token) did not pass validation.
+ */
+declare class AuthioTokenValidationError extends AuthioError {
+    /** Why, as a stable code. */
+    readonly reason: AuthioTokenFailure;
+    constructor(reason: AuthioTokenFailure, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Why an authorization callback was refused before any code was exchanged.
+ */
+type AuthioCallbackFailure = "state_mismatch" | "issuer_mismatch" | "missing_issuer" | "missing_code";
+/**
+ * The authorization callback does not belong to the request this client made: `state` differs, the `iss` parameter
+ * (RFC 9207) names another issuer or is missing where Authio sends it, or there is no code.
+ */
+declare class AuthioCallbackError extends AuthioError {
+    /** Why, as a stable code. */
+    readonly reason: AuthioCallbackFailure;
+    constructor(reason: AuthioCallbackFailure, message: string);
+}
+/**
+ * One message of an Admin API error, optionally tied to a field of the request.
+ */
+interface AuthioAdminNotification {
+    readonly message: string;
+    readonly field?: string;
+    readonly code?: string;
+}
+/**
+ * The Admin API refused a request. `errorCode` is the envelope's top-level `errorCode`; the HTTP status is read from
+ * the response, never from the envelope's numeric `statusCode`.
+ */
+declare class AuthioAdminError extends AuthioError {
+    /** The HTTP status. */
+    readonly status: number;
+    /** Authio's error code, such as `ValidationFailed` or `RealmNotFound`. */
+    readonly errorCode: string | undefined;
+    /** The messages, with the field each one is about. */
+    readonly notifications: readonly AuthioAdminNotification[];
+    /** The request id, from the envelope or the `X-Request-Id` header. */
+    readonly requestId: string | undefined;
+    /** Seconds to wait before retrying, from `Retry-After` (`429` and `503`). */
+    readonly retryAfterSeconds: number | undefined;
+    constructor(details: {
+        status: number;
+        errorCode?: string;
+        notifications?: readonly AuthioAdminNotification[];
+        requestId?: string;
+        retryAfterSeconds?: number;
+        cause?: unknown;
+    });
+}
+
+/**
+ * Time as the SDK sees it. Replace it in tests to control expiry, caching and device polling.
+ */
+interface AuthioClock {
+    /** Milliseconds since the epoch. */
+    now(): number;
+    /** Waits `ms` milliseconds; rejects when the signal aborts. */
+    sleep(ms: number, signal?: AbortSignal): Promise<void>;
+}
+/**
+ * The real clock.
+ */
+declare const systemClock: AuthioClock;
+/**
+ * Where Authio is and how to reach it. Shared by the client and the API verifier.
+ */
+interface AuthioConnectionOptions {
+    /**
+     * The realm's issuer, such as `https://auth.example.com/realms/acme`. When absent it is composed from
+     * `authority` and `realm`.
+     */
+    issuer?: string;
+    /** Authio's base URL, such as `https://auth.example.com`. */
+    authority?: string;
+    /** The realm name. */
+    realm?: string;
+    /**
+     * Refuses an `http` issuer or authority unless it is loopback. Defaults to `true`; turn it off only in
+     * development.
+     */
+    requireHttps?: boolean;
+    /** Seconds the discovery document is kept. Defaults to 3600. */
+    discoveryCacheDuration?: number;
+    /** Seconds every HTTP call may take. Defaults to 30. */
+    httpTimeout?: number;
+    /** The `fetch` every call goes through. Defaults to the global one. */
+    fetch?: typeof fetch;
+    /** The clock. Defaults to the system clock. */
+    clock?: AuthioClock;
+}
+/**
+ * How the client authenticates to the token, introspection, revocation and device endpoints.
+ */
+type AuthioClientAuthentication = "client_secret_basic" | "client_secret_post" | "private_key_jwt" | "none";
+/**
+ * The connection settings, resolved once.
+ */
+interface AuthioConnection {
+    readonly issuer: string;
+    readonly discoveryUrl: string;
+    readonly requireHttps: boolean;
+    readonly discoveryCacheDurationMs: number;
+    readonly httpTimeoutMs: number;
+    readonly fetch: typeof fetch;
+    readonly clock: AuthioClock;
+}
+/**
+ * Resolves and validates the connection settings.
+ *
+ * @throws AuthioConfigurationError when the issuer cannot be composed or is not HTTPS.
+ */
+declare function resolveConnection(options: AuthioConnectionOptions): AuthioConnection;
+/**
+ * The issuer: `issuer` when set, else `{authority}/realms/{realm}`.
+ *
+ * @throws AuthioConfigurationError when neither is configured.
+ */
+declare function resolveIssuer(options: Pick<AuthioConnectionOptions, "issuer" | "authority" | "realm">): string;
+/**
+ * Whether a URL may be used to reach Authio: HTTPS, or HTTP on loopback (or anywhere when HTTPS is not required).
+ */
+declare function isAllowedUrl(value: string, requireHttps: boolean): boolean;
+/**
+ * Percent-encodes everything but RFC 3986 unreserved characters, as .NET's `Uri.EscapeDataString` does.
+ */
+declare function escapeDataString(value: string): string;
+/**
+ * Converts optional seconds to milliseconds, refusing negative or non-finite values.
+ *
+ * @internal
+ */
+declare function seconds(value: number | undefined, fallback: number, name: string): number;
+
+/**
+ * The realm's OpenID Connect discovery document. Members not listed are kept as sent.
+ */
+interface AuthioDiscoveryDocument {
+    issuer: string;
+    authorization_endpoint?: string;
+    token_endpoint?: string;
+    userinfo_endpoint?: string;
+    jwks_uri?: string;
+    introspection_endpoint?: string;
+    revocation_endpoint?: string;
+    end_session_endpoint?: string;
+    device_authorization_endpoint?: string;
+    pushed_authorization_request_endpoint?: string;
+    scopes_supported?: string[];
+    response_types_supported?: string[];
+    response_modes_supported?: string[];
+    grant_types_supported?: string[];
+    subject_types_supported?: string[];
+    id_token_signing_alg_values_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+    token_endpoint_auth_signing_alg_values_supported?: string[];
+    introspection_endpoint_auth_methods_supported?: string[];
+    revocation_endpoint_auth_methods_supported?: string[];
+    code_challenge_methods_supported?: string[];
+    claims_supported?: string[];
+    prompt_values_supported?: string[];
+    authorization_response_iss_parameter_supported?: boolean;
+    [member: string]: unknown;
+}
+/**
+ * Reads and caches the discovery document.
+ */
+interface AuthioDiscoveryClient {
+    /** The connection settings the client was built with. */
+    readonly connection: AuthioConnection;
+    /**
+     * The document, read at most once per cache period (concurrent callers share one read).
+     *
+     * @throws AuthioDiscoveryError when it cannot be read or names another issuer.
+     */
+    get(signal?: AbortSignal): Promise<AuthioDiscoveryDocument>;
+    /** Drops the cached document, so the next `get` reads it again. */
+    invalidate(): void;
+}
+/**
+ * Creates a discovery client. It needs no client credentials, so an API that only validates tokens can use it.
+ */
+declare function createAuthioDiscoveryClient(options: AuthioConnectionOptions | AuthioConnection): AuthioDiscoveryClient;
+
+/**
+ * The OAuth error body Authio answers with.
+ */
+interface AuthioErrorResponse {
+    error?: string;
+    error_description?: string;
+    error_code?: string;
+    connect_uri?: string;
+    connection_provider?: string;
+    connections?: {
+        id: string;
+        label?: string;
+        external_login?: string;
+    }[];
+    [member: string]: unknown;
+}
+/**
+ * Joins scopes into one space-separated value, splitting values that already hold several and dropping duplicates.
+ *
+ * @returns `undefined` when there is no scope.
+ */
+declare function toScopeString(scopes: Iterable<string> | string | undefined | null): string | undefined;
+
+/**
+ * A private key as the SDK accepts it: PEM text (PKCS#8, PKCS#1 RSA or SEC1 EC; PKCS#1 and SEC1 need Node), a JWK
+ * (object or JSON text), or a `CryptoKey`.
+ */
+type AuthioPrivateKeyInput = string | JWK | CryptoKey;
+/**
+ * The algorithms a client assertion may be signed with.
+ */
+declare const AuthioClientAssertionAlgorithms: readonly ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512"];
+
+/**
+ * The client secret, or a function returning the current one, called for every request so a rotated secret is used
+ * without a restart.
+ */
+type AuthioSecretSource = string | (() => string | Promise<string>);
+/**
+ * How the client proves who it is.
+ */
+interface AuthioClientCredentialsSettings {
+    /** The client id. */
+    clientId: string;
+    /**
+     * The client secret, for `client_secret_basic` and `client_secret_post`; or a function returning the current one,
+     * called for every request.
+     */
+    clientSecret?: AuthioSecretSource;
+    /**
+     * Defaults to `private_key_jwt` when only a private key is configured, else `client_secret_basic`. A public client
+     * sets `none`.
+     */
+    clientAuthentication?: AuthioClientAuthentication;
+    /** The private key for `private_key_jwt`. */
+    clientPrivateKey?: AuthioPrivateKeyInput;
+    /** A PEM file holding the private key for `private_key_jwt` (Node only); re-read when it changes. */
+    clientPrivateKeyPath?: string;
+    /** The `kid` of the key, as registered in Authio. */
+    clientKeyId?: string;
+    /** The assertion's signing algorithm. Defaults to RS256 for RSA keys and the curve's ES algorithm for EC keys. */
+    clientSigningAlgorithm?: string;
+    /** Seconds a client assertion lives. Defaults to 120, at most 3600. */
+    clientAssertionLifetime?: number;
+}
+/**
+ * Builds the HTTP Basic value for a client id and secret, escaping both first as RFC 6749 §2.3.1 asks.
+ */
+declare function toBasicAuthorization(clientId: string, clientSecret: string): string;
+
+/**
+ * The client's own encryption key, the pair Authio encrypts the client's tokens and UserInfo to: the private JWK
+ * Authio hands over when it generates the pair (object or JSON text), or a PEM private key (PKCS#8 or PKCS#1 RSA).
+ */
+type AuthioEncryptionKey = string | JWK;
+/**
+ * Where the encryption key comes from: the key itself, or a function returning it (read again on every new
+ * algorithm, so a rotated key is picked up).
+ */
+type AuthioEncryptionKeySource = AuthioEncryptionKey | (() => AuthioEncryptionKey | Promise<AuthioEncryptionKey>);
+/**
+ * Opens a compact JWE and returns its plaintext; a token that is not a JWE comes back unchanged.
+ *
+ * @throws AuthioTokenValidationError with `legacy_algorithm` for RSA1_5 and `decryption_failed` when the key cannot
+ * open it.
+ */
+type AuthioTokenDecrypter = (token: string) => Promise<string>;
+/**
+ * The key management algorithms Authio encrypts with, and this SDK decrypts.
+ */
+declare const AuthioKeyManagementAlgorithms: readonly ["RSA-OAEP", "RSA-OAEP-256"];
+/**
+ * Key management algorithms Authio may still use for clients registered long ago. Node and WebCrypto cannot decrypt
+ * RSA1_5 (PKCS#1 v1.5), so this SDK refuses it even with `allowLegacyEncryptionAlgorithms`.
+ */
+declare const AuthioLegacyKeyManagementAlgorithms: readonly ["RSA1_5"];
+/**
+ * The content encryption algorithms Authio encrypts with.
+ */
+declare const AuthioContentEncryptionAlgorithms: readonly ["A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512"];
+/**
+ * Options of the decrypter.
+ */
+interface AuthioTokenDecrypterOptions {
+    /** The setting the key came from, named in errors. Defaults to `clientEncryptionKey`. */
+    setting?: string;
+    /**
+     * Accepted for parity with the other Authio SDKs. RSA1_5 stays refused here, with an error saying so, because
+     * neither Node nor WebCrypto can decrypt PKCS#1 v1.5.
+     */
+    allowLegacyEncryptionAlgorithms?: boolean;
+}
+/**
+ * Whether a value is a compact JWE (five segments).
+ */
+declare function isAuthioTokenEncrypted(token: unknown): token is string;
+/**
+ * Creates a decrypter for the client's own encryption key. Keys are imported once per algorithm.
+ *
+ * @param key The key, a function returning it, or `undefined` when none is configured: an encrypted token then throws.
+ * @param options The setting name for errors, and the legacy algorithm switch. A string is taken as the setting name.
+ */
+declare function createAuthioTokenDecrypter(key: AuthioEncryptionKeySource | undefined, options?: AuthioTokenDecrypterOptions | string): AuthioTokenDecrypter;
+/**
+ * Reads the client's encryption key from a PEM or JWK file (Node only), again whenever the file changes.
+ *
+ * @internal
+ */
+declare function encryptionKeyFromFile(path: string, setting?: string): () => Promise<AuthioEncryptionKey>;
+
+/**
+ * The claims of a validated ID token. Authio writes `typ` = `ID`, `sid`, `auth_time`, `acr`, `amr`, `nonce` and
+ * `at_hash`, besides the profile claims of the granted scopes.
+ */
+interface AuthioIdTokenClaims extends JWTPayload {
+    sub: string;
+    sid?: string;
+    nonce?: string;
+    auth_time?: number;
+    acr?: string;
+    amr?: string[];
+    at_hash?: string;
+    [claim: string]: unknown;
+}
+/**
+ * A validated back-channel logout token: end the sessions of `subject`, or the one session `sessionId` names.
+ */
+interface AuthioLogoutToken {
+    /** `sub`, when the token names the person. */
+    readonly subject: string | undefined;
+    /** `sid`, when the token names one session. */
+    readonly sessionId: string | undefined;
+    /** `jti`. */
+    readonly tokenId: string | undefined;
+    /** Every claim. */
+    readonly claims: Readonly<JWTPayload>;
+}
+/**
+ * The realm's signing keys, read from the discovery document's `jwks_uri` and cached; an unknown `kid` makes it read
+ * them again (at most once every 30 seconds).
+ *
+ * @internal
+ */
+type AuthioSigningKeys = (signal?: AbortSignal) => Promise<JWTVerifyGetKey>;
+/**
+ * What a JWT is checked against.
+ *
+ * @internal
+ */
+interface AuthioJwtExpectations {
+    readonly issuer: string;
+    readonly audiences: readonly string[];
+    readonly algorithms?: readonly string[];
+    /** Seconds. */
+    readonly clockSkew?: number;
+    /** Milliseconds since the epoch. */
+    readonly now: number;
+    readonly requiredClaims?: readonly string[];
+}
+/**
+ * Creates the cached reader of the realm's signing keys.
+ *
+ * @internal
+ */
+declare function createAuthioSigningKeys(connection: AuthioConnection, discovery: AuthioDiscoveryClient): AuthioSigningKeys;
+/**
+ * Verifies a signed JWT: signature by a realm key with an accepted algorithm, `iss`, `aud`, `exp` (required) and
+ * `nbf` with the clock skew.
+ *
+ * @throws AuthioTokenValidationError naming why the token was refused.
+ * @internal
+ */
+declare function verifyAuthioJwt(token: string, keys: JWTVerifyGetKey, expected: AuthioJwtExpectations): Promise<{
+    payload: JWTPayload;
+    header: Record<string, unknown>;
+}>;
+/**
+ * Turns a `jose` failure into the refusal it stands for, worded as ASP.NET Core's bearer handler words it.
+ *
+ * @internal
+ */
+declare function toTokenValidationError(error: unknown, audiences: readonly string[], token: string): AuthioTokenValidationError;
+/**
+ * The `at_hash` / `c_hash` of a value for a signing algorithm: the left half of its SHA-256, SHA-384 or SHA-512
+ * digest, base64url-encoded (OpenID Connect Core §3.1.3.6).
+ */
+declare function computeAuthioTokenHash(value: string, algorithm: string): Promise<string>;
+
+/**
+ * The PKCE method (RFC 7636). `S256` is the default; `plain` only when asked for, for a client that cannot hash.
+ */
+type AuthioCodeChallengeMethod = "S256" | "plain";
+/**
+ * A PKCE pair: send `codeChallenge` with the authorization request and `codeVerifier` with the code exchange.
+ */
+interface AuthioPkcePair {
+    readonly codeVerifier: string;
+    readonly codeChallenge: string;
+    readonly codeChallengeMethod: AuthioCodeChallengeMethod;
+}
+/**
+ * What an authorization request asks Authio for. Every member is optional; `redirectUri` falls back to the client's.
+ */
+interface AuthioAuthorizationRequest {
+    /** Where Authio sends the person back. Defaults to the client's `redirectUri`. */
+    redirectUri?: string;
+    /** Defaults to `openid`. */
+    scopes?: Iterable<string> | string;
+    /** The resource server the access token is for (RFC 8707). */
+    resource?: string;
+    /** The organization (its handle) the sign-in is for. Authoritative: the person cannot switch to another one. */
+    organization?: string;
+    /** `none` (silent), `login`, `select_account`, `consent`; several are joined with spaces. */
+    prompt?: AuthioPrompt | readonly AuthioPrompt[];
+    /** Seconds the person's sign-in may be old; Authio asks again past it, and the ID token's `auth_time` is checked. */
+    maxAge?: number;
+    /** Authentication context classes asked for: `1` one factor, `2` several, `3` one of them phishing-resistant. */
+    acrValues?: string | readonly string[];
+    /** Pre-fills the identifier on the sign-in screen. */
+    loginHint?: string;
+    /** A previously issued ID token, naming the person whose session is renewed. */
+    idTokenHint?: string;
+    /** Languages of the hosted screens, most preferred first. */
+    uiLocales?: string | readonly string[];
+    /** `page` (default) or `popup`, the layout of the hosted screens. */
+    display?: "page" | "popup";
+    /** `query` (default) or `web_message`, the popup's answer posted to the opener window. */
+    responseMode?: "query" | "web_message";
+    /** Shorthand for `display: "popup"` with `responseMode: "web_message"`. */
+    popup?: boolean;
+    /** The alias of the identity provider to go straight to, skipping Authio's sign-in screen. */
+    idpHint?: string;
+    /** Defaults to `S256`. */
+    codeChallengeMethod?: AuthioCodeChallengeMethod;
+    /** A `state` of your own; a random one otherwise. */
+    state?: string;
+    /** A `nonce` of your own; a random one otherwise. */
+    nonce?: string;
+    /** Further parameters, sent as given. */
+    extraParameters?: Record<string, string | undefined>;
+}
+/**
+ * What the application keeps between the authorization request and the callback (in its session, a cookie, …), to
+ * check the callback and redeem the code.
+ */
+interface AuthioAuthorizationTransaction {
+    readonly state: string;
+    readonly nonce: string;
+    readonly codeVerifier: string;
+    readonly codeChallengeMethod: AuthioCodeChallengeMethod;
+    readonly redirectUri: string;
+    readonly resource?: string;
+    readonly maxAge?: number;
+}
+/**
+ * An authorization URL and the transaction to keep until the callback.
+ */
+interface AuthioAuthorizationUrl {
+    readonly url: string;
+    readonly transaction: AuthioAuthorizationTransaction;
+}
+/**
+ * A `WWW-Authenticate` bearer challenge, as an API answers it (RFC 6750, RFC 9470, RFC 9728).
+ */
+interface AuthioBearerChallenge {
+    readonly error: string | undefined;
+    readonly errorDescription: string | undefined;
+    /** `insufficient_scope`: the scopes required. */
+    readonly scope: string | undefined;
+    /** `insufficient_user_authentication`: the context classes to ask for. */
+    readonly acrValues: string | undefined;
+    /** `insufficient_user_authentication`: how old the sign-in may be, in seconds. */
+    readonly maxAge: number | undefined;
+    /** RFC 9728: where the API's protected resource metadata is. */
+    readonly resourceMetadata: string | undefined;
+}
+/**
+ * Creates a PKCE pair: a 256-bit random verifier and its S256 (or plain) challenge.
+ */
+declare function createAuthioPkce(method?: AuthioCodeChallengeMethod): Promise<AuthioPkcePair>;
+/**
+ * A random, URL-safe value of `bytes` random bytes, for `state` and `nonce`.
+ */
+declare function randomValue(bytes?: number): string;
+/**
+ * Parses a `WWW-Authenticate` bearer challenge, or `undefined` when the header holds none.
+ */
+declare function parseAuthioBearerChallenge(header: string | null | undefined): AuthioBearerChallenge | undefined;
+
+/**
+ * A token endpoint answer, as Authio sends it.
+ */
+interface AuthioTokenResponse {
+    access_token: string;
+    token_type?: string;
+    /** Seconds. */
+    expires_in?: number;
+    /** Rotated on every refresh: store the new one. */
+    refresh_token?: string;
+    /** Seconds. */
+    refresh_expires_in?: number;
+    id_token?: string;
+    scope?: string;
+    session_state?: string;
+    issued_token_type?: string;
+    [member: string]: unknown;
+}
+/**
+ * An introspection answer (RFC 7662). Authio adds the token's other claims (roles, organization, claim-mapper
+ * claims, the user's own claims) as extra members.
+ */
+interface AuthioIntrospectionResult {
+    active: boolean;
+    scope?: string;
+    client_id?: string;
+    username?: string;
+    token_type?: string;
+    exp?: number;
+    iat?: number;
+    nbf?: number;
+    sub?: string;
+    aud?: string | string[];
+    iss?: string;
+    jti?: string;
+    [member: string]: unknown;
+}
+/**
+ * A device authorization answer (RFC 8628).
+ */
+interface AuthioDeviceAuthorization {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete?: string;
+    /** Seconds. */
+    expires_in: number;
+    /** Seconds between polls. */
+    interval?: number;
+    [member: string]: unknown;
+}
+/**
+ * What Authio's UserInfo endpoint answers: `sub` and the standard claims of the granted `profile`, `email` and `phone`
+ * scopes. Roles, claim-mapper claims, the user's own claims and the organization never reach it; read them from the
+ * access token or the ID token.
+ */
+interface AuthioUserInfo {
+    sub: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    preferred_username?: string;
+    email?: string;
+    email_verified?: boolean;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+    [claim: string]: unknown;
+}
+/**
+ * A cached client-credentials token.
+ */
+interface AuthioClientCredentialsToken {
+    readonly accessToken: string;
+    readonly tokenType: string;
+    /** Milliseconds since the epoch. */
+    readonly expiresAt: number;
+    /** When the cache renews it, in milliseconds since the epoch. */
+    readonly refreshAt: number;
+    readonly scope: string | undefined;
+}
+/**
+ * One of the person's connected accounts at a provider.
+ */
+interface AuthioConnectionChoice {
+    readonly id: string;
+    readonly label?: string;
+    /** The account's login at the provider. */
+    readonly externalLogin?: string;
+}
+/**
+ * The account at the provider a connection token belongs to.
+ */
+interface AuthioExternalAccount {
+    id?: string;
+    login?: string;
+    email?: string;
+    [member: string]: unknown;
+}
+/**
+ * The outcome of exchanging a user's token for the token of one of their connected accounts.
+ */
+type AuthioConnectionExchangeResult = AuthioConnectionGranted | AuthioConnectionRequired | AuthioConnectionSelectionRequired | AuthioConnectionRefused;
+/**
+ * The provider's access token.
+ */
+interface AuthioConnectionGranted {
+    readonly status: "granted";
+    readonly accessToken: string;
+    /** `urn:authio:params:oauth:token-type:connection-access-token`. */
+    readonly issuedTokenType?: string;
+    readonly tokenType?: string;
+    /** Seconds. */
+    readonly expiresIn?: number;
+    readonly scope?: string;
+    readonly connectionId?: string;
+    readonly provider: string;
+    /** The kind of provider, such as `GitHubApp`. */
+    readonly providerType?: string;
+    readonly externalAccount?: AuthioExternalAccount;
+}
+/**
+ * The person has not connected an account at the provider yet; send them to `connectUri`.
+ */
+interface AuthioConnectionRequired {
+    readonly status: "required";
+    readonly connectUri?: string;
+    readonly provider: string;
+    readonly errorCode?: string;
+    readonly errorDescription: string;
+}
+/**
+ * The person has several accounts at the provider; ask again with one `connectionId`.
+ */
+interface AuthioConnectionSelectionRequired {
+    readonly status: "selection_required";
+    readonly provider: string;
+    readonly connections: readonly AuthioConnectionChoice[];
+    readonly errorCode?: string;
+    readonly errorDescription: string;
+}
+/**
+ * Authio refused the exchange.
+ */
+interface AuthioConnectionRefused {
+    readonly status: "refused";
+    readonly error: string;
+    readonly errorCode?: string;
+    readonly errorDescription: string;
+    readonly connectUri?: string;
+}
+/**
+ * What one poll of the device flow's token endpoint means (RFC 8628 §3.5).
+ */
+type AuthioDevicePollOutcome = {
+    readonly outcome: "keep_polling";
+    readonly intervalIncrease: number;
+} | {
+    readonly outcome: "failed";
+    readonly error: string;
+};
+
+/**
+ * Everything the Authio client needs: where Authio is, and the client's credentials.
+ */
+interface AuthioClientOptions extends AuthioConnectionOptions, AuthioClientCredentialsSettings {
+    /**
+     * Seconds before expiry a cached token is renewed (capped at half its lifetime). Defaults to 60.
+     */
+    tokenRefreshSkew?: number;
+    /**
+     * The private half of the client's own encryption key, to read ID tokens, UserInfo and logout tokens Authio
+     * encrypts to the client (RSA-OAEP or RSA-OAEP-256); or a function returning it.
+     */
+    clientEncryptionKey?: AuthioEncryptionKeySource;
+    /** A PEM or JWK file holding `clientEncryptionKey` (Node only), read on first use. */
+    clientEncryptionKeyPath?: string;
+    /**
+     * Accepted for parity with the other Authio SDKs; RSA1_5 stays refused here, because Node and WebCrypto cannot
+     * decrypt it. Defaults to `false`.
+     */
+    allowLegacyEncryptionAlgorithms?: boolean;
+    /** Where Authio sends the person back after signing in, unless a request names another. */
+    redirectUri?: string;
+    /** Where Authio sends the person after signing out, unless a request names another. */
+    postLogoutRedirectUri?: string;
+    /** Seconds of clock skew tolerated on ID tokens, logout tokens and signed UserInfo. Defaults to 30. */
+    clockSkew?: number;
+    /** Algorithms ID tokens, logout tokens and signed UserInfo are accepted with. Defaults to RS*, PS*, ES*. */
+    validAlgorithms?: readonly string[];
+}
+/**
+ * What a completed sign-in yields.
+ */
+interface AuthioAuthorizationResult {
+    /** The token endpoint's answer: access token, refresh token, ID token. */
+    readonly tokens: AuthioTokenResponse;
+    /** The validated ID token's claims, when Authio issued one (the `openid` scope). */
+    readonly idToken: AuthioIdTokenClaims | undefined;
+}
+/**
+ * What the end-session URL carries (OpenID Connect RP-Initiated Logout).
+ */
+interface AuthioEndSessionRequest {
+    /** The ID token of the session to end. */
+    idTokenHint?: string;
+    /** Where to send the person afterwards; must be registered. Defaults to the client's `postLogoutRedirectUri`. */
+    postLogoutRedirectUri?: string;
+    /** Echoed back to `postLogoutRedirectUri`. */
+    state?: string;
+    /** The language of the signed-out screen. */
+    uiLocales?: string | readonly string[];
+    /** Sends the client id unless `false`, so Authio knows the client without an ID token. */
+    includeClientId?: boolean;
+}
+/**
+ * Per-call options.
+ */
+interface AuthioCallOptions {
+    /** Aborts the call. */
+    signal?: AbortSignal;
+}
+/**
+ * The token endpoint's grants.
+ */
+interface AuthioTokenClient {
+    /** `client_credentials`, optionally for a resource (RFC 8707). */
+    clientCredentials(options?: {
+        scopes?: Iterable<string> | string;
+        resource?: string;
+    } & AuthioCallOptions): Promise<AuthioTokenResponse>;
+    /** Redeems an authorization code. */
+    authorizationCode(options: {
+        code: string;
+        redirectUri: string;
+        codeVerifier?: string;
+        resource?: string;
+    } & AuthioCallOptions): Promise<AuthioTokenResponse>;
+    /** Refreshes; the answer carries the rotated refresh token, which must be stored. */
+    refresh(options: {
+        refreshToken: string;
+        scopes?: Iterable<string> | string;
+    } & AuthioCallOptions): Promise<AuthioTokenResponse>;
+    /** Exchanges a user's access token for one addressed to another resource (RFC 8693, on-behalf-of). */
+    exchange(options: {
+        subjectToken: string;
+        scopes?: Iterable<string> | string;
+        resource?: string;
+    } & AuthioCallOptions): Promise<AuthioTokenResponse>;
+    /**
+     * Exchanges a user's access token for the token of one of their connected accounts. OAuth refusals come back as
+     * a result, never thrown.
+     */
+    exchangeForConnection(options: {
+        subjectToken: string;
+        provider: string;
+        connectionId?: string;
+    } & AuthioCallOptions): Promise<AuthioConnectionExchangeResult>;
+    /** Starts the device flow (RFC 8628). */
+    deviceAuthorization(options?: {
+        scopes?: Iterable<string> | string;
+    } & AuthioCallOptions): Promise<AuthioDeviceAuthorization>;
+    /**
+     * Polls until the person approves: waits `interval` (default 5 s) before each poll, adds 5 s on `slow_down`, throws
+     * on `access_denied` and `expired_token`, and throws `expired_token` when `expires_in` elapses locally.
+     */
+    pollDevice(authorization: AuthioDeviceAuthorization | {
+        device_code: string;
+        interval?: number;
+        expires_in?: number;
+    }, options?: AuthioCallOptions): Promise<AuthioTokenResponse>;
+    /** The resource owner password grant, where the client allows it. */
+    password(options: {
+        username: string;
+        password: string;
+        scopes?: Iterable<string> | string;
+    } & AuthioCallOptions): Promise<AuthioTokenResponse>;
+    /**
+     * The `personal_access_token` grant: a `pat_` value presented as `client_secret`, with the consumer's client id for
+     * a consumer's token or none for an account's token. The client's own credentials are not sent.
+     */
+    personalAccessToken(options: {
+        token: string;
+        clientId?: string;
+        scopes?: Iterable<string> | string;
+        resource?: string;
+    } & AuthioCallOptions): Promise<AuthioTokenResponse>;
+}
+/**
+ * Client-credentials tokens, cached per scopes and resource.
+ */
+interface AuthioClientCredentialsCache {
+    /**
+     * A token for the scopes and resource, renewed `tokenRefreshSkew` before expiry (at most half its lifetime);
+     * concurrent callers for one key share one request.
+     */
+    getToken(options?: {
+        scopes?: Iterable<string> | string;
+        resource?: string;
+    } & AuthioCallOptions): Promise<AuthioClientCredentialsToken>;
+    /** Drops the cached token; with `accessToken`, only when the cache still holds that token. */
+    invalidate(options?: {
+        scopes?: Iterable<string> | string;
+        resource?: string;
+        accessToken?: string;
+    }): void;
+}
+/**
+ * The Authio client.
+ */
+interface AuthioClient {
+    /** The issuer. */
+    readonly issuer: string;
+    /** The client id. */
+    readonly clientId: string;
+    /** The connection settings. */
+    readonly connection: AuthioConnection;
+    /** The discovery document. */
+    readonly discovery: AuthioDiscoveryClient;
+    /** The token endpoint. */
+    readonly tokens: AuthioTokenClient;
+    /** Cached client-credentials tokens. */
+    readonly clientCredentials: AuthioClientCredentialsCache;
+    /**
+     * Introspects a token as this client (RFC 7662). Authio answers according to who asks: a token requested for a
+     * resource (RFC 8707) is active only to the client that resource server names as its introspection client.
+     */
+    introspect(token: string, options?: {
+        tokenTypeHint?: string;
+    } & AuthioCallOptions): Promise<AuthioIntrospectionResult>;
+    /** Revokes a token (RFC 7009). */
+    revoke(token: string, options?: {
+        tokenTypeHint?: string;
+    } & AuthioCallOptions): Promise<void>;
+    /**
+     * Reads UserInfo. A UserInfo answered as `application/jwt` is decrypted with `clientEncryptionKey` when it is a
+     * JWE, then verified against the realm's keys (`iss` the issuer, `aud` the client).
+     */
+    userInfo(accessToken: string, options?: AuthioCallOptions): Promise<AuthioUserInfo>;
+    /**
+     * A `fetch` that sends a cached client-credentials token, and on a `401` drops it and retries once.
+     */
+    clientCredentialsFetch(options?: {
+        scopes?: Iterable<string> | string;
+        resource?: string;
+        fetch?: typeof fetch;
+    }): typeof fetch;
+    /**
+     * Builds the authorization URL (PKCE S256, `state`, `nonce` and Authio's parameters) and the transaction to keep
+     * until the callback.
+     */
+    createAuthorizationUrl(request?: AuthioAuthorizationRequest & AuthioCallOptions): Promise<AuthioAuthorizationUrl>;
+    /**
+     * Completes a sign-in: checks `state` and the `iss` parameter (RFC 9207), throws the OAuth error Authio sent back,
+     * redeems the code with the PKCE verifier, and validates the ID token (nonce, `at_hash`, `max_age`).
+     *
+     * @param callback The callback URL, its query, or its parameters (a `web_message` answer, a parsed query).
+     * @param transaction What `createAuthorizationUrl` returned with the URL.
+     * @throws AuthioCallbackError when the callback is not for this transaction.
+     * @throws AuthioProtocolError for an OAuth error.
+     * @throws AuthioTokenValidationError when the ID token does not validate.
+     */
+    handleAuthorizationCallback(callback: string | URL | URLSearchParams | Readonly<Record<string, unknown>>, transaction: AuthioAuthorizationTransaction, options?: AuthioCallOptions): Promise<AuthioAuthorizationResult>;
+    /**
+     * Validates an ID token: decrypted with `clientEncryptionKey` when it is a JWE, then signature (cached JWKS), `iss`,
+     * `aud` = the client id, `exp` with the skew, payload `typ` = `ID`, and `nonce`, `at_hash` and `auth_time` when
+     * given.
+     *
+     * @throws AuthioTokenValidationError naming why it was refused.
+     */
+    validateIdToken(idToken: string, expectations?: {
+        nonce?: string;
+        accessToken?: string;
+        maxAge?: number;
+    } & AuthioCallOptions): Promise<AuthioIdTokenClaims>;
+    /**
+     * Validates a back-channel logout token Authio posted as `logout_token`.
+     *
+     * @throws AuthioTokenValidationError naming why it was refused (`invalid_logout_token` for the logout-specific rules).
+     */
+    validateLogoutToken(logoutToken: string, options?: AuthioCallOptions): Promise<AuthioLogoutToken>;
+    /** Builds the end-session URL (RP-Initiated Logout). */
+    createEndSessionUrl(request?: AuthioEndSessionRequest & AuthioCallOptions): Promise<string>;
+    /**
+     * Builds an authorization URL that satisfies an API's `insufficient_user_authentication` challenge (RFC 9470): its
+     * `acr_values` and `max_age`, with `prompt=login` when the challenge asks for a sign-in made just now (`max_age=0`).
+     *
+     * @param challenge The `WWW-Authenticate` header value, or the challenge already parsed.
+     */
+    createStepUpAuthorizationUrl(challenge: string | AuthioBearerChallenge, request?: AuthioAuthorizationRequest & AuthioCallOptions): Promise<AuthioAuthorizationUrl>;
+}
+/**
+ * Creates the Authio client.
+ *
+ * @throws AuthioConfigurationError when the settings are incomplete.
+ */
+declare function createAuthioClient(options: AuthioClientOptions): AuthioClient;
+/**
+ * When a token answer expires, and when a cache should renew it: `expires_in` (else 5 minutes) after `issuedAt`,
+ * renewed `refreshSkewMs` before that, at most half its lifetime.
+ */
+declare function toClientCredentialsToken(response: AuthioTokenResponse, issuedAt: number, refreshSkewMs: number): AuthioClientCredentialsToken;
+/**
+ * Reads the answer of a connected-account token exchange (see `conformance/oauth-responses.json`).
+ *
+ * @internal
+ */
+declare function toConnectionExchangeResult(body: string, status: number, provider: string): AuthioConnectionExchangeResult;
+/**
+ * What a device-flow poll's OAuth error means: keep polling (5 seconds slower after `slow_down`), or stop with it.
+ */
+declare function toDevicePollOutcome(error: string): AuthioDevicePollOutcome;
+
+/**
+ * A successful Admin API answer: the envelope's `data` (one object, or a listing's page `{ items, totalCount,
+ * pageNumber, pageSize }`), nothing for `204`.
+ */
+interface AuthioAdminSuccess<T = unknown> {
+    readonly ok: true;
+    readonly data?: T;
+}
+/**
+ * A refused Admin API answer.
+ */
+interface AuthioAdminFailure {
+    readonly ok: false;
+    readonly error: AuthioAdminError;
+}
+/**
+ * An Admin API answer, read.
+ */
+type AuthioAdminEnvelope<T = unknown> = AuthioAdminSuccess<T> | AuthioAdminFailure;
+/**
+ * How an account credential is presented: `ak_` (API key), `cs_` (client secret, exchanged first) or `pat_`
+ * (personal access token).
+ */
+type AuthioAccountCredentialKind = "api_key" | "client_secret" | "personal_access_token";
+/**
+ * Options of `createAuthioAccountCredential`.
+ */
+interface AuthioAccountCredentialOptions extends Omit<AuthioConnectionOptions, "issuer" | "realm"> {
+    /** Authio's base URL, such as `https://auth.example.com`. Required. */
+    authority?: string;
+    /** The credential's value: `ak_…`, `cs_…` or `pat_…`. */
+    credential: string;
+    /** The credential's id, needed to exchange a `cs_` secret (its `client_id` is `cred_` and the id without dashes). */
+    credentialId?: string;
+    /** How an `ak_` or `pat_` value is sent directly: `Authorization: Bearer` (default) or `x-api-key`. */
+    presentAs?: "bearer" | "x-api-key";
+    /** Exchanges a `pat_` value with the `personal_access_token` grant instead of sending it directly. */
+    exchangePersonalAccessToken?: boolean;
+    /** Narrows an exchanged token to these `admin:{permission}:{method}` scopes. */
+    scopes?: Iterable<string> | string;
+    /** Seconds before expiry an exchanged token is renewed (at most half its lifetime). Defaults to 60. */
+    tokenRefreshSkew?: number;
+}
+/**
+ * An account credential ready to call the Admin API with.
+ */
+interface AuthioAccountCredential {
+    /** How the credential is presented. */
+    readonly kind: AuthioAccountCredentialKind;
+    /** Whether it is exchanged at the `authio` realm's token endpoint before use. */
+    readonly exchanged: boolean;
+    /** The headers that authenticate a request: `Authorization` or `x-api-key`. */
+    headers(signal?: AbortSignal): Promise<Record<string, string>>;
+    /** Drops an exchanged token, so the next request exchanges again. */
+    invalidate(): void;
+    /**
+     * A `fetch` that authenticates every request; on `401` with an exchanged token it exchanges again and retries once;
+     * on `429` or `503` it waits `Retry-After` and retries an idempotent request (`GET`, `HEAD`, `PUT`, `DELETE`) once.
+     */
+    readonly fetch: typeof fetch;
+}
+/**
+ * Reads an Admin API answer (see `conformance/admin-envelopes.json`). The status is the HTTP one, never the
+ * envelope's numeric `statusCode`; `requestId` falls back to `X-Request-Id`, and `retryAfterSeconds` comes from
+ * `Retry-After`.
+ */
+declare function parseAuthioAdminEnvelope<T = unknown>(status: number, body: string | null | undefined, headers?: Headers | Readonly<Record<string, string | undefined>>): AuthioAdminEnvelope<T>;
+/**
+ * Reads an Admin API response, throwing `AuthioAdminError` when it is not a success.
+ */
+declare function readAuthioAdminResponse<T = unknown>(response: Response): Promise<AuthioAdminSuccess<T>>;
+/**
+ * Prepares an account credential for the Admin API: `ak_` and `pat_` go directly as `Authorization: Bearer` (or
+ * `x-api-key`); a `cs_` secret is exchanged at `{authority}/realms/authio` with `client_credentials` and the
+ * `client_id` `cred_{id}`; a `pat_` may be exchanged with the `personal_access_token` grant instead. Exchanged tokens
+ * are cached and renewed before expiry.
+ *
+ * @throws AuthioConfigurationError when the value has no known prefix or a `cs_` secret comes without its id.
+ */
+declare function createAuthioAccountCredential(options: AuthioAccountCredentialOptions): AuthioAccountCredential;
+/**
+ * The `client_id` an account credential's client secret is exchanged with: `cred_` and the id in format N (no dashes,
+ * lower case). An id already starting with `cred_` is kept.
+ */
+declare function toCredentialClientId(credentialId: string): string;
+
+/**
+ * One role read from a `*_resource_access` claim, with the permissions it grants.
+ */
+interface AuthioResourceAccessRole {
+    /** The claim the role came from. */
+    readonly source: AuthioResourceAccessSource;
+    /** The role name. */
+    readonly name: string;
+    /** Resource → methods the role allows on it. */
+    readonly permissions: Readonly<Record<string, readonly string[]>>;
+}
+/**
+ * The roles and permissions a token carries in its `*_resource_access` claims, merged across sources.
+ *
+ * Every comparison is case-insensitive, as Authio's own check is. When a name appears in different case, the first
+ * spelling read is the one listed.
+ */
+declare class AuthioResourceAccess {
+    /** No role at all. */
+    static readonly empty: AuthioResourceAccess;
+    /** Every role read, in claim order, one entry per source it came from. */
+    readonly entries: readonly AuthioResourceAccessRole[];
+    /** Every distinct role name. */
+    readonly roles: readonly string[];
+    /** Resource → every method any role allows on it. */
+    readonly permissions: Readonly<Record<string, readonly string[]>>;
+    private readonly lookup;
+    constructor(entries: Iterable<AuthioResourceAccessRole>);
+    /** Whether no role was read. */
+    get isEmpty(): boolean;
+    /**
+     * Whether the token holds the role, from any source or only from the given ones.
+     */
+    hasRole(role: string, sources?: readonly AuthioResourceAccessSource[]): boolean;
+    /**
+     * Authio's grant rule: whether any role (from any source, or only from the given ones) allows `method` on
+     * `resource`.
+     */
+    grants(resource: string, method: string, sources?: readonly AuthioResourceAccessSource[]): boolean;
+    /**
+     * The roles that came from one source.
+     */
+    fromSource(source: AuthioResourceAccessSource): AuthioResourceAccessRole[];
+}
+/**
+ * The source a claim name stands for, when it is one of the seven `*_resource_access` claims.
+ */
+declare function resourceAccessSourceOf(claimType: string | undefined | null): AuthioResourceAccessSource | undefined;
+/**
+ * Reads the roles of every `*_resource_access` claim. Takes a JWT payload or introspection answer, or
+ * `[type, value]` pairs; each value may be the JSON object itself or its JSON text. Other claims are ignored.
+ */
+declare function parseResourceAccess(claims: Readonly<Record<string, unknown>> | Iterable<readonly [string, unknown]>): AuthioResourceAccess;
+/**
+ * Reads the roles of one claim value, as strictly as Authio does: a value that is not exactly
+ * `{role: {resource: [method]}}` contributes nothing at all. `null` roles, resources and methods are allowed and grant
+ * nothing.
+ */
+declare function parseResourceAccessClaim(source: AuthioResourceAccessSource, value: unknown): AuthioResourceAccessRole[];
+
+/**
+ * Why a webhook delivery failed verification.
+ */
+type AuthioWebhookVerificationFailure = "missing_signature" | "malformed_signature" | "signature_mismatch" | "timestamp_outside_tolerance";
+/**
+ * The outcome of verifying a webhook signature.
+ */
+type AuthioWebhookVerificationResult = {
+    readonly valid: true;
+    readonly timestamp: Date;
+} | {
+    readonly valid: false;
+    readonly failure: AuthioWebhookVerificationFailure;
+    readonly reason: string;
+    readonly timestamp?: Date;
+};
+/**
+ * A webhook event. `data` holds the event-specific payload as delivered (snake_case); read it typed, in camelCase,
+ * with the `as…` helpers.
+ */
+interface AuthioWebhookEvent {
+    readonly id: string;
+    readonly type: string;
+    /** Seconds since the epoch. */
+    readonly created_at: number;
+    readonly realm_id?: string | null;
+    readonly client_id?: string | null;
+    readonly data: unknown;
+    [member: string]: unknown;
+}
+/** `user_created`, `user_updated`, `user_deleted`, as delivered. */
+interface AuthioWebhookUserData {
+    id: string;
+    username?: string | null;
+    email?: string | null;
+    first_name?: string | null;
+    last_name?: string | null;
+    email_confirmed: boolean;
+    status?: string | null;
+    realm_id?: string | null;
+    client_id?: string | null;
+}
+/** `login_succeeded`, `login_failed`, as delivered. */
+interface AuthioWebhookLoginData {
+    grant_type?: string | null;
+    user_id?: string | null;
+    username?: string | null;
+    email?: string | null;
+    ip_address?: string | null;
+    user_agent?: string | null;
+    session_id?: string | null;
+    failure_reason?: string | null;
+    resource?: string | null;
+    scopes?: string[] | null;
+    authentication_methods?: string[] | null;
+    acr?: string | null;
+    identity_provider?: string | null;
+    consumer_id?: string | null;
+    consumer_name?: string | null;
+}
+/** `user_locked_out`, as delivered. */
+interface AuthioWebhookUserLockedOutData {
+    user_id: string;
+    username?: string | null;
+    email?: string | null;
+    lockout_end?: string | null;
+    access_failed_count: number;
+}
+/** `token_revoked`, as delivered. */
+interface AuthioWebhookTokenRevokedData {
+    token_id?: string | null;
+    subject?: string | null;
+    session_id?: string | null;
+    token_type_hint?: string | null;
+}
+/**
+ * `keys_rotated`, as delivered: `rotation_days` and `automatic` on a scheduled rotation, `revoked_keys_count` on a
+ * manual one.
+ */
+interface AuthioWebhookKeysRotatedData {
+    signing_key_id?: string | null;
+    encryption_key_id?: string | null;
+    revoked_keys_count?: number | null;
+    rotation_days?: number | null;
+    automatic?: boolean | null;
+}
+/** `token_reuse_detected`, as delivered. */
+interface AuthioWebhookTokenReuseDetectedData {
+    token_id?: string | null;
+    subject?: string | null;
+    session_id?: string | null;
+    ip_address?: string | null;
+    user_agent?: string | null;
+}
+/** `admin_resource_created`, `admin_resource_updated`, `admin_resource_deleted`, as delivered. */
+interface AuthioWebhookAdminResourceData {
+    action?: string | null;
+    resource_type?: string | null;
+    resource_id?: string | null;
+    parent_id?: string | null;
+    realm_id?: string | null;
+    client_id?: string | null;
+    /** `User` or `Credential`. */
+    actor_type?: string | null;
+    actor_user_id?: string | null;
+    actor_username?: string | null;
+    actor_email?: string | null;
+    actor_credential_id?: string | null;
+    actor_credential_name?: string | null;
+    actor_platform_operator?: boolean | null;
+    ip_address?: string | null;
+    method?: string | null;
+    path?: string | null;
+    /** What changed, by resource type; kept as delivered. */
+    details?: Record<string, unknown> | null;
+}
+/** `user_suspended`, `user_suspension_ended`, as delivered. */
+interface AuthioWebhookUserSuspensionData {
+    id: string;
+    user_id: string;
+    level?: string | null;
+    status?: string | null;
+    starts_at?: string | null;
+    ends_at?: string | null;
+    restricted_scopes: string[];
+    revokes_every_role: boolean;
+    revoked_role_ids: string[];
+    sessions_terminated_at?: string | null;
+    lifted_at?: string | null;
+}
+/** `attack_detected`, as delivered: an attack on the realm and the measure Authio took. */
+interface AuthioWebhookAttackDetectedData {
+    incident_id: string;
+    /** Such as `credential_stuffing`. */
+    kind?: string | null;
+    severity?: string | null;
+    /** Such as `source_blocked`. */
+    measure?: string | null;
+    ip_address?: string | null;
+    country?: string | null;
+    asn?: number | null;
+    network_operator?: string | null;
+    user_id?: string | null;
+    started_at?: string | null;
+}
+/** `credential_compromised`, as delivered: a person's password was used by an attacker. */
+interface AuthioWebhookCredentialCompromisedData {
+    incident_id: string;
+    user_id?: string | null;
+    username?: string | null;
+    ip_address?: string | null;
+    country?: string | null;
+    asn?: number | null;
+    network_operator?: string | null;
+    password_change_required?: boolean | null;
+}
+/** `ping`, as delivered. */
+interface AuthioWebhookPingData {
+    message?: string | null;
+    subscription?: string | null;
+}
+/**
+ * The data shape of each event type, as delivered (snake_case).
+ */
+interface AuthioWebhookDataByType {
+    user_created: AuthioWebhookUserData;
+    user_updated: AuthioWebhookUserData;
+    user_deleted: AuthioWebhookUserData;
+    login_succeeded: AuthioWebhookLoginData;
+    login_failed: AuthioWebhookLoginData;
+    user_locked_out: AuthioWebhookUserLockedOutData;
+    token_revoked: AuthioWebhookTokenRevokedData;
+    keys_rotated: AuthioWebhookKeysRotatedData;
+    token_reuse_detected: AuthioWebhookTokenReuseDetectedData;
+    admin_resource_created: AuthioWebhookAdminResourceData;
+    admin_resource_updated: AuthioWebhookAdminResourceData;
+    admin_resource_deleted: AuthioWebhookAdminResourceData;
+    user_suspended: AuthioWebhookUserSuspensionData;
+    user_suspension_ended: AuthioWebhookUserSuspensionData;
+    attack_detected: AuthioWebhookAttackDetectedData;
+    credential_compromised: AuthioWebhookCredentialCompromisedData;
+    ping: AuthioWebhookPingData;
+}
+/**
+ * A snake_case name in camelCase.
+ */
+type AuthioCamelCase<S extends string> = S extends `${infer Head}_${infer Tail}` ? `${Head}${Capitalize<AuthioCamelCase<Tail>>}` : S;
+/**
+ * An object whose top-level member names are turned into camelCase, values unchanged.
+ */
+type AuthioCamelCased<T> = {
+    [K in keyof T as K extends string ? AuthioCamelCase<K> : K]: T[K];
+};
+/** The data of a user event, as the typed accessor exposes it. */
+type AuthioWebhookUser = AuthioCamelCased<AuthioWebhookUserData>;
+/** The data of a login event, as the typed accessor exposes it. */
+type AuthioWebhookLogin = AuthioCamelCased<AuthioWebhookLoginData>;
+/** The data of a lockout event, as the typed accessor exposes it. */
+type AuthioWebhookUserLockedOut = AuthioCamelCased<AuthioWebhookUserLockedOutData>;
+/** The data of a revocation event, as the typed accessor exposes it. */
+type AuthioWebhookTokenRevoked = AuthioCamelCased<AuthioWebhookTokenRevokedData>;
+/** The data of a key rotation event, as the typed accessor exposes it. */
+type AuthioWebhookKeysRotated = AuthioCamelCased<AuthioWebhookKeysRotatedData>;
+/** The data of a refresh token reuse event, as the typed accessor exposes it. */
+type AuthioWebhookTokenReuseDetected = AuthioCamelCased<AuthioWebhookTokenReuseDetectedData>;
+/** The data of an admin resource event, as the typed accessor exposes it. */
+type AuthioWebhookAdminResource = AuthioCamelCased<AuthioWebhookAdminResourceData>;
+/** The data of a suspension event, as the typed accessor exposes it. */
+type AuthioWebhookUserSuspension = AuthioCamelCased<AuthioWebhookUserSuspensionData>;
+/** The data of an attack event, as the typed accessor exposes it. */
+type AuthioWebhookAttackDetected = AuthioCamelCased<AuthioWebhookAttackDetectedData>;
+/** The data of a compromised credential event, as the typed accessor exposes it. */
+type AuthioWebhookCredentialCompromised = AuthioCamelCased<AuthioWebhookCredentialCompromisedData>;
+/** The data of a ping, as the typed accessor exposes it. */
+type AuthioWebhookPing = AuthioCamelCased<AuthioWebhookPingData>;
+/**
+ * An event narrowed to one type, with its data typed as delivered.
+ */
+type AuthioTypedWebhookEvent<T extends keyof AuthioWebhookDataByType> = AuthioWebhookEvent & {
+    readonly type: T;
+    readonly data: AuthioWebhookDataByType[T];
+};
+/**
+ * Verifies the `X-Authio-Signature` header (`t={unixSeconds},v1={hex}`) against the raw body: HMAC-SHA256 of
+ * `{t}.{body}` with the secret, compared in constant time, any matching `v1` accepted, the signature checked before
+ * the timestamp.
+ *
+ * @param signatureHeader The header value.
+ * @param rawBody The body exactly as received.
+ * @param secret The webhook's secret.
+ * @param options `tolerance` in seconds (default 300) and `now` in milliseconds (default the current time).
+ */
+declare function verifyWebhookSignature(signatureHeader: string | null | undefined, rawBody: string | Uint8Array, secret: string, options?: {
+    tolerance?: number;
+    now?: number;
+}): Promise<AuthioWebhookVerificationResult>;
+/**
+ * Computes the `X-Authio-Signature` value Authio would send, for tests and replays.
+ *
+ * @param timestamp Milliseconds since the epoch, or a date.
+ */
+declare function computeWebhookSignatureHeader(rawBody: string | Uint8Array, secret: string, timestamp: number | Date): Promise<string>;
+/**
+ * Parses a webhook body.
+ *
+ * @throws SyntaxError when it is not JSON or has no `type`.
+ */
+declare function parseWebhookEvent(rawBody: string | Uint8Array): AuthioWebhookEvent;
+/**
+ * Parses a webhook body, or returns `undefined` when it cannot be read.
+ */
+declare function tryParseWebhookEvent(rawBody: string | Uint8Array | null | undefined): AuthioWebhookEvent | undefined;
+/**
+ * Whether the event is of one of the given types, narrowing its data.
+ */
+declare function isWebhookEventOfType<T extends keyof AuthioWebhookDataByType>(event: AuthioWebhookEvent, ...types: T[]): event is AuthioTypedWebhookEvent<T>;
+/** The data of a user event in camelCase, or `undefined` for any other type. */
+declare const asUserEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookUserData> | undefined;
+/** The data of a login event in camelCase, or `undefined` for any other type. */
+declare const asLoginEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookLoginData> | undefined;
+/** The data of a lockout event in camelCase, or `undefined` for any other type. */
+declare const asUserLockedOutEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookUserLockedOutData> | undefined;
+/** The data of a revocation event in camelCase, or `undefined` for any other type. */
+declare const asTokenRevokedEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookTokenRevokedData> | undefined;
+/** The data of a key rotation event in camelCase, or `undefined` for any other type. */
+declare const asKeysRotatedEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookKeysRotatedData> | undefined;
+/** The data of a refresh token reuse event in camelCase, or `undefined` for any other type. */
+declare const asTokenReuseDetectedEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookTokenReuseDetectedData> | undefined;
+/** The data of an admin resource event in camelCase, or `undefined` for any other type. */
+declare const asAdminResourceEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookAdminResourceData> | undefined;
+/** The data of a suspension event in camelCase, or `undefined` for any other type. */
+declare const asUserSuspensionEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookUserSuspensionData> | undefined;
+/** The data of an attack event in camelCase, or `undefined` for any other type. */
+declare const asAttackDetectedEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookAttackDetectedData> | undefined;
+/** The data of a compromised credential event in camelCase, or `undefined` for any other type. */
+declare const asCredentialCompromisedEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookCredentialCompromisedData> | undefined;
+/** The data of a ping in camelCase, or `undefined` for any other type. */
+declare const asPingEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookPingData> | undefined;
+/**
+ * Whether Authio documents the event type. An unknown type still parses; read its `data` as delivered.
+ */
+declare function isKnownWebhookEventType(type: string): type is keyof AuthioWebhookDataByType;
+/**
+ * The data of any known event in camelCase (what the typed accessor of its type returns), or `undefined` for an
+ * unknown type.
+ */
+declare function readWebhookEventData(event: AuthioWebhookEvent): Record<string, unknown> | undefined;
+/**
+ * Turns the top-level member names of an object from snake_case into camelCase, leaving the values as they are.
+ */
+declare function toCamelCasedMembers<T extends object>(value: T): AuthioCamelCased<T>;
+
+export { type AuthioAccountCredential, type AuthioAccountCredentialKind, type AuthioAccountCredentialOptions, type AuthioAdminEnvelope, AuthioAdminError, type AuthioAdminFailure, type AuthioAdminNotification, type AuthioAdminSuccess, AuthioAsymmetricAlgorithms, type AuthioAuthorizationRequest, type AuthioAuthorizationResult, type AuthioAuthorizationTransaction, type AuthioAuthorizationUrl, type AuthioBearerChallenge, type AuthioCallOptions, AuthioCallbackError, type AuthioCallbackFailure, type AuthioCallerKind, AuthioCallerKinds, type AuthioCamelCase, type AuthioCamelCased, AuthioClaimTypes, type AuthioClient, AuthioClientAssertionAlgorithms, type AuthioClientAuthentication, type AuthioClientCredentialsCache, type AuthioClientCredentialsSettings, type AuthioClientCredentialsToken, type AuthioClientOptions, type AuthioClock, type AuthioCodeChallengeMethod, AuthioConfigurationError, type AuthioConnection, type AuthioConnectionChoice, type AuthioConnectionExchangeResult, type AuthioConnectionGranted, type AuthioConnectionOptions, type AuthioConnectionRefused, type AuthioConnectionRequired, type AuthioConnectionSelectionRequired, AuthioContentEncryptionAlgorithms, type AuthioCredentialForm, AuthioDefaults, type AuthioDeviceAuthorization, type AuthioDevicePollOutcome, type AuthioDiscoveryClient, type AuthioDiscoveryDocument, AuthioDiscoveryError, type AuthioEncryptionKey, type AuthioEncryptionKeySource, type AuthioEndSessionRequest, AuthioError, type AuthioErrorResponse, type AuthioExternalAccount, AuthioGrantTypes, type AuthioIdTokenClaims, type AuthioIntrospectionResult, type AuthioJwtExpectations, AuthioKeyManagementAlgorithms, AuthioLegacyKeyManagementAlgorithms, type AuthioLogoutToken, AuthioOAuthErrors, type AuthioPkcePair, type AuthioPrivateKeyInput, type AuthioPrompt, AuthioPrompts, AuthioProtocolError, AuthioResourceAccess, AuthioResourceAccessClaims, type AuthioResourceAccessRole, type AuthioResourceAccessSource, AuthioScopes, type AuthioSecretSource, type AuthioSigningKeys, type AuthioTokenClient, type AuthioTokenDecrypter, type AuthioTokenDecrypterOptions, type AuthioTokenFailure, type AuthioTokenResponse, AuthioTokenTypes, AuthioTokenValidationError, type AuthioTypedWebhookEvent, type AuthioUserInfo, type AuthioWebhookAdminResource, type AuthioWebhookAdminResourceData, type AuthioWebhookAttackDetected, type AuthioWebhookAttackDetectedData, type AuthioWebhookCredentialCompromised, type AuthioWebhookCredentialCompromisedData, type AuthioWebhookDataByType, type AuthioWebhookEvent, AuthioWebhookEventTypes, AuthioWebhookHeaders, type AuthioWebhookKeysRotated, type AuthioWebhookKeysRotatedData, type AuthioWebhookLogin, type AuthioWebhookLoginData, type AuthioWebhookPing, type AuthioWebhookPingData, type AuthioWebhookTokenReuseDetected, type AuthioWebhookTokenReuseDetectedData, type AuthioWebhookTokenRevoked, type AuthioWebhookTokenRevokedData, type AuthioWebhookUser, type AuthioWebhookUserData, type AuthioWebhookUserLockedOut, type AuthioWebhookUserLockedOutData, type AuthioWebhookUserSuspension, type AuthioWebhookUserSuspensionData, type AuthioWebhookVerificationFailure, type AuthioWebhookVerificationResult, asAdminResourceEvent, asAttackDetectedEvent, asCredentialCompromisedEvent, asKeysRotatedEvent, asLoginEvent, asPingEvent, asTokenReuseDetectedEvent, asTokenRevokedEvent, asUserEvent, asUserLockedOutEvent, asUserSuspensionEvent, computeAuthioTokenHash, computeWebhookSignatureHeader, createAuthioAccountCredential, createAuthioClient, createAuthioDiscoveryClient, createAuthioPkce, createAuthioSigningKeys, createAuthioTokenDecrypter, encryptionKeyFromFile, escapeDataString, isAllowedUrl, isAuthioTokenEncrypted, isKnownWebhookEventType, isWebhookEventOfType, parseAuthioAdminEnvelope, parseAuthioBearerChallenge, parseResourceAccess, parseResourceAccessClaim, parseWebhookEvent, randomValue, readAuthioAdminResponse, readWebhookEventData, resolveConnection, resolveIssuer, resourceAccessSourceOf, seconds, systemClock, toBasicAuthorization, toCamelCasedMembers, toClientCredentialsToken, toConnectionExchangeResult, toCredentialClientId, toDevicePollOutcome, toScopeString, toTokenValidationError, tryParseWebhookEvent, verifyAuthioJwt, verifyWebhookSignature };