@hyper.authio/client 0.0.0-stage → 0.7.0

package/dist/index.js

@@ -0,0 +1,1916 @@
+import { compactDecrypt, errors, decodeProtectedHeader, createRemoteJWKSet, customFetch, jwtVerify, importPKCS8, SignJWT, importJWK } from 'jose';
+
+// src/constants.ts
+var AuthioClaimTypes = {
+  Subject: "sub",
+  JwtId: "jti",
+  Issuer: "iss",
+  Audience: "aud",
+  Expiration: "exp",
+  IssuedAt: "iat",
+  NotBefore: "nbf",
+  AuthTime: "auth_time",
+  TokenType: "typ",
+  AuthorizedParty: "azp",
+  Scope: "scope",
+  SessionId: "sid",
+  AuthenticationContextClass: "acr",
+  AuthenticationMethods: "amr",
+  IdentityProvider: "idp",
+  Nonce: "nonce",
+  AccessTokenHash: "at_hash",
+  Events: "events",
+  OrganizationId: "org_id",
+  OrganizationAlias: "org_alias",
+  AccountId: "account_id",
+  Actor: "act",
+  DelegationId: "delegation_id",
+  ClientId: "client_id",
+  Name: "name",
+  GivenName: "given_name",
+  FamilyName: "family_name",
+  UniqueName: "unique_name",
+  PreferredUsername: "preferred_username",
+  UpdatedAt: "updated_at",
+  Email: "email",
+  EmailVerified: "email_verified",
+  PhoneNumber: "phone_number",
+  PhoneNumberVerified: "phone_number_verified",
+  ConsumerName: "consumer_name",
+  CredentialId: "credential_id",
+  CredentialType: "credential_type",
+  CredentialName: "credential_name",
+  CredentialRealm: "credential_realm",
+  CredentialClient: "credential_client",
+  ActorType: "actor_type",
+  OwnerUserId: "owner_user_id",
+  OwnerUsername: "owner_username",
+  UserResourceAccess: "user_resource_access",
+  RealmResourceAccess: "realm_resource_access",
+  ClientResourceAccess: "client_resource_access",
+  PlanResourceAccess: "plan_resource_access",
+  ConsumerResourceAccess: "consumer_resource_access",
+  SecretResourceAccess: "secret_resource_access",
+  SystemResourceAccess: "system_resource_access"
+};
+var AuthioResourceAccessClaims = Object.freeze({
+  [AuthioClaimTypes.UserResourceAccess]: "user",
+  [AuthioClaimTypes.RealmResourceAccess]: "realm",
+  [AuthioClaimTypes.ClientResourceAccess]: "client",
+  [AuthioClaimTypes.PlanResourceAccess]: "plan",
+  [AuthioClaimTypes.ConsumerResourceAccess]: "consumer",
+  [AuthioClaimTypes.SecretResourceAccess]: "secret",
+  [AuthioClaimTypes.SystemResourceAccess]: "system"
+});
+var AuthioScopes = {
+  OpenId: "openid",
+  Profile: "profile",
+  Email: "email",
+  Phone: "phone",
+  Roles: "roles",
+  OfflineAccess: "offline_access"
+};
+var AuthioGrantTypes = {
+  AuthorizationCode: "authorization_code",
+  RefreshToken: "refresh_token",
+  ClientCredentials: "client_credentials",
+  Password: "password",
+  DeviceCode: "urn:ietf:params:oauth:grant-type:device_code",
+  TokenExchange: "urn:ietf:params:oauth:grant-type:token-exchange",
+  PersonalAccessToken: "personal_access_token"
+};
+var AuthioTokenTypes = {
+  AccessTokenUrn: "urn:ietf:params:oauth:token-type:access_token",
+  ConnectionAccessTokenUrn: "urn:authio:params:oauth:token-type:connection-access-token",
+  AccessToken: "access_token",
+  RefreshToken: "refresh_token"
+};
+var AuthioOAuthErrors = {
+  InvalidRequest: "invalid_request",
+  InvalidClient: "invalid_client",
+  InvalidGrant: "invalid_grant",
+  UnauthorizedClient: "unauthorized_client",
+  UnsupportedGrantType: "unsupported_grant_type",
+  InvalidScope: "invalid_scope",
+  InvalidTarget: "invalid_target",
+  AccessDenied: "access_denied",
+  InvalidToken: "invalid_token",
+  AuthorizationPending: "authorization_pending",
+  SlowDown: "slow_down",
+  ExpiredToken: "expired_token",
+  ConnectionRequired: "connection_required",
+  ConnectionSelectionRequired: "connection_selection_required",
+  ConnectionPolicyViolation: "connection_policy_violation",
+  ServerError: "server_error",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  LoginRequired: "login_required",
+  InteractionRequired: "interaction_required",
+  ConsentRequired: "consent_required",
+  AccountSelectionRequired: "account_selection_required",
+  InsufficientScope: "insufficient_scope",
+  InsufficientUserAuthentication: "insufficient_user_authentication"
+};
+var AuthioWebhookEventTypes = {
+  UserCreated: "user_created",
+  UserUpdated: "user_updated",
+  UserDeleted: "user_deleted",
+  LoginSucceeded: "login_succeeded",
+  LoginFailed: "login_failed",
+  UserLockedOut: "user_locked_out",
+  TokenRevoked: "token_revoked",
+  KeysRotated: "keys_rotated",
+  TokenReuseDetected: "token_reuse_detected",
+  AdminResourceCreated: "admin_resource_created",
+  AdminResourceUpdated: "admin_resource_updated",
+  AdminResourceDeleted: "admin_resource_deleted",
+  UserSuspended: "user_suspended",
+  UserSuspensionEnded: "user_suspension_ended",
+  AttackDetected: "attack_detected",
+  CredentialCompromised: "credential_compromised",
+  Ping: "ping"
+};
+var AuthioWebhookHeaders = {
+  Signature: "X-Authio-Signature",
+  Event: "X-Authio-Event",
+  EventId: "X-Authio-Event-Id"
+};
+var AuthioCallerKinds = ["user", "client", "consumer", "account_credential"];
+var AuthioPrompts = ["none", "login", "select_account", "consent"];
+var AuthioAsymmetricAlgorithms = [
+  "RS256",
+  "RS384",
+  "RS512",
+  "PS256",
+  "PS384",
+  "PS512",
+  "ES256",
+  "ES384",
+  "ES512"
+];
+var AuthioDefaults = {
+  DiscoveryPath: "/.well-known/openid-configuration",
+  ProtectedResourceMetadataPath: "/.well-known/oauth-protected-resource",
+  RedactedValue: "[redacted]",
+  PlatformRealm: "authio",
+  PlatformClientId: "authio",
+  ApiKeyPrefix: "ak_",
+  ClientSecretPrefix: "cs_",
+  PersonalAccessTokenPrefix: "pat_",
+  /** The `client_id` an account credential's client secret is exchanged with: `cred_` and the credential id (format N). */
+  CredentialClientIdPrefix: "cred_",
+  ApiKeyHeader: "x-api-key",
+  RequestIdHeader: "X-Request-Id",
+  /** The header `typ` of a back-channel logout token. */
+  LogoutTokenType: "logout+jwt",
+  /** The event a back-channel logout token carries. */
+  BackchannelLogoutEvent: "http://schemas.openid.net/event/backchannel-logout",
+  /** Seconds. */
+  ClockSkew: 30,
+  /** Seconds. */
+  ClientAssertionLifetime: 120,
+  /** Seconds. */
+  MaxClientAssertionLifetime: 3600,
+  /** Seconds. */
+  DeviceInterval: 5,
+  /** Seconds. */
+  DeviceSlowDownIncrement: 5,
+  /** Seconds a token without `expires_in` is assumed to live. */
+  AssumedTokenLifetime: 300,
+  /** Seconds. */
+  DiscoveryCacheDuration: 3600,
+  /** Seconds. */
+  HttpTimeout: 30,
+  /** Seconds. */
+  TokenRefreshSkew: 60,
+  /** Seconds. */
+  WebhookTolerance: 300,
+  /** Smallest RSA key Authio verifies a client assertion from, in bits. */
+  MinimumRsaKeySize: 2048,
+  CredentialHeaders: ["authorization", "proxy-authorization", "x-api-key", "cookie", "set-cookie"]
+};
+
+// src/errors.ts
+var AuthioError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = new.target.name;
+  }
+};
+var AuthioProtocolError = class extends AuthioError {
+  /** The OAuth error code. */
+  error;
+  /** The OAuth error description. */
+  errorDescription;
+  /** Authio's own error code (`error_code`), more specific than `error`. */
+  errorCode;
+  /** The HTTP status, when the error came from a response. */
+  status;
+  constructor(error, errorDescription, errorCode, status, options) {
+    super(errorDescription ? `${error}: ${errorDescription}` : error, options);
+    this.error = error;
+    this.errorDescription = errorDescription;
+    this.errorCode = errorCode;
+    this.status = status;
+  }
+};
+var AuthioDiscoveryError = class extends AuthioError {
+};
+var AuthioConfigurationError = class extends AuthioError {
+};
+var AuthioTokenValidationError = class extends AuthioError {
+  /** Why, as a stable code. */
+  reason;
+  constructor(reason, message, options) {
+    super(message, options);
+    this.reason = reason;
+  }
+};
+var AuthioCallbackError = class extends AuthioError {
+  /** Why, as a stable code. */
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+  }
+};
+var AuthioAdminError = class extends AuthioError {
+  /** The HTTP status. */
+  status;
+  /** Authio's error code, such as `ValidationFailed` or `RealmNotFound`. */
+  errorCode;
+  /** The messages, with the field each one is about. */
+  notifications;
+  /** The request id, from the envelope or the `X-Request-Id` header. */
+  requestId;
+  /** Seconds to wait before retrying, from `Retry-After` (`429` and `503`). */
+  retryAfterSeconds;
+  constructor(details) {
+    const notifications = details.notifications ?? [];
+    const summary = notifications.map((notification) => notification.message).filter(Boolean).join(" ");
+    super(
+      `The Authio Admin API answered HTTP ${details.status}${details.errorCode ? ` (${details.errorCode})` : ""}${summary ? `: ${summary}` : "."}`,
+      { cause: details.cause }
+    );
+    this.status = details.status;
+    this.errorCode = details.errorCode;
+    this.notifications = Object.freeze([...notifications]);
+    this.requestId = details.requestId;
+    this.retryAfterSeconds = details.retryAfterSeconds;
+  }
+};
+
+// src/options.ts
+var systemClock = {
+  now: () => Date.now(),
+  sleep: (ms, signal) => new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(signal.reason);
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal?.reason);
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  })
+};
+function resolveConnection(options) {
+  const requireHttps = options.requireHttps ?? true;
+  const issuer = resolveIssuer(options);
+  for (const [name, value] of [
+    ["authority", options.authority],
+    ["issuer", issuer]
+  ]) {
+    if (value && !isAllowedUrl(value, requireHttps))
+      throw new AuthioConfigurationError(
+        `The Authio ${name} '${value}' must be an absolute HTTPS URL (http is allowed only for loopback, or with requireHttps: false).`
+      );
+  }
+  const fetchImplementation = options.fetch ?? globalThis.fetch;
+  if (typeof fetchImplementation !== "function")
+    throw new AuthioConfigurationError("No fetch implementation is available: pass options.fetch.");
+  return {
+    issuer,
+    discoveryUrl: issuer + AuthioDefaults.DiscoveryPath,
+    requireHttps,
+    discoveryCacheDurationMs: seconds(options.discoveryCacheDuration, AuthioDefaults.DiscoveryCacheDuration, "discoveryCacheDuration"),
+    httpTimeoutMs: seconds(options.httpTimeout, AuthioDefaults.HttpTimeout, "httpTimeout"),
+    fetch: fetchImplementation,
+    clock: options.clock ?? systemClock
+  };
+}
+function resolveIssuer(options) {
+  const issuer = options.issuer?.trim();
+  if (issuer) return trimTrailingSlashes(issuer);
+  const authority = options.authority?.trim();
+  const realm = options.realm?.trim();
+  if (!authority || !realm)
+    throw new AuthioConfigurationError(
+      "The Authio issuer is not set, and authority and realm are not both set to compose it."
+    );
+  return `${trimTrailingSlashes(authority)}/realms/${escapeDataString(realm)}`;
+}
+function isAllowedUrl(value, requireHttps) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url.protocol === "https:") return true;
+  return url.protocol === "http:" && (!requireHttps || isLoopback(url.hostname));
+}
+function escapeDataString(value) {
+  return encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function seconds(value, fallback, name) {
+  const resolved = value ?? fallback;
+  if (!Number.isFinite(resolved) || resolved < 0)
+    throw new AuthioConfigurationError(`The Authio option ${name} must be a non-negative number of seconds.`);
+  return resolved * 1e3;
+}
+function trimTrailingSlashes(value) {
+  return value.replace(/\/+$/, "");
+}
+function isLoopback(hostname) {
+  const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  return host === "localhost" || host === "::1" || /^127(\.\d{1,3}){3}$/.test(host);
+}
+
+// src/http.ts
+function send(connection, url, init, signal) {
+  const timeout = AbortSignal.timeout(connection.httpTimeoutMs);
+  return connection.fetch(url, { ...init, signal: signal ? AbortSignal.any([signal, timeout]) : timeout });
+}
+function formBody(parameters) {
+  const form = new URLSearchParams();
+  for (const [name, value] of Object.entries(parameters)) {
+    if (value !== void 0 && value !== null && value !== "") form.append(name, value);
+  }
+  return form;
+}
+function toScopeString(scopes) {
+  if (scopes === void 0 || scopes === null) return void 0;
+  const values = typeof scopes === "string" ? [scopes] : [...scopes];
+  const distinct = [...new Set(values.flatMap((scope) => (scope ?? "").split(" ").filter(Boolean)))];
+  return distinct.length === 0 ? void 0 : distinct.join(" ");
+}
+async function readProtocolJson(response) {
+  const body = await response.text();
+  if (!response.ok) throw toProtocolError(body, response.status);
+  return parseProtocolJson(body, response.status);
+}
+async function ensureProtocolSuccess(response) {
+  if (response.ok) return;
+  throw toProtocolError(await response.text(), response.status);
+}
+function parseProtocolJson(body, status) {
+  try {
+    const value = JSON.parse(body);
+    if (value === null || typeof value !== "object" || Array.isArray(value)) throw new SyntaxError("The body is not a JSON object.");
+    return value;
+  } catch (error) {
+    throw new AuthioProtocolError(
+      "invalid_response",
+      `Authio answered with a body that could not be read: ${error.message}`,
+      void 0,
+      status,
+      { cause: error }
+    );
+  }
+}
+function toErrorResponse(body) {
+  if (!body?.trim()) return void 0;
+  try {
+    const value = JSON.parse(body);
+    return value && typeof value === "object" && typeof value.error === "string" && value.error ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function toProtocolError(body, status) {
+  const error = toErrorResponse(body);
+  return error ? new AuthioProtocolError(error.error, error.error_description, error.error_code, status) : new AuthioProtocolError(`http_${status}`, `Authio answered HTTP ${status} without an OAuth error.`, void 0, status);
+}
+function redact(value, secrets) {
+  Object.defineProperty(value, /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom"), {
+    enumerable: false,
+    value() {
+      const copy = {};
+      for (const [name, member] of Object.entries(this))
+        copy[name] = secrets.includes(name) && member !== void 0 && member !== null ? AuthioDefaults.RedactedValue : member;
+      return copy;
+    }
+  });
+  return value;
+}
+
+// src/discovery.ts
+function createAuthioDiscoveryClient(options) {
+  const connection = isConnection(options) ? options : resolveConnection(options);
+  let cached;
+  let pending;
+  const fresh = () => cached && connection.clock.now() - cached.fetchedAt < connection.discoveryCacheDurationMs ? cached.document : void 0;
+  return {
+    connection,
+    async get(signal) {
+      const current = fresh();
+      if (current) return current;
+      pending ??= fetchDocument(connection, signal).then((document) => {
+        cached = { document, fetchedAt: connection.clock.now() };
+        return document;
+      }).finally(() => {
+        pending = void 0;
+      });
+      return pending;
+    },
+    invalidate() {
+      cached = void 0;
+    }
+  };
+}
+function requireEndpoint(document, member) {
+  const value = document[member];
+  if (typeof value !== "string" || !value)
+    throw new AuthioDiscoveryError(`The Authio discovery document has no ${member}.`);
+  return value;
+}
+async function fetchDocument(connection, signal) {
+  const url = connection.discoveryUrl;
+  let body;
+  try {
+    const response = await send(connection, url, { method: "GET", headers: { accept: "application/json" } }, signal);
+    body = await response.text();
+    if (!response.ok) throw new AuthioDiscoveryError(`Authio answered HTTP ${response.status} for the discovery document at ${url}.`);
+  } catch (error) {
+    if (error instanceof AuthioDiscoveryError) throw error;
+    if (signal?.aborted) throw error;
+    const timedOut = error?.name === "TimeoutError";
+    throw new AuthioDiscoveryError(
+      timedOut ? `Reading the Authio discovery document at ${url} timed out.` : `The Authio discovery document at ${url} could not be read.`,
+      { cause: error }
+    );
+  }
+  let document;
+  try {
+    document = JSON.parse(body);
+  } catch (error) {
+    throw new AuthioDiscoveryError(`The Authio discovery document at ${url} is not valid JSON.`, { cause: error });
+  }
+  if (!document || typeof document !== "object" || typeof document.issuer !== "string" || !document.issuer.trim())
+    throw new AuthioDiscoveryError(`The Authio discovery document at ${url} has no issuer.`);
+  if (document.issuer.replace(/\/+$/, "") !== connection.issuer)
+    throw new AuthioDiscoveryError(
+      `The Authio discovery document names the issuer '${document.issuer}', not the configured '${connection.issuer}'.`
+    );
+  return document;
+}
+function isConnection(value) {
+  return typeof value.discoveryUrl === "string" && typeof value.httpTimeoutMs === "number";
+}
+var curveAlgorithms = { "P-256": "ES256", "P-384": "ES384", "P-521": "ES512" };
+async function importSigningKey(input, algorithm, keyId, source) {
+  if (typeof input === "string") {
+    const text = input.trim();
+    if (text.startsWith("{")) return importSigningKey(parseJwk(text, source), algorithm, keyId, source);
+    return importPem(text, algorithm, keyId, source);
+  }
+  if (isCryptoKey(input)) {
+    const shape = describeCryptoKey(input, source);
+    return { key: input, algorithm: settleAlgorithm(shape, algorithm, source), keyId };
+  }
+  return importFromJwk(input, algorithm, keyId ?? (typeof input.kid === "string" ? input.kid : void 0), source);
+}
+var AuthioClientAssertionAlgorithms = AuthioAsymmetricAlgorithms;
+async function importPem(pem, algorithm, keyId, source) {
+  const nodeCrypto = await loadNodeCrypto();
+  if (nodeCrypto) {
+    let keyObject;
+    try {
+      keyObject = nodeCrypto.createPrivateKey({ key: pem, format: "pem" });
+    } catch (error) {
+      throw new AuthioConfigurationError(`${source} could not be read as an RSA or EC private key.`, { cause: error });
+    }
+    const jwk = keyObject.export({ format: "jwk" });
+    return importFromJwk(jwk, algorithm, keyId, source);
+  }
+  if (!pem.includes("-----BEGIN PRIVATE KEY-----"))
+    throw new AuthioConfigurationError(
+      `${source} must be a PKCS#8 PEM ("BEGIN PRIVATE KEY") or a JWK outside Node; PKCS#1 and SEC1 keys need Node.`
+    );
+  const chosen = algorithm?.trim() || "RS256";
+  try {
+    return { key: await importPKCS8(pem, chosen), algorithm: chosen, keyId };
+  } catch (error) {
+    throw new AuthioConfigurationError(`${source} could not be imported for ${chosen}.`, { cause: error });
+  }
+}
+async function importFromJwk(jwk, algorithm, keyId, source) {
+  if (!jwk.d) throw new AuthioConfigurationError(`${source} is a public key; Authio needs the private key to sign.`);
+  const shape = describeJwk(jwk, source);
+  const chosen = settleAlgorithm(shape, algorithm ?? (typeof jwk.alg === "string" ? jwk.alg : void 0), source);
+  try {
+    const key = await importJWK({ ...jwk, alg: chosen }, chosen);
+    return { key, algorithm: chosen, keyId };
+  } catch (error) {
+    throw new AuthioConfigurationError(`${source} could not be imported for ${chosen}.`, { cause: error });
+  }
+}
+function describeJwk(jwk, source) {
+  if (jwk.kty === "RSA") {
+    const bits = base64UrlLength(jwk.n ?? "") * 8;
+    if (bits < AuthioDefaults.MinimumRsaKeySize)
+      throw new AuthioConfigurationError(`${source} is a ${bits}-bit RSA key; use at least ${AuthioDefaults.MinimumRsaKeySize} bits.`);
+    return { type: "RSA" };
+  }
+  if (jwk.kty === "EC") {
+    if (!jwk.crv || !curveAlgorithms[jwk.crv])
+      throw new AuthioConfigurationError(`${source} is an EC key on a curve Authio does not accept; use P-256, P-384 or P-521.`);
+    return { type: "EC", curve: jwk.crv };
+  }
+  throw new AuthioConfigurationError(`${source} could not be read as an RSA or EC private key.`);
+}
+function describeCryptoKey(key, source) {
+  const algorithm = key.algorithm;
+  if (algorithm.name === "ECDSA" && algorithm.namedCurve && curveAlgorithms[algorithm.namedCurve])
+    return { type: "EC", curve: algorithm.namedCurve };
+  if (algorithm.name === "RSASSA-PKCS1-v1_5" || algorithm.name === "RSA-PSS") {
+    if ((algorithm.modulusLength ?? 0) < AuthioDefaults.MinimumRsaKeySize)
+      throw new AuthioConfigurationError(
+        `${source} is a ${algorithm.modulusLength}-bit RSA key; use at least ${AuthioDefaults.MinimumRsaKeySize} bits.`
+      );
+    const size = algorithm.hash?.name.replace("SHA-", "") ?? "256";
+    return { type: "RSA", fixedAlgorithm: `${algorithm.name === "RSA-PSS" ? "PS" : "RS"}${size}` };
+  }
+  throw new AuthioConfigurationError(`${source} is a CryptoKey Authio cannot sign assertions with; use an RSA or EC signing key.`);
+}
+function settleAlgorithm(shape, configured, source) {
+  const suited = shape.fixedAlgorithm !== void 0 ? [shape.fixedAlgorithm] : shape.type === "EC" ? [curveAlgorithms[shape.curve]] : AuthioAsymmetricAlgorithms.filter((name) => name.startsWith("RS") || name.startsWith("PS"));
+  const chosen = configured?.trim() || suited[0];
+  if (!suited.includes(chosen))
+    throw new AuthioConfigurationError(
+      `The signing algorithm '${chosen}' does not suit the key in ${source}; use one of: ${suited.join(", ")}.`
+    );
+  return chosen;
+}
+function parseJwk(text, source) {
+  try {
+    const parsed = JSON.parse(text);
+    if (Array.isArray(parsed.keys)) {
+      if (parsed.keys.length !== 1) throw new Error("A JWK Set must hold exactly one key.");
+      return parsed.keys[0];
+    }
+    return parsed;
+  } catch (error) {
+    throw new AuthioConfigurationError(`${source} is not a valid JWK.`, { cause: error });
+  }
+}
+function base64UrlLength(value) {
+  const clean = value.replace(/=+$/, "");
+  return Math.floor(clean.length * 3 / 4);
+}
+function isCryptoKey(value) {
+  return typeof value === "object" && value !== null && "algorithm" in value && "type" in value && "usages" in value;
+}
+var nodeCryptoModule;
+function loadNodeCrypto() {
+  nodeCryptoModule ??= globalThis.process?.versions?.node ? import('crypto').catch(() => void 0) : Promise.resolve(void 0);
+  return nodeCryptoModule;
+}
+
+// src/client-authentication.ts
+function toBasicAuthorization(clientId, clientSecret) {
+  const bytes = new TextEncoder().encode(`${escapeDataString(clientId)}:${escapeDataString(clientSecret)}`);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return `Basic ${btoa(binary)}`;
+}
+function createClientAuthenticator(settings, connection) {
+  const clientId = settings.clientId?.trim();
+  if (!clientId) throw new AuthioConfigurationError("The Authio clientId is required.");
+  const hasKey = settings.clientPrivateKey !== void 0 || !!settings.clientPrivateKeyPath;
+  const method = settings.clientAuthentication ?? (!settings.clientSecret && hasKey ? "private_key_jwt" : "client_secret_basic");
+  if ((method === "client_secret_basic" || method === "client_secret_post") && !settings.clientSecret)
+    throw new AuthioConfigurationError(`The Authio clientSecret is required with ${method}.`);
+  if (method === "private_key_jwt" && !hasKey)
+    throw new AuthioConfigurationError("private_key_jwt needs clientPrivateKey or clientPrivateKeyPath.");
+  const lifetimeMs = seconds(settings.clientAssertionLifetime, AuthioDefaults.ClientAssertionLifetime, "clientAssertionLifetime");
+  if (lifetimeMs <= 0 || lifetimeMs > AuthioDefaults.MaxClientAssertionLifetime * 1e3)
+    throw new AuthioConfigurationError(
+      `The Authio clientAssertionLifetime must be more than 0 and at most ${AuthioDefaults.MaxClientAssertionLifetime} seconds.`
+    );
+  const loadKey = method === "private_key_jwt" ? createKeyLoader(settings) : void 0;
+  const secret = async () => {
+    const value = typeof settings.clientSecret === "function" ? await settings.clientSecret() : settings.clientSecret;
+    if (typeof value !== "string" || !value) throw new AuthioConfigurationError("The Authio clientSecret function returned no secret.");
+    return value;
+  };
+  return {
+    clientId,
+    method,
+    async apply(form, headers) {
+      switch (method) {
+        case "client_secret_basic":
+          headers.set("authorization", toBasicAuthorization(clientId, await secret()));
+          return;
+        case "client_secret_post":
+          form.set("client_id", clientId);
+          form.set("client_secret", await secret());
+          return;
+        case "private_key_jwt":
+          form.set("client_id", clientId);
+          form.set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+          form.set("client_assertion", await buildAssertion(clientId, connection, lifetimeMs, await loadKey()));
+          return;
+        default:
+          form.set("client_id", clientId);
+      }
+    }
+  };
+}
+async function buildAssertion(clientId, connection, lifetimeMs, signing) {
+  const now = Math.floor(connection.clock.now() / 1e3);
+  const jti = [...crypto.getRandomValues(new Uint8Array(16))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  return new SignJWT({ jti }).setProtectedHeader({ alg: signing.algorithm, typ: "JWT", ...signing.keyId ? { kid: signing.keyId } : {} }).setIssuer(clientId).setSubject(clientId).setAudience(connection.issuer).setIssuedAt(now).setNotBefore(now).setExpirationTime(now + Math.floor(lifetimeMs / 1e3)).sign(signing.key);
+}
+function createKeyLoader(settings) {
+  if (settings.clientPrivateKey !== void 0) {
+    let loaded;
+    return () => {
+      loaded ??= importSigningKey(settings.clientPrivateKey, settings.clientSigningAlgorithm, settings.clientKeyId, "clientPrivateKey");
+      loaded.catch(() => {
+        loaded = void 0;
+      });
+      return loaded;
+    };
+  }
+  const path = settings.clientPrivateKeyPath;
+  let current;
+  return async () => {
+    const nodeCrypto = await loadNodeCrypto();
+    if (!nodeCrypto) throw new AuthioConfigurationError("clientPrivateKeyPath needs Node; pass clientPrivateKey instead.");
+    const { readFile, stat } = await import('fs/promises');
+    let written;
+    try {
+      written = (await stat(path)).mtimeMs;
+    } catch (error) {
+      throw new AuthioConfigurationError(`clientPrivateKeyPath '${path}' could not be read.`, { cause: error });
+    }
+    if (!current || current.written !== written) {
+      const key = readFile(path, "utf8").then(
+        (pem) => importSigningKey(pem, settings.clientSigningAlgorithm, settings.clientKeyId, `clientPrivateKeyPath '${path}'`)
+      );
+      current = { written, key };
+      key.catch(() => {
+        if (current?.key === key) current = void 0;
+      });
+    }
+    return current.key;
+  };
+}
+var AuthioKeyManagementAlgorithms = ["RSA-OAEP", "RSA-OAEP-256"];
+var AuthioLegacyKeyManagementAlgorithms = ["RSA1_5"];
+var AuthioContentEncryptionAlgorithms = ["A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512"];
+var rsaAlgorithmIdentifier = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
+function isAuthioTokenEncrypted(token) {
+  return typeof token === "string" && token.split(".").length === 5;
+}
+function createAuthioTokenDecrypter(key, options = {}) {
+  const settings = typeof options === "string" ? { setting: options } : options;
+  const setting = settings.setting ?? "clientEncryptionKey";
+  const imported = /* @__PURE__ */ new Map();
+  const importFor = (algorithm) => {
+    let pending = imported.get(algorithm);
+    if (!pending) {
+      pending = Promise.resolve(typeof key === "function" ? key() : key).then((value) => importDecryptionKey(value, algorithm, setting));
+      imported.set(algorithm, pending);
+      pending.catch(() => imported.delete(algorithm));
+    }
+    return pending;
+  };
+  return async (token) => {
+    if (!isAuthioTokenEncrypted(token)) return token;
+    const algorithm = algorithmOf(token);
+    if (AuthioLegacyKeyManagementAlgorithms.includes(algorithm))
+      throw new AuthioTokenValidationError(
+        "legacy_algorithm",
+        settings.allowLegacyEncryptionAlgorithms ? "The token is encrypted with RSA1_5 (PKCS#1 v1.5), which Node and WebCrypto cannot decrypt even with allowLegacyEncryptionAlgorithms; register RSA-OAEP-256 as the client's encryption algorithm in Authio." : "The token is encrypted with the legacy RSA1_5 algorithm, which is refused; register RSA-OAEP-256 as the client's encryption algorithm in Authio."
+      );
+    if (!AuthioKeyManagementAlgorithms.includes(algorithm))
+      throw new AuthioTokenValidationError(
+        "decryption_failed",
+        `The token is encrypted with '${algorithm}'; Authio encrypts with ${AuthioKeyManagementAlgorithms.join(" or ")}.`
+      );
+    if (key === void 0 || key === null || key === "")
+      throw new AuthioTokenValidationError(
+        "decryption_failed",
+        `Authio encrypted this token to the client's own key; set ${setting} to the private key Authio showed when it generated the pair.`
+      );
+    try {
+      const { plaintext } = await compactDecrypt(token, (header) => importFor(header.alg), {
+        keyManagementAlgorithms: [...AuthioKeyManagementAlgorithms],
+        contentEncryptionAlgorithms: [...AuthioContentEncryptionAlgorithms]
+      });
+      return new TextDecoder().decode(plaintext);
+    } catch (error) {
+      if (error instanceof AuthioConfigurationError) throw error;
+      if (error instanceof errors.JOSEError)
+        throw new AuthioTokenValidationError("decryption_failed", `The token could not be decrypted with ${setting}: ${error.message}`, { cause: error });
+      throw error;
+    }
+  };
+}
+function encryptionKeyFromFile(path, setting = "clientEncryptionKeyPath") {
+  let current;
+  return async () => {
+    const nodeCrypto = await loadNodeCrypto();
+    if (!nodeCrypto) throw new AuthioConfigurationError(`${setting} needs Node; pass clientEncryptionKey instead.`);
+    const { readFile, stat } = await import('fs/promises');
+    let written;
+    try {
+      written = (await stat(path)).mtimeMs;
+    } catch (error) {
+      throw new AuthioConfigurationError(`${setting} '${path}' could not be read.`, { cause: error });
+    }
+    if (!current || current.written !== written) current = { written, key: readFile(path, "utf8") };
+    return current.key;
+  };
+}
+function algorithmOf(token) {
+  try {
+    return String(decodeProtectedHeader(token).alg ?? "");
+  } catch (error) {
+    throw new AuthioTokenValidationError("decryption_failed", "The encrypted token's header could not be read.", { cause: error });
+  }
+}
+async function importDecryptionKey(key, algorithm, setting) {
+  try {
+    if (typeof key !== "string") return await importPrivateJwk(key, algorithm, setting);
+    const text = key.trim();
+    return text.startsWith("{") ? await importPrivateJwk(JSON.parse(text), algorithm, setting) : await importPKCS8(toPkcs8(text), algorithm);
+  } catch (error) {
+    if (error instanceof AuthioConfigurationError) throw error;
+    throw new AuthioConfigurationError(`${setting} is neither a private JWK nor a PEM private key.`, { cause: error });
+  }
+}
+function importPrivateJwk(jwk, algorithm, setting) {
+  if (!jwk.d) throw new AuthioConfigurationError(`${setting} is a JWK without its private parameters; only the private key decrypts.`);
+  return importJWK({ ...jwk, alg: algorithm, use: "enc", key_ops: void 0 }, algorithm);
+}
+function toPkcs8(pem) {
+  const normalized = pem.replace(/\\n/g, "\n").trim();
+  if (!normalized.includes("BEGIN RSA PRIVATE KEY")) return normalized;
+  const pkcs1 = fromBase64(normalized.replace(/-----[^-]+-----|\s/g, ""));
+  const body = [2, 1, 0, ...rsaAlgorithmIdentifier, 4, ...derLength(pkcs1.length), ...pkcs1];
+  const der = Uint8Array.from([48, ...derLength(body.length), ...body]);
+  const lines = toBase64(der).match(/.{1,64}/g) ?? [];
+  return `-----BEGIN PRIVATE KEY-----
+${lines.join("\n")}
+-----END PRIVATE KEY-----`;
+}
+function derLength(length) {
+  if (length < 128) return [length];
+  const bytes = [];
+  for (let rest = length; rest > 0; rest >>= 8) bytes.unshift(rest & 255);
+  return [128 | bytes.length, ...bytes];
+}
+function fromBase64(text) {
+  return Uint8Array.from(atob(text), (character) => character.charCodeAt(0));
+}
+function toBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+function createAuthioSigningKeys(connection, discovery) {
+  let keys;
+  return async (signal) => {
+    const document = await discovery.get(signal);
+    const uri = document.jwks_uri;
+    if (!uri) throw new AuthioError("The Authio discovery document has no jwks_uri.");
+    if (!keys || keys.uri !== uri)
+      keys = { uri, set: createRemoteJWKSet(new URL(uri), { [customFetch]: connection.fetch, timeoutDuration: connection.httpTimeoutMs }) };
+    return keys.set;
+  };
+}
+async function verifyAuthioJwt(token, keys, expected) {
+  if (!looksLikeJws(token))
+    throw new AuthioTokenValidationError("reference_token", "The token is not a JWT; only introspection can resolve it ('introspectionOnly').");
+  try {
+    const { payload, protectedHeader } = await jwtVerify(token, keys, {
+      issuer: expected.issuer,
+      audience: [...expected.audiences],
+      algorithms: [...expected.algorithms && expected.algorithms.length > 0 ? expected.algorithms : AuthioAsymmetricAlgorithms],
+      clockTolerance: expected.clockSkew ?? AuthioDefaults.ClockSkew,
+      requiredClaims: [.../* @__PURE__ */ new Set(["exp", ...expected.requiredClaims ?? []])],
+      currentDate: new Date(expected.now)
+    });
+    return { payload, header: protectedHeader };
+  } catch (error) {
+    throw toTokenValidationError(error, expected.audiences, token);
+  }
+}
+function toTokenValidationError(error, audiences, token) {
+  if (error instanceof AuthioTokenValidationError) return error;
+  const refuse = (reason, message) => new AuthioTokenValidationError(reason, message, { cause: error });
+  if (error instanceof errors.JWTExpired) {
+    const exp = error.payload.exp;
+    return refuse("expired", typeof exp === "number" ? `The token expired at '${new Date(exp * 1e3).toISOString()}'` : "The token has expired");
+  }
+  if (error instanceof errors.JWTClaimValidationFailed) {
+    switch (error.claim) {
+      case "aud":
+        return refuse("invalid_audience", describeAudience([error.payload.aud ?? []].flat(), audiences));
+      case "iss":
+        return refuse("invalid_issuer", `The issuer '${error.payload.iss ?? ""}' is invalid`);
+      case "nbf":
+        return refuse(
+          "not_yet_valid",
+          typeof error.payload.nbf === "number" ? `The token is not valid before '${new Date(error.payload.nbf * 1e3).toISOString()}'` : "The token is not valid yet"
+        );
+      case "exp":
+        return refuse("expired", "The token has no expiration");
+      default:
+        return refuse("malformed", `The token's ${error.claim} claim is invalid`);
+    }
+  }
+  if (error instanceof errors.JWSSignatureVerificationFailed) return refuse("invalid_signature", "The signature is invalid");
+  if (error instanceof errors.JWKSNoMatchingKey || error instanceof errors.JWKSMultipleMatchingKeys)
+    return refuse("invalid_signature", "The signature key was not found");
+  if (error instanceof errors.JOSEAlgNotAllowed) return refuse("invalid_algorithm", `The algorithm '${algorithmOf2(token)}' is not available`);
+  if (error instanceof errors.JWKSTimeout || error instanceof errors.JWKSInvalid)
+    return refuse("signing_keys_unavailable", "Authio could not be reached to read its signing keys.");
+  if (error instanceof errors.JWTInvalid || error instanceof errors.JWSInvalid) return refuse("malformed", "The token is malformed");
+  if (error instanceof errors.JOSEError) return refuse("malformed", error.message);
+  return refuse("signing_keys_unavailable", "Authio could not be reached to read its signing keys.");
+}
+async function computeAuthioTokenHash(value, algorithm) {
+  const size = /(\d{3})$/.exec(algorithm)?.[1];
+  const hash = size === "384" ? "SHA-384" : size === "512" ? "SHA-512" : "SHA-256";
+  const digest = new Uint8Array(await crypto.subtle.digest(hash, new TextEncoder().encode(value)));
+  return toBase64Url(digest.subarray(0, digest.length / 2));
+}
+async function validateAuthioIdToken(token, context, expectations = {}) {
+  const signed = isAuthioTokenEncrypted(token) ? await context.decrypt(token) : token;
+  const { payload, header } = await verifyAuthioJwt(signed, context.keys, {
+    issuer: context.issuer,
+    audiences: [context.clientId],
+    algorithms: context.algorithms,
+    clockSkew: context.clockSkew,
+    now: context.now,
+    requiredClaims: ["sub", "iat"]
+  });
+  const type = typeof payload.typ === "string" ? payload.typ : void 0;
+  if (type !== void 0 && type.toLowerCase() !== "id")
+    throw new AuthioTokenValidationError("not_id_token", `Only ID tokens are accepted; this token's typ is '${type}'.`);
+  const audiences = [payload.aud ?? []].flat();
+  if (audiences.length > 1 && payload.azp !== context.clientId)
+    throw new AuthioTokenValidationError("invalid_audience", `The ID token has several audiences and its azp is not '${context.clientId}'.`);
+  if (expectations.nonce !== void 0 && payload[AuthioClaimTypes.Nonce] !== expectations.nonce)
+    throw new AuthioTokenValidationError(
+      "invalid_nonce",
+      payload[AuthioClaimTypes.Nonce] === void 0 ? "The ID token carries no nonce, although one was sent." : "The ID token's nonce is not the one sent."
+    );
+  const atHash = payload[AuthioClaimTypes.AccessTokenHash];
+  if (expectations.accessToken !== void 0 && typeof atHash === "string") {
+    const expected = await computeAuthioTokenHash(expectations.accessToken, String(header.alg ?? ""));
+    if (expected !== atHash) throw new AuthioTokenValidationError("invalid_at_hash", "The ID token's at_hash does not match the access token.");
+  }
+  if (expectations.maxAge !== void 0) {
+    const authTime = payload[AuthioClaimTypes.AuthTime];
+    const skew = context.clockSkew ?? AuthioDefaults.ClockSkew;
+    if (typeof authTime !== "number")
+      throw new AuthioTokenValidationError("authentication_too_old", "max_age was requested, and the ID token carries no auth_time.");
+    if ((authTime + expectations.maxAge + skew) * 1e3 < context.now)
+      throw new AuthioTokenValidationError(
+        "authentication_too_old",
+        `The person signed in at '${new Date(authTime * 1e3).toISOString()}', more than ${expectations.maxAge} seconds ago.`
+      );
+  }
+  return payload;
+}
+async function validateAuthioLogoutToken(token, context) {
+  const signed = isAuthioTokenEncrypted(token) ? await context.decrypt(token) : token;
+  const invalid = (message) => new AuthioTokenValidationError("invalid_logout_token", message);
+  let headerType;
+  try {
+    const header = decodeProtectedHeader(signed);
+    headerType = typeof header.typ === "string" ? header.typ.toLowerCase() : void 0;
+  } catch (error) {
+    throw new AuthioTokenValidationError("malformed", "The logout token is malformed", { cause: error });
+  }
+  const { payload } = await verifyAuthioJwt(signed, context.keys, {
+    issuer: context.issuer,
+    audiences: [context.clientId],
+    algorithms: context.algorithms,
+    clockSkew: context.clockSkew,
+    now: context.now,
+    requiredClaims: ["iat"]
+  });
+  if (headerType !== AuthioDefaults.LogoutTokenType && headerType !== `application/${AuthioDefaults.LogoutTokenType}`)
+    throw invalid(`The token's header typ is '${headerType ?? ""}', not '${AuthioDefaults.LogoutTokenType}'.`);
+  const events = payload[AuthioClaimTypes.Events];
+  if (!events || typeof events !== "object" || Array.isArray(events) || typeof events[AuthioDefaults.BackchannelLogoutEvent] !== "object")
+    throw invalid("The token carries no back-channel logout event.");
+  if (payload[AuthioClaimTypes.Nonce] !== void 0) throw invalid("A logout token must not carry a nonce.");
+  const subject = typeof payload.sub === "string" && payload.sub ? payload.sub : void 0;
+  const sessionId = typeof payload.sid === "string" && payload.sid ? payload.sid : void 0;
+  if (!subject && !sessionId) throw invalid("The logout token names neither a subject nor a session.");
+  return Object.freeze({ subject, sessionId, tokenId: typeof payload.jti === "string" ? payload.jti : void 0, claims: Object.freeze({ ...payload }) });
+}
+function describeAudience(tokenAudiences, audiences) {
+  const known = tokenAudiences.length === 0 ? "" : ` ${tokenAudiences.map((audience) => `'${audience}'`).join(" and ")}`;
+  const accepted = audiences.map((audience) => `'${audience}'`).join(" or ");
+  return audiences.length === 1 ? `The token is not addressed to this API: its audience${known} is not ${accepted}. Request the token for that resource (RFC 8707).` : `The token is not addressed to this API: its audience${known} is not ${accepted}. Request the token for one of those resources (RFC 8707).`;
+}
+function looksLikeJws(token) {
+  const parts = token.split(".");
+  return parts.length === 3 && parts[0].length > 0;
+}
+function algorithmOf2(token) {
+  try {
+    return String(decodeProtectedHeader(token).alg ?? "");
+  } catch {
+    return "";
+  }
+}
+function toBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+// src/authorization.ts
+async function createAuthioPkce(method = "S256") {
+  if (method !== "S256" && method !== "plain") throw new TypeError(`The PKCE method '${String(method)}' is not S256 or plain.`);
+  const codeVerifier = randomValue(32);
+  const codeChallenge = method === "plain" ? codeVerifier : toBase64Url2(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier))));
+  return { codeVerifier, codeChallenge, codeChallengeMethod: method };
+}
+function randomValue(bytes = 32) {
+  return toBase64Url2(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+async function buildAuthorizationUrl(endpoint, clientId, request) {
+  const pkce = await createAuthioPkce(request.codeChallengeMethod ?? "S256");
+  const state = request.state?.trim() || randomValue();
+  const nonce = request.nonce?.trim() || randomValue();
+  if (request.maxAge !== void 0 && (!Number.isInteger(request.maxAge) || request.maxAge < 0))
+    throw new RangeError("maxAge must be a non-negative whole number of seconds.");
+  const display = request.popup ? "popup" : request.display;
+  const responseMode = request.popup ? "web_message" : request.responseMode;
+  const url = new URL(endpoint);
+  const parameters = {
+    ...request.extraParameters,
+    response_type: "code",
+    client_id: clientId,
+    redirect_uri: request.redirectUri,
+    scope: toScopeString(request.scopes) ?? "openid",
+    state,
+    nonce,
+    code_challenge: pkce.codeChallenge,
+    code_challenge_method: pkce.codeChallengeMethod,
+    resource: request.resource,
+    organization: request.organization,
+    prompt: joined(request.prompt),
+    max_age: request.maxAge?.toString(),
+    acr_values: joined(request.acrValues),
+    login_hint: request.loginHint,
+    id_token_hint: request.idTokenHint,
+    ui_locales: joined(request.uiLocales),
+    display,
+    response_mode: responseMode,
+    idp_hint: request.idpHint
+  };
+  for (const [name, value] of Object.entries(parameters)) if (value !== void 0 && value !== "") url.searchParams.set(name, value);
+  return {
+    url: url.toString(),
+    transaction: Object.freeze({
+      state,
+      nonce,
+      codeVerifier: pkce.codeVerifier,
+      codeChallengeMethod: pkce.codeChallengeMethod,
+      redirectUri: request.redirectUri,
+      ...request.resource ? { resource: request.resource } : {},
+      ...request.maxAge !== void 0 ? { maxAge: request.maxAge } : {}
+    })
+  };
+}
+function readCallbackParameters(callback) {
+  if (callback instanceof URLSearchParams) return Object.fromEntries(callback);
+  if (callback instanceof URL) return Object.fromEntries(callback.searchParams);
+  if (typeof callback === "string") {
+    const text = callback.trim();
+    const query = /^[a-z][a-z0-9+.-]*:/i.test(text) ? new URL(text).search : text.slice(text.indexOf("?") + 1);
+    return Object.fromEntries(new URLSearchParams(query));
+  }
+  const parameters = {};
+  for (const [name, value] of Object.entries(callback ?? {})) {
+    const first = Array.isArray(value) ? value[0] : value;
+    if (typeof first === "string") parameters[name] = first;
+  }
+  return parameters;
+}
+function parseAuthioBearerChallenge(header) {
+  if (!header || !/^\s*bearer(\s|$)/i.test(header)) return void 0;
+  const values = {};
+  for (const match of header.matchAll(/([a-zA-Z_]+)\s*=\s*"((?:[^"\\]|\\.)*)"|([a-zA-Z_]+)\s*=\s*([^,\s]+)/g)) {
+    const name = (match[1] ?? match[3] ?? "").toLowerCase();
+    values[name] ??= (match[2] ?? match[4] ?? "").replace(/\\(.)/g, "$1");
+  }
+  const maxAge = values.max_age !== void 0 && /^\d+$/.test(values.max_age) ? Number(values.max_age) : void 0;
+  return {
+    error: values.error,
+    errorDescription: values.error_description,
+    scope: values.scope,
+    acrValues: values.acr_values,
+    maxAge,
+    resourceMetadata: values.resource_metadata
+  };
+}
+function joined(value) {
+  if (value === void 0) return void 0;
+  const text = (typeof value === "string" ? [value] : [...value]).map((item) => item.trim()).filter(Boolean).join(" ");
+  return text || void 0;
+}
+function toBase64Url2(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+// src/client.ts
+function createAuthioClient(options) {
+  const connection = resolveConnection(options);
+  const discovery = createAuthioDiscoveryClient(connection);
+  const authenticator = createClientAuthenticator(options, connection);
+  const refreshSkewMs = seconds(options.tokenRefreshSkew, AuthioDefaults.TokenRefreshSkew, "tokenRefreshSkew");
+  const clockSkew = seconds(options.clockSkew, AuthioDefaults.ClockSkew, "clockSkew") / 1e3;
+  const decrypt = createAuthioTokenDecrypter(resolveEncryptionKey(options), {
+    setting: options.clientEncryptionKey === void 0 && options.clientEncryptionKeyPath ? "clientEncryptionKeyPath" : "clientEncryptionKey",
+    allowLegacyEncryptionAlgorithms: options.allowLegacyEncryptionAlgorithms
+  });
+  const signingKeys = createAuthioSigningKeys(connection, discovery);
+  const tokens = createTokenClient(connection, discovery, authenticator);
+  const clientCredentials = createClientCredentialsCache(connection, authenticator.clientId, tokens, refreshSkewMs);
+  const validationContext = async (signal) => ({
+    keys: await signingKeys(signal),
+    decrypt,
+    issuer: connection.issuer,
+    clientId: authenticator.clientId,
+    algorithms: options.validAlgorithms,
+    clockSkew,
+    now: connection.clock.now()
+  });
+  const validateIdToken = async (idToken, expectations = {}) => {
+    requireValue(idToken, "idToken");
+    return validateAuthioIdToken(idToken, await validationContext(expectations.signal), expectations);
+  };
+  const createAuthorizationUrl = async (request = {}) => {
+    const redirectUri = request.redirectUri ?? options.redirectUri;
+    requireValue(redirectUri, "redirectUri");
+    const document = await discovery.get(request.signal);
+    return buildAuthorizationUrl(requireEndpoint(document, "authorization_endpoint"), authenticator.clientId, { ...request, redirectUri });
+  };
+  return {
+    issuer: connection.issuer,
+    clientId: authenticator.clientId,
+    connection,
+    discovery,
+    tokens,
+    clientCredentials,
+    async introspect(token, callOptions = {}) {
+      requireValue(token, "token");
+      const response = await postForm(
+        connection,
+        discovery,
+        authenticator,
+        "introspection_endpoint",
+        { token, token_type_hint: callOptions.tokenTypeHint },
+        callOptions.signal
+      );
+      return readProtocolJson(response);
+    },
+    async revoke(token, callOptions = {}) {
+      requireValue(token, "token");
+      const response = await postForm(
+        connection,
+        discovery,
+        authenticator,
+        "revocation_endpoint",
+        { token, token_type_hint: callOptions.tokenTypeHint },
+        callOptions.signal
+      );
+      await ensureProtocolSuccess(response);
+    },
+    async userInfo(accessToken, callOptions = {}) {
+      requireValue(accessToken, "accessToken");
+      const document = await discovery.get(callOptions.signal);
+      const response = await send(
+        connection,
+        requireEndpoint(document, "userinfo_endpoint"),
+        { method: "GET", headers: { authorization: `Bearer ${accessToken}`, accept: "application/json, application/jwt" } },
+        callOptions.signal
+      );
+      const mediaType = response.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase();
+      if (response.ok && mediaType === "application/jwt")
+        return readUserInfoJwt((await response.text()).trim(), document, connection, authenticator.clientId, decrypt, signingKeys, {
+          algorithms: options.validAlgorithms,
+          clockSkew,
+          status: response.status,
+          signal: callOptions.signal
+        });
+      if (!response.ok) {
+        const body = await response.text();
+        const challenge = toErrorResponse(body) ? void 0 : readBearerChallenge(response);
+        throw challenge ? new AuthioProtocolError(challenge.error, challenge.description, void 0, response.status) : toProtocolError(body, response.status);
+      }
+      return readProtocolJson(response);
+    },
+    createAuthorizationUrl,
+    async handleAuthorizationCallback(callback, transaction, callOptions = {}) {
+      if (!transaction?.state || !transaction.redirectUri) throw new TypeError("transaction is required: keep what createAuthorizationUrl returned.");
+      const parameters = readCallbackParameters(callback);
+      if (parameters.state !== transaction.state)
+        throw new AuthioCallbackError("state_mismatch", "The callback's state is not the one this sign-in was started with.");
+      const document = await discovery.get(callOptions.signal);
+      if (parameters.iss !== void 0) {
+        if (parameters.iss.replace(/\/+$/, "") !== connection.issuer)
+          throw new AuthioCallbackError("issuer_mismatch", `The callback comes from the issuer '${parameters.iss}', not '${connection.issuer}' (RFC 9207).`);
+      } else if (document.authorization_response_iss_parameter_supported === true) {
+        throw new AuthioCallbackError("missing_issuer", "The callback carries no iss parameter, although Authio sends one (RFC 9207).");
+      }
+      if (parameters.error) throw new AuthioProtocolError(parameters.error, parameters.error_description, parameters.error_code);
+      if (!parameters.code) throw new AuthioCallbackError("missing_code", "The callback carries neither a code nor an error.");
+      const answer = await tokens.authorizationCode({
+        code: parameters.code,
+        redirectUri: transaction.redirectUri,
+        codeVerifier: transaction.codeVerifier,
+        resource: transaction.resource,
+        signal: callOptions.signal
+      });
+      const idToken = answer.id_token ? await validateIdToken(answer.id_token, {
+        nonce: transaction.nonce,
+        accessToken: answer.access_token,
+        maxAge: transaction.maxAge,
+        signal: callOptions.signal
+      }) : void 0;
+      return { tokens: answer, idToken };
+    },
+    validateIdToken,
+    async validateLogoutToken(logoutToken, callOptions = {}) {
+      requireValue(logoutToken, "logoutToken");
+      return validateAuthioLogoutToken(logoutToken, await validationContext(callOptions.signal));
+    },
+    async createEndSessionUrl(request = {}) {
+      const document = await discovery.get(request.signal);
+      const url = new URL(requireEndpoint(document, "end_session_endpoint"));
+      const locales = request.uiLocales === void 0 ? void 0 : (typeof request.uiLocales === "string" ? [request.uiLocales] : [...request.uiLocales]).join(" ");
+      const parameters = {
+        id_token_hint: request.idTokenHint,
+        post_logout_redirect_uri: request.postLogoutRedirectUri ?? options.postLogoutRedirectUri,
+        state: request.state,
+        ui_locales: locales,
+        client_id: request.includeClientId === false ? void 0 : authenticator.clientId
+      };
+      for (const [name, value] of Object.entries(parameters)) if (value) url.searchParams.set(name, value);
+      return url.toString();
+    },
+    async createStepUpAuthorizationUrl(challenge, request = {}) {
+      const parsed = typeof challenge === "string" ? parseAuthioBearerChallenge(challenge) : challenge;
+      if (!parsed || parsed.error !== AuthioOAuthErrors.InsufficientUserAuthentication)
+        throw new TypeError("The challenge is not an insufficient_user_authentication bearer challenge.");
+      return createAuthorizationUrl({
+        ...request,
+        acrValues: request.acrValues ?? parsed.acrValues,
+        maxAge: request.maxAge ?? parsed.maxAge,
+        prompt: request.prompt ?? (parsed.maxAge === 0 ? "login" : void 0)
+      });
+    },
+    clientCredentialsFetch(fetchOptions = {}) {
+      const inner = fetchOptions.fetch ?? connection.fetch;
+      const key = { scopes: fetchOptions.scopes, resource: fetchOptions.resource };
+      return async (input, init) => {
+        const request = new Request(input, init);
+        const body = request.body ? await request.arrayBuffer() : void 0;
+        const attempt = async (token2) => {
+          const headers = new Headers(request.headers);
+          headers.set("authorization", `${token2.tokenType} ${token2.accessToken}`);
+          return inner(request.url, { method: request.method, headers, body, signal: request.signal, redirect: request.redirect });
+        };
+        const token = await clientCredentials.getToken({ ...key, signal: request.signal });
+        const response = await attempt(token);
+        if (response.status !== 401) return response;
+        clientCredentials.invalidate({ ...key, accessToken: token.accessToken });
+        return attempt(await clientCredentials.getToken({ ...key, signal: request.signal }));
+      };
+    }
+  };
+}
+function createTokenClient(connection, discovery, authenticator) {
+  const requestToken = async (parameters, signal, authenticate = true) => {
+    const response = await postForm(connection, discovery, authenticate ? authenticator : void 0, "token_endpoint", parameters, signal);
+    const token = await readProtocolJson(response);
+    return redact(token, ["access_token", "refresh_token", "id_token"]);
+  };
+  const pollDevice = async (authorization, options = {}) => {
+    requireValue(authorization?.device_code, "device_code");
+    let wait = (authorization.interval && authorization.interval > 0 ? authorization.interval : AuthioDefaults.DeviceInterval) * 1e3;
+    const deadline = authorization.expires_in && authorization.expires_in > 0 ? connection.clock.now() + authorization.expires_in * 1e3 : void 0;
+    for (; ; ) {
+      await connection.clock.sleep(wait, options.signal);
+      if (deadline !== void 0 && connection.clock.now() >= deadline)
+        throw new AuthioProtocolError(AuthioOAuthErrors.ExpiredToken, "The device code expired before the user approved it.");
+      try {
+        return await requestToken({ grant_type: AuthioGrantTypes.DeviceCode, device_code: authorization.device_code }, options.signal);
+      } catch (error) {
+        if (!(error instanceof AuthioProtocolError)) throw error;
+        const outcome = toDevicePollOutcome(error.error);
+        if (outcome.outcome === "failed") throw error;
+        wait += outcome.intervalIncrease * 1e3;
+      }
+    }
+  };
+  return {
+    clientCredentials: (options = {}) => requestToken(
+      { grant_type: AuthioGrantTypes.ClientCredentials, scope: toScopeString(options.scopes), resource: options.resource },
+      options.signal
+    ),
+    authorizationCode: (options) => {
+      requireValue(options?.code, "code");
+      requireValue(options.redirectUri, "redirectUri");
+      return requestToken(
+        {
+          grant_type: AuthioGrantTypes.AuthorizationCode,
+          code: options.code,
+          redirect_uri: options.redirectUri,
+          code_verifier: options.codeVerifier,
+          resource: options.resource
+        },
+        options.signal
+      );
+    },
+    refresh: (options) => {
+      requireValue(options?.refreshToken, "refreshToken");
+      return requestToken(
+        { grant_type: AuthioGrantTypes.RefreshToken, refresh_token: options.refreshToken, scope: toScopeString(options.scopes) },
+        options.signal
+      );
+    },
+    exchange: (options) => {
+      requireValue(options?.subjectToken, "subjectToken");
+      return requestToken(
+        {
+          grant_type: AuthioGrantTypes.TokenExchange,
+          subject_token: options.subjectToken,
+          subject_token_type: AuthioTokenTypes.AccessTokenUrn,
+          requested_token_type: AuthioTokenTypes.AccessTokenUrn,
+          scope: toScopeString(options.scopes),
+          resource: options.resource
+        },
+        options.signal
+      );
+    },
+    async exchangeForConnection(options) {
+      requireValue(options?.subjectToken, "subjectToken");
+      requireValue(options.provider, "provider");
+      const response = await postForm(
+        connection,
+        discovery,
+        authenticator,
+        "token_endpoint",
+        {
+          grant_type: AuthioGrantTypes.TokenExchange,
+          subject_token: options.subjectToken,
+          subject_token_type: AuthioTokenTypes.AccessTokenUrn,
+          requested_token_type: AuthioTokenTypes.ConnectionAccessTokenUrn,
+          connection_provider: options.provider,
+          connection_id: options.connectionId
+        },
+        options.signal
+      );
+      return toConnectionExchangeResult(await response.text(), response.status, options.provider);
+    },
+    async deviceAuthorization(options = {}) {
+      const response = await postForm(
+        connection,
+        discovery,
+        authenticator,
+        "device_authorization_endpoint",
+        { scope: toScopeString(options.scopes) },
+        options.signal
+      );
+      return redact(await readProtocolJson(response), ["device_code"]);
+    },
+    pollDevice,
+    personalAccessToken: (options) => {
+      requireValue(options?.token, "token");
+      return requestToken(
+        {
+          grant_type: AuthioGrantTypes.PersonalAccessToken,
+          client_secret: options.token,
+          client_id: options.clientId,
+          scope: toScopeString(options.scopes),
+          resource: options.resource
+        },
+        options.signal,
+        false
+      );
+    },
+    password: (options) => {
+      requireValue(options?.username, "username");
+      if (typeof options.password !== "string") throw new TypeError("password is required.");
+      return requestToken(
+        { grant_type: AuthioGrantTypes.Password, username: options.username, password: options.password, scope: toScopeString(options.scopes) },
+        options.signal
+      );
+    }
+  };
+}
+function createClientCredentialsCache(connection, clientId, tokens, refreshSkewMs) {
+  const entries = /* @__PURE__ */ new Map();
+  const pending = /* @__PURE__ */ new Map();
+  const keyOf = (scope, resource) => `${connection.issuer}|${clientId}|${(scope ?? "").split(" ").filter(Boolean).sort().join(" ")}|${resource ?? ""}`;
+  return {
+    async getToken(options = {}) {
+      const scope = toScopeString(options.scopes);
+      const key = keyOf(scope, options.resource);
+      const cached = entries.get(key);
+      if (cached && connection.clock.now() < cached.refreshAt) return cached;
+      let request = pending.get(key);
+      if (!request) {
+        request = tokens.clientCredentials({ scopes: scope, resource: options.resource, signal: options.signal }).then((response) => {
+          const token = toClientCredentialsToken(response, connection.clock.now(), refreshSkewMs);
+          entries.set(key, token);
+          return token;
+        }).finally(() => pending.delete(key));
+        pending.set(key, request);
+      }
+      return request;
+    },
+    invalidate(options = {}) {
+      const key = keyOf(toScopeString(options.scopes), options.resource);
+      if (options.accessToken === void 0 || entries.get(key)?.accessToken === options.accessToken) entries.delete(key);
+    }
+  };
+}
+function toClientCredentialsToken(response, issuedAt, refreshSkewMs) {
+  const lifetime = (response.expires_in && response.expires_in > 0 ? response.expires_in : AuthioDefaults.AssumedTokenLifetime) * 1e3;
+  const expiresAt = issuedAt + lifetime;
+  const skew = Math.min(refreshSkewMs, lifetime / 2);
+  return redact(
+    {
+      accessToken: response.access_token,
+      tokenType: response.token_type?.trim() ? response.token_type : "Bearer",
+      expiresAt,
+      refreshAt: expiresAt - skew,
+      scope: response.scope
+    },
+    ["accessToken"]
+  );
+}
+function toConnectionExchangeResult(body, status, provider) {
+  if (status >= 200 && status < 300) {
+    const token = parseProtocolJson(body, status);
+    if (typeof token.access_token === "string" && token.access_token)
+      return redact(
+        withoutUndefined({
+          status: "granted",
+          accessToken: token.access_token,
+          issuedTokenType: textOf(token.issued_token_type),
+          tokenType: textOf(token.token_type),
+          expiresIn: typeof token.expires_in === "number" ? token.expires_in : void 0,
+          scope: textOf(token.scope),
+          connectionId: textOf(token.connection_id),
+          provider: textOf(token.provider) ?? provider,
+          providerType: textOf(token.provider_type),
+          externalAccount: token.external_account && typeof token.external_account === "object" ? token.external_account : void 0
+        }),
+        ["accessToken"]
+      );
+  }
+  const error = toErrorResponse(body);
+  const errorDescription = error?.error_description?.trim() ? error.error_description : `Authio answered HTTP ${status} to the connected-account token exchange.`;
+  const errorCode = textOf(error?.error_code);
+  switch (error?.error) {
+    case AuthioOAuthErrors.ConnectionRequired:
+      return withoutUndefined({
+        status: "required",
+        connectUri: textOf(error.connect_uri),
+        provider: textOf(error.connection_provider) ?? provider,
+        errorCode,
+        errorDescription
+      });
+    case AuthioOAuthErrors.ConnectionSelectionRequired:
+      return withoutUndefined({
+        status: "selection_required",
+        provider: textOf(error.connection_provider) ?? provider,
+        connections: (Array.isArray(error.connections) ? error.connections : []).map(toConnectionChoice),
+        errorCode,
+        errorDescription
+      });
+    default:
+      return withoutUndefined({
+        status: "refused",
+        error: error?.error ?? `http_${status}`,
+        errorCode,
+        errorDescription,
+        connectUri: textOf(error?.connect_uri)
+      });
+  }
+}
+function toDevicePollOutcome(error) {
+  if (error === AuthioOAuthErrors.AuthorizationPending) return { outcome: "keep_polling", intervalIncrease: 0 };
+  if (error === AuthioOAuthErrors.SlowDown) return { outcome: "keep_polling", intervalIncrease: AuthioDefaults.DeviceSlowDownIncrement };
+  return { outcome: "failed", error };
+}
+function toConnectionChoice(value) {
+  const record = value && typeof value === "object" ? value : {};
+  return withoutUndefined({ id: textOf(record.id) ?? "", label: textOf(record.label), externalLogin: textOf(record.external_login) });
+}
+function textOf(value) {
+  return typeof value === "string" && value ? value : void 0;
+}
+function withoutUndefined(value) {
+  for (const key of Object.keys(value)) if (value[key] === void 0) delete value[key];
+  return value;
+}
+function resolveEncryptionKey(options) {
+  if (options.clientEncryptionKey !== void 0) return options.clientEncryptionKey;
+  if (options.clientEncryptionKeyPath) return encryptionKeyFromFile(options.clientEncryptionKeyPath);
+  return void 0;
+}
+async function postForm(connection, discovery, authenticator, endpoint, parameters, signal) {
+  const document = await discovery.get(signal);
+  const url = requireEndpoint(document, endpoint);
+  const form = formBody(parameters);
+  const headers = new Headers({ accept: "application/json", "content-type": "application/x-www-form-urlencoded" });
+  await authenticator?.apply(form, headers);
+  return send(connection, url, { method: "POST", headers, body: form.toString() }, signal);
+}
+async function readUserInfoJwt(jwt, document, connection, clientId, decrypt, signingKeys, settings) {
+  try {
+    const signed = isAuthioTokenEncrypted(jwt) ? await decrypt(jwt) : jwt;
+    const { payload } = await verifyAuthioJwt(signed, await signingKeys(settings.signal), {
+      issuer: document.issuer.replace(/\/+$/, ""),
+      audiences: [clientId],
+      algorithms: settings.algorithms,
+      clockSkew: settings.clockSkew,
+      now: connection.clock.now(),
+      requiredClaims: ["sub"]
+    });
+    return payload;
+  } catch (error) {
+    throw new AuthioProtocolError(
+      "invalid_userinfo",
+      `The userinfo JWT could not be verified: ${error?.message ?? "unknown reason."}`,
+      void 0,
+      settings.status,
+      { cause: error }
+    );
+  }
+}
+function readBearerChallenge(response) {
+  const header = response.headers.get("www-authenticate");
+  if (!header || !/^bearer\s/i.test(header.trim())) return void 0;
+  let error = "";
+  let description;
+  for (const match of header.matchAll(/([a-zA-Z_]+)\s*=\s*"((?:[^"\\]|\\.)*)"|([a-zA-Z_]+)\s*=\s*([^,\s]+)/g)) {
+    const name = match[1] ?? match[3];
+    const value = (match[2] ?? match[4] ?? "").replace(/\\(.)/g, "$1");
+    if (name === "error") error = value;
+    else if (name === "error_description") description = value;
+  }
+  return error ? { error, description } : void 0;
+}
+function requireValue(value, name) {
+  if (typeof value !== "string" || !value.trim()) throw new TypeError(`${name} is required.`);
+}
+
+// src/admin.ts
+function parseAuthioAdminEnvelope(status, body, headers) {
+  const parsed = parseJson(body);
+  if (status >= 200 && status < 300) {
+    if (!parsed) return { ok: true };
+    return withoutUndefined2({ ok: true, data: parsed.data });
+  }
+  const notifications = Array.isArray(parsed?.notifications) ? parsed.notifications.map(toNotification).filter((item) => item.message) : [];
+  return {
+    ok: false,
+    error: new AuthioAdminError({
+      status,
+      errorCode: textOf2(parsed?.errorCode),
+      notifications,
+      requestId: textOf2(parsed?.requestId) ?? headerOf(headers, AuthioDefaults.RequestIdHeader),
+      retryAfterSeconds: retryAfterOf(headerOf(headers, "Retry-After"))
+    })
+  };
+}
+async function readAuthioAdminResponse(response) {
+  const envelope = parseAuthioAdminEnvelope(response.status, response.status === 204 ? null : await response.text(), response.headers);
+  if (!envelope.ok) throw envelope.error;
+  return envelope;
+}
+function createAuthioAccountCredential(options) {
+  const value = options.credential?.trim();
+  if (!value) throw new AuthioConfigurationError("The account credential is required.");
+  const kind = value.startsWith(AuthioDefaults.ApiKeyPrefix) ? "api_key" : value.startsWith(AuthioDefaults.ClientSecretPrefix) ? "client_secret" : value.startsWith(AuthioDefaults.PersonalAccessTokenPrefix) ? "personal_access_token" : void 0;
+  if (!kind)
+    throw new AuthioConfigurationError(
+      `The account credential must start with ${AuthioDefaults.ApiKeyPrefix}, ${AuthioDefaults.ClientSecretPrefix} or ${AuthioDefaults.PersonalAccessTokenPrefix}.`
+    );
+  const exchanged = kind === "client_secret" || kind === "personal_access_token" && options.exchangePersonalAccessToken === true;
+  const clock = options.clock ?? systemClock;
+  const inner = options.fetch ?? globalThis.fetch;
+  const scope = toScopeString(options.scopes);
+  const refreshSkewMs = seconds(options.tokenRefreshSkew, AuthioDefaults.TokenRefreshSkew, "tokenRefreshSkew");
+  let client;
+  let cached;
+  let pending;
+  if (exchanged) {
+    if (kind === "client_secret" && !options.credentialId?.trim())
+      throw new AuthioConfigurationError("A cs_ client secret is exchanged with its credential id: set credentialId.");
+    client = createAuthioClient({
+      ...options,
+      realm: AuthioDefaults.PlatformRealm,
+      clientId: kind === "client_secret" ? toCredentialClientId(options.credentialId) : AuthioDefaults.PlatformClientId,
+      clientSecret: kind === "client_secret" ? value : void 0,
+      clientAuthentication: kind === "client_secret" ? "client_secret_post" : "none"
+    });
+  }
+  const exchange = async (signal) => {
+    if (cached && clock.now() < cached.refreshAt) return cached;
+    pending ??= (async () => {
+      const issuedAt = clock.now();
+      const answer = kind === "client_secret" ? await client.tokens.clientCredentials({ scopes: scope, signal }) : await client.tokens.personalAccessToken({ token: value, scopes: scope, signal });
+      cached = toClientCredentialsToken(answer, issuedAt, refreshSkewMs);
+      return cached;
+    })().finally(() => {
+      pending = void 0;
+    });
+    return pending;
+  };
+  const headers = async (signal) => {
+    if (exchanged) {
+      const token = await exchange(signal);
+      return { authorization: `${token.tokenType} ${token.accessToken}` };
+    }
+    return options.presentAs === "x-api-key" ? { [AuthioDefaults.ApiKeyHeader]: value } : { authorization: `Bearer ${value}` };
+  };
+  const authenticatedFetch = async (input, init) => {
+    const request = new Request(input, init);
+    const body = request.body ? await request.arrayBuffer() : void 0;
+    const idempotent = ["GET", "HEAD", "PUT", "DELETE"].includes(request.method.toUpperCase());
+    const attempt = async () => {
+      const merged = new Headers(request.headers);
+      for (const [name, header] of Object.entries(await headers(request.signal))) merged.set(name, header);
+      return inner(request.url, { method: request.method, headers: merged, body, signal: request.signal, redirect: request.redirect });
+    };
+    let response = await attempt();
+    if (response.status === 401 && exchanged) {
+      cached = void 0;
+      response = await attempt();
+    }
+    if ((response.status === 429 || response.status === 503) && idempotent) {
+      const wait = retryAfterOf(response.headers.get("retry-after") ?? void 0);
+      if (wait !== void 0) {
+        await clock.sleep(wait * 1e3, request.signal);
+        response = await attempt();
+      }
+    }
+    return response;
+  };
+  return {
+    kind,
+    exchanged,
+    headers,
+    invalidate() {
+      cached = void 0;
+    },
+    fetch: authenticatedFetch
+  };
+}
+function toCredentialClientId(credentialId) {
+  const id = credentialId.trim();
+  return id.startsWith(AuthioDefaults.CredentialClientIdPrefix) ? id : `${AuthioDefaults.CredentialClientIdPrefix}${id.replace(/[{}-]/g, "").toLowerCase()}`;
+}
+function parseJson(body) {
+  if (!body?.trim()) return void 0;
+  try {
+    return asRecord(JSON.parse(body));
+  } catch {
+    return void 0;
+  }
+}
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function toNotification(value) {
+  const record = asRecord(value) ?? {};
+  return withoutUndefined2({ message: textOf2(record.message) ?? "", field: textOf2(record.field), code: textOf2(record.code) });
+}
+function headerOf(headers, name) {
+  if (!headers) return void 0;
+  if (typeof headers.get === "function") return headers.get(name) ?? void 0;
+  const wanted = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) if (key.toLowerCase() === wanted) return value;
+  return void 0;
+}
+function retryAfterOf(value) {
+  if (!value?.trim()) return void 0;
+  if (/^\d+$/.test(value.trim())) return Number(value.trim());
+  const date = Date.parse(value);
+  return Number.isNaN(date) ? void 0 : Math.max(0, Math.ceil((date - Date.now()) / 1e3));
+}
+function textOf2(value) {
+  return typeof value === "string" && value ? value : void 0;
+}
+function withoutUndefined2(value) {
+  for (const key of Object.keys(value)) if (value[key] === void 0) delete value[key];
+  return value;
+}
+
+// src/resource-access.ts
+var claimSources = new Map(Object.entries(AuthioResourceAccessClaims).map(([name, source]) => [name.toLowerCase(), source]));
+var AuthioResourceAccess = class _AuthioResourceAccess {
+  /** No role at all. */
+  static empty = new _AuthioResourceAccess([]);
+  /** Every role read, in claim order, one entry per source it came from. */
+  entries;
+  /** Every distinct role name. */
+  roles;
+  /** Resource → every method any role allows on it. */
+  permissions;
+  lookup;
+  constructor(entries) {
+    this.entries = Object.freeze([...entries]);
+    this.roles = Object.freeze(distinctIgnoringCase(this.entries.map((entry) => entry.name)));
+    this.lookup = /* @__PURE__ */ new Map();
+    const permissions = {};
+    const spelling = /* @__PURE__ */ new Map();
+    for (const entry of this.entries) {
+      for (const [resource, methods] of Object.entries(entry.permissions)) {
+        const resourceKey = resource.toLowerCase();
+        let allowed = this.lookup.get(resourceKey);
+        if (!allowed) {
+          allowed = /* @__PURE__ */ new Map();
+          this.lookup.set(resourceKey, allowed);
+          spelling.set(resourceKey, resource);
+          permissions[resource] = [];
+        }
+        for (const method of methods) {
+          const methodKey = method.toLowerCase();
+          if (allowed.has(methodKey)) continue;
+          allowed.set(methodKey, method);
+          permissions[spelling.get(resourceKey)].push(method);
+        }
+      }
+    }
+    this.permissions = Object.freeze(Object.fromEntries(Object.entries(permissions).map(([name, methods]) => [name, Object.freeze(methods)])));
+  }
+  /** Whether no role was read. */
+  get isEmpty() {
+    return this.entries.length === 0;
+  }
+  /**
+   * Whether the token holds the role, from any source or only from the given ones.
+   */
+  hasRole(role, sources) {
+    if (!role) return false;
+    const wanted = role.toLowerCase();
+    return this.entries.some((entry) => inSources(entry, sources) && entry.name.toLowerCase() === wanted);
+  }
+  /**
+   * Authio's grant rule: whether any role (from any source, or only from the given ones) allows `method` on
+   * `resource`.
+   */
+  grants(resource, method, sources) {
+    if (!resource || !method) return false;
+    if (!sources || sources.length === 0) return this.lookup.get(resource.toLowerCase())?.has(method.toLowerCase()) ?? false;
+    return this.entries.some((entry) => inSources(entry, sources) && entryGrants(entry, resource, method));
+  }
+  /**
+   * The roles that came from one source.
+   */
+  fromSource(source) {
+    return this.entries.filter((entry) => entry.source === source);
+  }
+};
+function resourceAccessSourceOf(claimType) {
+  return claimType ? claimSources.get(claimType.toLowerCase()) : void 0;
+}
+function parseResourceAccess(claims) {
+  const pairs = isIterable(claims) ? claims : Object.entries(claims);
+  const roles = [];
+  for (const [type, value] of pairs) {
+    const source = resourceAccessSourceOf(type);
+    if (source) roles.push(...parseResourceAccessClaim(source, value));
+  }
+  return roles.length === 0 ? AuthioResourceAccess.empty : new AuthioResourceAccess(roles);
+}
+function parseResourceAccessClaim(source, value) {
+  const root = typeof value === "string" ? parseJson2(value) : value;
+  if (!isPlainObject(root)) return [];
+  const roles = [];
+  for (const [name, rolePermissions] of Object.entries(root)) {
+    const permissions = readPermissions(rolePermissions);
+    if (!permissions) return [];
+    roles.push(Object.freeze({ source, name, permissions }));
+  }
+  return roles;
+}
+function readPermissions(value) {
+  if (value === null) return Object.freeze({});
+  if (!isPlainObject(value)) return void 0;
+  const read = {};
+  const seen = /* @__PURE__ */ new Set();
+  for (const [resource, methods] of Object.entries(value)) {
+    const key = resource.toLowerCase();
+    if (methods === null) {
+      if (!seen.has(key)) {
+        seen.add(key);
+        read[resource] = Object.freeze([]);
+      }
+      continue;
+    }
+    if (!Array.isArray(methods)) return void 0;
+    const allowed = [];
+    for (const method of methods) {
+      if (typeof method === "string") allowed.push(method);
+      else if (method !== null) return void 0;
+    }
+    if (!seen.has(key)) {
+      seen.add(key);
+      read[resource] = Object.freeze(allowed);
+    }
+  }
+  return Object.freeze(read);
+}
+function entryGrants(entry, resource, method) {
+  const resourceKey = resource.toLowerCase();
+  const methodKey = method.toLowerCase();
+  for (const [name, methods] of Object.entries(entry.permissions)) {
+    if (name.toLowerCase() === resourceKey) return methods.some((allowed) => allowed.toLowerCase() === methodKey);
+  }
+  return false;
+}
+function inSources(entry, sources) {
+  return !sources || sources.length === 0 || sources.includes(entry.source);
+}
+function distinctIgnoringCase(values) {
+  const seen = /* @__PURE__ */ new Set();
+  return values.filter((value) => {
+    const key = value.toLowerCase();
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function parseJson2(text) {
+  if (!text.trim()) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isIterable(value) {
+  return typeof value === "object" && value !== null && typeof value[Symbol.iterator] === "function";
+}
+
+// src/webhooks.ts
+var encoder = new TextEncoder();
+async function verifyWebhookSignature(signatureHeader, rawBody, secret, options = {}) {
+  if (!secret) throw new TypeError("secret is required.");
+  if (!signatureHeader?.trim())
+    return { valid: false, failure: "missing_signature", reason: "The X-Authio-Signature header is missing." };
+  const parsed = parseSignatureHeader(signatureHeader);
+  if (!parsed)
+    return {
+      valid: false,
+      failure: "malformed_signature",
+      reason: "The X-Authio-Signature header is not of the form t={unixSeconds},v1={hex}."
+    };
+  const signedAt = new Date(parsed.timestamp * 1e3);
+  const expected = await computeSignature(parsed.timestamp, rawBody, secret);
+  let matched = false;
+  for (const signature of parsed.signatures) matched = constantTimeEquals(expected, signature) || matched;
+  if (!matched)
+    return {
+      valid: false,
+      failure: "signature_mismatch",
+      reason: "No v1 signature matches the body: the secret is wrong or the body was altered.",
+      timestamp: signedAt
+    };
+  const tolerance = (options.tolerance ?? AuthioDefaults.WebhookTolerance) * 1e3;
+  const now = options.now ?? Date.now();
+  if (Math.abs(now - signedAt.getTime()) > tolerance)
+    return {
+      valid: false,
+      failure: "timestamp_outside_tolerance",
+      reason: `The signature was made at ${signedAt.toISOString()}, more than ${tolerance / 1e3} seconds from now.`,
+      timestamp: signedAt
+    };
+  return { valid: true, timestamp: signedAt };
+}
+async function computeWebhookSignatureHeader(rawBody, secret, timestamp) {
+  if (!secret) throw new TypeError("secret is required.");
+  const seconds2 = Math.floor((timestamp instanceof Date ? timestamp.getTime() : timestamp) / 1e3);
+  const signature = await computeSignature(seconds2, rawBody, secret);
+  return `t=${seconds2},v1=${[...signature].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+function parseWebhookEvent(rawBody) {
+  const text = typeof rawBody === "string" ? rawBody : new TextDecoder().decode(rawBody);
+  const value = JSON.parse(text);
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new SyntaxError("The webhook body is empty.");
+  if (typeof value.type !== "string" || !value.type) throw new SyntaxError("The webhook body has no type.");
+  return value;
+}
+function tryParseWebhookEvent(rawBody) {
+  if (rawBody === null || rawBody === void 0) return void 0;
+  try {
+    return parseWebhookEvent(rawBody);
+  } catch {
+    return void 0;
+  }
+}
+function isWebhookEventOfType(event, ...types) {
+  return types.includes(event.type);
+}
+var asUserEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.UserCreated, AuthioWebhookEventTypes.UserUpdated, AuthioWebhookEventTypes.UserDeleted);
+var asLoginEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.LoginSucceeded, AuthioWebhookEventTypes.LoginFailed);
+var asUserLockedOutEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.UserLockedOut);
+var asTokenRevokedEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.TokenRevoked);
+var asKeysRotatedEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.KeysRotated);
+var asTokenReuseDetectedEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.TokenReuseDetected);
+var asAdminResourceEvent = (event) => dataWhen(
+  event,
+  AuthioWebhookEventTypes.AdminResourceCreated,
+  AuthioWebhookEventTypes.AdminResourceUpdated,
+  AuthioWebhookEventTypes.AdminResourceDeleted
+);
+var asUserSuspensionEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.UserSuspended, AuthioWebhookEventTypes.UserSuspensionEnded);
+var asAttackDetectedEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.AttackDetected);
+var asCredentialCompromisedEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.CredentialCompromised);
+var asPingEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.Ping);
+var knownEventTypes = new Set(Object.values(AuthioWebhookEventTypes));
+function isKnownWebhookEventType(type) {
+  return knownEventTypes.has(type);
+}
+function readWebhookEventData(event) {
+  return isKnownWebhookEventType(event.type) ? dataWhen(event, event.type) : void 0;
+}
+function toCamelCasedMembers(value) {
+  const result = {};
+  for (const [name, member] of Object.entries(value)) result[name.replace(/_([a-z0-9])/g, (_, letter) => letter.toUpperCase())] = member;
+  return result;
+}
+function dataWhen(event, ...types) {
+  return types.includes(event.type) && event.data !== null && typeof event.data === "object" && !Array.isArray(event.data) ? toCamelCasedMembers(event.data) : void 0;
+}
+function parseSignatureHeader(header) {
+  let timestamp = 0;
+  let timestamps = 0;
+  const signatures = [];
+  for (const raw of header.split(",")) {
+    const part = raw.trim();
+    if (!part) continue;
+    const separator = part.indexOf("=");
+    if (separator <= 0) return void 0;
+    const key = part.slice(0, separator);
+    const value = part.slice(separator + 1);
+    if (key === "t") {
+      timestamps++;
+      if (!/^\d+$/.test(value)) return void 0;
+      timestamp = Number(value);
+    } else if (key === "v1" && value.length === 64 && /^[0-9a-fA-F]+$/.test(value)) {
+      signatures.push(Uint8Array.from(value.match(/../g).map((pair) => parseInt(pair, 16))));
+    }
+  }
+  return timestamps === 1 && signatures.length > 0 && Number.isSafeInteger(timestamp) ? { timestamp, signatures } : void 0;
+}
+async function computeSignature(timestamp, rawBody, secret) {
+  const prefix = encoder.encode(`${timestamp}.`);
+  const body = typeof rawBody === "string" ? encoder.encode(rawBody) : rawBody;
+  const message = new Uint8Array(prefix.length + body.length);
+  message.set(prefix, 0);
+  message.set(body, prefix.length);
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return new Uint8Array(await crypto.subtle.sign("HMAC", key, message));
+}
+function constantTimeEquals(left, right) {
+  if (left.length !== right.length) return false;
+  let difference = 0;
+  for (let index = 0; index < left.length; index++) difference |= left[index] ^ right[index];
+  return difference === 0;
+}
+
+export { AuthioAdminError, AuthioAsymmetricAlgorithms, AuthioCallbackError, AuthioCallerKinds, AuthioClaimTypes, AuthioClientAssertionAlgorithms, AuthioConfigurationError, AuthioContentEncryptionAlgorithms, AuthioDefaults, AuthioDiscoveryError, AuthioError, AuthioGrantTypes, AuthioKeyManagementAlgorithms, AuthioLegacyKeyManagementAlgorithms, AuthioOAuthErrors, AuthioPrompts, AuthioProtocolError, AuthioResourceAccess, AuthioResourceAccessClaims, AuthioScopes, AuthioTokenTypes, AuthioTokenValidationError, AuthioWebhookEventTypes, AuthioWebhookHeaders, asAdminResourceEvent, asAttackDetectedEvent, asCredentialCompromisedEvent, asKeysRotatedEvent, asLoginEvent, asPingEvent, asTokenReuseDetectedEvent, asTokenRevokedEvent, asUserEvent, asUserLockedOutEvent, asUserSuspensionEvent, computeAuthioTokenHash, computeWebhookSignatureHeader, createAuthioAccountCredential, createAuthioClient, createAuthioDiscoveryClient, createAuthioPkce, createAuthioSigningKeys, createAuthioTokenDecrypter, encryptionKeyFromFile, escapeDataString, isAllowedUrl, isAuthioTokenEncrypted, isKnownWebhookEventType, isWebhookEventOfType, parseAuthioAdminEnvelope, parseAuthioBearerChallenge, parseResourceAccess, parseResourceAccessClaim, parseWebhookEvent, randomValue, readAuthioAdminResponse, readWebhookEventData, resolveConnection, resolveIssuer, resourceAccessSourceOf, seconds, systemClock, toBasicAuthorization, toCamelCasedMembers, toClientCredentialsToken, toConnectionExchangeResult, toCredentialClientId, toDevicePollOutcome, toScopeString, toTokenValidationError, tryParseWebhookEvent, verifyAuthioJwt, verifyWebhookSignature };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map