@hyper.authio/client 0.7.0 → 0.8.0

package/dist/index.d.cts

@@ -190,6 +190,16 @@ type AuthioPrompt = (typeof AuthioPrompts)[number];
  * Asymmetric signing algorithms Authio issues tokens with and accepts in client assertions.
  */
 declare const AuthioAsymmetricAlgorithms: readonly ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512"];
+/**
+ * Symmetric algorithms Authio may sign a client's tokens with. A client verifies them with its own client secret
+ * (OpenID Connect Core §10.1), and only when `idTokenSignedResponseAlg` names one.
+ */
+declare const AuthioHmacAlgorithms: readonly ["HS256", "HS384", "HS512"];
+/**
+ * The shortest client secret, in bytes of its UTF-8 form, each HS* algorithm is verified with: the size of the hash
+ * output (RFC 7518 §3.2). Authio refuses a shorter secret for the algorithm, and so do the SDKs.
+ */
+declare const AuthioHmacMinimumSecretBytes: Readonly<Record<(typeof AuthioHmacAlgorithms)[number], number>>;
 /**
  * Defaults shared by every Authio SDK.
  */
@@ -373,9 +383,14 @@ interface AuthioConnectionOptions {
     clock?: AuthioClock;
 }
 /**
- * How the client authenticates to the token, introspection, revocation and device endpoints.
+ * How the client authenticates to the token, introspection, revocation and device endpoints: the client's
+ * `token_endpoint_auth_method` in Authio, which Authio matches exactly.
  */
-type AuthioClientAuthentication = "client_secret_basic" | "client_secret_post" | "private_key_jwt" | "none";
+type AuthioTokenEndpointAuthMethod = "client_secret_basic" | "client_secret_post" | "private_key_jwt" | "none";
+/**
+ * The values of `tokenEndpointAuthMethod`.
+ */
+declare const AuthioTokenEndpointAuthMethods: readonly ["client_secret_basic", "client_secret_post", "private_key_jwt", "none"];
 /**
  * The connection settings, resolved once.
  */
@@ -435,6 +450,7 @@ interface AuthioDiscoveryDocument {
     grant_types_supported?: string[];
     subject_types_supported?: string[];
     id_token_signing_alg_values_supported?: string[];
+    userinfo_signing_alg_values_supported?: string[];
     token_endpoint_auth_methods_supported?: string[];
     token_endpoint_auth_signing_alg_values_supported?: string[];
     introspection_endpoint_auth_methods_supported?: string[];
@@ -443,6 +459,8 @@ interface AuthioDiscoveryDocument {
     claims_supported?: string[];
     prompt_values_supported?: string[];
     authorization_response_iss_parameter_supported?: boolean;
+    frontchannel_logout_supported?: boolean;
+    frontchannel_logout_session_supported?: boolean;
     [member: string]: unknown;
 }
 /**
@@ -515,10 +533,10 @@ interface AuthioClientCredentialsSettings {
      */
     clientSecret?: AuthioSecretSource;
     /**
-     * Defaults to `private_key_jwt` when only a private key is configured, else `client_secret_basic`. A public client
-     * sets `none`.
+     * How the client authenticates, as registered in Authio (which matches it exactly). Defaults to
+     * `client_secret_basic` with a `clientSecret`, `private_key_jwt` with only a private key, and `none` with neither.
      */
-    clientAuthentication?: AuthioClientAuthentication;
+    tokenEndpointAuthMethod?: AuthioTokenEndpointAuthMethod;
     /** The private key for `private_key_jwt`. */
     clientPrivateKey?: AuthioPrivateKeyInput;
     /** A PEM file holding the private key for `private_key_jwt` (Node only); re-read when it changes. */
@@ -562,9 +580,13 @@ declare const AuthioKeyManagementAlgorithms: readonly ["RSA-OAEP", "RSA-OAEP-256
  */
 declare const AuthioLegacyKeyManagementAlgorithms: readonly ["RSA1_5"];
 /**
- * The content encryption algorithms Authio encrypts with.
+ * The content encryption algorithms Authio encrypts with to a client's own key, the default `encryptionMethods`.
  */
 declare const AuthioContentEncryptionAlgorithms: readonly ["A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512"];
+/**
+ * Every content encryption algorithm `encryptionMethods` may list: the CBC-HS ones and AES-GCM.
+ */
+declare const AuthioSupportedContentEncryptionAlgorithms: readonly ["A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512", "A128GCM", "A192GCM", "A256GCM"];
 /**
  * Options of the decrypter.
  */
@@ -576,6 +598,13 @@ interface AuthioTokenDecrypterOptions {
      * neither Node nor WebCrypto can decrypt PKCS#1 v1.5.
      */
     allowLegacyEncryptionAlgorithms?: boolean;
+    /**
+     * The key management algorithms (`alg`) accepted, as registered for the client in Authio. Defaults to RSA-OAEP and
+     * RSA-OAEP-256. RSA1_5 cannot be listed: neither Node nor WebCrypto can decrypt it.
+     */
+    encryptionAlgorithms?: readonly string[];
+    /** The content encryption algorithms (`enc`) accepted. Defaults to A128CBC-HS256, A192CBC-HS384 and A256CBC-HS512. */
+    encryptionMethods?: readonly string[];
 }
 /**
  * Whether a value is a compact JWE (five segments).
@@ -636,7 +665,8 @@ type AuthioSigningKeys = (signal?: AbortSignal) => Promise<JWTVerifyGetKey>;
  */
 interface AuthioJwtExpectations {
     readonly issuer: string;
-    readonly audiences: readonly string[];
+    /** The accepted audiences; `aud` is not checked when absent. */
+    readonly audiences?: readonly string[];
     readonly algorithms?: readonly string[];
     /** Seconds. */
     readonly clockSkew?: number;
@@ -661,6 +691,21 @@ declare function verifyAuthioJwt(token: string, keys: JWTVerifyGetKey, expected:
     payload: JWTPayload;
     header: Record<string, unknown>;
 }>;
+/**
+ * Wraps the realm's keys so an HS256, HS384 or HS512 signature is verified with the client secret instead (OpenID
+ * Connect Core §10.1: the octets of its UTF-8 form). Only reached for an algorithm the allowlist accepts, so an HS*
+ * token is verified with the secret only when `idTokenSignedResponseAlg` names that algorithm.
+ *
+ * @internal
+ */
+declare function withClientSecret(keys: JWTVerifyGetKey, secret: (() => Promise<string>) | undefined): JWTVerifyGetKey;
+/**
+ * Refuses a client secret shorter than the HS* algorithm's hash output (RFC 7518 §3.2).
+ *
+ * @throws AuthioConfigurationError naming the algorithm and both lengths.
+ * @internal
+ */
+declare function requireHmacSecretLength(algorithm: string, length: number): void;
 /**
  * Turns a `jose` failure into the refusal it stands for, worded as ASP.NET Core's bearer handler words it.
  *
@@ -677,6 +722,20 @@ declare function computeAuthioTokenHash(value: string, algorithm: string): Promi
  * The PKCE method (RFC 7636). `S256` is the default; `plain` only when asked for, for a client that cannot hash.
  */
 type AuthioCodeChallengeMethod = "S256" | "plain";
+/**
+ * What the client checks on an authorization round trip, as the client is registered in Authio: `pkce` sends a code
+ * challenge and redeems the code with its verifier, `state` binds the callback to the request, `nonce` binds the ID
+ * token to it. `none` is the same as an empty list. Nothing is checked unless listed.
+ */
+type AuthioCheck = "pkce" | "state" | "nonce" | "none";
+/**
+ * How Authio answers the authorization request: `query` (a redirect) or `web_message` (posted to the opener window).
+ */
+type AuthioResponseMode = "query" | "web_message";
+/**
+ * The checks every Authio library accepts.
+ */
+declare const AuthioChecks: readonly ["pkce", "state", "nonce", "none"];
 /**
  * A PKCE pair: send `codeChallenge` with the authorization request and `codeVerifier` with the code exchange.
  */
@@ -711,17 +770,19 @@ interface AuthioAuthorizationRequest {
     uiLocales?: string | readonly string[];
     /** `page` (default) or `popup`, the layout of the hosted screens. */
     display?: "page" | "popup";
-    /** `query` (default) or `web_message`, the popup's answer posted to the opener window. */
-    responseMode?: "query" | "web_message";
+    /** `query` or `web_message` (the answer posted to the opener window). Defaults to the client's `responseMode`. */
+    responseMode?: AuthioResponseMode;
     /** Shorthand for `display: "popup"` with `responseMode: "web_message"`. */
     popup?: boolean;
     /** The alias of the identity provider to go straight to, skipping Authio's sign-in screen. */
     idpHint?: string;
-    /** Defaults to `S256`. */
+    /** The checks of this request. Defaults to the client's `checks`. */
+    checks?: readonly AuthioCheck[];
+    /** The PKCE method, when `checks` holds `pkce`. Defaults to the client's `codeChallengeMethod`, else `S256`. */
     codeChallengeMethod?: AuthioCodeChallengeMethod;
-    /** A `state` of your own; a random one otherwise. */
+    /** A `state` of your own for the `state` check (a random one otherwise); without the check it is sent unchecked. */
     state?: string;
-    /** A `nonce` of your own; a random one otherwise. */
+    /** A `nonce` of your own for the `nonce` check (a random one otherwise); without the check it is sent unchecked. */
     nonce?: string;
     /** Further parameters, sent as given. */
     extraParameters?: Record<string, string | undefined>;
@@ -731,10 +792,16 @@ interface AuthioAuthorizationRequest {
  * check the callback and redeem the code.
  */
 interface AuthioAuthorizationTransaction {
-    readonly state: string;
-    readonly nonce: string;
-    readonly codeVerifier: string;
-    readonly codeChallengeMethod: AuthioCodeChallengeMethod;
+    /** The checks the request was made with; the callback checks exactly these. */
+    readonly checks: readonly Exclude<AuthioCheck, "none">[];
+    /** With the `state` check. */
+    readonly state?: string;
+    /** With the `nonce` check. */
+    readonly nonce?: string;
+    /** With the `pkce` check. */
+    readonly codeVerifier?: string;
+    /** With the `pkce` check. */
+    readonly codeChallengeMethod?: AuthioCodeChallengeMethod;
     readonly redirectUri: string;
     readonly resource?: string;
     readonly maxAge?: number;
@@ -769,6 +836,22 @@ declare function createAuthioPkce(method?: AuthioCodeChallengeMethod): Promise<A
  * A random, URL-safe value of `bytes` random bytes, for `state` and `nonce`.
  */
 declare function randomValue(bytes?: number): string;
+/**
+ * A front-channel logout request (OpenID Connect Front-Channel Logout 1.0): Authio loads the client's
+ * `frontchannel_logout_uri` in an iframe, with `iss` and `sid` when the client requires the session.
+ */
+interface AuthioFrontChannelLogout {
+    /** `sid`: the Authio session that ended, when Authio sent it. */
+    readonly sessionId: string | undefined;
+    /** `iss`, when Authio sent it; always this client's issuer. */
+    readonly issuer: string | undefined;
+}
+/**
+ * Reads a front-channel logout request: `iss` and `sid` come together, and `iss` must be the issuer.
+ *
+ * @throws AuthioCallbackError with `issuer_mismatch` for another issuer, `missing_issuer` for a `sid` without `iss`.
+ */
+declare function readAuthioFrontChannelLogout(request: string | URL | URLSearchParams | Readonly<Record<string, unknown>>, issuer: string): AuthioFrontChannelLogout;
 /**
  * Parses a `WWW-Authenticate` bearer challenge, or `undefined` when the header holds none.
  */
@@ -943,13 +1026,43 @@ interface AuthioClientOptions extends AuthioConnectionOptions, AuthioClientCrede
      * Seconds before expiry a cached token is renewed (capped at half its lifetime). Defaults to 60.
      */
     tokenRefreshSkew?: number;
+    /**
+     * What the authorization round trip checks, as the client is registered in Authio: `pkce`, `state`, `nonce`, or
+     * `none`. Only the listed checks are made; omitted, none is (a client that requires PKCE needs `["pkce"]`).
+     */
+    checks?: readonly AuthioCheck[];
+    /** The PKCE method, when `checks` holds `pkce`: one of the client's allowed methods. Defaults to `S256`. */
+    codeChallengeMethod?: AuthioCodeChallengeMethod;
+    /** The `response_mode` sent with every authorization request: `query` or `web_message`. Omitted, none is sent. */
+    responseMode?: AuthioResponseMode;
+    /**
+     * The algorithm the client's ID tokens are signed with, as registered in Authio, which signs the client's logout
+     * tokens with it too. HS256, HS384 and HS512 are verified with `clientSecret` (OpenID Connect Core
+     * §10.1). Omitted, the asymmetric algorithms the discovery document announces are accepted (RS*, PS*, ES*).
+     */
+    idTokenSignedResponseAlg?: string;
+    /** The algorithm a signed UserInfo answer is signed with. Defaults to `idTokenSignedResponseAlg`. */
+    userinfoSignedResponseAlg?: string;
+    /**
+     * The algorithm the client's access tokens are signed with (Authio's second signing setting), for
+     * `readAccessTokenClaims`. HS* is verified with `clientSecret`. Omitted, the asymmetric algorithms the discovery
+     * document announces are accepted, and never HS*.
+     */
+    accessTokenSignedResponseAlg?: string;
     /**
      * The private half of the client's own encryption key, to read ID tokens, UserInfo and logout tokens Authio
-     * encrypts to the client (RSA-OAEP or RSA-OAEP-256); or a function returning it.
+     * encrypts to the client; or a function returning it. Without it, nothing is decrypted.
      */
     clientEncryptionKey?: AuthioEncryptionKeySource;
     /** A PEM or JWK file holding `clientEncryptionKey` (Node only), read on first use. */
     clientEncryptionKeyPath?: string;
+    /**
+     * The key management algorithms (`alg`) decrypted, as registered for the client. Defaults to RSA-OAEP and
+     * RSA-OAEP-256; RSA1_5 cannot be listed, because Node and WebCrypto cannot decrypt it.
+     */
+    encryptionAlgorithms?: readonly string[];
+    /** The content encryption algorithms (`enc`) decrypted. Defaults to A128CBC-HS256, A192CBC-HS384, A256CBC-HS512. */
+    encryptionMethods?: readonly string[];
     /**
      * Accepted for parity with the other Authio SDKs; RSA1_5 stays refused here, because Node and WebCrypto cannot
      * decrypt it. Defaults to `false`.
@@ -961,8 +1074,6 @@ interface AuthioClientOptions extends AuthioConnectionOptions, AuthioClientCrede
     postLogoutRedirectUri?: string;
     /** Seconds of clock skew tolerated on ID tokens, logout tokens and signed UserInfo. Defaults to 30. */
     clockSkew?: number;
-    /** Algorithms ID tokens, logout tokens and signed UserInfo are accepted with. Defaults to RS*, PS*, ES*. */
-    validAlgorithms?: readonly string[];
 }
 /**
  * What a completed sign-in yields.
@@ -1011,10 +1122,14 @@ interface AuthioTokenClient {
         codeVerifier?: string;
         resource?: string;
     } & AuthioCallOptions): Promise<AuthioTokenResponse>;
-    /** Refreshes; the answer carries the rotated refresh token, which must be stored. */
+    /**
+     * Refreshes; the answer carries the rotated refresh token, which must be stored. `scopes` may only narrow the
+     * granted ones; `resource` (RFC 8707) asks for an access token addressed to that resource server.
+     */
     refresh(options: {
         refreshToken: string;
         scopes?: Iterable<string> | string;
+        resource?: string;
     } & AuthioCallOptions): Promise<AuthioTokenResponse>;
     /** Exchanges a user's access token for one addressed to another resource (RFC 8693, on-behalf-of). */
     exchange(options: {
@@ -1121,13 +1236,14 @@ interface AuthioClient {
         fetch?: typeof fetch;
     }): typeof fetch;
     /**
-     * Builds the authorization URL (PKCE S256, `state`, `nonce` and Authio's parameters) and the transaction to keep
-     * until the callback.
+     * Builds the authorization URL (the parameters of the configured `checks`, and Authio's parameters) and the
+     * transaction to keep until the callback.
      */
     createAuthorizationUrl(request?: AuthioAuthorizationRequest & AuthioCallOptions): Promise<AuthioAuthorizationUrl>;
     /**
-     * Completes a sign-in: checks `state` and the `iss` parameter (RFC 9207), throws the OAuth error Authio sent back,
-     * redeems the code with the PKCE verifier, and validates the ID token (nonce, `at_hash`, `max_age`).
+     * Completes a sign-in: checks `state` (with the `state` check) and the `iss` parameter (RFC 9207), throws the OAuth
+     * error Authio sent back, redeems the code (with the PKCE verifier, with the `pkce` check), and validates the ID
+     * token (`nonce` with the `nonce` check, `at_hash`, `max_age`). A `state` the transaction did not ask for is ignored.
      *
      * @param callback The callback URL, its query, or its parameters (a `web_message` answer, a parsed query).
      * @param transaction What `createAuthorizationUrl` returned with the URL.
@@ -1154,6 +1270,21 @@ interface AuthioClient {
      * @throws AuthioTokenValidationError naming why it was refused (`invalid_logout_token` for the logout-specific rules).
      */
     validateLogoutToken(logoutToken: string, options?: AuthioCallOptions): Promise<AuthioLogoutToken>;
+    /**
+     * Reads a front-channel logout request Authio loaded in an iframe: `iss` must be the issuer, and `sid` comes with
+     * it. End the sessions of `sessionId`, or the browser's own session when Authio sent none.
+     *
+     * @throws AuthioCallbackError when `iss` names another issuer, or `sid` comes without `iss`.
+     */
+    validateFrontChannelLogout(request: string | URL | URLSearchParams | Readonly<Record<string, unknown>>): AuthioFrontChannelLogout;
+    /**
+     * Reads an access token this client received from Authio: decrypted with `clientEncryptionKey` when it is a JWE,
+     * then its signature (with `accessTokenSignedResponseAlg`), `iss` and `exp` checked. Its audience is the API's, so it is not checked. `undefined` for an
+     * opaque token, or an encrypted one without `clientEncryptionKey`.
+     *
+     * @throws AuthioTokenValidationError naming why it was refused.
+     */
+    readAccessTokenClaims(accessToken: string, options?: AuthioCallOptions): Promise<JWTPayload | undefined>;
     /** Builds the end-session URL (RP-Initiated Logout). */
     createEndSessionUrl(request?: AuthioEndSessionRequest & AuthioCallOptions): Promise<string>;
     /**
@@ -1624,4 +1755,4 @@ declare function readWebhookEventData(event: AuthioWebhookEvent): Record<string,
  */
 declare function toCamelCasedMembers<T extends object>(value: T): AuthioCamelCased<T>;
 
-export { type AuthioAccountCredential, type AuthioAccountCredentialKind, type AuthioAccountCredentialOptions, type AuthioAdminEnvelope, AuthioAdminError, type AuthioAdminFailure, type AuthioAdminNotification, type AuthioAdminSuccess, AuthioAsymmetricAlgorithms, type AuthioAuthorizationRequest, type AuthioAuthorizationResult, type AuthioAuthorizationTransaction, type AuthioAuthorizationUrl, type AuthioBearerChallenge, type AuthioCallOptions, AuthioCallbackError, type AuthioCallbackFailure, type AuthioCallerKind, AuthioCallerKinds, type AuthioCamelCase, type AuthioCamelCased, AuthioClaimTypes, type AuthioClient, AuthioClientAssertionAlgorithms, type AuthioClientAuthentication, type AuthioClientCredentialsCache, type AuthioClientCredentialsSettings, type AuthioClientCredentialsToken, type AuthioClientOptions, type AuthioClock, type AuthioCodeChallengeMethod, AuthioConfigurationError, type AuthioConnection, type AuthioConnectionChoice, type AuthioConnectionExchangeResult, type AuthioConnectionGranted, type AuthioConnectionOptions, type AuthioConnectionRefused, type AuthioConnectionRequired, type AuthioConnectionSelectionRequired, AuthioContentEncryptionAlgorithms, type AuthioCredentialForm, AuthioDefaults, type AuthioDeviceAuthorization, type AuthioDevicePollOutcome, type AuthioDiscoveryClient, type AuthioDiscoveryDocument, AuthioDiscoveryError, type AuthioEncryptionKey, type AuthioEncryptionKeySource, type AuthioEndSessionRequest, AuthioError, type AuthioErrorResponse, type AuthioExternalAccount, AuthioGrantTypes, type AuthioIdTokenClaims, type AuthioIntrospectionResult, type AuthioJwtExpectations, AuthioKeyManagementAlgorithms, AuthioLegacyKeyManagementAlgorithms, type AuthioLogoutToken, AuthioOAuthErrors, type AuthioPkcePair, type AuthioPrivateKeyInput, type AuthioPrompt, AuthioPrompts, AuthioProtocolError, AuthioResourceAccess, AuthioResourceAccessClaims, type AuthioResourceAccessRole, type AuthioResourceAccessSource, AuthioScopes, type AuthioSecretSource, type AuthioSigningKeys, type AuthioTokenClient, type AuthioTokenDecrypter, type AuthioTokenDecrypterOptions, type AuthioTokenFailure, type AuthioTokenResponse, AuthioTokenTypes, AuthioTokenValidationError, type AuthioTypedWebhookEvent, type AuthioUserInfo, type AuthioWebhookAdminResource, type AuthioWebhookAdminResourceData, type AuthioWebhookAttackDetected, type AuthioWebhookAttackDetectedData, type AuthioWebhookCredentialCompromised, type AuthioWebhookCredentialCompromisedData, type AuthioWebhookDataByType, type AuthioWebhookEvent, AuthioWebhookEventTypes, AuthioWebhookHeaders, type AuthioWebhookKeysRotated, type AuthioWebhookKeysRotatedData, type AuthioWebhookLogin, type AuthioWebhookLoginData, type AuthioWebhookPing, type AuthioWebhookPingData, type AuthioWebhookTokenReuseDetected, type AuthioWebhookTokenReuseDetectedData, type AuthioWebhookTokenRevoked, type AuthioWebhookTokenRevokedData, type AuthioWebhookUser, type AuthioWebhookUserData, type AuthioWebhookUserLockedOut, type AuthioWebhookUserLockedOutData, type AuthioWebhookUserSuspension, type AuthioWebhookUserSuspensionData, type AuthioWebhookVerificationFailure, type AuthioWebhookVerificationResult, asAdminResourceEvent, asAttackDetectedEvent, asCredentialCompromisedEvent, asKeysRotatedEvent, asLoginEvent, asPingEvent, asTokenReuseDetectedEvent, asTokenRevokedEvent, asUserEvent, asUserLockedOutEvent, asUserSuspensionEvent, computeAuthioTokenHash, computeWebhookSignatureHeader, createAuthioAccountCredential, createAuthioClient, createAuthioDiscoveryClient, createAuthioPkce, createAuthioSigningKeys, createAuthioTokenDecrypter, encryptionKeyFromFile, escapeDataString, isAllowedUrl, isAuthioTokenEncrypted, isKnownWebhookEventType, isWebhookEventOfType, parseAuthioAdminEnvelope, parseAuthioBearerChallenge, parseResourceAccess, parseResourceAccessClaim, parseWebhookEvent, randomValue, readAuthioAdminResponse, readWebhookEventData, resolveConnection, resolveIssuer, resourceAccessSourceOf, seconds, systemClock, toBasicAuthorization, toCamelCasedMembers, toClientCredentialsToken, toConnectionExchangeResult, toCredentialClientId, toDevicePollOutcome, toScopeString, toTokenValidationError, tryParseWebhookEvent, verifyAuthioJwt, verifyWebhookSignature };
+export { type AuthioAccountCredential, type AuthioAccountCredentialKind, type AuthioAccountCredentialOptions, type AuthioAdminEnvelope, AuthioAdminError, type AuthioAdminFailure, type AuthioAdminNotification, type AuthioAdminSuccess, AuthioAsymmetricAlgorithms, type AuthioAuthorizationRequest, type AuthioAuthorizationResult, type AuthioAuthorizationTransaction, type AuthioAuthorizationUrl, type AuthioBearerChallenge, type AuthioCallOptions, AuthioCallbackError, type AuthioCallbackFailure, type AuthioCallerKind, AuthioCallerKinds, type AuthioCamelCase, type AuthioCamelCased, type AuthioCheck, AuthioChecks, AuthioClaimTypes, type AuthioClient, AuthioClientAssertionAlgorithms, type AuthioClientCredentialsCache, type AuthioClientCredentialsSettings, type AuthioClientCredentialsToken, type AuthioClientOptions, type AuthioClock, type AuthioCodeChallengeMethod, AuthioConfigurationError, type AuthioConnection, type AuthioConnectionChoice, type AuthioConnectionExchangeResult, type AuthioConnectionGranted, type AuthioConnectionOptions, type AuthioConnectionRefused, type AuthioConnectionRequired, type AuthioConnectionSelectionRequired, AuthioContentEncryptionAlgorithms, type AuthioCredentialForm, AuthioDefaults, type AuthioDeviceAuthorization, type AuthioDevicePollOutcome, type AuthioDiscoveryClient, type AuthioDiscoveryDocument, AuthioDiscoveryError, type AuthioEncryptionKey, type AuthioEncryptionKeySource, type AuthioEndSessionRequest, AuthioError, type AuthioErrorResponse, type AuthioExternalAccount, type AuthioFrontChannelLogout, AuthioGrantTypes, AuthioHmacAlgorithms, AuthioHmacMinimumSecretBytes, type AuthioIdTokenClaims, type AuthioIntrospectionResult, type AuthioJwtExpectations, AuthioKeyManagementAlgorithms, AuthioLegacyKeyManagementAlgorithms, type AuthioLogoutToken, AuthioOAuthErrors, type AuthioPkcePair, type AuthioPrivateKeyInput, type AuthioPrompt, AuthioPrompts, AuthioProtocolError, AuthioResourceAccess, AuthioResourceAccessClaims, type AuthioResourceAccessRole, type AuthioResourceAccessSource, type AuthioResponseMode, AuthioScopes, type AuthioSecretSource, type AuthioSigningKeys, AuthioSupportedContentEncryptionAlgorithms, type AuthioTokenClient, type AuthioTokenDecrypter, type AuthioTokenDecrypterOptions, type AuthioTokenEndpointAuthMethod, AuthioTokenEndpointAuthMethods, type AuthioTokenFailure, type AuthioTokenResponse, AuthioTokenTypes, AuthioTokenValidationError, type AuthioTypedWebhookEvent, type AuthioUserInfo, type AuthioWebhookAdminResource, type AuthioWebhookAdminResourceData, type AuthioWebhookAttackDetected, type AuthioWebhookAttackDetectedData, type AuthioWebhookCredentialCompromised, type AuthioWebhookCredentialCompromisedData, type AuthioWebhookDataByType, type AuthioWebhookEvent, AuthioWebhookEventTypes, AuthioWebhookHeaders, type AuthioWebhookKeysRotated, type AuthioWebhookKeysRotatedData, type AuthioWebhookLogin, type AuthioWebhookLoginData, type AuthioWebhookPing, type AuthioWebhookPingData, type AuthioWebhookTokenReuseDetected, type AuthioWebhookTokenReuseDetectedData, type AuthioWebhookTokenRevoked, type AuthioWebhookTokenRevokedData, type AuthioWebhookUser, type AuthioWebhookUserData, type AuthioWebhookUserLockedOut, type AuthioWebhookUserLockedOutData, type AuthioWebhookUserSuspension, type AuthioWebhookUserSuspensionData, type AuthioWebhookVerificationFailure, type AuthioWebhookVerificationResult, asAdminResourceEvent, asAttackDetectedEvent, asCredentialCompromisedEvent, asKeysRotatedEvent, asLoginEvent, asPingEvent, asTokenReuseDetectedEvent, asTokenRevokedEvent, asUserEvent, asUserLockedOutEvent, asUserSuspensionEvent, computeAuthioTokenHash, computeWebhookSignatureHeader, createAuthioAccountCredential, createAuthioClient, createAuthioDiscoveryClient, createAuthioPkce, createAuthioSigningKeys, createAuthioTokenDecrypter, encryptionKeyFromFile, escapeDataString, isAllowedUrl, isAuthioTokenEncrypted, isKnownWebhookEventType, isWebhookEventOfType, parseAuthioAdminEnvelope, parseAuthioBearerChallenge, parseResourceAccess, parseResourceAccessClaim, parseWebhookEvent, randomValue, readAuthioAdminResponse, readAuthioFrontChannelLogout, readWebhookEventData, requireHmacSecretLength, resolveConnection, resolveIssuer, resourceAccessSourceOf, seconds, systemClock, toBasicAuthorization, toCamelCasedMembers, toClientCredentialsToken, toConnectionExchangeResult, toCredentialClientId, toDevicePollOutcome, toScopeString, toTokenValidationError, tryParseWebhookEvent, verifyAuthioJwt, verifyWebhookSignature, withClientSecret };