@hyper.authio/client 0.7.0 → 0.8.1

package/dist/index.js

@@ -147,6 +147,8 @@ var AuthioAsymmetricAlgorithms = [
   "ES384",
   "ES512"
 ];
+var AuthioHmacAlgorithms = ["HS256", "HS384", "HS512"];
+var AuthioHmacMinimumSecretBytes = Object.freeze({ HS256: 32, HS384: 48, HS512: 64 });
 var AuthioDefaults = {
   DiscoveryPath: "/.well-known/openid-configuration",
   ProtectedResourceMetadataPath: "/.well-known/oauth-protected-resource",
@@ -278,6 +280,12 @@ var systemClock = {
     signal?.addEventListener("abort", onAbort, { once: true });
   })
 };
+var AuthioTokenEndpointAuthMethods = [
+  "client_secret_basic",
+  "client_secret_post",
+  "private_key_jwt",
+  "none"
+];
 function resolveConnection(options) {
   const requireHttps = options.requireHttps ?? true;
   const issuer = resolveIssuer(options);
@@ -593,7 +601,9 @@ function createClientAuthenticator(settings, connection) {
   const clientId = settings.clientId?.trim();
   if (!clientId) throw new AuthioConfigurationError("The Authio clientId is required.");
   const hasKey = settings.clientPrivateKey !== void 0 || !!settings.clientPrivateKeyPath;
-  const method = settings.clientAuthentication ?? (!settings.clientSecret && hasKey ? "private_key_jwt" : "client_secret_basic");
+  const method = settings.tokenEndpointAuthMethod ?? (settings.clientSecret ? "client_secret_basic" : hasKey ? "private_key_jwt" : "none");
+  if (!AuthioTokenEndpointAuthMethods.includes(method))
+    throw new AuthioConfigurationError(`The Authio tokenEndpointAuthMethod '${String(method)}' is not one of ${AuthioTokenEndpointAuthMethods.join(", ")}.`);
   if ((method === "client_secret_basic" || method === "client_secret_post") && !settings.clientSecret)
     throw new AuthioConfigurationError(`The Authio clientSecret is required with ${method}.`);
   if (method === "private_key_jwt" && !hasKey)
@@ -675,6 +685,7 @@ function createKeyLoader(settings) {
 var AuthioKeyManagementAlgorithms = ["RSA-OAEP", "RSA-OAEP-256"];
 var AuthioLegacyKeyManagementAlgorithms = ["RSA1_5"];
 var AuthioContentEncryptionAlgorithms = ["A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512"];
+var AuthioSupportedContentEncryptionAlgorithms = [...AuthioContentEncryptionAlgorithms, "A128GCM", "A192GCM", "A256GCM"];
 var rsaAlgorithmIdentifier = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
 function isAuthioTokenEncrypted(token) {
   return typeof token === "string" && token.split(".").length === 5;
@@ -682,6 +693,13 @@ function isAuthioTokenEncrypted(token) {
 function createAuthioTokenDecrypter(key, options = {}) {
   const settings = typeof options === "string" ? { setting: options } : options;
   const setting = settings.setting ?? "clientEncryptionKey";
+  const keyManagementAlgorithms = resolveAllowlist(settings.encryptionAlgorithms, AuthioKeyManagementAlgorithms, AuthioKeyManagementAlgorithms, "encryptionAlgorithms");
+  const contentEncryptionAlgorithms = resolveAllowlist(
+    settings.encryptionMethods,
+    AuthioContentEncryptionAlgorithms,
+    AuthioSupportedContentEncryptionAlgorithms,
+    "encryptionMethods"
+  );
   const imported = /* @__PURE__ */ new Map();
   const importFor = (algorithm) => {
     let pending = imported.get(algorithm);
@@ -700,10 +718,16 @@ function createAuthioTokenDecrypter(key, options = {}) {
         "legacy_algorithm",
         settings.allowLegacyEncryptionAlgorithms ? "The token is encrypted with RSA1_5 (PKCS#1 v1.5), which Node and WebCrypto cannot decrypt even with allowLegacyEncryptionAlgorithms; register RSA-OAEP-256 as the client's encryption algorithm in Authio." : "The token is encrypted with the legacy RSA1_5 algorithm, which is refused; register RSA-OAEP-256 as the client's encryption algorithm in Authio."
       );
-    if (!AuthioKeyManagementAlgorithms.includes(algorithm))
+    if (!keyManagementAlgorithms.includes(algorithm))
+      throw new AuthioTokenValidationError(
+        "decryption_failed",
+        `The token is encrypted with '${algorithm}', and encryptionAlgorithms accepts ${keyManagementAlgorithms.join(" or ")}.`
+      );
+    const method = contentMethodOf(token);
+    if (!contentEncryptionAlgorithms.includes(method))
       throw new AuthioTokenValidationError(
         "decryption_failed",
-        `The token is encrypted with '${algorithm}'; Authio encrypts with ${AuthioKeyManagementAlgorithms.join(" or ")}.`
+        `The token's content is encrypted with '${method}', and encryptionMethods accepts ${contentEncryptionAlgorithms.join(" or ")}.`
       );
     if (key === void 0 || key === null || key === "")
       throw new AuthioTokenValidationError(
@@ -712,8 +736,8 @@ function createAuthioTokenDecrypter(key, options = {}) {
       );
     try {
       const { plaintext } = await compactDecrypt(token, (header) => importFor(header.alg), {
-        keyManagementAlgorithms: [...AuthioKeyManagementAlgorithms],
-        contentEncryptionAlgorithms: [...AuthioContentEncryptionAlgorithms]
+        keyManagementAlgorithms: [...keyManagementAlgorithms],
+        contentEncryptionAlgorithms: [...contentEncryptionAlgorithms]
       });
       return new TextDecoder().decode(plaintext);
     } catch (error) {
@@ -747,6 +771,24 @@ function algorithmOf(token) {
     throw new AuthioTokenValidationError("decryption_failed", "The encrypted token's header could not be read.", { cause: error });
   }
 }
+function contentMethodOf(token) {
+  try {
+    return String(decodeProtectedHeader(token).enc ?? "");
+  } catch (error) {
+    throw new AuthioTokenValidationError("decryption_failed", "The encrypted token's header could not be read.", { cause: error });
+  }
+}
+function resolveAllowlist(configured, defaults, supported, setting) {
+  if (configured === void 0 || configured.length === 0) return defaults;
+  for (const value of configured) {
+    if (AuthioLegacyKeyManagementAlgorithms.includes(value))
+      throw new AuthioConfigurationError(
+        `${setting} cannot hold ${value}: Node and WebCrypto cannot decrypt PKCS#1 v1.5; register RSA-OAEP-256 as the client's encryption algorithm in Authio.`
+      );
+    if (!supported.includes(value)) throw new AuthioConfigurationError(`${setting} holds '${value}'; it accepts ${supported.join(", ")}.`);
+  }
+  return [...new Set(configured)];
+}
 async function importDecryptionKey(key, algorithm, setting) {
   try {
     if (typeof key !== "string") return await importPrivateJwk(key, algorithm, setting);
@@ -803,7 +845,7 @@ async function verifyAuthioJwt(token, keys, expected) {
   try {
     const { payload, protectedHeader } = await jwtVerify(token, keys, {
       issuer: expected.issuer,
-      audience: [...expected.audiences],
+      audience: expected.audiences ? [...expected.audiences] : void 0,
       algorithms: [...expected.algorithms && expected.algorithms.length > 0 ? expected.algorithms : AuthioAsymmetricAlgorithms],
       clockTolerance: expected.clockSkew ?? AuthioDefaults.ClockSkew,
       requiredClaims: [.../* @__PURE__ */ new Set(["exp", ...expected.requiredClaims ?? []])],
@@ -811,9 +853,34 @@ async function verifyAuthioJwt(token, keys, expected) {
     });
     return { payload, header: protectedHeader };
   } catch (error) {
-    throw toTokenValidationError(error, expected.audiences, token);
+    if (error instanceof AuthioConfigurationError) throw error;
+    throw toTokenValidationError(error, expected.audiences ?? [], token);
   }
 }
+function withClientSecret(keys, secret) {
+  if (!secret) return keys;
+  return async (header, token) => {
+    const algorithm = String(header.alg);
+    if (!AuthioHmacAlgorithms.includes(algorithm)) return keys(header, token);
+    const bytes = new TextEncoder().encode(await secret());
+    requireHmacSecretLength(algorithm, bytes.length);
+    return bytes;
+  };
+}
+function requireHmacSecretLength(algorithm, length) {
+  const minimum = AuthioHmacMinimumSecretBytes[algorithm];
+  if (minimum !== void 0 && length < minimum)
+    throw new AuthioConfigurationError(
+      `The Authio clientSecret has ${length} bytes, and ${algorithm} needs at least ${minimum} (RFC 7518 \xA73.2): Authio refuses a shorter secret for it.`
+    );
+}
+function acceptedSigningAlgorithms(configured, announced) {
+  if (configured) return [configured];
+  const asymmetric = (Array.isArray(announced) ? announced : []).filter(
+    (algorithm) => typeof algorithm === "string" && AuthioAsymmetricAlgorithms.includes(algorithm)
+  );
+  return asymmetric.length > 0 ? asymmetric : AuthioAsymmetricAlgorithms;
+}
 function toTokenValidationError(error, audiences, token) {
   if (error instanceof AuthioTokenValidationError) return error;
   const refuse = (reason, message) => new AuthioTokenValidationError(reason, message, { cause: error });
@@ -945,6 +1012,7 @@ function toBase64Url(bytes) {
 }
 
 // src/authorization.ts
+var AuthioChecks = ["pkce", "state", "nonce", "none"];
 async function createAuthioPkce(method = "S256") {
   if (method !== "S256" && method !== "plain") throw new TypeError(`The PKCE method '${String(method)}' is not S256 or plain.`);
   const codeVerifier = randomValue(32);
@@ -954,14 +1022,26 @@ async function createAuthioPkce(method = "S256") {
 function randomValue(bytes = 32) {
   return toBase64Url2(crypto.getRandomValues(new Uint8Array(bytes)));
 }
+function resolveChecks(checks, setting = "checks") {
+  const resolved = [];
+  for (const check of checks ?? []) {
+    if (!AuthioChecks.includes(check))
+      throw new AuthioConfigurationError(`The Authio ${setting} value '${String(check)}' is not one of ${AuthioChecks.join(", ")}.`);
+    if (check !== "none" && !resolved.includes(check)) resolved.push(check);
+  }
+  return Object.freeze(resolved);
+}
 async function buildAuthorizationUrl(endpoint, clientId, request) {
-  const pkce = await createAuthioPkce(request.codeChallengeMethod ?? "S256");
-  const state = request.state?.trim() || randomValue();
-  const nonce = request.nonce?.trim() || randomValue();
+  const checks = resolveChecks(request.checks);
+  const pkce = checks.includes("pkce") ? await createAuthioPkce(request.codeChallengeMethod ?? "S256") : void 0;
+  const state = checks.includes("state") ? request.state?.trim() || randomValue() : void 0;
+  const nonce = checks.includes("nonce") ? request.nonce?.trim() || randomValue() : void 0;
   if (request.maxAge !== void 0 && (!Number.isInteger(request.maxAge) || request.maxAge < 0))
     throw new RangeError("maxAge must be a non-negative whole number of seconds.");
   const display = request.popup ? "popup" : request.display;
   const responseMode = request.popup ? "web_message" : request.responseMode;
+  if (responseMode !== void 0 && responseMode !== "query" && responseMode !== "web_message")
+    throw new AuthioConfigurationError(`The Authio responseMode '${String(responseMode)}' is not query or web_message.`);
   const url = new URL(endpoint);
   const parameters = {
     ...request.extraParameters,
@@ -969,10 +1049,10 @@ async function buildAuthorizationUrl(endpoint, clientId, request) {
     client_id: clientId,
     redirect_uri: request.redirectUri,
     scope: toScopeString(request.scopes) ?? "openid",
-    state,
-    nonce,
-    code_challenge: pkce.codeChallenge,
-    code_challenge_method: pkce.codeChallengeMethod,
+    state: state ?? request.state?.trim(),
+    nonce: nonce ?? request.nonce?.trim(),
+    code_challenge: pkce?.codeChallenge,
+    code_challenge_method: pkce?.codeChallengeMethod,
     resource: request.resource,
     organization: request.organization,
     prompt: joined(request.prompt),
@@ -989,10 +1069,10 @@ async function buildAuthorizationUrl(endpoint, clientId, request) {
   return {
     url: url.toString(),
     transaction: Object.freeze({
-      state,
-      nonce,
-      codeVerifier: pkce.codeVerifier,
-      codeChallengeMethod: pkce.codeChallengeMethod,
+      checks,
+      ...state ? { state } : {},
+      ...nonce ? { nonce } : {},
+      ...pkce ? { codeVerifier: pkce.codeVerifier, codeChallengeMethod: pkce.codeChallengeMethod } : {},
       redirectUri: request.redirectUri,
       ...request.resource ? { resource: request.resource } : {},
       ...request.maxAge !== void 0 ? { maxAge: request.maxAge } : {}
@@ -1014,6 +1094,16 @@ function readCallbackParameters(callback) {
   }
   return parameters;
 }
+function readAuthioFrontChannelLogout(request, issuer) {
+  const parameters = readCallbackParameters(request);
+  const sessionId = parameters.sid?.trim() || void 0;
+  const sentIssuer = parameters.iss?.trim() || void 0;
+  if (sentIssuer !== void 0 && sentIssuer.replace(/\/+$/, "") !== issuer.replace(/\/+$/, ""))
+    throw new AuthioCallbackError("issuer_mismatch", `The front-channel logout comes from the issuer '${sentIssuer}', not '${issuer}'.`);
+  if (sessionId !== void 0 && sentIssuer === void 0)
+    throw new AuthioCallbackError("missing_issuer", "The front-channel logout names a sid without its iss.");
+  return Object.freeze({ sessionId, issuer: sentIssuer });
+}
 function parseAuthioBearerChallenge(header) {
   if (!header || !/^\s*bearer(\s|$)/i.test(header)) return void 0;
   const values = {};
@@ -1049,22 +1139,35 @@ function createAuthioClient(options) {
   const authenticator = createClientAuthenticator(options, connection);
   const refreshSkewMs = seconds(options.tokenRefreshSkew, AuthioDefaults.TokenRefreshSkew, "tokenRefreshSkew");
   const clockSkew = seconds(options.clockSkew, AuthioDefaults.ClockSkew, "clockSkew") / 1e3;
-  const decrypt = createAuthioTokenDecrypter(resolveEncryptionKey(options), {
+  const encryptionKey = resolveEncryptionKey(options);
+  const decrypt = createAuthioTokenDecrypter(encryptionKey, {
     setting: options.clientEncryptionKey === void 0 && options.clientEncryptionKeyPath ? "clientEncryptionKeyPath" : "clientEncryptionKey",
-    allowLegacyEncryptionAlgorithms: options.allowLegacyEncryptionAlgorithms
+    allowLegacyEncryptionAlgorithms: options.allowLegacyEncryptionAlgorithms,
+    encryptionAlgorithms: options.encryptionAlgorithms,
+    encryptionMethods: options.encryptionMethods
   });
+  const checks = resolveChecks(options.checks);
+  const codeChallengeMethod = resolveCodeChallengeMethod(options.codeChallengeMethod);
+  const responseMode = resolveResponseMode(options.responseMode);
+  const idTokenAlgorithm = resolveSigningAlgorithm(options.idTokenSignedResponseAlg, "idTokenSignedResponseAlg", options.clientSecret);
+  const userInfoAlgorithm = resolveSigningAlgorithm(options.userinfoSignedResponseAlg, "userinfoSignedResponseAlg", options.clientSecret) ?? idTokenAlgorithm;
+  const accessTokenAlgorithm = resolveSigningAlgorithm(options.accessTokenSignedResponseAlg, "accessTokenSignedResponseAlg", options.clientSecret);
+  const clientSecret = options.clientSecret === void 0 ? void 0 : () => readSecret(options.clientSecret);
   const signingKeys = createAuthioSigningKeys(connection, discovery);
   const tokens = createTokenClient(connection, discovery, authenticator);
   const clientCredentials = createClientCredentialsCache(connection, authenticator.clientId, tokens, refreshSkewMs);
-  const validationContext = async (signal) => ({
-    keys: await signingKeys(signal),
-    decrypt,
-    issuer: connection.issuer,
-    clientId: authenticator.clientId,
-    algorithms: options.validAlgorithms,
-    clockSkew,
-    now: connection.clock.now()
-  });
+  const validationContext = async (signal) => {
+    const document = await discovery.get(signal);
+    return {
+      keys: withClientSecret(await signingKeys(signal), clientSecret),
+      decrypt,
+      issuer: connection.issuer,
+      clientId: authenticator.clientId,
+      algorithms: acceptedSigningAlgorithms(idTokenAlgorithm, document.id_token_signing_alg_values_supported),
+      clockSkew,
+      now: connection.clock.now()
+    };
+  };
   const validateIdToken = async (idToken, expectations = {}) => {
     requireValue(idToken, "idToken");
     return validateAuthioIdToken(idToken, await validationContext(expectations.signal), expectations);
@@ -1073,7 +1176,13 @@ function createAuthioClient(options) {
     const redirectUri = request.redirectUri ?? options.redirectUri;
     requireValue(redirectUri, "redirectUri");
     const document = await discovery.get(request.signal);
-    return buildAuthorizationUrl(requireEndpoint(document, "authorization_endpoint"), authenticator.clientId, { ...request, redirectUri });
+    return buildAuthorizationUrl(requireEndpoint(document, "authorization_endpoint"), authenticator.clientId, {
+      ...request,
+      redirectUri,
+      checks: request.checks ?? checks,
+      codeChallengeMethod: request.codeChallengeMethod ?? codeChallengeMethod,
+      responseMode: request.responseMode ?? responseMode
+    });
   };
   return {
     issuer: connection.issuer,
@@ -1117,12 +1226,19 @@ function createAuthioClient(options) {
       );
       const mediaType = response.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase();
       if (response.ok && mediaType === "application/jwt")
-        return readUserInfoJwt((await response.text()).trim(), document, connection, authenticator.clientId, decrypt, signingKeys, {
-          algorithms: options.validAlgorithms,
-          clockSkew,
-          status: response.status,
-          signal: callOptions.signal
-        });
+        return readUserInfoJwt(
+          (await response.text()).trim(),
+          document,
+          connection,
+          authenticator.clientId,
+          decrypt,
+          withClientSecret(await signingKeys(callOptions.signal), clientSecret),
+          {
+            algorithms: acceptedSigningAlgorithms(userInfoAlgorithm, document.userinfo_signing_alg_values_supported ?? document.id_token_signing_alg_values_supported),
+            clockSkew,
+            status: response.status
+          }
+        );
       if (!response.ok) {
         const body = await response.text();
         const challenge = toErrorResponse(body) ? void 0 : readBearerChallenge(response);
@@ -1132,9 +1248,10 @@ function createAuthioClient(options) {
     },
     createAuthorizationUrl,
     async handleAuthorizationCallback(callback, transaction, callOptions = {}) {
-      if (!transaction?.state || !transaction.redirectUri) throw new TypeError("transaction is required: keep what createAuthorizationUrl returned.");
+      if (!transaction?.redirectUri || !Array.isArray(transaction.checks))
+        throw new TypeError("transaction is required: keep what createAuthorizationUrl returned.");
       const parameters = readCallbackParameters(callback);
-      if (parameters.state !== transaction.state)
+      if (transaction.checks.includes("state") && (!transaction.state || parameters.state !== transaction.state))
         throw new AuthioCallbackError("state_mismatch", "The callback's state is not the one this sign-in was started with.");
       const document = await discovery.get(callOptions.signal);
       if (parameters.iss !== void 0) {
@@ -1148,12 +1265,12 @@ function createAuthioClient(options) {
       const answer = await tokens.authorizationCode({
         code: parameters.code,
         redirectUri: transaction.redirectUri,
-        codeVerifier: transaction.codeVerifier,
+        codeVerifier: transaction.checks.includes("pkce") ? transaction.codeVerifier : void 0,
         resource: transaction.resource,
         signal: callOptions.signal
       });
       const idToken = answer.id_token ? await validateIdToken(answer.id_token, {
-        nonce: transaction.nonce,
+        nonce: transaction.checks.includes("nonce") ? transaction.nonce : void 0,
         accessToken: answer.access_token,
         maxAge: transaction.maxAge,
         signal: callOptions.signal
@@ -1165,6 +1282,23 @@ function createAuthioClient(options) {
       requireValue(logoutToken, "logoutToken");
       return validateAuthioLogoutToken(logoutToken, await validationContext(callOptions.signal));
     },
+    validateFrontChannelLogout(request) {
+      return readAuthioFrontChannelLogout(request, connection.issuer);
+    },
+    async readAccessTokenClaims(accessToken, callOptions = {}) {
+      requireValue(accessToken, "accessToken");
+      if (isAuthioTokenEncrypted(accessToken) && encryptionKey === void 0) return void 0;
+      const signed = await decrypt(accessToken);
+      if (signed.split(".").length !== 3) return void 0;
+      const document = await discovery.get(callOptions.signal);
+      const { payload } = await verifyAuthioJwt(signed, withClientSecret(await signingKeys(callOptions.signal), clientSecret), {
+        issuer: connection.issuer,
+        algorithms: acceptedSigningAlgorithms(accessTokenAlgorithm, document.id_token_signing_alg_values_supported),
+        clockSkew,
+        now: connection.clock.now()
+      });
+      return payload;
+    },
     async createEndSessionUrl(request = {}) {
       const document = await discovery.get(request.signal);
       const url = new URL(requireEndpoint(document, "end_session_endpoint"));
@@ -1203,13 +1337,16 @@ function createAuthioClient(options) {
         };
         const token = await clientCredentials.getToken({ ...key, signal: request.signal });
         const response = await attempt(token);
-        if (response.status !== 401) return response;
+        if (response.status !== 401 || isStepUpChallenge(response)) return response;
         clientCredentials.invalidate({ ...key, accessToken: token.accessToken });
         return attempt(await clientCredentials.getToken({ ...key, signal: request.signal }));
       };
     }
   };
 }
+function isStepUpChallenge(response) {
+  return parseAuthioBearerChallenge(response.headers.get("www-authenticate"))?.error === AuthioOAuthErrors.InsufficientUserAuthentication;
+}
 function createTokenClient(connection, discovery, authenticator) {
   const requestToken = async (parameters, signal, authenticate = true) => {
     const response = await postForm(connection, discovery, authenticate ? authenticator : void 0, "token_endpoint", parameters, signal);
@@ -1256,7 +1393,7 @@ function createTokenClient(connection, discovery, authenticator) {
     refresh: (options) => {
       requireValue(options?.refreshToken, "refreshToken");
       return requestToken(
-        { grant_type: AuthioGrantTypes.RefreshToken, refresh_token: options.refreshToken, scope: toScopeString(options.scopes) },
+        { grant_type: AuthioGrantTypes.RefreshToken, refresh_token: options.refreshToken, scope: toScopeString(options.scopes), resource: options.resource },
         options.signal
       );
     },
@@ -1451,10 +1588,10 @@ async function postForm(connection, discovery, authenticator, endpoint, paramete
   await authenticator?.apply(form, headers);
   return send(connection, url, { method: "POST", headers, body: form.toString() }, signal);
 }
-async function readUserInfoJwt(jwt, document, connection, clientId, decrypt, signingKeys, settings) {
+async function readUserInfoJwt(jwt, document, connection, clientId, decrypt, keys, settings) {
   try {
     const signed = isAuthioTokenEncrypted(jwt) ? await decrypt(jwt) : jwt;
-    const { payload } = await verifyAuthioJwt(signed, await signingKeys(settings.signal), {
+    const { payload } = await verifyAuthioJwt(signed, keys, {
       issuer: document.issuer.replace(/\/+$/, ""),
       audiences: [clientId],
       algorithms: settings.algorithms,
@@ -1486,6 +1623,33 @@ function readBearerChallenge(response) {
   }
   return error ? { error, description } : void 0;
 }
+function resolveCodeChallengeMethod(method) {
+  if (method !== void 0 && method !== "S256" && method !== "plain")
+    throw new AuthioConfigurationError(`The Authio codeChallengeMethod '${String(method)}' is not S256 or plain.`);
+  return method;
+}
+function resolveResponseMode(mode) {
+  if (mode !== void 0 && mode !== "query" && mode !== "web_message")
+    throw new AuthioConfigurationError(`The Authio responseMode '${String(mode)}' is not query or web_message.`);
+  return mode;
+}
+function resolveSigningAlgorithm(algorithm, setting, clientSecret) {
+  if (algorithm === void 0 || algorithm === "") return void 0;
+  const symmetric = AuthioHmacAlgorithms.includes(algorithm);
+  if (!symmetric && !AuthioAsymmetricAlgorithms.includes(algorithm))
+    throw new AuthioConfigurationError(
+      `The Authio ${setting} '${algorithm}' is not one of ${[...AuthioAsymmetricAlgorithms, ...AuthioHmacAlgorithms].join(", ")}.`
+    );
+  if (symmetric && !clientSecret)
+    throw new AuthioConfigurationError(`The Authio ${setting} ${algorithm} is verified with the client secret (OpenID Connect Core \xA710.1): set clientSecret.`);
+  if (symmetric && typeof clientSecret === "string") requireHmacSecretLength(algorithm, new TextEncoder().encode(clientSecret).length);
+  return algorithm;
+}
+async function readSecret(source) {
+  const value = typeof source === "function" ? await source() : source;
+  if (typeof value !== "string" || !value) throw new AuthioConfigurationError("The Authio clientSecret function returned no secret.");
+  return value;
+}
 function requireValue(value, name) {
   if (typeof value !== "string" || !value.trim()) throw new TypeError(`${name} is required.`);
 }
@@ -1538,7 +1702,7 @@ function createAuthioAccountCredential(options) {
       realm: AuthioDefaults.PlatformRealm,
       clientId: kind === "client_secret" ? toCredentialClientId(options.credentialId) : AuthioDefaults.PlatformClientId,
       clientSecret: kind === "client_secret" ? value : void 0,
-      clientAuthentication: kind === "client_secret" ? "client_secret_post" : "none"
+      tokenEndpointAuthMethod: kind === "client_secret" ? "client_secret_post" : "none"
     });
   }
   const exchange = async (signal) => {
@@ -1911,6 +2075,6 @@ function constantTimeEquals(left, right) {
   return difference === 0;
 }
 
-export { AuthioAdminError, AuthioAsymmetricAlgorithms, AuthioCallbackError, AuthioCallerKinds, AuthioClaimTypes, AuthioClientAssertionAlgorithms, AuthioConfigurationError, AuthioContentEncryptionAlgorithms, AuthioDefaults, AuthioDiscoveryError, AuthioError, AuthioGrantTypes, AuthioKeyManagementAlgorithms, AuthioLegacyKeyManagementAlgorithms, AuthioOAuthErrors, AuthioPrompts, AuthioProtocolError, AuthioResourceAccess, AuthioResourceAccessClaims, AuthioScopes, AuthioTokenTypes, AuthioTokenValidationError, AuthioWebhookEventTypes, AuthioWebhookHeaders, asAdminResourceEvent, asAttackDetectedEvent, asCredentialCompromisedEvent, asKeysRotatedEvent, asLoginEvent, asPingEvent, asTokenReuseDetectedEvent, asTokenRevokedEvent, asUserEvent, asUserLockedOutEvent, asUserSuspensionEvent, computeAuthioTokenHash, computeWebhookSignatureHeader, createAuthioAccountCredential, createAuthioClient, createAuthioDiscoveryClient, createAuthioPkce, createAuthioSigningKeys, createAuthioTokenDecrypter, encryptionKeyFromFile, escapeDataString, isAllowedUrl, isAuthioTokenEncrypted, isKnownWebhookEventType, isWebhookEventOfType, parseAuthioAdminEnvelope, parseAuthioBearerChallenge, parseResourceAccess, parseResourceAccessClaim, parseWebhookEvent, randomValue, readAuthioAdminResponse, readWebhookEventData, resolveConnection, resolveIssuer, resourceAccessSourceOf, seconds, systemClock, toBasicAuthorization, toCamelCasedMembers, toClientCredentialsToken, toConnectionExchangeResult, toCredentialClientId, toDevicePollOutcome, toScopeString, toTokenValidationError, tryParseWebhookEvent, verifyAuthioJwt, verifyWebhookSignature };
+export { AuthioAdminError, AuthioAsymmetricAlgorithms, AuthioCallbackError, AuthioCallerKinds, AuthioChecks, AuthioClaimTypes, AuthioClientAssertionAlgorithms, AuthioConfigurationError, AuthioContentEncryptionAlgorithms, AuthioDefaults, AuthioDiscoveryError, AuthioError, AuthioGrantTypes, AuthioHmacAlgorithms, AuthioHmacMinimumSecretBytes, AuthioKeyManagementAlgorithms, AuthioLegacyKeyManagementAlgorithms, AuthioOAuthErrors, AuthioPrompts, AuthioProtocolError, AuthioResourceAccess, AuthioResourceAccessClaims, AuthioScopes, AuthioSupportedContentEncryptionAlgorithms, AuthioTokenEndpointAuthMethods, AuthioTokenTypes, AuthioTokenValidationError, AuthioWebhookEventTypes, AuthioWebhookHeaders, asAdminResourceEvent, asAttackDetectedEvent, asCredentialCompromisedEvent, asKeysRotatedEvent, asLoginEvent, asPingEvent, asTokenReuseDetectedEvent, asTokenRevokedEvent, asUserEvent, asUserLockedOutEvent, asUserSuspensionEvent, computeAuthioTokenHash, computeWebhookSignatureHeader, createAuthioAccountCredential, createAuthioClient, createAuthioDiscoveryClient, createAuthioPkce, createAuthioSigningKeys, createAuthioTokenDecrypter, encryptionKeyFromFile, escapeDataString, isAllowedUrl, isAuthioTokenEncrypted, isKnownWebhookEventType, isWebhookEventOfType, parseAuthioAdminEnvelope, parseAuthioBearerChallenge, parseResourceAccess, parseResourceAccessClaim, parseWebhookEvent, randomValue, readAuthioAdminResponse, readAuthioFrontChannelLogout, readWebhookEventData, requireHmacSecretLength, resolveConnection, resolveIssuer, resourceAccessSourceOf, seconds, systemClock, toBasicAuthorization, toCamelCasedMembers, toClientCredentialsToken, toConnectionExchangeResult, toCredentialClientId, toDevicePollOutcome, toScopeString, toTokenValidationError, tryParseWebhookEvent, verifyAuthioJwt, verifyWebhookSignature, withClientSecret };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map