@hyper.authio/client 0.8.0 → 0.9.0

package/dist/index.d.cts

@@ -151,6 +151,10 @@ declare const AuthioWebhookEventTypes: {
     readonly UserSuspensionEnded: "user_suspension_ended";
     readonly AttackDetected: "attack_detected";
     readonly CredentialCompromised: "credential_compromised";
+    readonly UserAuthenticatorAppEnrolled: "user_authenticator_app_enrolled";
+    readonly UserAuthenticatorAppRemoved: "user_authenticator_app_removed";
+    readonly UserRecoveryCodesRegenerated: "user_recovery_codes_regenerated";
+    readonly UserRecoveryCodeUsed: "user_recovery_code_used";
     readonly Ping: "ping";
 };
 /**
@@ -216,6 +220,8 @@ declare const AuthioDefaults: {
     readonly CredentialClientIdPrefix: "cred_";
     readonly ApiKeyHeader: "x-api-key";
     readonly RequestIdHeader: "X-Request-Id";
+    /** The header `typ` of an access token (RFC 9068 §2.1). */
+    readonly AccessTokenType: "at+jwt";
     /** The header `typ` of a back-channel logout token. */
     readonly LogoutTokenType: "logout+jwt";
     /** The event a back-channel logout token carries. */
@@ -717,6 +723,15 @@ declare function toTokenValidationError(error: unknown, audiences: readonly stri
  * digest, base64url-encoded (OpenID Connect Core §3.1.3.6).
  */
 declare function computeAuthioTokenHash(value: string, algorithm: string): Promise<string>;
+/**
+ * Requires the header `typ` of an access token to be `at+jwt` (or `application/at+jwt`), as RFC 9068 §4 asks a
+ * resource server to check, so an ID token or any other JWT is never taken for an access token.
+ *
+ * @param header The protected header of the verified token.
+ * @throws AuthioTokenValidationError with the reason `not_access_token` otherwise.
+ * @internal
+ */
+declare function requireAccessTokenType(header: Record<string, unknown>): void;
 
 /**
  * The PKCE method (RFC 7636). `S256` is the default; `plain` only when asked for, for a client that cannot hash.
@@ -853,7 +868,9 @@ interface AuthioFrontChannelLogout {
  */
 declare function readAuthioFrontChannelLogout(request: string | URL | URLSearchParams | Readonly<Record<string, unknown>>, issuer: string): AuthioFrontChannelLogout;
 /**
- * Parses a `WWW-Authenticate` bearer challenge, or `undefined` when the header holds none.
+ * Parses a `WWW-Authenticate` bearer challenge, or `undefined` when the header holds none. It reads the header only,
+ * whatever the status: a step-up challenge (`insufficient_user_authentication`) comes with `401` (RFC 9470 §3), or
+ * with `403` from servers before `@hyper.authio/server` 0.8.1 and `@hyper.authio/mcp` 0.4.1.
  */
 declare function parseAuthioBearerChallenge(header: string | null | undefined): AuthioBearerChallenge | undefined;
 
@@ -1167,7 +1184,8 @@ interface AuthioTokenClient {
     } & AuthioCallOptions): Promise<AuthioTokenResponse>;
     /**
      * The `personal_access_token` grant: a `pat_` value presented as `client_secret`, with the consumer's client id for
-     * a consumer's token or none for an account's token. The client's own credentials are not sent.
+     * a consumer's token or the platform client (`AuthioDefaults.PlatformClientId`) for an account's token. The client's
+     * own credentials are not sent.
      */
     personalAccessToken(options: {
         token: string;
@@ -1279,7 +1297,8 @@ interface AuthioClient {
     validateFrontChannelLogout(request: string | URL | URLSearchParams | Readonly<Record<string, unknown>>): AuthioFrontChannelLogout;
     /**
      * Reads an access token this client received from Authio: decrypted with `clientEncryptionKey` when it is a JWE,
-     * then its signature (with `accessTokenSignedResponseAlg`), `iss` and `exp` checked. Its audience is the API's, so it is not checked. `undefined` for an
+     * then its signature (with `accessTokenSignedResponseAlg`), `iss`, `exp` and the header `typ` `at+jwt` (RFC 9068 §4)
+     * checked. Its audience is the API's, so it is not checked. `undefined` for an
      * opaque token, or an encrypted one without `clientEncryptionKey`.
      *
      * @throws AuthioTokenValidationError naming why it was refused.
@@ -1489,6 +1508,10 @@ interface AuthioWebhookEvent {
     /** Seconds since the epoch. */
     readonly created_at: number;
     readonly realm_id?: string | null;
+    /**
+     * The client the event came through. On a realm endpoint, `null` when there is none, such as a person created in
+     * the realm.
+     */
     readonly client_id?: string | null;
     readonly data: unknown;
     [member: string]: unknown;
@@ -1619,6 +1642,19 @@ interface AuthioWebhookCredentialCompromisedData {
     network_operator?: string | null;
     password_change_required?: boolean | null;
 }
+/**
+ * `user_authenticator_app_enrolled`, `user_authenticator_app_removed`, `user_recovery_codes_regenerated` and
+ * `user_recovery_code_used`, as delivered: a change to a person's authenticator app, never a code nor the secret.
+ */
+interface AuthioWebhookAuthenticatorAppData {
+    user_id: string;
+    username?: string | null;
+    email?: string | null;
+    /** Who made the change: `user`, or `administrator` when an administrator reset the app. */
+    actor?: string | null;
+    /** The recovery codes the account has left after the change. */
+    recovery_codes_remaining?: number | null;
+}
 /** `ping`, as delivered. */
 interface AuthioWebhookPingData {
     message?: string | null;
@@ -1644,6 +1680,10 @@ interface AuthioWebhookDataByType {
     user_suspension_ended: AuthioWebhookUserSuspensionData;
     attack_detected: AuthioWebhookAttackDetectedData;
     credential_compromised: AuthioWebhookCredentialCompromisedData;
+    user_authenticator_app_enrolled: AuthioWebhookAuthenticatorAppData;
+    user_authenticator_app_removed: AuthioWebhookAuthenticatorAppData;
+    user_recovery_codes_regenerated: AuthioWebhookAuthenticatorAppData;
+    user_recovery_code_used: AuthioWebhookAuthenticatorAppData;
     ping: AuthioWebhookPingData;
 }
 /**
@@ -1676,6 +1716,8 @@ type AuthioWebhookUserSuspension = AuthioCamelCased<AuthioWebhookUserSuspensionD
 type AuthioWebhookAttackDetected = AuthioCamelCased<AuthioWebhookAttackDetectedData>;
 /** The data of a compromised credential event, as the typed accessor exposes it. */
 type AuthioWebhookCredentialCompromised = AuthioCamelCased<AuthioWebhookCredentialCompromisedData>;
+/** The data of an authenticator app event, as the typed accessor exposes it. */
+type AuthioWebhookAuthenticatorApp = AuthioCamelCased<AuthioWebhookAuthenticatorAppData>;
 /** The data of a ping, as the typed accessor exposes it. */
 type AuthioWebhookPing = AuthioCamelCased<AuthioWebhookPingData>;
 /**
@@ -1739,6 +1781,8 @@ declare const asUserSuspensionEvent: (event: AuthioWebhookEvent) => AuthioCamelC
 declare const asAttackDetectedEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookAttackDetectedData> | undefined;
 /** The data of a compromised credential event in camelCase, or `undefined` for any other type. */
 declare const asCredentialCompromisedEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookCredentialCompromisedData> | undefined;
+/** The data of an authenticator app event in camelCase, or `undefined` for any other type. */
+declare const asAuthenticatorAppEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookAuthenticatorAppData> | undefined;
 /** The data of a ping in camelCase, or `undefined` for any other type. */
 declare const asPingEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookPingData> | undefined;
 /**
@@ -1755,4 +1799,4 @@ declare function readWebhookEventData(event: AuthioWebhookEvent): Record<string,
  */
 declare function toCamelCasedMembers<T extends object>(value: T): AuthioCamelCased<T>;
 
-export { type AuthioAccountCredential, type AuthioAccountCredentialKind, type AuthioAccountCredentialOptions, type AuthioAdminEnvelope, AuthioAdminError, type AuthioAdminFailure, type AuthioAdminNotification, type AuthioAdminSuccess, AuthioAsymmetricAlgorithms, type AuthioAuthorizationRequest, type AuthioAuthorizationResult, type AuthioAuthorizationTransaction, type AuthioAuthorizationUrl, type AuthioBearerChallenge, type AuthioCallOptions, AuthioCallbackError, type AuthioCallbackFailure, type AuthioCallerKind, AuthioCallerKinds, type AuthioCamelCase, type AuthioCamelCased, type AuthioCheck, AuthioChecks, AuthioClaimTypes, type AuthioClient, AuthioClientAssertionAlgorithms, type AuthioClientCredentialsCache, type AuthioClientCredentialsSettings, type AuthioClientCredentialsToken, type AuthioClientOptions, type AuthioClock, type AuthioCodeChallengeMethod, AuthioConfigurationError, type AuthioConnection, type AuthioConnectionChoice, type AuthioConnectionExchangeResult, type AuthioConnectionGranted, type AuthioConnectionOptions, type AuthioConnectionRefused, type AuthioConnectionRequired, type AuthioConnectionSelectionRequired, AuthioContentEncryptionAlgorithms, type AuthioCredentialForm, AuthioDefaults, type AuthioDeviceAuthorization, type AuthioDevicePollOutcome, type AuthioDiscoveryClient, type AuthioDiscoveryDocument, AuthioDiscoveryError, type AuthioEncryptionKey, type AuthioEncryptionKeySource, type AuthioEndSessionRequest, AuthioError, type AuthioErrorResponse, type AuthioExternalAccount, type AuthioFrontChannelLogout, AuthioGrantTypes, AuthioHmacAlgorithms, AuthioHmacMinimumSecretBytes, type AuthioIdTokenClaims, type AuthioIntrospectionResult, type AuthioJwtExpectations, AuthioKeyManagementAlgorithms, AuthioLegacyKeyManagementAlgorithms, type AuthioLogoutToken, AuthioOAuthErrors, type AuthioPkcePair, type AuthioPrivateKeyInput, type AuthioPrompt, AuthioPrompts, AuthioProtocolError, AuthioResourceAccess, AuthioResourceAccessClaims, type AuthioResourceAccessRole, type AuthioResourceAccessSource, type AuthioResponseMode, AuthioScopes, type AuthioSecretSource, type AuthioSigningKeys, AuthioSupportedContentEncryptionAlgorithms, type AuthioTokenClient, type AuthioTokenDecrypter, type AuthioTokenDecrypterOptions, type AuthioTokenEndpointAuthMethod, AuthioTokenEndpointAuthMethods, type AuthioTokenFailure, type AuthioTokenResponse, AuthioTokenTypes, AuthioTokenValidationError, type AuthioTypedWebhookEvent, type AuthioUserInfo, type AuthioWebhookAdminResource, type AuthioWebhookAdminResourceData, type AuthioWebhookAttackDetected, type AuthioWebhookAttackDetectedData, type AuthioWebhookCredentialCompromised, type AuthioWebhookCredentialCompromisedData, type AuthioWebhookDataByType, type AuthioWebhookEvent, AuthioWebhookEventTypes, AuthioWebhookHeaders, type AuthioWebhookKeysRotated, type AuthioWebhookKeysRotatedData, type AuthioWebhookLogin, type AuthioWebhookLoginData, type AuthioWebhookPing, type AuthioWebhookPingData, type AuthioWebhookTokenReuseDetected, type AuthioWebhookTokenReuseDetectedData, type AuthioWebhookTokenRevoked, type AuthioWebhookTokenRevokedData, type AuthioWebhookUser, type AuthioWebhookUserData, type AuthioWebhookUserLockedOut, type AuthioWebhookUserLockedOutData, type AuthioWebhookUserSuspension, type AuthioWebhookUserSuspensionData, type AuthioWebhookVerificationFailure, type AuthioWebhookVerificationResult, asAdminResourceEvent, asAttackDetectedEvent, asCredentialCompromisedEvent, asKeysRotatedEvent, asLoginEvent, asPingEvent, asTokenReuseDetectedEvent, asTokenRevokedEvent, asUserEvent, asUserLockedOutEvent, asUserSuspensionEvent, computeAuthioTokenHash, computeWebhookSignatureHeader, createAuthioAccountCredential, createAuthioClient, createAuthioDiscoveryClient, createAuthioPkce, createAuthioSigningKeys, createAuthioTokenDecrypter, encryptionKeyFromFile, escapeDataString, isAllowedUrl, isAuthioTokenEncrypted, isKnownWebhookEventType, isWebhookEventOfType, parseAuthioAdminEnvelope, parseAuthioBearerChallenge, parseResourceAccess, parseResourceAccessClaim, parseWebhookEvent, randomValue, readAuthioAdminResponse, readAuthioFrontChannelLogout, readWebhookEventData, requireHmacSecretLength, resolveConnection, resolveIssuer, resourceAccessSourceOf, seconds, systemClock, toBasicAuthorization, toCamelCasedMembers, toClientCredentialsToken, toConnectionExchangeResult, toCredentialClientId, toDevicePollOutcome, toScopeString, toTokenValidationError, tryParseWebhookEvent, verifyAuthioJwt, verifyWebhookSignature, withClientSecret };
+export { type AuthioAccountCredential, type AuthioAccountCredentialKind, type AuthioAccountCredentialOptions, type AuthioAdminEnvelope, AuthioAdminError, type AuthioAdminFailure, type AuthioAdminNotification, type AuthioAdminSuccess, AuthioAsymmetricAlgorithms, type AuthioAuthorizationRequest, type AuthioAuthorizationResult, type AuthioAuthorizationTransaction, type AuthioAuthorizationUrl, type AuthioBearerChallenge, type AuthioCallOptions, AuthioCallbackError, type AuthioCallbackFailure, type AuthioCallerKind, AuthioCallerKinds, type AuthioCamelCase, type AuthioCamelCased, type AuthioCheck, AuthioChecks, AuthioClaimTypes, type AuthioClient, AuthioClientAssertionAlgorithms, type AuthioClientCredentialsCache, type AuthioClientCredentialsSettings, type AuthioClientCredentialsToken, type AuthioClientOptions, type AuthioClock, type AuthioCodeChallengeMethod, AuthioConfigurationError, type AuthioConnection, type AuthioConnectionChoice, type AuthioConnectionExchangeResult, type AuthioConnectionGranted, type AuthioConnectionOptions, type AuthioConnectionRefused, type AuthioConnectionRequired, type AuthioConnectionSelectionRequired, AuthioContentEncryptionAlgorithms, type AuthioCredentialForm, AuthioDefaults, type AuthioDeviceAuthorization, type AuthioDevicePollOutcome, type AuthioDiscoveryClient, type AuthioDiscoveryDocument, AuthioDiscoveryError, type AuthioEncryptionKey, type AuthioEncryptionKeySource, type AuthioEndSessionRequest, AuthioError, type AuthioErrorResponse, type AuthioExternalAccount, type AuthioFrontChannelLogout, AuthioGrantTypes, AuthioHmacAlgorithms, AuthioHmacMinimumSecretBytes, type AuthioIdTokenClaims, type AuthioIntrospectionResult, type AuthioJwtExpectations, AuthioKeyManagementAlgorithms, AuthioLegacyKeyManagementAlgorithms, type AuthioLogoutToken, AuthioOAuthErrors, type AuthioPkcePair, type AuthioPrivateKeyInput, type AuthioPrompt, AuthioPrompts, AuthioProtocolError, AuthioResourceAccess, AuthioResourceAccessClaims, type AuthioResourceAccessRole, type AuthioResourceAccessSource, type AuthioResponseMode, AuthioScopes, type AuthioSecretSource, type AuthioSigningKeys, AuthioSupportedContentEncryptionAlgorithms, type AuthioTokenClient, type AuthioTokenDecrypter, type AuthioTokenDecrypterOptions, type AuthioTokenEndpointAuthMethod, AuthioTokenEndpointAuthMethods, type AuthioTokenFailure, type AuthioTokenResponse, AuthioTokenTypes, AuthioTokenValidationError, type AuthioTypedWebhookEvent, type AuthioUserInfo, type AuthioWebhookAdminResource, type AuthioWebhookAdminResourceData, type AuthioWebhookAttackDetected, type AuthioWebhookAttackDetectedData, type AuthioWebhookAuthenticatorApp, type AuthioWebhookAuthenticatorAppData, type AuthioWebhookCredentialCompromised, type AuthioWebhookCredentialCompromisedData, type AuthioWebhookDataByType, type AuthioWebhookEvent, AuthioWebhookEventTypes, AuthioWebhookHeaders, type AuthioWebhookKeysRotated, type AuthioWebhookKeysRotatedData, type AuthioWebhookLogin, type AuthioWebhookLoginData, type AuthioWebhookPing, type AuthioWebhookPingData, type AuthioWebhookTokenReuseDetected, type AuthioWebhookTokenReuseDetectedData, type AuthioWebhookTokenRevoked, type AuthioWebhookTokenRevokedData, type AuthioWebhookUser, type AuthioWebhookUserData, type AuthioWebhookUserLockedOut, type AuthioWebhookUserLockedOutData, type AuthioWebhookUserSuspension, type AuthioWebhookUserSuspensionData, type AuthioWebhookVerificationFailure, type AuthioWebhookVerificationResult, asAdminResourceEvent, asAttackDetectedEvent, asAuthenticatorAppEvent, asCredentialCompromisedEvent, asKeysRotatedEvent, asLoginEvent, asPingEvent, asTokenReuseDetectedEvent, asTokenRevokedEvent, asUserEvent, asUserLockedOutEvent, asUserSuspensionEvent, computeAuthioTokenHash, computeWebhookSignatureHeader, createAuthioAccountCredential, createAuthioClient, createAuthioDiscoveryClient, createAuthioPkce, createAuthioSigningKeys, createAuthioTokenDecrypter, encryptionKeyFromFile, escapeDataString, isAllowedUrl, isAuthioTokenEncrypted, isKnownWebhookEventType, isWebhookEventOfType, parseAuthioAdminEnvelope, parseAuthioBearerChallenge, parseResourceAccess, parseResourceAccessClaim, parseWebhookEvent, randomValue, readAuthioAdminResponse, readAuthioFrontChannelLogout, readWebhookEventData, requireAccessTokenType, requireHmacSecretLength, resolveConnection, resolveIssuer, resourceAccessSourceOf, seconds, systemClock, toBasicAuthorization, toCamelCasedMembers, toClientCredentialsToken, toConnectionExchangeResult, toCredentialClientId, toDevicePollOutcome, toScopeString, toTokenValidationError, tryParseWebhookEvent, verifyAuthioJwt, verifyWebhookSignature, withClientSecret };

package/dist/index.d.ts

@@ -151,6 +151,10 @@ declare const AuthioWebhookEventTypes: {
     readonly UserSuspensionEnded: "user_suspension_ended";
     readonly AttackDetected: "attack_detected";
     readonly CredentialCompromised: "credential_compromised";
+    readonly UserAuthenticatorAppEnrolled: "user_authenticator_app_enrolled";
+    readonly UserAuthenticatorAppRemoved: "user_authenticator_app_removed";
+    readonly UserRecoveryCodesRegenerated: "user_recovery_codes_regenerated";
+    readonly UserRecoveryCodeUsed: "user_recovery_code_used";
     readonly Ping: "ping";
 };
 /**
@@ -216,6 +220,8 @@ declare const AuthioDefaults: {
     readonly CredentialClientIdPrefix: "cred_";
     readonly ApiKeyHeader: "x-api-key";
     readonly RequestIdHeader: "X-Request-Id";
+    /** The header `typ` of an access token (RFC 9068 §2.1). */
+    readonly AccessTokenType: "at+jwt";
     /** The header `typ` of a back-channel logout token. */
     readonly LogoutTokenType: "logout+jwt";
     /** The event a back-channel logout token carries. */
@@ -717,6 +723,15 @@ declare function toTokenValidationError(error: unknown, audiences: readonly stri
  * digest, base64url-encoded (OpenID Connect Core §3.1.3.6).
  */
 declare function computeAuthioTokenHash(value: string, algorithm: string): Promise<string>;
+/**
+ * Requires the header `typ` of an access token to be `at+jwt` (or `application/at+jwt`), as RFC 9068 §4 asks a
+ * resource server to check, so an ID token or any other JWT is never taken for an access token.
+ *
+ * @param header The protected header of the verified token.
+ * @throws AuthioTokenValidationError with the reason `not_access_token` otherwise.
+ * @internal
+ */
+declare function requireAccessTokenType(header: Record<string, unknown>): void;
 
 /**
  * The PKCE method (RFC 7636). `S256` is the default; `plain` only when asked for, for a client that cannot hash.
@@ -853,7 +868,9 @@ interface AuthioFrontChannelLogout {
  */
 declare function readAuthioFrontChannelLogout(request: string | URL | URLSearchParams | Readonly<Record<string, unknown>>, issuer: string): AuthioFrontChannelLogout;
 /**
- * Parses a `WWW-Authenticate` bearer challenge, or `undefined` when the header holds none.
+ * Parses a `WWW-Authenticate` bearer challenge, or `undefined` when the header holds none. It reads the header only,
+ * whatever the status: a step-up challenge (`insufficient_user_authentication`) comes with `401` (RFC 9470 §3), or
+ * with `403` from servers before `@hyper.authio/server` 0.8.1 and `@hyper.authio/mcp` 0.4.1.
  */
 declare function parseAuthioBearerChallenge(header: string | null | undefined): AuthioBearerChallenge | undefined;
 
@@ -1167,7 +1184,8 @@ interface AuthioTokenClient {
     } & AuthioCallOptions): Promise<AuthioTokenResponse>;
     /**
      * The `personal_access_token` grant: a `pat_` value presented as `client_secret`, with the consumer's client id for
-     * a consumer's token or none for an account's token. The client's own credentials are not sent.
+     * a consumer's token or the platform client (`AuthioDefaults.PlatformClientId`) for an account's token. The client's
+     * own credentials are not sent.
      */
     personalAccessToken(options: {
         token: string;
@@ -1279,7 +1297,8 @@ interface AuthioClient {
     validateFrontChannelLogout(request: string | URL | URLSearchParams | Readonly<Record<string, unknown>>): AuthioFrontChannelLogout;
     /**
      * Reads an access token this client received from Authio: decrypted with `clientEncryptionKey` when it is a JWE,
-     * then its signature (with `accessTokenSignedResponseAlg`), `iss` and `exp` checked. Its audience is the API's, so it is not checked. `undefined` for an
+     * then its signature (with `accessTokenSignedResponseAlg`), `iss`, `exp` and the header `typ` `at+jwt` (RFC 9068 §4)
+     * checked. Its audience is the API's, so it is not checked. `undefined` for an
      * opaque token, or an encrypted one without `clientEncryptionKey`.
      *
      * @throws AuthioTokenValidationError naming why it was refused.
@@ -1489,6 +1508,10 @@ interface AuthioWebhookEvent {
     /** Seconds since the epoch. */
     readonly created_at: number;
     readonly realm_id?: string | null;
+    /**
+     * The client the event came through. On a realm endpoint, `null` when there is none, such as a person created in
+     * the realm.
+     */
     readonly client_id?: string | null;
     readonly data: unknown;
     [member: string]: unknown;
@@ -1619,6 +1642,19 @@ interface AuthioWebhookCredentialCompromisedData {
     network_operator?: string | null;
     password_change_required?: boolean | null;
 }
+/**
+ * `user_authenticator_app_enrolled`, `user_authenticator_app_removed`, `user_recovery_codes_regenerated` and
+ * `user_recovery_code_used`, as delivered: a change to a person's authenticator app, never a code nor the secret.
+ */
+interface AuthioWebhookAuthenticatorAppData {
+    user_id: string;
+    username?: string | null;
+    email?: string | null;
+    /** Who made the change: `user`, or `administrator` when an administrator reset the app. */
+    actor?: string | null;
+    /** The recovery codes the account has left after the change. */
+    recovery_codes_remaining?: number | null;
+}
 /** `ping`, as delivered. */
 interface AuthioWebhookPingData {
     message?: string | null;
@@ -1644,6 +1680,10 @@ interface AuthioWebhookDataByType {
     user_suspension_ended: AuthioWebhookUserSuspensionData;
     attack_detected: AuthioWebhookAttackDetectedData;
     credential_compromised: AuthioWebhookCredentialCompromisedData;
+    user_authenticator_app_enrolled: AuthioWebhookAuthenticatorAppData;
+    user_authenticator_app_removed: AuthioWebhookAuthenticatorAppData;
+    user_recovery_codes_regenerated: AuthioWebhookAuthenticatorAppData;
+    user_recovery_code_used: AuthioWebhookAuthenticatorAppData;
     ping: AuthioWebhookPingData;
 }
 /**
@@ -1676,6 +1716,8 @@ type AuthioWebhookUserSuspension = AuthioCamelCased<AuthioWebhookUserSuspensionD
 type AuthioWebhookAttackDetected = AuthioCamelCased<AuthioWebhookAttackDetectedData>;
 /** The data of a compromised credential event, as the typed accessor exposes it. */
 type AuthioWebhookCredentialCompromised = AuthioCamelCased<AuthioWebhookCredentialCompromisedData>;
+/** The data of an authenticator app event, as the typed accessor exposes it. */
+type AuthioWebhookAuthenticatorApp = AuthioCamelCased<AuthioWebhookAuthenticatorAppData>;
 /** The data of a ping, as the typed accessor exposes it. */
 type AuthioWebhookPing = AuthioCamelCased<AuthioWebhookPingData>;
 /**
@@ -1739,6 +1781,8 @@ declare const asUserSuspensionEvent: (event: AuthioWebhookEvent) => AuthioCamelC
 declare const asAttackDetectedEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookAttackDetectedData> | undefined;
 /** The data of a compromised credential event in camelCase, or `undefined` for any other type. */
 declare const asCredentialCompromisedEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookCredentialCompromisedData> | undefined;
+/** The data of an authenticator app event in camelCase, or `undefined` for any other type. */
+declare const asAuthenticatorAppEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookAuthenticatorAppData> | undefined;
 /** The data of a ping in camelCase, or `undefined` for any other type. */
 declare const asPingEvent: (event: AuthioWebhookEvent) => AuthioCamelCased<AuthioWebhookPingData> | undefined;
 /**
@@ -1755,4 +1799,4 @@ declare function readWebhookEventData(event: AuthioWebhookEvent): Record<string,
  */
 declare function toCamelCasedMembers<T extends object>(value: T): AuthioCamelCased<T>;
 
-export { type AuthioAccountCredential, type AuthioAccountCredentialKind, type AuthioAccountCredentialOptions, type AuthioAdminEnvelope, AuthioAdminError, type AuthioAdminFailure, type AuthioAdminNotification, type AuthioAdminSuccess, AuthioAsymmetricAlgorithms, type AuthioAuthorizationRequest, type AuthioAuthorizationResult, type AuthioAuthorizationTransaction, type AuthioAuthorizationUrl, type AuthioBearerChallenge, type AuthioCallOptions, AuthioCallbackError, type AuthioCallbackFailure, type AuthioCallerKind, AuthioCallerKinds, type AuthioCamelCase, type AuthioCamelCased, type AuthioCheck, AuthioChecks, AuthioClaimTypes, type AuthioClient, AuthioClientAssertionAlgorithms, type AuthioClientCredentialsCache, type AuthioClientCredentialsSettings, type AuthioClientCredentialsToken, type AuthioClientOptions, type AuthioClock, type AuthioCodeChallengeMethod, AuthioConfigurationError, type AuthioConnection, type AuthioConnectionChoice, type AuthioConnectionExchangeResult, type AuthioConnectionGranted, type AuthioConnectionOptions, type AuthioConnectionRefused, type AuthioConnectionRequired, type AuthioConnectionSelectionRequired, AuthioContentEncryptionAlgorithms, type AuthioCredentialForm, AuthioDefaults, type AuthioDeviceAuthorization, type AuthioDevicePollOutcome, type AuthioDiscoveryClient, type AuthioDiscoveryDocument, AuthioDiscoveryError, type AuthioEncryptionKey, type AuthioEncryptionKeySource, type AuthioEndSessionRequest, AuthioError, type AuthioErrorResponse, type AuthioExternalAccount, type AuthioFrontChannelLogout, AuthioGrantTypes, AuthioHmacAlgorithms, AuthioHmacMinimumSecretBytes, type AuthioIdTokenClaims, type AuthioIntrospectionResult, type AuthioJwtExpectations, AuthioKeyManagementAlgorithms, AuthioLegacyKeyManagementAlgorithms, type AuthioLogoutToken, AuthioOAuthErrors, type AuthioPkcePair, type AuthioPrivateKeyInput, type AuthioPrompt, AuthioPrompts, AuthioProtocolError, AuthioResourceAccess, AuthioResourceAccessClaims, type AuthioResourceAccessRole, type AuthioResourceAccessSource, type AuthioResponseMode, AuthioScopes, type AuthioSecretSource, type AuthioSigningKeys, AuthioSupportedContentEncryptionAlgorithms, type AuthioTokenClient, type AuthioTokenDecrypter, type AuthioTokenDecrypterOptions, type AuthioTokenEndpointAuthMethod, AuthioTokenEndpointAuthMethods, type AuthioTokenFailure, type AuthioTokenResponse, AuthioTokenTypes, AuthioTokenValidationError, type AuthioTypedWebhookEvent, type AuthioUserInfo, type AuthioWebhookAdminResource, type AuthioWebhookAdminResourceData, type AuthioWebhookAttackDetected, type AuthioWebhookAttackDetectedData, type AuthioWebhookCredentialCompromised, type AuthioWebhookCredentialCompromisedData, type AuthioWebhookDataByType, type AuthioWebhookEvent, AuthioWebhookEventTypes, AuthioWebhookHeaders, type AuthioWebhookKeysRotated, type AuthioWebhookKeysRotatedData, type AuthioWebhookLogin, type AuthioWebhookLoginData, type AuthioWebhookPing, type AuthioWebhookPingData, type AuthioWebhookTokenReuseDetected, type AuthioWebhookTokenReuseDetectedData, type AuthioWebhookTokenRevoked, type AuthioWebhookTokenRevokedData, type AuthioWebhookUser, type AuthioWebhookUserData, type AuthioWebhookUserLockedOut, type AuthioWebhookUserLockedOutData, type AuthioWebhookUserSuspension, type AuthioWebhookUserSuspensionData, type AuthioWebhookVerificationFailure, type AuthioWebhookVerificationResult, asAdminResourceEvent, asAttackDetectedEvent, asCredentialCompromisedEvent, asKeysRotatedEvent, asLoginEvent, asPingEvent, asTokenReuseDetectedEvent, asTokenRevokedEvent, asUserEvent, asUserLockedOutEvent, asUserSuspensionEvent, computeAuthioTokenHash, computeWebhookSignatureHeader, createAuthioAccountCredential, createAuthioClient, createAuthioDiscoveryClient, createAuthioPkce, createAuthioSigningKeys, createAuthioTokenDecrypter, encryptionKeyFromFile, escapeDataString, isAllowedUrl, isAuthioTokenEncrypted, isKnownWebhookEventType, isWebhookEventOfType, parseAuthioAdminEnvelope, parseAuthioBearerChallenge, parseResourceAccess, parseResourceAccessClaim, parseWebhookEvent, randomValue, readAuthioAdminResponse, readAuthioFrontChannelLogout, readWebhookEventData, requireHmacSecretLength, resolveConnection, resolveIssuer, resourceAccessSourceOf, seconds, systemClock, toBasicAuthorization, toCamelCasedMembers, toClientCredentialsToken, toConnectionExchangeResult, toCredentialClientId, toDevicePollOutcome, toScopeString, toTokenValidationError, tryParseWebhookEvent, verifyAuthioJwt, verifyWebhookSignature, withClientSecret };
+export { type AuthioAccountCredential, type AuthioAccountCredentialKind, type AuthioAccountCredentialOptions, type AuthioAdminEnvelope, AuthioAdminError, type AuthioAdminFailure, type AuthioAdminNotification, type AuthioAdminSuccess, AuthioAsymmetricAlgorithms, type AuthioAuthorizationRequest, type AuthioAuthorizationResult, type AuthioAuthorizationTransaction, type AuthioAuthorizationUrl, type AuthioBearerChallenge, type AuthioCallOptions, AuthioCallbackError, type AuthioCallbackFailure, type AuthioCallerKind, AuthioCallerKinds, type AuthioCamelCase, type AuthioCamelCased, type AuthioCheck, AuthioChecks, AuthioClaimTypes, type AuthioClient, AuthioClientAssertionAlgorithms, type AuthioClientCredentialsCache, type AuthioClientCredentialsSettings, type AuthioClientCredentialsToken, type AuthioClientOptions, type AuthioClock, type AuthioCodeChallengeMethod, AuthioConfigurationError, type AuthioConnection, type AuthioConnectionChoice, type AuthioConnectionExchangeResult, type AuthioConnectionGranted, type AuthioConnectionOptions, type AuthioConnectionRefused, type AuthioConnectionRequired, type AuthioConnectionSelectionRequired, AuthioContentEncryptionAlgorithms, type AuthioCredentialForm, AuthioDefaults, type AuthioDeviceAuthorization, type AuthioDevicePollOutcome, type AuthioDiscoveryClient, type AuthioDiscoveryDocument, AuthioDiscoveryError, type AuthioEncryptionKey, type AuthioEncryptionKeySource, type AuthioEndSessionRequest, AuthioError, type AuthioErrorResponse, type AuthioExternalAccount, type AuthioFrontChannelLogout, AuthioGrantTypes, AuthioHmacAlgorithms, AuthioHmacMinimumSecretBytes, type AuthioIdTokenClaims, type AuthioIntrospectionResult, type AuthioJwtExpectations, AuthioKeyManagementAlgorithms, AuthioLegacyKeyManagementAlgorithms, type AuthioLogoutToken, AuthioOAuthErrors, type AuthioPkcePair, type AuthioPrivateKeyInput, type AuthioPrompt, AuthioPrompts, AuthioProtocolError, AuthioResourceAccess, AuthioResourceAccessClaims, type AuthioResourceAccessRole, type AuthioResourceAccessSource, type AuthioResponseMode, AuthioScopes, type AuthioSecretSource, type AuthioSigningKeys, AuthioSupportedContentEncryptionAlgorithms, type AuthioTokenClient, type AuthioTokenDecrypter, type AuthioTokenDecrypterOptions, type AuthioTokenEndpointAuthMethod, AuthioTokenEndpointAuthMethods, type AuthioTokenFailure, type AuthioTokenResponse, AuthioTokenTypes, AuthioTokenValidationError, type AuthioTypedWebhookEvent, type AuthioUserInfo, type AuthioWebhookAdminResource, type AuthioWebhookAdminResourceData, type AuthioWebhookAttackDetected, type AuthioWebhookAttackDetectedData, type AuthioWebhookAuthenticatorApp, type AuthioWebhookAuthenticatorAppData, type AuthioWebhookCredentialCompromised, type AuthioWebhookCredentialCompromisedData, type AuthioWebhookDataByType, type AuthioWebhookEvent, AuthioWebhookEventTypes, AuthioWebhookHeaders, type AuthioWebhookKeysRotated, type AuthioWebhookKeysRotatedData, type AuthioWebhookLogin, type AuthioWebhookLoginData, type AuthioWebhookPing, type AuthioWebhookPingData, type AuthioWebhookTokenReuseDetected, type AuthioWebhookTokenReuseDetectedData, type AuthioWebhookTokenRevoked, type AuthioWebhookTokenRevokedData, type AuthioWebhookUser, type AuthioWebhookUserData, type AuthioWebhookUserLockedOut, type AuthioWebhookUserLockedOutData, type AuthioWebhookUserSuspension, type AuthioWebhookUserSuspensionData, type AuthioWebhookVerificationFailure, type AuthioWebhookVerificationResult, asAdminResourceEvent, asAttackDetectedEvent, asAuthenticatorAppEvent, asCredentialCompromisedEvent, asKeysRotatedEvent, asLoginEvent, asPingEvent, asTokenReuseDetectedEvent, asTokenRevokedEvent, asUserEvent, asUserLockedOutEvent, asUserSuspensionEvent, computeAuthioTokenHash, computeWebhookSignatureHeader, createAuthioAccountCredential, createAuthioClient, createAuthioDiscoveryClient, createAuthioPkce, createAuthioSigningKeys, createAuthioTokenDecrypter, encryptionKeyFromFile, escapeDataString, isAllowedUrl, isAuthioTokenEncrypted, isKnownWebhookEventType, isWebhookEventOfType, parseAuthioAdminEnvelope, parseAuthioBearerChallenge, parseResourceAccess, parseResourceAccessClaim, parseWebhookEvent, randomValue, readAuthioAdminResponse, readAuthioFrontChannelLogout, readWebhookEventData, requireAccessTokenType, requireHmacSecretLength, resolveConnection, resolveIssuer, resourceAccessSourceOf, seconds, systemClock, toBasicAuthorization, toCamelCasedMembers, toClientCredentialsToken, toConnectionExchangeResult, toCredentialClientId, toDevicePollOutcome, toScopeString, toTokenValidationError, tryParseWebhookEvent, verifyAuthioJwt, verifyWebhookSignature, withClientSecret };

package/dist/index.js

@@ -127,6 +127,10 @@ var AuthioWebhookEventTypes = {
   UserSuspensionEnded: "user_suspension_ended",
   AttackDetected: "attack_detected",
   CredentialCompromised: "credential_compromised",
+  UserAuthenticatorAppEnrolled: "user_authenticator_app_enrolled",
+  UserAuthenticatorAppRemoved: "user_authenticator_app_removed",
+  UserRecoveryCodesRegenerated: "user_recovery_codes_regenerated",
+  UserRecoveryCodeUsed: "user_recovery_code_used",
   Ping: "ping"
 };
 var AuthioWebhookHeaders = {
@@ -162,6 +166,8 @@ var AuthioDefaults = {
   CredentialClientIdPrefix: "cred_",
   ApiKeyHeader: "x-api-key",
   RequestIdHeader: "X-Request-Id",
+  /** The header `typ` of an access token (RFC 9068 §2.1). */
+  AccessTokenType: "at+jwt",
   /** The header `typ` of a back-channel logout token. */
   LogoutTokenType: "logout+jwt",
   /** The event a back-channel logout token carries. */
@@ -960,6 +966,14 @@ async function validateAuthioIdToken(token, context, expectations = {}) {
   }
   return payload;
 }
+function requireAccessTokenType(header) {
+  const type = typeof header.typ === "string" ? header.typ.toLowerCase() : void 0;
+  if (type !== AuthioDefaults.AccessTokenType && type !== `application/${AuthioDefaults.AccessTokenType}`)
+    throw new AuthioTokenValidationError(
+      "not_access_token",
+      `Only access tokens are accepted; this token's header typ is '${header.typ ?? ""}', not '${AuthioDefaults.AccessTokenType}'.`
+    );
+}
 async function validateAuthioLogoutToken(token, context) {
   const signed = isAuthioTokenEncrypted(token) ? await context.decrypt(token) : token;
   const invalid = (message) => new AuthioTokenValidationError("invalid_logout_token", message);
@@ -1291,12 +1305,13 @@ function createAuthioClient(options) {
       const signed = await decrypt(accessToken);
       if (signed.split(".").length !== 3) return void 0;
       const document = await discovery.get(callOptions.signal);
-      const { payload } = await verifyAuthioJwt(signed, withClientSecret(await signingKeys(callOptions.signal), clientSecret), {
+      const { payload, header } = await verifyAuthioJwt(signed, withClientSecret(await signingKeys(callOptions.signal), clientSecret), {
         issuer: connection.issuer,
         algorithms: acceptedSigningAlgorithms(accessTokenAlgorithm, document.id_token_signing_alg_values_supported),
         clockSkew,
         now: connection.clock.now()
       });
+      requireAccessTokenType(header);
       return payload;
     },
     async createEndSessionUrl(request = {}) {
@@ -1337,13 +1352,16 @@ function createAuthioClient(options) {
         };
         const token = await clientCredentials.getToken({ ...key, signal: request.signal });
         const response = await attempt(token);
-        if (response.status !== 401) return response;
+        if (response.status !== 401 || isStepUpChallenge(response)) return response;
         clientCredentials.invalidate({ ...key, accessToken: token.accessToken });
         return attempt(await clientCredentials.getToken({ ...key, signal: request.signal }));
       };
     }
   };
 }
+function isStepUpChallenge(response) {
+  return parseAuthioBearerChallenge(response.headers.get("www-authenticate"))?.error === AuthioOAuthErrors.InsufficientUserAuthentication;
+}
 function createTokenClient(connection, discovery, authenticator) {
   const requestToken = async (parameters, signal, authenticate = true) => {
     const response = await postForm(connection, discovery, authenticate ? authenticator : void 0, "token_endpoint", parameters, signal);
@@ -1706,7 +1724,7 @@ function createAuthioAccountCredential(options) {
     if (cached && clock.now() < cached.refreshAt) return cached;
     pending ??= (async () => {
       const issuedAt = clock.now();
-      const answer = kind === "client_secret" ? await client.tokens.clientCredentials({ scopes: scope, signal }) : await client.tokens.personalAccessToken({ token: value, scopes: scope, signal });
+      const answer = kind === "client_secret" ? await client.tokens.clientCredentials({ scopes: scope, signal }) : await client.tokens.personalAccessToken({ token: value, clientId: AuthioDefaults.PlatformClientId, scopes: scope, signal });
       cached = toClientCredentialsToken(answer, issuedAt, refreshSkewMs);
       return cached;
     })().finally(() => {
@@ -2019,6 +2037,13 @@ var asAdminResourceEvent = (event) => dataWhen(
 var asUserSuspensionEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.UserSuspended, AuthioWebhookEventTypes.UserSuspensionEnded);
 var asAttackDetectedEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.AttackDetected);
 var asCredentialCompromisedEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.CredentialCompromised);
+var asAuthenticatorAppEvent = (event) => dataWhen(
+  event,
+  AuthioWebhookEventTypes.UserAuthenticatorAppEnrolled,
+  AuthioWebhookEventTypes.UserAuthenticatorAppRemoved,
+  AuthioWebhookEventTypes.UserRecoveryCodesRegenerated,
+  AuthioWebhookEventTypes.UserRecoveryCodeUsed
+);
 var asPingEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.Ping);
 var knownEventTypes = new Set(Object.values(AuthioWebhookEventTypes));
 function isKnownWebhookEventType(type) {
@@ -2072,6 +2097,6 @@ function constantTimeEquals(left, right) {
   return difference === 0;
 }
 
-export { AuthioAdminError, AuthioAsymmetricAlgorithms, AuthioCallbackError, AuthioCallerKinds, AuthioChecks, AuthioClaimTypes, AuthioClientAssertionAlgorithms, AuthioConfigurationError, AuthioContentEncryptionAlgorithms, AuthioDefaults, AuthioDiscoveryError, AuthioError, AuthioGrantTypes, AuthioHmacAlgorithms, AuthioHmacMinimumSecretBytes, AuthioKeyManagementAlgorithms, AuthioLegacyKeyManagementAlgorithms, AuthioOAuthErrors, AuthioPrompts, AuthioProtocolError, AuthioResourceAccess, AuthioResourceAccessClaims, AuthioScopes, AuthioSupportedContentEncryptionAlgorithms, AuthioTokenEndpointAuthMethods, AuthioTokenTypes, AuthioTokenValidationError, AuthioWebhookEventTypes, AuthioWebhookHeaders, asAdminResourceEvent, asAttackDetectedEvent, asCredentialCompromisedEvent, asKeysRotatedEvent, asLoginEvent, asPingEvent, asTokenReuseDetectedEvent, asTokenRevokedEvent, asUserEvent, asUserLockedOutEvent, asUserSuspensionEvent, computeAuthioTokenHash, computeWebhookSignatureHeader, createAuthioAccountCredential, createAuthioClient, createAuthioDiscoveryClient, createAuthioPkce, createAuthioSigningKeys, createAuthioTokenDecrypter, encryptionKeyFromFile, escapeDataString, isAllowedUrl, isAuthioTokenEncrypted, isKnownWebhookEventType, isWebhookEventOfType, parseAuthioAdminEnvelope, parseAuthioBearerChallenge, parseResourceAccess, parseResourceAccessClaim, parseWebhookEvent, randomValue, readAuthioAdminResponse, readAuthioFrontChannelLogout, readWebhookEventData, requireHmacSecretLength, resolveConnection, resolveIssuer, resourceAccessSourceOf, seconds, systemClock, toBasicAuthorization, toCamelCasedMembers, toClientCredentialsToken, toConnectionExchangeResult, toCredentialClientId, toDevicePollOutcome, toScopeString, toTokenValidationError, tryParseWebhookEvent, verifyAuthioJwt, verifyWebhookSignature, withClientSecret };
+export { AuthioAdminError, AuthioAsymmetricAlgorithms, AuthioCallbackError, AuthioCallerKinds, AuthioChecks, AuthioClaimTypes, AuthioClientAssertionAlgorithms, AuthioConfigurationError, AuthioContentEncryptionAlgorithms, AuthioDefaults, AuthioDiscoveryError, AuthioError, AuthioGrantTypes, AuthioHmacAlgorithms, AuthioHmacMinimumSecretBytes, AuthioKeyManagementAlgorithms, AuthioLegacyKeyManagementAlgorithms, AuthioOAuthErrors, AuthioPrompts, AuthioProtocolError, AuthioResourceAccess, AuthioResourceAccessClaims, AuthioScopes, AuthioSupportedContentEncryptionAlgorithms, AuthioTokenEndpointAuthMethods, AuthioTokenTypes, AuthioTokenValidationError, AuthioWebhookEventTypes, AuthioWebhookHeaders, asAdminResourceEvent, asAttackDetectedEvent, asAuthenticatorAppEvent, asCredentialCompromisedEvent, asKeysRotatedEvent, asLoginEvent, asPingEvent, asTokenReuseDetectedEvent, asTokenRevokedEvent, asUserEvent, asUserLockedOutEvent, asUserSuspensionEvent, computeAuthioTokenHash, computeWebhookSignatureHeader, createAuthioAccountCredential, createAuthioClient, createAuthioDiscoveryClient, createAuthioPkce, createAuthioSigningKeys, createAuthioTokenDecrypter, encryptionKeyFromFile, escapeDataString, isAllowedUrl, isAuthioTokenEncrypted, isKnownWebhookEventType, isWebhookEventOfType, parseAuthioAdminEnvelope, parseAuthioBearerChallenge, parseResourceAccess, parseResourceAccessClaim, parseWebhookEvent, randomValue, readAuthioAdminResponse, readAuthioFrontChannelLogout, readWebhookEventData, requireAccessTokenType, requireHmacSecretLength, resolveConnection, resolveIssuer, resourceAccessSourceOf, seconds, systemClock, toBasicAuthorization, toCamelCasedMembers, toClientCredentialsToken, toConnectionExchangeResult, toCredentialClientId, toDevicePollOutcome, toScopeString, toTokenValidationError, tryParseWebhookEvent, verifyAuthioJwt, verifyWebhookSignature, withClientSecret };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map