@spec ensure_signing_alg(String.t() | atom() | nil) ::
  :ok | {:error, :invalid_signing_alg}

@spec ensure_supported_response_type(String.t() | nil) ::
  :ok | {:error, :unsupported_response_type}

@spec ensure_supported_token_endpoint_auth_method(atom() | nil) ::
  :ok | {:error, :unsupported_token_endpoint_auth_method}

@spec fetch_required_config!(atom(), term()) :: term()

@spec hash_client_secret(String.t()) :: String.t()

@spec hash_token(String.t()) :: String.t()

@spec validate_issuer_and_mount_path!(String.t(), String.t()) :: String.t()

@spec validate_key_compliance(
  Lockspire.Domain.SigningKey.t(),
  :fapi_2_0_security | :none
) ::
  :ok | {:error, term()}

@spec validate_signing_alg!(String.t() | atom() | nil) :: :ok

@spec verify_client_secret(String.t(), String.t()) :: boolean()