@absolutejs/auth 0.78.0 → 0.80.0

package/dist/server.js

@@ -4023,7 +4023,7 @@ import { Elysia, t } from "elysia";
 // src/apikeys/config.ts
 init_constants();
 init_crypto();
-var DEFAULT_TOKEN_ROUTE = "/oauth2/token";
+var DEFAULT_TOKEN_ROUTE = "/auth/api/token";
 var ACCESS_TOKEN_PREFIX = "at_";
 var API_KEY_PREFIX = "sk_";
 var BEARER_PREFIX = "Bearer ";
@@ -4235,6 +4235,602 @@ var apiKeysRoutes = ({
   });
 };
 
+// src/oidc/config.ts
+init_constants();
+init_crypto();
+
+// src/oidc/keys.ts
+var ENCODER = new TextEncoder;
+var ES256 = { hash: "SHA-256", name: "ECDSA" };
+var KEY_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
+var ES256_JOSE_SIGNATURE_BYTES = 64;
+var toBase64Url = (bytes) => Buffer.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)).toString("base64url");
+var fromBase64Url = (value) => new Uint8Array(Buffer.from(value, "base64url"));
+var encodeSegment = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+var decodeSegment = (segment) => {
+  try {
+    const value = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+      return;
+    }
+    return Object.fromEntries(Object.entries(value));
+  } catch {
+    return;
+  }
+};
+var generateSigningKey = async () => {
+  const pair = await crypto.subtle.generateKey(KEY_PARAMS, true, [
+    "sign",
+    "verify"
+  ]);
+  const privateJwk = await crypto.subtle.exportKey("jwk", pair.privateKey);
+  const publicJwk = await crypto.subtle.exportKey("jwk", pair.publicKey);
+  return { kid: await jwkThumbprint(publicJwk), privateJwk, publicJwk };
+};
+var jwkThumbprint = async (jwk) => {
+  const canonical = JSON.stringify({
+    crv: jwk.crv,
+    kty: jwk.kty,
+    x: jwk.x,
+    y: jwk.y
+  });
+  return toBase64Url(await crypto.subtle.digest("SHA-256", ENCODER.encode(canonical)));
+};
+var signJwt = async (payload, signing, typ = "JWT") => {
+  const input = `${encodeSegment({ alg: "ES256", kid: signing.kid, typ })}.${encodeSegment(payload)}`;
+  const encoded = ENCODER.encode(input);
+  let signature;
+  if (signing.sign !== undefined) {
+    signature = await signing.sign(encoded);
+  } else {
+    const key = await crypto.subtle.importKey("jwk", signing.privateJwk, KEY_PARAMS, false, ["sign"]);
+    signature = await crypto.subtle.sign(ES256, key, encoded);
+  }
+  if (signature.byteLength !== ES256_JOSE_SIGNATURE_BYTES) {
+    throw new Error("ES256 signer must return a 64-byte JOSE signature");
+  }
+  return `${input}.${toBase64Url(signature)}`;
+};
+var toPublicJwk = (key) => ({
+  alg: "ES256",
+  crv: key.publicJwk.crv,
+  kid: key.kid,
+  kty: key.publicJwk.kty,
+  use: "sig",
+  x: key.publicJwk.x,
+  y: key.publicJwk.y
+});
+var verifyJwt = async (token, publicJwk) => {
+  const [headerSegment, payloadSegment, signatureSegment] = token.split(".");
+  if (headerSegment === undefined || payloadSegment === undefined || signatureSegment === undefined) {
+    return;
+  }
+  const key = await crypto.subtle.importKey("jwk", publicJwk, KEY_PARAMS, false, ["verify"]);
+  const valid = await crypto.subtle.verify(ES256, key, fromBase64Url(signatureSegment), ENCODER.encode(`${headerSegment}.${payloadSegment}`));
+  if (!valid)
+    return;
+  const header = decodeSegment(headerSegment);
+  const payload = decodeSegment(payloadSegment);
+  if (header === undefined || payload === undefined)
+    return;
+  return {
+    header,
+    payload
+  };
+};
+var signingVerificationKeys = (active, previous = []) => {
+  const keys = [active, ...previous];
+  const keyIds = new Set(keys.map(({ kid }) => kid));
+  if (keyIds.size !== keys.length)
+    throw new Error("OIDC signing key IDs must be unique");
+  return keys;
+};
+var verifyJwtWithKeys = async (token, keys) => {
+  const [headerSegment] = token.split(".");
+  if (!headerSegment)
+    return;
+  const header = decodeSegment(headerSegment);
+  const kid = header?.kid;
+  if (typeof kid !== "string" || kid.length === 0)
+    return;
+  const key = keys.find((candidate) => candidate.kid === kid);
+  if (!key)
+    return;
+  return verifyJwt(token, key.publicJwk);
+};
+
+// src/oidc/config.ts
+var DEFAULT_OIDC_ROUTE = "/oauth2";
+var MS_PER_SECOND = 1000;
+var TOKEN_BYTES2 = 32;
+var REFRESH_TTL_DAYS = 30;
+var DEFAULT_ACCESS_TOKEN_TTL_MS2 = MILLISECONDS_IN_AN_HOUR;
+var DEFAULT_ID_TOKEN_TTL_MS = MILLISECONDS_IN_AN_HOUR;
+var DEFAULT_REFRESH_TOKEN_TTL_MS = MILLISECONDS_IN_A_DAY * REFRESH_TTL_DAYS;
+var resolveAccessTtl = (ttl, scopes) => {
+  if (typeof ttl === "function")
+    return ttl({ scopes });
+  return ttl ?? DEFAULT_ACCESS_TOKEN_TTL_MS2;
+};
+var nowSeconds = (milliseconds) => Math.floor(milliseconds / MS_PER_SECOND);
+var narrowScopes = (available, requested) => requested === undefined || requested.length === 0 ? available : requested.filter((scope) => available.includes(scope));
+var RESERVED_ACCESS_CLAIMS = new Set([
+  "act",
+  "aud",
+  "client_id",
+  "cnf",
+  "exp",
+  "iat",
+  "iss",
+  "jti",
+  "scope",
+  "sub",
+  "token_use"
+]);
+var buildAccessClaims = ({
+  act,
+  audience,
+  clientCertThumbprint,
+  clientId,
+  dpopJkt,
+  extraClaims,
+  issuer,
+  now,
+  scopes,
+  sub,
+  ttl
+}) => {
+  const safeExtra = extraClaims === undefined ? {} : Object.fromEntries(Object.entries(extraClaims).filter(([key]) => !RESERVED_ACCESS_CLAIMS.has(key)));
+  const claims = {
+    ...safeExtra,
+    aud: audience ?? clientId,
+    client_id: clientId,
+    exp: nowSeconds(now + ttl),
+    iat: nowSeconds(now),
+    iss: issuer,
+    jti: crypto.randomUUID(),
+    scope: scopes.join(" "),
+    sub,
+    token_use: "access"
+  };
+  if (act !== undefined)
+    claims.act = act;
+  const cnf = {
+    ...dpopJkt === undefined ? {} : { jkt: dpopJkt },
+    ...clientCertThumbprint === undefined ? {} : { "x5t#S256": clientCertThumbprint }
+  };
+  if (Object.keys(cnf).length > 0) {
+    claims.cnf = cnf;
+  }
+  return claims;
+};
+var exchangeToken = async ({
+  actorClientId,
+  audience,
+  config,
+  dpopJkt,
+  now = Date.now(),
+  requestedScopes,
+  subjectToken
+}) => {
+  const verified = await verifyJwtWithKeys(subjectToken, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
+  const payload = verified?.payload;
+  if (payload === undefined || typeof payload.sub !== "string" || typeof payload.exp !== "number" || payload.exp <= nowSeconds(now)) {
+    return { error: "invalid_grant", ok: false };
+  }
+  const available = typeof payload.scope === "string" ? payload.scope.split(" ") : [];
+  if (requestedScopes?.some((scope) => !available.includes(scope)) === true) {
+    return { error: "invalid_scope", ok: false };
+  }
+  const scopes = narrowScopes(available, requestedScopes);
+  const ttl = resolveAccessTtl(config.accessTokenTtlMs, scopes);
+  const extraClaims = await config.getAccessTokenClaims?.({
+    audience,
+    clientId: actorClientId,
+    scopes,
+    sub: payload.sub
+  });
+  return {
+    accessToken: await signJwt(buildAccessClaims({
+      act: { sub: actorClientId },
+      audience,
+      clientId: actorClientId,
+      dpopJkt,
+      extraClaims,
+      issuer: config.issuer,
+      now,
+      scopes,
+      sub: payload.sub,
+      ttl
+    }), config.signingKey),
+    expiresIn: Math.floor(ttl / MS_PER_SECOND),
+    ok: true,
+    scope: scopes.join(" ")
+  };
+};
+var issueTokenSet = async ({
+  acr,
+  audience,
+  claims,
+  clientCertThumbprint,
+  clientId,
+  config,
+  dpopJkt,
+  familyId,
+  nonce,
+  now = Date.now(),
+  persistRefreshToken,
+  scopes,
+  sub
+}) => {
+  const accessTtl = resolveAccessTtl(config.accessTokenTtlMs, scopes);
+  const idTtl = config.idTokenTtlMs ?? DEFAULT_ID_TOKEN_TTL_MS;
+  const refreshTtl = config.refreshTokenTtlMs ?? DEFAULT_REFRESH_TOKEN_TTL_MS;
+  const accessExtra = await config.getAccessTokenClaims?.({
+    audience,
+    clientId,
+    scopes,
+    sub
+  });
+  const accessPayload = buildAccessClaims({
+    audience,
+    clientCertThumbprint,
+    clientId,
+    dpopJkt,
+    extraClaims: { ...accessExtra, ...acr === undefined ? {} : { acr } },
+    issuer: config.issuer,
+    now,
+    scopes,
+    sub,
+    ttl: accessTtl
+  });
+  const idPayload = {
+    ...claims,
+    aud: clientId,
+    exp: nowSeconds(now + idTtl),
+    iat: nowSeconds(now),
+    iss: config.issuer,
+    sub
+  };
+  if (nonce !== undefined)
+    idPayload.nonce = nonce;
+  if (acr !== undefined)
+    idPayload.acr = acr;
+  const refreshToken = generateSecureToken(TOKEN_BYTES2);
+  const refreshRecord = {
+    acr,
+    audience,
+    claims,
+    clientId,
+    createdAt: now,
+    dpopJkt,
+    expiresAt: now + refreshTtl,
+    familyId: familyId ?? crypto.randomUUID(),
+    scopes,
+    tokenHash: await hashToken(refreshToken),
+    userId: sub
+  };
+  if (persistRefreshToken)
+    await persistRefreshToken(refreshRecord);
+  else
+    await config.refreshTokenStore.saveToken(refreshRecord);
+  return {
+    access_token: await signJwt(accessPayload, config.signingKey),
+    expires_in: Math.floor(accessTtl / MS_PER_SECOND),
+    id_token: await signJwt(idPayload, config.signingKey),
+    refresh_token: refreshToken,
+    scope: scopes.join(" "),
+    token_type: dpopJkt === undefined ? "Bearer" : "DPoP"
+  };
+};
+var mcpProtectedResourceMetadata = ({
+  issuer,
+  resource,
+  scopes
+}) => ({
+  authorization_servers: [issuer],
+  resource,
+  scopes_supported: scopes ?? []
+});
+var verifyPkce = async (codeVerifier, codeChallenge) => await hashToken(codeVerifier) === codeChallenge;
+var inactive = { active: false };
+var introspectToken = async ({
+  config,
+  hint,
+  now = Date.now(),
+  token
+}) => {
+  if (hint !== "refresh_token") {
+    const verified = await verifyJwtWithKeys(token, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
+    const payload = verified?.payload;
+    if (payload !== undefined && typeof payload.sub === "string" && typeof payload.exp === "number" && payload.exp > nowSeconds(now)) {
+      return {
+        active: true,
+        client_id: typeof payload.client_id === "string" ? payload.client_id : "",
+        exp: payload.exp,
+        iat: typeof payload.iat === "number" ? payload.iat : 0,
+        scope: typeof payload.scope === "string" ? payload.scope : "",
+        sub: payload.sub,
+        token_type: "access_token"
+      };
+    }
+  }
+  if (hint !== "access_token") {
+    const refresh = await config.refreshTokenStore.getToken(await hashToken(token));
+    if (refresh && refresh.expiresAt > now) {
+      return {
+        active: true,
+        client_id: refresh.clientId,
+        exp: nowSeconds(refresh.expiresAt),
+        iat: nowSeconds(refresh.createdAt),
+        scope: refresh.scopes.join(" "),
+        sub: refresh.userId,
+        token_type: "refresh_token"
+      };
+    }
+  }
+  return inactive;
+};
+var revokeRefreshToken = async (config, token) => {
+  const consumed = await config.refreshTokenStore.consumeToken(await hashToken(token));
+  return consumed !== undefined;
+};
+var DEVICE_CODE_BYTES = 32;
+var USER_CODE_HALF_LENGTH = 4;
+var USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ23456789";
+var DEFAULT_DEVICE_CODE_TTL_MINUTES = 15;
+var DEFAULT_DEVICE_CODE_TTL_MS = MILLISECONDS_IN_A_MINUTE * DEFAULT_DEVICE_CODE_TTL_MINUTES;
+var DEFAULT_DEVICE_POLL_INTERVAL_SECONDS = 5;
+var generateUserCode = () => {
+  const length = USER_CODE_HALF_LENGTH * 2;
+  const random = crypto.getRandomValues(new Uint8Array(length));
+  let code = "";
+  for (const byte of random) {
+    code += USER_CODE_ALPHABET[byte % USER_CODE_ALPHABET.length];
+  }
+  return `${code.slice(0, USER_CODE_HALF_LENGTH)}-${code.slice(USER_CODE_HALF_LENGTH)}`;
+};
+var issueDeviceAuthorization = async ({
+  audience,
+  clientId,
+  config,
+  now = Date.now(),
+  requestedScopes
+}) => {
+  if (!config.deviceAuthorizationStore) {
+    throw new Error("oidc.deviceAuthorizationStore is not configured \u2014 cannot start a device flow");
+  }
+  const deviceCode = generateSecureToken(DEVICE_CODE_BYTES);
+  const userCode = generateUserCode();
+  const ttl = config.deviceCodeTtlMs ?? DEFAULT_DEVICE_CODE_TTL_MS;
+  const interval = config.devicePollIntervalSeconds ?? DEFAULT_DEVICE_POLL_INTERVAL_SECONDS;
+  await config.deviceAuthorizationStore.saveDeviceAuthorization({
+    audience,
+    clientId,
+    createdAt: now,
+    deviceCodeHash: await hashToken(deviceCode),
+    expiresAt: now + ttl,
+    intervalSeconds: interval,
+    scopes: requestedScopes,
+    status: "pending",
+    userCode
+  });
+  const verificationUri = `${config.issuer}${config.oidcRoute ?? DEFAULT_OIDC_ROUTE}/device`;
+  return {
+    device_code: deviceCode,
+    expires_in: Math.floor(ttl / MS_PER_SECOND),
+    interval,
+    user_code: userCode,
+    verification_uri: verificationUri,
+    verification_uri_complete: `${verificationUri}?user_code=${encodeURIComponent(userCode)}`
+  };
+};
+var decideDeviceAuthorization = async (config, userCode, approval) => {
+  if (!config.deviceAuthorizationStore) {
+    return { error: "not_configured", ok: false };
+  }
+  const record = await config.deviceAuthorizationStore.findByUserCode(userCode);
+  if (!record)
+    return { error: "invalid_user_code", ok: false };
+  if (record.expiresAt < Date.now()) {
+    return { error: "expired_token", ok: false };
+  }
+  if (record.status !== "pending") {
+    return { error: "already_decided", ok: false };
+  }
+  await config.deviceAuthorizationStore.updateStatus(record.deviceCodeHash, approval.status, approval.userSub);
+  if (approval.status === "approved" && approval.userSub !== undefined) {
+    await config.onDeviceAuthorizationApproved?.({
+      clientId: record.clientId,
+      scopes: record.scopes,
+      userSub: approval.userSub
+    });
+  }
+  return { ok: true };
+};
+var approveDeviceAuthorization = async ({
+  config,
+  userCode,
+  userSub
+}) => decideDeviceAuthorization(config, userCode, {
+  status: "approved",
+  userSub
+});
+var denyDeviceAuthorization = async ({
+  config,
+  userCode
+}) => decideDeviceAuthorization(config, userCode, { status: "denied" });
+var exchangeDeviceCode = async ({
+  clientId,
+  config,
+  deviceCode,
+  dpopJkt,
+  now = Date.now()
+}) => {
+  if (!config.deviceAuthorizationStore) {
+    return { error: "invalid_grant", ok: false };
+  }
+  const deviceCodeHash = await hashToken(deviceCode);
+  const record = await config.deviceAuthorizationStore.findByDeviceCodeHash(deviceCodeHash);
+  if (!record || record.clientId !== clientId) {
+    return { error: "invalid_grant", ok: false };
+  }
+  if (record.expiresAt < now) {
+    await config.deviceAuthorizationStore.deleteByDeviceCodeHash(deviceCodeHash);
+    return { error: "expired_token", ok: false };
+  }
+  if (record.status === "pending") {
+    return { error: "authorization_pending", ok: false };
+  }
+  if (record.status === "denied" || record.userSub === undefined) {
+    return { error: "access_denied", ok: false };
+  }
+  await config.deviceAuthorizationStore.deleteByDeviceCodeHash(deviceCodeHash);
+  const tokenSet = await issueTokenSet({
+    audience: record.audience,
+    clientId,
+    config,
+    dpopJkt,
+    now,
+    scopes: record.scopes,
+    sub: record.userSub
+  });
+  return { ...tokenSet, ok: true };
+};
+var AUTH_REQ_ID_BYTES = 32;
+var DEFAULT_BACKCHANNEL_TTL_MINUTES = 10;
+var DEFAULT_BACKCHANNEL_TTL_MS = MILLISECONDS_IN_A_MINUTE * DEFAULT_BACKCHANNEL_TTL_MINUTES;
+var DEFAULT_BACKCHANNEL_POLL_INTERVAL_SECONDS = 5;
+var CIBA_GRANT_TYPE = "urn:openid:params:grant-type:ciba";
+var issueBackchannelAuth = async ({
+  clientId,
+  config,
+  loginHint,
+  bindingMessage,
+  now = Date.now(),
+  requestedScopes
+}) => {
+  if (!config.backchannelAuthStore || !config.resolveBackchannelUser) {
+    return { error: "invalid_request", ok: false };
+  }
+  const client = await config.clientStore.findClient(clientId) ?? await config.resolveClientIdMetadata?.(clientId);
+  if (!client)
+    return { error: "invalid_client", ok: false };
+  const resolved = await config.resolveBackchannelUser({
+    client,
+    loginHint
+  });
+  if (!resolved)
+    return { error: "unknown_user_id", ok: false };
+  const authReqId = generateSecureToken(AUTH_REQ_ID_BYTES);
+  const ttl = config.backchannelAuthTtlMs ?? DEFAULT_BACKCHANNEL_TTL_MS;
+  const interval = config.backchannelPollIntervalSeconds ?? DEFAULT_BACKCHANNEL_POLL_INTERVAL_SECONDS;
+  await config.backchannelAuthStore.saveBackchannelAuth({
+    authReqId,
+    bindingMessage,
+    clientId,
+    createdAt: now,
+    expiresAt: now + ttl,
+    intervalSeconds: interval,
+    scopes: requestedScopes,
+    status: "pending",
+    userSub: resolved.sub
+  });
+  await config.onBackchannelAuthRequest?.({
+    authReqId,
+    bindingMessage,
+    clientId,
+    scopes: requestedScopes,
+    userSub: resolved.sub
+  });
+  return {
+    auth_req_id: authReqId,
+    expires_in: Math.floor(ttl / MS_PER_SECOND),
+    interval,
+    ok: true
+  };
+};
+var decideBackchannel = async (config, authReqId, approval) => {
+  if (!config.backchannelAuthStore) {
+    return { error: "not_configured", ok: false };
+  }
+  const record = await config.backchannelAuthStore.findByAuthReqId(authReqId);
+  if (!record)
+    return { error: "invalid_auth_req_id", ok: false };
+  if (record.expiresAt < Date.now()) {
+    return { error: "expired_token", ok: false };
+  }
+  if (record.status !== "pending") {
+    return { error: "already_decided", ok: false };
+  }
+  await config.backchannelAuthStore.updateStatus(authReqId, approval.status, approval.userSub ?? record.userSub);
+  return { ok: true };
+};
+var approveBackchannelAuth = async ({
+  authReqId,
+  config,
+  userSub
+}) => decideBackchannel(config, authReqId, {
+  status: "approved",
+  userSub
+});
+var denyBackchannelAuth = async ({
+  authReqId,
+  config
+}) => decideBackchannel(config, authReqId, { status: "denied" });
+var exchangeBackchannelAuth = async ({
+  authReqId,
+  clientCertThumbprint,
+  clientId,
+  config,
+  dpopJkt,
+  now = Date.now()
+}) => {
+  if (!config.backchannelAuthStore) {
+    return { error: "invalid_grant", ok: false };
+  }
+  const record = await config.backchannelAuthStore.findByAuthReqId(authReqId);
+  if (!record || record.clientId !== clientId) {
+    return { error: "invalid_grant", ok: false };
+  }
+  if (record.expiresAt < now) {
+    await config.backchannelAuthStore.deleteByAuthReqId(authReqId);
+    return { error: "expired_token", ok: false };
+  }
+  if (record.lastPolledAt !== undefined && now - record.lastPolledAt < record.intervalSeconds * MS_PER_SECOND) {
+    return { error: "slow_down", ok: false };
+  }
+  await config.backchannelAuthStore.recordPoll(authReqId, now);
+  if (record.status === "pending") {
+    return { error: "authorization_pending", ok: false };
+  }
+  if (record.status === "denied" || record.userSub === undefined) {
+    return { error: "access_denied", ok: false };
+  }
+  await config.backchannelAuthStore.deleteByAuthReqId(authReqId);
+  const tokenSet = await issueTokenSet({
+    clientCertThumbprint,
+    clientId,
+    config,
+    dpopJkt,
+    now,
+    scopes: record.scopes,
+    sub: record.userSub
+  });
+  return { ...tokenSet, ok: true };
+};
+
+// src/apikeys/tokenRoutes.ts
+var assertTokenRouteConfiguration = (apikeys, oidc) => {
+  if (apikeys?.apiClientStore === undefined || apikeys.accessTokenStore === undefined || oidc === undefined)
+    return;
+  const apiTokenRoute = apikeys.tokenRoute ?? DEFAULT_TOKEN_ROUTE;
+  const oidcTokenRoute = `${oidc.oidcRoute ?? DEFAULT_OIDC_ROUTE}/token`;
+  if (apiTokenRoute.replace(/\/$/u, "") === oidcTokenRoute) {
+    throw new Error(`Conflicting auth token routes: POST ${apiTokenRoute} is configured for both API client credentials and OIDC. Set apikeys.tokenRoute to a separate path (default: ${DEFAULT_TOKEN_ROUTE}).`);
+  }
+};
+
 // src/agents/routes.ts
 import { Elysia as Elysia3 } from "elysia";
 
@@ -4491,108 +5087,6 @@ one resource or transport is not authority for another.
 // src/agents/registration.ts
 init_constants();
 init_crypto();
-
-// src/oidc/keys.ts
-var ENCODER = new TextEncoder;
-var ES256 = { hash: "SHA-256", name: "ECDSA" };
-var KEY_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
-var ES256_JOSE_SIGNATURE_BYTES = 64;
-var toBase64Url = (bytes) => Buffer.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)).toString("base64url");
-var fromBase64Url = (value) => new Uint8Array(Buffer.from(value, "base64url"));
-var encodeSegment = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
-var decodeSegment = (segment) => {
-  try {
-    const value = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-      return;
-    }
-    return Object.fromEntries(Object.entries(value));
-  } catch {
-    return;
-  }
-};
-var generateSigningKey = async () => {
-  const pair = await crypto.subtle.generateKey(KEY_PARAMS, true, [
-    "sign",
-    "verify"
-  ]);
-  const privateJwk = await crypto.subtle.exportKey("jwk", pair.privateKey);
-  const publicJwk = await crypto.subtle.exportKey("jwk", pair.publicKey);
-  return { kid: await jwkThumbprint(publicJwk), privateJwk, publicJwk };
-};
-var jwkThumbprint = async (jwk) => {
-  const canonical = JSON.stringify({
-    crv: jwk.crv,
-    kty: jwk.kty,
-    x: jwk.x,
-    y: jwk.y
-  });
-  return toBase64Url(await crypto.subtle.digest("SHA-256", ENCODER.encode(canonical)));
-};
-var signJwt = async (payload, signing, typ = "JWT") => {
-  const input = `${encodeSegment({ alg: "ES256", kid: signing.kid, typ })}.${encodeSegment(payload)}`;
-  const encoded = ENCODER.encode(input);
-  let signature;
-  if (signing.sign !== undefined) {
-    signature = await signing.sign(encoded);
-  } else {
-    const key = await crypto.subtle.importKey("jwk", signing.privateJwk, KEY_PARAMS, false, ["sign"]);
-    signature = await crypto.subtle.sign(ES256, key, encoded);
-  }
-  if (signature.byteLength !== ES256_JOSE_SIGNATURE_BYTES) {
-    throw new Error("ES256 signer must return a 64-byte JOSE signature");
-  }
-  return `${input}.${toBase64Url(signature)}`;
-};
-var toPublicJwk = (key) => ({
-  alg: "ES256",
-  crv: key.publicJwk.crv,
-  kid: key.kid,
-  kty: key.publicJwk.kty,
-  use: "sig",
-  x: key.publicJwk.x,
-  y: key.publicJwk.y
-});
-var verifyJwt = async (token, publicJwk) => {
-  const [headerSegment, payloadSegment, signatureSegment] = token.split(".");
-  if (headerSegment === undefined || payloadSegment === undefined || signatureSegment === undefined) {
-    return;
-  }
-  const key = await crypto.subtle.importKey("jwk", publicJwk, KEY_PARAMS, false, ["verify"]);
-  const valid = await crypto.subtle.verify(ES256, key, fromBase64Url(signatureSegment), ENCODER.encode(`${headerSegment}.${payloadSegment}`));
-  if (!valid)
-    return;
-  const header = decodeSegment(headerSegment);
-  const payload = decodeSegment(payloadSegment);
-  if (header === undefined || payload === undefined)
-    return;
-  return {
-    header,
-    payload
-  };
-};
-var signingVerificationKeys = (active, previous = []) => {
-  const keys = [active, ...previous];
-  const keyIds = new Set(keys.map(({ kid }) => kid));
-  if (keyIds.size !== keys.length)
-    throw new Error("OIDC signing key IDs must be unique");
-  return keys;
-};
-var verifyJwtWithKeys = async (token, keys) => {
-  const [headerSegment] = token.split(".");
-  if (!headerSegment)
-    return;
-  const header = decodeSegment(headerSegment);
-  const kid = header?.kid;
-  if (typeof kid !== "string" || kid.length === 0)
-    return;
-  const key = keys.find((candidate) => candidate.kid === kid);
-  if (!key)
-    return;
-  return verifyJwt(token, key.publicJwk);
-};
-
-// src/agents/registration.ts
 var AGENT_CLAIM_GRANT_TYPE = "urn:workos:agent-auth:grant-type:claim";
 var AGENT_IDENTITY_ASSERTION_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
 var AGENT_IDENTITY_ASSERTION_TYPE = "urn:ietf:params:oauth:token-type:id-jag";
@@ -4603,12 +5097,12 @@ var DEFAULT_GUIDE_ROUTE2 = "/auth.md";
 var DEFAULT_CLAIM_TTL_MS = 24 * 60 * MILLISECONDS_IN_A_MINUTE;
 var DEFAULT_ATTEMPT_TTL_MS = 10 * MILLISECONDS_IN_A_MINUTE;
 var DEFAULT_ASSERTION_TTL_MS = 60 * MILLISECONDS_IN_A_MINUTE;
-var DEFAULT_ACCESS_TOKEN_TTL_MS2 = 15 * MILLISECONDS_IN_A_MINUTE;
+var DEFAULT_ACCESS_TOKEN_TTL_MS3 = 15 * MILLISECONDS_IN_A_MINUTE;
 var DEFAULT_MAX_AUTH_AGE_MS = 60 * MILLISECONDS_IN_A_MINUTE;
 var DEFAULT_POLL_INTERVAL_SECONDS = 5;
 var DEFAULT_MAX_CODE_ATTEMPTS = 5;
 var MAX_CONCURRENT_UPDATE_RETRIES = 5;
-var TOKEN_BYTES2 = 32;
+var TOKEN_BYTES3 = 32;
 var agentRegistrationDiscoveryMetadata = (config) => {
   const registration = requiredRegistration(config);
   const endpoints = agentRegistrationEndpoints(config);
@@ -4724,7 +5218,7 @@ var randomCode = () => {
   const value = new DataView(bytes.buffer).getUint32(0) % 1e6;
   return value.toString().padStart(6, "0");
 };
-var makeSecret = (prefix) => `${prefix}_${generateSecureToken(TOKEN_BYTES2)}`;
+var makeSecret = (prefix) => `${prefix}_${generateSecureToken(TOKEN_BYTES3)}`;
 var makeAttempt = async ({
   email,
   now,
@@ -5053,9 +5547,9 @@ var completeAgentClaim = async (config, input, now = Date.now()) => {
 };
 var issueAgentAccessToken = async (config, flow, now) => {
   const registration = requiredRegistration(config);
-  const accessToken = `at_${generateSecureToken(TOKEN_BYTES2)}`;
+  const accessToken = `at_${generateSecureToken(TOKEN_BYTES3)}`;
   const scopes = (flow.status === "claimed" ? registration.postClaimScopes : registration.preClaimScopes ?? []).filter((scope) => config.scopes.includes(scope));
-  const expiresAt = now + (registration.tokenTtlMs ?? DEFAULT_ACCESS_TOKEN_TTL_MS2);
+  const expiresAt = now + (registration.tokenTtlMs ?? DEFAULT_ACCESS_TOKEN_TTL_MS3);
   await registration.accessTokenStore.saveToken({
     clientId: flow.agentId,
     createdAt: now,
@@ -8287,489 +8781,6 @@ init_constants();
 init_crypto();
 import { Elysia as Elysia24, t as t17 } from "elysia";
 
-// src/oidc/config.ts
-init_constants();
-init_crypto();
-var DEFAULT_OIDC_ROUTE = "/oauth2";
-var MS_PER_SECOND = 1000;
-var TOKEN_BYTES3 = 32;
-var REFRESH_TTL_DAYS = 30;
-var DEFAULT_ACCESS_TOKEN_TTL_MS3 = MILLISECONDS_IN_AN_HOUR;
-var DEFAULT_ID_TOKEN_TTL_MS = MILLISECONDS_IN_AN_HOUR;
-var DEFAULT_REFRESH_TOKEN_TTL_MS = MILLISECONDS_IN_A_DAY * REFRESH_TTL_DAYS;
-var resolveAccessTtl = (ttl, scopes) => {
-  if (typeof ttl === "function")
-    return ttl({ scopes });
-  return ttl ?? DEFAULT_ACCESS_TOKEN_TTL_MS3;
-};
-var nowSeconds = (milliseconds) => Math.floor(milliseconds / MS_PER_SECOND);
-var narrowScopes = (available, requested) => requested === undefined || requested.length === 0 ? available : requested.filter((scope) => available.includes(scope));
-var RESERVED_ACCESS_CLAIMS = new Set([
-  "act",
-  "aud",
-  "client_id",
-  "cnf",
-  "exp",
-  "iat",
-  "iss",
-  "jti",
-  "scope",
-  "sub",
-  "token_use"
-]);
-var buildAccessClaims = ({
-  act,
-  audience,
-  clientCertThumbprint,
-  clientId,
-  dpopJkt,
-  extraClaims,
-  issuer,
-  now,
-  scopes,
-  sub,
-  ttl
-}) => {
-  const safeExtra = extraClaims === undefined ? {} : Object.fromEntries(Object.entries(extraClaims).filter(([key]) => !RESERVED_ACCESS_CLAIMS.has(key)));
-  const claims = {
-    ...safeExtra,
-    aud: audience ?? clientId,
-    client_id: clientId,
-    exp: nowSeconds(now + ttl),
-    iat: nowSeconds(now),
-    iss: issuer,
-    jti: crypto.randomUUID(),
-    scope: scopes.join(" "),
-    sub,
-    token_use: "access"
-  };
-  if (act !== undefined)
-    claims.act = act;
-  const cnf = {
-    ...dpopJkt === undefined ? {} : { jkt: dpopJkt },
-    ...clientCertThumbprint === undefined ? {} : { "x5t#S256": clientCertThumbprint }
-  };
-  if (Object.keys(cnf).length > 0) {
-    claims.cnf = cnf;
-  }
-  return claims;
-};
-var exchangeToken = async ({
-  actorClientId,
-  audience,
-  config,
-  dpopJkt,
-  now = Date.now(),
-  requestedScopes,
-  subjectToken
-}) => {
-  const verified = await verifyJwtWithKeys(subjectToken, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
-  const payload = verified?.payload;
-  if (payload === undefined || typeof payload.sub !== "string" || typeof payload.exp !== "number" || payload.exp <= nowSeconds(now)) {
-    return { error: "invalid_grant", ok: false };
-  }
-  const available = typeof payload.scope === "string" ? payload.scope.split(" ") : [];
-  if (requestedScopes?.some((scope) => !available.includes(scope)) === true) {
-    return { error: "invalid_scope", ok: false };
-  }
-  const scopes = narrowScopes(available, requestedScopes);
-  const ttl = resolveAccessTtl(config.accessTokenTtlMs, scopes);
-  const extraClaims = await config.getAccessTokenClaims?.({
-    audience,
-    clientId: actorClientId,
-    scopes,
-    sub: payload.sub
-  });
-  return {
-    accessToken: await signJwt(buildAccessClaims({
-      act: { sub: actorClientId },
-      audience,
-      clientId: actorClientId,
-      dpopJkt,
-      extraClaims,
-      issuer: config.issuer,
-      now,
-      scopes,
-      sub: payload.sub,
-      ttl
-    }), config.signingKey),
-    expiresIn: Math.floor(ttl / MS_PER_SECOND),
-    ok: true,
-    scope: scopes.join(" ")
-  };
-};
-var issueTokenSet = async ({
-  acr,
-  audience,
-  claims,
-  clientCertThumbprint,
-  clientId,
-  config,
-  dpopJkt,
-  familyId,
-  nonce,
-  now = Date.now(),
-  persistRefreshToken,
-  scopes,
-  sub
-}) => {
-  const accessTtl = resolveAccessTtl(config.accessTokenTtlMs, scopes);
-  const idTtl = config.idTokenTtlMs ?? DEFAULT_ID_TOKEN_TTL_MS;
-  const refreshTtl = config.refreshTokenTtlMs ?? DEFAULT_REFRESH_TOKEN_TTL_MS;
-  const accessExtra = await config.getAccessTokenClaims?.({
-    audience,
-    clientId,
-    scopes,
-    sub
-  });
-  const accessPayload = buildAccessClaims({
-    audience,
-    clientCertThumbprint,
-    clientId,
-    dpopJkt,
-    extraClaims: { ...accessExtra, ...acr === undefined ? {} : { acr } },
-    issuer: config.issuer,
-    now,
-    scopes,
-    sub,
-    ttl: accessTtl
-  });
-  const idPayload = {
-    ...claims,
-    aud: clientId,
-    exp: nowSeconds(now + idTtl),
-    iat: nowSeconds(now),
-    iss: config.issuer,
-    sub
-  };
-  if (nonce !== undefined)
-    idPayload.nonce = nonce;
-  if (acr !== undefined)
-    idPayload.acr = acr;
-  const refreshToken = generateSecureToken(TOKEN_BYTES3);
-  const refreshRecord = {
-    acr,
-    audience,
-    claims,
-    clientId,
-    createdAt: now,
-    dpopJkt,
-    expiresAt: now + refreshTtl,
-    familyId: familyId ?? crypto.randomUUID(),
-    scopes,
-    tokenHash: await hashToken(refreshToken),
-    userId: sub
-  };
-  if (persistRefreshToken)
-    await persistRefreshToken(refreshRecord);
-  else
-    await config.refreshTokenStore.saveToken(refreshRecord);
-  return {
-    access_token: await signJwt(accessPayload, config.signingKey),
-    expires_in: Math.floor(accessTtl / MS_PER_SECOND),
-    id_token: await signJwt(idPayload, config.signingKey),
-    refresh_token: refreshToken,
-    scope: scopes.join(" "),
-    token_type: dpopJkt === undefined ? "Bearer" : "DPoP"
-  };
-};
-var mcpProtectedResourceMetadata = ({
-  issuer,
-  resource,
-  scopes
-}) => ({
-  authorization_servers: [issuer],
-  resource,
-  scopes_supported: scopes ?? []
-});
-var verifyPkce = async (codeVerifier, codeChallenge) => await hashToken(codeVerifier) === codeChallenge;
-var inactive = { active: false };
-var introspectToken = async ({
-  config,
-  hint,
-  now = Date.now(),
-  token
-}) => {
-  if (hint !== "refresh_token") {
-    const verified = await verifyJwtWithKeys(token, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
-    const payload = verified?.payload;
-    if (payload !== undefined && typeof payload.sub === "string" && typeof payload.exp === "number" && payload.exp > nowSeconds(now)) {
-      return {
-        active: true,
-        client_id: typeof payload.client_id === "string" ? payload.client_id : "",
-        exp: payload.exp,
-        iat: typeof payload.iat === "number" ? payload.iat : 0,
-        scope: typeof payload.scope === "string" ? payload.scope : "",
-        sub: payload.sub,
-        token_type: "access_token"
-      };
-    }
-  }
-  if (hint !== "access_token") {
-    const refresh = await config.refreshTokenStore.getToken(await hashToken(token));
-    if (refresh && refresh.expiresAt > now) {
-      return {
-        active: true,
-        client_id: refresh.clientId,
-        exp: nowSeconds(refresh.expiresAt),
-        iat: nowSeconds(refresh.createdAt),
-        scope: refresh.scopes.join(" "),
-        sub: refresh.userId,
-        token_type: "refresh_token"
-      };
-    }
-  }
-  return inactive;
-};
-var revokeRefreshToken = async (config, token) => {
-  const consumed = await config.refreshTokenStore.consumeToken(await hashToken(token));
-  return consumed !== undefined;
-};
-var DEVICE_CODE_BYTES = 32;
-var USER_CODE_HALF_LENGTH = 4;
-var USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ23456789";
-var DEFAULT_DEVICE_CODE_TTL_MINUTES = 15;
-var DEFAULT_DEVICE_CODE_TTL_MS = MILLISECONDS_IN_A_MINUTE * DEFAULT_DEVICE_CODE_TTL_MINUTES;
-var DEFAULT_DEVICE_POLL_INTERVAL_SECONDS = 5;
-var generateUserCode = () => {
-  const length = USER_CODE_HALF_LENGTH * 2;
-  const random = crypto.getRandomValues(new Uint8Array(length));
-  let code = "";
-  for (const byte of random) {
-    code += USER_CODE_ALPHABET[byte % USER_CODE_ALPHABET.length];
-  }
-  return `${code.slice(0, USER_CODE_HALF_LENGTH)}-${code.slice(USER_CODE_HALF_LENGTH)}`;
-};
-var issueDeviceAuthorization = async ({
-  audience,
-  clientId,
-  config,
-  now = Date.now(),
-  requestedScopes
-}) => {
-  if (!config.deviceAuthorizationStore) {
-    throw new Error("oidc.deviceAuthorizationStore is not configured \u2014 cannot start a device flow");
-  }
-  const deviceCode = generateSecureToken(DEVICE_CODE_BYTES);
-  const userCode = generateUserCode();
-  const ttl = config.deviceCodeTtlMs ?? DEFAULT_DEVICE_CODE_TTL_MS;
-  const interval = config.devicePollIntervalSeconds ?? DEFAULT_DEVICE_POLL_INTERVAL_SECONDS;
-  await config.deviceAuthorizationStore.saveDeviceAuthorization({
-    audience,
-    clientId,
-    createdAt: now,
-    deviceCodeHash: await hashToken(deviceCode),
-    expiresAt: now + ttl,
-    intervalSeconds: interval,
-    scopes: requestedScopes,
-    status: "pending",
-    userCode
-  });
-  const verificationUri = `${config.issuer}${config.oidcRoute ?? DEFAULT_OIDC_ROUTE}/device`;
-  return {
-    device_code: deviceCode,
-    expires_in: Math.floor(ttl / MS_PER_SECOND),
-    interval,
-    user_code: userCode,
-    verification_uri: verificationUri,
-    verification_uri_complete: `${verificationUri}?user_code=${encodeURIComponent(userCode)}`
-  };
-};
-var decideDeviceAuthorization = async (config, userCode, approval) => {
-  if (!config.deviceAuthorizationStore) {
-    return { error: "not_configured", ok: false };
-  }
-  const record = await config.deviceAuthorizationStore.findByUserCode(userCode);
-  if (!record)
-    return { error: "invalid_user_code", ok: false };
-  if (record.expiresAt < Date.now()) {
-    return { error: "expired_token", ok: false };
-  }
-  if (record.status !== "pending") {
-    return { error: "already_decided", ok: false };
-  }
-  await config.deviceAuthorizationStore.updateStatus(record.deviceCodeHash, approval.status, approval.userSub);
-  if (approval.status === "approved" && approval.userSub !== undefined) {
-    await config.onDeviceAuthorizationApproved?.({
-      clientId: record.clientId,
-      scopes: record.scopes,
-      userSub: approval.userSub
-    });
-  }
-  return { ok: true };
-};
-var approveDeviceAuthorization = async ({
-  config,
-  userCode,
-  userSub
-}) => decideDeviceAuthorization(config, userCode, {
-  status: "approved",
-  userSub
-});
-var denyDeviceAuthorization = async ({
-  config,
-  userCode
-}) => decideDeviceAuthorization(config, userCode, { status: "denied" });
-var exchangeDeviceCode = async ({
-  clientId,
-  config,
-  deviceCode,
-  dpopJkt,
-  now = Date.now()
-}) => {
-  if (!config.deviceAuthorizationStore) {
-    return { error: "invalid_grant", ok: false };
-  }
-  const deviceCodeHash = await hashToken(deviceCode);
-  const record = await config.deviceAuthorizationStore.findByDeviceCodeHash(deviceCodeHash);
-  if (!record || record.clientId !== clientId) {
-    return { error: "invalid_grant", ok: false };
-  }
-  if (record.expiresAt < now) {
-    await config.deviceAuthorizationStore.deleteByDeviceCodeHash(deviceCodeHash);
-    return { error: "expired_token", ok: false };
-  }
-  if (record.status === "pending") {
-    return { error: "authorization_pending", ok: false };
-  }
-  if (record.status === "denied" || record.userSub === undefined) {
-    return { error: "access_denied", ok: false };
-  }
-  await config.deviceAuthorizationStore.deleteByDeviceCodeHash(deviceCodeHash);
-  const tokenSet = await issueTokenSet({
-    audience: record.audience,
-    clientId,
-    config,
-    dpopJkt,
-    now,
-    scopes: record.scopes,
-    sub: record.userSub
-  });
-  return { ...tokenSet, ok: true };
-};
-var AUTH_REQ_ID_BYTES = 32;
-var DEFAULT_BACKCHANNEL_TTL_MINUTES = 10;
-var DEFAULT_BACKCHANNEL_TTL_MS = MILLISECONDS_IN_A_MINUTE * DEFAULT_BACKCHANNEL_TTL_MINUTES;
-var DEFAULT_BACKCHANNEL_POLL_INTERVAL_SECONDS = 5;
-var CIBA_GRANT_TYPE = "urn:openid:params:grant-type:ciba";
-var issueBackchannelAuth = async ({
-  clientId,
-  config,
-  loginHint,
-  bindingMessage,
-  now = Date.now(),
-  requestedScopes
-}) => {
-  if (!config.backchannelAuthStore || !config.resolveBackchannelUser) {
-    return { error: "invalid_request", ok: false };
-  }
-  const client = await config.clientStore.findClient(clientId) ?? await config.resolveClientIdMetadata?.(clientId);
-  if (!client)
-    return { error: "invalid_client", ok: false };
-  const resolved = await config.resolveBackchannelUser({
-    client,
-    loginHint
-  });
-  if (!resolved)
-    return { error: "unknown_user_id", ok: false };
-  const authReqId = generateSecureToken(AUTH_REQ_ID_BYTES);
-  const ttl = config.backchannelAuthTtlMs ?? DEFAULT_BACKCHANNEL_TTL_MS;
-  const interval = config.backchannelPollIntervalSeconds ?? DEFAULT_BACKCHANNEL_POLL_INTERVAL_SECONDS;
-  await config.backchannelAuthStore.saveBackchannelAuth({
-    authReqId,
-    bindingMessage,
-    clientId,
-    createdAt: now,
-    expiresAt: now + ttl,
-    intervalSeconds: interval,
-    scopes: requestedScopes,
-    status: "pending",
-    userSub: resolved.sub
-  });
-  await config.onBackchannelAuthRequest?.({
-    authReqId,
-    bindingMessage,
-    clientId,
-    scopes: requestedScopes,
-    userSub: resolved.sub
-  });
-  return {
-    auth_req_id: authReqId,
-    expires_in: Math.floor(ttl / MS_PER_SECOND),
-    interval,
-    ok: true
-  };
-};
-var decideBackchannel = async (config, authReqId, approval) => {
-  if (!config.backchannelAuthStore) {
-    return { error: "not_configured", ok: false };
-  }
-  const record = await config.backchannelAuthStore.findByAuthReqId(authReqId);
-  if (!record)
-    return { error: "invalid_auth_req_id", ok: false };
-  if (record.expiresAt < Date.now()) {
-    return { error: "expired_token", ok: false };
-  }
-  if (record.status !== "pending") {
-    return { error: "already_decided", ok: false };
-  }
-  await config.backchannelAuthStore.updateStatus(authReqId, approval.status, approval.userSub ?? record.userSub);
-  return { ok: true };
-};
-var approveBackchannelAuth = async ({
-  authReqId,
-  config,
-  userSub
-}) => decideBackchannel(config, authReqId, {
-  status: "approved",
-  userSub
-});
-var denyBackchannelAuth = async ({
-  authReqId,
-  config
-}) => decideBackchannel(config, authReqId, { status: "denied" });
-var exchangeBackchannelAuth = async ({
-  authReqId,
-  clientCertThumbprint,
-  clientId,
-  config,
-  dpopJkt,
-  now = Date.now()
-}) => {
-  if (!config.backchannelAuthStore) {
-    return { error: "invalid_grant", ok: false };
-  }
-  const record = await config.backchannelAuthStore.findByAuthReqId(authReqId);
-  if (!record || record.clientId !== clientId) {
-    return { error: "invalid_grant", ok: false };
-  }
-  if (record.expiresAt < now) {
-    await config.backchannelAuthStore.deleteByAuthReqId(authReqId);
-    return { error: "expired_token", ok: false };
-  }
-  if (record.lastPolledAt !== undefined && now - record.lastPolledAt < record.intervalSeconds * MS_PER_SECOND) {
-    return { error: "slow_down", ok: false };
-  }
-  await config.backchannelAuthStore.recordPoll(authReqId, now);
-  if (record.status === "pending") {
-    return { error: "authorization_pending", ok: false };
-  }
-  if (record.status === "denied" || record.userSub === undefined) {
-    return { error: "access_denied", ok: false };
-  }
-  await config.backchannelAuthStore.deleteByAuthReqId(authReqId);
-  const tokenSet = await issueTokenSet({
-    clientCertThumbprint,
-    clientId,
-    config,
-    dpopJkt,
-    now,
-    scopes: record.scopes,
-    sub: record.userSub
-  });
-  return { ...tokenSet, ok: true };
-};
-
 // src/oidc/clientAuth.ts
 init_constants();
 var CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
@@ -26778,10 +26789,9 @@ var toUnregisteredSessionData = (row) => ({
   sessionInformation: cloneRecord(row.session_information_json ?? undefined),
   userIdentity: cloneRecord(row.user_identity_json ?? undefined)
 });
-var createNeonAuthSessionStore = (databaseUrl, decodeUser) => {
-  const sql2 = as(databaseUrl);
-  const db = drizzle({ client: sql2 });
-  return {
+var createNeonAuthSessionStore = (databaseUrl, decodeUser) => createPostgresAuthSessionStore(drizzle({ client: as(databaseUrl) }), decodeUser);
+var createPostgresAuthSessionStore = (db, decodeUser) => {
+  const store = {
     deleteExpired: async () => {
       const rows = await db.delete(authSessionsTable).where(lt(authSessionsTable.expires_at_ms, Date.now())).returning({ id: authSessionsTable.id });
       return rows.length;
@@ -26859,6 +26869,7 @@ var createNeonAuthSessionStore = (databaseUrl, decodeUser) => {
       });
     }
   };
+  return store;
 };
 // src/providersFromEnv.ts
 var envKey = (provider, suffix) => `${provider.replace(/[^a-zA-Z0-9]/g, "_").toUpperCase()}_${suffix}`;
@@ -34955,6 +34966,30 @@ var createRedisAuthSessionStore = (redis, decodeUser, keyPrefix = "auth:session:
     }
   };
 };
+// src/linkedProviders/credentialError.ts
+class LinkedProviderCredentialError extends Error {
+  code;
+  recovery;
+  constructor(code, recovery, message, cause) {
+    super(message, { cause });
+    this.code = code;
+    this.recovery = recovery;
+    this.name = "LinkedProviderCredentialError";
+  }
+}
+var credentialRefreshError = (error2) => {
+  if (error2 instanceof LinkedProviderCredentialError)
+    return error2;
+  const message = error2 instanceof Error ? error2.message : "";
+  if (/\binvalid_grant\b/.test(message)) {
+    return new LinkedProviderCredentialError("invalid_grant", "reconnect", "Authorization has expired or was revoked. Reconnect your account.", error2);
+  }
+  if (/\b(invalid_client|unauthorized_client)\b/.test(message)) {
+    return new LinkedProviderCredentialError("invalid_client", "configuration", "The provider connection is misconfigured. Contact support.", error2);
+  }
+  return new LinkedProviderCredentialError("refresh_failed", "retry", "The provider could not refresh the connection. Try again.", error2);
+};
+
 // src/linkedProviders/resolver.ts
 var uniqueStrings = (values) => [...new Set(values)];
 var getEffectiveScopes = (grant, binding) => {
@@ -35052,6 +35087,30 @@ var resolveBindingCredential = async (grantStore, binding, input) => {
   }
   return buildResolvedCredential(grant, binding);
 };
+var refreshAndRecord = async (grant, input, refresh2, grantStore, now) => {
+  let refreshed;
+  try {
+    const result = await refresh2(grant, input);
+    if (!result)
+      throw new Error("Linked provider access token refresh failed");
+    refreshed = result;
+  } catch (cause) {
+    const error2 = credentialRefreshError(cause);
+    await grantStore.saveGrant({
+      ...grant,
+      lastRefreshError: error2.message,
+      metadata: { ...grant.metadata, credentialFailureCode: error2.code, credentialRecovery: error2.recovery },
+      status: "refresh_required",
+      updatedAt: now()
+    });
+    throw error2;
+  }
+  const metadata = { ...refreshed.grant.metadata };
+  delete metadata.credentialRecovery;
+  delete metadata.credentialFailureCode;
+  await grantStore.saveGrant({ ...refreshed.grant, lastRefreshError: undefined, metadata });
+  return refreshed;
+};
 var createLinkedProviderCredentialResolver = ({
   grantStore,
   bindingStore,
@@ -35081,11 +35140,7 @@ var createLinkedProviderCredentialResolver = ({
       if (!refreshAccessTokenLease) {
         throw new Error("Linked provider access token lease requires refresh");
       }
-      const refreshed = await refreshAccessTokenLease(grant, input);
-      if (!refreshed) {
-        throw new Error("Linked provider access token refresh failed");
-      }
-      await grantStore.saveGrant(refreshed.grant);
+      const refreshed = await refreshAndRecord(grant, input, refreshAccessTokenLease, grantStore, now);
       ({ lease } = refreshed);
     }
     if (!lease) {
@@ -35178,8 +35233,11 @@ var createOAuthLinkedProviderCredentialResolver = async ({
       tokenType: grant.tokenType
     } : null,
     refreshAccessTokenLease: async (grant) => {
-      if (!isValidProviderOption(grant.authProviderKey) || !grant.refreshTokenCiphertext) {
-        return null;
+      if (!grant.refreshTokenCiphertext) {
+        throw new LinkedProviderCredentialError("missing_refresh_token", "reconnect", "Authorization cannot renew automatically. Reconnect your account.");
+      }
+      if (!isValidProviderOption(grant.authProviderKey)) {
+        throw new LinkedProviderCredentialError("unsupported_provider", "configuration", "This provider cannot renew the connection. Contact support.");
       }
       const providerKey = grant.authProviderKey;
       const providerClientName = typeof grant.metadata?.providerClient === "string" && grant.metadata.providerClient.trim().length > 0 ? grant.metadata.providerClient.trim() : undefined;
@@ -35189,11 +35247,11 @@ var createOAuthLinkedProviderCredentialResolver = async ({
         providersConfiguration
       });
       if ("error" in resolvedProviderClientConfiguration || !resolvedProviderClientConfiguration.config) {
-        return null;
+        throw new LinkedProviderCredentialError("provider_configuration", "configuration", "The provider connection is misconfigured. Contact support.");
       }
       const providerClient = await createOAuth2Client(providerKey, resolvedProviderClientConfiguration.config.credentials);
       if (!providerClient || !isRefreshableOAuth2Client(providerKey, providerClient)) {
-        return null;
+        throw new LinkedProviderCredentialError("unsupported_refresh", "configuration", "This provider cannot renew the connection. Contact support.");
       }
       const tokenResponse2 = await providerClient.refreshAccessToken(grant.refreshTokenCiphertext);
       const refreshedAt = Date.now();
@@ -41599,6 +41657,7 @@ var buildAuthApplications = async (configuration) => {
     onRevocationError,
     onSessionCleanup
   } = configuration;
+  assertTokenRouteConfiguration(apikeys, oidc);
   if (push && nativePush2)
     throw new Error("Configure `push`, not both `push` and `nativePush`");
   const pushConfig = push ?? nativePush2;
@@ -42085,5 +42144,5 @@ export {
   userSessionIdTypebox
 };
 
-//# debugId=2F4B37C045D05FBC64756E2164756E21
+//# debugId=DE4780E5239C13EA64756E2164756E21
 //# sourceMappingURL=server.js.map