@better-auth/oauth-provider 1.5.0-beta.9 → 1.5.0

package/dist/index.mjs

@@ -1,221 +1,58 @@
-import { a as getJwtPlugin, c as parseClientMetadata, d as storeToken, f as validateClientCredentials, i as getClient, l as parsePrompt, m as mcpHandler, n as decryptStoredClientSecret, r as deleteFromPrompt, s as getStoredToken, t as basicToClientCredentials, u as storeClientSecret } from "./utils-CUVT0Bep.mjs";
+import { a as getJwtPlugin, c as isPKCERequired, d as storeClientSecret, f as storeToken, h as mcpHandler, i as getClient, l as parseClientMetadata, n as decryptStoredClientSecret, p as validateClientCredentials, r as deleteFromPrompt, s as getStoredToken, t as basicToClientCredentials, u as parsePrompt } from "./utils-D6kv_BUA.mjs";
+import { APIError, createAuthEndpoint, createAuthMiddleware, getOAuthState, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { generateCodeChallenge, getJwks, verifyJwsAccessToken } from "better-auth/oauth2";
-import { APIError } from "better-call";
-import { BetterAuthError } from "@better-auth/core/error";
+import { APIError as APIError$1 } from "better-call";
 import { constantTimeEqual, generateRandomString, makeSignature } from "better-auth/crypto";
 import { defineRequestState } from "@better-auth/core/context";
 import { logger } from "@better-auth/core/env";
-import { APIError as APIError$1, createAuthEndpoint, createAuthMiddleware, getOAuthState, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
+import { BetterAuthError } from "@better-auth/core/error";
 import { parseSetCookieHeader } from "better-auth/cookies";
 import { mergeSchema } from "better-auth/db";
 import * as z from "zod";
 import { signJWT, toExpJWT } from "better-auth/plugins";
 import { SignJWT, compactVerify, createLocalJWKSet, decodeJwt } from "jose";
 
-//#region src/metadata.ts
-function authServerMetadata(ctx, opts, overrides) {
-	const baseURL = ctx.context.baseURL;
-	return {
-		scopes_supported: overrides?.scopes_supported,
-		issuer: opts?.jwt?.issuer ?? baseURL,
-		authorization_endpoint: `${baseURL}/oauth2/authorize`,
-		token_endpoint: `${baseURL}/oauth2/token`,
-		jwks_uri: overrides?.jwt_disabled ? void 0 : opts?.jwks?.remoteUrl ?? `${baseURL}${opts?.jwks?.jwksPath ?? "/jwks"}`,
-		registration_endpoint: `${baseURL}/oauth2/register`,
-		introspection_endpoint: `${baseURL}/oauth2/introspect`,
-		revocation_endpoint: `${baseURL}/oauth2/revoke`,
-		response_types_supported: overrides?.grant_types_supported && !overrides.grant_types_supported.includes("authorization_code") ? [] : ["code"],
-		response_modes_supported: ["query"],
-		grant_types_supported: overrides?.grant_types_supported ?? [
-			"authorization_code",
-			"client_credentials",
-			"refresh_token"
-		],
-		token_endpoint_auth_methods_supported: [
-			...overrides?.public_client_supported ? ["none"] : [],
-			"client_secret_basic",
-			"client_secret_post"
-		],
-		introspection_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
-		revocation_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
-		code_challenge_methods_supported: ["S256"]
-	};
-}
-function oidcServerMetadata(ctx, opts) {
-	const baseURL = ctx.context.baseURL;
-	const jwtPluginOptions = opts.disableJwtPlugin ? void 0 : getJwtPlugin(ctx.context).options;
-	return {
-		...authServerMetadata(ctx, jwtPluginOptions, {
-			scopes_supported: opts.advertisedMetadata?.scopes_supported ?? opts.scopes,
-			public_client_supported: opts.allowUnauthenticatedClientRegistration,
-			grant_types_supported: opts.grantTypes,
-			jwt_disabled: opts.disableJwtPlugin
-		}),
-		claims_supported: opts?.advertisedMetadata?.claims_supported ?? opts?.claims ?? [],
-		userinfo_endpoint: `${baseURL}/oauth2/userinfo`,
-		subject_types_supported: ["public"],
-		id_token_signing_alg_values_supported: jwtPluginOptions?.jwks?.keyPairConfig?.alg ? [jwtPluginOptions?.jwks?.keyPairConfig?.alg] : opts.disableJwtPlugin ? ["HS256"] : ["EdDSA"],
-		end_session_endpoint: `${baseURL}/oauth2/end-session`,
-		acr_values_supported: ["urn:mace:incommon:iap:bronze"],
-		prompt_values_supported: [
-			"login",
-			"consent",
-			"create",
-			"select_account"
-		]
-	};
-}
-/**
-* Provides an exportable `/.well-known/oauth-authorization-server`.
-*
-* Useful when basePath prevents the endpoint from being located at the root
-* and must be provided manually.
-*
-* @external
-*/
-const oauthProviderAuthServerMetadata = (auth, opts) => {
-	return async (_request) => {
-		const res = await auth.api.getOAuthServerConfig();
-		return new Response(JSON.stringify(res), {
-			status: 200,
-			headers: {
-				"Cache-Control": "public, max-age=15, stale-while-revalidate=15, stale-if-error=86400",
-				...opts?.headers,
-				"Content-Type": "application/json"
-			}
-		});
-	};
-};
-/**
-* Provides an exportable `/.well-known/openid-configuration`.
-*
-* Useful when basePath prevents the endpoint from being located at the root
-* and must be provided manually.
-*
-* @external
-*/
-const oauthProviderOpenIdConfigMetadata = (auth, opts) => {
-	return async (_request) => {
-		const res = await auth.api.getOpenIdConfig();
-		return new Response(JSON.stringify(res), {
-			status: 200,
-			headers: {
-				"Cache-Control": "public, max-age=15, stale-while-revalidate=15, stale-if-error=86400",
-				...opts?.headers,
-				"Content-Type": "application/json"
-			}
-		});
-	};
-};
-
-//#endregion
-//#region src/authorize.ts
-/**
-* Formats an error url
-*/
-function formatErrorURL(url, error, description, state) {
-	const searchParams = new URLSearchParams({
-		error,
-		error_description: description
-	});
-	state && searchParams.append("state", state);
-	return `${url}${url.includes("?") ? "&" : "?"}${searchParams.toString()}`;
-}
-const handleRedirect = (ctx, uri) => {
-	if (ctx.headers?.get("accept")?.includes("application/json")) return {
-		redirect: true,
-		url: uri.toString()
-	};
-	else throw ctx.redirect(uri);
-};
-/**
-* Error page url if redirect_uri has not been verified yet
-* Generates Url for custom error page
-*/
-function getErrorURL(ctx, error, description) {
-	return formatErrorURL(ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`, error, description);
-}
-async function authorizeEndpoint(ctx, opts, settings) {
-	if (opts.grantTypes && !opts.grantTypes.includes("authorization_code")) throw new APIError("NOT_FOUND");
-	if (!ctx.request) throw new APIError("UNAUTHORIZED", {
-		error_description: "request not found",
+//#region src/consent.ts
+async function consentEndpoint(ctx, opts) {
+	const _query = (await oAuthState.get())?.query;
+	if (!_query) throw new APIError("BAD_REQUEST", {
+		error_description: "missing oauth query",
 		error: "invalid_request"
 	});
-	const query = ctx.query;
-	if (!query.client_id) throw ctx.redirect(getErrorURL(ctx, "invalid_client", "client_id is required"));
-	if (!query.response_type) throw ctx.redirect(getErrorURL(ctx, "invalid_request", "response_type is required"));
-	const promptSet = ctx.query?.prompt ? parsePrompt(ctx.query?.prompt) : void 0;
-	if (promptSet?.has("select_account") && !opts.selectAccount?.page) throw ctx.redirect(getErrorURL(ctx, `unsupported_prompt_select_account`, "unsupported prompt type"));
-	if (!(query.response_type === "code")) throw ctx.redirect(getErrorURL(ctx, "unsupported_response_type", "unsupported response type"));
-	const client = await getClient(ctx, opts, query.client_id);
-	if (!client) throw ctx.redirect(getErrorURL(ctx, "invalid_client", "client_id is required"));
-	if (client.disabled) throw ctx.redirect(getErrorURL(ctx, "client_disabled", "client is disabled"));
-	if (!client.redirectUris?.find((url) => url === query.redirect_uri) || !query.redirect_uri) throw ctx.redirect(getErrorURL(ctx, "invalid_redirect", "invalid redirect uri"));
-	let requestedScopes = query.scope?.split(" ").filter((s) => s);
+	const query = new URLSearchParams(_query);
+	const originalRequestedScopes = query.get("scope")?.split(" ") ?? [];
+	const clientId = query.get("client_id");
+	if (!clientId) throw new APIError("BAD_REQUEST", {
+		error_description: "client_id is required",
+		error: "invalid_client"
+	});
+	const requestedScopes = ctx.body.scope?.split(" ");
 	if (requestedScopes) {
-		const validScopes = new Set(client.scopes ?? opts.scopes);
-		const invalidScopes = requestedScopes.filter((scope) => {
-			return !validScopes?.has(scope) || scope === "offline_access" && (query.code_challenge_method !== "S256" || !query.code_challenge);
+		if (!requestedScopes.every((sc) => originalRequestedScopes?.includes(sc))) throw new APIError("BAD_REQUEST", {
+			error_description: "Scope not originally requested",
+			error: "invalid_request"
 		});
-		if (invalidScopes.length) throw ctx.redirect(formatErrorURL(query.redirect_uri, "invalid_scope", `The following scopes are invalid: ${invalidScopes.join(", ")}`, query.state));
-	}
-	if (!requestedScopes) {
-		requestedScopes = client.scopes ?? opts.scopes ?? [];
-		query.scope = requestedScopes.join(" ");
 	}
-	if (!query.code_challenge || !query.code_challenge_method) throw ctx.redirect(formatErrorURL(query.redirect_uri, "invalid_request", "pkce is required", query.state));
-	if (!["S256"].includes(query.code_challenge_method)) throw ctx.redirect(formatErrorURL(query.redirect_uri, "invalid_request", "invalid code_challenge method", query.state));
+	if (!(ctx.body.accept === true)) return {
+		redirect: true,
+		url: formatErrorURL(query.get("redirect_uri") ?? "", "access_denied", "User denied access", query.get("state") ?? void 0, getIssuer(ctx, opts))
+	};
 	const session = await getSessionFromCtx(ctx);
-	if (!session || promptSet?.has("login") || promptSet?.has("create")) return redirectWithPromptCode(ctx, opts, promptSet?.has("create") ? "create" : "login");
-	if (settings?.isAuthorize && promptSet?.has("select_account")) return redirectWithPromptCode(ctx, opts, "select_account");
-	if (settings?.isAuthorize && opts.selectAccount) {
-		if (await opts.selectAccount.shouldRedirect({
-			headers: ctx.request.headers,
-			user: session.user,
-			session: session.session,
-			scopes: requestedScopes
-		})) return redirectWithPromptCode(ctx, opts, "select_account");
-	}
-	if (opts.signup?.shouldRedirect) {
-		const signupRedirect = await opts.signup.shouldRedirect({
-			headers: ctx.request.headers,
-			user: session.user,
-			session: session.session,
-			scopes: requestedScopes
-		});
-		if (signupRedirect) return redirectWithPromptCode(ctx, opts, "create", typeof signupRedirect === "string" ? signupRedirect : void 0);
-	}
-	if (!settings?.postLogin && opts.postLogin) {
-		if (await opts.postLogin.shouldRedirect({
-			headers: ctx.request.headers,
-			user: session.user,
-			session: session.session,
-			scopes: requestedScopes
-		})) return redirectWithPromptCode(ctx, opts, "post_login");
-	}
-	if (promptSet?.has("consent")) return redirectWithPromptCode(ctx, opts, "consent");
 	const referenceId = await opts.postLogin?.consentReferenceId?.({
-		user: session.user,
-		session: session.session,
-		scopes: requestedScopes
-	});
-	if (client.skipConsent) return redirectWithAuthorizationCode(ctx, opts, {
-		query,
-		clientId: client.clientId,
-		userId: session.user.id,
-		sessionId: session.session.id,
-		referenceId
+		user: session?.user,
+		session: session?.session,
+		scopes: requestedScopes ?? originalRequestedScopes
 	});
-	const consent = await ctx.context.adapter.findOne({
+	const foundConsent = await ctx.context.adapter.findOne({
 		model: "oauthConsent",
 		where: [
 			{
 				field: "clientId",
-				value: client.clientId
+				value: clientId
 			},
 			{
 				field: "userId",
-				value: session.user.id
+				value: session?.user.id
 			},
 			...referenceId ? [{
 				field: "referenceId",
@@ -223,142 +60,40 @@ async function authorizeEndpoint(ctx, opts, settings) {
 			}] : []
 		]
 	});
-	if (!consent || !requestedScopes.every((val) => consent.scopes.includes(val))) return redirectWithPromptCode(ctx, opts, "consent");
-	return redirectWithAuthorizationCode(ctx, opts, {
-		query,
-		clientId: client.clientId,
-		userId: session.user.id,
-		sessionId: session.session.id,
-		referenceId
-	});
-}
-async function redirectWithAuthorizationCode(ctx, opts, verificationValue) {
-	const code = generateRandomString(32, "a-z", "A-Z", "0-9");
 	const iat = Math.floor(Date.now() / 1e3);
-	const exp = iat + (opts.codeExpiresIn ?? 600);
-	const data = {
-		identifier: await storeToken(opts.storeTokens, code, "authorization_code"),
+	const consent = {
+		clientId,
+		userId: session?.user.id,
+		scopes: requestedScopes ?? originalRequestedScopes,
+		createdAt: /* @__PURE__ */ new Date(iat * 1e3),
 		updatedAt: /* @__PURE__ */ new Date(iat * 1e3),
-		expiresAt: /* @__PURE__ */ new Date(exp * 1e3),
-		value: JSON.stringify({
-			type: "authorization_code",
-			query: ctx.query,
-			userId: verificationValue.userId,
-			sessionId: verificationValue?.sessionId,
-			referenceId: verificationValue.referenceId
-		})
+		referenceId
 	};
-	ctx.context.verification_id ? await ctx.context.internalAdapter.updateVerificationValue(ctx.context.verification_id, data) : await ctx.context.internalAdapter.createVerificationValue({
-		...data,
-		createdAt: /* @__PURE__ */ new Date(iat * 1e3)
-	});
-	const redirectUriWithCode = new URL(verificationValue.query.redirect_uri);
-	redirectUriWithCode.searchParams.set("code", code);
-	if (verificationValue.query.state) redirectUriWithCode.searchParams.set("state", verificationValue.query.state);
-	return handleRedirect(ctx, redirectUriWithCode.toString());
-}
-async function redirectWithPromptCode(ctx, opts, type, page) {
-	const queryParams = await signParams(ctx, opts);
-	let path = opts.loginPage;
-	if (type === "select_account") path = opts.selectAccount?.page ?? opts.loginPage;
-	else if (type === "post_login") {
-		if (!opts.postLogin?.page) throw new APIError("INTERNAL_SERVER_ERROR", { error_description: "postLogin should have been defined" });
-		path = opts.postLogin?.page;
-	} else if (type === "consent") path = opts.consentPage;
-	else if (type === "create") path = opts.signup?.page ?? opts.loginPage;
-	return handleRedirect(ctx, `${page ?? path}?${queryParams}`);
-}
-async function signParams(ctx, opts) {
-	const exp = Math.floor(Date.now() / 1e3) + (opts.codeExpiresIn ?? 600);
-	const params = new URLSearchParams(ctx.query);
-	params.set("exp", String(exp));
-	const signature = await makeSignature(params.toString(), ctx.context.secret);
-	params.append("sig", signature);
-	return params.toString();
-}
-
-//#endregion
-//#region src/consent.ts
-async function consentEndpoint(ctx, opts) {
-	const _query = (await oAuthState.get())?.query;
-	if (!_query) throw new APIError$1("BAD_REQUEST", {
-		error_description: "missing oauth query",
-		error: "invalid_request"
-	});
-	const query = new URLSearchParams(_query);
-	const originalRequestedScopes = query.get("scope")?.split(" ") ?? [];
-	const clientId = query.get("client_id");
-	if (!clientId) throw new APIError$1("BAD_REQUEST", {
-		error_description: "client_id is required",
-		error: "invalid_client"
-	});
-	const requestedScopes = ctx.body.scope?.split(" ");
-	if (requestedScopes) {
-		if (!requestedScopes.every((sc) => originalRequestedScopes?.includes(sc))) throw new APIError$1("BAD_REQUEST", {
-			error_description: "Scope not originally requested",
-			error: "invalid_request"
-		});
-	}
-	if (!(ctx.body.accept === true)) return {
-		redirect: true,
-		uri: formatErrorURL(query.get("redirect_uri") ?? "", "access_denied", "User denied access", query.get("state") ?? void 0)
-	};
-	const session = await getSessionFromCtx(ctx);
-	const referenceId = await opts.postLogin?.consentReferenceId?.({
-		user: session?.user,
-		session: session?.session,
-		scopes: requestedScopes ?? originalRequestedScopes
-	});
-	const foundConsent = await ctx.context.adapter.findOne({
-		model: "oauthConsent",
-		where: [
-			{
-				field: "clientId",
-				value: clientId
-			},
-			{
-				field: "userId",
-				value: session?.user.id
-			},
-			...referenceId ? [{
-				field: "referenceId",
-				value: referenceId
-			}] : []
-		]
-	});
-	const iat = Math.floor(Date.now() / 1e3);
-	const consent = {
-		clientId,
-		userId: session?.user.id,
-		scopes: requestedScopes ?? originalRequestedScopes,
-		createdAt: /* @__PURE__ */ new Date(iat * 1e3),
-		updatedAt: /* @__PURE__ */ new Date(iat * 1e3),
-		referenceId
-	};
-	foundConsent?.id ? await ctx.context.adapter.update({
-		model: "oauthConsent",
-		where: [{
-			field: "id",
-			value: foundConsent.id
-		}],
-		update: {
-			scopes: consent.scopes,
-			updatedAt: /* @__PURE__ */ new Date(iat * 1e3)
-		}
-	}) : await ctx.context.adapter.create({
-		model: "oauthConsent",
-		data: {
-			...consent,
-			scopes: consent.scopes
-		}
+	foundConsent?.id ? await ctx.context.adapter.update({
+		model: "oauthConsent",
+		where: [{
+			field: "id",
+			value: foundConsent.id
+		}],
+		update: {
+			scopes: consent.scopes,
+			updatedAt: /* @__PURE__ */ new Date(iat * 1e3)
+		}
+	}) : await ctx.context.adapter.create({
+		model: "oauthConsent",
+		data: {
+			...consent,
+			scopes: consent.scopes
+		}
 	});
+	if (requestedScopes) query.set("scope", consent.scopes.join(" "));
 	ctx?.headers?.set("accept", "application/json");
 	ctx.query = deleteFromPrompt(query, "consent");
 	ctx.context.postLogin = true;
 	const { url } = await authorizeEndpoint(ctx, opts);
 	return {
 		redirect: true,
-		uri: url
+		url
 	};
 }
 
@@ -368,14 +103,14 @@ async function continueEndpoint(ctx, opts) {
 	if (ctx.body.selected === true) return await selected(ctx, opts);
 	else if (ctx.body.created === true) return await created(ctx, opts);
 	else if (ctx.body.postLogin === true) return await postLogin(ctx, opts);
-	else throw new APIError$1("BAD_REQUEST", {
+	else throw new APIError("BAD_REQUEST", {
 		error_description: "Missing parameters",
 		error: "invalid_request"
 	});
 }
 async function selected(ctx, opts) {
 	const _query = (await oAuthState.get())?.query;
-	if (!_query) throw new APIError$1("BAD_REQUEST", {
+	if (!_query) throw new APIError("BAD_REQUEST", {
 		error_description: "missing oauth query",
 		error: "invalid_request"
 	});
@@ -384,12 +119,12 @@ async function selected(ctx, opts) {
 	const { url } = await authorizeEndpoint(ctx, opts);
 	return {
 		redirect: true,
-		uri: url
+		url
 	};
 }
 async function created(ctx, opts) {
 	const _query = (await oAuthState.get())?.query;
-	if (!_query) throw new APIError$1("BAD_REQUEST", {
+	if (!_query) throw new APIError("BAD_REQUEST", {
 		error_description: "missing oauth query",
 		error: "invalid_request"
 	});
@@ -397,12 +132,12 @@ async function created(ctx, opts) {
 	const { url } = await authorizeEndpoint(ctx, opts);
 	return {
 		redirect: true,
-		uri: url
+		url
 	};
 }
 async function postLogin(ctx, opts) {
 	const _query = (await oAuthState.get())?.query;
-	if (!_query) throw new APIError$1("BAD_REQUEST", {
+	if (!_query) throw new APIError("BAD_REQUEST", {
 		error_description: "missing oauth query",
 		error: "invalid_request"
 	});
@@ -412,7 +147,7 @@ async function postLogin(ctx, opts) {
 	const { url } = await authorizeEndpoint(ctx, opts, { postLogin: true });
 	return {
 		redirect: true,
-		uri: url
+		url
 	};
 }
 
@@ -445,28 +180,28 @@ function userNormalClaims(user, scopes) {
 * Handles the /oauth2/userinfo endpoint
 */
 async function userInfoEndpoint(ctx, opts) {
-	if (!ctx.request) throw new APIError$1("UNAUTHORIZED", {
+	if (!ctx.request) throw new APIError("UNAUTHORIZED", {
 		error_description: "request not found",
 		error: "invalid_request"
 	});
 	const authorization = ctx.request.headers.get("authorization");
 	const token = typeof authorization === "string" && authorization?.startsWith("Bearer ") ? authorization?.replace("Bearer ", "") : authorization;
-	if (!token?.length) throw new APIError$1("UNAUTHORIZED", {
+	if (!token?.length) throw new APIError("UNAUTHORIZED", {
 		error_description: "authorization header not found",
 		error: "invalid_request"
 	});
 	const jwt = await validateAccessToken(ctx, opts, token);
 	const scopes = jwt.scope?.split(" ");
-	if (!scopes?.includes("openid")) throw new APIError$1("BAD_REQUEST", {
+	if (!scopes?.includes("openid")) throw new APIError("BAD_REQUEST", {
 		error_description: "Missing required scope",
 		error: "invalid_scope"
 	});
-	if (!jwt.sub) throw new APIError$1("BAD_REQUEST", {
+	if (!jwt.sub) throw new APIError("BAD_REQUEST", {
 		error_description: "user not found",
 		error: "invalid_request"
 	});
 	const user = await ctx.context.internalAdapter.findUserById(jwt.sub);
-	if (!user) throw new APIError$1("BAD_REQUEST", {
+	if (!user) throw new APIError("BAD_REQUEST", {
 		error_description: "user not found",
 		error: "invalid_request"
 	});
@@ -490,7 +225,7 @@ async function userInfoEndpoint(ctx, opts) {
 */
 async function tokenEndpoint(ctx, opts) {
 	const grantType = ctx.body?.grant_type;
-	if (opts.grantTypes && grantType && !opts.grantTypes.includes(grantType)) throw new APIError$1("BAD_REQUEST", {
+	if (opts.grantTypes && grantType && !opts.grantTypes.includes(grantType)) throw new APIError("BAD_REQUEST", {
 		error_description: `unsupported grant_type ${grantType}`,
 		error: "unsupported_grant_type"
 	});
@@ -498,11 +233,11 @@ async function tokenEndpoint(ctx, opts) {
 		case "authorization_code": return handleAuthorizationCodeGrant(ctx, opts);
 		case "client_credentials": return handleClientCredentialsGrant(ctx, opts);
 		case "refresh_token": return handleRefreshTokenGrant(ctx, opts);
-		case void 0: throw new APIError$1("BAD_REQUEST", {
+		case void 0: throw new APIError("BAD_REQUEST", {
 			error_description: "missing required grant_type",
 			error: "unsupported_grant_type"
 		});
-		default: throw new APIError$1("BAD_REQUEST", {
+		default: throw new APIError("BAD_REQUEST", {
 			error_description: `unsupported grant_type ${grantType}`,
 			error: "unsupported_grant_type"
 		});
@@ -538,11 +273,11 @@ async function createJwtAccessToken(ctx, opts, user, client, audience, scopes, r
 * Creates a user id token in code_authorization with scope of 'openid'
 * and hybrid/implicit (not yet implemented) flows
 */
-async function createIdToken(ctx, opts, user, client, scopes, nonce, sessionId) {
+async function createIdToken(ctx, opts, user, client, scopes, nonce, sessionId, authTime) {
 	const iat = Math.floor(Date.now() / 1e3);
 	const exp = iat + (opts.idTokenExpiresIn ?? 36e3);
 	const userClaims = userNormalClaims(user, scopes);
-	const authTime = Math.floor((ctx.context.session?.session.createdAt ?? /* @__PURE__ */ new Date(iat * 1e3)).getTime() / 1e3);
+	const authTimeSec = authTime != null ? Math.floor(authTime.getTime() / 1e3) : void 0;
 	const acr = "urn:mace:incommon:iap:bronze";
 	const customClaims = opts.customIdTokenClaims ? await opts.customIdTokenClaims({
 		user,
@@ -553,7 +288,7 @@ async function createIdToken(ctx, opts, user, client, scopes, nonce, sessionId)
 	const payload = {
 		...customClaims,
 		...userClaims,
-		auth_time: authTime,
+		auth_time: authTimeSec,
 		acr,
 		iss: jwtPluginOptions?.jwt?.issuer ?? ctx.context.baseURL,
 		sub: user.id,
@@ -582,7 +317,7 @@ async function encodeRefreshToken(opts, token, sessionId) {
 */
 async function decodeRefreshToken(opts, token) {
 	if (opts.prefix?.refreshToken) if (token.startsWith(opts.prefix.refreshToken)) token = token.replace(opts.prefix.refreshToken, "");
-	else throw new APIError$1("BAD_REQUEST", {
+	else throw new APIError("BAD_REQUEST", {
 		error_description: "refresh token not found",
 		error: "invalid_token"
 	});
@@ -608,7 +343,7 @@ async function createOpaqueAccessToken(ctx, opts, user, client, scopes, payload,
 	});
 	return (opts.prefix?.opaqueAccessToken ?? "") + token;
 }
-async function createRefreshToken(ctx, opts, user, referenceId, client, scopes, payload, originalRefresh) {
+async function createRefreshToken(ctx, opts, user, referenceId, client, scopes, payload, originalRefresh, authTime) {
 	const iat = payload.iat ?? Math.floor(Date.now() / 1e3);
 	const exp = payload?.exp ?? iat + (opts.refreshTokenExpiresIn ?? 2592e3);
 	const token = opts.generateRefreshToken ? await opts.generateRefreshToken() : generateRandomString(32, "A-Z", "a-z");
@@ -630,6 +365,7 @@ async function createRefreshToken(ctx, opts, user, referenceId, client, scopes,
 				sessionId,
 				userId: user.id,
 				referenceId,
+				authTime,
 				scopes,
 				createdAt: /* @__PURE__ */ new Date(iat * 1e3),
 				expiresAt: /* @__PURE__ */ new Date(exp * 1e3)
@@ -648,14 +384,14 @@ async function checkResource(ctx, opts, scopes) {
 	if (audience) {
 		if (scopes.includes("openid")) audience.push(`${ctx.context.baseURL}/oauth2/userinfo`);
 		const validAudiences = new Set([...opts.validAudiences ?? [ctx.context.baseURL], scopes?.includes("openid") ? `${ctx.context.baseURL}/oauth2/userinfo` : void 0].flat().filter((v) => v?.length));
-		for (const aud of audience) if (!validAudiences.has(aud)) throw new APIError$1("BAD_REQUEST", {
+		for (const aud of audience) if (!validAudiences.has(aud)) throw new APIError("BAD_REQUEST", {
 			error_description: "requested resource invalid",
 			error: "invalid_request"
 		});
 	}
 	return audience?.length === 1 ? audience.at(0) : audience;
 }
-async function createUserTokens(ctx, opts, client, scopes, user, referenceId, sessionId, nonce, additional) {
+async function createUserTokens(ctx, opts, client, scopes, user, referenceId, sessionId, nonce, additional, authTime) {
 	const iat = Math.floor(Date.now() / 1e3);
 	const defaultExp = iat + (opts.accessTokenExpiresIn ?? 3600);
 	const exp = opts.scopeExpirations ? scopes.map((sc) => opts.scopeExpirations?.[sc] ? toExpJWT(opts.scopeExpirations[sc], iat) : defaultExp).reduce((prev, curr) => {
@@ -669,7 +405,7 @@ async function createUserTokens(ctx, opts, client, scopes, user, referenceId, se
 		iat,
 		exp: iat + (opts.refreshTokenExpiresIn ?? 2592e3),
 		sid: sessionId
-	}, additional?.refreshToken) : void 0;
+	}, additional?.refreshToken, authTime) : void 0;
 	const [accessToken, refreshToken, idToken] = await Promise.all([
 		isJwtAccessToken ? createJwtAccessToken(ctx, opts, user, client, audience, scopes, referenceId, {
 			iat,
@@ -684,8 +420,8 @@ async function createUserTokens(ctx, opts, client, scopes, user, referenceId, se
 			iat,
 			exp: iat + (opts.refreshTokenExpiresIn ?? 2592e3),
 			sid: sessionId
-		}, additional?.refreshToken) : void 0,
-		isIdToken ? createIdToken(ctx, opts, user, client, scopes, nonce, sessionId) : void 0
+		}, additional?.refreshToken, authTime) : void 0,
+		isIdToken ? createIdToken(ctx, opts, user, client, scopes, nonce, sessionId, authTime) : void 0
 	]);
 	return ctx.json({
 		access_token: accessToken,
@@ -704,32 +440,32 @@ async function createUserTokens(ctx, opts, client, scopes, user, referenceId, se
 async function checkVerificationValue(ctx, opts, code, client_id, redirect_uri) {
 	const verification = await ctx.context.internalAdapter.findVerificationValue(await storeToken(opts.storeTokens, code, "authorization_code"));
 	const verificationValue = verification ? JSON.parse(verification?.value) : void 0;
-	if (!verification) throw new APIError$1("UNAUTHORIZED", {
+	if (!verification) throw new APIError("UNAUTHORIZED", {
 		error_description: "Invalid code",
 		error: "invalid_verification"
 	});
 	if (verification?.id) await ctx.context.internalAdapter.deleteVerificationValue(verification.id);
-	if (!verification.expiresAt || verification.expiresAt < /* @__PURE__ */ new Date()) throw new APIError$1("UNAUTHORIZED", {
+	if (!verification.expiresAt || verification.expiresAt < /* @__PURE__ */ new Date()) throw new APIError("UNAUTHORIZED", {
 		error_description: "code expired",
 		error: "invalid_verification"
 	});
-	if (!verificationValue) throw new APIError$1("UNAUTHORIZED", {
+	if (!verificationValue) throw new APIError("UNAUTHORIZED", {
 		error_description: "missing verification value content",
 		error: "invalid_verification"
 	});
-	if (verificationValue.type !== "authorization_code") throw new APIError$1("UNAUTHORIZED", {
+	if (verificationValue.type !== "authorization_code") throw new APIError("UNAUTHORIZED", {
 		error_description: "incorrect verification type",
 		error: "invalid_verification"
 	});
-	if (verificationValue.query.client_id !== client_id) throw new APIError$1("UNAUTHORIZED", {
+	if (verificationValue.query.client_id !== client_id) throw new APIError("UNAUTHORIZED", {
 		error_description: "invalid client_id",
 		error: "invalid_client"
 	});
-	if (!verificationValue.userId) throw new APIError$1("BAD_REQUEST", {
+	if (!verificationValue.userId) throw new APIError("BAD_REQUEST", {
 		error_description: "missing user_id on challenge",
 		error: "invalid_user"
 	});
-	if (verificationValue.query?.redirect_uri && verificationValue.query?.redirect_uri !== redirect_uri) throw new APIError$1("BAD_REQUEST", {
+	if (verificationValue.query?.redirect_uri && verificationValue.query?.redirect_uri !== redirect_uri) throw new APIError("BAD_REQUEST", {
 		error_description: "missing verification redirect_uri",
 		error: "invalid_request"
 	});
@@ -746,50 +482,66 @@ async function handleAuthorizationCodeGrant(ctx, opts) {
 		client_id = res?.client_id;
 		client_secret = res?.client_secret;
 	}
-	if (!client_id) throw new APIError$1("BAD_REQUEST", {
+	if (!client_id) throw new APIError("BAD_REQUEST", {
 		error_description: "client_id is required",
 		error: "invalid_request"
 	});
-	if (!code) throw new APIError$1("BAD_REQUEST", {
+	if (!code) throw new APIError("BAD_REQUEST", {
 		error_description: "code is required",
 		error: "invalid_request"
 	});
-	if (!redirect_uri) throw new APIError$1("BAD_REQUEST", {
+	if (!redirect_uri) throw new APIError("BAD_REQUEST", {
 		error_description: "redirect_uri is required",
 		error: "invalid_request"
 	});
 	const isAuthCodeWithSecret = client_id && client_secret;
 	const isAuthCodeWithPkce = client_id && code && code_verifier;
-	if (!(isAuthCodeWithPkce || isAuthCodeWithSecret)) throw new APIError$1("BAD_REQUEST", {
-		error_description: "Missing a required credential value for authorization_code grant",
+	if (!isAuthCodeWithSecret && !isAuthCodeWithPkce) throw new APIError("BAD_REQUEST", {
+		error_description: "Either code_verifier or client_secret is required",
 		error: "invalid_request"
 	});
 	/** Get and check Verification Value */
 	const verificationValue = await checkVerificationValue(ctx, opts, code, client_id, redirect_uri);
 	const scopes = verificationValue.query.scope?.split(" ");
-	if (!scopes) throw new APIError$1("INTERNAL_SERVER_ERROR", {
+	if (!scopes) throw new APIError("INTERNAL_SERVER_ERROR", {
 		error_description: "verification scope unset",
 		error: "invalid_scope"
 	});
 	/** Verify Client */
 	const client = await validateClientCredentials(ctx, opts, client_id, client_secret, scopes);
-	/** Check challenge */
-	const challenge = code_verifier && verificationValue.query?.code_challenge_method === "S256" ? await generateCodeChallenge(code_verifier) : void 0;
-	if (isAuthCodeWithSecret && (challenge || verificationValue?.query?.code_challenge) && challenge !== verificationValue.query?.code_challenge) throw new APIError$1("UNAUTHORIZED", {
-		error_description: "code verification failed",
-		error: "invalid_request"
-	});
-	if (isAuthCodeWithPkce && challenge !== verificationValue.query?.code_challenge) throw new APIError$1("UNAUTHORIZED", {
-		error_description: "code verification failed",
+	if (isPKCERequired(client, (verificationValue.query?.scope)?.split(" ") || [])) {
+		if (!isAuthCodeWithPkce) throw new APIError("BAD_REQUEST", {
+			error_description: "PKCE is required for this client",
+			error: "invalid_request"
+		});
+	} else if (!(isAuthCodeWithPkce || isAuthCodeWithSecret)) throw new APIError("BAD_REQUEST", {
+		error_description: "Either PKCE (code_verifier) or client authentication (client_secret) is required",
 		error: "invalid_request"
 	});
+	/** Check PKCE challenge if verifier is provided */
+	const pkceUsedInAuth = !!verificationValue.query?.code_challenge;
+	const pkceUsedInToken = !!code_verifier;
+	if (pkceUsedInAuth || pkceUsedInToken) {
+		if (pkceUsedInAuth && !pkceUsedInToken) throw new APIError("UNAUTHORIZED", {
+			error_description: "code_verifier required because PKCE was used in authorization",
+			error: "invalid_request"
+		});
+		if (!pkceUsedInAuth && pkceUsedInToken) throw new APIError("UNAUTHORIZED", {
+			error_description: "code_verifier provided but PKCE was not used in authorization",
+			error: "invalid_request"
+		});
+		if ((verificationValue.query?.code_challenge_method === "S256" ? await generateCodeChallenge(code_verifier) : void 0) !== verificationValue.query?.code_challenge) throw new APIError("UNAUTHORIZED", {
+			error_description: "code verification failed",
+			error: "invalid_request"
+		});
+	}
 	/** Get user */
-	if (!verificationValue.userId) throw new APIError$1("BAD_REQUEST", {
+	if (!verificationValue.userId) throw new APIError("BAD_REQUEST", {
 		error_description: "missing user, user may have been deleted",
 		error: "invalid_user"
 	});
 	const user = await ctx.context.internalAdapter.findUserById(verificationValue.userId);
-	if (!user) throw new APIError$1("BAD_REQUEST", {
+	if (!user) throw new APIError("BAD_REQUEST", {
 		error_description: "missing user, user may have been deleted",
 		error: "invalid_user"
 	});
@@ -800,11 +552,12 @@ async function handleAuthorizationCodeGrant(ctx, opts) {
 			value: verificationValue.sessionId
 		}]
 	});
-	if (!session || session.expiresAt < /* @__PURE__ */ new Date()) throw new APIError$1("BAD_REQUEST", {
+	if (!session || session.expiresAt < /* @__PURE__ */ new Date()) throw new APIError("BAD_REQUEST", {
 		error_description: "session no longer exists",
 		error: "invalid_request"
 	});
-	return createUserTokens(ctx, opts, client, verificationValue.query.scope?.split(" ") ?? [], user, verificationValue.referenceId, session.id, verificationValue.query?.nonce);
+	const authTime = verificationValue.authTime != null ? new Date(verificationValue.authTime) : new Date(session.createdAt);
+	return createUserTokens(ctx, opts, client, verificationValue.query.scope?.split(" ") ?? [], user, verificationValue.referenceId, session.id, verificationValue.query?.nonce, void 0, authTime);
 }
 /**
 * Grant that allows direct access to an API using the application's credentials
@@ -820,11 +573,11 @@ async function handleClientCredentialsGrant(ctx, opts) {
 		client_id = res?.client_id;
 		client_secret = res?.client_secret;
 	}
-	if (!client_id) throw new APIError$1("BAD_REQUEST", {
+	if (!client_id) throw new APIError("BAD_REQUEST", {
 		error_description: "Missing required client_id",
 		error: "invalid_grant"
 	});
-	if (!client_secret) throw new APIError$1("BAD_REQUEST", {
+	if (!client_secret) throw new APIError("BAD_REQUEST", {
 		error_description: "Missing a required client_secret",
 		error: "invalid_grant"
 	});
@@ -838,10 +591,10 @@ async function handleClientCredentialsGrant(ctx, opts) {
 			"email",
 			"offline_access"
 		]);
-		const invalidScopes = requestedScopes.filter((scope$1) => {
-			return !validScopes?.has(scope$1) || oidcScopes.has(scope$1);
+		const invalidScopes = requestedScopes.filter((scope) => {
+			return !validScopes?.has(scope) || oidcScopes.has(scope);
 		});
-		if (invalidScopes.length) throw new APIError$1("BAD_REQUEST", {
+		if (invalidScopes.length) throw new APIError("BAD_REQUEST", {
 			error_description: `The following scopes are invalid: ${invalidScopes.join(", ")}`,
 			error: "invalid_scope"
 		});
@@ -899,11 +652,11 @@ async function handleRefreshTokenGrant(ctx, opts) {
 		client_id = res?.client_id;
 		client_secret = res?.client_secret;
 	}
-	if (!client_id) throw new APIError$1("BAD_REQUEST", {
+	if (!client_id) throw new APIError("BAD_REQUEST", {
 		error_description: "Missing required client_id",
 		error: "invalid_grant"
 	});
-	if (!refresh_token) throw new APIError$1("BAD_REQUEST", {
+	if (!refresh_token) throw new APIError("BAD_REQUEST", {
 		error_description: "Missing a required refresh_token for refresh_token grant",
 		error: "invalid_grant"
 	});
@@ -915,17 +668,17 @@ async function handleRefreshTokenGrant(ctx, opts) {
 			value: await getStoredToken(opts.storeTokens, decodedRefresh.token, "refresh_token")
 		}]
 	});
-	if (!refreshToken) throw new APIError$1("BAD_REQUEST", {
+	if (!refreshToken) throw new APIError("BAD_REQUEST", {
 		error_description: "session not found",
-		error: "invalid_request"
+		error: "invalid_grant"
 	});
-	if (refreshToken.clientId !== client_id) throw new APIError$1("BAD_REQUEST", {
+	if (refreshToken.clientId !== client_id) throw new APIError("BAD_REQUEST", {
 		error_description: "invalid client_id",
 		error: "invalid_client"
 	});
-	if (refreshToken.expiresAt < /* @__PURE__ */ new Date()) throw new APIError$1("BAD_REQUEST", {
+	if (refreshToken.expiresAt < /* @__PURE__ */ new Date()) throw new APIError("BAD_REQUEST", {
 		error_description: "invalid refresh token",
-		error: "invalid_request"
+		error: "invalid_grant"
 	});
 	if (refreshToken.revoked) {
 		await ctx.context.adapter.deleteMany({
@@ -938,27 +691,28 @@ async function handleRefreshTokenGrant(ctx, opts) {
 				value: refreshToken.userId
 			}]
 		});
-		throw new APIError$1("BAD_REQUEST", {
+		throw new APIError("BAD_REQUEST", {
 			error_description: "invalid refresh token",
-			error: "invalid_request"
+			error: "invalid_grant"
 		});
 	}
 	const scopes = refreshToken?.scopes;
 	const requestedScopes = scope?.split(" ");
 	if (requestedScopes) {
 		const validScopes = new Set(scopes);
-		for (const requestedScope of requestedScopes) if (!validScopes.has(requestedScope)) throw new APIError$1("BAD_REQUEST", {
+		for (const requestedScope of requestedScopes) if (!validScopes.has(requestedScope)) throw new APIError("BAD_REQUEST", {
 			error_description: `unable to issue scope ${requestedScope}`,
 			error: "invalid_scope"
 		});
 	}
 	const client = await validateClientCredentials(ctx, opts, client_id, client_secret, requestedScopes ?? scopes);
 	const user = await ctx.context.internalAdapter.findUserById(refreshToken.userId);
-	if (!user) throw new APIError$1("BAD_REQUEST", {
+	if (!user) throw new APIError("BAD_REQUEST", {
 		error_description: "user not found",
 		error: "invalid_request"
 	});
-	return createUserTokens(ctx, opts, client, requestedScopes ?? scopes, user, refreshToken.referenceId, refreshToken.sessionId, void 0, { refreshToken });
+	const authTime = refreshToken.authTime != null ? new Date(refreshToken.authTime) : void 0;
+	return createUserTokens(ctx, opts, client, requestedScopes ?? scopes, user, refreshToken.referenceId, refreshToken.sessionId, void 0, { refreshToken }, authTime);
 }
 
 //#endregion
@@ -991,7 +745,7 @@ async function validateJwtAccessToken(ctx, opts, token, clientId) {
 		});
 	} catch (error) {
 		if (error instanceof Error) {
-			if (error.name === "TypeError" || error.name === "JWSInvalid") throw new APIError("BAD_REQUEST", {
+			if (error.name === "TypeError" || error.name === "JWSInvalid") throw new APIError$1("BAD_REQUEST", {
 				error_description: "invalid JWT signature",
 				error: "invalid_request"
 			});
@@ -1030,7 +784,7 @@ async function validateJwtAccessToken(ctx, opts, token, clientId) {
 async function validateOpaqueAccessToken(ctx, opts, token, clientId) {
 	let tokenValue = token;
 	if (opts.prefix?.opaqueAccessToken) if (tokenValue.startsWith(opts.prefix.opaqueAccessToken)) tokenValue = tokenValue.replace(opts.prefix.opaqueAccessToken, "");
-	else throw new APIError("BAD_REQUEST", {
+	else throw new APIError$1("BAD_REQUEST", {
 		error_description: "opaque access token not found",
 		error: "invalid_request"
 	});
@@ -1041,7 +795,7 @@ async function validateOpaqueAccessToken(ctx, opts, token, clientId) {
 			value: await getStoredToken(opts.storeTokens, tokenValue, "access_token")
 		}]
 	});
-	if (!accessToken) throw new APIError("BAD_REQUEST", {
+	if (!accessToken) throw new APIError$1("BAD_REQUEST", {
 		error_description: "opaque access token not found",
 		error: "invalid_token"
 	});
@@ -1079,8 +833,8 @@ async function validateOpaqueAccessToken(ctx, opts, token, clientId) {
 		client_id: accessToken.clientId,
 		sub: user?.id,
 		sid: sessionId,
-		exp: Math.floor(accessToken.expiresAt.getTime() / 1e3),
-		iat: Math.floor(accessToken.createdAt.getTime() / 1e3),
+		exp: Math.floor(new Date(accessToken.expiresAt).getTime() / 1e3),
+		iat: Math.floor(new Date(accessToken.createdAt).getTime() / 1e3),
 		scope: accessToken.scopes?.join(" ")
 	};
 }
@@ -1097,7 +851,7 @@ async function validateRefreshToken(ctx, opts, token, clientId) {
 			value: await getStoredToken(opts.storeTokens, token, "refresh_token")
 		}]
 	});
-	if (!refreshToken) throw new APIError("BAD_REQUEST", {
+	if (!refreshToken) throw new APIError$1("BAD_REQUEST", {
 		error_description: "token not found",
 		error: "invalid_token"
 	});
@@ -1123,8 +877,8 @@ async function validateRefreshToken(ctx, opts, token, clientId) {
 		iss: ((opts.disableJwtPlugin ? void 0 : getJwtPlugin(ctx.context))?.options)?.jwt?.issuer ?? ctx.context.baseURL,
 		sub: user?.id,
 		sid: sessionId,
-		exp: Math.floor(refreshToken.expiresAt.getTime() / 1e3),
-		iat: Math.floor(refreshToken.createdAt.getTime() / 1e3),
+		exp: Math.floor(new Date(refreshToken.expiresAt).getTime() / 1e3),
+		iat: Math.floor(new Date(refreshToken.createdAt).getTime() / 1e3),
 		scope: refreshToken.scopes?.join(" ")
 	};
 }
@@ -1140,16 +894,16 @@ async function validateAccessToken(ctx, opts, token, clientId) {
 	try {
 		return await validateJwtAccessToken(ctx, opts, token, clientId);
 	} catch (err) {
-		if (err instanceof APIError) {} else if (err instanceof Error) throw err;
+		if (err instanceof APIError$1) {} else if (err instanceof Error) throw err;
 		else throw new Error(err);
 	}
 	try {
 		return await validateOpaqueAccessToken(ctx, opts, token, clientId);
 	} catch (err) {
-		if (err instanceof APIError) {} else if (err instanceof Error) throw err;
+		if (err instanceof APIError$1) {} else if (err instanceof Error) throw err;
 		else throw new Error("Unknown error validating access token");
 	}
-	throw new APIError("BAD_REQUEST", {
+	throw new APIError$1("BAD_REQUEST", {
 		error_description: "Invalid access token",
 		error: "invalid_request"
 	});
@@ -1162,12 +916,12 @@ async function introspectEndpoint(ctx, opts) {
 		client_id = res?.client_id;
 		client_secret = res?.client_secret;
 	}
-	if (!client_id || !client_secret) throw new APIError("UNAUTHORIZED", {
+	if (!client_id || !client_secret) throw new APIError$1("UNAUTHORIZED", {
 		error_description: "missing required credentials",
 		error: "invalid_client"
 	});
 	if (token && typeof token === "string" && token.startsWith("Bearer ")) token = token.replace("Bearer ", "");
-	if (!token?.length) throw new APIError("BAD_REQUEST", {
+	if (!token?.length) throw new APIError$1("BAD_REQUEST", {
 		error_description: "missing a required token for introspection",
 		error: "invalid_request"
 	});
@@ -1176,7 +930,7 @@ async function introspectEndpoint(ctx, opts) {
 		if (token_type_hint === void 0 || token_type_hint === "access_token") try {
 			return await validateAccessToken(ctx, opts, token, client.clientId);
 		} catch (error) {
-			if (error instanceof APIError) {
+			if (error instanceof APIError$1) {
 				if (token_type_hint === "access_token") throw error;
 			} else if (error instanceof Error) throw error;
 			else throw new Error(error);
@@ -1184,25 +938,25 @@ async function introspectEndpoint(ctx, opts) {
 		if (token_type_hint === void 0 || token_type_hint === "refresh_token") try {
 			return await validateRefreshToken(ctx, opts, (await decodeRefreshToken(opts, token)).token, client.clientId);
 		} catch (error) {
-			if (error instanceof APIError) {
+			if (error instanceof APIError$1) {
 				if (token_type_hint === "refresh_token") throw error;
 			} else if (error instanceof Error) throw error;
 			else throw new Error(error);
 		}
-		throw new APIError("BAD_REQUEST", {
+		throw new APIError$1("BAD_REQUEST", {
 			error_description: "token not found",
 			error: "invalid_request"
 		});
 	} catch (error) {
-		if (error instanceof APIError) {
+		if (error instanceof APIError$1) {
 			if (error.name === "BAD_REQUEST") return { active: false };
 			throw error;
 		} else if (error instanceof Error) {
 			logger.error("Introspection error:", error.message, error.stack);
-			throw new APIError("INTERNAL_SERVER_ERROR");
+			throw new APIError$1("INTERNAL_SERVER_ERROR");
 		} else {
 			logger.error("Introspection error:", error);
-			throw new APIError("INTERNAL_SERVER_ERROR");
+			throw new APIError$1("INTERNAL_SERVER_ERROR");
 		}
 	}
 }
@@ -1226,34 +980,34 @@ async function rpInitiatedLogoutEndpoint(ctx, opts) {
 		try {
 			decoded = decodeJwt(id_token_hint);
 		} catch (_e) {
-			throw new APIError("UNAUTHORIZED", {
+			throw new APIError$1("UNAUTHORIZED", {
 				error_description: "invalid id token",
 				error: "invalid_token"
 			});
 		}
 		clientId = decoded?.aud;
-		if (!clientId) throw new APIError("INTERNAL_SERVER_ERROR", {
+		if (!clientId) throw new APIError$1("INTERNAL_SERVER_ERROR", {
 			error_description: "id token missing audience",
 			error: "invalid_request"
 		});
 	}
 	const client = await getClient(ctx, opts, clientId);
-	if (!client) throw new APIError("BAD_REQUEST", {
+	if (!client) throw new APIError$1("BAD_REQUEST", {
 		error_description: "client doesn't exist",
 		error: "invalid_client"
 	});
-	if (client.disabled) throw new APIError("BAD_REQUEST", {
+	if (client.disabled) throw new APIError$1("BAD_REQUEST", {
 		error_description: "client is disabled",
 		error: "invalid_client"
 	});
-	if (!client.enableEndSession) throw new APIError("UNAUTHORIZED", {
+	if (!client.enableEndSession) throw new APIError$1("UNAUTHORIZED", {
 		error_description: "client unable to logout",
 		error: "invalid_client"
 	});
 	let idTokenPayload;
 	if (opts.disableJwtPlugin) {
 		const clientSecret = client.clientSecret;
-		if (!clientSecret) throw new APIError("UNAUTHORIZED", {
+		if (!clientSecret) throw new APIError$1("UNAUTHORIZED", {
 			error_description: "missing required credentials",
 			error: "invalid_client"
 		});
@@ -1266,25 +1020,25 @@ async function rpInitiatedLogoutEndpoint(ctx, opts) {
 		const idToken = new TextDecoder().decode(payload);
 		idTokenPayload = JSON.parse(idToken);
 	}
-	if (!idTokenPayload) throw new APIError("INTERNAL_SERVER_ERROR", {
+	if (!idTokenPayload) throw new APIError$1("INTERNAL_SERVER_ERROR", {
 		error_description: "missing payload",
 		error: "invalid_request"
 	});
-	if ((jwtPluginOptions?.jwt?.issuer ?? ctx.context.baseURL) !== idTokenPayload.iss) throw new APIError("INTERNAL_SERVER_ERROR", {
+	if ((jwtPluginOptions?.jwt?.issuer ?? ctx.context.baseURL) !== idTokenPayload.iss) throw new APIError$1("INTERNAL_SERVER_ERROR", {
 		error_description: "invalid issuer",
 		error: "invalid_request"
 	});
 	const idTokenAudience = typeof idTokenPayload.aud === "string" ? [idTokenPayload.aud] : idTokenPayload.aud;
-	if (!idTokenAudience) throw new APIError("INTERNAL_SERVER_ERROR", {
+	if (!idTokenAudience) throw new APIError$1("INTERNAL_SERVER_ERROR", {
 		error_description: "id token missing audience",
 		error: "invalid_request"
 	});
-	if (client_id && !idTokenAudience.includes(client_id)) throw new APIError("BAD_REQUEST", {
+	if (client_id && !idTokenAudience.includes(client_id)) throw new APIError$1("BAD_REQUEST", {
 		error_description: "audience mismatch",
 		error: "invalid_request"
 	});
 	const sessionId = idTokenPayload.sid;
-	if (!sessionId) throw new APIError("INTERNAL_SERVER_ERROR", {
+	if (!sessionId) throw new APIError$1("INTERNAL_SERVER_ERROR", {
 		error_description: "id token missing session",
 		error: "invalid_request"
 	});
@@ -1322,18 +1076,18 @@ async function rpInitiatedLogoutEndpoint(ctx, opts) {
 //#endregion
 //#region src/register.ts
 async function registerEndpoint(ctx, opts) {
-	if (!opts.allowDynamicClientRegistration) throw new APIError$1("FORBIDDEN", {
+	if (!opts.allowDynamicClientRegistration) throw new APIError("FORBIDDEN", {
 		error: "access_denied",
 		error_description: "Client registration is disabled"
 	});
 	const body = ctx.body;
 	const session = await getSessionFromCtx(ctx);
-	if (!(session || opts.allowUnauthenticatedClientRegistration)) throw new APIError$1("UNAUTHORIZED", {
+	if (!(session || opts.allowUnauthenticatedClientRegistration)) throw new APIError("UNAUTHORIZED", {
 		error: "invalid_token",
 		error_description: "Authentication required for client registration"
 	});
 	const isPublic = body.token_endpoint_auth_method === "none";
-	if (!session && !isPublic) throw new APIError$1("UNAUTHORIZED", {
+	if (!session && !isPublic) throw new APIError("UNAUTHORIZED", {
 		error: "invalid_request",
 		error_description: "Authentication required for confidential client registration"
 	});
@@ -1343,22 +1097,22 @@ async function registerEndpoint(ctx, opts) {
 async function checkOAuthClient(client, opts, settings) {
 	const isPublic = client.token_endpoint_auth_method === "none";
 	if (client.type) {
-		if (isPublic && !(client.type === "native" || client.type === "user-agent-based")) throw new APIError$1("BAD_REQUEST", {
+		if (isPublic && !(client.type === "native" || client.type === "user-agent-based")) throw new APIError("BAD_REQUEST", {
 			error: "invalid_client_metadata",
 			error_description: `Type must be 'native' or 'user-agent-based' for public applications`
 		});
-		else if (!isPublic && !(client.type === "web")) throw new APIError$1("BAD_REQUEST", {
+		else if (!isPublic && !(client.type === "web")) throw new APIError("BAD_REQUEST", {
 			error: "invalid_client_metadata",
 			error_description: `Type must be 'web' for confidential applications`
 		});
 	}
-	if ((!client.grant_types || client.grant_types.includes("authorization_code")) && (!client.redirect_uris || client.redirect_uris.length === 0)) throw new APIError$1("BAD_REQUEST", {
+	if ((!client.grant_types || client.grant_types.includes("authorization_code")) && (!client.redirect_uris || client.redirect_uris.length === 0)) throw new APIError("BAD_REQUEST", {
 		error: "invalid_redirect_uri",
 		error_description: "Redirect URIs are required for authorization_code and implicit grant types"
 	});
 	const grantTypes = client.grant_types ?? ["authorization_code"];
 	const responseTypes = client.response_types ?? ["code"];
-	if (grantTypes.includes("authorization_code") && !responseTypes.includes("code")) throw new APIError$1("BAD_REQUEST", {
+	if (grantTypes.includes("authorization_code") && !responseTypes.includes("code")) throw new APIError("BAD_REQUEST", {
 		error: "invalid_client_metadata",
 		error_description: "When 'authorization_code' grant type is used, 'code' response type must be included"
 	});
@@ -1366,11 +1120,15 @@ async function checkOAuthClient(client, opts, settings) {
 	const allowedScopes = settings?.isRegister ? opts.clientRegistrationAllowedScopes ?? opts.scopes : opts.scopes;
 	if (allowedScopes) {
 		const validScopes = new Set(allowedScopes);
-		for (const requestedScope of requestedScopes ?? []) if (!validScopes?.has(requestedScope)) throw new APIError$1("BAD_REQUEST", {
+		for (const requestedScope of requestedScopes ?? []) if (!validScopes?.has(requestedScope)) throw new APIError("BAD_REQUEST", {
 			error: "invalid_scope",
 			error_description: `cannot request scope ${requestedScope}`
 		});
 	}
+	if (settings?.isRegister && client.require_pkce === false) throw new APIError("BAD_REQUEST", {
+		error: "invalid_client_metadata",
+		error_description: `pkce is required for registered clients.`
+	});
 }
 async function createOAuthClientEndpoint(ctx, opts, settings) {
 	const body = ctx.body;
@@ -1385,7 +1143,7 @@ async function createOAuthClientEndpoint(ctx, opts, settings) {
 		user: session?.user,
 		session: session?.session
 	}) : void 0;
-	const schema$1 = oauthToSchema({
+	const schema = oauthToSchema({
 		...body ?? {},
 		disabled: void 0,
 		jwks: void 0,
@@ -1400,7 +1158,11 @@ async function createOAuthClientEndpoint(ctx, opts, settings) {
 	});
 	const client = await ctx.context.adapter.create({
 		model: "oauthClient",
-		data: schema$1
+		data: {
+			...schema,
+			createdAt: /* @__PURE__ */ new Date(iat * 1e3),
+			updatedAt: /* @__PURE__ */ new Date(iat * 1e3)
+		}
 	});
 	return ctx.json(schemaToOAuth({
 		...client,
@@ -1420,7 +1182,7 @@ async function createOAuthClientEndpoint(ctx, opts, settings) {
 * @returns
 */
 function oauthToSchema(input) {
-	const { client_id: clientId, client_secret: clientSecret, client_secret_expires_at: _expiresAt, scope: _scope, user_id: userId, client_id_issued_at: _createdAt, client_name: name, client_uri: uri, logo_uri: icon, contacts, tos_uri: tos, policy_uri: policy, jwks: _jwks, jwks_uri: _jwksUri, software_id: softwareId, software_version: softwareVersion, software_statement: softwareStatement, redirect_uris: redirectUris, post_logout_redirect_uris: postLogoutRedirectUris, token_endpoint_auth_method: tokenEndpointAuthMethod, grant_types: grantTypes, response_types: responseTypes, public: _public, type, disabled, skip_consent: skipConsent, enable_end_session: enableEndSession, reference_id: referenceId, metadata: inputMetadata, ...rest } = input;
+	const { client_id: clientId, client_secret: clientSecret, client_secret_expires_at: _expiresAt, scope: _scope, user_id: userId, client_id_issued_at: _createdAt, client_name: name, client_uri: uri, logo_uri: icon, contacts, tos_uri: tos, policy_uri: policy, jwks: _jwks, jwks_uri: _jwksUri, software_id: softwareId, software_version: softwareVersion, software_statement: softwareStatement, redirect_uris: redirectUris, post_logout_redirect_uris: postLogoutRedirectUris, token_endpoint_auth_method: tokenEndpointAuthMethod, grant_types: grantTypes, response_types: responseTypes, public: _public, type, disabled, skip_consent: skipConsent, enable_end_session: enableEndSession, require_pkce: requirePKCE, reference_id: referenceId, metadata: inputMetadata, ...rest } = input;
 	const expiresAt = _expiresAt ? /* @__PURE__ */ new Date(_expiresAt * 1e3) : void 0;
 	const createdAt = _createdAt ? /* @__PURE__ */ new Date(_createdAt * 1e3) : void 0;
 	const scopes = _scope?.split(" ");
@@ -1454,6 +1216,7 @@ function oauthToSchema(input) {
 		type,
 		skipConsent,
 		enableEndSession,
+		requirePKCE,
 		referenceId,
 		metadata: Object.keys(metadataObj).length ? JSON.stringify(metadataObj) : void 0
 	};
@@ -1465,9 +1228,9 @@ function oauthToSchema(input) {
 * @returns
 */
 function schemaToOAuth(input) {
-	const { clientId, clientSecret, disabled, scopes, userId, createdAt, updatedAt: _updatedAt, expiresAt, name, uri, icon, contacts, tos, policy, softwareId, softwareVersion, softwareStatement, redirectUris, postLogoutRedirectUris, tokenEndpointAuthMethod, grantTypes, responseTypes, public: _public, type, skipConsent, enableEndSession, referenceId, metadata } = input;
-	const _expiresAt = expiresAt ? Math.round(expiresAt.getTime() / 1e3) : void 0;
-	const _createdAt = createdAt ? Math.round(createdAt.getTime() / 1e3) : void 0;
+	const { clientId, clientSecret, disabled, scopes, userId, createdAt, updatedAt: _updatedAt, expiresAt, name, uri, icon, contacts, tos, policy, softwareId, softwareVersion, softwareStatement, redirectUris, postLogoutRedirectUris, tokenEndpointAuthMethod, grantTypes, responseTypes, public: _public, type, skipConsent, enableEndSession, requirePKCE, referenceId, metadata } = input;
+	const _expiresAt = expiresAt ? Math.round(new Date(expiresAt).getTime() / 1e3) : void 0;
+	const _createdAt = createdAt ? Math.round(new Date(createdAt).getTime() / 1e3) : void 0;
 	const _scopes = scopes?.join(" ");
 	return {
 		...parseClientMetadata(metadata),
@@ -1496,14 +1259,26 @@ function schemaToOAuth(input) {
 		disabled: disabled ?? void 0,
 		skip_consent: skipConsent ?? void 0,
 		enable_end_session: enableEndSession ?? void 0,
+		require_pkce: requirePKCE ?? void 0,
 		reference_id: referenceId ?? void 0
 	};
 }
 
 //#endregion
 //#region src/types/zod.ts
+const DANGEROUS_SCHEMES = [
+	"javascript:",
+	"data:",
+	"vbscript:"
+];
+function isLocalhost(hostname) {
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
 /**
-* Reusable URL validation that disallows javascript: scheme
+* Reusable URL validation for OAuth redirect URIs.
+* - Blocks dangerous schemes (javascript:, data:, vbscript:)
+* - For http/https: requires HTTPS (HTTP allowed only for localhost)
+* - Allows custom schemes for mobile apps (e.g., myapp://callback)
 */
 const SafeUrlSchema = z.url().superRefine((val, ctx) => {
 	if (!URL.canParse(val)) {
@@ -1514,33 +1289,44 @@ const SafeUrlSchema = z.url().superRefine((val, ctx) => {
 		});
 		return z.NEVER;
 	}
-}).refine((url) => {
-	const u = new URL(url);
-	return u.protocol !== "javascript:" && u.protocol !== "data:" && u.protocol !== "vbscript:";
-}, { message: "URL cannot use javascript:, data:, or vbscript: scheme" });
+	const u = new URL(val);
+	if (DANGEROUS_SCHEMES.includes(u.protocol)) {
+		ctx.addIssue({
+			code: "custom",
+			message: "URL cannot use javascript:, data:, or vbscript: scheme"
+		});
+		return;
+	}
+	if (u.protocol === "http:" || u.protocol === "https:") {
+		if (u.protocol === "http:" && !isLocalhost(u.hostname)) ctx.addIssue({
+			code: "custom",
+			message: "Redirect URI must use HTTPS (HTTP allowed only for localhost)"
+		});
+	}
+});
 
 //#endregion
 //#region src/oauthClient/endpoints.ts
 async function getClientEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	if (!session) throw new APIError$1("UNAUTHORIZED");
-	if (!ctx.headers) throw new APIError$1("BAD_REQUEST");
+	if (!session) throw new APIError("UNAUTHORIZED");
+	if (!ctx.headers) throw new APIError("BAD_REQUEST");
 	if (opts.clientPrivileges && !await opts.clientPrivileges({
 		headers: ctx.headers,
 		action: "read",
 		session: session.session,
 		user: session.user
-	})) throw new APIError$1("UNAUTHORIZED");
+	})) throw new APIError("UNAUTHORIZED");
 	const client = await getClient(ctx, opts, ctx.query.client_id);
-	if (!client) throw new APIError$1("NOT_FOUND", {
+	if (!client) throw new APIError("NOT_FOUND", {
 		error_description: "client not found",
 		error: "not_found"
 	});
 	if (client.userId) {
-		if (client.userId !== session.user.id) throw new APIError$1("UNAUTHORIZED");
+		if (client.userId !== session.user.id) throw new APIError("UNAUTHORIZED");
 	} else if (client.referenceId && opts.clientReference) {
-		if (client.referenceId !== await opts.clientReference(session)) throw new APIError$1("UNAUTHORIZED");
-	} else throw new APIError$1("UNAUTHORIZED");
+		if (client.referenceId !== await opts.clientReference(session)) throw new APIError("UNAUTHORIZED");
+	} else throw new APIError("UNAUTHORIZED");
 	const res = schemaToOAuth(client);
 	res.client_secret = void 0;
 	return res;
@@ -1551,11 +1337,11 @@ async function getClientEndpoint(ctx, opts) {
 */
 async function getClientPublicEndpoint(ctx, opts) {
 	const client = await getClient(ctx, opts, ctx.query.client_id);
-	if (!client) throw new APIError$1("NOT_FOUND", {
+	if (!client) throw new APIError("NOT_FOUND", {
 		error_description: "client not found",
 		error: "not_found"
 	});
-	if (client.disabled) throw new APIError$1("NOT_FOUND", {
+	if (client.disabled) throw new APIError("NOT_FOUND", {
 		error_description: "client not found",
 		error: "not_found"
 	});
@@ -1571,14 +1357,14 @@ async function getClientPublicEndpoint(ctx, opts) {
 }
 async function getClientsEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	if (!session) throw new APIError$1("UNAUTHORIZED");
-	if (!ctx.headers) throw new APIError$1("BAD_REQUEST");
+	if (!session) throw new APIError("UNAUTHORIZED");
+	if (!ctx.headers) throw new APIError("BAD_REQUEST");
 	if (opts.clientPrivileges && !await opts.clientPrivileges({
 		headers: ctx.headers,
 		action: "list",
 		session: session.session,
 		user: session.user
-	})) throw new APIError$1("UNAUTHORIZED");
+	})) throw new APIError("UNAUTHORIZED");
 	const referenceId = await opts.clientReference?.(session);
 	if (referenceId) return await ctx.context.adapter.findMany({
 		model: "oauthClient",
@@ -1589,9 +1375,9 @@ async function getClientsEndpoint(ctx, opts) {
 	}).then((res) => {
 		if (!res) return null;
 		return res.map((v) => {
-			const res$1 = schemaToOAuth(v);
-			res$1.client_secret = void 0;
-			return res$1;
+			const res = schemaToOAuth(v);
+			res.client_secret = void 0;
+			return res;
 		});
 	});
 	else if (session.user.id) return await ctx.context.adapter.findMany({
@@ -1603,38 +1389,38 @@ async function getClientsEndpoint(ctx, opts) {
 	}).then((res) => {
 		if (!res) return null;
 		return res.map((v) => {
-			const res$1 = schemaToOAuth(v);
-			res$1.client_secret = void 0;
-			return res$1;
+			const res = schemaToOAuth(v);
+			res.client_secret = void 0;
+			return res;
 		});
 	});
-	else throw new APIError$1("BAD_REQUEST", { message: "either user_id or reference_id must be provided" });
+	else throw new APIError("BAD_REQUEST", { message: "either user_id or reference_id must be provided" });
 }
 async function deleteClientEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	if (!session) throw new APIError$1("UNAUTHORIZED");
-	if (!ctx.headers) throw new APIError$1("BAD_REQUEST");
+	if (!session) throw new APIError("UNAUTHORIZED");
+	if (!ctx.headers) throw new APIError("BAD_REQUEST");
 	if (opts.clientPrivileges && !await opts.clientPrivileges({
 		headers: ctx.headers,
 		action: "delete",
 		session: session.session,
 		user: session.user
-	})) throw new APIError$1("UNAUTHORIZED");
+	})) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
-	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError$1("INTERNAL_SERVER_ERROR", {
+	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
 		error_description: "trusted clients must be updated manually",
 		error: "invalid_client"
 	});
 	const client = await getClient(ctx, opts, clientId);
-	if (!client) throw new APIError$1("NOT_FOUND", {
+	if (!client) throw new APIError("NOT_FOUND", {
 		error_description: "client not found",
 		error: "not_found"
 	});
 	if (client.userId) {
-		if (client.userId !== session.user.id) throw new APIError$1("UNAUTHORIZED");
+		if (client.userId !== session.user.id) throw new APIError("UNAUTHORIZED");
 	} else if (client.referenceId && opts.clientReference) {
-		if (client.referenceId !== await opts.clientReference(session)) throw new APIError$1("UNAUTHORIZED");
-	} else throw new APIError$1("UNAUTHORIZED");
+		if (client.referenceId !== await opts.clientReference(session)) throw new APIError("UNAUTHORIZED");
+	} else throw new APIError("UNAUTHORIZED");
 	await ctx.context.adapter.delete({
 		model: "oauthClient",
 		where: [{
@@ -1645,34 +1431,34 @@ async function deleteClientEndpoint(ctx, opts) {
 }
 async function updateClientEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	if (!session) throw new APIError$1("UNAUTHORIZED");
-	if (!ctx.headers) throw new APIError$1("BAD_REQUEST");
+	if (!session) throw new APIError("UNAUTHORIZED");
+	if (!ctx.headers) throw new APIError("BAD_REQUEST");
 	if (opts.clientPrivileges && !await opts.clientPrivileges({
 		headers: ctx.headers,
 		action: "update",
 		session: session.session,
 		user: session.user
-	})) throw new APIError$1("UNAUTHORIZED");
+	})) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
-	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError$1("INTERNAL_SERVER_ERROR", {
+	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
 		error_description: "trusted clients must be updated manually",
 		error: "invalid_client"
 	});
 	const client = await getClient(ctx, opts, clientId);
-	if (!client) throw new APIError$1("NOT_FOUND", {
+	if (!client) throw new APIError("NOT_FOUND", {
 		error_description: "client not found",
 		error: "not_found"
 	});
 	if (client.userId) {
-		if (client.userId !== session.user.id) throw new APIError$1("UNAUTHORIZED");
+		if (client.userId !== session.user.id) throw new APIError("UNAUTHORIZED");
 	} else if (client.referenceId && opts.clientReference) {
-		if (client.referenceId !== await opts.clientReference(session)) throw new APIError$1("UNAUTHORIZED");
-	} else throw new APIError$1("UNAUTHORIZED");
+		if (client.referenceId !== await opts.clientReference(session)) throw new APIError("UNAUTHORIZED");
+	} else throw new APIError("UNAUTHORIZED");
 	const updates = ctx.body.update;
 	if (Object.keys(updates).length === 0) {
-		const res$1 = schemaToOAuth(client);
-		res$1.client_secret = void 0;
-		return res$1;
+		const res = schemaToOAuth(client);
+		res.client_secret = void 0;
+		return res;
 	}
 	await checkOAuthClient({
 		...schemaToOAuth(client),
@@ -1684,9 +1470,12 @@ async function updateClientEndpoint(ctx, opts) {
 			field: "clientId",
 			value: clientId
 		}],
-		update: oauthToSchema(updates)
+		update: {
+			...oauthToSchema(updates),
+			updatedAt: /* @__PURE__ */ new Date(Math.floor(Date.now() / 1e3) * 1e3)
+		}
 	});
-	if (!updatedClient) throw new APIError$1("INTERNAL_SERVER_ERROR", {
+	if (!updatedClient) throw new APIError("INTERNAL_SERVER_ERROR", {
 		error_description: "unable to update client",
 		error: "invalid_client"
 	});
@@ -1696,30 +1485,30 @@ async function updateClientEndpoint(ctx, opts) {
 }
 async function rotateClientSecretEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	if (!session) throw new APIError$1("UNAUTHORIZED");
-	if (!ctx.headers) throw new APIError$1("BAD_REQUEST");
+	if (!session) throw new APIError("UNAUTHORIZED");
+	if (!ctx.headers) throw new APIError("BAD_REQUEST");
 	if (opts.clientPrivileges && !await opts.clientPrivileges({
 		headers: ctx.headers,
 		action: "rotate",
 		session: session.session,
 		user: session.user
-	})) throw new APIError$1("UNAUTHORIZED");
+	})) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
-	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError$1("INTERNAL_SERVER_ERROR", {
+	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
 		error_description: "trusted clients must be updated manually",
 		error: "invalid_client"
 	});
 	const client = await getClient(ctx, opts, clientId);
-	if (!client) throw new APIError$1("NOT_FOUND", {
+	if (!client) throw new APIError("NOT_FOUND", {
 		error_description: "client not found",
 		error: "not_found"
 	});
 	if (client.userId) {
-		if (client.userId !== session.user.id) throw new APIError$1("UNAUTHORIZED");
+		if (client.userId !== session.user.id) throw new APIError("UNAUTHORIZED");
 	} else if (client.referenceId && opts.clientReference) {
-		if (client.referenceId !== await opts.clientReference(session)) throw new APIError$1("UNAUTHORIZED");
-	} else throw new APIError$1("UNAUTHORIZED");
-	if (client.public || !client.clientSecret) throw new APIError$1("BAD_REQUEST", {
+		if (client.referenceId !== await opts.clientReference(session)) throw new APIError("UNAUTHORIZED");
+	} else throw new APIError("UNAUTHORIZED");
+	if (client.public || !client.clientSecret) throw new APIError("BAD_REQUEST", {
 		error_description: "public clients cannot be updated",
 		error: "invalid_client"
 	});
@@ -1732,11 +1521,11 @@ async function rotateClientSecretEndpoint(ctx, opts) {
 			value: clientId
 		}],
 		update: {
-			...schemaToOAuth(client),
-			clientSecret: storedClientSecret
+			clientSecret: storedClientSecret,
+			updatedAt: /* @__PURE__ */ new Date(Math.floor(Date.now() / 1e3) * 1e3)
 		}
 	});
-	if (!updatedClient) throw new APIError$1("INTERNAL_SERVER_ERROR", {
+	if (!updatedClient) throw new APIError("INTERNAL_SERVER_ERROR", {
 		error_description: "unable to update client",
 		error: "invalid_client"
 	});
@@ -1782,6 +1571,7 @@ const adminCreateOAuthClient = (opts) => createAuthEndpoint("/admin/oauth2/creat
 		client_secret_expires_at: z.union([z.string(), z.number()]).optional().default(0),
 		skip_consent: z.boolean().optional(),
 		enable_end_session: z.boolean().optional(),
+		require_pkce: z.boolean().optional(),
 		metadata: z.record(z.string(), z.unknown()).optional()
 	}),
 	metadata: {
@@ -1908,6 +1698,11 @@ const adminCreateOAuthClient = (opts) => createAuthEndpoint("/admin/oauth2/creat
 							type: "boolean",
 							description: "Whether the client is disabled"
 						},
+						require_pkce: {
+							type: "boolean",
+							description: "Whether the client requires PKCE",
+							default: true
+						},
 						metadata: {
 							type: "object",
 							additionalProperties: true,
@@ -2221,23 +2016,23 @@ async function getConsent(ctx, opts, id) {
 }
 async function getConsentEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	if (!session) throw new APIError$1("UNAUTHORIZED");
+	if (!session) throw new APIError("UNAUTHORIZED");
 	const { id } = ctx.query;
-	if (!id) throw new APIError$1("NOT_FOUND", {
+	if (!id) throw new APIError("NOT_FOUND", {
 		error_description: "missing id parameter",
 		error: "not_found"
 	});
 	const consent = await getConsent(ctx, opts, id);
-	if (!consent) throw new APIError$1("NOT_FOUND", {
+	if (!consent) throw new APIError("NOT_FOUND", {
 		error_description: "no consent",
 		error: "not_found"
 	});
-	if (consent.userId !== session.user.id) throw new APIError$1("UNAUTHORIZED");
+	if (consent.userId !== session.user.id) throw new APIError("UNAUTHORIZED");
 	return consent;
 }
 async function getConsentsEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	if (!session) throw new APIError$1("UNAUTHORIZED");
+	if (!session) throw new APIError("UNAUTHORIZED");
 	return await ctx.context.adapter.findMany({
 		model: "oauthConsent",
 		where: [{
@@ -2248,18 +2043,18 @@ async function getConsentsEndpoint(ctx, opts) {
 }
 async function deleteConsentEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	if (!session) throw new APIError$1("UNAUTHORIZED");
+	if (!session) throw new APIError("UNAUTHORIZED");
 	const { id } = ctx.body;
-	if (!id) throw new APIError$1("NOT_FOUND", {
+	if (!id) throw new APIError("NOT_FOUND", {
 		error_description: "missing id parameter",
 		error: "not_found"
 	});
 	const consent = await getConsent(ctx, opts, id);
-	if (!consent) throw new APIError$1("NOT_FOUND", {
+	if (!consent) throw new APIError("NOT_FOUND", {
 		error_description: "no consent",
 		error: "not_found"
 	});
-	if (consent.userId !== session.user.id) throw new APIError$1("UNAUTHORIZED");
+	if (consent.userId !== session.user.id) throw new APIError("UNAUTHORIZED");
 	await ctx.context.adapter.delete({
 		model: "oauthConsent",
 		where: [{
@@ -2270,27 +2065,27 @@ async function deleteConsentEndpoint(ctx, opts) {
 }
 async function updateConsentEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	if (!session) throw new APIError$1("UNAUTHORIZED");
+	if (!session) throw new APIError("UNAUTHORIZED");
 	const { id } = ctx.body;
-	if (!id) throw new APIError$1("NOT_FOUND", {
+	if (!id) throw new APIError("NOT_FOUND", {
 		error_description: "missing id parameter",
 		error: "not_found"
 	});
 	const consent = await getConsent(ctx, opts, id);
-	if (!consent) throw new APIError$1("NOT_FOUND", {
+	if (!consent) throw new APIError("NOT_FOUND", {
 		error_description: "no consent",
 		error: "not_found"
 	});
 	const client = await getClient(ctx, opts, consent.clientId);
-	if (!consent) throw new APIError$1("NOT_FOUND", {
+	if (!consent) throw new APIError("NOT_FOUND", {
 		error_description: "no consent",
 		error: "not_found"
 	});
-	if (consent.userId !== session.user.id) throw new APIError$1("UNAUTHORIZED");
+	if (consent.userId !== session.user.id) throw new APIError("UNAUTHORIZED");
 	const allowedScopes = client?.scopes ?? opts.scopes ?? [];
 	const updates = ctx.body.update;
 	const scopes = updates.scopes;
-	if (scopes && !scopes.every((val) => allowedScopes?.includes(val))) throw new APIError$1("BAD_REQUEST", {
+	if (scopes && !scopes.every((val) => allowedScopes?.includes(val))) throw new APIError("BAD_REQUEST", {
 		error_description: `unable to provide scopes to ${client?.referenceId ?? client?.userId}`,
 		error: "invalid_request"
 	});
@@ -2373,7 +2168,7 @@ async function revokeJwtAccessToken(ctx, opts, token) {
 		});
 	} catch (error) {
 		if (error instanceof Error) {
-			if (error.name === "TypeError" || error.name === "JWSInvalid") throw new APIError("BAD_REQUEST", {
+			if (error.name === "TypeError" || error.name === "JWSInvalid") throw new APIError$1("BAD_REQUEST", {
 				error_description: "invalid JWT signature",
 				error: "invalid_request"
 			});
@@ -2390,7 +2185,7 @@ async function revokeJwtAccessToken(ctx, opts, token) {
 async function revokeOpaqueAccessToken(ctx, opts, token, clientId) {
 	let tokenValue = token;
 	if (opts.prefix?.opaqueAccessToken) if (tokenValue.startsWith(opts.prefix.opaqueAccessToken)) tokenValue = tokenValue.replace(opts.prefix.opaqueAccessToken, "");
-	else throw new APIError("BAD_REQUEST", {
+	else throw new APIError$1("BAD_REQUEST", {
 		error_description: "opaque access token not found",
 		error: "invalid_request"
 	});
@@ -2401,7 +2196,7 @@ async function revokeOpaqueAccessToken(ctx, opts, token, clientId) {
 			value: await getStoredToken(opts.storeTokens, tokenValue, "access_token")
 		}]
 	});
-	if (!accessToken) throw new APIError("BAD_REQUEST", {
+	if (!accessToken) throw new APIError$1("BAD_REQUEST", {
 		error_description: "opaque access token not found",
 		error: "invalid_request"
 	});
@@ -2431,7 +2226,7 @@ async function revokeRefreshToken(ctx, opts, token, clientId) {
 			value: await getStoredToken(opts.storeTokens, token, "refresh_token")
 		}]
 	});
-	if (!refreshToken) throw new APIError("BAD_REQUEST", {
+	if (!refreshToken) throw new APIError$1("BAD_REQUEST", {
 		error_description: "token not found",
 		error: "invalid_request"
 	});
@@ -2446,7 +2241,7 @@ async function revokeRefreshToken(ctx, opts, token, clientId) {
 				value: refreshToken.userId
 			}]
 		});
-		throw new APIError("BAD_REQUEST", {
+		throw new APIError$1("BAD_REQUEST", {
 			error_description: "refresh token revoked",
 			error: "invalid_request"
 		});
@@ -2476,16 +2271,16 @@ async function revokeAccessToken(ctx, opts, clientId, token) {
 	try {
 		return await revokeJwtAccessToken(ctx, opts, token);
 	} catch (err) {
-		if (err instanceof APIError) {} else if (err instanceof Error) throw err;
+		if (err instanceof APIError$1) {} else if (err instanceof Error) throw err;
 		else throw new Error(err);
 	}
 	try {
 		return await revokeOpaqueAccessToken(ctx, opts, token, clientId);
 	} catch (err) {
-		if (err instanceof APIError) {} else if (err instanceof Error) throw err;
+		if (err instanceof APIError$1) {} else if (err instanceof Error) throw err;
 		else throw new Error("Unknown error validating access token");
 	}
-	throw new APIError("BAD_REQUEST", {
+	throw new APIError$1("BAD_REQUEST", {
 		error_description: "Invalid access token",
 		error: "invalid_request"
 	});
@@ -2498,12 +2293,12 @@ async function revokeEndpoint(ctx, opts) {
 		client_id = res?.client_id;
 		client_secret = res?.client_secret;
 	}
-	if (!client_id) throw new APIError("UNAUTHORIZED", {
+	if (!client_id) throw new APIError$1("UNAUTHORIZED", {
 		error_description: "missing required credentials",
 		error: "invalid_client"
 	});
 	if (typeof token === "string" && token.startsWith("Bearer ")) token = token.replace("Bearer ", "");
-	if (!token?.length) throw new APIError("BAD_REQUEST", {
+	if (!token?.length) throw new APIError$1("BAD_REQUEST", {
 		error_description: "missing a required token for introspection",
 		error: "invalid_request"
 	});
@@ -2512,7 +2307,7 @@ async function revokeEndpoint(ctx, opts) {
 		if (token_type_hint === void 0 || token_type_hint === "access_token") try {
 			return await revokeAccessToken(ctx, opts, client.clientId, token);
 		} catch (error) {
-			if (error instanceof APIError) {
+			if (error instanceof APIError$1) {
 				if (token_type_hint === "access_token") throw error;
 			} else if (error instanceof Error) throw error;
 			else throw new Error(error);
@@ -2520,25 +2315,25 @@ async function revokeEndpoint(ctx, opts) {
 		if (token_type_hint === void 0 || token_type_hint === "refresh_token") try {
 			return await revokeRefreshToken(ctx, opts, (await decodeRefreshToken(opts, token)).token, client.clientId);
 		} catch (error) {
-			if (error instanceof APIError) {
+			if (error instanceof APIError$1) {
 				if (token_type_hint === "refresh_token") throw error;
 			} else if (error instanceof Error) throw error;
 			else throw new Error(error);
 		}
-		throw new APIError("BAD_REQUEST", {
+		throw new APIError$1("BAD_REQUEST", {
 			error_description: "token not found",
 			error: "invalid_request"
 		});
 	} catch (error) {
-		if (error instanceof APIError) {
+		if (error instanceof APIError$1) {
 			if (error.name === "BAD_REQUEST") return null;
 			throw error;
 		} else if (error instanceof Error) {
 			logger.error("Introspection error:", error.message, error.stack);
-			throw new APIError("INTERNAL_SERVER_ERROR");
+			throw new APIError$1("INTERNAL_SERVER_ERROR");
 		} else {
 			logger.error("Introspection error:", error);
-			throw new APIError("INTERNAL_SERVER_ERROR");
+			throw new APIError$1("INTERNAL_SERVER_ERROR");
 		}
 	}
 }
@@ -2655,6 +2450,10 @@ const schema = {
 				type: "string",
 				required: false
 			},
+			requirePKCE: {
+				type: "boolean",
+				required: false
+			},
 			referenceId: {
 				type: "string",
 				required: false
@@ -2705,6 +2504,10 @@ const schema = {
 			type: "date",
 			required: false
 		},
+		authTime: {
+			type: "date",
+			required: false
+		},
 		scopes: {
 			type: "string[]",
 			required: true
@@ -2798,6 +2601,7 @@ const schema = {
 //#endregion
 //#region src/oauth.ts
 const oAuthState = defineRequestState(() => null);
+const getOAuthProviderState = oAuthState.get;
 /**
 * oAuth 2.1 provider plugin for Better Auth.
 *
@@ -2886,7 +2690,7 @@ const oauthProvider = (options) => {
 					queryParams.delete("sig");
 					queryParams = new URLSearchParams(queryParams);
 					const verifySig = await makeSignature(queryParams.toString(), ctx.context.secret);
-					if (!sig || !constantTimeEqual(sig, verifySig) || /* @__PURE__ */ new Date(exp * 1e3) < /* @__PURE__ */ new Date()) throw new APIError$1("BAD_REQUEST", { error: "invalid_signature" });
+					if (!sig || !constantTimeEqual(sig, verifySig) || /* @__PURE__ */ new Date(exp * 1e3) < /* @__PURE__ */ new Date()) throw new APIError("BAD_REQUEST", { error: "invalid_signature" });
 					queryParams.delete("exp");
 					await oAuthState.set({ query: new URLSearchParams(queryParams).toString() });
 					if (ctx.path === "/sign-in/social" || ctx.path === "/sign-in/oauth2") {
@@ -2920,13 +2724,18 @@ const oauthProvider = (options) => {
 				metadata: { SERVER_ONLY: true }
 			}, async (ctx) => {
 				if (opts.scopes && opts.scopes.includes("openid")) return oidcServerMetadata(ctx, opts);
-				else return authServerMetadata(ctx, opts.disableJwtPlugin ? void 0 : getJwtPlugin(ctx.context)?.options, { scopes_supported: opts.advertisedMetadata?.scopes_supported ?? opts.scopes });
+				else return authServerMetadata(ctx, opts.disableJwtPlugin ? void 0 : getJwtPlugin(ctx.context)?.options, {
+					scopes_supported: opts.advertisedMetadata?.scopes_supported ?? opts.scopes,
+					public_client_supported: opts.allowUnauthenticatedClientRegistration,
+					grant_types_supported: opts.grantTypes,
+					jwt_disabled: opts.disableJwtPlugin
+				});
 			}),
 			getOpenIdConfig: createAuthEndpoint("/.well-known/openid-configuration", {
 				method: "GET",
 				metadata: { SERVER_ONLY: true }
 			}, async (ctx) => {
-				if (opts.scopes && !opts.scopes.includes("openid")) throw new APIError$1("NOT_FOUND");
+				if (opts.scopes && !opts.scopes.includes("openid")) throw new APIError("NOT_FOUND");
 				return oidcServerMetadata(ctx, opts);
 			}),
 			oauth2Authorize: createAuthEndpoint("/oauth2/authorize", {
@@ -2941,6 +2750,7 @@ const oauthProvider = (options) => {
 					code_challenge_method: z.enum(["S256"]).optional(),
 					nonce: z.string().optional(),
 					prompt: z.enum([
+						"none",
 						"consent",
 						"login",
 						"create",
@@ -3715,9 +3525,354 @@ const oauthProvider = (options) => {
 			updateOAuthConsent: updateOAuthConsent(opts),
 			deleteOAuthConsent: deleteOAuthConsent(opts)
 		},
-		schema: mergeSchema(schema, opts?.schema)
+		schema: mergeSchema(schema, opts?.schema),
+		rateLimit: [
+			...opts.rateLimit?.token !== false ? [{
+				pathMatcher: (path) => path === "/oauth2/token",
+				window: opts.rateLimit?.token?.window ?? 60,
+				max: opts.rateLimit?.token?.max ?? 20
+			}] : [],
+			...opts.rateLimit?.authorize !== false ? [{
+				pathMatcher: (path) => path === "/oauth2/authorize",
+				window: opts.rateLimit?.authorize?.window ?? 60,
+				max: opts.rateLimit?.authorize?.max ?? 30
+			}] : [],
+			...opts.rateLimit?.introspect !== false ? [{
+				pathMatcher: (path) => path === "/oauth2/introspect",
+				window: opts.rateLimit?.introspect?.window ?? 60,
+				max: opts.rateLimit?.introspect?.max ?? 100
+			}] : [],
+			...opts.rateLimit?.revoke !== false ? [{
+				pathMatcher: (path) => path === "/oauth2/revoke",
+				window: opts.rateLimit?.revoke?.window ?? 60,
+				max: opts.rateLimit?.revoke?.max ?? 30
+			}] : [],
+			...opts.rateLimit?.register !== false ? [{
+				pathMatcher: (path) => path === "/oauth2/register",
+				window: opts.rateLimit?.register?.window ?? 60,
+				max: opts.rateLimit?.register?.max ?? 5
+			}] : [],
+			...opts.rateLimit?.userinfo !== false ? [{
+				pathMatcher: (path) => path === "/oauth2/userinfo",
+				window: opts.rateLimit?.userinfo?.window ?? 60,
+				max: opts.rateLimit?.userinfo?.max ?? 60
+			}] : []
+		]
+	};
+};
+
+//#endregion
+//#region src/authorize.ts
+/**
+* Formats an error url
+*/
+function formatErrorURL(url, error, description, state, iss) {
+	const searchParams = new URLSearchParams({
+		error,
+		error_description: description
+	});
+	state && searchParams.append("state", state);
+	iss && searchParams.append("iss", iss);
+	return `${url}${url.includes("?") ? "&" : "?"}${searchParams.toString()}`;
+}
+const handleRedirect = (ctx, uri) => {
+	if (ctx.headers?.get("accept")?.includes("application/json")) return {
+		redirect: true,
+		url: uri.toString()
+	};
+	else throw ctx.redirect(uri);
+};
+/**
+* Validates that the issuer URL
+* - MUST use HTTPS scheme (HTTP allowed for localhost in dev)
+* - MUST NOT contain query components
+* - MUST NOT contain fragment components
+*
+* @returns The validated issuer URL, or a sanitized version if invalid
+*/
+function validateIssuerUrl(issuer) {
+	try {
+		const url = new URL(issuer);
+		const isLocalhost = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+		if (url.protocol !== "https:" && !isLocalhost) url.protocol = "https:";
+		url.search = "";
+		url.hash = "";
+		return url.toString().replace(/\/$/, "");
+	} catch {
+		return issuer;
+	}
+}
+/**
+* Gets the issuer identifier
+*/
+function getIssuer(ctx, opts) {
+	let issuer;
+	if (opts.disableJwtPlugin) issuer = ctx.context.baseURL;
+	else try {
+		issuer = getJwtPlugin(ctx.context).options?.jwt?.issuer ?? ctx.context.baseURL;
+	} catch {
+		issuer = ctx.context.baseURL;
+	}
+	return validateIssuerUrl(issuer);
+}
+/**
+* Error page url if redirect_uri has not been verified yet
+* Generates Url for custom error page
+*/
+function getErrorURL(ctx, error, description) {
+	return formatErrorURL(ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`, error, description);
+}
+async function authorizeEndpoint(ctx, opts, settings) {
+	if (opts.grantTypes && !opts.grantTypes.includes("authorization_code")) throw new APIError$1("NOT_FOUND");
+	if (!ctx.request) throw new APIError$1("UNAUTHORIZED", {
+		error_description: "request not found",
+		error: "invalid_request"
+	});
+	const query = ctx.query;
+	await oAuthState.set({ query: query.toString() });
+	if (!query.client_id) throw ctx.redirect(getErrorURL(ctx, "invalid_client", "client_id is required"));
+	if (!query.response_type) throw ctx.redirect(getErrorURL(ctx, "invalid_request", "response_type is required"));
+	const promptSet = ctx.query?.prompt ? parsePrompt(ctx.query?.prompt) : void 0;
+	if (promptSet?.has("select_account") && !opts.selectAccount?.page) throw ctx.redirect(getErrorURL(ctx, `unsupported_prompt_select_account`, "unsupported prompt type"));
+	if (!(query.response_type === "code")) throw ctx.redirect(getErrorURL(ctx, "unsupported_response_type", "unsupported response type"));
+	const client = await getClient(ctx, opts, query.client_id);
+	if (!client) throw ctx.redirect(getErrorURL(ctx, "invalid_client", "client_id is required"));
+	if (client.disabled) throw ctx.redirect(getErrorURL(ctx, "client_disabled", "client is disabled"));
+	if (!client.redirectUris?.find((url) => url === query.redirect_uri) || !query.redirect_uri) throw ctx.redirect(getErrorURL(ctx, "invalid_redirect", "invalid redirect uri"));
+	let requestedScopes = query.scope?.split(" ").filter((s) => s);
+	if (requestedScopes) {
+		const validScopes = new Set(client.scopes ?? opts.scopes);
+		const invalidScopes = requestedScopes.filter((scope) => {
+			return !validScopes?.has(scope);
+		});
+		if (invalidScopes.length) throw ctx.redirect(formatErrorURL(query.redirect_uri, "invalid_scope", `The following scopes are invalid: ${invalidScopes.join(", ")}`, query.state, getIssuer(ctx, opts)));
+	}
+	if (!requestedScopes) {
+		requestedScopes = client.scopes ?? opts.scopes ?? [];
+		query.scope = requestedScopes.join(" ");
+	}
+	const pkceRequired = isPKCERequired(client, requestedScopes);
+	if (pkceRequired) {
+		if (!query.code_challenge || !query.code_challenge_method) throw ctx.redirect(formatErrorURL(query.redirect_uri, "invalid_request", pkceRequired.valueOf(), query.state, getIssuer(ctx, opts)));
+	}
+	if (query.code_challenge || query.code_challenge_method) {
+		if (!query.code_challenge || !query.code_challenge_method) throw ctx.redirect(formatErrorURL(query.redirect_uri, "invalid_request", "code_challenge and code_challenge_method must both be provided", query.state, getIssuer(ctx, opts)));
+		if (!["S256"].includes(query.code_challenge_method)) throw ctx.redirect(formatErrorURL(query.redirect_uri, "invalid_request", "invalid code_challenge method, only S256 is supported", query.state, getIssuer(ctx, opts)));
+	}
+	const session = await getSessionFromCtx(ctx);
+	if (!session || promptSet?.has("login") || promptSet?.has("create")) return redirectWithPromptCode(ctx, opts, promptSet?.has("create") ? "create" : "login");
+	if (settings?.isAuthorize && promptSet?.has("select_account")) return redirectWithPromptCode(ctx, opts, "select_account");
+	if (settings?.isAuthorize && opts.selectAccount) {
+		if (await opts.selectAccount.shouldRedirect({
+			headers: ctx.request.headers,
+			user: session.user,
+			session: session.session,
+			scopes: requestedScopes
+		})) return redirectWithPromptCode(ctx, opts, "select_account");
+	}
+	if (opts.signup?.shouldRedirect) {
+		const signupRedirect = await opts.signup.shouldRedirect({
+			headers: ctx.request.headers,
+			user: session.user,
+			session: session.session,
+			scopes: requestedScopes
+		});
+		if (signupRedirect) return redirectWithPromptCode(ctx, opts, "create", typeof signupRedirect === "string" ? signupRedirect : void 0);
+	}
+	if (!settings?.postLogin && opts.postLogin) {
+		if (await opts.postLogin.shouldRedirect({
+			headers: ctx.request.headers,
+			user: session.user,
+			session: session.session,
+			scopes: requestedScopes
+		})) return redirectWithPromptCode(ctx, opts, "post_login");
+	}
+	if (promptSet?.has("consent")) return redirectWithPromptCode(ctx, opts, "consent");
+	const referenceId = await opts.postLogin?.consentReferenceId?.({
+		user: session.user,
+		session: session.session,
+		scopes: requestedScopes
+	});
+	if (client.skipConsent) return redirectWithAuthorizationCode(ctx, opts, {
+		query,
+		clientId: client.clientId,
+		userId: session.user.id,
+		sessionId: session.session.id,
+		authTime: new Date(session.session.createdAt).getTime(),
+		referenceId
+	});
+	const consent = await ctx.context.adapter.findOne({
+		model: "oauthConsent",
+		where: [
+			{
+				field: "clientId",
+				value: client.clientId
+			},
+			{
+				field: "userId",
+				value: session.user.id
+			},
+			...referenceId ? [{
+				field: "referenceId",
+				value: referenceId
+			}] : []
+		]
+	});
+	if (!consent || !requestedScopes.every((val) => consent.scopes.includes(val))) return redirectWithPromptCode(ctx, opts, "consent");
+	return redirectWithAuthorizationCode(ctx, opts, {
+		query,
+		clientId: client.clientId,
+		userId: session.user.id,
+		sessionId: session.session.id,
+		authTime: new Date(session.session.createdAt).getTime(),
+		referenceId
+	});
+}
+async function redirectWithAuthorizationCode(ctx, opts, verificationValue) {
+	const code = generateRandomString(32, "a-z", "A-Z", "0-9");
+	const iat = Math.floor(Date.now() / 1e3);
+	const exp = iat + (opts.codeExpiresIn ?? 600);
+	const data = {
+		identifier: await storeToken(opts.storeTokens, code, "authorization_code"),
+		updatedAt: /* @__PURE__ */ new Date(iat * 1e3),
+		expiresAt: /* @__PURE__ */ new Date(exp * 1e3),
+		value: JSON.stringify({
+			type: "authorization_code",
+			query: ctx.query,
+			userId: verificationValue.userId,
+			sessionId: verificationValue?.sessionId,
+			referenceId: verificationValue.referenceId,
+			authTime: verificationValue.authTime
+		})
+	};
+	ctx.context.verification_id ? await ctx.context.internalAdapter.updateVerificationValue(ctx.context.verification_id, data) : await ctx.context.internalAdapter.createVerificationValue({
+		...data,
+		createdAt: /* @__PURE__ */ new Date(iat * 1e3)
+	});
+	const redirectUriWithCode = new URL(verificationValue.query.redirect_uri);
+	redirectUriWithCode.searchParams.set("code", code);
+	if (verificationValue.query.state) redirectUriWithCode.searchParams.set("state", verificationValue.query.state);
+	redirectUriWithCode.searchParams.set("iss", getIssuer(ctx, opts));
+	return handleRedirect(ctx, redirectUriWithCode.toString());
+}
+async function redirectWithPromptCode(ctx, opts, type, page) {
+	const queryParams = await signParams(ctx, opts);
+	let path = opts.loginPage;
+	if (type === "select_account") path = opts.selectAccount?.page ?? opts.loginPage;
+	else if (type === "post_login") {
+		if (!opts.postLogin?.page) throw new APIError$1("INTERNAL_SERVER_ERROR", { error_description: "postLogin should have been defined" });
+		path = opts.postLogin?.page;
+	} else if (type === "consent") path = opts.consentPage;
+	else if (type === "create") path = opts.signup?.page ?? opts.loginPage;
+	return handleRedirect(ctx, `${page ?? path}?${queryParams}`);
+}
+async function signParams(ctx, opts) {
+	const exp = Math.floor(Date.now() / 1e3) + (opts.codeExpiresIn ?? 600);
+	const params = new URLSearchParams(ctx.query);
+	params.set("exp", String(exp));
+	const signature = await makeSignature(params.toString(), ctx.context.secret);
+	params.append("sig", signature);
+	return params.toString();
+}
+
+//#endregion
+//#region src/metadata.ts
+function authServerMetadata(ctx, opts, overrides) {
+	const baseURL = ctx.context.baseURL;
+	return {
+		scopes_supported: overrides?.scopes_supported,
+		issuer: validateIssuerUrl(opts?.jwt?.issuer ?? baseURL),
+		authorization_endpoint: `${baseURL}/oauth2/authorize`,
+		token_endpoint: `${baseURL}/oauth2/token`,
+		jwks_uri: overrides?.jwt_disabled ? void 0 : opts?.jwks?.remoteUrl ?? `${baseURL}${opts?.jwks?.jwksPath ?? "/jwks"}`,
+		registration_endpoint: `${baseURL}/oauth2/register`,
+		introspection_endpoint: `${baseURL}/oauth2/introspect`,
+		revocation_endpoint: `${baseURL}/oauth2/revoke`,
+		response_types_supported: overrides?.grant_types_supported && !overrides.grant_types_supported.includes("authorization_code") ? [] : ["code"],
+		response_modes_supported: ["query"],
+		grant_types_supported: overrides?.grant_types_supported ?? [
+			"authorization_code",
+			"client_credentials",
+			"refresh_token"
+		],
+		token_endpoint_auth_methods_supported: [
+			...overrides?.public_client_supported ? ["none"] : [],
+			"client_secret_basic",
+			"client_secret_post"
+		],
+		introspection_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
+		revocation_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
+		code_challenge_methods_supported: ["S256"],
+		authorization_response_iss_parameter_supported: true
+	};
+}
+function oidcServerMetadata(ctx, opts) {
+	const baseURL = ctx.context.baseURL;
+	const jwtPluginOptions = opts.disableJwtPlugin ? void 0 : getJwtPlugin(ctx.context).options;
+	return {
+		...authServerMetadata(ctx, jwtPluginOptions, {
+			scopes_supported: opts.advertisedMetadata?.scopes_supported ?? opts.scopes,
+			public_client_supported: opts.allowUnauthenticatedClientRegistration,
+			grant_types_supported: opts.grantTypes,
+			jwt_disabled: opts.disableJwtPlugin
+		}),
+		claims_supported: opts?.advertisedMetadata?.claims_supported ?? opts?.claims ?? [],
+		userinfo_endpoint: `${baseURL}/oauth2/userinfo`,
+		subject_types_supported: ["public"],
+		id_token_signing_alg_values_supported: jwtPluginOptions?.jwks?.keyPairConfig?.alg ? [jwtPluginOptions?.jwks?.keyPairConfig?.alg] : opts.disableJwtPlugin ? ["HS256"] : ["EdDSA"],
+		end_session_endpoint: `${baseURL}/oauth2/end-session`,
+		acr_values_supported: ["urn:mace:incommon:iap:bronze"],
+		prompt_values_supported: [
+			"login",
+			"consent",
+			"create",
+			"select_account"
+		]
+	};
+}
+/**
+* Provides an exportable `/.well-known/oauth-authorization-server`.
+*
+* Useful when basePath prevents the endpoint from being located at the root
+* and must be provided manually.
+*
+* @external
+*/
+const oauthProviderAuthServerMetadata = (auth, opts) => {
+	return async (_request) => {
+		const res = await auth.api.getOAuthServerConfig();
+		return new Response(JSON.stringify(res), {
+			status: 200,
+			headers: {
+				"Cache-Control": "public, max-age=15, stale-while-revalidate=15, stale-if-error=86400",
+				...opts?.headers,
+				"Content-Type": "application/json"
+			}
+		});
+	};
+};
+/**
+* Provides an exportable `/.well-known/openid-configuration`.
+*
+* Useful when basePath prevents the endpoint from being located at the root
+* and must be provided manually.
+*
+* @external
+*/
+const oauthProviderOpenIdConfigMetadata = (auth, opts) => {
+	return async (_request) => {
+		const res = await auth.api.getOpenIdConfig();
+		return new Response(JSON.stringify(res), {
+			status: 200,
+			headers: {
+				"Cache-Control": "public, max-age=15, stale-while-revalidate=15, stale-if-error=86400",
+				...opts?.headers,
+				"Content-Type": "application/json"
+			}
+		});
 	};
 };
 
 //#endregion
-export { authServerMetadata, mcpHandler, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata };
+export { authServerMetadata, getOAuthProviderState, mcpHandler, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata };
+//# sourceMappingURL=index.mjs.map