@better-auth/oauth-provider 1.7.0-rc.5 → 1.7.0

package/dist/{signed-query-BQAwsV_w.mjs → signed-query-Df1MNiSH.mjs}

@@ -16,7 +16,7 @@ function canonicalizeOAuthQueryParams(params) {
 }
 function setSignedOAuthQueryParameterNames(params) {
 	params.delete(signedQueryParameterNameParam);
-	const signedParameterNames = [.../* @__PURE__ */ new Set([...params.keys(), signedQueryParameterNameParam])].sort();
+	const signedParameterNames = [...new Set([...params.keys(), signedQueryParameterNameParam])].sort();
 	for (const parameterName of signedParameterNames) params.append(signedQueryParameterNameParam, parameterName);
 }
 function getSignedOAuthQueryParameterNames(params) {

package/dist/{utils-jZEA4KQb.mjs → utils-CCi1maVd.mjs}

@@ -1,4 +1,4 @@
-import { n as canonicalizeOAuthQueryParams } from "./signed-query-BQAwsV_w.mjs";
+import { n as canonicalizeOAuthQueryParams } from "./signed-query-Df1MNiSH.mjs";
 import { constantTimeEqual, makeSignature, symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { APIError } from "better-call";
 import { logger } from "@better-auth/core/env";
@@ -151,7 +151,7 @@ function getExtensionGrantTypes(opts) {
 	return getOAuthProviderExtensions(opts).flatMap((extension) => Object.keys(extension.grants ?? {}));
 }
 function getSupportedGrantTypes(opts) {
-	return Array.from(/* @__PURE__ */ new Set([...opts.grantTypes ?? DEFAULT_GRANT_TYPES, ...getExtensionGrantTypes(opts)]));
+	return Array.from(new Set([...opts.grantTypes ?? DEFAULT_GRANT_TYPES, ...getExtensionGrantTypes(opts)]));
 }
 function getExtensionGrantHandler(opts, grantType) {
 	for (const extension of getOAuthProviderExtensions(opts)) {
@@ -169,7 +169,7 @@ function getExtensionTokenEndpointAuthMethods(opts) {
 * endpoints, which never accept public clients, omit it (the default).
 */
 function getSupportedAuthMethods(opts, settings) {
-	return Array.from(/* @__PURE__ */ new Set([
+	return Array.from(new Set([
 		...settings?.includeNone ? ["none"] : [],
 		...BUILT_IN_CONFIDENTIAL_AUTH_METHODS,
 		...getExtensionTokenEndpointAuthMethods(opts)
@@ -707,7 +707,7 @@ async function extractClientCredentials(ctx, opts, expectedAudience) {
 				confirmation: result.confirmation
 			};
 		}
-		const { verifyClientAssertion: verify } = await import("./client-assertion-Cy8ZcH7P.mjs").then((n) => n.t);
+		const { verifyClientAssertion: verify } = await import("./authorize-BP2_wo6r.mjs").then((n) => n.o);
 		return {
 			kind: "pre_verified",
 			method: "private_key_jwt",

package/dist/{version-CwxXc1Y6.mjs → version-C0TE7qRr.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-rc.5";
+const PACKAGE_VERSION = "1.7.0";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.7.0-rc.5",
+  "version": "1.7.0",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -70,17 +70,17 @@
   },
   "devDependencies": {
     "listhen": "^1.9.0",
-    "tsdown": "0.22.7",
-    "@better-auth/core": "1.7.0-rc.5",
-    "better-auth": "1.7.0-rc.5",
-    "@better-auth/memory-adapter": "1.7.0-rc.5"
+    "tsdown": "0.21.10",
+    "@better-auth/core": "1.7.0",
+    "@better-auth/memory-adapter": "1.7.0",
+    "better-auth": "1.7.0"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
     "better-call": "1.4.0",
-    "@better-auth/core": "^1.7.0-rc.5",
-    "better-auth": "^1.7.0-rc.5"
+    "@better-auth/core": "^1.7.0",
+    "better-auth": "^1.7.0"
   },
   "scripts": {
     "build": "tsdown",

package/dist/client-assertion-Cy8ZcH7P.mjs

@@ -1,469 +0,0 @@
-import { P as getClientDiscoveries, a as getClient } from "./utils-jZEA4KQb.mjs";
-import { isPublicRoutableHost } from "@better-auth/core/utils/host";
-import { APIError } from "better-call";
-import { CLIENT_ASSERTION_TYPE, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS } from "@better-auth/core/oauth2";
-import { base64Url } from "@better-auth/utils/base64";
-import { createHash } from "@better-auth/utils/hash";
-import { createLocalJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-//#endregion
-//#region src/client-jwks.ts
-const EC_PRIVATE_KEY_JWT_ALGORITHM_BY_CURVE = {
-	"P-256": "ES256",
-	"P-384": "ES384",
-	"P-521": "ES512"
-};
-const OKP_PRIVATE_KEY_JWT_SIGNING_CURVES = ["Ed25519"];
-const PRIVATE_JWK_MEMBER_NAMES = [
-	"d",
-	"p",
-	"q",
-	"dp",
-	"dq",
-	"qi",
-	"oth"
-];
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function hasStringMember(key, memberName) {
-	return typeof key[memberName] === "string" && key[memberName].length > 0;
-}
-function isSupportedEcSigningCurve(curve) {
-	return typeof curve === "string" && Object.prototype.hasOwnProperty.call(EC_PRIVATE_KEY_JWT_ALGORITHM_BY_CURVE, curve);
-}
-function isSupportedOkpSigningCurve(curve) {
-	return OKP_PRIVATE_KEY_JWT_SIGNING_CURVES.some((signingCurve) => signingCurve === curve);
-}
-function isSupportedPublicJwk(key) {
-	switch (key.kty) {
-		case "RSA": return hasStringMember(key, "n") && hasStringMember(key, "e");
-		case "EC": return isSupportedEcSigningCurve(key.crv) && hasStringMember(key, "x") && hasStringMember(key, "y");
-		case "OKP": return isSupportedOkpSigningCurve(key.crv) && hasStringMember(key, "x");
-		default: return false;
-	}
-}
-function hasSupportedPrivateKeyJwtAlgorithm(key) {
-	if (key.alg === void 0) return true;
-	if (typeof key.alg !== "string" || !PRIVATE_KEY_JWT_SIGNING_ALGORITHMS.some((algorithm) => algorithm === key.alg)) return false;
-	switch (key.kty) {
-		case "RSA": return key.alg.startsWith("RS") || key.alg.startsWith("PS");
-		case "EC": return isSupportedEcSigningCurve(key.crv) && EC_PRIVATE_KEY_JWT_ALGORITHM_BY_CURVE[key.crv] === key.alg;
-		case "OKP": return isSupportedOkpSigningCurve(key.crv) && key.alg === "EdDSA";
-		default: return false;
-	}
-}
-/**
-* Validates an OAuth client's public asymmetric JWK set.
-*
-* This boundary accepts only the RFC 7517 `{ keys: [...] }` representation.
-* It performs no I/O and returns the validated set for downstream JOSE
-* verification.
-*
-* @internal
-*/
-function validatePublicClientJwks(input) {
-	const keys = isRecord(input) && Array.isArray(input.keys) ? input.keys : void 0;
-	if (!keys?.length) return {
-		valid: false,
-		error: "jwks must be an RFC 7517 JWK Set object with a non-empty keys array"
-	};
-	for (const key of keys) {
-		if (!isRecord(key)) return {
-			valid: false,
-			error: "jwks keys must be supported public JWKs with required key parameters"
-		};
-		if (key.kty === "oct" || "k" in key || PRIVATE_JWK_MEMBER_NAMES.some((name) => name in key)) return {
-			valid: false,
-			error: "jwks must contain only public asymmetric keys"
-		};
-		if (!isSupportedPublicJwk(key)) return {
-			valid: false,
-			error: "jwks keys must be supported public JWKs with required key parameters"
-		};
-		if (!hasSupportedPrivateKeyJwtAlgorithm(key)) return {
-			valid: false,
-			error: "jwks key alg must be supported for private_key_jwt and compatible with its key type and signing curve"
-		};
-	}
-	return {
-		valid: true,
-		jwks: { keys }
-	};
-}
-//#endregion
-//#region src/utils/client-assertion.ts
-var client_assertion_exports = /* @__PURE__ */ __exportAll({
-	consumeClientAssertion: () => consumeClientAssertion,
-	isPrivateHostname: () => isPrivateHostname,
-	verifyClientAssertion: () => verifyClientAssertion
-});
-const jwksCaches = /* @__PURE__ */ new WeakMap();
-const JWKS_CACHE_TTL_MS = 300 * 1e3;
-const JWKS_CACHE_MAX_ENTRIES = 500;
-const JWKS_FETCH_TIMEOUT_MS = 5e3;
-const MAX_JWKS_RESPONSE_BYTES = 64 * 1024;
-const JSON_CONTENT_TYPE = /^application\/(?:[-\w.]+\+)?json\s*(?:;|$)/i;
-function setJwksCache(jwksCache, cacheKey, jwks, fetchedAt) {
-	jwksCache.set(cacheKey, {
-		jwks,
-		fetchedAt
-	});
-	if (jwksCache.size > JWKS_CACHE_MAX_ENTRIES) {
-		const oldest = jwksCache.keys().next().value;
-		if (oldest !== void 0) jwksCache.delete(oldest);
-	}
-}
-function getJwksCache(opts) {
-	const existingCache = jwksCaches.get(opts);
-	if (existingCache) return existingCache;
-	const cache = /* @__PURE__ */ new Map();
-	jwksCaches.set(opts, cache);
-	return cache;
-}
-function getJwksCacheKey(client) {
-	return `${client.clientDiscoveryId ?? "managed"}:${client.jwksUri ?? ""}`;
-}
-const ALGORITHMS_LIST = [...PRIVATE_KEY_JWT_SIGNING_ALGORITHMS];
-/**
-* SSRF gate for user-supplied server-side fetch targets (`jwks_uri`,
-* `backchannel_logout_uri`): returns true when the host is NOT publicly
-* routable. That covers loopback, RFC 1918 private, link-local (including AWS
-* IMDS `169.254.169.254`), shared-address-space (carrier-grade NAT),
-* IPv4-mapped IPv6, 6to4/NAT64/Teredo tunnels, every other RFC 6890
-* special-purpose range, and cloud-metadata FQDNs.
-*
-* Delegates to the audited single source of truth so this check cannot drift
-* into the kind of encoding bypass that bespoke regexes invite. This is a
-* syntactic check only: it does not resolve DNS, so a public name that
-* resolves to a private address at fetch time is not caught here.
-*/
-function isPrivateHostname(hostname) {
-	return !isPublicRoutableHost(hostname);
-}
-function validateJwksUri(ctx, jwksUri, clientIdUrlOrigin) {
-	const parsed = new URL(jwksUri);
-	if (parsed.protocol !== "https:") throw new APIError("BAD_REQUEST", {
-		error_description: "jwks_uri must use HTTPS",
-		error: "invalid_client"
-	});
-	if (parsed.username || parsed.password) throw new APIError("BAD_REQUEST", {
-		error_description: "jwks_uri must not contain credentials",
-		error: "invalid_client"
-	});
-	if (jwksUri.includes("#")) throw new APIError("BAD_REQUEST", {
-		error_description: "jwks_uri must not include a fragment component",
-		error: "invalid_client"
-	});
-	if (isPrivateHostname(parsed.hostname)) throw new APIError("BAD_REQUEST", {
-		error_description: "jwks_uri must not point to a private or reserved address",
-		error: "invalid_client"
-	});
-	if (clientIdUrlOrigin && parsed.origin === clientIdUrlOrigin) return;
-	if (!ctx.context.isTrustedOrigin(parsed.href)) throw new APIError("BAD_REQUEST", {
-		error_description: "client jwks_uri is not trusted",
-		error: "invalid_client"
-	});
-}
-function urlClientIdOrigin(clientId) {
-	try {
-		const parsed = new URL(clientId);
-		if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return;
-		return parsed.origin;
-	} catch {
-		return;
-	}
-}
-async function readBoundedResponseBody(response) {
-	const contentLength = response.headers.get("content-length");
-	if (contentLength !== null && Number.isFinite(Number(contentLength)) && Number(contentLength) > MAX_JWKS_RESPONSE_BYTES) {
-		await response.body?.cancel();
-		throw new Error("JWKS response exceeds 64 KiB");
-	}
-	if (!response.body) return "";
-	const reader = response.body.getReader();
-	const chunks = [];
-	let totalBytes = 0;
-	while (true) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		totalBytes += value.byteLength;
-		if (totalBytes > MAX_JWKS_RESPONSE_BYTES) {
-			await reader.cancel();
-			throw new Error("JWKS response exceeds 64 KiB");
-		}
-		chunks.push(value);
-	}
-	const bytes = new Uint8Array(totalBytes);
-	let offset = 0;
-	for (const chunk of chunks) {
-		bytes.set(chunk, offset);
-		offset += chunk.byteLength;
-	}
-	return new TextDecoder().decode(bytes);
-}
-async function fetchJwksFromUri(jwksUri, fetchClientMetadataResource = globalThis.fetch) {
-	const controller = new AbortController();
-	const timeout = setTimeout(() => controller.abort(), JWKS_FETCH_TIMEOUT_MS);
-	try {
-		const response = await fetchClientMetadataResource(jwksUri, {
-			signal: controller.signal,
-			headers: { accept: "application/json" },
-			redirect: "error"
-		});
-		if (response.redirected) throw new Error("JWKS fetch redirected");
-		if (response.status !== 200) throw new Error(`JWKS fetch returned ${response.status}`);
-		const contentType = response.headers.get("content-type");
-		if (!contentType || !JSON_CONTENT_TYPE.test(contentType)) throw new Error("JWKS response must use a JSON media type");
-		const responseBody = await readBoundedResponseBody(response);
-		let parsedBody;
-		try {
-			parsedBody = JSON.parse(responseBody);
-		} catch {
-			return { valid: false };
-		}
-		const result = validatePublicClientJwks(parsedBody);
-		if (!result.valid) return { valid: false };
-		return {
-			valid: true,
-			jwks: result.jwks
-		};
-	} finally {
-		clearTimeout(timeout);
-	}
-}
-function createClientJwksFetchError() {
-	return new APIError("BAD_REQUEST", {
-		error_description: "failed to fetch client JWKS",
-		error: "invalid_client"
-	});
-}
-async function fetchClientJwks(ctx, opts, client) {
-	if (client.jwks) return JSON.parse(client.jwks);
-	if (!client.jwksUri) throw new APIError("BAD_REQUEST", {
-		error_description: "client has no JWKS configured",
-		error: "invalid_client"
-	});
-	const discovery = client.clientDiscoveryId ? getClientDiscoveries(opts).find((candidate) => candidate.id === client.clientDiscoveryId) : void 0;
-	if (client.clientDiscoveryId && !discovery?.fetchClientMetadataResource) throw new APIError("BAD_REQUEST", {
-		error_description: "client discovery does not provide a metadata resource transport",
-		error: "invalid_client"
-	});
-	validateJwksUri(ctx, client.jwksUri, client.clientDiscoveryId ? urlClientIdOrigin(client.clientId) : void 0);
-	const now = Date.now();
-	const cacheKey = getJwksCacheKey(client);
-	const jwksCache = getJwksCache(opts);
-	const cached = jwksCache.get(cacheKey);
-	if (cached && now - cached.fetchedAt < JWKS_CACHE_TTL_MS) return cached.jwks;
-	let result;
-	try {
-		result = await fetchJwksFromUri(client.jwksUri, discovery?.fetchClientMetadataResource);
-	} catch {
-		const staleLimitMs = JWKS_CACHE_TTL_MS * 2;
-		if (cached && now - cached.fetchedAt < staleLimitMs) return cached.jwks;
-		throw createClientJwksFetchError();
-	}
-	if (!result.valid) throw createClientJwksFetchError();
-	setJwksCache(jwksCache, cacheKey, result.jwks, now);
-	return result.jwks;
-}
-/**
-* Refetch JWKS from jwks_uri when signature verification fails with cached keys.
-* Handles key rotation: the client may have published a new key that isn't in our cache yet.
-*/
-async function refetchClientJwks(opts, client) {
-	if (!client.jwksUri) return null;
-	const discovery = client.clientDiscoveryId ? getClientDiscoveries(opts).find((candidate) => candidate.id === client.clientDiscoveryId) : void 0;
-	if (client.clientDiscoveryId && !discovery?.fetchClientMetadataResource) return null;
-	try {
-		const result = await fetchJwksFromUri(client.jwksUri, discovery?.fetchClientMetadataResource);
-		if (!result.valid) return null;
-		setJwksCache(getJwksCache(opts), getJwksCacheKey(client), result.jwks, Date.now());
-		return result.jwks;
-	} catch {
-		return null;
-	}
-}
-/**
-* Enforces the assertion-hygiene claims every client-assertion authentication
-* method must check, independent of how the signature is verified or where the
-* verification keys come from:
-* - `aud` MUST include `expectedAudience` (RFC 7523 §3 rule 3),
-* - `exp` MUST be present, unexpired, and at most `assertionMaxLifetime`
-*   seconds away (RFC 7523 §3 rule 4),
-* - `iat`, when present, MUST be within `assertionMaxLifetime`,
-* - `jti` MUST be present and single-use; this consumes a replay tombstone keyed
-*   by `` `${namespace}:${jti}` ``, inserted under the adapter's primary key so a
-*   replay across workers fails atomically.
-*
-* A custom {@link OAuthClientAuthenticationStrategy} should call this after
-* verifying the assertion signature, so an extension method inherits the same
-* replay, lifetime, and audience guarantees as the built-in `private_key_jwt`
-* path, which calls it too.
-*
-* @param params.namespace Scopes the replay tombstone to the method and client,
-*   e.g. `` `${method}:${clientId}` ``, so the same `jti` can recur across
-*   distinct methods or clients but never within one.
-*/
-async function consumeClientAssertion(ctx, opts, params) {
-	const { namespace, payload, expectedAudience } = params;
-	if (!(Array.isArray(payload.aud) ? payload.aud : payload.aud != null ? [payload.aud] : []).includes(expectedAudience)) throw new APIError("BAD_REQUEST", {
-		error_description: "client assertion aud does not match the endpoint",
-		error: "invalid_client"
-	});
-	const maxLifetime = opts.assertionMaxLifetime ?? 300;
-	const now = Math.floor(Date.now() / 1e3);
-	if (typeof payload.exp !== "number") throw new APIError("BAD_REQUEST", {
-		error_description: "client assertion must include exp claim",
-		error: "invalid_client"
-	});
-	if (payload.exp <= now) throw new APIError("BAD_REQUEST", {
-		error_description: "client assertion has expired",
-		error: "invalid_client"
-	});
-	if (payload.exp - now > maxLifetime) throw new APIError("BAD_REQUEST", {
-		error_description: `client assertion exp is too far in the future (max ${maxLifetime}s)`,
-		error: "invalid_client"
-	});
-	if (typeof payload.iat === "number" && now - payload.iat > maxLifetime) throw new APIError("BAD_REQUEST", {
-		error_description: `client assertion iat is too far in the past (max ${maxLifetime}s)`,
-		error: "invalid_client"
-	});
-	if (typeof payload.jti !== "string" || payload.jti.length === 0) throw new APIError("BAD_REQUEST", {
-		error_description: "client assertion must include jti claim",
-		error: "invalid_client"
-	});
-	const jtiDigest = await createHash("SHA-256").digest(new TextEncoder().encode(`${namespace}:${payload.jti}`));
-	const jtiId = base64Url.encode(new Uint8Array(jtiDigest).slice(0, 24), { padding: false });
-	try {
-		await ctx.context.adapter.create({
-			model: "oauthClientAssertion",
-			data: {
-				id: jtiId,
-				expiresAt: /* @__PURE__ */ new Date(payload.exp * 1e3)
-			},
-			forceAllowId: true
-		});
-	} catch (createErr) {
-		let alreadyUsed = false;
-		try {
-			alreadyUsed = Boolean(await ctx.context.adapter.findOne({
-				model: "oauthClientAssertion",
-				where: [{
-					field: "id",
-					value: jtiId
-				}]
-			}));
-		} catch {}
-		if (alreadyUsed) throw new APIError("BAD_REQUEST", {
-			error_description: "client assertion jti has already been used",
-			error: "invalid_client"
-		});
-		throw createErr;
-	}
-}
-/**
-* Verifies a client assertion JWT for `private_key_jwt` authentication.
-*
-* Validates: signature, iss=client_id, sub=client_id, aud=token_endpoint,
-* exp, assertion max lifetime, jti uniqueness (replay prevention).
-*/
-async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertionType, clientIdHint, expectedAudience) {
-	if (clientAssertionType !== CLIENT_ASSERTION_TYPE) throw new APIError("BAD_REQUEST", {
-		error_description: "unsupported client_assertion_type",
-		error: "invalid_client"
-	});
-	let header;
-	try {
-		header = decodeProtectedHeader(clientAssertion);
-	} catch {
-		throw new APIError("BAD_REQUEST", {
-			error_description: "malformed client assertion: invalid JWT header",
-			error: "invalid_client"
-		});
-	}
-	if (!header.alg || !ALGORITHMS_LIST.includes(header.alg)) throw new APIError("BAD_REQUEST", {
-		error_description: `unsupported assertion signing algorithm: ${header.alg}`,
-		error: "invalid_client"
-	});
-	let unverified;
-	try {
-		unverified = decodeJwt(clientAssertion);
-	} catch {
-		throw new APIError("BAD_REQUEST", {
-			error_description: "malformed client assertion: invalid JWT payload",
-			error: "invalid_client"
-		});
-	}
-	const clientId = unverified.sub ?? unverified.iss;
-	if (!clientId) throw new APIError("BAD_REQUEST", {
-		error_description: "client assertion must contain sub or iss claim identifying the client",
-		error: "invalid_client"
-	});
-	if (clientIdHint && clientIdHint !== clientId) throw new APIError("BAD_REQUEST", {
-		error_description: "client_id in body does not match assertion sub/iss",
-		error: "invalid_client"
-	});
-	const client = await getClient(ctx, opts, clientId);
-	if (!client) throw new APIError("BAD_REQUEST", {
-		error_description: "unknown client",
-		error: "invalid_client"
-	});
-	if (client.disabled) throw new APIError("BAD_REQUEST", {
-		error_description: "client is disabled",
-		error: "invalid_client"
-	});
-	if (client.tokenEndpointAuthMethod !== "private_key_jwt") throw new APIError("BAD_REQUEST", {
-		error_description: "client is not registered for private_key_jwt authentication",
-		error: "invalid_client"
-	});
-	const jwks = await fetchClientJwks(ctx, opts, client);
-	const audience = expectedAudience ?? `${ctx.context.baseURL}/oauth2/token`;
-	const verifyOpts = {
-		issuer: clientId,
-		subject: clientId,
-		audience,
-		algorithms: ALGORITHMS_LIST
-	};
-	let payload;
-	try {
-		({payload} = await jwtVerify(clientAssertion, createLocalJWKSet(jwks), verifyOpts));
-	} catch (verifyErr) {
-		if (verifyErr instanceof Error && /no matching key|no applicable key/i.test(verifyErr.message)) {
-			const refreshed = await refetchClientJwks(opts, client);
-			if (refreshed) try {
-				({payload} = await jwtVerify(clientAssertion, createLocalJWKSet(refreshed), verifyOpts));
-			} catch {
-				throw new APIError("UNAUTHORIZED", {
-					error_description: "client assertion signature verification failed",
-					error: "invalid_client"
-				});
-			}
-			else throw new APIError("UNAUTHORIZED", {
-				error_description: "client assertion signature verification failed",
-				error: "invalid_client"
-			});
-		} else throw new APIError("UNAUTHORIZED", {
-			error_description: "client assertion signature verification failed",
-			error: "invalid_client"
-		});
-	}
-	await consumeClientAssertion(ctx, opts, {
-		namespace: `private_key_jwt:${clientId}`,
-		payload,
-		expectedAudience: audience
-	});
-	return { clientId };
-}
-//#endregion
-export { __exportAll as a, validatePublicClientJwks as i, consumeClientAssertion as n, isPrivateHostname as r, client_assertion_exports as t };