@better-auth/oauth-provider 1.7.0-rc.5 → 1.7.0

package/dist/register-BjyzmoSI.mjs

@@ -1,1557 +0,0 @@
-import { i as validatePublicClientJwks, r as isPrivateHostname } from "./client-assertion-Cy8ZcH7P.mjs";
-import { I as getSupportedAuthMethods, L as getSupportedGrantTypes, S as storeClientSecret, h as parseClientMetadata, m as parseBearerToken, z as isExtensionTokenEndpointAuthMethod } from "./utils-jZEA4KQb.mjs";
-import { isLoopbackIP } from "@better-auth/core/utils/host";
-import { APIError, NO_STORE_HEADERS, getSessionFromCtx } from "better-auth/api";
-import { generateRandomString } from "better-auth/crypto";
-import { APIError as APIError$1 } from "better-call";
-import { logger } from "@better-auth/core/env";
-import { getCurrentAdapter, runWithTransaction } from "@better-auth/core/context";
-import { toExpJWT } from "better-auth/plugins";
-import { isReverseDomainPrivateUseRedirectUri } from "@better-auth/core/utils/redirect-uri";
-//#region src/resources.ts
-/**
-* Source-of-truth list of asymmetric JWS algorithms supported by the JWT
-* plugin. Mirrors the {@link JWSAlgorithms} literal-union type from
-* `packages/better-auth/src/plugins/jwt/types.ts`. Kept as a runtime const
-* so the admin-CRUD zod schema AND the seed-config validator can reject
-* bad values up-front rather than surfacing opaque jose errors at issuance.
-*
-* MUST stay in sync with `JWSAlgorithms`. The type-level guard immediately
-* below fails the typecheck if the two drift.
-*/
-const JWS_ALGORITHMS = [
-	"EdDSA",
-	"ES256",
-	"ES512",
-	"PS256",
-	"RS256"
-];
-const JWS_ALGORITHM_SET = new Set(JWS_ALGORITHMS);
-/**
-* Upper bound on how many entries are accepted in a JWT's `aud` claim during
-* introspection / revocation validation. Without a cap, a hostile or replayed
-* token can supply hundreds of fake resource identifiers and amplify load on
-* the resource table (one DB lookup per unique unrecognized entry). Real-world
-* deployments use single-digit resource lists; 64 is a generous ceiling that
-* stays well clear of any legitimate use and bounds the per-request DB fan-out.
-*
-* RFC 7519 §4.1.3 does not specify a maximum, so this is a defensive limit,
-* not a spec one. Tokens that exceed it are treated as invalid (introspect →
-* `active: false`, revoke → no-op) rather than triggering the lookup path.
-*
-* @internal
-*/
-const MAX_AUD_VALUES = 64;
-/**
-* Validates a resource `identifier` per RFC 8707 §2 (absolute URI, no
-* fragment), honoring {@link OAuthOptions.identifierValidator} when provided.
-*
-* Returns a structured result so callers can decide whether to throw
-* (admin CRUD / DCR) or warn-and-skip (config seed path).
-*
-* @internal
-*/
-async function checkIdentifier(opts, identifier) {
-	const customValidator = opts.identifierValidator;
-	if (customValidator) {
-		if (!await customValidator(identifier)) return {
-			ok: false,
-			reason: `resource identifier ${identifier} failed validation`
-		};
-		return { ok: true };
-	}
-	let url;
-	try {
-		url = new URL(identifier);
-	} catch {
-		return {
-			ok: false,
-			reason: `resource identifier ${identifier} must be an absolute URI (RFC 8707 §2)`
-		};
-	}
-	if (url.hash) return {
-		ok: false,
-		reason: `resource identifier ${identifier} must not contain a URI fragment (RFC 8707 §2)`
-	};
-	return { ok: true };
-}
-/**
-* Variant of {@link checkIdentifier} that throws `invalid_target` on failure.
-* Used by admin CRUD endpoints where validation failure is a client error.
-*
-* @internal
-*/
-async function assertIdentifierValid(opts, identifier) {
-	const result = await checkIdentifier(opts, identifier);
-	if (!result.ok) throw new APIError("BAD_REQUEST", {
-		error: "invalid_target",
-		error_description: result.reason
-	});
-}
-/**
-* The OIDC userinfo endpoint's resource identifier. Always accepted as an
-* implicit `aud` value when `openid` is in scope — not looked up against
-* `oauthResource` rows.
-*/
-const userInfoResource = (baseURL) => `${baseURL}/oauth2/userinfo`;
-/**
-* Re-parses a request's raw `application/x-www-form-urlencoded` body to
-* recover every value of the repeated `resource` parameter (RFC 8707 §2).
-*
-* Workaround for better-call's form-body parser (better-call ≤1.3.5), which
-* collapses repeated form keys with last-write-wins. A client sending
-* `resource=https://a&resource=https://b` would otherwise arrive in the
-* handler as `{ resource: "https://b" }`, silently narrowing the issued
-* token's `aud` to a single resource.
-*
-* Returns the full ordered list when the body is form-encoded and contains
-* any `resource` entries; `undefined` otherwise. Caller MUST enable
-* `cloneRequest: true` on the endpoint — the body stream is read here a
-* second time, and that only works when better-call cloned the request
-* before its own parse.
-*
-* Note: the URL-encoded body path is the only one affected. The query-string
-* path (e.g. `/oauth2/authorize?resource=…&resource=…`) is parsed by the
-* router itself, which DOES array-promote duplicate keys correctly.
-*
-* @internal
-*/
-async function extractRepeatedResourceFromForm(request) {
-	if (!(request.headers.get("content-type")?.toLowerCase() ?? "").includes("application/x-www-form-urlencoded")) return;
-	let text;
-	try {
-		text = await request.clone().text();
-	} catch {
-		return;
-	}
-	if (!text) return void 0;
-	const values = new URLSearchParams(text).getAll("resource").filter((value) => value.length > 0);
-	return values.length > 0 ? values : void 0;
-}
-/**
-* Normalizes a `resource` parameter into an array. Accepts the RFC 8707
-* forms: a single string, a string[], or undefined.
-*
-* @internal
-*/
-function normalizeResourceParam(resource) {
-	if (resource === void 0 || resource === null) return void 0;
-	if (typeof resource === "string") return [resource];
-	if (Array.isArray(resource)) {
-		const result = resource.filter((r) => typeof r === "string" && r.length > 0);
-		return result.length > 0 ? result : void 0;
-	}
-}
-/**
-* Validates a JWT `aud` claim against the OAuth resource model.
-*
-* Every non-implicit audience value must resolve to an `oauthResource` row.
-* Disabled rows still pass because disabling blocks new issuance; deleting the
-* row is the operation that invalidates already-issued tokens.
-*
-* @internal
-*/
-async function isAudienceClaimAllowed(ctx, opts, audienceClaim, implicitAudiences = []) {
-	if (audienceClaim === void 0) return true;
-	const audienceValues = Array.isArray(audienceClaim) ? audienceClaim : [audienceClaim];
-	if (audienceValues.length > MAX_AUD_VALUES) return false;
-	const implicitAudienceSet = new Set(implicitAudiences);
-	const resourcesToLookup = /* @__PURE__ */ new Set();
-	for (const audienceValue of audienceValues) {
-		if (implicitAudienceSet.has(audienceValue)) continue;
-		resourcesToLookup.add(audienceValue);
-	}
-	if (resourcesToLookup.size === 0) return true;
-	return (await Promise.all(Array.from(resourcesToLookup, (resource) => getResource(ctx, opts, resource)))).every(Boolean);
-}
-/**
-* Resolves the resource policy for a request.
-*
-* Validation steps (RFC 8707 §3 + per-resource policy):
-*
-* 1. Resolve `resource` parameter to a list of identifiers.
-* 2. For each identifier, look up the {@link OAuthResource} row.
-*    - Missing → `invalid_target`.
-*    - `disabled` → `invalid_target` (no new issuance).
-* 3. If {@link OAuthOptions.enforcePerClientResources} resolves to true,
-*    confirm the client is linked to every requested resource via
-*    `oauthClientResource`. Unlinked → `invalid_target`.
-* 4. Intersect `requestedScopes` with each resource's `allowedScopes`.
-*    Empty intersection → `invalid_scope`.
-* 5. Pick the minimum `accessTokenTtl` across requested resources.
-* 6. Pick signing config — only honored for single-resource requests
-*    (a JWT can only have one signature).
-* 7. Merge per-resource `customClaims` (returned raw; reserved-claim
-*    stripping is owned by `resolveAccessTokenClaims`).
-*
-* When no `resource` param is present, returns an empty policy: no `aud`
-* claim and no resource-specific overrides.
-*
-* @internal
-*/
-async function resolveResourcePolicy(ctx, opts, params) {
-	const requestedResources = normalizeResourceParam(params.resource);
-	const includesOpenid = params.requestedScopes.includes("openid");
-	const baseURL = ctx.context.baseURL ?? "";
-	const userInfoResourceIdentifier = userInfoResource(baseURL);
-	if (!requestedResources) return {
-		audienceClaim: void 0,
-		accessTokenTtl: null,
-		refreshTokenTtl: null,
-		signingAlgorithm: null,
-		signingKeyId: null,
-		rawCustomClaims: {},
-		dpopBoundAccessTokensRequired: false,
-		effectiveScopes: [...params.requestedScopes]
-	};
-	const uniqueRequestedResources = [...new Set(requestedResources)];
-	const resolved = [];
-	for (const identifier of uniqueRequestedResources) {
-		if (identifier === userInfoResourceIdentifier) continue;
-		const row = await getResource(ctx, opts, identifier);
-		if (row) {
-			if (row.disabled) throw new APIError("BAD_REQUEST", {
-				error: "invalid_target",
-				error_description: `requested resource ${identifier} is disabled`
-			});
-			resolved.push(row);
-			continue;
-		}
-		throw new APIError("BAD_REQUEST", {
-			error: "invalid_target",
-			error_description: `requested resource ${identifier} is not configured`
-		});
-	}
-	const { value: enforcePerClient } = resolveEnforcePerClientResources(opts);
-	if (enforcePerClient && resolved.length > 0) await assertClientLinkedToResources(ctx, opts, params.clientId, resolved);
-	let effectiveScopes = [...params.requestedScopes];
-	for (const row of resolved) {
-		if (row.allowedScopes === null || row.allowedScopes === void 0) continue;
-		const allowed = new Set(row.allowedScopes);
-		const intersection = effectiveScopes.filter((s) => allowed.has(s));
-		if (intersection.length === 0) throw new APIError("BAD_REQUEST", {
-			error: "invalid_scope",
-			error_description: `none of the requested scopes are allowed for resource ${row.identifier}`
-		});
-		effectiveScopes = intersection;
-	}
-	let accessTokenTtl = null;
-	let refreshTokenTtl = null;
-	for (const row of resolved) {
-		if (row.accessTokenTtl != null) accessTokenTtl = accessTokenTtl === null ? row.accessTokenTtl : Math.min(accessTokenTtl, row.accessTokenTtl);
-		if (row.refreshTokenTtl != null) refreshTokenTtl = refreshTokenTtl === null ? row.refreshTokenTtl : Math.min(refreshTokenTtl, row.refreshTokenTtl);
-	}
-	const uniqueSigningAlgs = /* @__PURE__ */ new Set();
-	const uniqueSigningKids = /* @__PURE__ */ new Set();
-	for (const row of resolved) {
-		if (row.signingAlgorithm) uniqueSigningAlgs.add(row.signingAlgorithm);
-		if (row.signingKeyId) uniqueSigningKids.add(row.signingKeyId);
-	}
-	if (uniqueSigningAlgs.size > 1) throw new APIError("BAD_REQUEST", {
-		error: "invalid_request",
-		error_description: "multi-resource request has conflicting signingAlgorithm pins; a single JWS signature cannot satisfy multiple algorithms"
-	});
-	if (uniqueSigningKids.size > 1) throw new APIError("BAD_REQUEST", {
-		error: "invalid_request",
-		error_description: "multi-resource request has conflicting signingKeyId pins; a single JWS signature cannot satisfy multiple key ids"
-	});
-	const signingAlgorithm = uniqueSigningAlgs.values().next().value ?? null;
-	const signingKeyId = uniqueSigningKids.values().next().value ?? null;
-	const mergedClaims = {};
-	for (const row of resolved) if (row.customClaims && typeof row.customClaims === "object") Object.assign(mergedClaims, row.customClaims);
-	const dpopBoundAccessTokensRequired = resolved.some((row) => row.dpopBoundAccessTokensRequired === true);
-	const audienceIdentifiers = includesOpenid ? [...uniqueRequestedResources, userInfoResourceIdentifier] : uniqueRequestedResources;
-	const audClaim = [...new Set(audienceIdentifiers)];
-	return {
-		audienceClaim: audClaim.length === 1 ? audClaim[0] : audClaim,
-		accessTokenTtl,
-		refreshTokenTtl,
-		signingAlgorithm,
-		signingKeyId,
-		rawCustomClaims: mergedClaims,
-		dpopBoundAccessTokensRequired,
-		effectiveScopes
-	};
-}
-/**
-* Throws `invalid_target` if the client isn't linked to every resource via
-* the `oauthClientResource` join table. Issues one `findMany` per call.
-*
-* @internal
-*/
-async function assertClientLinkedToResources(ctx, opts, clientId, resources) {
-	if (resources.length === 0) return;
-	const modelName = opts.schema?.oauthClientResource?.modelName ?? "oauthClientResource";
-	const links = await ctx.context.adapter.findMany({
-		model: modelName,
-		where: [{
-			field: "clientId",
-			value: clientId
-		}]
-	});
-	const linkedSet = new Set(links?.map((l) => l.resourceId) ?? []);
-	const unlinked = resources.filter((resource) => !linkedSet.has(resource.identifier));
-	if (unlinked.length > 0) throw new APIError("BAD_REQUEST", {
-		error: "invalid_target",
-		error_description: `client ${clientId} is not linked to resource(s) ${unlinked.map((resource) => resource.identifier).join(", ")}`
-	});
-}
-/**
-* Returns `true` when `clientId` is linked, via the `oauthClientResource` join
-* table, to at least one of `resourceIdentifiers`. Authorizes cross-client token
-* introspection (RFC 7662 §2.1/§4): a resource server may introspect a token
-* whose audience it serves, even when a different client issued the token.
-*
-* @internal
-*/
-async function isClientLinkedToAnyResource(ctx, opts, clientId, resourceIdentifiers) {
-	if (resourceIdentifiers.length === 0) return false;
-	const modelName = opts.schema?.oauthClientResource?.modelName ?? "oauthClientResource";
-	return ((await ctx.context.adapter.findMany({
-		model: modelName,
-		where: [{
-			field: "clientId",
-			value: clientId
-		}, {
-			field: "resourceId",
-			operator: "in",
-			value: resourceIdentifiers
-		}],
-		limit: 1
-	}))?.length ?? 0) > 0;
-}
-/**
-* Merges `customClaims` from the existing rows of `resourceIdentifiers` in
-* order (later resources win on collision). Missing rows are skipped; disabled
-* rows are included, since an already-issued token keeps its claims until it
-* expires. Returned raw; `resolveAccessTokenClaims` strips reserved names.
-*
-* Unlike {@link resolveResourcePolicy}, this applies none of the new-issuance
-* gates (disabled, scope allowlist, client linkage), so it is the right way to
-* re-derive claims for an already-issued token at introspection.
-*
-* @internal
-*/
-async function getResourceCustomClaims(ctx, opts, resourceIdentifiers) {
-	if (resourceIdentifiers.length === 0) return {};
-	const rows = await ctx.context.adapter.findMany({
-		model: opts.schema?.oauthResource?.modelName ?? "oauthResource",
-		where: [{
-			field: "identifier",
-			operator: "in",
-			value: resourceIdentifiers
-		}]
-	});
-	const rowByIdentifier = new Map(rows.map((row) => [row.identifier, row]));
-	const merged = {};
-	for (const identifier of resourceIdentifiers) {
-		const row = rowByIdentifier.get(identifier);
-		if (row?.customClaims && typeof row.customClaims === "object") Object.assign(merged, row.customClaims);
-	}
-	return merged;
-}
-/**
-* Resolves the effective {@link OAuthOptions.enforcePerClientResources} value.
-*
-* - Explicit `true | false` always wins (`source: "explicit"`).
-* - Otherwise resolve to `true` (`source: "default"`). RFC 8707 §3 per-client
-*   validation is the secure default.
-*
-* Deterministic and pure — safe to call on every validation pass.
-*/
-function resolveEnforcePerClientResources(opts) {
-	if (opts.enforcePerClientResources !== void 0) return {
-		value: opts.enforcePerClientResources,
-		source: "explicit"
-	};
-	return {
-		value: true,
-		source: "default"
-	};
-}
-/**
-* In-process cache of {@link OAuthResource} rows, keyed by `identifier`.
-*
-* Opt-in via {@link OAuthOptions.cachedResources} (same membership-Set pattern
-* as `cachedTrustedClients`). Resources outside the set are looked up from the
-* DB on every request — the safe default for deployments that edit rows
-* through external tooling.
-*
-* Module-scoped so admin CRUD handlers can invalidate from anywhere via
-* {@link invalidateResourceCache}.
-*/
-const resourceCache = /* @__PURE__ */ new Map();
-/**
-* Removes an entry from the resource cache. Called by admin CRUD handlers
-* after every write. Pass no argument to clear the entire cache.
-*
-* @internal
-*/
-function invalidateResourceCache(identifier) {
-	if (identifier === void 0) {
-		resourceCache.clear();
-		return;
-	}
-	resourceCache.delete(identifier);
-}
-/**
-* Looks up an {@link OAuthResource} by `identifier`, consulting the in-process
-* cache when the identifier is in {@link OAuthOptions.cachedResources}.
-*
-* Triggers the lazy seed via {@link seedResourcesOnce} on first call — this
-* is the safety net for deployments where migrations run after plugin init
-* (so seeding at init couldn't see the table yet). The seed is idempotent
-* and coalesced, so the cost is paid only once per process.
-*
-* Returns a defensive copy so callers can't mutate cached state.
-*
-* @internal
-*/
-async function getResource(ctx, opts, identifier) {
-	await seedResourcesOnce(ctx.context, opts);
-	if (opts.cachedResources?.has(identifier)) {
-		const cached = resourceCache.get(identifier);
-		if (cached) return Object.assign({}, cached);
-	}
-	const dbResource = await ctx.context.adapter.findOne({
-		model: opts.schema?.oauthResource?.modelName ?? "oauthResource",
-		where: [{
-			field: "identifier",
-			value: identifier
-		}]
-	});
-	if (dbResource && opts.cachedResources?.has(identifier)) resourceCache.set(identifier, Object.assign({}, dbResource));
-	return dbResource;
-}
-/**
-* Default `name` value when an input doesn't provide one. Mirrors what most
-* admin UIs would show.
-*/
-function defaultName(input) {
-	return input.name ?? input.identifier;
-}
-/**
-* Coerces seed-config `resources` entries — string or object form — into a
-* normalized list of {@link OAuthResourceInput}.
-*
-* @internal
-*/
-function collectResourceInputs(opts) {
-	const inputs = [];
-	if (opts.resources?.length) for (const entry of opts.resources) inputs.push(typeof entry === "string" ? { identifier: entry } : entry);
-	return inputs;
-}
-/**
-* Builds the row payload sent to the adapter for a seed insert. All policy
-* columns default to `null` (= inherit plugin default at issuance time)
-* when the input doesn't specify a value.
-*/
-function buildSeedRow(input, now) {
-	return {
-		identifier: input.identifier,
-		name: defaultName(input),
-		accessTokenTtl: input.accessTokenTtl ?? null,
-		refreshTokenTtl: input.refreshTokenTtl ?? null,
-		signingAlgorithm: input.signingAlgorithm ?? null,
-		signingKeyId: input.signingKeyId ?? null,
-		allowedScopes: input.allowedScopes ?? null,
-		customClaims: input.customClaims ?? null,
-		dpopBoundAccessTokensRequired: input.dpopBoundAccessTokensRequired ?? false,
-		disabled: input.disabled ?? false,
-		policyVersion: 1,
-		metadata: input.metadata ?? null,
-		createdAt: now,
-		updatedAt: now
-	};
-}
-/**
-* Builds the partial update payload when re-seeding an existing row.
-*
-* - `overwrite` mode replaces every policy column with the input value
-*   (omitted fields fall back to `null` to clear stale state).
-* - `merge` mode updates only fields present in the input — admin edits to
-*   other fields are preserved.
-*/
-function buildSeedUpdate(input, mode, now) {
-	if (mode === "overwrite") {
-		const { identifier: _identifier, createdAt: _createdAt, ...rest } = buildSeedRow(input, now);
-		return rest;
-	}
-	const update = { updatedAt: now };
-	if (input.name !== void 0) update.name = input.name;
-	if (input.accessTokenTtl !== void 0) update.accessTokenTtl = input.accessTokenTtl;
-	if (input.refreshTokenTtl !== void 0) update.refreshTokenTtl = input.refreshTokenTtl;
-	if (input.signingAlgorithm !== void 0) update.signingAlgorithm = input.signingAlgorithm;
-	if (input.signingKeyId !== void 0) update.signingKeyId = input.signingKeyId;
-	if (input.allowedScopes !== void 0) update.allowedScopes = input.allowedScopes;
-	if (input.customClaims !== void 0) update.customClaims = input.customClaims;
-	if (input.dpopBoundAccessTokensRequired !== void 0) update.dpopBoundAccessTokensRequired = input.dpopBoundAccessTokensRequired;
-	if (input.disabled !== void 0) update.disabled = input.disabled;
-	if (input.metadata !== void 0) update.metadata = input.metadata;
-	return update;
-}
-/**
-* Pattern matched against adapter errors to detect the "table not yet
-* created" case — i.e. migrations haven't been run. When matched, the
-* caller treats the seed as deferred (will retry on first resource access).
-*
-* Covers SQLite ("no such table"), Postgres ("relation X does not exist"),
-* and MySQL ("Table X does not exist" / contracted form).
-*/
-const MISSING_TABLE_PATTERN = /no such table|relation.*does not exist|table.*does(?: not|n[''']?t) exist/i;
-/**
-* Per-adapter state for the lazy-seed path. A module-level boolean would let
-* one Better Auth instance suppress seeding for every later instance in the same
-* process. Endpoint `AuthContext` objects are not guaranteed to be stable across
-* requests, so keying by the adapter keeps one seed state per backing store.
-*/
-let seedStates = /* @__PURE__ */ new WeakMap();
-function getSeedState(ctx) {
-	const key = ctx.adapter;
-	const existing = seedStates.get(key);
-	if (existing) return existing;
-	const created = {
-		completed: false,
-		promise: null
-	};
-	seedStates.set(key, created);
-	return created;
-}
-/**
-* Seeds `oauthResource` rows from plugin config.
-*
-* Behavior is controlled by {@link OAuthOptions.resourceSeedMode}:
-*
-* - `"insertOnly"` (default, safe): inserts rows whose `identifier` is not
-*   already present. Existing rows are untouched — admin edits via CRUD
-*   are never reverted on restart.
-* - `"merge"`: inserts missing rows; updates only specified fields for
-*   existing rows. Useful when config holds the "preferred defaults" but
-*   admins customize per-row.
-* - `"overwrite"`: inserts missing rows; replaces every policy column on
-*   existing rows with the config value (omitted fields → null). Use only
-*   when config is the single source of truth.
-*
-* Race-safety: the `identifier` column carries a UNIQUE constraint, so two
-* processes booting simultaneously can each attempt the insert — one wins,
-* the other catches the constraint error and treats it as a no-op.
-*
-* Migration ordering: at plugin `init` time, tables may not exist yet
-* (Better Auth's test harness, and many deployment setups, run migrations
-* after auth construction). Seeding tolerates "no such table" errors and
-* defers — the lazy {@link seedResourcesOnce} path picks up the work on
-* the first resource access.
-*
-* Idempotent: safe to call multiple times.
-*
-* @internal
-*/
-async function seedResources(ctx, opts) {
-	const inputs = collectResourceInputs(opts);
-	if (inputs.length === 0) return;
-	const mode = opts.resourceSeedMode ?? "insertOnly";
-	const modelName = opts.schema?.oauthResource?.modelName ?? "oauthResource";
-	for (const rawInput of inputs) {
-		const check = await checkIdentifier(opts, rawInput.identifier);
-		if (!check.ok) {
-			logger.warn(`oauth-provider: skipping resource seed for ${rawInput.identifier} — ${check.reason}`);
-			continue;
-		}
-		let input = rawInput;
-		if (input.signingAlgorithm != null && !JWS_ALGORITHM_SET.has(input.signingAlgorithm)) {
-			logger.warn(`oauth-provider: dropping unsupported signingAlgorithm "${input.signingAlgorithm}" for resource ${input.identifier} — must be one of ${JWS_ALGORITHMS.join(", ")}. Continuing without an algorithm override.`);
-			const { signingAlgorithm: _, ...rest } = input;
-			input = rest;
-		}
-		let existing;
-		try {
-			existing = await ctx.adapter.findOne({
-				model: modelName,
-				where: [{
-					field: "identifier",
-					value: input.identifier
-				}]
-			});
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			if (MISSING_TABLE_PATTERN.test(message)) {
-				logger.debug("oauth-provider: oauthResource table not yet created; deferring resource seed to first access.");
-				return;
-			}
-			throw err;
-		}
-		const now = /* @__PURE__ */ new Date();
-		if (!existing) {
-			try {
-				await ctx.adapter.create({
-					model: modelName,
-					data: buildSeedRow(input, now)
-				});
-			} catch (err) {
-				const message = err instanceof Error ? err.message : String(err);
-				if (/unique|duplicate|UNIQUE/i.test(message)) {
-					logger.debug(`oauth-provider: resource ${input.identifier} already inserted by a concurrent process — skipping.`);
-					continue;
-				}
-				if (MISSING_TABLE_PATTERN.test(message)) {
-					logger.debug("oauth-provider: oauthResource table not yet created; deferring resource seed to first access.");
-					return;
-				}
-				throw err;
-			}
-			continue;
-		}
-		if (mode === "insertOnly") continue;
-		await ctx.adapter.update({
-			model: modelName,
-			where: [{
-				field: "identifier",
-				value: input.identifier
-			}],
-			update: buildSeedUpdate(input, mode, now)
-		});
-	}
-}
-/**
-* Idempotent, coalesced wrapper around {@link seedResources} for the
-* lazy-seed path. Safe to call from every resource lookup — the first call
-* runs the seed, concurrent calls await the same promise, and subsequent
-* calls become no-ops.
-*
-* The endpoint context shape (`{ context: AuthContext }`) is what
-* `getResource` receives, so this is a convenience overload that unwraps
-* for callers.
-*
-* @internal
-*/
-async function seedResourcesOnce(ctx, opts) {
-	const state = getSeedState(ctx);
-	if (state.completed === true) return;
-	if (state.promise !== null) return state.promise;
-	state.promise = seedResources(ctx, opts).then(() => {
-		state.completed = true;
-	}).catch((err) => {
-		state.promise = null;
-		throw err;
-	});
-	return state.promise;
-}
-/**
-* Logs the resolved value of {@link OAuthOptions.enforcePerClientResources}
-* so deployment admins see which default applied at init. Separated from
-* {@link resolveEnforcePerClientResources} so the latter stays pure and
-* cheap to call from validation flow.
-*
-* @internal
-*/
-function logEnforcePerClientResourcesResolution(opts) {
-	const resolved = resolveEnforcePerClientResources(opts);
-	logger.info(`oauth-provider: enforcePerClientResources resolved to ${resolved.value} (${resolved.source})`);
-}
-//#endregion
-//#region src/oauthClient/client-credentials.ts
-const USER_DELEGATED_SCOPES = /* @__PURE__ */ new Set([
-	"openid",
-	"profile",
-	"email",
-	"offline_access"
-]);
-function isUserDelegatedScope(scope) {
-	return USER_DELEGATED_SCOPES.has(scope);
-}
-function normalizeClientCredentialsScopes(scopes) {
-	return [...new Set(scopes.map((scope) => scope.trim()).filter(Boolean))];
-}
-function validateClientCredentialsScopes(scopes, grantTypes, tokenEndpointAuthMethod, opts) {
-	if (scopes.length === 0) return;
-	if (!grantTypes.includes("client_credentials")) throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: "client_credentials_scopes requires the client_credentials grant"
-	});
-	if (tokenEndpointAuthMethod === "none") throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: "public clients cannot be assigned client_credentials scopes"
-	});
-	const providerScopes = new Set(opts.scopes ?? []);
-	const invalidScopes = scopes.filter((scope) => !providerScopes.has(scope) || isUserDelegatedScope(scope));
-	if (invalidScopes.length > 0) throw new APIError("BAD_REQUEST", {
-		error: "invalid_scope",
-		error_description: `The following client_credentials scopes are invalid: ${invalidScopes.join(", ")}`
-	});
-}
-//#endregion
-//#region src/client-metadata.ts
-const OAUTH_CLIENT_RECORD_FIELD_NAMES = Object.freeze(Object.keys({
-	clientId: true,
-	clientSecret: true,
-	clientDiscoveryId: true,
-	disabled: true,
-	scopes: true,
-	clientCredentialsScopes: true,
-	userId: true,
-	createdAt: true,
-	updatedAt: true,
-	expiresAt: true,
-	name: true,
-	uri: true,
-	icon: true,
-	contacts: true,
-	tos: true,
-	policy: true,
-	softwareId: true,
-	softwareVersion: true,
-	softwareStatement: true,
-	redirectUris: true,
-	postLogoutRedirectUris: true,
-	backchannelLogoutUri: true,
-	backchannelLogoutSessionRequired: true,
-	tokenEndpointAuthMethod: true,
-	grantTypes: true,
-	responseTypes: true,
-	applicationType: true,
-	jwks: true,
-	jwksUri: true,
-	requirePKCE: true,
-	dpopBoundAccessTokens: true,
-	skipConsent: true,
-	enableEndSession: true,
-	subjectType: true,
-	referenceId: true,
-	metadata: true
-}));
-/**
-* Canonical wire fields emitted by schemaToOAuth. They are mapped explicitly
-* and therefore must never also survive inside the opaque metadata envelope.
-*/
-const OAUTH_CLIENT_WIRE_FIELD_NAMES = [
-	"client_id",
-	"client_secret",
-	"client_secret_expires_at",
-	"scope",
-	"user_id",
-	"client_id_issued_at",
-	"client_name",
-	"client_uri",
-	"logo_uri",
-	"contacts",
-	"tos_uri",
-	"policy_uri",
-	"jwks",
-	"jwks_uri",
-	"software_id",
-	"software_version",
-	"software_statement",
-	"redirect_uris",
-	"post_logout_redirect_uris",
-	"backchannel_logout_uri",
-	"backchannel_logout_session_required",
-	"token_endpoint_auth_method",
-	"grant_types",
-	"response_types",
-	"application_type",
-	"disabled",
-	"skip_consent",
-	"enable_end_session",
-	"require_pkce",
-	"dpop_bound_access_tokens",
-	"subject_type",
-	"reference_id"
-];
-const OPAQUE_METADATA_RESERVED_FIELDS = /* @__PURE__ */ new Set([
-	...OAUTH_CLIENT_RECORD_FIELD_NAMES,
-	...OAUTH_CLIENT_WIRE_FIELD_NAMES,
-	"public",
-	"type",
-	"resources",
-	"client_credentials_scopes"
-]);
-const CIMD_FORBIDDEN_SERVER_FIELD_NAMES = /* @__PURE__ */ new Set([
-	"disabled",
-	"client_secret",
-	"client_secret_expires_at",
-	"client_id_issued_at",
-	"skip_consent",
-	"enable_end_session",
-	"require_pkce",
-	"reference_id",
-	"user_id",
-	"resources",
-	"clientSecret",
-	"clientDiscoveryId",
-	"skipConsent",
-	"enableEndSession",
-	"requirePKCE",
-	"referenceId",
-	"userId",
-	"clientId",
-	"applicationType",
-	"tokenEndpointAuthMethod",
-	"redirectUris",
-	"postLogoutRedirectUris",
-	"grantTypes",
-	"responseTypes",
-	"scopes",
-	"expiresAt",
-	"createdAt",
-	"updatedAt",
-	"softwareId",
-	"softwareVersion",
-	"softwareStatement",
-	"backchannelLogoutUri",
-	"backchannelLogoutSessionRequired",
-	"jwksUri",
-	"dpopBoundAccessTokens",
-	"subjectType"
-]);
-function isForbiddenCimdClientMetadataField(field) {
-	return CIMD_FORBIDDEN_SERVER_FIELD_NAMES.has(field);
-}
-function stripReservedOAuthClientMetadataExtensions(metadata) {
-	if (!metadata) return void 0;
-	return Object.fromEntries(Object.entries(metadata).filter(([field]) => !OPAQUE_METADATA_RESERVED_FIELDS.has(field)));
-}
-//#endregion
-//#region src/oauthClient/privileges.ts
-/**
-* Authorizes a client action against the configured `clientPrivileges` hook.
-*
-* This is the single authorization helper for every OAuth client mutation. The
-* create path enforces it at the shared creation chokepoint so that no
-* registration route can reach client persistence without it.
-*
-* @throws APIError UNAUTHORIZED when there is no session or the hook denies the action.
-* @throws APIError BAD_REQUEST when the request carries no headers.
-*/
-async function assertClientPrivileges(ctx, session, opts, action) {
-	if (!session) throw new APIError("UNAUTHORIZED");
-	if (!ctx.headers) throw new APIError("BAD_REQUEST");
-	if (action === "configure-client-credentials-scopes" && !opts.clientPrivileges) throw new APIError("UNAUTHORIZED");
-	if (opts.clientPrivileges && !await opts.clientPrivileges({
-		headers: ctx.headers,
-		action,
-		session: session.session,
-		user: session.user
-	})) throw new APIError("UNAUTHORIZED");
-}
-//#endregion
-//#region src/utils/initial-access-token.ts
-/**
-* Builds an RFC 6750 §3 Bearer challenge for the registration endpoint. The
-* `error` code maps to the status per RFC 6750 §3.1 (`invalid_request` → 400,
-* `invalid_token` → 401) and is echoed in both the `WWW-Authenticate` challenge
-* and the JSON body.
-*
-* @see https://datatracker.ietf.org/doc/html/rfc6750#section-3
-*/
-function registrationBearerError(status, error, errorDescription) {
-	return new APIError$1(status, {
-		error,
-		error_description: errorDescription
-	}, {
-		"WWW-Authenticate": `Bearer error="${error}"`,
-		...NO_STORE_HEADERS
-	});
-}
-/**
-* Resolves an RFC 7591 initial access token from the request and authorizes it
-* against the deployment-supplied validator.
-*
-* Returns the authorization (optionally carrying a `referenceId`) when a valid
-* token is present, or `undefined` when no Bearer credentials were sent so the
-* caller can fall back to session or open registration. Throws an RFC 6750
-* Bearer challenge when the header is malformed, no validator is configured, or
-* the token is rejected.
-*
-* @see https://datatracker.ietf.org/doc/html/rfc7591#section-3
-*/
-async function authorizeInitialAccessToken(ctx, opts, clientMetadata) {
-	const headers = ctx.headers;
-	let initialAccessToken;
-	try {
-		initialAccessToken = parseBearerToken(headers?.get("authorization"));
-	} catch {
-		throw registrationBearerError("BAD_REQUEST", "invalid_request", "Malformed initial access token Authorization header");
-	}
-	if (!initialAccessToken || !headers) return;
-	if (!opts.validateInitialAccessToken) throw registrationBearerError("UNAUTHORIZED", "invalid_token", "Invalid initial access token");
-	let authorization;
-	try {
-		authorization = await opts.validateInitialAccessToken({
-			initialAccessToken,
-			headers,
-			clientMetadata
-		});
-	} catch (error) {
-		if (error instanceof APIError$1) throw error;
-		throw new APIError$1("INTERNAL_SERVER_ERROR", {
-			error: "server_error",
-			error_description: "Initial access token validation failed"
-		});
-	}
-	if (!authorization) throw registrationBearerError("UNAUTHORIZED", "invalid_token", "Invalid initial access token");
-	return authorization;
-}
-//#endregion
-//#region src/register.ts
-const DEFAULT_REGISTRATION_GRANT_TYPES = ["authorization_code"];
-function resolveClientRegistrationScopes(opts) {
-	return [.../* @__PURE__ */ new Set([...opts.clientRegistrationDefaultScopes ?? opts.scopes ?? [], ...opts.clientRegistrationAllowedScopes ?? []])];
-}
-function resolveRegistrationGrantTypes(client) {
-	const grantTypes = client.grant_types ?? [...DEFAULT_REGISTRATION_GRANT_TYPES];
-	if (grantTypes.length > 0) return grantTypes;
-	throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: "grant_types must contain at least one grant type"
-	});
-}
-function resolveRegistrationResponseTypes(client, grantTypes) {
-	if (client.response_types) return client.response_types;
-	return grantTypes.includes("authorization_code") ? ["code"] : void 0;
-}
-function applyOAuthClientRegistrationDefaults(client, defaultApplicationType = "web") {
-	const grantTypes = resolveRegistrationGrantTypes(client);
-	return {
-		...client,
-		token_endpoint_auth_method: client.token_endpoint_auth_method ?? "client_secret_basic",
-		application_type: client.application_type ?? (defaultApplicationType === null ? void 0 : defaultApplicationType),
-		grant_types: grantTypes,
-		response_types: resolveRegistrationResponseTypes(client, grantTypes)
-	};
-}
-const FORBIDDEN_NATIVE_REDIRECT_SCHEMES = /* @__PURE__ */ new Set([
-	"file:",
-	"ftp:",
-	"mailto:",
-	"javascript:",
-	"data:",
-	"vbscript:"
-]);
-function invalidRedirectUri(description) {
-	throw new APIError("BAD_REQUEST", {
-		error: "invalid_redirect_uri",
-		error_description: description
-	});
-}
-function getRawHttpHostname(redirectUri) {
-	const authority = /^http:\/\/([^/?#]*)/i.exec(redirectUri)?.[1];
-	if (!authority) return null;
-	const hostAndPort = authority.slice(authority.lastIndexOf("@") + 1);
-	if (hostAndPort.startsWith("[")) {
-		const bracketEnd = hostAndPort.indexOf("]");
-		return bracketEnd < 0 ? null : hostAndPort.slice(0, bracketEnd + 1).toLowerCase();
-	}
-	return (hostAndPort.split(":")[0] ?? "").toLowerCase();
-}
-async function resolveClientRegistrationResources(ctx, opts, requestedResources) {
-	const defaultResources = opts.clientRegistrationDefaultResources ?? [];
-	const allowedResources = /* @__PURE__ */ new Set([...defaultResources, ...opts.clientRegistrationAllowedResources ?? []]);
-	for (const identifier of requestedResources) if (!allowedResources.has(identifier)) throw new APIError("BAD_REQUEST", {
-		error: "invalid_target",
-		error_description: `requested resource ${identifier} is not allowed for client registration`
-	});
-	const resources = [.../* @__PURE__ */ new Set([...defaultResources, ...requestedResources])];
-	for (const identifier of resources) {
-		const row = await getResource(ctx, opts, identifier);
-		if (!row) throw new APIError("BAD_REQUEST", {
-			error: "invalid_target",
-			error_description: `requested resource ${identifier} does not exist`
-		});
-		if (row.disabled) throw new APIError("BAD_REQUEST", {
-			error: "invalid_target",
-			error_description: `requested resource ${identifier} is disabled`
-		});
-	}
-	return resources;
-}
-function validateClientRedirectUri(redirectUri, applicationType) {
-	let url;
-	try {
-		url = new URL(redirectUri);
-	} catch {
-		invalidRedirectUri(`redirect URI must be an absolute URI: ${redirectUri}`);
-	}
-	if (redirectUri.includes("#") || url.username.length > 0 || url.password.length > 0) invalidRedirectUri(`redirect URI must not include credentials or a fragment: ${redirectUri}`);
-	const isHttp = url.protocol === "http:";
-	const isHttps = url.protocol === "https:";
-	if (/^localhost\.+$/i.test(url.hostname)) invalidRedirectUri(`redirect URI localhost must not include trailing dots: ${redirectUri}`);
-	const isRedirectLoopback = isLoopbackIP(url.hostname) || url.hostname === "localhost";
-	const rawHttpHostname = getRawHttpHostname(redirectUri);
-	const isAllowedNativeHttpLoopback = rawHttpHostname === "localhost" || rawHttpHostname === "127.0.0.1" || rawHttpHostname === "[::1]";
-	if (applicationType === "web") {
-		if (!isHttps || isRedirectLoopback) invalidRedirectUri(`web clients require https redirect URIs on non-loopback hosts: ${redirectUri}`);
-		return;
-	}
-	if (isHttps) {
-		if (isRedirectLoopback) invalidRedirectUri(`native clients must not use https loopback redirect URIs: ${redirectUri}`);
-		return;
-	}
-	if (isHttp) {
-		if (!isAllowedNativeHttpLoopback) invalidRedirectUri(`native clients may use http only on the exact loopback hosts localhost, 127.0.0.1, or [::1]: ${redirectUri}`);
-		return;
-	}
-	if (FORBIDDEN_NATIVE_REDIRECT_SCHEMES.has(url.protocol) || !isReverseDomainPrivateUseRedirectUri(url)) invalidRedirectUri(`native private-use redirect URI schemes must be well-formed reverse-domain names, omit the naming authority, and must not use a reserved scheme: ${redirectUri}`);
-}
-function assertValidRegistrationJwks(jwks) {
-	const result = validatePublicClientJwks(jwks);
-	if (!result.valid) throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: result.error
-	});
-}
-async function registerEndpoint(ctx, opts) {
-	const body = ctx.body;
-	if (!opts.allowDynamicClientRegistration) throw new APIError("FORBIDDEN", {
-		error: "access_denied",
-		error_description: "Client registration is disabled"
-	});
-	const session = await getSessionFromCtx(ctx);
-	const tokenAuthorization = session ? void 0 : await authorizeInitialAccessToken(ctx, opts, body);
-	const isTokenAuthorized = Boolean(tokenAuthorization);
-	if (!(session || isTokenAuthorized || opts.allowUnauthenticatedClientRegistration)) throw new APIError("UNAUTHORIZED", { error_description: "Authentication required for client registration" }, {
-		"WWW-Authenticate": "Bearer",
-		...NO_STORE_HEADERS
-	});
-	if (!session && !isTokenAuthorized) {
-		if (body.grant_types?.includes("client_credentials")) throw new APIError("BAD_REQUEST", {
-			error: "invalid_client_metadata",
-			error_description: "client_credentials grant requires authenticated registration"
-		});
-	}
-	const requestedResources = Array.isArray(body.resources) ? body.resources.filter((resource) => typeof resource === "string" && resource.length > 0) : [];
-	if (session) await assertClientPrivileges(ctx, session, opts, "create");
-	const referenceId = tokenAuthorization?.referenceId ?? (session && opts.clientReference ? await opts.clientReference({
-		user: session.user,
-		session: session.session
-	}) : void 0);
-	const response = await createOAuthClientRegistration(ctx, opts, {
-		metadata: body,
-		registrationSource: "dynamic",
-		userId: referenceId ? void 0 : session?.session.userId,
-		referenceId,
-		requestedResources
-	});
-	ctx.setStatus(201);
-	return ctx.json(response);
-}
-async function checkOAuthClient(client, opts, settings) {
-	const isClientMetadataDocument = settings?.registrationSource === "clientMetadataDocument";
-	const clientWithDefaults = applyOAuthClientRegistrationDefaults(client, isClientMetadataDocument ? null : "web");
-	const tokenEndpointAuthMethod = clientWithDefaults.token_endpoint_auth_method ?? "client_secret_basic";
-	if (!new Set(getSupportedAuthMethods(opts, { includeNone: true })).has(tokenEndpointAuthMethod)) throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: `unsupported token_endpoint_auth_method ${tokenEndpointAuthMethod}`
-	});
-	if (clientWithDefaults.dpop_bound_access_tokens !== void 0 && typeof clientWithDefaults.dpop_bound_access_tokens !== "boolean") throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: "dpop_bound_access_tokens must be a boolean"
-	});
-	const grantTypes = clientWithDefaults.grant_types ?? [];
-	const responseTypes = clientWithDefaults.response_types;
-	const applicationType = clientWithDefaults.application_type;
-	if (applicationType !== void 0 && applicationType !== "web" && applicationType !== "native") throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: "application_type must be web or native"
-	});
-	if (grantTypes.includes("authorization_code") && (!clientWithDefaults.redirect_uris || clientWithDefaults.redirect_uris.length === 0)) throw new APIError("BAD_REQUEST", {
-		error: "invalid_redirect_uri",
-		error_description: "Redirect URIs are required for authorization_code and implicit grant types"
-	});
-	for (const uri of clientWithDefaults.redirect_uris ?? []) validateClientRedirectUri(uri, applicationType ?? (isClientMetadataDocument ? "native" : "web"));
-	const supportedGrantTypes = new Set(getSupportedGrantTypes(opts));
-	for (const grantType of grantTypes) if (!supportedGrantTypes.has(grantType)) throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: `unsupported grant_type ${grantType}`
-	});
-	if (grantTypes.includes("authorization_code") && !responseTypes?.includes("code")) throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: "When 'authorization_code' grant type is used, 'code' response type must be included"
-	});
-	if (!grantTypes.includes("authorization_code") && responseTypes?.includes("code")) throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: "When 'code' response type is used, 'authorization_code' grant type must be included"
-	});
-	if (clientWithDefaults.subject_type !== void 0) {
-		if (clientWithDefaults.subject_type !== "public" && clientWithDefaults.subject_type !== "pairwise") throw new APIError("BAD_REQUEST", {
-			error: "invalid_client_metadata",
-			error_description: `subject_type must be "public" or "pairwise"`
-		});
-		if (clientWithDefaults.subject_type === "pairwise" && !opts.pairwiseSecret) throw new APIError("BAD_REQUEST", {
-			error: "invalid_client_metadata",
-			error_description: "pairwise subject_type requires server pairwiseSecret configuration"
-		});
-		if (clientWithDefaults.subject_type === "pairwise" && clientWithDefaults.redirect_uris && clientWithDefaults.redirect_uris.length > 1) {
-			if (new Set(clientWithDefaults.redirect_uris.map((uri) => new URL(uri).host)).size > 1) throw new APIError("BAD_REQUEST", {
-				error: "invalid_client_metadata",
-				error_description: "pairwise clients with redirect_uris on different hosts require a sector_identifier_uri, which is not yet supported. All redirect_uris must share the same host."
-			});
-		}
-	}
-	const requestedScopes = (clientWithDefaults?.scope)?.split(" ").filter((v) => v.length);
-	const validatesRegistrationMetadata = settings?.registrationSource === "dynamic" || settings?.registrationSource === "clientMetadataDocument";
-	const allowedScopes = validatesRegistrationMetadata ? resolveClientRegistrationScopes(opts) : opts.scopes;
-	if (allowedScopes) {
-		const validScopes = new Set(allowedScopes);
-		for (const requestedScope of requestedScopes ?? []) if (!validScopes?.has(requestedScope)) throw new APIError("BAD_REQUEST", {
-			error: "invalid_scope",
-			error_description: `cannot request scope ${requestedScope}`
-		});
-	}
-	if (validatesRegistrationMetadata && clientWithDefaults.require_pkce === false) throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: `pkce is required for registered clients.`
-	});
-	if (clientWithDefaults.jwks || clientWithDefaults.jwks_uri) {
-		if (clientWithDefaults.jwks && clientWithDefaults.jwks_uri) throw new APIError("BAD_REQUEST", {
-			error: "invalid_client_metadata",
-			error_description: "jwks and jwks_uri are mutually exclusive"
-		});
-		if (clientWithDefaults.jwks_uri) try {
-			const uri = new URL(clientWithDefaults.jwks_uri);
-			if (uri.protocol !== "https:") throw new APIError("BAD_REQUEST", {
-				error: "invalid_client_metadata",
-				error_description: "jwks_uri must use HTTPS"
-			});
-			if (uri.username || uri.password) throw new APIError("BAD_REQUEST", {
-				error: "invalid_client_metadata",
-				error_description: "jwks_uri must not contain credentials"
-			});
-			if (clientWithDefaults.jwks_uri.includes("#")) throw new APIError("BAD_REQUEST", {
-				error: "invalid_client_metadata",
-				error_description: "jwks_uri must not include a fragment component"
-			});
-			if (isPrivateHostname(uri.hostname)) throw new APIError("BAD_REQUEST", {
-				error: "invalid_client_metadata",
-				error_description: "jwks_uri must not point to a private or reserved address"
-			});
-			if (settings?.ctx && !settings.ctx.context.isTrustedOrigin(uri.href)) {
-				const clientId = typeof clientWithDefaults.client_id === "string" ? clientWithDefaults.client_id : void 0;
-				if (!(isClientMetadataDocument && clientId !== void 0 && URL.canParse(clientId) && new URL(clientId).origin === uri.origin)) throw new APIError("BAD_REQUEST", {
-					error: "invalid_client_metadata",
-					error_description: "jwks_uri must belong to a trusted origin or the Client ID Metadata Document origin"
-				});
-			}
-		} catch (e) {
-			if (e instanceof APIError) throw e;
-			throw new APIError("BAD_REQUEST", {
-				error: "invalid_client_metadata",
-				error_description: "jwks_uri must be a valid URL"
-			});
-		}
-		if (clientWithDefaults.jwks) assertValidRegistrationJwks(clientWithDefaults.jwks);
-	}
-	if (tokenEndpointAuthMethod === "private_key_jwt" && !clientWithDefaults.jwks && !clientWithDefaults.jwks_uri) throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: "private_key_jwt requires either jwks or jwks_uri"
-	});
-	if (clientWithDefaults.backchannel_logout_uri !== void 0) {
-		if (opts.disableJwtPlugin) throw new APIError("BAD_REQUEST", {
-			error: "invalid_client_metadata",
-			error_description: "backchannel_logout_uri requires the jwt plugin (disableJwtPlugin must be false)"
-		});
-		let url;
-		try {
-			url = new URL(clientWithDefaults.backchannel_logout_uri);
-		} catch {
-			throw new APIError("BAD_REQUEST", {
-				error: "invalid_client_metadata",
-				error_description: "backchannel_logout_uri must be an absolute URL"
-			});
-		}
-		if (clientWithDefaults.backchannel_logout_uri.includes("#")) throw new APIError("BAD_REQUEST", {
-			error: "invalid_client_metadata",
-			error_description: "backchannel_logout_uri must not include a fragment component"
-		});
-		if (url.protocol !== "https:") throw new APIError("BAD_REQUEST", {
-			error: "invalid_client_metadata",
-			error_description: "backchannel_logout_uri must use https"
-		});
-		if (url.username || url.password) throw new APIError("BAD_REQUEST", {
-			error: "invalid_client_metadata",
-			error_description: "backchannel_logout_uri must not contain credentials"
-		});
-		if (isPrivateHostname(url.hostname)) throw new APIError("BAD_REQUEST", {
-			error: "invalid_client_metadata",
-			error_description: "backchannel_logout_uri must not point to a private or reserved address"
-		});
-	}
-}
-const CLIENT_REGISTRATION_COLLISION = Symbol("client-registration-collision");
-function isClientRegistrationCollision(error) {
-	if (!error || typeof error !== "object") return false;
-	const candidate = error;
-	return candidate[CLIENT_REGISTRATION_COLLISION] === true && (candidate.kind === "oauth-client-row-unique" || candidate.kind === "oauth-client-resource-link-unique") && "cause" in candidate;
-}
-/**
-* Creates and persists one canonical OAuth client registration.
-*
-* Authorization and ownership resolution belong to endpoint adapters. This
-* operation owns metadata normalization, validation, credentials, persistence,
-* and resource links so canonical creation paths share one transactional
-* boundary.
-*/
-async function persistOAuthClientRegistration(ctx, opts, input) {
-	const body = applyOAuthClientRegistrationDefaults(input.registrationSource === "dynamic" && !input.metadata.scope ? {
-		...input.metadata,
-		scope: (opts.clientRegistrationDefaultScopes ?? opts.scopes)?.join(" ")
-	} : input.metadata, input.registrationSource === "clientMetadataDocument" ? null : "web");
-	const isPublic = body.token_endpoint_auth_method === "none";
-	const isPrivateKeyJwt = body.token_endpoint_auth_method === "private_key_jwt";
-	const isExtensionAuthMethod = isExtensionTokenEndpointAuthMethod(opts, body.token_endpoint_auth_method);
-	await checkOAuthClient(body, opts, {
-		registrationSource: input.registrationSource,
-		ctx
-	});
-	const clientId = input.clientId ?? opts.generateClientId?.() ?? generateRandomString(32, "a-z", "A-Z");
-	const clientSecret = isPublic || isPrivateKeyJwt || isExtensionAuthMethod ? void 0 : opts.generateClientSecret?.() || generateRandomString(32, "a-z", "A-Z");
-	const storedClientSecret = clientSecret ? await storeClientSecret(ctx, opts, clientSecret) : void 0;
-	const isPKCEOptionalForRegisteredClient = input.registrationSource === "dynamic" && !isPublic && opts.clientRegistrationRequirePKCE === false;
-	const requirePKCE = body.require_pkce ?? (isPKCEOptionalForRegisteredClient ? false : void 0);
-	const iat = Math.floor(Date.now() / 1e3);
-	const { resources: _requestedResources, ...persistableBody } = input.registrationSource === "dynamic" || input.registrationSource === "clientMetadataDocument" ? {
-		...body,
-		scope: resolveClientRegistrationScopes(opts).join(" ")
-	} : body;
-	const owner = input.registrationSource === "clientMetadataDocument" ? void 0 : {
-		userId: input.userId,
-		referenceId: input.referenceId
-	};
-	const schema = oauthToSchema({
-		...persistableBody,
-		redirect_uris: body.redirect_uris ?? [],
-		disabled: void 0,
-		client_secret_expires_at: storedClientSecret ? input.registrationSource === "dynamic" && opts.clientRegistrationClientSecretExpiration ? toExpJWT(opts.clientRegistrationClientSecretExpiration, iat) : 0 : void 0,
-		client_id: clientId,
-		client_secret: storedClientSecret,
-		client_id_issued_at: iat,
-		require_pkce: requirePKCE,
-		user_id: owner?.referenceId ? void 0 : owner?.userId,
-		reference_id: owner?.referenceId
-	});
-	schema.clientCredentialsScopes = input.registrationSource === "clientMetadataDocument" ? input.existingClient?.clientCredentialsScopes ?? [] : input.registrationSource === "managed" ? input.clientCredentialsScopes ?? [] : [];
-	schema.clientDiscoveryId = input.registrationSource === "clientMetadataDocument" ? input.clientDiscoveryId : null;
-	if (input.registrationSource === "clientMetadataDocument" && body.application_type === void 0) schema.applicationType = null;
-	const resources = await resolveClientRegistrationResources(ctx, opts, input.registrationSource === "dynamic" ? input.requestedResources ?? [] : []);
-	const clientModel = opts.schema?.oauthClient?.modelName ?? "oauthClient";
-	const clientResourceModel = opts.schema?.oauthClientResource?.modelName ?? "oauthClientResource";
-	const existingClient = input.registrationSource === "clientMetadataDocument" ? input.existingClient : void 0;
-	const clientDiscoveryId = input.registrationSource === "clientMetadataDocument" ? input.clientDiscoveryId : null;
-	const persistenceResult = await runWithTransaction(ctx.context.adapter, async () => {
-		const adapter = await getCurrentAdapter(ctx.context.adapter);
-		let storedClient;
-		let created = false;
-		if (existingClient) {
-			const updatedClient = await adapter.update({
-				model: clientModel,
-				where: [{
-					field: "clientId",
-					value: clientId
-				}, {
-					field: "clientDiscoveryId",
-					value: clientDiscoveryId
-				}],
-				update: {
-					...schema,
-					disabled: existingClient.disabled,
-					skipConsent: existingClient.skipConsent,
-					enableEndSession: existingClient.enableEndSession,
-					createdAt: existingClient.createdAt,
-					updatedAt: /* @__PURE__ */ new Date(iat * 1e3)
-				}
-			});
-			if (!updatedClient) throw new APIError("BAD_REQUEST", {
-				error: "invalid_client",
-				error_description: "client no longer exists"
-			});
-			storedClient = updatedClient;
-		} else {
-			try {
-				storedClient = await adapter.create({
-					model: clientModel,
-					data: {
-						...schema,
-						createdAt: /* @__PURE__ */ new Date(iat * 1e3),
-						updatedAt: /* @__PURE__ */ new Date(iat * 1e3)
-					}
-				});
-			} catch (error) {
-				if (input.registrationSource === "clientMetadataDocument" && isUniqueConstraintError(error)) throw {
-					[CLIENT_REGISTRATION_COLLISION]: true,
-					kind: "oauth-client-row-unique",
-					clientId,
-					cause: error
-				};
-				throw error;
-			}
-			created = true;
-		}
-		const linkedResources = resources.length === 0 ? [] : await adapter.findMany({
-			model: clientResourceModel,
-			where: [{
-				field: "clientId",
-				value: clientId
-			}]
-		});
-		const linkedResourceIds = new Set(linkedResources.map((link) => link.resourceId));
-		const now = /* @__PURE__ */ new Date();
-		for (const resourceId of resources) {
-			if (linkedResourceIds.has(resourceId)) continue;
-			try {
-				await adapter.create({
-					model: clientResourceModel,
-					data: {
-						clientId,
-						resourceId,
-						createdAt: now
-					}
-				});
-			} catch (error) {
-				if (input.registrationSource === "clientMetadataDocument" && isUniqueConstraintError(error)) throw {
-					[CLIENT_REGISTRATION_COLLISION]: true,
-					kind: "oauth-client-resource-link-unique",
-					clientId,
-					resourceId,
-					cause: error
-				};
-				throw error;
-			}
-		}
-		return {
-			client: storedClient,
-			created
-		};
-	});
-	return {
-		client: persistenceResult.client,
-		clientSecret,
-		resources,
-		created: persistenceResult.created
-	};
-}
-function createOAuthClientRegistrationResponse(result, opts) {
-	const responseBody = schemaToOAuth({
-		...result.client,
-		clientSecret: result.clientSecret ? (opts.prefix?.clientSecret ?? "") + result.clientSecret : void 0
-	});
-	if (result.resources.length > 0) responseBody.resources = result.resources;
-	return responseBody;
-}
-function createOAuthClientAdministrativeResponse(result, opts) {
-	return {
-		...createOAuthClientRegistrationResponse(result, opts),
-		client_credentials_scopes: [...result.client.clientCredentialsScopes ?? []]
-	};
-}
-/**
-* Creates and persists one canonical OAuth client registration.
-*/
-async function createOAuthClientRegistration(ctx, opts, input) {
-	return createOAuthClientRegistrationResponse(await persistOAuthClientRegistration(ctx, opts, input), opts);
-}
-async function createOAuthClientAdministrativeRegistration(ctx, opts, input) {
-	return createOAuthClientAdministrativeResponse(await persistOAuthClientRegistration(ctx, opts, input), opts);
-}
-function assertClientDiscoveryOwnership(client, clientDiscoveryId) {
-	if (!client || client.clientDiscoveryId === clientDiscoveryId) return;
-	throw new APIError("BAD_REQUEST", {
-		error: "invalid_client",
-		error_description: "client_id is already owned by a different registration source"
-	});
-}
-/**
-* First-party persistence seam for a validated Client ID Metadata Document.
-*
-* This operation owns both initial creation and atomic replacement. It never
-* generates a client secret, preserves operator-controlled flags on
-* replacement, and ensures server-default resource links in the same
-* transaction.
-*
-* @internal
-*/
-async function registerClientMetadataDocument(ctx, opts, input) {
-	assertClientDiscoveryOwnership(input.existingClient, input.clientDiscoveryId);
-	if (input.metadata.backchannel_logout_uri !== void 0 || input.metadata.backchannel_logout_session_required !== void 0) throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: "Client ID Metadata Documents cannot register a back-channel logout target"
-	});
-	if ((input.metadata.token_endpoint_auth_method ?? "none") !== "none" && input.metadata.token_endpoint_auth_method !== "private_key_jwt") throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: "Client ID Metadata Document clients cannot use a shared secret"
-	});
-	const registrationInput = {
-		...input,
-		metadata: {
-			...input.metadata,
-			token_endpoint_auth_method: input.metadata.token_endpoint_auth_method ?? "none",
-			client_secret: void 0,
-			client_secret_expires_at: void 0
-		},
-		registrationSource: "clientMetadataDocument"
-	};
-	try {
-		return await persistOAuthClientRegistration(ctx, opts, registrationInput);
-	} catch (error) {
-		if (!isClientRegistrationCollision(error)) throw error;
-		const clientModel = opts.schema?.oauthClient?.modelName ?? "oauthClient";
-		const clientResourceModel = opts.schema?.oauthClientResource?.modelName ?? "oauthClientResource";
-		const currentClient = await ctx.context.adapter.findOne({
-			model: clientModel,
-			where: [{
-				field: "clientId",
-				value: input.clientId
-			}]
-		});
-		if (error.clientId !== input.clientId || !currentClient || currentClient.clientDiscoveryId !== input.clientDiscoveryId) throw error.cause;
-		if (error.kind === "oauth-client-resource-link-unique") {
-			if (!await ctx.context.adapter.findOne({
-				model: clientResourceModel,
-				where: [{
-					field: "clientId",
-					value: error.clientId
-				}, {
-					field: "resourceId",
-					value: error.resourceId
-				}]
-			})) throw error.cause;
-		}
-		try {
-			return await persistOAuthClientRegistration(ctx, opts, {
-				...registrationInput,
-				existingClient: currentClient
-			});
-		} catch (retryError) {
-			if (isClientRegistrationCollision(retryError)) throw retryError.cause;
-			throw retryError;
-		}
-	}
-}
-function isUniqueConstraintError(error) {
-	if (!error || typeof error !== "object") return false;
-	const candidate = error;
-	const code = String(candidate.code ?? candidate.errno ?? "");
-	if ([
-		"1062",
-		"11000",
-		"23505",
-		"ER_DUP_ENTRY",
-		"P2002",
-		"SQLITE_CONSTRAINT_UNIQUE"
-	].includes(code)) return true;
-	if (candidate.name === "MongoServerError" && candidate.code === 11e3) return true;
-	return typeof candidate.message === "string" && /(?:duplicate|unique constraint|unique key)/i.test(candidate.message);
-}
-async function createOAuthClientEndpoint(ctx, opts, settings) {
-	const session = await getSessionFromCtx(ctx);
-	await assertClientPrivileges(ctx, session, opts, "create");
-	if (!session) throw new APIError("UNAUTHORIZED");
-	const referenceId = opts.clientReference ? await opts.clientReference({
-		user: session.user,
-		session: session.session
-	}) : void 0;
-	const { client_credentials_scopes: rawClientCredentialsScopes, ...metadata } = ctx.body;
-	const clientCredentialsScopes = settings?.admin ? normalizeClientCredentialsScopes(rawClientCredentialsScopes ?? []) : [];
-	validateClientCredentialsScopes(clientCredentialsScopes, resolveRegistrationGrantTypes(metadata), metadata.token_endpoint_auth_method, opts);
-	if (clientCredentialsScopes.length > 0) await assertClientPrivileges(ctx, session, opts, "configure-client-credentials-scopes");
-	const registrationInput = {
-		metadata,
-		registrationSource: "managed",
-		userId: referenceId ? void 0 : session.session.userId,
-		referenceId,
-		clientCredentialsScopes
-	};
-	const responseBody = settings?.admin ? await createOAuthClientAdministrativeRegistration(ctx, opts, registrationInput) : await createOAuthClientRegistration(ctx, opts, registrationInput);
-	ctx.setStatus(201);
-	return ctx.json(responseBody);
-}
-function oauthToSchema(input) {
-	const { client_id: clientId, client_secret: clientSecret, client_secret_expires_at: _expiresAt, scope: _scope, user_id: userId, client_id_issued_at: _createdAt, client_name: name, client_uri: uri, logo_uri: icon, contacts, tos_uri: tos, policy_uri: policy, jwks: inputJwks, jwks_uri: jwksUri, software_id: softwareId, software_version: softwareVersion, software_statement: softwareStatement, redirect_uris: redirectUris, post_logout_redirect_uris: postLogoutRedirectUris, backchannel_logout_uri: backchannelLogoutUri, backchannel_logout_session_required: backchannelLogoutSessionRequired, token_endpoint_auth_method: tokenEndpointAuthMethod, grant_types: grantTypes, response_types: responseTypes, application_type: applicationType, disabled, skip_consent: skipConsent, enable_end_session: enableEndSession, require_pkce: requirePKCE, dpop_bound_access_tokens: dpopBoundAccessTokens, subject_type: subjectType, reference_id: referenceId, metadata: inputMetadata } = input;
-	const expiresAt = _expiresAt ? /* @__PURE__ */ new Date(Number(_expiresAt) * 1e3) : void 0;
-	const createdAt = _createdAt ? /* @__PURE__ */ new Date(_createdAt * 1e3) : void 0;
-	const scopes = _scope?.split(" ");
-	const metadataObj = stripReservedOAuthClientMetadataExtensions(inputMetadata ?? {});
-	const metadata = metadataObj && Object.keys(metadataObj).length ? JSON.stringify(metadataObj) : void 0;
-	return {
-		clientId,
-		clientSecret,
-		disabled,
-		scopes,
-		userId,
-		createdAt,
-		expiresAt,
-		name,
-		uri,
-		icon,
-		contacts,
-		tos,
-		policy,
-		softwareId,
-		softwareVersion,
-		softwareStatement,
-		redirectUris,
-		postLogoutRedirectUris,
-		backchannelLogoutUri,
-		backchannelLogoutSessionRequired,
-		tokenEndpointAuthMethod,
-		grantTypes,
-		responseTypes,
-		jwks: inputJwks ? JSON.stringify(inputJwks) : void 0,
-		jwksUri,
-		applicationType,
-		skipConsent,
-		enableEndSession,
-		requirePKCE,
-		dpopBoundAccessTokens,
-		subjectType,
-		referenceId,
-		metadata
-	};
-}
-/**
-* Converts a Database Schema to an OAuth 2.0 Dynamic Client Schema
-* @param input
-* @param cleaned - default true, determines if the output has only Oauth 2.0 compatible data
-* @returns
-*/
-function schemaToOAuth(input) {
-	const { clientId, clientSecret, disabled, scopes, userId, createdAt, updatedAt: _updatedAt, expiresAt, name, uri, icon, contacts, tos, policy, softwareId, softwareVersion, softwareStatement, redirectUris, postLogoutRedirectUris, backchannelLogoutUri, backchannelLogoutSessionRequired, tokenEndpointAuthMethod, grantTypes, responseTypes, applicationType, jwks, jwksUri, skipConsent, enableEndSession, requirePKCE, dpopBoundAccessTokens, subjectType, referenceId, metadata } = input;
-	const _expiresAt = expiresAt ? Math.round(new Date(expiresAt).getTime() / 1e3) : void 0;
-	const _createdAt = createdAt ? Math.round(new Date(createdAt).getTime() / 1e3) : void 0;
-	const _scopes = scopes?.join(" ");
-	return {
-		...stripReservedOAuthClientMetadataExtensions(parseClientMetadata(metadata)),
-		client_id: clientId,
-		client_secret: clientSecret ?? void 0,
-		client_secret_expires_at: clientSecret ? _expiresAt ?? 0 : void 0,
-		scope: _scopes ?? void 0,
-		user_id: userId ?? void 0,
-		client_id_issued_at: _createdAt ?? void 0,
-		client_name: name ?? void 0,
-		client_uri: uri ?? void 0,
-		logo_uri: icon ?? void 0,
-		contacts: contacts ?? void 0,
-		tos_uri: tos ?? void 0,
-		policy_uri: policy ?? void 0,
-		jwks: jwks ? JSON.parse(jwks) : void 0,
-		jwks_uri: jwksUri ?? void 0,
-		software_id: softwareId ?? void 0,
-		software_version: softwareVersion ?? void 0,
-		software_statement: softwareStatement ?? void 0,
-		redirect_uris: redirectUris ?? [],
-		post_logout_redirect_uris: postLogoutRedirectUris ?? void 0,
-		backchannel_logout_uri: backchannelLogoutUri ?? void 0,
-		backchannel_logout_session_required: backchannelLogoutSessionRequired ?? void 0,
-		token_endpoint_auth_method: tokenEndpointAuthMethod ?? void 0,
-		grant_types: grantTypes ?? void 0,
-		response_types: responseTypes ?? void 0,
-		application_type: applicationType ?? void 0,
-		disabled: disabled ?? void 0,
-		skip_consent: skipConsent ?? void 0,
-		enable_end_session: enableEndSession ?? void 0,
-		require_pkce: requirePKCE ?? void 0,
-		dpop_bound_access_tokens: dpopBoundAccessTokens ?? void 0,
-		subject_type: subjectType ?? void 0,
-		reference_id: referenceId ?? void 0
-	};
-}
-//#endregion
-export { isAudienceClaimAllowed as _, registerEndpoint as a, resolveResourcePolicy as b, isForbiddenCimdClientMetadataField as c, validateClientCredentialsScopes as d, JWS_ALGORITHMS as f, invalidateResourceCache as g, getResourceCustomClaims as h, registerClientMetadataDocument as i, isUserDelegatedScope as l, extractRepeatedResourceFromForm as m, createOAuthClientEndpoint as n, schemaToOAuth as o, assertIdentifierValid as p, oauthToSchema as r, assertClientPrivileges as s, checkOAuthClient as t, normalizeClientCredentialsScopes as u, isClientLinkedToAnyResource as v, seedResources as x, logEnforcePerClientResourcesResolution as y };