@better-auth/oauth-provider 1.7.10 → 1.8.0-beta.1

package/dist/client-resource.d.mts

@@ -1,6 +1,6 @@
-import { c as ResourceServerMetadata } from "./oauth-DXiqbRzK.mjs";
-import { JWTPayload, JWTVerifyOptions } from "jose";
+import { c as ResourceServerMetadata } from "./oauth-CzT1PvAY.mjs";
 import { ResourceRequestInput, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
+import { JWTPayload, JWTVerifyOptions } from "jose";
 import { BetterAuthOptions } from "better-auth/types";
 
 //#region src/client-resource.d.ts

package/dist/client-resource.mjs

@@ -1,5 +1,5 @@
-import { l as getJwtPlugin, u as getOAuthProviderPlugin } from "./utils-DfMNRh3J.mjs";
-import { t as PACKAGE_VERSION } from "./version-aKfgWHzo.mjs";
+import { f as getJwtPlugin, p as getOAuthProviderPlugin } from "./utils-D-CUrvd1.mjs";
+import { t as PACKAGE_VERSION } from "./version-BwHks7Wg.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-call";
 import { BetterAuthError } from "@better-auth/core/error";

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { p as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-Cse_eZ6i.mjs";
+import { g as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-DfH-ghKj.mjs";
 import * as _$_better_fetch_fetch0 from "@better-fetch/fetch";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,5 +1,5 @@
 import { t as buildSignedOAuthQuery } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-aKfgWHzo.mjs";
+import { t as PACKAGE_VERSION } from "./version-BwHks7Wg.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { deviceAuthorizationClient } from "better-auth/client/plugins";
 //#region src/client.ts

package/dist/index-DVydGHlT.d.mts

@@ -0,0 +1,275 @@
+import { J as Scope, K as Prompt, L as OAuthOptions, R as OAuthProviderApi, a as GrantType, l as TokenEndpointAuthMethod, n as AuthServerMetadata, q as SchemaClient, rt as Awaitable, z as OAuthProviderExtension } from "./oauth-CzT1PvAY.mjs";
+import { APIError } from "better-call";
+import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
+import { JWTPayload } from "jose";
+import { User } from "better-auth/types";
+import { AuthContext, GenericEndpointContext } from "@better-auth/core";
+import * as _$better_auth0 from "better-auth";
+//#region src/extensions.d.ts
+/**
+ * Registers an {@link OAuthProviderExtension} with the OAuth Provider plugin
+ * from a companion plugin's `init()` hook. An extension can add token grants,
+ * assertion-based client authentication methods, additive discovery metadata,
+ * access-token / ID-token / UserInfo claims, and client-id discovery, without
+ * forking provider core.
+ *
+ * Call this once, at `init()` time. It is idempotent in the same `extension`
+ * object, so re-running a plugin's `init()` (for example when one plugin factory
+ * result is shared across two `betterAuth()` instances) does not register it
+ * twice. It throws if the oauth-provider plugin is not installed, if a grant
+ * type or assertion type is not an absolute URI, if a client authentication
+ * method reuses a built-in name, or if the extension registers a grant type,
+ * auth method, assertion type, or client discovery identifier that another
+ * extension already registered (contributions must be disjoint).
+ *
+ * @example
+ * ```ts
+ * init(ctx) {
+ *   extendOAuthProvider(ctx, {
+ *     grants: { "urn:example:grant": async ({ provider }) => provider.issueTokens(...) },
+ *   });
+ * }
+ * ```
+ */
+declare function extendOAuthProvider(ctx: AuthContext, extension: OAuthProviderExtension): void;
+/** Registration fields that extensions define, stored in the client's `metadata`. */
+declare function getExtensionClientMetadataFields(opts: OAuthOptions<Scope[]>): Set<string>;
+//#endregion
+//#region src/metadata.d.ts
+declare function authServerMetadata(ctx: GenericEndpointContext, opts?: JwtOptions, overrides?: {
+  scopes_supported?: AuthServerMetadata["scopes_supported"];
+  dynamic_client_registration_supported?: boolean;
+  public_client_supported?: boolean;
+  grant_types_supported?: GrantType[];
+  token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[];
+  endpoint_auth_methods_supported?: TokenEndpointAuthMethod[];
+  jwt_disabled?: boolean;
+  dpop_signing_alg_values_supported?: JWSAlgorithms[];
+}): AuthServerMetadata;
+declare function oauthAuthorizationServerMetadata(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>): AuthServerMetadata;
+declare function oidcServerMetadata(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]> & {
+  claims?: string[];
+}): {
+  jwks_uri?: string | undefined;
+  userinfo_endpoint: string;
+  acr_values_supported?: string[] | undefined;
+  subject_types_supported: ("public" | "pairwise")[];
+  claims_supported: string[];
+  claims_parameter_supported?: boolean | undefined;
+  end_session_endpoint: string;
+  request_parameter_supported?: boolean | undefined;
+  request_uri_parameter_supported?: boolean | undefined;
+  prompt_values_supported: Prompt[];
+  issuer: string;
+  authorization_endpoint: string;
+  token_endpoint: string;
+  registration_endpoint?: string | undefined;
+  scopes_supported?: string[] | undefined;
+  response_types_supported: "code"[];
+  response_modes_supported: "query"[];
+  grant_types_supported: GrantType[];
+  token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
+  token_endpoint_auth_signing_alg_values_supported?: _$better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
+  service_documentation?: string | undefined;
+  ui_locales_supported?: string[] | undefined;
+  op_policy_uri?: string | undefined;
+  op_tos_uri?: string | undefined;
+  revocation_endpoint?: string | undefined;
+  revocation_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
+  revocation_endpoint_auth_signing_alg_values_supported?: _$better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
+  introspection_endpoint?: string | undefined;
+  introspection_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
+  introspection_endpoint_auth_signing_alg_values_supported?: _$better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
+  code_challenge_methods_supported: "S256"[];
+  authorization_response_iss_parameter_supported?: boolean | undefined;
+  client_id_metadata_document_supported?: boolean | undefined;
+  backchannel_logout_supported?: boolean | undefined;
+  backchannel_logout_session_supported?: boolean | undefined;
+  dpop_signing_alg_values_supported?: JWSAlgorithms[] | undefined;
+  frontchannel_logout_supported?: boolean | undefined;
+  frontchannel_logout_session_supported?: boolean | undefined;
+  id_token_signing_alg_values_supported: JWSAlgorithms[] | ["HS256"];
+};
+declare function metadataResponse(body: unknown, extraHeaders?: HeadersInit): Response;
+/**
+ * Provides an exportable `/.well-known/oauth-authorization-server`.
+ *
+ * Useful when basePath prevents the endpoint from being located at the root
+ * and must be provided manually.
+ *
+ * @external
+ */
+declare const oauthProviderAuthServerMetadata: <Auth extends {
+  api: {
+    getOAuthServerConfig: (...args: any) => any;
+  };
+}>(auth: Auth, opts?: {
+  headers?: HeadersInit;
+}) => (request: Request) => Promise<Response>;
+/**
+ * Provides an exportable `/.well-known/openid-configuration`.
+ *
+ * Useful when basePath prevents the endpoint from being located at the root
+ * and must be provided manually.
+ *
+ * @external
+ */
+declare const oauthProviderOpenIdConfigMetadata: <Auth extends {
+  api: {
+    getOpenIdConfig: (...args: any) => any;
+  };
+}>(auth: Auth, opts?: {
+  headers?: HeadersInit;
+}) => (request: Request) => Promise<Response>;
+//#endregion
+//#region src/resource-challenge.d.ts
+/**
+ * Create an OAuth resource-server challenge for a failed access-token request.
+ *
+ * Missing/invalid bearer credentials are reported with RFC 6750 plus the RFC
+ * 9728 `resource_metadata` pointer. Insufficient-scope failures (built with
+ * `createInsufficientScopeError`) are reported with RFC 6750 §3.1's
+ * `insufficient_scope` challenge on a 403 naming the scopes the token lacks, so
+ * clients can step up their authorization. DPoP-bound-token failures are
+ * reported with RFC 9449's `DPoP` challenge so clients know which proof
+ * algorithms to use. Non-URL resources (for example a `urn:` or a client id)
+ * resolve their metadata URL through `resourceMetadataMappings`.
+ *
+ * Every other error returns `undefined`, including a plain `FORBIDDEN`: a
+ * permission denial that re-authorizing cannot fix must not be answered with a
+ * challenge that sends the user through consent for scopes they already hold.
+ *
+ * @external
+ */
+declare function createResourceServerChallenge(error: unknown, resource: string | string[], opts?: {
+  /** Maps non-URL (urn, client) resources to their resource_metadata URL. */resourceMetadataMappings?: Record<string, string>; /** DPoP JWS algorithms to advertise in RFC 9449 challenges. */
+  dpopSigningAlgorithms?: readonly string[];
+  /**
+   * Scopes to advertise in RFC 6750 bearer challenges,
+   * hinting what an unauthenticated client should request. An
+   * insufficient-scope failure advertises the scopes it names instead.
+   */
+  challengeScopes?: readonly string[];
+}): APIError | undefined;
+//#endregion
+//#region src/token.d.ts
+/**
+ * Returns the OAuth Provider's server-side capability surface bound to `ctx`.
+ * The token endpoint passes one (pre-bound to the dispatched grant) to each
+ * extension grant handler; a companion plugin's own endpoint calls this directly
+ * with its grant type. `grantType` is bound here, not per issuance, so a handler
+ * cannot mislabel the grant; omit it for capabilities that do not issue tokens
+ * (`getClient`, `validateAccessToken`, `requireActiveAccessToken`), and
+ * `issueTokens` then throws.
+ */
+declare function getOAuthProviderApi(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>, grantType?: GrantType): OAuthProviderApi;
+//#endregion
+//#region src/token-exchange.d.ts
+/** RFC 8693 §2.1 token exchange grant type. */
+declare const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
+/** RFC 8693 §3 token type identifier for an OAuth 2.0 access token. */
+declare const ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token";
+interface OAuthTokenExchangeRequest {
+  /** The authenticated client requesting the exchange. */
+  client: SchemaClient<Scope[]>;
+  /** The user the subject token represents, and the issued token's `sub`. */
+  user: User;
+  /** The validated subject token, in RFC 7662 introspection form. */
+  subjectToken: JWTPayload;
+  /** Resource identifiers the issued token is requested for. */
+  resources: string[];
+  /** Scopes the issued token is requested with. */
+  scopes: string[];
+  /**
+   * Consent reference (`postLogin.consentReferenceId`) the subject token was
+   * issued under, such as an organization. The issued token keeps it.
+   */
+  referenceId?: string;
+}
+interface OAuthTokenExchangeOptions {
+  /**
+   * Final policy check, run after every built-in check passes. Return `false`
+   * to deny the exchange with `invalid_request`, or throw an `APIError` for a
+   * different OAuth error.
+   */
+  allowExchange?: (request: OAuthTokenExchangeRequest) => Awaitable<boolean>;
+}
+/**
+ * RFC 8693 token exchange for the OAuth Provider. A confidential client
+ * registered for the token-exchange grant trades a user's access token, issued
+ * by this server to it or for a resource it serves, for an access token to
+ * another registered resource. The issued token represents the same user
+ * (impersonation), carries the requesting client as `client_id`, and expires
+ * no later than the subject token.
+ *
+ * @example
+ * ```ts
+ * const auth = betterAuth({
+ *   plugins: [jwt(), oauthProvider({ ... }), oauthTokenExchange()],
+ * });
+ * ```
+ */
+declare function oauthTokenExchange(options?: OAuthTokenExchangeOptions): {
+  id: string;
+  init(ctx: AuthContext): void;
+};
+//#endregion
+//#region src/utils/index.d.ts
+/**
+ * Normalizes OAuth resource values into a non-empty string array.
+ */
+declare function toResourceList(value: string | string[] | undefined): string[] | undefined;
+/**
+ * Verify the signature and expiration of an OAuth query issued by this provider.
+ * Use the provider's current auth secret on the server before displaying a
+ * consent page. A valid signature does not replace client or session checks.
+ */
+declare function verifyOAuthQueryParams(oauth_query: string, secret: string): Promise<boolean>;
+/**
+ * Validates requested scopes against a registered client's allowed scopes.
+ *
+ * @internal
+ */
+declare function validateClientScopes(client: Pick<SchemaClient<Scope[]>, "scopes">, scopes?: string[]): void;
+/**
+ * Parse client metadata that may be stored as JSON string or already parsed object.
+ * Handles database adapters that auto-parse JSON columns.
+ *
+ * @internal
+ */
+declare function parseClientMetadata(metadata: string | object | undefined): Record<string, unknown> | undefined;
+//#endregion
+//#region src/utils/client-assertion.d.ts
+/**
+ * Enforces the assertion-hygiene claims every client-assertion authentication
+ * method must check, independent of how the signature is verified or where the
+ * verification keys come from:
+ * - `aud` MUST include `expectedAudience` (RFC 7523 §3 rule 3),
+ * - `exp` MUST be present, unexpired, and at most `assertionMaxLifetime`
+ *   seconds away (RFC 7523 §3 rule 4),
+ * - `iat`, when present, MUST be within `assertionMaxLifetime`,
+ * - `jti` MUST be present and single-use; this consumes a replay tombstone keyed
+ *   by `` `${namespace}:${jti}` ``, inserted under the adapter's primary key so a
+ *   replay across workers fails atomically.
+ *
+ * A custom {@link OAuthClientAuthenticationStrategy} should call this after
+ * verifying the assertion signature, so an extension method inherits the same
+ * replay, lifetime, and audience guarantees as the built-in `private_key_jwt`
+ * path, which calls it too.
+ *
+ * @param params.namespace Scopes the replay tombstone to the method and client,
+ *   e.g. `` `${method}:${clientId}` ``, so the same `jti` can recur across
+ *   distinct methods or clients but never within one.
+ */
+declare function consumeClientAssertion(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>, params: {
+  namespace: string;
+  payload: {
+    aud?: unknown;
+    exp?: unknown;
+    iat?: unknown;
+    jti?: unknown;
+  };
+  expectedAudience: string;
+}): Promise<void>;
+//#endregion
+export { oauthProviderOpenIdConfigMetadata as _, verifyOAuthQueryParams as a, getExtensionClientMetadataFields as b, OAuthTokenExchangeRequest as c, getOAuthProviderApi as d, createResourceServerChallenge as f, oauthProviderAuthServerMetadata as g, oauthAuthorizationServerMetadata as h, validateClientScopes as i, TOKEN_EXCHANGE_GRANT_TYPE as l, metadataResponse as m, parseClientMetadata as n, ACCESS_TOKEN_TYPE as o, authServerMetadata as p, toResourceList as r, OAuthTokenExchangeOptions as s, consumeClientAssertion as t, oauthTokenExchange as u, oidcServerMetadata as v, extendOAuthProvider as y };

package/dist/index.d.mts

@@ -1,203 +1,4 @@
-import { A as OAuthOpaqueAccessToken, B as Prompt, C as OAuthClientAuthenticationStrategy, D as OAuthExtensionGrantHandler, E as OAuthConsent, F as OAuthResource, G as VerificationValue, H as Scope, I as OAuthResourceInput, J as ResourceUriSchema, K as ClientRegistrationRequest, L as OAuthTokenIssueParams, M as OAuthProviderApi, N as OAuthProviderExtension, O as OAuthExtensionGrantHandlerInput, P as OAuthRefreshToken, R as OAuthTokenResponse, S as OAuthClientAuthenticationResult, T as OAuthClientResource, U as StoreTokenType, V as SchemaClient, W as StoredAuthorizationQuery, Y as oauthClientMetadataSchema, _ as OAuthAuthorizationQuery, a as GrantType, b as OAuthClientAuthenticationInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, q as OAuthClientMetadata, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClaimExtensionInput, w as OAuthClientRegistrationResponse, x as OAuthClientAuthenticationRequest, y as OAuthClientAdministrativeResponse, z as OAuthUserInfoExtensionInput } from "./oauth-DXiqbRzK.mjs";
-import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, d as DEVICE_CODE_GRANT_TYPE, f as OAuthDeviceAuthorizationOptions, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, p as oauthDeviceAuthorization, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-Cse_eZ6i.mjs";
-import { APIError } from "better-call";
-import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
-import { AuthContext, GenericEndpointContext } from "@better-auth/core";
-import * as _$better_auth0 from "better-auth";
-//#region src/extensions.d.ts
-/**
- * Registers an {@link OAuthProviderExtension} with the OAuth Provider plugin
- * from a companion plugin's `init()` hook. An extension can add token grants,
- * assertion-based client authentication methods, additive discovery metadata,
- * access-token / ID-token / UserInfo claims, and client-id discovery, without
- * forking provider core.
- *
- * Call this once, at `init()` time. It is idempotent in the same `extension`
- * object, so re-running a plugin's `init()` (for example when one plugin factory
- * result is shared across two `betterAuth()` instances) does not register it
- * twice. It throws if the oauth-provider plugin is not installed, if a grant
- * type or assertion type is not an absolute URI, if a client authentication
- * method reuses a built-in name, or if the extension registers a grant type,
- * auth method, assertion type, or client discovery identifier that another
- * extension already registered (contributions must be disjoint).
- *
- * @example
- * ```ts
- * init(ctx) {
- *   extendOAuthProvider(ctx, {
- *     grants: { "urn:example:grant": async ({ provider }) => provider.issueTokens(...) },
- *   });
- * }
- * ```
- */
-declare function extendOAuthProvider(ctx: AuthContext, extension: OAuthProviderExtension): void;
-//#endregion
-//#region src/metadata.d.ts
-declare function authServerMetadata(ctx: GenericEndpointContext, opts?: JwtOptions, overrides?: {
-  scopes_supported?: AuthServerMetadata["scopes_supported"];
-  dynamic_client_registration_supported?: boolean;
-  public_client_supported?: boolean;
-  grant_types_supported?: GrantType[];
-  token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[];
-  endpoint_auth_methods_supported?: TokenEndpointAuthMethod[];
-  jwt_disabled?: boolean;
-  dpop_signing_alg_values_supported?: JWSAlgorithms[];
-}): AuthServerMetadata;
-declare function oauthAuthorizationServerMetadata(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>): AuthServerMetadata;
-declare function oidcServerMetadata(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]> & {
-  claims?: string[];
-}): {
-  jwks_uri?: string | undefined;
-  userinfo_endpoint: string;
-  acr_values_supported?: string[] | undefined;
-  subject_types_supported: ("public" | "pairwise")[];
-  claims_supported: string[];
-  claims_parameter_supported?: boolean | undefined;
-  end_session_endpoint: string;
-  request_parameter_supported?: boolean | undefined;
-  request_uri_parameter_supported?: boolean | undefined;
-  prompt_values_supported: Prompt[];
-  issuer: string;
-  authorization_endpoint: string;
-  token_endpoint: string;
-  registration_endpoint?: string | undefined;
-  scopes_supported?: string[] | undefined;
-  response_types_supported: "code"[];
-  response_modes_supported: "query"[];
-  grant_types_supported: GrantType[];
-  token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-  token_endpoint_auth_signing_alg_values_supported?: _$better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
-  service_documentation?: string | undefined;
-  ui_locales_supported?: string[] | undefined;
-  op_policy_uri?: string | undefined;
-  op_tos_uri?: string | undefined;
-  revocation_endpoint?: string | undefined;
-  revocation_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-  revocation_endpoint_auth_signing_alg_values_supported?: _$better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
-  introspection_endpoint?: string | undefined;
-  introspection_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-  introspection_endpoint_auth_signing_alg_values_supported?: _$better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
-  code_challenge_methods_supported: "S256"[];
-  authorization_response_iss_parameter_supported?: boolean | undefined;
-  client_id_metadata_document_supported?: boolean | undefined;
-  backchannel_logout_supported?: boolean | undefined;
-  backchannel_logout_session_supported?: boolean | undefined;
-  dpop_signing_alg_values_supported?: JWSAlgorithms[] | undefined;
-  id_token_signing_alg_values_supported: JWSAlgorithms[] | ["HS256"];
-};
-declare function metadataResponse(body: unknown, extraHeaders?: HeadersInit): Response;
-/**
- * Provides an exportable `/.well-known/oauth-authorization-server`.
- *
- * Useful when basePath prevents the endpoint from being located at the root
- * and must be provided manually.
- *
- * @external
- */
-declare const oauthProviderAuthServerMetadata: <Auth extends {
-  api: {
-    getOAuthServerConfig: (...args: any) => any;
-  };
-}>(auth: Auth, opts?: {
-  headers?: HeadersInit;
-}) => (request: Request) => Promise<Response>;
-/**
- * Provides an exportable `/.well-known/openid-configuration`.
- *
- * Useful when basePath prevents the endpoint from being located at the root
- * and must be provided manually.
- *
- * @external
- */
-declare const oauthProviderOpenIdConfigMetadata: <Auth extends {
-  api: {
-    getOpenIdConfig: (...args: any) => any;
-  };
-}>(auth: Auth, opts?: {
-  headers?: HeadersInit;
-}) => (request: Request) => Promise<Response>;
-//#endregion
-//#region src/resource-challenge.d.ts
-/**
- * Create an OAuth resource-server challenge for a failed access-token request.
- *
- * Missing/invalid bearer credentials are reported with RFC 6750 plus the RFC
- * 9728 `resource_metadata` pointer. Insufficient-scope failures (built with
- * `createInsufficientScopeError`) are reported with RFC 6750 §3.1's
- * `insufficient_scope` challenge on a 403 naming the scopes the token lacks, so
- * clients can step up their authorization. DPoP-bound-token failures are
- * reported with RFC 9449's `DPoP` challenge so clients know which proof
- * algorithms to use. Non-URL resources (for example a `urn:` or a client id)
- * resolve their metadata URL through `resourceMetadataMappings`.
- *
- * Every other error returns `undefined`, including a plain `FORBIDDEN`: a
- * permission denial that re-authorizing cannot fix must not be answered with a
- * challenge that sends the user through consent for scopes they already hold.
- *
- * @external
- */
-declare function createResourceServerChallenge(error: unknown, resource: string | string[], opts?: {
-  /** Maps non-URL (urn, client) resources to their resource_metadata URL. */resourceMetadataMappings?: Record<string, string>; /** DPoP JWS algorithms to advertise in RFC 9449 challenges. */
-  dpopSigningAlgorithms?: readonly string[];
-  /**
-   * Scopes to advertise in RFC 6750 bearer challenges,
-   * hinting what an unauthenticated client should request. An
-   * insufficient-scope failure advertises the scopes it names instead.
-   */
-  challengeScopes?: readonly string[];
-}): APIError | undefined;
-//#endregion
-//#region src/token.d.ts
-/**
- * Returns the OAuth Provider's server-side capability surface bound to `ctx`.
- * The token endpoint passes one (pre-bound to the dispatched grant) to each
- * extension grant handler; a companion plugin's own endpoint calls this directly
- * with its grant type. `grantType` is bound here, not per issuance, so a handler
- * cannot mislabel the grant; omit it for capabilities that do not issue tokens
- * (`getClient`, `validateAccessToken`, `requireActiveAccessToken`), and
- * `issueTokens` then throws.
- */
-declare function getOAuthProviderApi(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>, grantType?: GrantType): OAuthProviderApi;
-//#endregion
-//#region src/utils/index.d.ts
-/**
- * Verify the signature and expiration of an OAuth query issued by this provider.
- * Use the provider's current auth secret on the server before displaying a
- * consent page. A valid signature does not replace client or session checks.
- */
-declare function verifyOAuthQueryParams(oauth_query: string, secret: string): Promise<boolean>;
-//#endregion
-//#region src/utils/client-assertion.d.ts
-/**
- * Enforces the assertion-hygiene claims every client-assertion authentication
- * method must check, independent of how the signature is verified or where the
- * verification keys come from:
- * - `aud` MUST include `expectedAudience` (RFC 7523 §3 rule 3),
- * - `exp` MUST be present, unexpired, and at most `assertionMaxLifetime`
- *   seconds away (RFC 7523 §3 rule 4),
- * - `iat`, when present, MUST be within `assertionMaxLifetime`,
- * - `jti` MUST be present and single-use; this consumes a replay tombstone keyed
- *   by `` `${namespace}:${jti}` ``, inserted under the adapter's primary key so a
- *   replay across workers fails atomically.
- *
- * A custom {@link OAuthClientAuthenticationStrategy} should call this after
- * verifying the assertion signature, so an extension method inherits the same
- * replay, lifetime, and audience guarantees as the built-in `private_key_jwt`
- * path, which calls it too.
- *
- * @param params.namespace Scopes the replay tombstone to the method and client,
- *   e.g. `` `${method}:${clientId}` ``, so the same `jti` can recur across
- *   distinct methods or clients but never within one.
- */
-declare function consumeClientAssertion(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>, params: {
-  namespace: string;
-  payload: {
-    aud?: unknown;
-    exp?: unknown;
-    iat?: unknown;
-    jti?: unknown;
-  };
-  expectedAudience: string;
-}): Promise<void>;
-//#endregion
-export { ActiveAccessTokenPayload, AuthMethod, AuthServerMetadata, AuthorizePrompt, BearerMethodsSupported, ClientDiscovery, ClientMetadataResourceFetch, ClientRegistrationRequest, Confirmation, DEFAULT_OAUTH_SCOPES, DEVICE_CODE_GRANT_TYPE, GrantType, InitialAccessTokenAuthorization, OAuthAuthenticatedClient, OAuthAuthorizationQuery, OAuthClaimExtensionInput, type OAuthClient, OAuthClientAdministrativeResponse, OAuthClientAuthenticationInput, OAuthClientAuthenticationRequest, OAuthClientAuthenticationResult, OAuthClientAuthenticationStrategy, type OAuthClientMetadata, OAuthClientRegistrationResponse, OAuthClientResource, OAuthConsent, type OAuthDeviceAuthorizationOptions, type OAuthEndpointErrorResult, type OAuthEndpointRedirectContext, type OAuthErrorCode, OAuthExtensionGrantHandler, OAuthExtensionGrantHandlerInput, type OAuthFieldErrorCode, type OAuthFieldErrorCodeMap, OAuthMetadataExtensionInput, OAuthOpaqueAccessToken, OAuthOptions, OAuthProviderApi, OAuthProviderExtension, type OAuthRedirectOnError, OAuthRefreshToken, OAuthResource, OAuthResourceInput, OAuthTokenIssueParams, OAuthTokenResponse, OAuthUserInfoExtensionInput, OIDCMetadata, Prompt, type ResourceServerMetadata, ResourceUriSchema, SchemaClient, Scope, StoreTokenType, StoredAuthorizationQuery, TokenEndpointAuthMethod, TokenType, VerificationValue, authServerMetadata, consumeClientAssertion, createResourceServerChallenge, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthClientMetadataSchema, oauthDeviceAuthorization, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata, verifyOAuthQueryParams };
+import { $ as OAuthClientMetadata, A as OAuthExtensionGrantHandler, B as OAuthRefreshToken, C as OAuthClientAuthenticationRequest, D as OAuthClientRegistrationResponse, E as OAuthClientMetadataExtensionInput, F as OAuthMetadataExtensionInput, G as OAuthUserInfoExtensionInput, H as OAuthResourceInput, I as OAuthOpaqueAccessToken, J as Scope, K as Prompt, L as OAuthOptions, M as OAuthInteractionQuery, N as OAuthInteractionRequest, O as OAuthClientResource, P as OAuthInteractionRequestHandler, Q as ClientRegistrationRequest, R as OAuthProviderApi, S as OAuthClientAuthenticationInput, T as OAuthClientAuthenticationStrategy, U as OAuthTokenIssueParams, V as OAuthResource, W as OAuthTokenResponse, X as StoredAuthorizationQuery, Y as StoreTokenType, Z as VerificationValue, _ as OAuthAuthenticationContext, a as GrantType, b as OAuthClaimExtensionInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, et as ResourceUriSchema, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, it as OAuthClientRegistrationMetadata, j as OAuthExtensionGrantHandlerInput, k as OAuthConsent, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, nt as oauthClientMetadataSchema, o as OAuthClient, p as ClientDiscovery, q as SchemaClient, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthAuthenticationContextOptions, w as OAuthClientAuthenticationResult, x as OAuthClientAdministrativeResponse, y as OAuthAuthorizationQuery, z as OAuthProviderExtension } from "./oauth-CzT1PvAY.mjs";
+import { c as OAuthEndpointRedirectContext, d as OAuthFieldErrorCodeMap, f as OAuthRedirectOnError, g as oauthDeviceAuthorization, h as OAuthDeviceAuthorizationOptions, l as OAuthErrorCode, m as DEVICE_CODE_GRANT_TYPE, n as getOAuthProviderState, o as getIssuer, r as oauthProvider, s as OAuthEndpointErrorResult, t as DEFAULT_OAUTH_SCOPES, u as OAuthFieldErrorCode } from "./oauth-DfH-ghKj.mjs";
+import { _ as oauthProviderOpenIdConfigMetadata, a as verifyOAuthQueryParams, c as OAuthTokenExchangeRequest, d as getOAuthProviderApi, f as createResourceServerChallenge, g as oauthProviderAuthServerMetadata, h as oauthAuthorizationServerMetadata, l as TOKEN_EXCHANGE_GRANT_TYPE, m as metadataResponse, o as ACCESS_TOKEN_TYPE, p as authServerMetadata, s as OAuthTokenExchangeOptions, t as consumeClientAssertion, u as oauthTokenExchange, v as oidcServerMetadata, y as extendOAuthProvider } from "./index-DVydGHlT.mjs";
+export { ACCESS_TOKEN_TYPE, ActiveAccessTokenPayload, AuthMethod, AuthServerMetadata, AuthorizePrompt, BearerMethodsSupported, ClientDiscovery, ClientMetadataResourceFetch, ClientRegistrationRequest, Confirmation, DEFAULT_OAUTH_SCOPES, DEVICE_CODE_GRANT_TYPE, GrantType, InitialAccessTokenAuthorization, OAuthAuthenticatedClient, OAuthAuthenticationContext, OAuthAuthenticationContextOptions, OAuthAuthorizationQuery, OAuthClaimExtensionInput, OAuthClient, OAuthClientAdministrativeResponse, OAuthClientAuthenticationInput, OAuthClientAuthenticationRequest, OAuthClientAuthenticationResult, OAuthClientAuthenticationStrategy, OAuthClientMetadata, OAuthClientMetadataExtensionInput, OAuthClientRegistrationMetadata, OAuthClientRegistrationResponse, OAuthClientResource, OAuthConsent, OAuthDeviceAuthorizationOptions, OAuthEndpointErrorResult, OAuthEndpointRedirectContext, OAuthErrorCode, OAuthExtensionGrantHandler, OAuthExtensionGrantHandlerInput, OAuthFieldErrorCode, OAuthFieldErrorCodeMap, OAuthInteractionQuery, OAuthInteractionRequest, OAuthInteractionRequestHandler, OAuthMetadataExtensionInput, OAuthOpaqueAccessToken, OAuthOptions, OAuthProviderApi, OAuthProviderExtension, OAuthRedirectOnError, OAuthRefreshToken, OAuthResource, OAuthResourceInput, OAuthTokenExchangeOptions, OAuthTokenExchangeRequest, OAuthTokenIssueParams, OAuthTokenResponse, OAuthUserInfoExtensionInput, OIDCMetadata, Prompt, ResourceServerMetadata, ResourceUriSchema, SchemaClient, Scope, StoreTokenType, StoredAuthorizationQuery, TOKEN_EXCHANGE_GRANT_TYPE, TokenEndpointAuthMethod, TokenType, VerificationValue, authServerMetadata, consumeClientAssertion, createResourceServerChallenge, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthClientMetadataSchema, oauthDeviceAuthorization, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oauthTokenExchange, oidcServerMetadata, verifyOAuthQueryParams };