@better-auth/oauth-provider 1.7.6 → 1.7.8

package/dist/{introspect-CbYi2MJT.mjs → introspect-H3uoUiuS.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as collectExtensionAccessTokenClaims, C as storeToken, E as validateClientCredentials, F as getExtensionGrantHandler, L as getSupportedGrantTypes, M as collectExtensionUserInfoClaims, R as hasUserInfoClaimExtension, T as toResourceList, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, h as parseClientMetadata, i as extractClientCredentials, j as collectExtensionIdTokenClaims, l as isPKCERequired, n as decryptStoredClientSecret, o as getJwtPlugin, p as normalizeTimestampValue, r as destructureCredentials, t as clientAllowsGrant, w as toAudienceClaim, y as resolveSessionAuthTime } from "./utils-CoqjzHuU.mjs";
+import { A as collectExtensionAccessTokenClaims, C as storeToken, E as validateClientCredentials, F as getExtensionGrantHandler, L as getSupportedGrantTypes, M as collectExtensionUserInfoClaims, R as hasUserInfoClaimExtension, T as toResourceList, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, h as parseClientMetadata, i as extractClientCredentials, j as collectExtensionIdTokenClaims, l as isPKCERequired, n as decryptStoredClientSecret, o as getJwtPlugin, p as normalizeTimestampValue, r as destructureCredentials, t as clientAllowsGrant, w as toAudienceClaim, y as resolveSessionAuthTime } from "./utils-CGIZS-Da.mjs";
 import { APIError } from "better-auth/api";
 import { generateRandomString, symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { APIError as APIError$1 } from "better-call";
@@ -7,8 +7,8 @@ import { logger } from "@better-auth/core/env";
 import * as z from "zod";
 import { createDpopReplayStore, enforceDpopBinding, generateCodeChallenge, getConfirmationJkt, getDpopJktFromPayload, getJwks, isDpopBindingError, isDpopProofError, parseAccessTokenAuthorization, stripAccessTokenAuthorizationScheme, verifyDpopProof } from "better-auth/oauth2";
 import { SignJWT, base64url, createLocalJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
-import { resolveSigningKey, signJWT, toExpJWT } from "better-auth/plugins";
 import { SafeUrlSchema } from "@better-auth/core/utils/redirect-uri";
+import { resolveSigningKey, signJWT, toExpJWT } from "better-auth/plugins";
 //#region src/authentication-context.ts
 const RESERVED_ID_TOKEN_CLAIMS = new Set([
 	"iss",
@@ -265,6 +265,187 @@ async function resolveAccessTokenClaims(input) {
 	});
 }
 //#endregion
+//#region src/types/zod.ts
+const DANGEROUS_SCHEMES = [
+	"javascript:",
+	"data:",
+	"vbscript:"
+];
+/**
+* Validates an RFC 8707 resource indicator. The value must be an absolute URI
+* with no fragment (RFC 8707 §2). Unlike a redirect URI it is not restricted to
+* HTTPS, because a resource server identifier may use any absolute URI scheme;
+* configured OAuth resources are the authoritative control over
+* which resources a token may target.
+*/
+const ResourceUriSchema = z.string().superRefine((val, ctx) => {
+	if (!URL.canParse(val)) {
+		ctx.addIssue({
+			code: "custom",
+			message: "resource must be an absolute URI",
+			fatal: true
+		});
+		return z.NEVER;
+	}
+	if (val.includes("#")) {
+		ctx.addIssue({
+			code: "custom",
+			message: "resource must not contain a fragment"
+		});
+		return;
+	}
+	if (DANGEROUS_SCHEMES.includes(new URL(val).protocol)) ctx.addIssue({
+		code: "custom",
+		message: "resource cannot use javascript:, data:, or vbscript: scheme"
+	});
+});
+const authorizationPromptTokenSchema = z.enum([
+	"none",
+	"consent",
+	"login",
+	"create",
+	"select_account"
+]);
+const authorizationPromptSchema = z.string().superRefine((value, ctx) => {
+	const promptTokens = value.split(" ").map((token) => token.trim()).filter(Boolean);
+	const promptSet = /* @__PURE__ */ new Set();
+	if (!promptTokens.length) {
+		ctx.addIssue({
+			code: "custom",
+			message: "prompt must include at least one value"
+		});
+		return;
+	}
+	for (const token of promptTokens) {
+		const result = authorizationPromptTokenSchema.safeParse(token);
+		if (!result.success) {
+			ctx.addIssue({
+				code: "custom",
+				message: `unsupported prompt value: ${token}`
+			});
+			continue;
+		}
+		promptSet.add(result.data);
+	}
+	if (promptSet.has("none") && promptSet.size > 1) ctx.addIssue({
+		code: "custom",
+		message: "prompt=none cannot be combined with other prompt values"
+	});
+});
+/** Canonical RFC 7517 JWK Set metadata for an OAuth client. */
+const clientJwksSchema = z.object({ keys: z.array(z.record(z.string(), z.unknown())).min(1) });
+const maxAgeSchema = z.union([z.number(), z.string().trim().min(1)]).transform((value, ctx) => {
+	const maxAge = typeof value === "number" ? value : Number(value);
+	if (!Number.isInteger(maxAge) || maxAge < 0) {
+		ctx.addIssue({
+			code: "custom",
+			message: "max_age must be a non-negative integer"
+		});
+		return z.NEVER;
+	}
+	return maxAge;
+});
+const dpopJktSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/, "dpop_jkt must be a base64url-encoded SHA-256 JWK thumbprint");
+/**
+* Runtime schema for OAuthAuthorizationQuery.
+* Uses passthrough to tolerate fields added by future extensions (PAR, FPA, etc.)
+*/
+const authorizationQuerySchema = z.object({
+	response_type: z.string().pipe(z.enum(["code"])).optional(),
+	request: z.string().optional(),
+	request_uri: z.string().optional(),
+	redirect_uri: SafeUrlSchema.optional(),
+	scope: z.string().optional(),
+	state: z.string().optional(),
+	client_id: z.string().min(1, "client_id is required"),
+	prompt: authorizationPromptSchema.optional(),
+	display: z.string().optional(),
+	ui_locales: z.string().optional(),
+	max_age: maxAgeSchema.optional(),
+	acr_values: z.string().optional(),
+	login_hint: z.string().optional(),
+	id_token_hint: z.string().optional(),
+	code_challenge: z.string().optional(),
+	code_challenge_method: z.string().pipe(z.enum(["S256"])).optional(),
+	nonce: z.string().optional(),
+	claims: claimsRequestInputSchema.optional(),
+	dpop_jkt: dpopJktSchema.optional(),
+	resource: z.union([ResourceUriSchema, z.array(ResourceUriSchema).min(1)]).optional()
+}).passthrough();
+const storedAuthorizationQuerySchema = authorizationQuerySchema.extend({
+	redirect_uri: SafeUrlSchema.optional(),
+	claims: claimsRequestParameterSchema.optional()
+});
+/**
+* Runtime schema for the authorization code verification value.
+* Validates structure on deserialization from the JSON blob stored in the DB.
+* Uses passthrough so future fields (e.g. from authorization challenge) don't break parsing.
+*/
+const verificationValueSchema = z.object({
+	type: z.literal("authorization_code"),
+	query: storedAuthorizationQuerySchema,
+	sessionId: z.string(),
+	userId: z.string(),
+	referenceId: z.string().optional(),
+	authTime: z.number().optional(),
+	resource: z.array(z.string()).optional()
+}).passthrough();
+/**
+* Request body accepted at `POST /oauth2/register` (RFC 7591 §2 client
+* metadata). This is the single source of truth for the registration contract:
+* the endpoint validates against it and {@link ClientRegistrationRequest} is
+* inferred from it, so the type a `validateInitialAccessToken` callback receives
+* always matches what is actually validated. `grant_types` and
+* `token_endpoint_auth_method` are open strings because extensions can register
+* custom values. Server-assigned fields (`client_id`, `client_secret`, the
+* issued/expiry timestamps) and internal state (`disabled`, `reference_id`) are
+* never part of a registration request.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc7591#section-2
+*/
+const clientRegistrationRequestSchema = z.object({
+	redirect_uris: z.array(SafeUrlSchema).min(1).optional(),
+	scope: z.string().optional(),
+	client_name: z.string().refine((value) => value.trim().length > 0, "client_name cannot be empty").optional(),
+	client_uri: z.string().optional(),
+	logo_uri: z.string().optional(),
+	contacts: z.array(z.string().min(1)).min(1).optional(),
+	tos_uri: z.string().optional(),
+	policy_uri: z.string().optional(),
+	software_id: z.string().optional(),
+	software_version: z.string().optional(),
+	software_statement: z.string().optional(),
+	post_logout_redirect_uris: z.array(SafeUrlSchema).min(1).optional(),
+	backchannel_logout_uri: SafeUrlSchema.optional(),
+	backchannel_logout_session_required: z.boolean().optional(),
+	token_endpoint_auth_method: z.string().trim().min(1).optional(),
+	jwks: clientJwksSchema.optional(),
+	jwks_uri: z.string().optional(),
+	grant_types: z.array(z.string().trim().min(1)).min(1).optional(),
+	response_types: z.array(z.enum(["code"])).optional(),
+	application_type: z.enum(["web", "native"]).optional(),
+	subject_type: z.enum(["public", "pairwise"]).optional(),
+	dpop_bound_access_tokens: z.boolean().optional(),
+	resources: z.array(ResourceUriSchema).optional(),
+	skip_consent: z.never({ error: "skip_consent cannot be set during dynamic client registration" }).optional()
+});
+/**
+* Complete OAuth client metadata document schema shared by registration and
+* verified client-discovery integrations.
+*
+* Unlike {@link clientRegistrationRequestSchema}, a metadata document carries
+* its own identifier and may contain the server-assigned secret fields that a
+* discovery profile must explicitly prohibit. Keeping those fields in the
+* parsed shape lets profile validation distinguish a forbidden value from an
+* unknown extension without unsafe casts or ad-hoc allowlists.
+*/
+const oauthClientMetadataSchema = clientRegistrationRequestSchema.omit({ skip_consent: true }).extend({
+	client_id: z.string().refine((value) => value.trim().length > 0, "client_id cannot be empty"),
+	client_secret: z.string().optional(),
+	client_secret_expires_at: z.number().int().nonnegative().optional(),
+	client_id_issued_at: z.number().int().nonnegative().optional()
+}).loose();
+//#endregion
 //#region src/resources.ts
 /**
 * Source-of-truth list of asymmetric JWS algorithms supported by the JWT
@@ -317,18 +498,10 @@ async function checkIdentifier(opts, identifier) {
 		};
 		return { ok: true };
 	}
-	let url;
-	try {
-		url = new URL(identifier);
-	} catch {
-		return {
-			ok: false,
-			reason: `resource identifier ${identifier} must be an absolute URI (RFC 8707 §2)`
-		};
-	}
-	if (url.hash) return {
+	const parsed = ResourceUriSchema.safeParse(identifier);
+	if (!parsed.success) return {
 		ok: false,
-		reason: `resource identifier ${identifier} must not contain a URI fragment (RFC 8707 §2)`
+		reason: `resource identifier ${identifier} is invalid: ${parsed.error.issues[0]?.message ?? "not an absolute URI"}`
 	};
 	return { ok: true };
 }
@@ -654,10 +827,10 @@ function invalidateResourceCache(identifier) {
 * Looks up an {@link OAuthResource} by `identifier`, consulting the in-process
 * cache when the identifier is in {@link OAuthOptions.cachedResources}.
 *
-* Triggers the lazy seed via {@link seedResourcesOnce} on first call — this
-* is the safety net for deployments where migrations run after plugin init
-* (so seeding at init couldn't see the table yet). The seed is idempotent
-* and coalesced, so the cost is paid only once per process.
+* Triggers the lazy seed via {@link seedResourcesOnce} on first call — the
+* retry path when the startup seed failed (database unreachable, or
+* migrations run after plugin init). The seed is idempotent and coalesced,
+* so the cost is paid only once per process.
 *
 * Returns a defensive copy so callers can't mutate cached state.
 *
@@ -748,29 +921,56 @@ function buildSeedUpdate(input, mode, now) {
 }
 /**
 * Pattern matched against adapter errors to detect the "table not yet
-* created" case — i.e. migrations haven't been run. When matched, the
-* caller treats the seed as deferred (will retry on first resource access).
+* created" case — i.e. migrations or `auth generate` haven't run. Only
+* used to keep the expected startup seed failure quiet.
 *
 * Covers SQLite ("no such table"), Postgres ("relation X does not exist"),
-* and MySQL ("Table X does not exist" / contracted form).
+* MySQL ("Table X does not exist" / contracted form), and the Drizzle and
+* Prisma adapters' missing-model errors.
+*/
+const MISSING_TABLE_PATTERN = /no such table|relation.*does not exist|table.*does(?: not|n'?t) exist|model.*(?:does not exist|was not found in the schema)/i;
+/**
+* Logs a failed startup seed. Missing tables are expected before migrations
+* and stay quiet; anything else is an error worth seeing.
+*
+* @internal
 */
-const MISSING_TABLE_PATTERN = /no such table|relation.*does not exist|table.*does(?: not|n[''']?t) exist/i;
+function logStartupSeedFailure(ctx, error) {
+	let missingTable = false;
+	let current = error;
+	for (let depth = 0; current && !missingTable && depth < 5; depth++) {
+		missingTable = MISSING_TABLE_PATTERN.test(current instanceof Error ? current.message : String(current));
+		current = current instanceof Error ? current.cause : void 0;
+	}
+	if (missingTable) {
+		ctx.logger.debug("oauth-provider: oauthResource table not yet created; deferring resource seed to first access.");
+		return;
+	}
+	ctx.logger.error("oauth-provider: could not seed `resources` at startup; retrying on first resource access.", error);
+}
 /**
-* Per-adapter state for the lazy-seed path. A module-level boolean would let
-* one Better Auth instance suppress seeding for every later instance in the same
-* process. Endpoint `AuthContext` objects are not guaranteed to be stable across
-* requests, so keying by the adapter keeps one seed state per backing store.
+* Lazy-seed state per adapter and plugin options. A module-level boolean would
+* let one Better Auth instance suppress seeding for every later instance in the
+* same process. Endpoint `AuthContext` objects are not guaranteed to be stable
+* across requests, so the adapter identifies the backing store, and the options
+* object separates instances that share an adapter but configure different
+* `resources`.
 */
 let seedStates = /* @__PURE__ */ new WeakMap();
-function getSeedState(ctx) {
-	const key = ctx.adapter;
-	const existing = seedStates.get(key);
+function getSeedState(ctx, opts) {
+	const adapterKey = ctx.adapter;
+	let byOptions = seedStates.get(adapterKey);
+	if (!byOptions) {
+		byOptions = /* @__PURE__ */ new WeakMap();
+		seedStates.set(adapterKey, byOptions);
+	}
+	const existing = byOptions.get(opts);
 	if (existing) return existing;
 	const created = {
 		completed: false,
 		promise: null
 	};
-	seedStates.set(key, created);
+	byOptions.set(opts, created);
 	return created;
 }
 /**
@@ -790,13 +990,11 @@ function getSeedState(ctx) {
 *
 * Race-safety: the `identifier` column carries a UNIQUE constraint, so two
 * processes booting simultaneously can each attempt the insert — one wins,
-* the other catches the constraint error and treats it as a no-op.
+* the other re-reads the row and treats the failed insert as a no-op.
 *
-* Migration ordering: at plugin `init` time, tables may not exist yet
-* (Better Auth's test harness, and many deployment setups, run migrations
-* after auth construction). Seeding tolerates "no such table" errors and
-* defers — the lazy {@link seedResourcesOnce} path picks up the work on
-* the first resource access.
+* Throws on storage errors, including a missing table. Callers go through
+* {@link seedResourcesOnce}, which resets so the next resource access
+* retries (e.g. after migrations run).
 *
 * Idempotent: safe to call multiple times.
 *
@@ -819,69 +1017,45 @@ async function seedResources(ctx, opts) {
 			const { signingAlgorithm: _, ...rest } = input;
 			input = rest;
 		}
-		let existing;
-		try {
-			existing = await ctx.adapter.findOne({
+		const where = [{
+			field: "identifier",
+			value: input.identifier
+		}];
+		const existing = await ctx.adapter.findOne({
+			model: modelName,
+			where
+		});
+		const now = /* @__PURE__ */ new Date();
+		if (!existing) try {
+			await ctx.adapter.create({
 				model: modelName,
-				where: [{
-					field: "identifier",
-					value: input.identifier
-				}]
+				data: buildSeedRow(input, now)
 			});
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			if (MISSING_TABLE_PATTERN.test(message)) {
-				logger.debug("oauth-provider: oauthResource table not yet created; deferring resource seed to first access.");
-				return;
-			}
-			throw err;
-		}
-		const now = /* @__PURE__ */ new Date();
-		if (!existing) {
-			try {
-				await ctx.adapter.create({
-					model: modelName,
-					data: buildSeedRow(input, now)
-				});
-			} catch (err) {
-				const message = err instanceof Error ? err.message : String(err);
-				if (/unique|duplicate|UNIQUE/i.test(message)) {
-					logger.debug(`oauth-provider: resource ${input.identifier} already inserted by a concurrent process — skipping.`);
-					continue;
-				}
-				if (MISSING_TABLE_PATTERN.test(message)) {
-					logger.debug("oauth-provider: oauthResource table not yet created; deferring resource seed to first access.");
-					return;
-				}
-				throw err;
-			}
 			continue;
+		} catch (err) {
+			if (!await ctx.adapter.findOne({
+				model: modelName,
+				where
+			}).catch(() => null)) throw err;
 		}
 		if (mode === "insertOnly") continue;
 		await ctx.adapter.update({
 			model: modelName,
-			where: [{
-				field: "identifier",
-				value: input.identifier
-			}],
+			where,
 			update: buildSeedUpdate(input, mode, now)
 		});
 	}
 }
 /**
-* Idempotent, coalesced wrapper around {@link seedResources} for the
-* lazy-seed path. Safe to call from every resource lookup — the first call
-* runs the seed, concurrent calls await the same promise, and subsequent
-* calls become no-ops.
-*
-* The endpoint context shape (`{ context: AuthContext }`) is what
-* `getResource` receives, so this is a convenience overload that unwraps
-* for callers.
+* Idempotent, coalesced wrapper around {@link seedResources}, called from
+* plugin `init` and from every resource lookup. The first call runs the
+* seed, concurrent calls await the same promise, and calls after a success
+* are no-ops. A failure resets the state so the next call retries.
 *
 * @internal
 */
 async function seedResourcesOnce(ctx, opts) {
-	const state = getSeedState(ctx);
+	const state = getSeedState(ctx, opts);
 	if (state.completed === true) return;
 	if (state.promise !== null) return state.promise;
 	state.promise = seedResources(ctx, opts).then(() => {
@@ -944,187 +1118,6 @@ function validateClientCredentialsScopes(scopes, grantTypes, tokenEndpointAuthMe
 	});
 }
 //#endregion
-//#region src/types/zod.ts
-const DANGEROUS_SCHEMES = [
-	"javascript:",
-	"data:",
-	"vbscript:"
-];
-/**
-* Validates an RFC 8707 resource indicator. The value must be an absolute URI
-* with no fragment (RFC 8707 §2). Unlike a redirect URI it is not restricted to
-* HTTPS, because a resource server identifier may use any absolute URI scheme;
-* configured OAuth resources are the authoritative control over
-* which resources a token may target.
-*/
-const ResourceUriSchema = z.string().superRefine((val, ctx) => {
-	if (!URL.canParse(val)) {
-		ctx.addIssue({
-			code: "custom",
-			message: "resource must be an absolute URI",
-			fatal: true
-		});
-		return z.NEVER;
-	}
-	if (val.includes("#")) {
-		ctx.addIssue({
-			code: "custom",
-			message: "resource must not contain a fragment"
-		});
-		return;
-	}
-	if (DANGEROUS_SCHEMES.includes(new URL(val).protocol)) ctx.addIssue({
-		code: "custom",
-		message: "resource cannot use javascript:, data:, or vbscript: scheme"
-	});
-});
-const authorizationPromptTokenSchema = z.enum([
-	"none",
-	"consent",
-	"login",
-	"create",
-	"select_account"
-]);
-const authorizationPromptSchema = z.string().superRefine((value, ctx) => {
-	const promptTokens = value.split(" ").map((token) => token.trim()).filter(Boolean);
-	const promptSet = /* @__PURE__ */ new Set();
-	if (!promptTokens.length) {
-		ctx.addIssue({
-			code: "custom",
-			message: "prompt must include at least one value"
-		});
-		return;
-	}
-	for (const token of promptTokens) {
-		const result = authorizationPromptTokenSchema.safeParse(token);
-		if (!result.success) {
-			ctx.addIssue({
-				code: "custom",
-				message: `unsupported prompt value: ${token}`
-			});
-			continue;
-		}
-		promptSet.add(result.data);
-	}
-	if (promptSet.has("none") && promptSet.size > 1) ctx.addIssue({
-		code: "custom",
-		message: "prompt=none cannot be combined with other prompt values"
-	});
-});
-/** Canonical RFC 7517 JWK Set metadata for an OAuth client. */
-const clientJwksSchema = z.object({ keys: z.array(z.record(z.string(), z.unknown())).min(1) });
-const maxAgeSchema = z.union([z.number(), z.string().trim().min(1)]).transform((value, ctx) => {
-	const maxAge = typeof value === "number" ? value : Number(value);
-	if (!Number.isInteger(maxAge) || maxAge < 0) {
-		ctx.addIssue({
-			code: "custom",
-			message: "max_age must be a non-negative integer"
-		});
-		return z.NEVER;
-	}
-	return maxAge;
-});
-const dpopJktSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/, "dpop_jkt must be a base64url-encoded SHA-256 JWK thumbprint");
-/**
-* Runtime schema for OAuthAuthorizationQuery.
-* Uses passthrough to tolerate fields added by future extensions (PAR, FPA, etc.)
-*/
-const authorizationQuerySchema = z.object({
-	response_type: z.string().pipe(z.enum(["code"])).optional(),
-	request: z.string().optional(),
-	request_uri: z.string().optional(),
-	redirect_uri: SafeUrlSchema.optional(),
-	scope: z.string().optional(),
-	state: z.string().optional(),
-	client_id: z.string().min(1, "client_id is required"),
-	prompt: authorizationPromptSchema.optional(),
-	display: z.string().optional(),
-	ui_locales: z.string().optional(),
-	max_age: maxAgeSchema.optional(),
-	acr_values: z.string().optional(),
-	login_hint: z.string().optional(),
-	id_token_hint: z.string().optional(),
-	code_challenge: z.string().optional(),
-	code_challenge_method: z.string().pipe(z.enum(["S256"])).optional(),
-	nonce: z.string().optional(),
-	claims: claimsRequestInputSchema.optional(),
-	dpop_jkt: dpopJktSchema.optional(),
-	resource: z.union([ResourceUriSchema, z.array(ResourceUriSchema).min(1)]).optional()
-}).passthrough();
-const storedAuthorizationQuerySchema = authorizationQuerySchema.extend({
-	redirect_uri: SafeUrlSchema.optional(),
-	claims: claimsRequestParameterSchema.optional()
-});
-/**
-* Runtime schema for the authorization code verification value.
-* Validates structure on deserialization from the JSON blob stored in the DB.
-* Uses passthrough so future fields (e.g. from authorization challenge) don't break parsing.
-*/
-const verificationValueSchema = z.object({
-	type: z.literal("authorization_code"),
-	query: storedAuthorizationQuerySchema,
-	sessionId: z.string(),
-	userId: z.string(),
-	referenceId: z.string().optional(),
-	authTime: z.number().optional(),
-	resource: z.array(z.string()).optional()
-}).passthrough();
-/**
-* Request body accepted at `POST /oauth2/register` (RFC 7591 §2 client
-* metadata). This is the single source of truth for the registration contract:
-* the endpoint validates against it and {@link ClientRegistrationRequest} is
-* inferred from it, so the type a `validateInitialAccessToken` callback receives
-* always matches what is actually validated. `grant_types` and
-* `token_endpoint_auth_method` are open strings because extensions can register
-* custom values. Server-assigned fields (`client_id`, `client_secret`, the
-* issued/expiry timestamps) and internal state (`disabled`, `reference_id`) are
-* never part of a registration request.
-*
-* @see https://datatracker.ietf.org/doc/html/rfc7591#section-2
-*/
-const clientRegistrationRequestSchema = z.object({
-	redirect_uris: z.array(SafeUrlSchema).min(1).optional(),
-	scope: z.string().optional(),
-	client_name: z.string().refine((value) => value.trim().length > 0, "client_name cannot be empty").optional(),
-	client_uri: z.string().optional(),
-	logo_uri: z.string().optional(),
-	contacts: z.array(z.string().min(1)).min(1).optional(),
-	tos_uri: z.string().optional(),
-	policy_uri: z.string().optional(),
-	software_id: z.string().optional(),
-	software_version: z.string().optional(),
-	software_statement: z.string().optional(),
-	post_logout_redirect_uris: z.array(SafeUrlSchema).min(1).optional(),
-	backchannel_logout_uri: SafeUrlSchema.optional(),
-	backchannel_logout_session_required: z.boolean().optional(),
-	token_endpoint_auth_method: z.string().trim().min(1).optional(),
-	jwks: clientJwksSchema.optional(),
-	jwks_uri: z.string().optional(),
-	grant_types: z.array(z.string().trim().min(1)).min(1).optional(),
-	response_types: z.array(z.enum(["code"])).optional(),
-	application_type: z.enum(["web", "native"]).optional(),
-	subject_type: z.enum(["public", "pairwise"]).optional(),
-	dpop_bound_access_tokens: z.boolean().optional(),
-	resources: z.array(ResourceUriSchema).optional(),
-	skip_consent: z.never({ error: "skip_consent cannot be set during dynamic client registration" }).optional()
-});
-/**
-* Complete OAuth client metadata document schema shared by registration and
-* verified client-discovery integrations.
-*
-* Unlike {@link clientRegistrationRequestSchema}, a metadata document carries
-* its own identifier and may contain the server-assigned secret fields that a
-* discovery profile must explicitly prohibit. Keeping those fields in the
-* parsed shape lets profile validation distinguish a forbidden value from an
-* unknown extension without unsafe casts or ad-hoc allowlists.
-*/
-const oauthClientMetadataSchema = clientRegistrationRequestSchema.omit({ skip_consent: true }).extend({
-	client_id: z.string().refine((value) => value.trim().length > 0, "client_id cannot be empty"),
-	client_secret: z.string().optional(),
-	client_secret_expires_at: z.number().int().nonnegative().optional(),
-	client_id_issued_at: z.number().int().nonnegative().optional()
-}).loose();
-//#endregion
 //#region src/userinfo.ts
 /**
 * Builds the standard OIDC claims (OIDC Core §5.1) for the UserInfo response.
@@ -2548,4 +2541,4 @@ async function introspectEndpoint(ctx, opts) {
 	}
 }
 //#endregion
-export { filterClaimsRequestUserInfoClaims as A, resolveResourcePolicy as C, getSupportedClaims as D, STANDARD_CLAIM_NAMES as E, isValidOidcClaimsRequest as M, canSatisfyEssentialAcrRequest as O, logEnforcePerClientResourcesResolution as S, STANDARD_CLAIMS as T, assertIdentifierValid as _, invalidateRefreshFamily as a, invalidateResourceCache as b, ResourceUriSchema as c, clientJwksSchema as d, clientRegistrationRequestSchema as f, JWS_ALGORITHMS as g, validateClientCredentialsScopes as h, getOAuthProviderApi as i, getRequestedUserInfoClaims as j, claimsRequestParameterSchema as k, SafeUrlSchema as l, normalizeClientCredentialsScopes as m, introspect_exports as n, tokenEndpoint as o, oauthClientMetadataSchema as p, decodeRefreshToken as r, userInfoEndpoint as s, introspectEndpoint as t, authorizationQuerySchema as u, extractRepeatedResourceFromForm as v, seedResources as w, isAudienceClaimAllowed as x, getResource as y };
+export { claimsRequestParameterSchema as A, clientJwksSchema as C, STANDARD_CLAIM_NAMES as D, STANDARD_CLAIMS as E, getRequestedUserInfoClaims as M, isValidOidcClaimsRequest as N, getSupportedClaims as O, authorizationQuerySchema as S, oauthClientMetadataSchema as T, logStartupSeedFailure as _, invalidateRefreshFamily as a, ResourceUriSchema as b, normalizeClientCredentialsScopes as c, assertIdentifierValid as d, extractRepeatedResourceFromForm as f, logEnforcePerClientResourcesResolution as g, isAudienceClaimAllowed as h, getOAuthProviderApi as i, filterClaimsRequestUserInfoClaims as j, canSatisfyEssentialAcrRequest as k, validateClientCredentialsScopes as l, invalidateResourceCache as m, introspect_exports as n, tokenEndpoint as o, getResource as p, decodeRefreshToken as r, userInfoEndpoint as s, introspectEndpoint as t, JWS_ALGORITHMS as u, resolveResourcePolicy as v, clientRegistrationRequestSchema as w, SafeUrlSchema as x, seedResourcesOnce as y };