@crvouga/mockingbird-service-oauth 0.1.0

package/dist/chunk-X6FYBOEA.js

@@ -0,0 +1,3510 @@
+// ../core/dist/clock.js
+var createClock = (source = Date.now) => {
+  let offsetMs = 0;
+  let frozenAt;
+  const now = () => frozenAt ?? source() + offsetMs;
+  return {
+    now,
+    set: (epochMs) => {
+      if (frozenAt !== void 0)
+        frozenAt = epochMs;
+      else
+        offsetMs = epochMs - source();
+    },
+    advance: (deltaMs) => {
+      if (frozenAt !== void 0)
+        frozenAt += deltaMs;
+      else
+        offsetMs += deltaMs;
+    },
+    freeze: () => {
+      frozenAt = now();
+    },
+    unfreeze: () => {
+      if (frozenAt === void 0)
+        return;
+      offsetMs = frozenAt - source();
+      frozenAt = void 0;
+    },
+    reset: () => {
+      offsetMs = 0;
+      frozenAt = void 0;
+    },
+    state: () => ({ now: now(), frozen: frozenAt !== void 0, offsetMs })
+  };
+};
+
+// ../core/dist/collection.js
+var Collection = class {
+  sqlite;
+  namespace;
+  name;
+  constructor(sqlite, namespace, name) {
+    this.sqlite = sqlite;
+    this.namespace = namespace;
+    this.name = name;
+  }
+  bumpCollectionSeq() {
+    const row = this.sqlite.prepare("SELECT value FROM mockingbird_sequences WHERE namespace = ? AND name = ? AND kind = 'collection'").get(this.namespace, this.name);
+    const next = (row?.value ?? 0) + 1;
+    this.sqlite.prepare(`INSERT INTO mockingbird_sequences (namespace, name, kind, value) VALUES (?, ?, 'collection', ?)
+         ON CONFLICT(namespace, name, kind) DO UPDATE SET value = excluded.value`).run(this.namespace, this.name, next);
+    return next;
+  }
+  nextSequence() {
+    return this.sqlite.transaction(() => this.bumpCollectionSeq());
+  }
+  get(id) {
+    const row = this.sqlite.prepare("SELECT value FROM mockingbird_records WHERE namespace = ? AND collection = ? AND id = ?").get(this.namespace, this.name, id);
+    if (!row)
+      return void 0;
+    return JSON.parse(row.value).value;
+  }
+  has(id) {
+    const row = this.sqlite.prepare("SELECT 1 AS ok FROM mockingbird_records WHERE namespace = ? AND collection = ? AND id = ?").get(this.namespace, this.name, id);
+    return row !== void 0;
+  }
+  /** Insert a new record, assigning it the next sequence number. */
+  insert(id, value) {
+    return this.sqlite.transaction(() => {
+      const seq = this.bumpCollectionSeq();
+      const stored = { seq, value };
+      this.sqlite.prepare(`INSERT INTO mockingbird_records (namespace, collection, id, seq, value)
+           VALUES (?, ?, ?, ?, ?)
+           ON CONFLICT(namespace, collection, id) DO UPDATE SET seq = excluded.seq, value = excluded.value`).run(this.namespace, this.name, id, seq, JSON.stringify(stored));
+      return stored;
+    });
+  }
+  /** Replace an existing record's value, keeping its position. */
+  update(id, value) {
+    return this.sqlite.transaction(() => {
+      const row = this.sqlite.prepare("SELECT seq, value FROM mockingbird_records WHERE namespace = ? AND collection = ? AND id = ?").get(this.namespace, this.name, id);
+      if (!row)
+        return void 0;
+      const stored = { seq: row.seq, value };
+      this.sqlite.prepare("UPDATE mockingbird_records SET value = ? WHERE namespace = ? AND collection = ? AND id = ?").run(JSON.stringify(stored), this.namespace, this.name, id);
+      return stored;
+    });
+  }
+  delete(id) {
+    const result = this.sqlite.prepare("DELETE FROM mockingbird_records WHERE namespace = ? AND collection = ? AND id = ?").run(this.namespace, this.name, id);
+    return result.changes > 0;
+  }
+  /** How many records the collection holds, without reading them. */
+  count() {
+    const row = this.sqlite.prepare("SELECT COUNT(*) AS n FROM mockingbird_records WHERE namespace = ? AND collection = ?").get(this.namespace, this.name);
+    return Number(row?.n ?? 0);
+  }
+  list(options = {}) {
+    const rows = this.sqlite.prepare("SELECT id, seq, value FROM mockingbird_records WHERE namespace = ? AND collection = ?").all(this.namespace, this.name);
+    const out = [];
+    for (const row of rows) {
+      const stored = JSON.parse(row.value);
+      if (options.where && !options.where(stored.value, stored.seq))
+        continue;
+      out.push({ id: row.id, seq: stored.seq, value: stored.value });
+    }
+    out.sort((a, b) => options.order === "oldest" ? a.seq - b.seq : b.seq - a.seq);
+    return out;
+  }
+};
+
+// ../core/dist/control.js
+var HEALTH_PATH = "/health";
+var ADMIN_PREFIX = "/__admin";
+var ADMIN_KEY_HEADER = "x-mockingbird-admin-key";
+var NAMESPACE_HEADER = "x-mockingbird-namespace";
+var json = (status, body) => new Response(JSON.stringify(body), {
+  status,
+  headers: { "content-type": "application/json" }
+});
+var adminError = (status, message) => json(status, { error: { type: "mockingbird_admin", message } });
+var UNITS = {
+  ms: 1,
+  s: 1e3,
+  m: 6e4,
+  h: 36e5,
+  d: 864e5
+};
+var parseDuration = (value) => {
+  if (typeof value === "number" && Number.isFinite(value))
+    return value;
+  if (typeof value !== "string")
+    return void 0;
+  const match2 = /^(-?\d+(?:\.\d+)?)\s*(ms|s|m|h|d)$/.exec(value.trim());
+  if (!match2)
+    return void 0;
+  return Number(match2[1]) * UNITS[match2[2]];
+};
+var parseInstant = (value) => {
+  if (typeof value === "number" && Number.isFinite(value))
+    return value;
+  if (typeof value !== "string")
+    return void 0;
+  const parsed = Date.parse(value);
+  return Number.isNaN(parsed) ? void 0 : parsed;
+};
+var matchRoute = (pattern, path) => {
+  const want = pattern.split("/").filter(Boolean);
+  const have = path.split("/").filter(Boolean);
+  if (want.length !== have.length)
+    return void 0;
+  const params = {};
+  for (let i = 0; i < want.length; i++) {
+    const segment = want[i];
+    const actual = have[i];
+    if (segment.startsWith(":"))
+      params[segment.slice(1)] = decodeURIComponent(actual);
+    else if (segment !== actual)
+      return void 0;
+  }
+  return params;
+};
+var readJson = async (request) => {
+  const text = await request.text();
+  if (text.trim() === "")
+    return void 0;
+  return JSON.parse(text);
+};
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var createControlPlane = (context) => {
+  const snapshots = /* @__PURE__ */ new Map();
+  let snapshotCounter = 0;
+  const headerNamespace = (request) => request.headers.get(NAMESPACE_HEADER) ?? context.defaultNamespace;
+  const adminNamespace = (request, url) => url.searchParams.get("namespace") ?? headerNamespace(request);
+  const builtin = {
+    "GET /": () => json(200, {
+      service: context.name,
+      routes: [...Object.keys(builtin), ...Object.keys(context.routes)].sort()
+    }),
+    "POST /reset": async ({ url, namespace }) => {
+      const target = url.searchParams.get("all") === "1" ? "*" : namespace;
+      await context.reset(target);
+      return json(200, { status: "ok", reset: target === "*" ? context.namespaces() : [target] });
+    },
+    "GET /namespaces": () => json(200, { default: context.defaultNamespace, namespaces: context.namespaces() }),
+    "GET /clock": () => json(200, context.clock.state()),
+    "POST /clock": ({ body }) => {
+      if (!isRecord(body))
+        return adminError(400, "expected a JSON object");
+      if (body.reset === true)
+        context.clock.reset();
+      if (body.set !== void 0) {
+        const instant = parseInstant(body.set);
+        if (instant === void 0)
+          return adminError(400, "set: expected epoch ms or ISO-8601");
+        context.clock.set(instant);
+      }
+      if (body.advance !== void 0) {
+        const delta = parseDuration(body.advance);
+        if (delta === void 0)
+          return adminError(400, 'advance: expected ms or "15m"-style');
+        context.clock.advance(delta);
+      }
+      if (body.freeze === true)
+        context.clock.freeze();
+      if (body.freeze === false)
+        context.clock.unfreeze();
+      return json(200, context.clock.state());
+    },
+    "GET /faults": () => json(200, { faults: context.faults.list() }),
+    "POST /faults": ({ body, namespace }) => {
+      if (isRecord(body) && typeof body.preset === "string") {
+        if (!context.applyPreset)
+          return adminError(400, `${context.name} has no fault presets`);
+        const { preset, ...overrides } = body;
+        try {
+          return json(201, {
+            preset,
+            rules: context.applyPreset(preset, namespace, overrides)
+          });
+        } catch (error) {
+          return adminError(404, error instanceof Error ? error.message : String(error));
+        }
+      }
+      if (!isRecord(body) || typeof body.status !== "number" && typeof body.delayMs !== "number" && typeof body.latencyMs !== "number" && body.drop !== true && typeof body.effect !== "string") {
+        return adminError(400, "a fault needs a numeric status, a delayMs/latencyMs, drop: true, an effect, or a preset");
+      }
+      const rule = {
+        // Scoped to the caller's namespace unless it asks for every one, so one worker's
+        // injected failure never lands on another's request.
+        namespace,
+        ...body,
+        id: typeof body.id === "string" ? body.id : `fault_${context.faults.list().length + 1}`
+      };
+      return json(201, context.faults.add(rule));
+    },
+    "DELETE /faults": ({ url }) => {
+      const id = url.searchParams.get("id");
+      if (id === null) {
+        context.faults.clear();
+        return json(200, { status: "ok" });
+      }
+      return context.faults.remove(id) ? json(200, { status: "ok" }) : adminError(404, `no fault ${id}`);
+    },
+    "POST /snapshots": ({ namespace }) => {
+      const point = context.timeTravel.checkpoint(namespace, "main");
+      context.timeTravel.retain(namespace, point.id);
+      snapshotCounter++;
+      const id = `snap_${snapshotCounter}`;
+      snapshots.set(id, { namespace, checkpoint: point.id });
+      return json(201, { id, namespace, records: point.records ?? 0 });
+    },
+    "POST /snapshots/:id/restore": ({ params, namespace }) => {
+      const alias = snapshots.get(params.id);
+      if (!alias)
+        return adminError(404, `no snapshot ${params.id}`);
+      if (alias.namespace !== namespace) {
+        return adminError(409, `snapshot ${params.id} belongs to namespace ${alias.namespace}`);
+      }
+      context.timeTravel.checkout(alias.checkpoint, { namespace, branch: "main" });
+      return json(200, { status: "ok", id: params.id, namespace });
+    },
+    "DELETE /snapshots/:id": ({ params }) => {
+      const id = params.id;
+      const alias = snapshots.get(id);
+      if (!alias)
+        return adminError(404, `no snapshot ${id}`);
+      snapshots.delete(id);
+      context.timeTravel.release(alias.namespace, alias.checkpoint);
+      return json(200, { status: "ok" });
+    },
+    "GET /timeline": ({ namespace }) => json(200, context.timeTravel.inspect(namespace)),
+    "POST /checkpoints": ({ body, namespace }) => {
+      const branch = isRecord(body) && typeof body.branch === "string" ? body.branch : "main";
+      try {
+        return json(201, context.timeTravel.checkpoint(namespace, branch));
+      } catch (error) {
+        return adminError(409, error instanceof Error ? error.message : String(error));
+      }
+    },
+    "POST /branches/:name": ({ params, body, namespace }) => {
+      const at = isRecord(body) && typeof body.at === "string" ? body.at : void 0;
+      try {
+        return json(201, context.timeTravel.branch(params.name, {
+          namespace,
+          ...at !== void 0 ? { at } : {}
+        }));
+      } catch (error) {
+        return adminError(409, error instanceof Error ? error.message : String(error));
+      }
+    },
+    "POST /branches/:name/checkout": ({ params, body, namespace }) => {
+      if (!isRecord(body) || typeof body.checkpoint !== "string") {
+        return adminError(400, 'expected {"checkpoint":"cp_..."}');
+      }
+      try {
+        context.timeTravel.checkout(body.checkpoint, {
+          namespace,
+          branch: params.name
+        });
+        return json(200, { status: "ok", branch: params.name, checkpoint: body.checkpoint });
+      } catch (error) {
+        return adminError(409, error instanceof Error ? error.message : String(error));
+      }
+    },
+    "GET /requests": ({ url, namespace }) => {
+      const status = url.searchParams.get("status");
+      const since = url.searchParams.get("since");
+      const limit = url.searchParams.get("limit");
+      const sinceMs = since === null ? void 0 : parseInstant(/^\d+$/.test(since) ? Number(since) : since);
+      if (since !== null && sinceMs === void 0) {
+        return adminError(400, "since: expected epoch ms or ISO-8601");
+      }
+      if (status !== null && !/^\d{3}$/.test(status))
+        return adminError(400, "status: expected an HTTP status");
+      if (limit !== null && !/^\d+$/.test(limit))
+        return adminError(400, "limit: expected a count");
+      const operationId = url.searchParams.get("operationId");
+      const everyNamespace = url.searchParams.get("all") === "1";
+      return json(200, {
+        size: context.journal.size,
+        requests: context.journal.list({
+          ...everyNamespace ? {} : { namespace },
+          ...operationId !== null ? { operationId } : {},
+          ...status !== null ? { status: Number(status) } : {},
+          ...sinceMs !== void 0 ? { since: sinceMs } : {},
+          ...limit !== null ? { limit: Number(limit) } : {}
+        })
+      });
+    },
+    "DELETE /requests": ({ url, namespace }) => {
+      context.journal.clear(url.searchParams.get("all") === "1" ? void 0 : namespace);
+      return json(200, { status: "ok" });
+    },
+    "GET /metrics": () => json(200, context.metrics.report()),
+    "DELETE /metrics": () => {
+      context.metrics.reset();
+      return json(200, { status: "ok" });
+    }
+  };
+  const routes = [...Object.entries(context.routes), ...Object.entries(builtin)].map(([key, handler]) => {
+    const space = key.indexOf(" ");
+    return { method: key.slice(0, space), pattern: key.slice(space + 1), handler };
+  });
+  return {
+    namespaceOf: headerNamespace,
+    async handle(request) {
+      const url = new URL(request.url);
+      if (url.pathname === HEALTH_PATH && request.method === "GET") {
+        return json(200, {
+          status: "ok",
+          service: context.name,
+          uptimeMs: context.wallNow() - context.startedAt,
+          clock: context.clock.state(),
+          namespaces: context.namespaces().length,
+          ...context.describe()
+        });
+      }
+      if (url.pathname !== ADMIN_PREFIX && !url.pathname.startsWith(`${ADMIN_PREFIX}/`)) {
+        return void 0;
+      }
+      if (context.adminKey !== void 0 && request.headers.get(ADMIN_KEY_HEADER) !== context.adminKey) {
+        return adminError(401, `missing or wrong ${ADMIN_KEY_HEADER}`);
+      }
+      const path = url.pathname.slice(ADMIN_PREFIX.length) || "/";
+      for (const route of routes) {
+        if (route.method !== request.method)
+          continue;
+        const params = matchRoute(route.pattern, path);
+        if (!params)
+          continue;
+        let body;
+        try {
+          body = await readJson(request);
+        } catch {
+          return adminError(400, "request body is not valid JSON");
+        }
+        return route.handler({
+          request,
+          url,
+          params,
+          namespace: adminNamespace(request, url),
+          body
+        });
+      }
+      return adminError(404, `no admin route ${request.method} ${path}; GET ${ADMIN_PREFIX} lists them`);
+    }
+  };
+};
+
+// ../core/dist/credentials.js
+var createCredentialRegistry = () => {
+  const map = /* @__PURE__ */ new Map();
+  return {
+    set: (credential, namespace) => {
+      map.set(credential, namespace);
+    },
+    get: (credential) => map.get(credential),
+    remove: (credential) => map.delete(credential),
+    clear: () => map.clear(),
+    entries: () => [...map].map(([credential, namespace]) => ({ credential, namespace })).sort((a, b) => a.credential.localeCompare(b.credential))
+  };
+};
+var maskCredential = (credential) => credential.length <= 8 ? `${credential.slice(0, 2)}\u2026` : `${credential.slice(0, 6)}\u2026${credential.slice(-2)}`;
+
+// ../core/dist/rng.js
+var seedFrom = (value) => {
+  let hash2 = 2166136261;
+  for (let i = 0; i < value.length; i++) {
+    hash2 ^= value.charCodeAt(i);
+    hash2 = Math.imul(hash2, 16777619);
+  }
+  return hash2 >>> 0;
+};
+var createRng = (seed = 0) => {
+  const numeric = typeof seed === "string" ? seedFrom(seed) : seed >>> 0;
+  let state = numeric;
+  const next = () => {
+    state = state + 1831565813 >>> 0;
+    let t = state;
+    t = Math.imul(t ^ t >>> 15, t | 1);
+    t ^= t + Math.imul(t ^ t >>> 7, t | 61);
+    return ((t ^ t >>> 14) >>> 0) / 4294967296;
+  };
+  return {
+    next,
+    int: (min, max) => min + Math.floor(next() * (max - min + 1)),
+    reset: () => {
+      state = numeric;
+    },
+    state: () => state,
+    setState: (next2) => {
+      if (!Number.isSafeInteger(next2) || next2 < 0 || next2 > 4294967295) {
+        throw new RangeError("rng state must be an unsigned 32-bit integer");
+      }
+      state = next2 >>> 0;
+    },
+    seed: numeric
+  };
+};
+
+// ../core/dist/faults.js
+var matches = (rule, candidate) => {
+  if (rule.namespace !== void 0 && rule.namespace !== "*" && rule.namespace !== candidate.namespace) {
+    return false;
+  }
+  if (rule.operationId !== void 0 && rule.operationId !== candidate.operationId)
+    return false;
+  if (rule.method !== void 0 && rule.method.toUpperCase() !== candidate.method.toUpperCase()) {
+    return false;
+  }
+  if (rule.pathPrefix !== void 0 && !candidate.path.startsWith(rule.pathPrefix))
+    return false;
+  return true;
+};
+var faultResponse = (rule) => {
+  const status = rule.status ?? 500;
+  const headers = { "content-type": "application/json", ...rule.headers };
+  if (typeof rule.body === "string")
+    return new Response(rule.body, { status, headers });
+  if (rule.body === null)
+    return new Response(null, { status, headers: rule.headers ?? {} });
+  const body = rule.body === void 0 ? { detail: "Injected by Mockingbird" } : rule.body;
+  return new Response(JSON.stringify(body), { status, headers });
+};
+var createFaultRegistry = (rng = createRng(0), sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) => {
+  const entries = [];
+  return {
+    add(rule) {
+      const existing = entries.findIndex((e) => e.rule.id === rule.id);
+      const entry = { rule, remaining: rule.count ?? null, hits: 0 };
+      if (existing >= 0)
+        entries[existing] = entry;
+      else
+        entries.push(entry);
+      return rule;
+    },
+    list: () => entries.map((e) => ({ ...e.rule, remaining: e.remaining, hits: e.hits })),
+    remove(id) {
+      const index = entries.findIndex((e) => e.rule.id === id);
+      if (index < 0)
+        return false;
+      entries.splice(index, 1);
+      return true;
+    },
+    clear() {
+      entries.length = 0;
+    },
+    async take(candidate) {
+      const hits = [];
+      for (const entry of entries) {
+        if (entry.remaining === 0)
+          continue;
+        if (!matches(entry.rule, candidate))
+          continue;
+        const rate = entry.rule.rate ?? 1;
+        if (rng.next() >= rate)
+          continue;
+        entry.hits++;
+        if (entry.remaining !== null)
+          entry.remaining--;
+        const delay = entry.rule.delayMs ?? entry.rule.latencyMs;
+        if (delay !== void 0 && delay > 0) {
+          await sleep(delay);
+        }
+        const hit = { id: entry.rule.id };
+        if (entry.rule.effect !== void 0) {
+          hit.effect = { name: entry.rule.effect, params: entry.rule.params ?? {} };
+        }
+        if (entry.rule.drop === true)
+          hit.drop = true;
+        else if (entry.rule.status !== void 0)
+          hit.response = faultResponse(entry.rule);
+        hits.push(hit);
+        if (hit.drop || hit.response)
+          break;
+      }
+      return hits;
+    }
+  };
+};
+
+// ../../openapi/core/dist/refs.js
+var OpenAPIReferenceError = class extends Error {
+  ref;
+  constructor(ref) {
+    super(`unresolvable $ref: ${ref}`);
+    this.ref = ref;
+    this.name = "OpenAPIReferenceError";
+  }
+};
+var unescapePointer = (segment) => segment.replace(/~1/g, "/").replace(/~0/g, "~");
+var isReference = (value) => typeof value === "object" && value !== null && typeof value.$ref === "string";
+var resolveRef = (document2, ref) => {
+  if (!ref.startsWith("#/"))
+    throw new OpenAPIReferenceError(ref);
+  let cursor = document2;
+  for (const raw of ref.slice(2).split("/")) {
+    const segment = unescapePointer(raw);
+    if (typeof cursor !== "object" || cursor === null || !(segment in cursor)) {
+      throw new OpenAPIReferenceError(ref);
+    }
+    cursor = cursor[segment];
+  }
+  if (cursor === void 0)
+    throw new OpenAPIReferenceError(ref);
+  return cursor;
+};
+var deref = (document2, value) => {
+  let current = value;
+  const seen = /* @__PURE__ */ new Set();
+  while (isReference(current)) {
+    if (seen.has(current.$ref))
+      throw new OpenAPIReferenceError(`${current.$ref} (cycle)`);
+    seen.add(current.$ref);
+    current = resolveRef(document2, current.$ref);
+  }
+  return current;
+};
+
+// ../../openapi/core/dist/types.js
+var HTTP_METHODS = [
+  "get",
+  "put",
+  "post",
+  "delete",
+  "options",
+  "head",
+  "patch",
+  "trace"
+];
+
+// ../../openapi/core/dist/document.js
+var mergeParameters = (document2, item, own) => {
+  const merged = /* @__PURE__ */ new Map();
+  for (const raw of item.parameters ?? []) {
+    const parameter = deref(document2, raw);
+    merged.set(`${parameter.in}:${parameter.name}`, parameter);
+  }
+  for (const raw of own ?? []) {
+    const parameter = deref(document2, raw);
+    merged.set(`${parameter.in}:${parameter.name}`, parameter);
+  }
+  return [...merged.values()];
+};
+var listOperations = (document2) => {
+  const operations = [];
+  for (const [path, item] of Object.entries(document2.paths)) {
+    for (const method of HTTP_METHODS) {
+      const operation = item[method];
+      if (operation?.operationId === void 0)
+        continue;
+      const responses = {};
+      for (const [status, response] of Object.entries(operation.responses)) {
+        responses[status] = deref(document2, response);
+      }
+      operations.push({
+        operationId: operation.operationId,
+        method,
+        path,
+        operation,
+        parameters: mergeParameters(document2, item, operation.parameters),
+        requestBody: operation.requestBody === void 0 ? void 0 : deref(document2, operation.requestBody),
+        responses
+      });
+    }
+  }
+  return operations;
+};
+
+// ../core/dist/journal.js
+var DEFAULT_JOURNAL_SIZE = 1e3;
+var createJournal = (size = DEFAULT_JOURNAL_SIZE) => {
+  const capacity = Math.max(0, Math.floor(size));
+  const rings = /* @__PURE__ */ new Map();
+  let sequence = 0;
+  const order = /* @__PURE__ */ new WeakMap();
+  const inOrder = (ring) => ring.entries.length < capacity ? ring.entries : [...ring.entries.slice(ring.next), ...ring.entries.slice(0, ring.next)];
+  return {
+    size: capacity,
+    record(entry) {
+      if (capacity === 0)
+        return;
+      order.set(entry, sequence++);
+      let ring = rings.get(entry.namespace);
+      if (!ring) {
+        ring = { entries: [], next: 0 };
+        rings.set(entry.namespace, ring);
+      }
+      if (ring.entries.length < capacity)
+        ring.entries.push(entry);
+      else {
+        ring.entries[ring.next] = entry;
+        ring.next = (ring.next + 1) % capacity;
+      }
+    },
+    list(query = {}) {
+      const source = query.namespace !== void 0 ? inOrder(rings.get(query.namespace) ?? { entries: [], next: 0 }) : [...rings.values()].flatMap(inOrder).sort((a, b) => (order.get(a) ?? 0) - (order.get(b) ?? 0));
+      const matched = source.filter((entry) => (query.operationId === void 0 || entry.operationId === query.operationId) && (query.status === void 0 || entry.status === query.status) && (query.since === void 0 || Date.parse(entry.at) >= query.since));
+      return query.limit !== void 0 ? matched.slice(-Math.max(0, query.limit)) : matched;
+    },
+    clear(namespace) {
+      if (namespace === void 0)
+        rings.clear();
+      else
+        rings.delete(namespace);
+    }
+  };
+};
+var notes = /* @__PURE__ */ new WeakMap();
+var responseNotes = (response) => notes.get(response);
+
+// ../core/dist/metrics.js
+var createMetrics = () => {
+  let requests = 0;
+  let faults = 0;
+  let totalDurationMs = 0;
+  const byOperation = /* @__PURE__ */ new Map();
+  const unmatched = /* @__PURE__ */ new Map();
+  return {
+    record(entry) {
+      requests++;
+      totalDurationMs += entry.durationMs;
+      if (entry.faultId !== void 0)
+        faults++;
+      const key = `${entry.operationId ?? "(unmatched)"} ${entry.status}`;
+      byOperation.set(key, (byOperation.get(key) ?? 0) + 1);
+      if (entry.unmatched) {
+        const route = `${entry.method} ${entry.path}`;
+        unmatched.set(route, (unmatched.get(route) ?? 0) + 1);
+      }
+    },
+    report: () => ({
+      requests,
+      byOperation: Object.fromEntries([...byOperation].sort(([a], [b]) => a.localeCompare(b))),
+      unmatched: [...unmatched].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).map(([route, count]) => {
+        const space = route.indexOf(" ");
+        return { method: route.slice(0, space), path: route.slice(space + 1), count };
+      }),
+      faults,
+      totalDurationMs
+    }),
+    reset() {
+      requests = 0;
+      faults = 0;
+      totalDurationMs = 0;
+      byOperation.clear();
+      unmatched.clear();
+    }
+  };
+};
+
+// ../../core/dist/timeline.js
+var BRANCH_PATTERN = /^[A-Za-z0-9_.-]{1,64}$/;
+var Timeline = class {
+  maxCheckpoints;
+  now;
+  makeId;
+  nodes = /* @__PURE__ */ new Map();
+  heads = /* @__PURE__ */ new Map();
+  /** Unreferenced nodes in the exact order they became collectible. */
+  evictable = /* @__PURE__ */ new Set();
+  /** Branch heads plus explicit retainers. Absent means zero. */
+  references = /* @__PURE__ */ new Map();
+  explicitPins = /* @__PURE__ */ new Map();
+  sequence = 0;
+  constructor(options = {}) {
+    const max = options.maxCheckpoints ?? 1e3;
+    if (!Number.isSafeInteger(max) || max < 1)
+      throw new RangeError("maxCheckpoints must be a positive integer");
+    this.maxCheckpoints = max;
+    this.now = options.now ?? (() => this.sequence);
+    this.makeId = options.id ?? ((sequence) => `cp_${sequence.toString(36).padStart(8, "0")}`);
+  }
+  /** Capture a new immutable value and move `branch` to it. */
+  commit(value, options = {}) {
+    const branch = options.branch ?? "main";
+    this.assertBranch(branch);
+    const parent = options.parent === void 0 ? this.heads.get(branch) ?? null : options.parent;
+    if (parent !== null && !this.nodes.has(parent))
+      throw new RangeError(`no checkpoint ${parent}`);
+    const id = this.makeId(++this.sequence);
+    if (this.nodes.has(id))
+      throw new RangeError(`duplicate checkpoint id ${id}`);
+    const checkpoint = Object.freeze({ id, branch, parent, at: this.now(), value });
+    this.nodes.set(id, checkpoint);
+    this.moveHead(branch, id);
+    this.collect(this.maxCheckpoints);
+    return checkpoint;
+  }
+  /** Create a branch pointer without copying its checkpoint value. */
+  fork(branch, options = {}) {
+    this.assertBranch(branch);
+    if (this.heads.has(branch))
+      throw new RangeError(`branch already exists: ${branch}`);
+    const from = options.from ?? this.heads.get("main");
+    if (from === void 0)
+      return void 0;
+    const checkpoint = this.get(from);
+    this.moveHead(branch, checkpoint.id);
+    return checkpoint;
+  }
+  /** Move a branch pointer to an existing checkpoint. */
+  checkout(branch, id) {
+    this.assertBranch(branch);
+    const checkpoint = this.get(id);
+    this.moveHead(branch, checkpoint.id);
+    return checkpoint;
+  }
+  get(id) {
+    const checkpoint = this.nodes.get(id);
+    if (!checkpoint)
+      throw new RangeError(`no checkpoint ${id}`);
+    return checkpoint;
+  }
+  head(branch = "main") {
+    const id = this.heads.get(branch);
+    return id === void 0 ? void 0 : this.get(id);
+  }
+  hasBranch(branch) {
+    return this.heads.has(branch);
+  }
+  branches() {
+    return Object.freeze(Object.fromEntries([...this.heads].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)));
+  }
+  checkpoints() {
+    return [...this.nodes.values()];
+  }
+  /** Number of retained checkpoints without allocating an array. */
+  get size() {
+    return this.nodes.size;
+  }
+  /** Pin a checkpoint independently of branch heads (used by compatibility snapshot handles). */
+  retain(id) {
+    const checkpoint = this.get(id);
+    this.explicitPins.set(id, (this.explicitPins.get(id) ?? 0) + 1);
+    this.addReference(id);
+    return checkpoint;
+  }
+  /** Release one explicit pin. Branch heads remain pinned until moved or deleted. */
+  release(id) {
+    if (!this.nodes.has(id))
+      return false;
+    const pins = this.explicitPins.get(id) ?? 0;
+    if (pins === 0)
+      return false;
+    if (pins === 1)
+      this.explicitPins.delete(id);
+    else
+      this.explicitPins.set(id, pins - 1);
+    this.removeReference(id);
+    this.collect(this.maxCheckpoints);
+    return true;
+  }
+  deleteBranch(branch) {
+    if (branch === "main")
+      throw new RangeError("cannot delete main branch");
+    const previous = this.heads.get(branch);
+    const deleted = this.heads.delete(branch);
+    if (previous !== void 0)
+      this.removeReference(previous);
+    this.collect(this.maxCheckpoints);
+    return deleted;
+  }
+  /**
+   * Deterministically discard oldest unpinned checkpoints. Collection is O(number removed):
+   * commits never scan pinned nodes or the retained history. Parents are metadata rather than a
+   * storage dependency, so a retained node remains usable after pruning.
+   */
+  gc(max = this.maxCheckpoints) {
+    if (!Number.isSafeInteger(max) || max < 1)
+      throw new RangeError("max must be a positive integer");
+    const removed = [];
+    this.collect(max, removed);
+    return removed;
+  }
+  collect(max, removed) {
+    while (this.nodes.size > max && this.evictable.size > 0) {
+      const id = this.evictable.values().next().value;
+      this.evictable.delete(id);
+      this.nodes.delete(id);
+      removed?.push(id);
+    }
+  }
+  moveHead(branch, id) {
+    const previous = this.heads.get(branch);
+    if (previous === id)
+      return;
+    if (previous !== void 0)
+      this.removeReference(previous);
+    this.heads.set(branch, id);
+    this.addReference(id);
+  }
+  addReference(id) {
+    this.references.set(id, (this.references.get(id) ?? 0) + 1);
+    this.evictable.delete(id);
+  }
+  removeReference(id) {
+    const next = (this.references.get(id) ?? 0) - 1;
+    if (next > 0)
+      this.references.set(id, next);
+    else {
+      this.references.delete(id);
+      if (this.nodes.has(id))
+        this.evictable.add(id);
+    }
+  }
+  assertBranch(branch) {
+    if (!BRANCH_PATTERN.test(branch))
+      throw new RangeError(`branch must match ${BRANCH_PATTERN}`);
+  }
+};
+
+// ../../sqlite/dist/default.js
+import { Database } from "@crvouga/mockingbird-service-sqlite";
+var createDefaultSqlite = () => new Database();
+var resolveSqlite = (sqlite) => sqlite ?? createDefaultSqlite();
+
+// ../../sqlite/dist/migrate.js
+var ensureMigrationsTable = (sqlite) => {
+  sqlite.exec(`
+    CREATE TABLE IF NOT EXISTS schema_migrations (
+      id TEXT PRIMARY KEY NOT NULL,
+      applied_at INTEGER NOT NULL
+    )
+  `);
+};
+var migrate = (sqlite, migrations) => {
+  ensureMigrationsTable(sqlite);
+  const applied = new Set(sqlite.prepare("SELECT id FROM schema_migrations").all().map((row) => row.id));
+  const pending = migrations.filter((migration) => !applied.has(migration.id));
+  if (pending.length === 0)
+    return;
+  const insert = sqlite.prepare("INSERT INTO schema_migrations (id, applied_at) VALUES (?, ?)");
+  const now = Math.floor(Date.now() / 1e3);
+  sqlite.transaction(() => {
+    for (const migration of pending) {
+      sqlite.exec(migration.sql);
+      insert.run(migration.id, now);
+    }
+  });
+};
+
+// ../../sqlite/dist/schema.js
+var CORE_MIGRATIONS = [
+  {
+    id: "20260322_core_records_sequences",
+    sql: `
+      CREATE TABLE IF NOT EXISTS mockingbird_records (
+        namespace TEXT NOT NULL,
+        collection TEXT NOT NULL,
+        id TEXT NOT NULL,
+        seq INTEGER NOT NULL,
+        value TEXT NOT NULL,
+        PRIMARY KEY (namespace, collection, id)
+      );
+      CREATE INDEX IF NOT EXISTS mockingbird_records_seq
+        ON mockingbird_records (namespace, collection, seq);
+      CREATE TABLE IF NOT EXISTS mockingbird_sequences (
+        namespace TEXT NOT NULL,
+        name TEXT NOT NULL,
+        kind TEXT NOT NULL,
+        value INTEGER NOT NULL,
+        PRIMARY KEY (namespace, name, kind)
+      );
+    `
+  }
+];
+var migrateCore = (sqlite) => {
+  migrate(sqlite, CORE_MIGRATIONS);
+};
+var clearNamespace = (sqlite, namespace) => {
+  sqlite.transaction(() => {
+    sqlite.prepare("DELETE FROM mockingbird_records WHERE namespace = ?").run(namespace);
+    sqlite.prepare("DELETE FROM mockingbird_sequences WHERE namespace = ?").run(namespace);
+  });
+};
+
+// ../../../node_modules/.bun/hono@4.11.9/node_modules/hono/dist/request/constants.js
+var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
+
+// ../../../node_modules/.bun/hono@4.11.9/node_modules/hono/dist/utils/body.js
+var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
+  const { all = false, dot = false } = options;
+  const headers = request instanceof HonoRequest ? request.raw.headers : request.headers;
+  const contentType = headers.get("Content-Type");
+  if (contentType?.startsWith("multipart/form-data") || contentType?.startsWith("application/x-www-form-urlencoded")) {
+    return parseFormData(request, { all, dot });
+  }
+  return {};
+};
+async function parseFormData(request, options) {
+  const formData = await request.formData();
+  if (formData) {
+    return convertFormDataToBodyData(formData, options);
+  }
+  return {};
+}
+function convertFormDataToBodyData(formData, options) {
+  const form = /* @__PURE__ */ Object.create(null);
+  formData.forEach((value, key) => {
+    const shouldParseAllValues = options.all || key.endsWith("[]");
+    if (!shouldParseAllValues) {
+      form[key] = value;
+    } else {
+      handleParsingAllValues(form, key, value);
+    }
+  });
+  if (options.dot) {
+    Object.entries(form).forEach(([key, value]) => {
+      const shouldParseDotValues = key.includes(".");
+      if (shouldParseDotValues) {
+        handleParsingNestedValues(form, key, value);
+        delete form[key];
+      }
+    });
+  }
+  return form;
+}
+var handleParsingAllValues = (form, key, value) => {
+  if (form[key] !== void 0) {
+    if (Array.isArray(form[key])) {
+      ;
+      form[key].push(value);
+    } else {
+      form[key] = [form[key], value];
+    }
+  } else {
+    if (!key.endsWith("[]")) {
+      form[key] = value;
+    } else {
+      form[key] = [value];
+    }
+  }
+};
+var handleParsingNestedValues = (form, key, value) => {
+  let nestedForm = form;
+  const keys2 = key.split(".");
+  keys2.forEach((key2, index) => {
+    if (index === keys2.length - 1) {
+      nestedForm[key2] = value;
+    } else {
+      if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+        nestedForm[key2] = /* @__PURE__ */ Object.create(null);
+      }
+      nestedForm = nestedForm[key2];
+    }
+  });
+};
+
+// ../../../node_modules/.bun/hono@4.11.9/node_modules/hono/dist/utils/url.js
+var tryDecode = (str, decoder) => {
+  try {
+    return decoder(str);
+  } catch {
+    return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match2) => {
+      try {
+        return decoder(match2);
+      } catch {
+        return match2;
+      }
+    });
+  }
+};
+var _decodeURI = (value) => {
+  if (!/[%+]/.test(value)) {
+    return value;
+  }
+  if (value.indexOf("+") !== -1) {
+    value = value.replace(/\+/g, " ");
+  }
+  return value.indexOf("%") !== -1 ? tryDecode(value, decodeURIComponent_) : value;
+};
+var _getQueryParam = (url, key, multiple) => {
+  let encoded;
+  if (!multiple && key && !/[%+]/.test(key)) {
+    let keyIndex2 = url.indexOf("?", 8);
+    if (keyIndex2 === -1) {
+      return void 0;
+    }
+    if (!url.startsWith(key, keyIndex2 + 1)) {
+      keyIndex2 = url.indexOf(`&${key}`, keyIndex2 + 1);
+    }
+    while (keyIndex2 !== -1) {
+      const trailingKeyCode = url.charCodeAt(keyIndex2 + key.length + 1);
+      if (trailingKeyCode === 61) {
+        const valueIndex = keyIndex2 + key.length + 2;
+        const endIndex = url.indexOf("&", valueIndex);
+        return _decodeURI(url.slice(valueIndex, endIndex === -1 ? void 0 : endIndex));
+      } else if (trailingKeyCode == 38 || isNaN(trailingKeyCode)) {
+        return "";
+      }
+      keyIndex2 = url.indexOf(`&${key}`, keyIndex2 + 1);
+    }
+    encoded = /[%+]/.test(url);
+    if (!encoded) {
+      return void 0;
+    }
+  }
+  const results = {};
+  encoded ??= /[%+]/.test(url);
+  let keyIndex = url.indexOf("?", 8);
+  while (keyIndex !== -1) {
+    const nextKeyIndex = url.indexOf("&", keyIndex + 1);
+    let valueIndex = url.indexOf("=", keyIndex);
+    if (valueIndex > nextKeyIndex && nextKeyIndex !== -1) {
+      valueIndex = -1;
+    }
+    let name = url.slice(
+      keyIndex + 1,
+      valueIndex === -1 ? nextKeyIndex === -1 ? void 0 : nextKeyIndex : valueIndex
+    );
+    if (encoded) {
+      name = _decodeURI(name);
+    }
+    keyIndex = nextKeyIndex;
+    if (name === "") {
+      continue;
+    }
+    let value;
+    if (valueIndex === -1) {
+      value = "";
+    } else {
+      value = url.slice(valueIndex + 1, nextKeyIndex === -1 ? void 0 : nextKeyIndex);
+      if (encoded) {
+        value = _decodeURI(value);
+      }
+    }
+    if (multiple) {
+      if (!(results[name] && Array.isArray(results[name]))) {
+        results[name] = [];
+      }
+      ;
+      results[name].push(value);
+    } else {
+      results[name] ??= value;
+    }
+  }
+  return key ? results[key] : results;
+};
+var getQueryParam = _getQueryParam;
+var getQueryParams = (url, key) => {
+  return _getQueryParam(url, key, true);
+};
+var decodeURIComponent_ = decodeURIComponent;
+
+// ../../../node_modules/.bun/hono@4.11.9/node_modules/hono/dist/request.js
+var tryDecodeURIComponent = (str) => tryDecode(str, decodeURIComponent_);
+var HonoRequest = class {
+  /**
+   * `.raw` can get the raw Request object.
+   *
+   * @see {@link https://hono.dev/docs/api/request#raw}
+   *
+   * @example
+   * ```ts
+   * // For Cloudflare Workers
+   * app.post('/', async (c) => {
+   *   const metadata = c.req.raw.cf?.hostMetadata?
+   *   ...
+   * })
+   * ```
+   */
+  raw;
+  #validatedData;
+  // Short name of validatedData
+  #matchResult;
+  routeIndex = 0;
+  /**
+   * `.path` can get the pathname of the request.
+   *
+   * @see {@link https://hono.dev/docs/api/request#path}
+   *
+   * @example
+   * ```ts
+   * app.get('/about/me', (c) => {
+   *   const pathname = c.req.path // `/about/me`
+   * })
+   * ```
+   */
+  path;
+  bodyCache = {};
+  constructor(request, path = "/", matchResult = [[]]) {
+    this.raw = request;
+    this.path = path;
+    this.#matchResult = matchResult;
+    this.#validatedData = {};
+  }
+  param(key) {
+    return key ? this.#getDecodedParam(key) : this.#getAllDecodedParams();
+  }
+  #getDecodedParam(key) {
+    const paramKey = this.#matchResult[0][this.routeIndex][1][key];
+    const param = this.#getParamValue(paramKey);
+    return param && /\%/.test(param) ? tryDecodeURIComponent(param) : param;
+  }
+  #getAllDecodedParams() {
+    const decoded = {};
+    const keys2 = Object.keys(this.#matchResult[0][this.routeIndex][1]);
+    for (const key of keys2) {
+      const value = this.#getParamValue(this.#matchResult[0][this.routeIndex][1][key]);
+      if (value !== void 0) {
+        decoded[key] = /\%/.test(value) ? tryDecodeURIComponent(value) : value;
+      }
+    }
+    return decoded;
+  }
+  #getParamValue(paramKey) {
+    return this.#matchResult[1] ? this.#matchResult[1][paramKey] : paramKey;
+  }
+  query(key) {
+    return getQueryParam(this.url, key);
+  }
+  queries(key) {
+    return getQueryParams(this.url, key);
+  }
+  header(name) {
+    if (name) {
+      return this.raw.headers.get(name) ?? void 0;
+    }
+    const headerData = {};
+    this.raw.headers.forEach((value, key) => {
+      headerData[key] = value;
+    });
+    return headerData;
+  }
+  async parseBody(options) {
+    return this.bodyCache.parsedBody ??= await parseBody(this, options);
+  }
+  #cachedBody = (key) => {
+    const { bodyCache, raw } = this;
+    const cachedBody = bodyCache[key];
+    if (cachedBody) {
+      return cachedBody;
+    }
+    const anyCachedKey = Object.keys(bodyCache)[0];
+    if (anyCachedKey) {
+      return bodyCache[anyCachedKey].then((body) => {
+        if (anyCachedKey === "json") {
+          body = JSON.stringify(body);
+        }
+        return new Response(body)[key]();
+      });
+    }
+    return bodyCache[key] = raw[key]();
+  };
+  /**
+   * `.json()` can parse Request body of type `application/json`
+   *
+   * @see {@link https://hono.dev/docs/api/request#json}
+   *
+   * @example
+   * ```ts
+   * app.post('/entry', async (c) => {
+   *   const body = await c.req.json()
+   * })
+   * ```
+   */
+  json() {
+    return this.#cachedBody("text").then((text) => JSON.parse(text));
+  }
+  /**
+   * `.text()` can parse Request body of type `text/plain`
+   *
+   * @see {@link https://hono.dev/docs/api/request#text}
+   *
+   * @example
+   * ```ts
+   * app.post('/entry', async (c) => {
+   *   const body = await c.req.text()
+   * })
+   * ```
+   */
+  text() {
+    return this.#cachedBody("text");
+  }
+  /**
+   * `.arrayBuffer()` parse Request body as an `ArrayBuffer`
+   *
+   * @see {@link https://hono.dev/docs/api/request#arraybuffer}
+   *
+   * @example
+   * ```ts
+   * app.post('/entry', async (c) => {
+   *   const body = await c.req.arrayBuffer()
+   * })
+   * ```
+   */
+  arrayBuffer() {
+    return this.#cachedBody("arrayBuffer");
+  }
+  /**
+   * Parses the request body as a `Blob`.
+   * @example
+   * ```ts
+   * app.post('/entry', async (c) => {
+   *   const body = await c.req.blob();
+   * });
+   * ```
+   * @see https://hono.dev/docs/api/request#blob
+   */
+  blob() {
+    return this.#cachedBody("blob");
+  }
+  /**
+   * Parses the request body as `FormData`.
+   * @example
+   * ```ts
+   * app.post('/entry', async (c) => {
+   *   const body = await c.req.formData();
+   * });
+   * ```
+   * @see https://hono.dev/docs/api/request#formdata
+   */
+  formData() {
+    return this.#cachedBody("formData");
+  }
+  /**
+   * Adds validated data to the request.
+   *
+   * @param target - The target of the validation.
+   * @param data - The validated data to add.
+   */
+  addValidatedData(target, data) {
+    this.#validatedData[target] = data;
+  }
+  valid(target) {
+    return this.#validatedData[target];
+  }
+  /**
+   * `.url()` can get the request url strings.
+   *
+   * @see {@link https://hono.dev/docs/api/request#url}
+   *
+   * @example
+   * ```ts
+   * app.get('/about/me', (c) => {
+   *   const url = c.req.url // `http://localhost:8787/about/me`
+   *   ...
+   * })
+   * ```
+   */
+  get url() {
+    return this.raw.url;
+  }
+  /**
+   * `.method()` can get the method name of the request.
+   *
+   * @see {@link https://hono.dev/docs/api/request#method}
+   *
+   * @example
+   * ```ts
+   * app.get('/about/me', (c) => {
+   *   const method = c.req.method // `GET`
+   * })
+   * ```
+   */
+  get method() {
+    return this.raw.method;
+  }
+  get [GET_MATCH_RESULT]() {
+    return this.#matchResult;
+  }
+  /**
+   * `.matchedRoutes()` can return a matched route in the handler
+   *
+   * @deprecated
+   *
+   * Use matchedRoutes helper defined in "hono/route" instead.
+   *
+   * @see {@link https://hono.dev/docs/api/request#matchedroutes}
+   *
+   * @example
+   * ```ts
+   * app.use('*', async function logger(c, next) {
+   *   await next()
+   *   c.req.matchedRoutes.forEach(({ handler, method, path }, i) => {
+   *     const name = handler.name || (handler.length < 2 ? '[handler]' : '[middleware]')
+   *     console.log(
+   *       method,
+   *       ' ',
+   *       path,
+   *       ' '.repeat(Math.max(10 - path.length, 0)),
+   *       name,
+   *       i === c.req.routeIndex ? '<- respond from here' : ''
+   *     )
+   *   })
+   * })
+   * ```
+   */
+  get matchedRoutes() {
+    return this.#matchResult[0].map(([[, route]]) => route);
+  }
+  /**
+   * `routePath()` can retrieve the path registered within the handler
+   *
+   * @deprecated
+   *
+   * Use routePath helper defined in "hono/route" instead.
+   *
+   * @see {@link https://hono.dev/docs/api/request#routepath}
+   *
+   * @example
+   * ```ts
+   * app.get('/posts/:id', (c) => {
+   *   return c.json({ path: c.req.routePath })
+   * })
+   * ```
+   */
+  get routePath() {
+    return this.#matchResult[0].map(([[, route]]) => route)[this.routeIndex].path;
+  }
+};
+
+// ../../../node_modules/.bun/hono@4.11.9/node_modules/hono/dist/router/reg-exp-router/node.js
+var regExpMetaChars = new Set(".\\+*[^]$()");
+
+// ../core/dist/service.js
+var bootSqlite = (sqlite) => {
+  const client = resolveSqlite(sqlite);
+  migrateCore(client);
+  return client;
+};
+
+// ../core/dist/snapshot.js
+var snapshotNamespace = (sqlite, namespace) => ({
+  namespace,
+  records: sqlite.prepare("SELECT collection, id, seq, value FROM mockingbird_records WHERE namespace = ? ORDER BY collection, seq").all(namespace),
+  sequences: sqlite.prepare("SELECT name, kind, value FROM mockingbird_sequences WHERE namespace = ? ORDER BY name, kind").all(namespace)
+});
+var restoreNamespace = (sqlite, namespace, snapshot) => {
+  sqlite.transaction(() => {
+    sqlite.prepare("DELETE FROM mockingbird_records WHERE namespace = ?").run(namespace);
+    sqlite.prepare("DELETE FROM mockingbird_sequences WHERE namespace = ?").run(namespace);
+    const record = sqlite.prepare("INSERT INTO mockingbird_records (namespace, collection, id, seq, value) VALUES (?, ?, ?, ?, ?)");
+    for (const row of snapshot.records) {
+      record.run(namespace, row.collection, row.id, row.seq, row.value);
+    }
+    const sequence = sqlite.prepare("INSERT INTO mockingbird_sequences (namespace, name, kind, value) VALUES (?, ?, ?, ?)");
+    for (const row of snapshot.sequences) {
+      sequence.run(namespace, row.name, row.kind, row.value);
+    }
+  });
+};
+
+// ../core/dist/version.js
+var PACKAGE_VERSION = true ? "0.1.0" : UNRELEASED_VERSION;
+
+// ../core/dist/webhooks.js
+var json2 = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+var adminError2 = (status, message) => json2(status, { error: { type: "mockingbird_admin", message } });
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var parseEndpoint = (value) => {
+  if (!isRecord2(value) || typeof value.url !== "string")
+    return "each endpoint needs a url";
+  try {
+    new URL(value.url);
+  } catch {
+    return `not a URL: ${value.url}`;
+  }
+  const endpoint = { url: value.url };
+  if (typeof value.id === "string")
+    endpoint.id = value.id;
+  if (typeof value.secret === "string")
+    endpoint.secret = value.secret;
+  if (typeof value.signUrl === "string")
+    endpoint.signUrl = value.signUrl;
+  const events = value.events ?? value.enabledEvents;
+  if (Array.isArray(events))
+    endpoint.events = events.map(String);
+  if (isRecord2(value.tags)) {
+    endpoint.tags = Object.fromEntries(Object.entries(value.tags).map(([k, v]) => [k, String(v)]));
+  }
+  if (typeof value.account === "string")
+    endpoint.tags = { ...endpoint.tags, account: value.account };
+  if (isRecord2(value.headers)) {
+    endpoint.headers = Object.fromEntries(Object.entries(value.headers).map(([k, v]) => [k, String(v)]));
+  }
+  return endpoint;
+};
+var webhookAdminRoutes = (hub) => ({
+  "GET /webhooks": ({ url, namespace }) => json2(200, {
+    deliveries: hub.deliveries(url.searchParams.get("all") === "1" ? void 0 : namespace).filter((d) => {
+      const type = url.searchParams.get("type");
+      return type === null || d.type === type;
+    })
+  }),
+  "GET /webhooks/events": ({ url, namespace }) => {
+    const type = url.searchParams.get("type");
+    return json2(200, {
+      events: hub.messages(url.searchParams.get("all") === "1" ? void 0 : namespace).filter((m) => type === null || m.type === type).map((m) => ({ ...m, payload: parsePayload(m) }))
+    });
+  },
+  "POST /webhooks/:id/replay": async ({ params }) => {
+    const replayed = await hub.replay(params.id);
+    return replayed ? json2(200, replayed) : adminError2(404, `no delivery ${params.id}`);
+  },
+  "POST /webhooks/flush": async () => {
+    await hub.flush();
+    return json2(200, { status: "ok" });
+  },
+  "POST /webhooks/faults": ({ body, namespace }) => {
+    if (!isRecord2(body) || !["duplicate", "reorder", "drop"].includes(String(body.mode))) {
+      return adminError2(400, "mode must be duplicate, reorder or drop");
+    }
+    const fault = { mode: body.mode };
+    if (typeof body.count === "number")
+      fault.count = body.count;
+    hub.fault(namespace, fault);
+    return json2(201, { namespace, ...fault });
+  },
+  "GET /webhook-endpoints": ({ namespace }) => json2(200, {
+    endpoints: hub.endpoints(namespace).map(({ secret, ...rest }) => ({
+      ...rest,
+      secret: secret ? "(set)" : null
+    }))
+  }),
+  "PUT /webhook-endpoints": ({ body, namespace }) => {
+    const list = Array.isArray(body) ? body : isRecord2(body) ? body.endpoints : void 0;
+    if (!Array.isArray(list))
+      return adminError2(400, "expected [{url, secret?, events?}]");
+    const parsed = [];
+    for (const each of list) {
+      const endpoint = parseEndpoint(each);
+      if (typeof endpoint === "string")
+        return adminError2(400, endpoint);
+      parsed.push(endpoint);
+    }
+    const set = hub.setEndpoints(namespace, parsed);
+    return json2(200, { endpoints: set.map((e) => ({ ...e, secret: e.secret ? "(set)" : null })) });
+  },
+  "DELETE /webhook-endpoints": ({ namespace }) => {
+    hub.setEndpoints(namespace, []);
+    return json2(200, { status: "ok" });
+  }
+});
+var parsePayload = (message) => {
+  if (message.contentType.startsWith("application/json")) {
+    try {
+      return JSON.parse(message.body);
+    } catch {
+      return message.body;
+    }
+  }
+  if (message.contentType.startsWith("application/x-www-form-urlencoded")) {
+    return Object.fromEntries(new URLSearchParams(message.body));
+  }
+  return message.body;
+};
+
+// ../core/dist/runtime.js
+var MOCKINGBIRD_HEADER = "x-mockingbird";
+var BRANCH_HEADER = "x-mockingbird-branch";
+var AT_HEADER = "x-mockingbird-at";
+var CHECKPOINT_HEADER = "x-mockingbird-checkpoint";
+var DEFAULT_NAMESPACE = "default";
+var NAMESPACE_PATTERN = /^[A-Za-z0-9_.-]{1,64}$/;
+var PATH_PREFIX = /^\/ns\/([^/]+)(\/.*)?$/;
+var BRANCH_PATTERN2 = /^[A-Za-z0-9_.-]{1,64}$/;
+var MUTATING_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var effects = /* @__PURE__ */ new WeakMap();
+var reuseSorted = (fresh, previous, compare, equal) => {
+  if (!previous || previous.length === 0)
+    return fresh.map((row) => Object.freeze(row));
+  const result = new Array(fresh.length);
+  let unchanged = fresh.length === previous.length;
+  let oldIndex = 0;
+  for (let index = 0; index < fresh.length; index++) {
+    const row = fresh[index];
+    while (oldIndex < previous.length && compare(previous[oldIndex], row) < 0) {
+      oldIndex++;
+    }
+    const old = previous[oldIndex];
+    result[index] = old !== void 0 && compare(old, row) === 0 && equal(old, row) ? old : Object.freeze(row);
+    if (result[index] !== previous[index])
+      unchanged = false;
+  }
+  return unchanged ? previous : result;
+};
+var DroppedConnectionError = class extends TypeError {
+  code = "MOCKINGBIRD_DROP";
+  constructor() {
+    super("fetch failed: connection dropped by Mockingbird fault");
+    this.name = "TypeError";
+  }
+};
+var operationMatcher = (document2) => {
+  const matchers = listOperations(document2).map((operation) => ({
+    operationId: operation.operationId,
+    method: operation.method.toUpperCase(),
+    pattern: new RegExp(`^${operation.path.split("/").map((segment) => segment.startsWith("{") ? "[^/]+" : segment.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("/")}/?$`),
+    params: (operation.path.match(/\{/g) ?? []).length
+  })).sort((a, b) => a.params - b.params);
+  return (request, path) => matchers.find((m) => m.method === request.method && m.pattern.test(path))?.operationId;
+};
+var createRuntime = (options) => {
+  const sqlite = bootSqlite(options.sqlite);
+  const clock = options.clock ?? createClock();
+  const rng = createRng(options.seed ?? 0);
+  const wallNow = options.io?.wallNow ?? Date.now;
+  const monotonicNow = options.io?.monotonicNow ?? (() => performance.now());
+  const sleep = options.io?.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const faults = createFaultRegistry(createRng(options.seed ?? 0), sleep);
+  const metrics = createMetrics();
+  const journal = createJournal(options.journalSize ?? DEFAULT_JOURNAL_SIZE);
+  const version = options.version ?? PACKAGE_VERSION;
+  const instances = /* @__PURE__ */ new Map();
+  const publicNamespaces = /* @__PURE__ */ new Set();
+  const branchRngs = /* @__PURE__ */ new Map();
+  const timelines = /* @__PURE__ */ new Map();
+  const branchStorage = /* @__PURE__ */ new Map();
+  const captured = /* @__PURE__ */ new Map();
+  const credentials = createCredentialRegistry();
+  const operationIdFor = options.document ? operationMatcher(options.document) : () => void 0;
+  const storageNamespace = (name) => name === DEFAULT_NAMESPACE ? options.name : `${options.name}:${name}`;
+  const instanceFor = (key, publicNamespace = key, isolatedRng) => {
+    const existing = instances.get(key);
+    if (existing)
+      return existing;
+    if (!NAMESPACE_PATTERN.test(key) || !NAMESPACE_PATTERN.test(publicNamespace)) {
+      throw new RangeError(`namespace must match ${NAMESPACE_PATTERN}: ${JSON.stringify(publicNamespace)}`);
+    }
+    const created = options.create({
+      namespace: storageNamespace(key),
+      publicNamespace,
+      sqlite,
+      clock,
+      rng: isolatedRng ?? rng
+    });
+    instances.set(key, created);
+    publicNamespaces.add(publicNamespace);
+    if (isolatedRng)
+      branchRngs.set(key, isolatedRng);
+    return created;
+  };
+  const instance = (name = DEFAULT_NAMESPACE) => instanceFor(name);
+  const capture = (storage) => {
+    const fresh = snapshotNamespace(sqlite, storageNamespace(storage));
+    const previous = captured.get(storage);
+    const snapshot2 = {
+      namespace: fresh.namespace,
+      records: reuseSorted(fresh.records, previous?.records, (left, right) => left.collection < right.collection ? -1 : left.collection > right.collection ? 1 : left.seq - right.seq, (left, right) => left.id === right.id && left.value === right.value),
+      sequences: reuseSorted(fresh.sequences, previous?.sequences, (left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : left.kind < right.kind ? -1 : left.kind > right.kind ? 1 : 0, (left, right) => left.value === right.value)
+    };
+    Object.freeze(snapshot2.records);
+    Object.freeze(snapshot2.sequences);
+    Object.freeze(snapshot2);
+    captured.set(storage, snapshot2);
+    return Object.freeze({
+      snapshot: snapshot2,
+      clock: Object.freeze(clock.state()),
+      rngState: (branchRngs.get(storage) ?? rng).state()
+    });
+  };
+  const timeline = (name = DEFAULT_NAMESPACE) => {
+    let found = timelines.get(name);
+    if (found)
+      return found;
+    instance(name);
+    found = new Timeline({
+      now: clock.now,
+      ...options.maxCheckpoints !== void 0 ? { maxCheckpoints: options.maxCheckpoints } : {}
+    });
+    found.commit(capture(name));
+    timelines.set(name, found);
+    return found;
+  };
+  const physicalBranch = (namespace, branch2) => {
+    if (branch2 === "main")
+      return namespace;
+    const mapKey = `${namespace}\0${branch2}`;
+    const existing = branchStorage.get(mapKey);
+    if (existing)
+      return existing;
+    const key = `branch_${seedFrom(`${options.name}\0${namespace}\0${branch2}`).toString(36)}`;
+    branchStorage.set(mapKey, key);
+    return key;
+  };
+  const ensureBranch = (namespace, branch2, at) => {
+    if (!BRANCH_PATTERN2.test(branch2))
+      throw new RangeError(`branch must match ${BRANCH_PATTERN2}`);
+    const history = timeline(namespace);
+    if (branch2 === "main") {
+      if (at !== void 0) {
+        const point = history.checkout("main", at);
+        restoreNamespace(sqlite, storageNamespace(namespace), point.value.snapshot);
+        captured.set(namespace, point.value.snapshot);
+        rng.setState(point.value.rngState);
+        clock.set(point.value.clock.now);
+        if (point.value.clock.frozen)
+          clock.freeze();
+        else
+          clock.unfreeze();
+      }
+      return namespace;
+    }
+    const storage = physicalBranch(namespace, branch2);
+    if (!history.hasBranch(branch2)) {
+      if (at === void 0)
+        history.commit(capture(namespace));
+      const point = history.fork(branch2, at === void 0 ? {} : { from: at });
+      const branchRng = createRng(options.seed ?? 0);
+      if (point)
+        branchRng.setState(point.value.rngState);
+      instanceFor(storage, namespace, branchRng);
+      if (point)
+        restoreNamespace(sqlite, storageNamespace(storage), point.value.snapshot);
+      if (point)
+        captured.set(storage, point.value.snapshot);
+    } else if (at !== void 0 && history.head(branch2)?.id !== at) {
+      const point = history.checkout(branch2, at);
+      if (!instances.has(storage)) {
+        const branchRng = createRng(options.seed ?? 0);
+        branchRng.setState(point.value.rngState);
+        instanceFor(storage, namespace, branchRng);
+      }
+      branchRngs.get(storage)?.setState(point.value.rngState);
+      restoreNamespace(sqlite, storageNamespace(storage), point.value.snapshot);
+      captured.set(storage, point.value.snapshot);
+    } else {
+      if (!instances.has(storage)) {
+        const point = history.head(branch2);
+        const branchRng = createRng(options.seed ?? 0);
+        if (point)
+          branchRng.setState(point.value.rngState);
+        instanceFor(storage, namespace, branchRng);
+      }
+    }
+    return storage;
+  };
+  const checkpoint = (namespace = DEFAULT_NAMESPACE, branch2 = "main") => {
+    const storage = ensureBranch(namespace, branch2);
+    return timeline(namespace).commit(capture(storage), { branch: branch2 });
+  };
+  const branch = (name, branchOptions = {}) => {
+    const namespace = branchOptions.namespace ?? DEFAULT_NAMESPACE;
+    ensureBranch(namespace, name, branchOptions.at);
+    const head = timeline(namespace).head(name);
+    if (!head)
+      throw new RangeError(`branch ${name} has no checkpoint`);
+    return head;
+  };
+  const checkout = (checkpointId, checkoutOptions = {}) => {
+    const namespace = checkoutOptions.namespace ?? DEFAULT_NAMESPACE;
+    const branchName = checkoutOptions.branch ?? "main";
+    const history = timeline(namespace);
+    const point = history.checkout(branchName, checkpointId);
+    const storage = ensureBranch(namespace, branchName);
+    restoreNamespace(sqlite, storageNamespace(storage), point.value.snapshot);
+    captured.set(storage, point.value.snapshot);
+    clock.set(point.value.clock.now);
+    if (point.value.clock.frozen)
+      clock.freeze();
+    else
+      clock.unfreeze();
+    (branchRngs.get(storage) ?? rng).setState(point.value.rngState);
+  };
+  const reset = async (name = DEFAULT_NAMESPACE) => {
+    if (name === "*") {
+      options.webhooks?.clear();
+      for (const each of instances.values())
+        await each.reset();
+      timelines.clear();
+      branchStorage.clear();
+      branchRngs.clear();
+      captured.clear();
+      return;
+    }
+    options.webhooks?.clear(name);
+    const target = instances.get(name);
+    if (target)
+      await target.reset();
+    else
+      clearNamespace(sqlite, storageNamespace(name));
+    for (const [mapping, storage] of branchStorage) {
+      if (!mapping.startsWith(`${name}\0`))
+        continue;
+      const branchInstance = instances.get(storage);
+      if (branchInstance)
+        await branchInstance.reset();
+      else
+        clearNamespace(sqlite, storageNamespace(storage));
+      branchStorage.delete(mapping);
+      branchRngs.delete(storage);
+      captured.delete(storage);
+    }
+    timelines.delete(name);
+    captured.delete(name);
+  };
+  const snapshot = (name = DEFAULT_NAMESPACE) => {
+    return checkpoint(name, "main").value.snapshot;
+  };
+  const restore = (from, name = DEFAULT_NAMESPACE) => {
+    instance(name);
+    restoreNamespace(sqlite, storageNamespace(name), from);
+    captured.set(name, from);
+    const history = timelines.get(name);
+    if (history)
+      history.commit(capture(name), { branch: "main" });
+    else
+      timeline(name);
+  };
+  const runtime = {
+    name: options.name,
+    sqlite,
+    clock,
+    faults,
+    metrics,
+    journal,
+    rng,
+    credentials,
+    webhooks: options.webhooks,
+    applyPreset: (name, namespace = DEFAULT_NAMESPACE, overrides = {}) => {
+      const preset = options.presets?.[name];
+      if (!preset)
+        throw new RangeError(`no fault preset ${JSON.stringify(name)}`);
+      const added = (preset.rules ?? []).map((rule, index) => faults.add({
+        namespace,
+        ...rule,
+        ...overrides,
+        preset: name,
+        id: `${overrides.id ?? name}${(preset.rules ?? []).length > 1 ? `_${index + 1}` : ""}`
+      }));
+      if (preset.webhook && options.webhooks) {
+        options.webhooks.fault(namespace, {
+          ...preset.webhook,
+          ...overrides.count !== void 0 ? { count: overrides.count } : {}
+        });
+      }
+      return added;
+    },
+    instance,
+    namespaces: () => [...publicNamespaces].sort(),
+    reset,
+    snapshot,
+    restore,
+    checkpoint,
+    branch,
+    checkout,
+    timeline,
+    fetch: async (incoming) => {
+      let request = incoming;
+      const prefixed = PATH_PREFIX.exec(new URL(request.url).pathname);
+      if (prefixed) {
+        const url2 = new URL(request.url);
+        url2.pathname = prefixed[2] ?? "/";
+        const headers = new Headers(request.headers);
+        if (!headers.has(NAMESPACE_HEADER)) {
+          headers.set(NAMESPACE_HEADER, decodeURIComponent(prefixed[1]));
+        }
+        const hasBody = request.method !== "GET" && request.method !== "HEAD";
+        request = new Request(url2, {
+          method: request.method,
+          headers,
+          ...hasBody ? { body: await request.arrayBuffer() } : {},
+          signal: request.signal
+        });
+      }
+      let namespace = control.namespaceOf(request);
+      if (!request.headers.has(NAMESPACE_HEADER) && options.credential) {
+        const credential = options.credential(request);
+        const mapped = credential !== void 0 ? credentials.get(credential) : void 0;
+        if (mapped !== void 0)
+          namespace = mapped;
+      }
+      const selectedBranch = request.headers.get(BRANCH_HEADER) ?? "main";
+      const at = request.headers.get(AT_HEADER) ?? void 0;
+      const stamp = (response2) => {
+        const value = NAMESPACE_PATTERN.test(namespace) ? `${options.name}@${version}; ns=${namespace}` : `${options.name}@${version}`;
+        try {
+          response2.headers.set(MOCKINGBIRD_HEADER, value);
+          return response2;
+        } catch {
+          const copy = new Response(response2.body, response2);
+          copy.headers.set(MOCKINGBIRD_HEADER, value);
+          return copy;
+        }
+      };
+      const handled = await control.handle(request);
+      if (handled)
+        return stamp(handled);
+      const started = monotonicNow();
+      const url = new URL(request.url);
+      const operationId = operationIdFor(request, url.pathname);
+      const log = (status, faultId, response2) => {
+        const noted = response2 ? responseNotes(response2) : void 0;
+        const entry = {
+          service: options.name,
+          namespace,
+          operationId,
+          method: request.method,
+          path: url.pathname,
+          status,
+          durationMs: Math.round((monotonicNow() - started) * 100) / 100,
+          unmatched: options.document !== void 0 && operationId === void 0,
+          ...faultId !== void 0 ? { faultId } : {},
+          ...noted?.ids && Object.keys(noted.ids).length > 0 ? { ids: noted.ids } : {},
+          ...noted?.adopted ? { adopted: true } : {}
+        };
+        metrics.record(entry);
+        journal.record({ ...entry, at: new Date(clock.now()).toISOString() });
+        options.onLog?.(entry);
+      };
+      if (!NAMESPACE_PATTERN.test(namespace)) {
+        log(400);
+        return stamp(new Response(JSON.stringify({
+          error: {
+            type: "mockingbird_admin",
+            message: `${NAMESPACE_HEADER} must match ${NAMESPACE_PATTERN}`
+          }
+        }), { status: 400, headers: { "content-type": "application/json" } }));
+      }
+      if (!BRANCH_PATTERN2.test(selectedBranch)) {
+        log(400);
+        return stamp(adminFail(400, `${BRANCH_HEADER} must match ${BRANCH_PATTERN2}`));
+      }
+      let storage;
+      try {
+        if (at !== void 0 && selectedBranch === "main" && !MUTATING_METHODS.has(request.method)) {
+          const point = timeline(namespace).get(at);
+          storage = physicalBranch(namespace, `at_${at}`);
+          let viewRng = branchRngs.get(storage);
+          if (!viewRng) {
+            viewRng = createRng(options.seed ?? 0);
+            instanceFor(storage, namespace, viewRng);
+          }
+          viewRng.setState(point.value.rngState);
+          restoreNamespace(sqlite, storageNamespace(storage), point.value.snapshot);
+          captured.set(storage, point.value.snapshot);
+        } else {
+          storage = ensureBranch(namespace, selectedBranch, at);
+        }
+      } catch (error) {
+        log(409);
+        return stamp(adminFail(409, error instanceof Error ? error.message : String(error)));
+      }
+      const hits = await faults.take({
+        operationId,
+        method: request.method,
+        path: url.pathname,
+        namespace
+      });
+      const final = hits.find((hit) => hit.drop || hit.response);
+      if (final?.drop) {
+        log(0, final.id);
+        throw new DroppedConnectionError();
+      }
+      if (final?.response) {
+        log(final.response.status, final.id);
+        return stamp(final.response);
+      }
+      const fired = hits.filter((hit) => hit.effect !== void 0);
+      if (fired.length > 0)
+        effects.set(request, fired.map((hit) => hit.effect));
+      let response = await instanceFor(storage, namespace).fetch(request);
+      if (MUTATING_METHODS.has(request.method) && response.status >= 200 && response.status < 400) {
+        const point = timeline(namespace).commit(capture(storage), { branch: selectedBranch });
+        response = mutableResponse(response);
+        response.headers.set(CHECKPOINT_HEADER, point.id);
+      }
+      if (selectedBranch !== "main") {
+        response = mutableResponse(response);
+        response.headers.set(BRANCH_HEADER, selectedBranch);
+      }
+      if (at !== void 0) {
+        response = mutableResponse(response);
+        response.headers.set(AT_HEADER, at);
+      }
+      log(response.status, fired[0]?.id, response);
+      return stamp(response);
+    }
+  };
+  const control = createControlPlane({
+    name: options.name,
+    startedAt: wallNow(),
+    wallNow,
+    clock,
+    faults,
+    metrics,
+    journal,
+    defaultNamespace: DEFAULT_NAMESPACE,
+    namespaces: runtime.namespaces,
+    reset,
+    timeTravel: {
+      checkpoint: (name, branchName) => {
+        const point = checkpoint(name, branchName);
+        return {
+          id: point.id,
+          branch: point.branch,
+          parent: point.parent,
+          at: point.at,
+          records: point.value.snapshot.records.length
+        };
+      },
+      branch: (branchName, branchOptions) => {
+        const point = branch(branchName, branchOptions);
+        return { id: point.id, branch: point.branch, parent: point.parent, at: point.at };
+      },
+      checkout: (checkpointId, checkoutOptions) => checkout(checkpointId, checkoutOptions),
+      retain: (name, checkpointId) => {
+        timeline(name).retain(checkpointId);
+      },
+      release: (name, checkpointId) => timeline(name).release(checkpointId),
+      inspect: (name) => {
+        const history = timeline(name);
+        return {
+          branches: history.branches(),
+          checkpoints: history.checkpoints().map(({ id, branch: branchName, parent, at }) => ({
+            id,
+            branch: branchName,
+            parent,
+            at
+          }))
+        };
+      }
+    },
+    describe: options.describe ?? (() => ({})),
+    ...options.presets ? {
+      applyPreset: (name, namespace, overrides) => runtime.applyPreset(name, namespace, overrides)
+    } : {},
+    routes: {
+      ...credentialRoutes(credentials),
+      ...options.presets ? presetRoutes(options.presets, runtime) : {},
+      ...options.webhooks ? webhookAdminRoutes(options.webhooks) : {},
+      ...options.admin?.(runtime) ?? {}
+    },
+    adminKey: options.adminKey
+  });
+  return runtime;
+};
+var mutableResponse = (response) => {
+  try {
+    response.headers.set("x-mockingbird-mutable-probe", "1");
+    response.headers.delete("x-mockingbird-mutable-probe");
+    return response;
+  } catch {
+    return new Response(response.body, response);
+  }
+};
+var adminJson = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+var adminFail = (status, message) => adminJson(status, { error: { type: "mockingbird_admin", message } });
+var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var credentialRoutes = (registry) => ({
+  "GET /credentials": () => adminJson(200, {
+    credentials: registry.entries().map(({ credential, namespace }) => ({
+      credential: maskCredential(credential),
+      namespace
+    }))
+  }),
+  "PUT /credentials": ({ body, namespace }) => {
+    const pairs = [];
+    const list = Array.isArray(body) ? body : isObject(body) ? body.credentials : void 0;
+    if (Array.isArray(list)) {
+      for (const each of list) {
+        if (typeof each === "string")
+          pairs.push([each, namespace]);
+        else if (isObject(each) && typeof each.credential === "string") {
+          pairs.push([
+            each.credential,
+            typeof each.namespace === "string" ? each.namespace : namespace
+          ]);
+        } else
+          return adminFail(400, "each entry is a credential string or {credential, namespace}");
+      }
+    } else if (isObject(list)) {
+      for (const [credential, target] of Object.entries(list)) {
+        if (typeof target !== "string")
+          return adminFail(400, `namespace for ${credential} must be a string`);
+        pairs.push([credential, target]);
+      }
+    } else if (isObject(body) && typeof body.credential === "string") {
+      pairs.push([body.credential, typeof body.namespace === "string" ? body.namespace : namespace]);
+    } else {
+      return adminFail(400, 'expected {"credentials": {"<credential>": "<namespace>"}}');
+    }
+    for (const [credential, target] of pairs) {
+      if (!NAMESPACE_PATTERN.test(target))
+        return adminFail(400, `bad namespace ${JSON.stringify(target)}`);
+      registry.set(credential, target);
+    }
+    return adminJson(200, { mapped: pairs.length });
+  },
+  "DELETE /credentials": ({ url }) => {
+    const credential = url.searchParams.get("credential");
+    if (credential === null)
+      registry.clear();
+    else
+      registry.remove(credential);
+    return adminJson(200, { status: "ok" });
+  }
+});
+var presetRoutes = (presets, runtime) => ({
+  "GET /faults/presets": () => adminJson(200, {
+    presets: Object.entries(presets).map(([name, preset]) => ({ name, ...preset }))
+  }),
+  "POST /faults/presets/:name": ({ params, body, namespace }) => {
+    const name = params.name;
+    if (!presets[name])
+      return adminFail(404, `no fault preset ${name}; GET /__admin/faults/presets`);
+    const overrides = isObject(body) ? body : {};
+    return adminJson(201, { preset: name, rules: runtime.applyPreset(name, namespace, overrides) });
+  }
+});
+
+// src/behavior.ts
+var OAUTH_SCENARIOS = {
+  apple_private_relay: { apple: { emailMode: "hide" } },
+  apple_share_email: { apple: { emailMode: "share" } },
+  apple_returning_user: { apple: { omitUser: true } },
+  apple_boolean_claims: { apple: { booleanClaims: "boolean" } },
+  microsoft_missing_email: { claims: { omitEmail: true } },
+  microsoft_spa_expiry: { tokens: { refreshTtlSeconds: 86400 } },
+  github_unverified_email: { claims: { unverifiedEmail: true } },
+  missing_email: { claims: { omitEmail: true } },
+  missing_name: { claims: { omitName: true } },
+  unverified_email: { claims: { unverifiedEmail: true } },
+  google_no_refresh_token: { google: { refreshToken: "never" } },
+  google_reauthentication: { tokens: { refreshError: "invalid_rapt" } },
+  revoked_refresh_token: { tokens: { refreshError: "invalid_grant" } },
+  rotating_refresh_tokens: { tokens: { refreshRotation: "rotate" } },
+  short_lived_tokens: { tokens: { accessTtlSeconds: 5, codeTtlSeconds: 5, refreshTtlSeconds: 30 } },
+  consent_denied: { consent: { error: "access_denied" } },
+  intermittent_token_failure: { probabilities: { tokenUnavailable: 0.25 } }
+};
+var object = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+var keys = (value, allowed) => {
+  for (const k of Object.keys(value))
+    if (!allowed.includes(k)) throw new Error(`Unknown behavior option: ${k}`);
+};
+var enumeration = (v, values) => {
+  if (v !== void 0 && !values.includes(v))
+    throw new Error(`Expected one of ${values.join(", ")}`);
+};
+var strings = (v) => {
+  if (v !== void 0 && (!Array.isArray(v) || v.some((s) => typeof s !== "string" || !s || /\s/.test(s))))
+    throw new Error("Scopes must be nonempty strings without whitespace");
+};
+function validateBehavior(input) {
+  if (!object(input)) throw new Error("Behavior must be an object");
+  keys(input, [
+    "preset",
+    "session",
+    "probabilities",
+    "apple",
+    "google",
+    "claims",
+    "consent",
+    "tokens",
+    "additionalScopes"
+  ]);
+  if (input.preset !== void 0 && (typeof input.preset !== "string" || !Object.hasOwn(OAUTH_SCENARIOS, input.preset)))
+    throw new Error("Unknown OAuth scenario");
+  for (const key of ["probabilities", "apple", "google", "claims", "consent", "tokens", "session"])
+    if (input[key] !== void 0 && !object(input[key])) throw new Error(`${key} must be an object`);
+  const session = input.session;
+  if (session) {
+    keys(session, ["reuseLastAccount"]);
+    enumeration(session.reuseLastAccount, [true, false]);
+  }
+  const p = input.probabilities;
+  if (p) {
+    keys(p, [
+      "hideEmail",
+      "omitEmail",
+      "omitName",
+      "unverifiedEmail",
+      "denyConsent",
+      "tokenUnavailable",
+      "invalidGrant"
+    ]);
+    for (const v of Object.values(p))
+      if (typeof v !== "number" || !Number.isFinite(v) || v < 0 || v > 1)
+        throw new Error("Probabilities must be finite numbers in [0,1]");
+  }
+  const apple = input.apple;
+  if (apple) {
+    keys(apple, ["emailMode", "booleanClaims", "omitUser"]);
+    enumeration(apple.emailMode, ["choose", "hide", "share"]);
+    enumeration(apple.booleanClaims, ["string", "boolean"]);
+    enumeration(apple.omitUser, [true, false]);
+  }
+  const google = input.google;
+  if (google) {
+    keys(google, ["refreshToken", "testing", "maxRefreshTokens"]);
+    enumeration(google.refreshToken, ["first-consent", "always", "never"]);
+    enumeration(google.testing, [true, false]);
+    if (google.maxRefreshTokens !== void 0 && (typeof google.maxRefreshTokens !== "number" || !Number.isSafeInteger(google.maxRefreshTokens) || google.maxRefreshTokens < 1 || google.maxRefreshTokens > 1e3))
+      throw new Error("maxRefreshTokens must be an integer in [1,1000]");
+  }
+  const claims = input.claims;
+  if (claims) {
+    keys(claims, ["omitEmail", "omitName", "unverifiedEmail"]);
+    for (const v of Object.values(claims)) enumeration(v, [true, false]);
+  }
+  const consent = input.consent;
+  if (consent) {
+    keys(consent, ["deniedScopes", "error"]);
+    strings(consent.deniedScopes);
+    enumeration(consent.error, ["access_denied", "interaction_required", "temporarily_unavailable"]);
+  }
+  const tokens = input.tokens;
+  if (tokens) {
+    keys(tokens, [
+      "accessTtlSeconds",
+      "codeTtlSeconds",
+      "refreshTtlSeconds",
+      "refreshRotation",
+      "refreshError"
+    ]);
+    enumeration(tokens.refreshRotation, ["reuse", "rotate"]);
+    enumeration(tokens.refreshError, ["invalid_grant", "invalid_rapt"]);
+    for (const key of ["accessTtlSeconds", "codeTtlSeconds", "refreshTtlSeconds"]) {
+      const v = tokens[key];
+      if (v !== void 0 && (typeof v !== "number" || !Number.isSafeInteger(v) || v < 1 || v > 31536e4))
+        throw new Error(`${key} must be an integer in [1,315360000]`);
+    }
+  }
+  strings(input.additionalScopes);
+  const { preset, ...config } = input;
+  const base = preset ? structuredClone(OAUTH_SCENARIOS[preset]) : {};
+  return {
+    ...base,
+    ...structuredClone(config),
+    ...Object.fromEntries(
+      ["probabilities", "apple", "google", "claims", "consent", "tokens", "session"].filter((k) => k in base || k in config).map((k) => [
+        k,
+        {
+          ...base[k],
+          ...config[k]
+        }
+      ])
+    )
+  };
+}
+var BehaviorState = class {
+  constructor(sqlite, namespace, seed, initial) {
+    this.seed = seed;
+    this.state = new Collection(sqlite, namespace, "oauth_behavior");
+    if (!this.state.has("state")) this.configure(initial);
+  }
+  seed;
+  state;
+  configure(input) {
+    const config = validateBehavior(input);
+    this.state.insert("state", { config, cursor: 0, events: [] });
+    return config;
+  }
+  get config() {
+    return this.state.get("state")?.config ?? {};
+  }
+  get events() {
+    return this.state.get("state")?.events ?? [];
+  }
+  sample(stage, names) {
+    const state = this.state.get("state") ?? { config: {}, cursor: 0, events: [] };
+    const sequence = state.cursor++;
+    const outcomes = Object.fromEntries(
+      names.map((name) => [
+        name,
+        seedFrom(`${this.seed}:${sequence}:${name}`) / 4294967296 < (state.config.probabilities?.[name] ?? 0)
+      ])
+    );
+    state.events.push({ sequence, stage, outcomes });
+    state.events = state.events.slice(-100);
+    this.state.insert("state", state);
+    return outcomes;
+  }
+  decisions() {
+    const sampled = this.sample("authorization", [
+      "hideEmail",
+      "omitEmail",
+      "omitName",
+      "unverifiedEmail",
+      "denyConsent"
+    ]);
+    return {
+      hideEmail: sampled.hideEmail ?? false,
+      omitEmail: !!(sampled.omitEmail || this.config.claims?.omitEmail),
+      omitName: !!(sampled.omitName || this.config.claims?.omitName),
+      unverifiedEmail: !!(sampled.unverifiedEmail || this.config.claims?.unverifiedEmail),
+      denyConsent: sampled.denyConsent ?? false
+    };
+  }
+};
+
+// src/crypto.ts
+var encoder = new TextEncoder();
+var base64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var random = () => base64url(crypto.getRandomValues(new Uint8Array(32)));
+var hash = async (value) => base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(value))));
+var Signer = class {
+  pair = crypto.subtle.generateKey(
+    {
+      name: "RSASSA-PKCS1-v1_5",
+      modulusLength: 2048,
+      publicExponent: new Uint8Array([1, 0, 1]),
+      hash: "SHA-256"
+    },
+    true,
+    ["sign", "verify"]
+  );
+  kid = random();
+  async jwks() {
+    const pair = await this.pair;
+    return {
+      keys: [
+        {
+          ...await crypto.subtle.exportKey("jwk", pair.publicKey),
+          kid: this.kid,
+          use: "sig",
+          alg: "RS256"
+        }
+      ]
+    };
+  }
+  async sign(claims) {
+    const header = base64url(
+      encoder.encode(JSON.stringify({ alg: "RS256", kid: this.kid, typ: "JWT" }))
+    );
+    const payload = base64url(encoder.encode(JSON.stringify(claims)));
+    const input = `${header}.${payload}`;
+    const signature = await crypto.subtle.sign(
+      "RSASSA-PKCS1-v1_5",
+      (await this.pair).privateKey,
+      encoder.encode(input)
+    );
+    return `${input}.${base64url(new Uint8Array(signature))}`;
+  }
+};
+var halfHash = async (value) => base64url(
+  new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(value))).slice(0, 16)
+);
+async function verifyAppleSecret(token, clientId, apple, now) {
+  try {
+    const parts = token.split(".");
+    const [header, payload, signature] = parts;
+    if (parts.length !== 3 || !header || !payload || !signature) return false;
+    const decode = (value) => Uint8Array.from(atob(value.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0));
+    const h = JSON.parse(new TextDecoder().decode(decode(header)));
+    const p = JSON.parse(new TextDecoder().decode(decode(payload)));
+    const seconds = Math.floor(now / 1e3);
+    if (h.alg !== "ES256" || h.kid !== apple.keyId || p.iss !== apple.teamId || p.sub !== clientId || p.aud !== "https://appleid.apple.com" || typeof p.iat !== "number" || typeof p.exp !== "number" || p.iat > seconds + 60 || p.exp <= seconds || p.exp <= p.iat || p.exp - p.iat > 15777e3)
+      return false;
+    const key = await crypto.subtle.importKey(
+      "jwk",
+      apple.publicKey,
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      ["verify"]
+    );
+    return await crypto.subtle.verify(
+      { name: "ECDSA", hash: "SHA-256" },
+      key,
+      decode(signature),
+      encoder.encode(`${header}.${payload}`)
+    );
+  } catch {
+    return false;
+  }
+}
+
+// src/ui.ts
+var escapeHtml = (value) => value.replace(
+  /[&<>"']/g,
+  (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c] ?? c
+);
+var style = `
+:root{color-scheme:light dark;--bg:#fafafa;--card:#fff;--ink:#18181b;--muted:#62626b;--line:#dedee3;--soft:#f4f4f5;--accent:#27272a;--on-accent:#fff;--error:#a82d32;font-family:ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif}
+@media(prefers-color-scheme:dark){:root{--bg:#111113;--card:#19191c;--ink:#f4f4f5;--muted:#a9a9b2;--line:#36363c;--soft:#242428;--accent:#e4e4e7;--on-accent:#18181b;--error:#ffaaaa}}
+.privacy{border:1px solid var(--line);border-radius:12px;padding:14px;margin:0 0 20px}.privacy legend{font-size:13px;font-weight:600;padding:0 5px}.privacy label{display:flex;align-items:flex-start;gap:10px;margin:10px 0;font-size:14px;cursor:pointer}.privacy input{width:18px;height:18px;min-height:18px;accent-color:var(--accent);flex-shrink:0}.privacy small{display:block;font-size:12px;font-weight:400;color:var(--muted);line-height:1.6;margin-top:3px}*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--ink);min-height:100svh;display:flex;flex-direction:column}a{color:var(--accent);text-underline-offset:4px}header{padding:28px 5vw;display:flex;align-items:center;gap:12px;font-size:15px;font-weight:650;letter-spacing:-.3px}.mark{display:grid;place-items:center;width:34px;height:34px;border-radius:11px;background:var(--accent);color:var(--on-accent);font-size:21px}.badge{margin-left:auto;border:1px solid var(--line);border-radius:30px;padding:7px 12px;font-size:11px;font-weight:500;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}main{width:min(100% - 32px,460px);margin:auto; padding:35px 0 55px}.card{background:var(--card);border:1px solid var(--line);border-radius:12px;padding:28px}.eyebrow{font-size:11px;text-transform:uppercase;letter-spacing:.16em;color:var(--accent);font-weight:700}h1{font-size:30px;line-height:1.18;letter-spacing:-.5px;font-weight:600;margin:16px 0 12px}p{line-height:1.65;color:var(--muted);font-size:14px;margin:0 0 24px}.app{color:var(--ink);font-weight:600}.accounts{display:grid;gap:10px;margin:26px 0}button,input{font:inherit}button{cursor:pointer}button:disabled{opacity:.55;cursor:wait}.account{width:100%;display:flex;gap:13px;align-items:center;text-align:left;background:var(--card);border:1px solid var(--line);border-radius:13px;padding:14px;color:var(--ink)}.account:hover{background:var(--soft);border-color:var(--accent)}.avatar{flex-shrink:0;display:grid;place-items:center;width:40px;height:40px;background:var(--soft);color:var(--accent);border-radius:50%;font-size:15px;font-weight:600}.identity{min-width:0;flex:1}.identity strong,.identity small{display:block;overflow-wrap:anywhere}.identity strong{font-size:14px;font-weight:600}.identity small{font-size:12px;color:var(--muted);margin-top:4px}.arrow{color:var(--muted)}.primary,.secondary{width:100%;min-height:46px;border-radius:11px;padding:12px 16px;font-weight:600;font-size:14px}.primary{background:var(--accent);color:var(--on-accent);border:1px solid var(--accent)}.primary:hover{filter:brightness(1.08)}.secondary{background:transparent;color:var(--ink);border:1px solid var(--line);margin-top:10px}.secondary:hover{background:var(--soft)}label{display:block;font-size:13px;font-weight:600;margin:18px 0 7px}input{width:100%;min-height:46px;border:1px solid var(--line);border-radius:10px;background:var(--card);color:var(--ink);padding:11px 13px;font-size:15px}input:focus{border-color:var(--accent)}:is(a,button,input,select,textarea,summary,[tabindex="0"]):focus-visible{outline:3px solid var(--accent);outline-offset:4px}h1[tabindex="-1"]:focus{outline:none}form{margin:0}.fields{margin:24px 0}.note{font-size:12px;text-align:center;margin:22px 8px 0;line-height:1.7}.divider{height:1px;background:var(--line);margin:25px 0}footer{display:flex;justify-content:center;gap:20px;padding:24px;font-size:11px;color:var(--muted)}.error{color:var(--error);background:var(--soft);border-radius:10px;padding:12px;font-size:13px;margin:18px 0}.permissions{padding:0;list-style:none;margin:22px 0}.permissions li{padding:13px 0;border-bottom:1px solid var(--line);font-size:14px;display:flex;gap:12px}.check{color:var(--accent)}.back{display:block;text-align:center;font-size:13px;margin-top:20px}.empty{padding:20px 0}.skip{position:absolute;top:-100px;left:16px;background:var(--card);padding:12px;z-index:2}.skip:focus{top:10px}@media(max-width:480px){header{padding:20px}.card{padding:26px 23px}main{padding-top:18px}h1{font-size:28px}}@media(prefers-reduced-motion:no-preference){button{transition:background .15s,border-color .15s}.card{animation:arrive .2s ease-out}@keyframes arrive{from{opacity:0;transform:translateY(5px)}to{opacity:1;transform:translateY(0)}}}
+:root:has(input[name="oauth-theme"][value="light"]:checked){color-scheme:light;--bg:#fafafa;--card:#fff;--ink:#18181b;--muted:#62626b;--line:#dedee3;--soft:#f4f4f5;--accent:#27272a;--on-accent:#fff;--error:#a82d32}
+:root:has(input[name="oauth-theme"][value="dark"]:checked){color-scheme:dark;--bg:#111113;--card:#19191c;--ink:#f4f4f5;--muted:#a9a9b2;--line:#36363c;--soft:#242428;--accent:#e4e4e7;--on-accent:#18181b;--error:#ffaaaa}
+.theme{border:0;padding:0;display:flex;gap:16px;align-items:center}.theme legend{float:left;margin-right:16px;padding:0}.theme label{display:flex;align-items:center;gap:5px;margin:0;font-weight:400;font-size:12px}.theme input{width:14px;height:14px;min-height:0;margin:0;padding:0;accent-color:var(--accent)}
+
+`;
+function page(title, body, status = 200, action = "'self'", nonce = crypto.randomUUID()) {
+  return new Response(
+    `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="light dark"><title>${escapeHtml(title)} \xB7 OAuth Mock</title><style nonce="${nonce}">${style}</style></head><body><a class="skip" href="#main">Skip to content</a><header><span>OAuth Mock</span></header><main id="main"><section class="card" aria-labelledby="title">${body}</section><p class="note">Test accounts only.</p></main><footer><fieldset class="theme"><legend>Appearance</legend><label><input type="radio" name="oauth-theme" value="system" checked>System</label><label><input type="radio" name="oauth-theme" value="light">Light</label><label><input type="radio" name="oauth-theme" value="dark">Dark</label></fieldset></footer><script nonce="${nonce}">(()=>{const root=document.documentElement;const inputs=document.querySelectorAll('input[name="oauth-theme"]');const apply=value=>{root.dataset.theme=value;for(const input of inputs)input.checked=input.value===value;try{sessionStorage.setItem('oauth-mock-theme',value)}catch{}};try{const saved=sessionStorage.getItem('oauth-mock-theme');if(['system','light','dark'].includes(saved))apply(saved)}catch{}for(const input of inputs)input.addEventListener('change',()=>apply(input.value))})()</script></body></html>`,
+    {
+      status,
+      headers: {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store",
+        "referrer-policy": "same-origin",
+        "x-content-type-options": "nosniff",
+        "content-security-policy": `default-src 'none'; style-src 'nonce-${nonce}'; script-src 'nonce-${nonce}'; form-action ${action}; base-uri 'none'; frame-ancestors 'none'`
+      }
+    }
+  );
+}
+function loginPage(transaction, client, accounts, base, signup = false, error = "") {
+  const hidden = `<input type="hidden" name="transaction" value="${escapeHtml(transaction)}">`;
+  const endpoint = escapeHtml(`${base}/interaction`);
+  const intro = `<span class="eyebrow">Sign in</span><h1 id="title">${signup ? "Create your account" : "Choose an account"}</h1><p>${signup ? "Create an account to continue to" : "Choose an account to continue to"}<br><span class="app">${escapeHtml(client)}</span></p>${error ? `<div class="error" role="alert">${escapeHtml(error)}</div>` : ""}`;
+  const body = signup ? `<form method="post" action="${endpoint}">${hidden}<input type="hidden" name="action" value="signup"><div class="fields"><label for="name">Full name</label><input id="name" name="name" autocomplete="name" required maxlength="120"><label for="email">Email address</label><input id="email" name="email" type="email" autocomplete="email" required maxlength="254" aria-describedby="email-help"><p id="email-help" class="note">Use a fictional address. No email will be sent.</p></div><button class="primary">Create account &amp; continue</button></form><a class="back" href="${endpoint}?transaction=${escapeHtml(transaction)}">Back to accounts</a>` : `<div class="accounts">${accounts.map((a) => `<form method="post" action="${endpoint}">${hidden}<input type="hidden" name="action" value="select"><button class="account" name="account" value="${escapeHtml(a.id)}"><span class="avatar" aria-hidden="true">${escapeHtml(a.name.slice(0, 1).toUpperCase())}</span><span class="identity"><strong>${escapeHtml(a.name)}</strong><small>${escapeHtml(a.email)}</small></span><span class="arrow" aria-hidden="true">\u2192</span></button></form>`).join("") || '<p class="empty">No accounts yet. Create your first test identity below.</p>'}</div><form method="get" action="${endpoint}">${hidden}<input type="hidden" name="screen" value="signup"><button class="secondary">\uFF0B Create a new account</button></form>`;
+  return page(
+    signup ? "Create account" : "Choose an account",
+    `${intro}${body}<div class="divider"></div><form method="post" action="${endpoint}">${hidden}<button class="secondary" name="action" value="deny">Cancel sign-in</button></form>`,
+    error ? 400 : 200
+  );
+}
+function consentPage(transaction, client, account, scopes2, base, privacy) {
+  const labels = {
+    openid: "Confirm your identity",
+    email: "View your email address",
+    profile: "View your name and profile",
+    name: "View your name",
+    offline_access: "Stay connected when you\u2019re away"
+  };
+  const privacyFields = privacy ? privacy.choice ? `<fieldset class="privacy"><legend>Choose what to share</legend><label><input type="radio" name="email_choice" value="share" ${!privacy.hideEmail ? "checked" : ""}><span>Share my email<small>Your app will receive ${escapeHtml(account.email)}.</small></span></label><label><input type="radio" name="email_choice" value="hide" ${privacy.hideEmail ? "checked" : ""}><span>Hide my email<small>Use a private relay address to keep your email private.</small></span></label></fieldset>` : `<p>${privacy.hideEmail ? "A private relay address will be shared with this app." : "Your email address will be shared with this app."}</p>` : "";
+  return page(
+    "Review access",
+    `<span class="eyebrow">Permissions</span><h1 id="title">Review access</h1><p><span class="app">${escapeHtml(client)}</span> would like access to your account.</p><div class="account"><span class="avatar" aria-hidden="true">${escapeHtml(account.name.slice(0, 1))}</span><span class="identity"><strong>${escapeHtml(account.name)}</strong><small>${escapeHtml(account.email)}</small></span></div><ul class="permissions">${scopes2.split(" ").filter(Boolean).map(
+      (s) => `<li><span class="check" aria-hidden="true">\u2713</span>${escapeHtml(labels[s] ?? s)}</li>`
+    ).join(
+      ""
+    )}</ul><p>You can cancel now without sharing anything.</p><form method="post" action="${escapeHtml(base)}/interaction"><input type="hidden" name="transaction" value="${escapeHtml(transaction)}">${privacyFields}<button class="primary" name="action" value="allow">Allow &amp; continue</button><button class="secondary" name="action" value="deny">Cancel</button></form>`
+  );
+}
+
+// src/generated/openapi.ts
+var document = JSON.parse(`{"openapi":"3.1.0","info":{"title":"Mockingbird OAuth & Social Login","version":"1.0.0"},"paths":{"/.well-known/openid-configuration":{"get":{"operationId":"Discovery","summary":"Discovery","x-mockingbird":{"parity":{"enabled":true,"reason":"Google, Apple and Microsoft discovery metadata is checked against their public live endpoints by scripts/parity.ts."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/jwks":{"get":{"operationId":"Jwks","summary":"Jwks","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/authorize":{"get":{"operationId":"Authorize","summary":"Authorize","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"text/html":{"schema":{"type":"string"}}}},"302":{"description":"302","content":{"text/html":{"schema":{"type":"string"}}}},"400":{"description":"400","content":{"text/html":{"schema":{"type":"string"}}}},"401":{"description":"401","content":{"text/html":{"schema":{"type":"string"}}}},"403":{"description":"403","content":{"text/html":{"schema":{"type":"string"}}}},"404":{"description":"404","content":{"text/html":{"schema":{"type":"string"}}}},"503":{"description":"503","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/interaction":{"get":{"operationId":"InteractionPage","summary":"InteractionPage","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"text/html":{"schema":{"type":"string"}}}},"302":{"description":"302","content":{"text/html":{"schema":{"type":"string"}}}},"400":{"description":"400","content":{"text/html":{"schema":{"type":"string"}}}},"401":{"description":"401","content":{"text/html":{"schema":{"type":"string"}}}},"403":{"description":"403","content":{"text/html":{"schema":{"type":"string"}}}},"404":{"description":"404","content":{"text/html":{"schema":{"type":"string"}}}},"503":{"description":"503","content":{"text/html":{"schema":{"type":"string"}}}}}},"post":{"operationId":"Interact","summary":"Interact","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"text/html":{"schema":{"type":"string"}}}},"302":{"description":"302","content":{"text/html":{"schema":{"type":"string"}}}},"400":{"description":"400","content":{"text/html":{"schema":{"type":"string"}}}},"401":{"description":"401","content":{"text/html":{"schema":{"type":"string"}}}},"403":{"description":"403","content":{"text/html":{"schema":{"type":"string"}}}},"404":{"description":"404","content":{"text/html":{"schema":{"type":"string"}}}},"503":{"description":"503","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/token":{"post":{"operationId":"Token","summary":"Token","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/userinfo":{"get":{"operationId":"UserInfo","summary":"UserInfo","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}},"post":{"operationId":"UserInfoPost","summary":"UserInfo","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/revoke":{"post":{"operationId":"Revoke","summary":"Revoke","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/o/oauth2/v2/auth":{"get":{"operationId":"GoogleAuthorize","summary":"Authorize","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"text/html":{"schema":{"type":"string"}}}},"302":{"description":"302","content":{"text/html":{"schema":{"type":"string"}}}},"400":{"description":"400","content":{"text/html":{"schema":{"type":"string"}}}},"401":{"description":"401","content":{"text/html":{"schema":{"type":"string"}}}},"403":{"description":"403","content":{"text/html":{"schema":{"type":"string"}}}},"404":{"description":"404","content":{"text/html":{"schema":{"type":"string"}}}},"503":{"description":"503","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/o/oauth2/auth":{"get":{"operationId":"GoogleLegacyAuthorize","summary":"Authorize","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"text/html":{"schema":{"type":"string"}}}},"302":{"description":"302","content":{"text/html":{"schema":{"type":"string"}}}},"400":{"description":"400","content":{"text/html":{"schema":{"type":"string"}}}},"401":{"description":"401","content":{"text/html":{"schema":{"type":"string"}}}},"403":{"description":"403","content":{"text/html":{"schema":{"type":"string"}}}},"404":{"description":"404","content":{"text/html":{"schema":{"type":"string"}}}},"503":{"description":"503","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/auth/authorize":{"get":{"operationId":"AppleAuthorize","summary":"Authorize","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"text/html":{"schema":{"type":"string"}}}},"302":{"description":"302","content":{"text/html":{"schema":{"type":"string"}}}},"400":{"description":"400","content":{"text/html":{"schema":{"type":"string"}}}},"401":{"description":"401","content":{"text/html":{"schema":{"type":"string"}}}},"403":{"description":"403","content":{"text/html":{"schema":{"type":"string"}}}},"404":{"description":"404","content":{"text/html":{"schema":{"type":"string"}}}},"503":{"description":"503","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/auth/token":{"post":{"operationId":"AppleToken","summary":"Token","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/auth/keys":{"get":{"operationId":"AppleKeys","summary":"Jwks","x-mockingbird":{"parity":{"enabled":true,"reason":"Apple's public signing-key contract is checked by scripts/parity.ts."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/oauth2/v3/certs":{"get":{"operationId":"GoogleKeys","summary":"Jwks","x-mockingbird":{"parity":{"enabled":true,"reason":"Google's public signing-key contract is checked by scripts/parity.ts."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/v1/userinfo":{"get":{"operationId":"GoogleUserInfo","summary":"UserInfo","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}},"post":{"operationId":"GoogleUserInfoPost","summary":"UserInfo","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/oauth2/v3/userinfo":{"get":{"operationId":"GoogleV3UserInfo","summary":"UserInfo","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}},"post":{"operationId":"GoogleV3UserInfoPost","summary":"UserInfo","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/auth/revoke":{"post":{"operationId":"AppleRevoke","summary":"Revoke","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/oauth2/v2.0/authorize":{"get":{"operationId":"MicrosoftAuthorize","summary":"Authorize","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"text/html":{"schema":{"type":"string"}}}},"302":{"description":"302","content":{"text/html":{"schema":{"type":"string"}}}},"400":{"description":"400","content":{"text/html":{"schema":{"type":"string"}}}},"401":{"description":"401","content":{"text/html":{"schema":{"type":"string"}}}},"403":{"description":"403","content":{"text/html":{"schema":{"type":"string"}}}},"404":{"description":"404","content":{"text/html":{"schema":{"type":"string"}}}},"503":{"description":"503","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/oauth2/v2.0/token":{"post":{"operationId":"MicrosoftToken","summary":"Token","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/discovery/v2.0/keys":{"get":{"operationId":"MicrosoftKeys","summary":"Jwks","x-mockingbird":{"parity":{"enabled":true,"reason":"Microsoft's public signing-key contract is checked by scripts/parity.ts."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/oidc/userinfo":{"get":{"operationId":"MicrosoftUserInfo","summary":"UserInfo","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}},"post":{"operationId":"MicrosoftUserInfoPost","summary":"UserInfo","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/login/oauth/authorize":{"get":{"operationId":"GitHubAuthorize","summary":"Authorize","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"text/html":{"schema":{"type":"string"}}}},"302":{"description":"302","content":{"text/html":{"schema":{"type":"string"}}}},"400":{"description":"400","content":{"text/html":{"schema":{"type":"string"}}}},"401":{"description":"401","content":{"text/html":{"schema":{"type":"string"}}}},"403":{"description":"403","content":{"text/html":{"schema":{"type":"string"}}}},"404":{"description":"404","content":{"text/html":{"schema":{"type":"string"}}}},"503":{"description":"503","content":{"text/html":{"schema":{"type":"string"}}}}}}},"/login/oauth/access_token":{"post":{"operationId":"GitHubToken","summary":"Token","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}},"application/x-www-form-urlencoded":{"schema":{"type":"string"}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}},"application/x-www-form-urlencoded":{"schema":{"type":"string"}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}},"application/x-www-form-urlencoded":{"schema":{"type":"string"}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}},"application/x-www-form-urlencoded":{"schema":{"type":"string"}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}},"application/x-www-form-urlencoded":{"schema":{"type":"string"}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}},"application/x-www-form-urlencoded":{"schema":{"type":"string"}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}},"application/x-www-form-urlencoded":{"schema":{"type":"string"}}}}}}},"/user":{"get":{"operationId":"GitHubUser","summary":"UserInfo","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}},"post":{"operationId":"GitHubUserPost","summary":"UserInfo","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/user/emails":{"get":{"operationId":"GitHubEmails","summary":"UserInfo","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"array","items":{"type":"object","additionalProperties":true}}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}},"post":{"operationId":"GitHubEmailsPost","summary":"UserInfo","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"application/json":{"schema":{"type":"array","items":{"type":"object","additionalProperties":true}}}}},"302":{"description":"302","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"description":"400","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"401":{"description":"401","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"403":{"description":"403","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"404":{"description":"404","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"503":{"description":"503","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}}}}},"/":{"get":{"operationId":"Welcome","summary":"InteractionPage","x-mockingbird":{"parity":{"enabled":false,"reason":"Interactive OAuth transactions are exercised by protocol and independent JOSE tests."}},"responses":{"200":{"description":"200","content":{"text/html":{"schema":{"type":"string"}}}},"302":{"description":"302","content":{"text/html":{"schema":{"type":"string"}}}},"400":{"description":"400","content":{"text/html":{"schema":{"type":"string"}}}},"401":{"description":"401","content":{"text/html":{"schema":{"type":"string"}}}},"403":{"description":"403","content":{"text/html":{"schema":{"type":"string"}}}},"404":{"description":"404","content":{"text/html":{"schema":{"type":"string"}}}},"503":{"description":"503","content":{"text/html":{"schema":{"type":"string"}}}}}}}}}`);
+var operationIds = ["Discovery", "Jwks", "Authorize", "InteractionPage", "Interact", "Token", "UserInfo", "UserInfoPost", "Revoke", "GoogleAuthorize", "GoogleLegacyAuthorize", "AppleAuthorize", "AppleToken", "AppleKeys", "GoogleKeys", "GoogleUserInfo", "GoogleUserInfoPost", "GoogleV3UserInfo", "GoogleV3UserInfoPost", "AppleRevoke", "MicrosoftAuthorize", "MicrosoftToken", "MicrosoftKeys", "MicrosoftUserInfo", "MicrosoftUserInfoPost", "GitHubAuthorize", "GitHubToken", "GitHubUser", "GitHubUserPost", "GitHubEmails", "GitHubEmailsPost", "Welcome"];
+var supportedOperationIds = ["Discovery", "Jwks", "Authorize", "InteractionPage", "Interact", "Token", "UserInfo", "UserInfoPost", "Revoke", "GoogleAuthorize", "GoogleLegacyAuthorize", "AppleAuthorize", "AppleToken", "AppleKeys", "GoogleKeys", "GoogleUserInfo", "GoogleUserInfoPost", "GoogleV3UserInfo", "GoogleV3UserInfoPost", "AppleRevoke", "MicrosoftAuthorize", "MicrosoftToken", "MicrosoftKeys", "MicrosoftUserInfo", "MicrosoftUserInfoPost", "GitHubAuthorize", "GitHubToken", "GitHubUser", "GitHubUserPost", "GitHubEmails", "GitHubEmailsPost", "Welcome"];
+
+// src/runtime.ts
+var OAUTH_PRESETS = {
+  token_unavailable: {
+    description: "Token endpoint returns temporarily_unavailable",
+    rules: ["Token", "AppleToken", "MicrosoftToken", "GitHubToken"].map((operationId) => ({
+      operationId,
+      status: 503,
+      body: { error: "temporarily_unavailable" }
+    }))
+  },
+  access_denied: {
+    description: "Authorization is denied before interaction",
+    rules: [
+      "Authorize",
+      "GoogleAuthorize",
+      "GoogleLegacyAuthorize",
+      "AppleAuthorize",
+      "MicrosoftAuthorize",
+      "GitHubAuthorize"
+    ].map((operationId) => ({ operationId, status: 403, body: { error: "access_denied" } }))
+  }
+};
+function createRuntime2(options = {}) {
+  return createRuntime({
+    name: options.runtimeName ?? "oauth",
+    document,
+    presets: OAUTH_PRESETS,
+    ...options.sqlite ? { sqlite: options.sqlite } : {},
+    ...options.clock ? { clock: options.clock } : {},
+    ...options.adminKey !== void 0 ? { adminKey: options.adminKey } : {},
+    ...options.seed !== void 0 ? { seed: options.seed } : {},
+    create: ({ sqlite, namespace, publicNamespace, clock }) => new OAuthAPI({ ...options, sqlite, namespace, publicNamespace, now: clock.now }),
+    admin: (runtime) => ({
+      "GET /scenarios": () => Response.json(OAUTH_SCENARIOS),
+      "GET /behavior": ({ namespace }) => Response.json({
+        behavior: runtime.instance(namespace).behavior.config,
+        events: runtime.instance(namespace).behavior.events
+      }),
+      "PUT /behavior": ({ namespace, body }) => {
+        try {
+          return Response.json(runtime.instance(namespace).behavior.configure(body));
+        } catch (error) {
+          return Response.json({ error: String(error) }, { status: 400 });
+        }
+      },
+      "POST /consents/revoke": ({ namespace, body }) => {
+        const input = body;
+        if (!input || typeof input.clientId !== "string" || typeof input.accountId !== "string")
+          return Response.json({ error: "clientId and accountId are required" }, { status: 400 });
+        runtime.instance(namespace).revokeConsent(input.clientId, input.accountId);
+        return Response.json({ revoked: true });
+      },
+      "POST /keys/rotate": ({ namespace, body }) => {
+        const input = body;
+        if (input?.retainPrevious !== void 0 && typeof input.retainPrevious !== "boolean")
+          return Response.json({ error: "retainPrevious must be boolean" }, { status: 400 });
+        return Response.json(
+          runtime.instance(namespace).rotateSigningKey(input?.retainPrevious !== false)
+        );
+      },
+      "GET /accounts": ({ namespace }) => Response.json({
+        accounts: runtime.instance(namespace).accounts.list({ order: "oldest" }).map((a) => a.value)
+      }),
+      "POST /accounts": ({ namespace, body }) => {
+        try {
+          return Response.json(runtime.instance(namespace).seedAccount(body), {
+            status: 201
+          });
+        } catch (error) {
+          return Response.json({ error: String(error) }, { status: 400 });
+        }
+      },
+      "GET /clients": ({ namespace }) => Response.json({
+        clients: runtime.instance(namespace).clients.list({ order: "oldest" }).map(({ value }) => ({
+          id: value.id,
+          name: value.name,
+          redirectUris: value.redirectUris,
+          requirePkce: value.requirePkce ?? value.secret === void 0
+        }))
+      }),
+      "POST /clients": ({ namespace, body }) => {
+        try {
+          const client = runtime.instance(namespace).registerClient(body);
+          return Response.json(
+            { id: client.id, name: client.name, redirectUris: client.redirectUris },
+            { status: 201 }
+          );
+        } catch (error) {
+          return Response.json({ error: String(error) }, { status: 400 });
+        }
+      }
+    })
+  });
+}
+
+// src/multi.ts
+var MOUNT_PATTERN = /^\/[A-Za-z0-9](?:[A-Za-z0-9._~-]*)(?:\/[A-Za-z0-9](?:[A-Za-z0-9._~-]*))*$/;
+var NS_PREFIX = /^\/ns\/([^/]+)(\/.*)?$/;
+var json3 = (body, status = 200) => Response.json(body, { status, headers: { "cache-control": "no-store" } });
+var validateMounts = (mounts) => {
+  if (mounts.length === 0) throw new Error("at least one OAuth mount is required");
+  const paths = /* @__PURE__ */ new Set();
+  const issuers = /* @__PURE__ */ new Set();
+  for (const mount of mounts) {
+    if (!MOUNT_PATTERN.test(mount.path) || mount.path.includes("//"))
+      throw new Error(`invalid OAuth mount path ${JSON.stringify(mount.path)}`);
+    if (paths.has(mount.path)) throw new Error(`duplicate OAuth mount path ${mount.path}`);
+    paths.add(mount.path);
+    if (mount.issuer) {
+      const normalized = mount.issuer.replace(/\/$/, "");
+      if (issuers.has(normalized)) throw new Error(`duplicate OAuth issuer ${normalized}`);
+      issuers.add(normalized);
+    }
+    const clientIds = /* @__PURE__ */ new Set();
+    const keyIds = /* @__PURE__ */ new Set();
+    for (const client of mount.clients ?? []) {
+      if (clientIds.has(client.id))
+        throw new Error(`duplicate client ID ${client.id} in OAuth mount ${mount.path}`);
+      clientIds.add(client.id);
+      if (client.apple?.keyId) {
+        if (keyIds.has(client.apple.keyId))
+          throw new Error(
+            `duplicate Apple key ID ${client.apple.keyId} in OAuth mount ${mount.path}`
+          );
+        keyIds.add(client.apple.keyId);
+      }
+    }
+  }
+};
+var withoutMount = (request, namespacePrefix, rest) => {
+  const url = new URL(request.url);
+  url.pathname = `${namespacePrefix}${rest || "/"}`;
+  return new Request(url, request);
+};
+function createMultiRuntime(options) {
+  validateMounts(options.mounts);
+  const clock = options.clock ?? createClock();
+  const runtimes = /* @__PURE__ */ new Map();
+  for (const mount of options.mounts) {
+    const { path, ...runtimeOptions } = mount;
+    const runtime = createRuntime2({
+      ...runtimeOptions,
+      clock,
+      ...options.sqlite ? { sqlite: options.sqlite } : {},
+      ...runtimeOptions.adminKey ?? options.adminKey ? { adminKey: runtimeOptions.adminKey ?? options.adminKey } : {},
+      ...(runtimeOptions.seed ?? options.seed) !== void 0 ? { seed: runtimeOptions.seed ?? options.seed } : {},
+      mountPath: path,
+      runtimeName: `oauth@${path}`
+    });
+    runtime.instance();
+    runtimes.set(path, runtime);
+  }
+  const reset = async (namespace = "*") => {
+    await Promise.all([...runtimes.values()].map((runtime) => runtime.reset(namespace)));
+  };
+  return {
+    name: "oauth",
+    clock,
+    mounts: runtimes,
+    reset,
+    async fetch(request) {
+      const url = new URL(request.url);
+      if (request.method === "GET" && url.pathname === "/health") {
+        const health = await Promise.all(
+          [...runtimes.entries()].map(async ([path2, runtime]) => [
+            path2,
+            await (await runtime.fetch(new Request(new URL("/health", url), request))).json()
+          ])
+        );
+        return json3({ status: "ok", service: "oauth", mounts: Object.fromEntries(health) });
+      }
+      if (url.pathname.startsWith("/__admin") && options.adminKey !== void 0 && request.headers.get("x-mockingbird-admin-key") !== options.adminKey)
+        return json3({ error: { type: "mockingbird_admin", message: "invalid admin key" } }, 401);
+      if (url.pathname === "/__admin/mounts" && request.method === "GET")
+        return json3({
+          mounts: options.mounts.map(({ path: path2, provider, issuer }) => ({ path: path2, provider, issuer }))
+        });
+      if (url.pathname === "/__admin/reset" && request.method === "POST") {
+        const namespace2 = url.searchParams.get("all") === "1" ? "*" : url.searchParams.get("namespace") ?? request.headers.get("x-mockingbird-namespace") ?? "default";
+        await reset(namespace2);
+        return json3({ status: "ok", mounts: [...runtimes.keys()], namespace: namespace2 });
+      }
+      if (url.pathname.startsWith("/__admin/")) {
+        const selected = url.searchParams.get("mount");
+        const runtime = selected && runtimes.get(selected);
+        if (!runtime)
+          return json3({ error: { type: "mockingbird_admin", message: "mount is required" } }, 400);
+        url.searchParams.delete("mount");
+        return runtime.fetch(new Request(url, request));
+      }
+      const namespace = NS_PREFIX.exec(url.pathname);
+      const namespacePrefix = namespace ? `/ns/${namespace[1]}` : "";
+      const path = namespace ? namespace[2] ?? "/" : url.pathname;
+      for (const [mount, runtime] of runtimes) {
+        if (path !== mount && !path.startsWith(`${mount}/`)) continue;
+        return runtime.fetch(withoutMount(request, namespacePrefix, path.slice(mount.length)));
+      }
+      return json3({ error: { type: "mockingbird_not_found", message: "unknown OAuth mount" } }, 404);
+    }
+  };
+}
+
+// src/index.ts
+var json4 = (body, status = 200) => Response.json(body, { status, headers: { "cache-control": "no-store", pragma: "no-cache" } });
+var fail = (error, description, status = 400) => json4({ error, error_description: description }, status);
+var scopes = (value) => new Set(value.split(/\s+/).filter(Boolean));
+var validEmail = (s) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s) && s.length <= 254;
+var WEB_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
+var FORBIDDEN_REDIRECT_SCHEMES = /* @__PURE__ */ new Set(["blob:", "data:", "file:", "javascript:", "vbscript:"]);
+var safeRedirect = (s) => {
+  try {
+    const u = new URL(s);
+    return /^[a-z][a-z0-9+.-]*:$/i.test(u.protocol) && !FORBIDDEN_REDIRECT_SCHEMES.has(u.protocol.toLowerCase()) && !u.hash && !u.username && !u.password;
+  } catch {
+    return false;
+  }
+};
+var OAuthAPI = class {
+  constructor(options = {}) {
+    this.options = options;
+    this.sqlite = bootSqlite(options.sqlite);
+    this.namespace = options.namespace ?? "oauth";
+    this.now = options.now ?? Date.now;
+    this.provider = options.provider ?? "oidc";
+    if (options.issuer) {
+      const url = new URL(options.issuer);
+      if (!safeRedirect(options.issuer) || url.search)
+        throw new Error("issuer must be an HTTP(S) URL without query or fragment");
+    }
+    this.accounts = new Collection(this.sqlite, this.namespace, "accounts");
+    this.clients = new Collection(this.sqlite, this.namespace, "clients");
+    this.transactions = new Collection(this.sqlite, this.namespace, "transactions");
+    this.codes = new Collection(this.sqlite, this.namespace, "codes");
+    this.tokens = new Collection(this.sqlite, this.namespace, "tokens");
+    this.sessions = new Collection(this.sqlite, this.namespace, "sessions");
+    this.consents = new Collection(this.sqlite, this.namespace, "consents");
+    this.identities = new Collection(this.sqlite, this.namespace, "identities");
+    this.appleDisclosures = new Collection(this.sqlite, this.namespace, "apple_disclosures");
+    this.refreshIssued = new Collection(this.sqlite, this.namespace, "refresh_issued");
+    this.behavior = new BehaviorState(
+      this.sqlite,
+      this.namespace,
+      options.seed ?? 0,
+      options.behavior ?? {}
+    );
+    this.seed();
+  }
+  options;
+  accounts;
+  clients;
+  transactions;
+  codes;
+  tokens;
+  sessions;
+  consents;
+  signer = new Signer();
+  previousSigners = [];
+  behavior;
+  identities;
+  appleDisclosures;
+  refreshIssued;
+  sqlite;
+  namespace;
+  now;
+  provider;
+  seed() {
+    for (const client of this.options.clients ?? []) this.registerClient(client);
+    for (const account of this.options.accounts ?? []) this.seedAccount(account);
+  }
+  seedAccount(account) {
+    if (!account || typeof account.id !== "string" || !account.id || typeof account.name !== "string" || !account.name.trim() || typeof account.email !== "string" || !validEmail(account.email))
+      throw new Error("Account requires id, name and a valid email");
+    const email = account.email.toLowerCase().trim();
+    if (this.accounts.list().some((a) => a.value.email === email && a.id !== account.id))
+      throw new Error("An account with this email already exists");
+    if (account.relayEmail !== void 0 && (typeof account.relayEmail !== "string" || !/^[a-zA-Z0-9._-]+@privaterelay\.appleid\.com$/.test(account.relayEmail)))
+      throw new Error("relayEmail must be an Apple private relay address");
+    if (account.realUserStatus !== void 0 && ![0, 1, 2].includes(account.realUserStatus))
+      throw new Error("realUserStatus must be 0, 1 or 2");
+    if (account.transferSub !== void 0 && (typeof account.transferSub !== "string" || !account.transferSub))
+      throw new Error("transferSub must be a nonempty string");
+    if (account.github && (!Number.isSafeInteger(account.github.id) || account.github.id < 1 || typeof account.github.login !== "string" || !account.github.login))
+      throw new Error("GitHub account requires a positive integer id and login");
+    if (account.github?.emails && (!Array.isArray(account.github.emails) || account.github.emails.some(
+      (e) => !e || typeof e.email !== "string" || !validEmail(e.email) || typeof e.primary !== "boolean" || typeof e.verified !== "boolean" || !["public", "private", null].includes(e.visibility)
+    )))
+      throw new Error("Invalid GitHub email records");
+    const value = { ...account, email };
+    this.accounts.insert(account.id, value);
+    return value;
+  }
+  registerClient(client) {
+    if (!client || typeof client.id !== "string" || !client.id || typeof client.name !== "string" || !client.name || !Array.isArray(client.redirectUris) || !client.redirectUris.length || !client.redirectUris.every((s) => typeof s === "string" && safeRedirect(s)))
+      throw new Error(
+        "Client requires id, name and exact safe redirectUris without fragments or credentials"
+      );
+    if (client.apple && (client.secret !== void 0 || !client.apple.teamId || !client.apple.keyId || client.apple.publicKey?.kty !== "EC" || client.apple.publicKey.crv !== "P-256" || client.apple.publicKey.d))
+      throw new Error(
+        "Apple client requires teamId, keyId and a public P-256 JWK, without a static secret"
+      );
+    this.clients.insert(client.id, structuredClone(client));
+    return client;
+  }
+  async reset() {
+    clearNamespace(this.sqlite, this.namespace);
+    this.behavior.configure(this.options.behavior ?? {});
+    this.seed();
+  }
+  issuer(request) {
+    const prefix = this.options.publicNamespace && this.options.publicNamespace !== "default" ? `/ns/${encodeURIComponent(this.options.publicNamespace)}` : "";
+    return (this.options.issuer ?? `${new URL(request.url).origin}${prefix}${this.options.mountPath ?? ""}`).replace(/\/$/, "");
+  }
+  configureBehavior(input) {
+    return this.behavior.configure(input);
+  }
+  rotateSigningKey(retainPrevious = true) {
+    this.previousSigners = retainPrevious ? [this.signer, ...this.previousSigners].slice(0, 4) : [];
+    this.signer = new Signer();
+    return { kid: this.signer.kid };
+  }
+  revokeConsent(clientId, accountId) {
+    const key = JSON.stringify([clientId, accountId]);
+    this.consents.delete(key);
+    this.refreshIssued.delete(key);
+    const client = this.clients.get(clientId);
+    if (client) {
+      this.identities.delete(this.identityKey(client, accountId));
+      this.appleDisclosures.delete(this.identityKey(client, accountId));
+    }
+    for (const row of this.codes.list({
+      where: (c) => c.clientId === clientId && c.accountId === accountId
+    }))
+      this.codes.delete(row.id);
+    for (const row of this.tokens.list({
+      where: (t) => t.clientId === clientId && t.accountId === accountId
+    }))
+      this.tokens.delete(row.id);
+  }
+  paths() {
+    const paths = {
+      google: {
+        authorize: "/o/oauth2/v2/auth",
+        token: "/token",
+        jwks: "/oauth2/v3/certs",
+        userinfo: "/v1/userinfo",
+        revoke: "/revoke"
+      },
+      apple: {
+        authorize: "/auth/authorize",
+        token: "/auth/token",
+        jwks: "/auth/keys",
+        userinfo: "/userinfo",
+        revoke: "/auth/revoke"
+      },
+      microsoft: {
+        authorize: "/oauth2/v2.0/authorize",
+        token: "/oauth2/v2.0/token",
+        jwks: "/discovery/v2.0/keys",
+        userinfo: "/oidc/userinfo",
+        revoke: "/revoke"
+      },
+      github: {
+        authorize: "/login/oauth/authorize",
+        token: "/login/oauth/access_token",
+        jwks: "/jwks",
+        userinfo: "/user",
+        revoke: "/revoke"
+      },
+      oidc: {
+        authorize: "/authorize",
+        token: "/token",
+        jwks: "/jwks",
+        userinfo: "/userinfo",
+        revoke: "/revoke"
+      }
+    };
+    return paths[this.provider];
+  }
+  supportedScopes() {
+    const base = this.provider === "apple" ? ["openid", "email", "name"] : this.provider === "github" ? ["read:user", "user:email", "user"] : [
+      "openid",
+      "email",
+      "profile",
+      ...this.provider !== "google" ? ["offline_access"] : [],
+      ...this.provider === "microsoft" ? ["User.Read"] : []
+    ];
+    return [
+      .../* @__PURE__ */ new Set([
+        ...base,
+        ...this.provider === "google" ? [
+          "https://www.googleapis.com/auth/userinfo.email",
+          "https://www.googleapis.com/auth/userinfo.profile"
+        ] : [],
+        ...this.behavior.config.additionalScopes ?? []
+      ])
+    ];
+  }
+  identityKey(client, accountId) {
+    return JSON.stringify([
+      this.provider,
+      client.subjectGroup ?? client.apple?.teamId ?? client.id,
+      accountId
+    ]);
+  }
+  async identity(account, auth) {
+    const client = this.clients.get(auth.clientId);
+    if (!client) throw new Error("Client no longer exists");
+    const key = this.identityKey(client, account.id);
+    const previous = this.identities.get(key);
+    const digest = await hash(key);
+    const existing = this.identities.get(key) ?? previous;
+    const hide = existing?.privateEmail ?? (auth.emailChoice ? auth.emailChoice === "hide" : account.privateEmail ?? (this.behavior.config.apple?.emailMode === "hide" || (this.behavior.config.apple?.emailMode ?? "choose") === "choose" && auth.decisions.hideEmail));
+    const identity = {
+      sub: this.provider === "apple" || this.provider === "microsoft" ? digest : account.id,
+      email: this.provider === "apple" && hide ? existing?.email ?? account.relayEmail ?? `${digest.slice(0, 20).toLowerCase()}@privaterelay.appleid.com` : account.email,
+      privateEmail: this.provider === "apple" && hide
+    };
+    this.identities.insert(key, identity);
+    return identity;
+  }
+  profile(account, grant) {
+    const requested = scopes(grant.scope);
+    if (requested.has("https://www.googleapis.com/auth/userinfo.email")) requested.add("email");
+    if (requested.has("https://www.googleapis.com/auth/userinfo.profile")) requested.add("profile");
+    const omitEmail = grant.decisions.omitEmail || account.omitEmail;
+    const omitName = grant.decisions.omitName || account.omitName;
+    const claims = { sub: grant.identity.sub };
+    if (requested.has("email") && !omitEmail)
+      Object.assign(claims, {
+        email: grant.identity.privateEmail ? grant.identity.email : account.email,
+        ...this.provider !== "microsoft" ? {
+          email_verified: this.provider === "apple" && this.behavior.config.apple?.booleanClaims !== "boolean" ? String(!grant.decisions.unverifiedEmail && (account.emailVerified ?? true)) : !grant.decisions.unverifiedEmail && (account.emailVerified ?? true)
+        } : {}
+      });
+    if (this.provider !== "apple" && requested.has("profile"))
+      Object.assign(claims, {
+        ...!omitName ? {
+          name: account.name,
+          given_name: account.givenName ?? account.name.split(" ")[0],
+          family_name: account.familyName ?? account.name.split(" ").slice(1).join(" ")
+        } : {},
+        ...account.picture ? { picture: account.picture } : {},
+        locale: account.locale ?? "en"
+      });
+    if (this.provider === "google" && account.hostedDomain) claims.hd = account.hostedDomain;
+    if (this.provider === "apple") {
+      if (requested.has("email") && !omitEmail)
+        claims.is_private_email = this.behavior.config.apple?.booleanClaims === "boolean" ? grant.identity.privateEmail : String(grant.identity.privateEmail);
+      if (account.realUserStatus !== void 0) claims.real_user_status = account.realUserStatus;
+      if (account.transferSub) claims.transfer_sub = account.transferSub;
+    }
+    if (this.provider === "microsoft" && requested.has("profile"))
+      Object.assign(claims, {
+        ver: "2.0",
+        oid: account.objectId ?? account.id,
+        tid: account.tenantId ?? "9188040d-6c67-4c5b-b112-36a304b66dad",
+        preferred_username: account.preferredUsername ?? account.email
+      });
+    return claims;
+  }
+  async idToken(grant, issuer, extra = {}) {
+    const account = this.accounts.get(grant.accountId);
+    if (!account) throw new Error("Account no longer exists");
+    return this.signer.sign({
+      ...this.profile(account, grant),
+      iss: issuer,
+      aud: grant.clientId,
+      iat: Math.floor(this.now() / 1e3),
+      exp: Math.floor(this.now() / 1e3) + (this.behavior.config.tokens?.accessTtlSeconds ?? 3600),
+      auth_time: Math.floor(grant.authTime / 1e3),
+      ...grant.nonce ? { nonce: grant.nonce } : {},
+      ...extra
+    });
+  }
+  async fetch(request) {
+    const url = new URL(request.url);
+    const issuer = this.issuer(request);
+    const mount = new URL(issuer).pathname.replace(/\/$/, "");
+    const path = mount && url.pathname.startsWith(`${mount}/`) ? url.pathname.slice(mount.length) : url.pathname;
+    const paths = this.paths();
+    if (request.method === "GET" && path === "/.well-known/openid-configuration" && this.provider !== "github")
+      return json4({
+        issuer,
+        authorization_endpoint: issuer + paths.authorize,
+        token_endpoint: issuer + paths.token,
+        jwks_uri: issuer + paths.jwks,
+        ...this.provider !== "apple" ? { userinfo_endpoint: issuer + paths.userinfo } : {},
+        ...this.provider !== "microsoft" ? { revocation_endpoint: issuer + paths.revoke } : {},
+        response_types_supported: this.provider === "apple" ? ["code", "code id_token"] : ["code"],
+        response_modes_supported: ["query", "form_post", "fragment"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        subject_types_supported: [
+          this.provider === "apple" || this.provider === "microsoft" ? "pairwise" : "public"
+        ],
+        id_token_signing_alg_values_supported: ["RS256"],
+        token_endpoint_auth_methods_supported: this.provider === "apple" ? ["client_secret_post"] : this.provider === "oidc" ? ["client_secret_post", "client_secret_basic", "none"] : ["client_secret_post", "client_secret_basic"],
+        ...this.provider !== "apple" ? { code_challenge_methods_supported: ["S256"] } : {},
+        scopes_supported: this.supportedScopes(),
+        claims_supported: this.provider === "apple" ? [
+          "aud",
+          "email",
+          "email_verified",
+          "exp",
+          "iat",
+          "is_private_email",
+          "iss",
+          "nonce",
+          "real_user_status",
+          "sub",
+          "transfer_sub"
+        ] : this.provider === "microsoft" ? [
+          "aud",
+          "auth_time",
+          "email",
+          "exp",
+          "family_name",
+          "given_name",
+          "iat",
+          "iss",
+          "name",
+          "nonce",
+          "oid",
+          "preferred_username",
+          "sub",
+          "tid",
+          "ver"
+        ] : [
+          "aud",
+          "auth_time",
+          "email",
+          "email_verified",
+          "exp",
+          "family_name",
+          "given_name",
+          "iat",
+          "iss",
+          "locale",
+          "name",
+          "nonce",
+          "picture",
+          "sub",
+          ...this.provider === "google" ? ["hd"] : []
+        ]
+      });
+    if (request.method === "GET" && [paths.jwks, "/jwks"].includes(path))
+      return json4({
+        keys: (await Promise.all([this.signer, ...this.previousSigners].map((s) => s.jwks()))).flatMap((j) => j.keys)
+      });
+    if (request.method === "GET" && [
+      paths.authorize,
+      "/authorize",
+      ...this.provider === "google" ? ["/o/oauth2/auth"] : []
+    ].includes(path))
+      return this.authorize(request, url.searchParams, issuer);
+    if (path === "/interaction" && ["GET", "POST"].includes(request.method))
+      return this.interact(request, issuer);
+    if (request.method === "POST" && [paths.token, "/token"].includes(path)) {
+      const response = await this.token(request, issuer);
+      return this.provider === "github" ? this.githubTokenResponse(request, response) : response;
+    }
+    if (["GET", "POST"].includes(request.method) && [
+      paths.userinfo,
+      "/userinfo",
+      ...this.provider === "google" ? ["/oauth2/v3/userinfo"] : [],
+      ...this.provider === "github" ? ["/user/emails"] : []
+    ].includes(path) && this.provider !== "apple") {
+      const token = this.tokens.get(
+        request.headers.get("authorization")?.replace(/^Bearer\s+/i, "") ?? ""
+      );
+      const account = token && this.accounts.get(token.accountId);
+      if (token?.kind !== "access" || token.expires <= this.now() || !account || account.disabled) {
+        const res = this.provider === "github" ? json4(
+          { message: "Bad credentials", documentation_url: "https://docs.github.com/rest" },
+          401
+        ) : fail("invalid_token", "Invalid or expired access token", 401);
+        res.headers.set("www-authenticate", 'Bearer error="invalid_token"');
+        return res;
+      }
+      if (this.provider === "github") {
+        const granted = scopes(token.scope);
+        const scopeHeaders = {
+          "x-oauth-scopes": [...granted].sort().join(", "),
+          "x-accepted-oauth-scopes": path === "/user/emails" ? "user:email" : ""
+        };
+        if (path === "/user/emails") {
+          if (!granted.has("user:email") && !granted.has("user"))
+            return new Response(
+              JSON.stringify({ message: "Resource not accessible by integration" }),
+              {
+                status: 403,
+                headers: { "content-type": "application/json", ...scopeHeaders }
+              }
+            );
+          const emails = token.decisions.omitEmail || account.omitEmail ? [] : account.github?.emails ?? [
+            {
+              email: account.email,
+              primary: true,
+              verified: !token.decisions.unverifiedEmail && (account.emailVerified ?? true),
+              visibility: "private"
+            }
+          ];
+          const response2 = json4(emails);
+          for (const [key, value] of Object.entries(scopeHeaders)) response2.headers.set(key, value);
+          return response2;
+        }
+        const response = json4({
+          login: account.github?.login ?? account.id,
+          id: account.github?.id ?? seedFrom(account.id) + 1,
+          node_id: btoa(`User:${account.github?.id ?? seedFrom(account.id) + 1}`),
+          name: token.decisions.omitName || account.omitName ? null : account.name,
+          email: token.decisions.omitEmail || account.omitEmail ? null : account.github?.publicEmail ?? null,
+          avatar_url: account.picture ?? "",
+          type: "User"
+        });
+        for (const [key, value] of Object.entries(scopeHeaders)) response.headers.set(key, value);
+        return response;
+      }
+      return json4(this.profile(account, token));
+    }
+    if (request.method === "POST" && [paths.revoke, "/revoke"].includes(path)) {
+      const data = await this.form(request);
+      if (!data) return fail("invalid_request", "Expected form-encoded body");
+      const client = await this.authenticate(request, data);
+      if (client instanceof Response) return client;
+      const token = this.tokens.get(data.get("token") ?? "");
+      if (token && token.clientId === client.id)
+        for (const row of this.tokens.list({ where: (t) => t.family === token.family }))
+          this.tokens.delete(row.id);
+      return json4({});
+    }
+    if (request.method === "GET" && path === "/")
+      return page(
+        "Identity sandbox",
+        '<span class="eyebrow">Mockingbird Identity</span><h1 id="title">Make sign-in<br>feel real.</h1><p>Your identity sandbox is ready. Start sign-in from your application to choose an account, create a new identity, and review access.</p><div class="account"><span class="avatar" aria-hidden="true">\u2713</span><span class="identity"><strong>Ready when you are</strong><small>OAuth 2.0 \xB7 OpenID Connect</small></span></div>'
+      );
+    return fail("not_found", "Unknown endpoint", 404);
+  }
+  async form(request) {
+    if (!request.headers.get("content-type")?.startsWith("application/x-www-form-urlencoded"))
+      return void 0;
+    const body = await request.text();
+    if (body.length > 16384) return void 0;
+    const params = new URLSearchParams(body);
+    if ([...params.keys()].some((k) => params.getAll(k).length !== 1)) return void 0;
+    return params;
+  }
+  async authenticate(request, data) {
+    let id = data.get("client_id") ?? "", secret = data.get("client_secret") ?? "";
+    const auth = request.headers.get("authorization");
+    if (auth) {
+      if (this.provider === "apple")
+        return fail("invalid_client", "Apple requires client_secret_post", 401);
+      if (!auth.startsWith("Basic ") || data.has("client_secret"))
+        return fail("invalid_client", "Invalid client authentication", 401);
+      try {
+        const decoded = atob(auth.slice(6));
+        const colon = decoded.indexOf(":");
+        if (colon < 0) throw new Error();
+        id = decodeURIComponent(decoded.slice(0, colon).replace(/\+/g, " "));
+        secret = decodeURIComponent(decoded.slice(colon + 1).replace(/\+/g, " "));
+      } catch {
+        return fail("invalid_client", "Malformed client authentication", 401);
+      }
+      if (data.has("client_id") && data.get("client_id") !== id)
+        return fail("invalid_client", "Conflicting client identities", 401);
+    }
+    const client = this.clients.get(id);
+    if (!client || client.secret !== void 0 && client.secret !== secret || client.secret === void 0 && !client.apple && secret)
+      return fail("invalid_client", "Client authentication failed", 401);
+    if (client.apple && !await verifyAppleSecret(secret, client.id, client.apple, this.now()))
+      return fail("invalid_client", "Invalid Apple client-secret JWT", 401);
+    return client;
+  }
+  async authorize(request, p, issuer) {
+    if ([...p.keys()].some((k) => p.getAll(k).length !== 1))
+      return fail("invalid_request", "Duplicate parameters");
+    const client = this.clients.get(p.get("client_id") ?? "");
+    const redirectUri = p.get("redirect_uri") ?? (this.provider === "github" ? client?.redirectUris[0] ?? "" : "");
+    if (!client?.redirectUris.includes(redirectUri))
+      return fail("invalid_request", "Unknown client or redirect_uri mismatch");
+    const mode = p.get("response_mode") ?? "query";
+    const auth = {
+      clientId: client.id,
+      redirectUri,
+      scope: p.get("scope") ?? (this.provider === "github" ? "read:user" : this.provider === "apple" ? "openid" : ""),
+      state: p.get("state") ?? "",
+      nonce: p.get("nonce") ?? "",
+      responseType: p.get("response_type") ?? (this.provider === "github" ? "code" : ""),
+      responseMode: ["query", "form_post", "fragment"].includes(mode) ? mode : "query",
+      challenge: p.get("code_challenge") ?? "",
+      expires: this.now() + 6e5,
+      offline: p.get("access_type") === "offline",
+      forceConsent: scopes(p.get("prompt") ?? "").has("consent"),
+      includeGrantedScopes: p.get("include_granted_scopes") === "true",
+      decisions: this.behavior.decisions(),
+      authTime: this.now()
+    };
+    const error = (code, message) => this.callback(auth, { error: code, error_description: message });
+    if (!["query", "form_post", "fragment"].includes(mode))
+      return error("invalid_request", "Unsupported response_mode");
+    if (auth.responseType !== "code" && !(this.provider === "apple" && auth.responseType === "code id_token"))
+      return error("unsupported_response_type", "Unsupported response_type");
+    if (auth.responseType.includes("id_token") && (!auth.nonce || mode === "query"))
+      return error("invalid_request", "Hybrid flow requires nonce and form_post or fragment");
+    if (this.provider === "apple" && /\b(email|name)\b/.test(auth.scope) && mode !== "form_post")
+      return error("invalid_request", "Apple name/email scopes require form_post");
+    const supported = this.supportedScopes();
+    if (!auth.scope || [...scopes(auth.scope)].some((s) => !supported.includes(s)))
+      return error("invalid_scope", "Unsupported scope");
+    if ((client.requirePkce || client.secret === void 0 && !client.apple) && !auth.challenge)
+      return error("invalid_request", "PKCE is required for this client");
+    if (auth.challenge && (p.get("code_challenge_method") !== "S256" || !/^[A-Za-z0-9_-]{43}$/.test(auth.challenge)))
+      return error("invalid_request", "PKCE requires a valid S256 challenge");
+    const prompt = scopes(p.get("prompt") ?? "");
+    if ([...prompt].some((s) => !["none", "login", "consent", "select_account"].includes(s)) || prompt.has("none") && prompt.size > 1)
+      return error("invalid_request", "Invalid prompt");
+    const maxAge = p.get("max_age");
+    if (maxAge !== null && !/^\d+$/.test(maxAge)) return error("invalid_request", "Invalid max_age");
+    const cookie = request.headers.get(this.options.cookieHeaders?.request ?? "cookie")?.split(";").map((v) => v.trim()).find((v) => v.startsWith("mb_session="))?.slice(11);
+    const session = cookie ? this.sessions.get(cookie) : void 0;
+    const account = session && session.expires > this.now() ? this.accounts.get(session.accountId) : void 0;
+    const current = this.behavior.config.session?.reuseLastAccount !== false && account && !account.disabled && session && maxAge !== "0" && (maxAge === null || this.now() - session.authTime <= Number(maxAge) * 1e3) ? account : void 0;
+    const consent = current ? this.consents.get(JSON.stringify([client.id, current.id])) : void 0;
+    const granted = consent && [...scopes(auth.scope)].every((s) => scopes(consent.scope).has(s));
+    if (prompt.has("none")) {
+      if (!current || !session) return error("login_required", "An active session is required");
+      if (!granted) return error("consent_required", "Consent is required");
+      return this.finish({ ...auth, accountId: current.id, authTime: session.authTime }, issuer);
+    }
+    const id = random();
+    if (current && session && !prompt.has("login") && !prompt.has("select_account")) {
+      auth.accountId = current.id;
+      auth.authTime = session.authTime;
+      if (granted && !prompt.has("consent"))
+        return this.finish(auth, issuer);
+    }
+    this.transactions.insert(id, auth);
+    if (auth.accountId && current) return this.consent(id, client, current, auth, issuer);
+    const accounts = this.accounts.list({ order: "oldest", where: (a) => !a.disabled }).map((a) => a.value);
+    const hint = p.get("login_hint");
+    if (hint)
+      accounts.sort(
+        (a, b) => Number(b.email === hint || b.id === hint) - Number(a.email === hint || a.id === hint)
+      );
+    return loginPage(id, client.name, accounts, issuer);
+  }
+  consent(id, client, account, auth, issuer) {
+    const existing = this.identities.get(this.identityKey(client, account.id));
+    const denied = new Set(this.behavior.config.consent?.deniedScopes ?? []);
+    const allowed = [...scopes(auth.scope)].filter((s) => !denied.has(s)).join(" ");
+    return consentPage(
+      id,
+      client.name,
+      account,
+      allowed,
+      issuer,
+      this.provider === "apple" && scopes(auth.scope).has("email") && !existing ? {
+        hideEmail: account.privateEmail ?? (this.behavior.config.apple?.emailMode === "hide" || (this.behavior.config.apple?.emailMode ?? "choose") === "choose" && auth.decisions.hideEmail),
+        choice: (this.behavior.config.apple?.emailMode ?? "choose") === "choose"
+      } : void 0
+    );
+  }
+  async interact(request, issuer) {
+    const p = request.method === "GET" ? new URL(request.url).searchParams : await this.form(request);
+    if (!p) return fail("invalid_request", "Expected form-encoded body");
+    if (request.method === "POST" && request.headers.get("origin") && request.headers.get("origin") !== new URL(issuer).origin)
+      return fail("invalid_request", "Cross-origin interaction rejected", 403);
+    const id = p.get("transaction") ?? "";
+    const auth = this.transactions.get(id);
+    const client = auth && this.clients.get(auth.clientId);
+    if (!auth || auth.expires <= this.now() || !client)
+      return page(
+        "Session expired",
+        '<span class="eyebrow">Let\u2019s try again</span><h1 id="title">This sign-in expired</h1><p>Return to your application and start sign-in again.</p>',
+        400
+      );
+    const accounts = () => this.accounts.list({ order: "oldest", where: (a) => !a.disabled }).map((a) => a.value);
+    if (request.method === "GET")
+      return loginPage(id, client.name, accounts(), issuer, p.get("screen") === "signup");
+    const action = p.get("action");
+    if (action === "deny") {
+      this.transactions.delete(id);
+      return this.callback(auth, {
+        error: "access_denied",
+        error_description: "The user denied access"
+      });
+    }
+    if (action === "signup") {
+      const email = (p.get("email") ?? "").trim().toLowerCase(), name = (p.get("name") ?? "").trim();
+      if (!validEmail(email) || !name || name.length > 120)
+        return loginPage(
+          id,
+          client.name,
+          [],
+          issuer,
+          true,
+          "Enter a full name and a valid email address."
+        );
+      if (accounts().some((a) => a.email === email) || this.accounts.list().some((a) => a.value.email === email))
+        return loginPage(
+          id,
+          client.name,
+          [],
+          issuer,
+          true,
+          "This email already has an account. Go back to choose it."
+        );
+      const account = this.seedAccount({ id: random(), email, name, emailVerified: true });
+      auth.accountId = account.id;
+      auth.authTime = this.now();
+      this.transactions.update(id, auth);
+      return this.consent(id, client, account, auth, issuer);
+    }
+    if (action === "select") {
+      const account = this.accounts.get(p.get("account") ?? "");
+      if (!account || account.disabled)
+        return loginPage(id, client.name, accounts(), issuer, false, "Choose an available account.");
+      auth.accountId = account.id;
+      auth.authTime = this.now();
+      this.transactions.update(id, auth);
+      return this.consent(id, client, account, auth, issuer);
+    }
+    if (action === "allow" && auth.accountId) {
+      const account = this.accounts.get(auth.accountId);
+      if (!account || account.disabled) return fail("access_denied", "Account is unavailable");
+      const choice = p.get("email_choice");
+      if (choice !== null && choice !== "hide" && choice !== "share")
+        return fail("invalid_request", "Invalid email choice");
+      if (choice && this.provider === "apple" && (this.behavior.config.apple?.emailMode ?? "choose") === "choose" && !this.identities.has(this.identityKey(client, account.id)))
+        auth.emailChoice = choice;
+      this.transactions.delete(id);
+      const result = await this.finish(auth, issuer);
+      const session = random();
+      this.sessions.insert(session, {
+        accountId: account.id,
+        authTime: auth.authTime,
+        expires: this.now() + 864e5
+      });
+      result.headers.append(
+        this.options.cookieHeaders?.response ?? "set-cookie",
+        `mb_session=${session}; Path=${new URL(issuer).pathname.replace(/\/$/, "") || "/"}; HttpOnly; SameSite=Lax; Max-Age=86400${issuer.startsWith("https:") ? "; Secure" : ""}`
+      );
+      return result;
+    }
+    return fail("invalid_request", "Invalid interaction action");
+  }
+  async finish(auth, issuer) {
+    const behavior = this.behavior.config;
+    if (auth.decisions.denyConsent || behavior.consent?.error)
+      return this.callback(auth, {
+        error: behavior.consent?.error ?? "access_denied",
+        error_description: "The authorization request was declined"
+      });
+    const account = this.accounts.get(auth.accountId);
+    if (!account || account.disabled)
+      return this.callback(auth, {
+        error: "access_denied",
+        error_description: "Account is unavailable"
+      });
+    const identity = await this.identity(account, auth);
+    const key = JSON.stringify([auth.clientId, auth.accountId]);
+    const previous = this.consents.get(key);
+    const denied = new Set(behavior.consent?.deniedScopes ?? []);
+    const scope = [
+      ...scopes(
+        `${this.provider === "google" && auth.includeGrantedScopes ? previous?.scope ?? "" : ""} ${auth.scope}`
+      )
+    ].filter((s) => !denied.has(s)).join(" ");
+    if (!scope || scopes(auth.scope).has("openid") && !scopes(scope).has("openid"))
+      return this.callback(auth, {
+        error: "access_denied",
+        error_description: "Required identity scope was declined"
+      });
+    const googleRefresh = behavior.google?.refreshToken ?? "first-consent";
+    const issueRefresh = this.provider === "google" ? auth.offline && googleRefresh !== "never" && (googleRefresh === "always" || auth.forceConsent || !previous) : this.provider === "apple" || scopes(scope).has("offline_access");
+    const code = random();
+    const grant = {
+      ...auth,
+      scope,
+      identity,
+      issueRefresh,
+      expires: this.now() + (behavior.tokens?.codeTtlSeconds ?? 300) * 1e3,
+      family: random()
+    };
+    this.codes.insert(code, grant);
+    this.consents.insert(key, { scope: [...scopes(`${previous?.scope ?? ""} ${scope}`)].join(" ") });
+    const values = { code };
+    if (this.provider === "google" || this.provider === "github") values.scope = scope;
+    if (auth.responseType.includes("id_token"))
+      values.id_token = await this.idToken(grant, issuer, { c_hash: await halfHash(code) });
+    const appleClient = this.clients.get(auth.clientId);
+    const appleKey = appleClient ? this.identityKey(appleClient, account.id) : "";
+    const disclosed = this.appleDisclosures.has(appleKey);
+    if (this.provider === "apple") this.appleDisclosures.insert(appleKey, { disclosed: true });
+    if (this.provider === "apple" && !disclosed && !behavior.apple?.omitUser && (scopes(scope).has("name") || scopes(scope).has("email"))) {
+      values.user = JSON.stringify({
+        ...scopes(scope).has("name") && !auth.decisions.omitName && !account.omitName ? {
+          name: {
+            firstName: account.givenName ?? account.name.split(" ")[0],
+            lastName: account.familyName ?? account.name.split(" ").slice(1).join(" ")
+          }
+        } : {},
+        ...scopes(scope).has("email") && !auth.decisions.omitEmail && !account.omitEmail ? { email: identity.email } : {}
+      });
+    }
+    return this.callback(auth, values);
+  }
+  callback(auth, values) {
+    if (auth.state) values.state = auth.state;
+    const redirect = new URL(auth.redirectUri);
+    if (auth.responseMode === "form_post") {
+      const nonce = this.options.nonce?.() ?? crypto.randomUUID();
+      const result = page(
+        "Continue to your app",
+        `<span class="eyebrow">All set</span><h1 id="title">Back to your app</h1><p>Your sign-in response is ready.</p><form id="callback" method="post" action="${escapeHtml(auth.redirectUri)}">${Object.entries(
+          values
+        ).map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`).join(
+          ""
+        )}<button class="primary">Continue</button></form><script nonce="${nonce}">document.getElementById('callback').submit()</script>`,
+        200,
+        WEB_SCHEMES.has(redirect.protocol) ? redirect.origin : redirect.protocol,
+        nonce
+      );
+      return result;
+    }
+    let location;
+    if (!WEB_SCHEMES.has(redirect.protocol)) {
+      const encoded = new URLSearchParams(values).toString();
+      location = `${auth.redirectUri}${auth.responseMode === "fragment" ? "#" : auth.redirectUri.includes("?") ? "&" : "?"}${encoded}`;
+    } else {
+      if (auth.responseMode === "fragment") redirect.hash = new URLSearchParams(values).toString();
+      else for (const [k, v] of Object.entries(values)) redirect.searchParams.set(k, v);
+      location = redirect.href;
+    }
+    return new Response(null, {
+      status: 302,
+      headers: {
+        location,
+        "cache-control": "no-store",
+        "referrer-policy": "no-referrer"
+      }
+    });
+  }
+  async githubTokenResponse(request, response) {
+    if (!response.headers.get("content-type")?.includes("application/json")) return response;
+    const body = await response.json();
+    if (body.error === "invalid_client") body.error = "incorrect_client_credentials";
+    else if (body.error === "invalid_grant")
+      body.error = String(body.error_description).includes("redirect_uri") ? "redirect_uri_mismatch" : "bad_verification_code";
+    if (body.error && response.status < 500)
+      body.error_uri = `https://docs.github.com/en/apps/oauth-apps/maintaining-oauth-apps/troubleshooting-oauth-app-access-token-request-errors#${String(body.error).replace(/_/g, "-")}`;
+    const status = body.error && response.status < 500 ? 200 : response.status;
+    if (request.headers.get("accept")?.includes("application/json")) return json4(body, status);
+    return new Response(
+      new URLSearchParams(Object.fromEntries(Object.entries(body).map(([k, v]) => [k, String(v)]))),
+      {
+        status,
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          "cache-control": "no-store",
+          ...response.headers.has("retry-after") ? { "retry-after": response.headers.get("retry-after") ?? "1" } : {}
+        }
+      }
+    );
+  }
+  async token(request, issuer) {
+    let p;
+    if (this.provider === "github" && request.headers.get("content-type")?.startsWith("application/json")) {
+      try {
+        const text = await request.text();
+        if (text.length <= 16384) {
+          const body = JSON.parse(text);
+          if (body && typeof body === "object" && !Array.isArray(body) && Object.values(body).every((v) => typeof v === "string"))
+            p = new URLSearchParams(body);
+        }
+      } catch {
+      }
+    } else p = await this.form(request);
+    if (!p)
+      return fail("invalid_request", "Expected form-encoded body without duplicate parameters");
+    const client = await this.authenticate(request, p);
+    if (client instanceof Response) return client;
+    const type = p.get("grant_type") ?? (this.provider === "github" ? "authorization_code" : null);
+    if (type !== "authorization_code" && type !== "refresh_token")
+      return fail("unsupported_grant_type", "Unsupported grant_type");
+    const key = p.get(type === "authorization_code" ? "code" : "refresh_token") ?? "";
+    const stored = type === "authorization_code" ? this.codes.get(key) : this.tokens.get(key);
+    const account = stored && this.accounts.get(stored.accountId);
+    if (!stored || stored.clientId !== client.id || stored.expires <= this.now() || !account || account.disabled || type === "refresh_token" && (!("kind" in stored) || stored.kind !== "refresh"))
+      return fail("invalid_grant", "Invalid, expired or consumed grant");
+    if (type === "refresh_token" && this.provider === "google" && "lastUsed" in stored && typeof stored.lastUsed === "number") {
+      const inactiveUntil = new Date(stored.lastUsed);
+      inactiveUntil.setUTCMonth(inactiveUntil.getUTCMonth() + 6);
+      if (this.now() >= inactiveUntil.getTime()) {
+        this.tokens.delete(key);
+        return fail("invalid_grant", "Refresh token expired after six months of inactivity");
+      }
+    }
+    if (this.provider === "github" && (account.emailVerified === false || account.github?.emails?.find((e) => e.primary)?.verified === false || stored.decisions.unverifiedEmail))
+      return fail("unverified_user_email", "The user must have a verified primary email.");
+    const behavior = this.behavior.config;
+    const effects2 = this.behavior.sample("token", ["tokenUnavailable", "invalidGrant"]);
+    if (effects2.tokenUnavailable) {
+      const response = fail(
+        "temporarily_unavailable",
+        "Authorization server temporarily unavailable",
+        503
+      );
+      response.headers.set("retry-after", "1");
+      return response;
+    }
+    if (type === "refresh_token" && (behavior.tokens?.refreshError || effects2.invalidGrant)) {
+      if (behavior.tokens?.refreshError === "invalid_grant" || effects2.invalidGrant)
+        for (const row of this.tokens.list({ where: (t) => t.family === stored.family }))
+          this.tokens.delete(row.id);
+      return json4(
+        {
+          error: "invalid_grant",
+          error_description: "Token has been expired or revoked.",
+          ...behavior.tokens?.refreshError === "invalid_rapt" ? { error_subtype: "invalid_rapt" } : {}
+        },
+        400
+      );
+    }
+    if (effects2.invalidGrant) {
+      this.codes.delete(key);
+      return fail("invalid_grant", "Token has been expired or revoked.");
+    }
+    if (type === "refresh_token" && "consumed" in stored && stored.consumed) {
+      for (const row of this.tokens.list({ where: (t) => t.family === stored.family }))
+        this.tokens.delete(row.id);
+      return fail("invalid_grant", "Refresh token reuse detected; token family revoked");
+    }
+    if (type === "authorization_code") {
+      if ((this.provider !== "github" || p.has("redirect_uri")) && p.get("redirect_uri") !== stored.redirectUri)
+        return fail("invalid_grant", "redirect_uri mismatch");
+      if (stored.challenge) {
+        const verifier = p.get("code_verifier") ?? "";
+        if (!/^[A-Za-z0-9._~-]{43,128}$/.test(verifier) || await hash(verifier) !== stored.challenge)
+          return fail("invalid_grant", "PKCE verification failed");
+      }
+      if (!this.codes.delete(key))
+        return fail("invalid_grant", "Authorization code already consumed");
+    }
+    const grant = { ...stored };
+    if (type === "refresh_token" && p.has("scope")) {
+      const requested = p.get("scope") ?? "";
+      if ([...scopes(requested)].some((s) => !scopes(stored.scope).has(s)))
+        return fail("invalid_scope", "Cannot expand granted scope");
+      grant.scope = requested;
+    }
+    if (type === "refresh_token")
+      this.tokens.update(key, { ...stored, kind: "refresh", lastUsed: this.now() });
+    const accessTtl = behavior.tokens?.accessTtlSeconds ?? 3600;
+    const access = random();
+    const result = {
+      access_token: access,
+      token_type: "Bearer",
+      expires_in: accessTtl,
+      scope: grant.scope
+    };
+    if (this.provider === "apple") {
+      result.token_type = "bearer";
+      delete result.scope;
+    }
+    if (this.provider === "microsoft") result.ext_expires_in = accessTtl;
+    if (this.provider === "github") {
+      delete result.expires_in;
+      result.token_type = "bearer";
+      result.scope = [...scopes(grant.scope)].sort().join(",");
+    }
+    const rotating = type === "refresh_token" && behavior.tokens?.refreshRotation === "rotate";
+    const microsoftRefresh = type === "refresh_token" && this.provider === "microsoft";
+    if (rotating) this.tokens.update(key, { ...stored, kind: "refresh", consumed: true });
+    this.tokens.insert(access, {
+      ...grant,
+      expires: this.provider === "github" && !behavior.tokens?.accessTtlSeconds ? Number.MAX_SAFE_INTEGER : this.now() + accessTtl * 1e3,
+      kind: "access",
+      consumed: false
+    });
+    const refreshKey = JSON.stringify([grant.clientId, grant.accountId]);
+    const googleEligible = this.provider !== "google" || behavior.google?.refreshToken === "always" || grant.forceConsent || !this.refreshIssued.has(refreshKey);
+    if (type === "authorization_code" && grant.issueRefresh && googleEligible || rotating || microsoftRefresh) {
+      const refresh = random();
+      const basicScopes = [
+        "openid",
+        "email",
+        "profile",
+        "https://www.googleapis.com/auth/userinfo.email",
+        "https://www.googleapis.com/auth/userinfo.profile"
+      ];
+      const testingExpiry = this.provider === "google" && behavior.google?.testing && [...scopes(grant.scope)].some((s) => !basicScopes.includes(s));
+      const refreshTtl = behavior.tokens?.refreshTtlSeconds ?? (testingExpiry ? 604800 : this.provider === "microsoft" ? 7776e3 : 2592e3);
+      const unbounded = behavior.tokens?.refreshTtlSeconds === void 0 && !testingExpiry && (this.provider === "google" || this.provider === "apple");
+      this.tokens.insert(refresh, {
+        ...grant,
+        expires: rotating || microsoftRefresh ? stored.expires : unbounded ? Number.MAX_SAFE_INTEGER : this.now() + refreshTtl * 1e3,
+        lastUsed: this.now(),
+        kind: "refresh",
+        consumed: false
+      });
+      if (this.provider === "google") {
+        const outstanding = this.tokens.list({
+          order: "oldest",
+          where: (t) => t.kind === "refresh" && t.accountId === grant.accountId && t.clientId === grant.clientId
+        });
+        for (const row of outstanding.slice(
+          0,
+          Math.max(0, outstanding.length - (behavior.google?.maxRefreshTokens ?? 100))
+        ))
+          this.tokens.delete(row.id);
+      }
+      this.refreshIssued.insert(refreshKey, { issued: true });
+      result.refresh_token = refresh;
+      if (testingExpiry) result.refresh_token_expires_in = refreshTtl;
+    }
+    if (this.provider !== "github" && (scopes(grant.scope).has("openid") || this.provider === "apple"))
+      result.id_token = await this.idToken(grant, issuer, { at_hash: await halfHash(access) });
+    if (this.provider === "github" && !request.headers.get("accept")?.includes("application/json"))
+      return new Response(
+        new URLSearchParams(
+          Object.fromEntries(Object.entries(result).map(([k, v]) => [k, String(v)]))
+        ),
+        {
+          headers: {
+            "content-type": "application/x-www-form-urlencoded",
+            "cache-control": "no-store"
+          }
+        }
+      );
+    return json4(result);
+  }
+};
+
+export {
+  OAUTH_SCENARIOS,
+  document,
+  operationIds,
+  supportedOperationIds,
+  OAUTH_PRESETS,
+  createRuntime2 as createRuntime,
+  createMultiRuntime,
+  OAuthAPI
+};
+//# sourceMappingURL=chunk-X6FYBOEA.js.map