@desplega.ai/agent-swarm 1.119.5 → 1.120.0

package/dist/cli-84j2vp67.js

@@ -0,0 +1,791 @@
+import {
+  decryptSecret,
+  encryptSecret,
+  getDb,
+  getEncryptionKey,
+  init_crypto,
+  init_date_utils,
+  init_db,
+  normalizeDateRequired
+} from "./cli-383wyw2f.js";
+
+// src/be/db-queries/oauth.ts
+init_crypto();
+init_date_utils();
+init_db();
+function parseScopeList(value) {
+  try {
+    const parsed = JSON.parse(value);
+    if (Array.isArray(parsed)) {
+      return parsed.filter((item) => typeof item === "string");
+    }
+  } catch {}
+  return value.split(",").map((scope) => scope.trim()).filter(Boolean);
+}
+function storeScopeList(value) {
+  return JSON.stringify(Array.isArray(value) ? value : parseScopeList(value));
+}
+function parseObject(value) {
+  try {
+    const parsed = JSON.parse(value || "{}");
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function storageMetadata(metadata) {
+  const parsed = parseObject(metadata);
+  const extraParams = parsed.extraParams && typeof parsed.extraParams === "object" && !Array.isArray(parsed.extraParams) ? parsed.extraParams : null;
+  const tokenAuthStyle = parsed.tokenAuthStyle === "basic" ? "basic" : "body";
+  const tokenBodyFormat = parsed.tokenBodyFormat === "json" ? "json" : "form";
+  const revocationUrl = typeof parsed.revocationUrl === "string" ? parsed.revocationUrl : null;
+  const hasLiftedFields = [
+    "extraParams",
+    "tokenAuthStyle",
+    "tokenBodyFormat",
+    "revocationUrl"
+  ].some((key) => Object.hasOwn(parsed, key));
+  if (hasLiftedFields) {
+    delete parsed.extraParams;
+    delete parsed.tokenAuthStyle;
+    delete parsed.tokenBodyFormat;
+    delete parsed.revocationUrl;
+  }
+  return {
+    metadata: hasLiftedFields ? JSON.stringify(parsed) : metadata,
+    extraParamsJson: extraParams ? JSON.stringify(extraParams) : null,
+    tokenAuthStyle,
+    tokenBodyFormat,
+    revocationUrl
+  };
+}
+function normalizeOAuthApp(row) {
+  const encrypted = row.clientSecretEncrypted === 1;
+  return {
+    ...row,
+    clientSecret: row.clientSecret == null ? "" : encrypted ? decryptSecret(row.clientSecret, getEncryptionKey()) : row.clientSecret,
+    clientSecretEncrypted: encrypted,
+    scopes: parseScopeList(row.scopes).join(","),
+    requiresRefreshTokenRotation: row.requiresRefreshTokenRotation === 1,
+    createdAt: normalizeDateRequired(row.createdAt),
+    updatedAt: normalizeDateRequired(row.updatedAt)
+  };
+}
+function normalizeAuthorization(row) {
+  const encrypted = row.tokensEncrypted === 1;
+  const key = encrypted ? getEncryptionKey() : null;
+  return {
+    ...row,
+    accessToken: key ? decryptSecret(row.accessToken, key) : row.accessToken,
+    refreshToken: row.refreshToken == null ? null : key ? decryptSecret(row.refreshToken, key) : row.refreshToken,
+    tokensEncrypted: encrypted,
+    createdAt: normalizeDateRequired(row.createdAt),
+    updatedAt: normalizeDateRequired(row.updatedAt)
+  };
+}
+function rawOAuthAppByProvider(provider) {
+  return getDb().query(`SELECT * FROM oauth_apps
+       WHERE provider = ? AND mcpServerId IS NULL
+       ORDER BY createdAt ASC, id ASC
+       LIMIT 1`).get(provider);
+}
+function rawOAuthAppById(id) {
+  return getDb().query("SELECT * FROM oauth_apps WHERE id = ? AND mcpServerId IS NULL").get(id);
+}
+function rawDefaultAuthorizationForApp(appId) {
+  return getDb().query("SELECT * FROM oauth_authorizations WHERE appId = ? AND label = 'default'").get(appId);
+}
+function rawDefaultAuthorizationForProvider(provider) {
+  return getDb().query(`SELECT z.*
+       FROM oauth_authorizations z
+       JOIN oauth_apps a ON a.id = z.appId
+       WHERE a.provider = ? AND a.mcpServerId IS NULL AND z.label = 'default'
+       ORDER BY a.createdAt ASC, a.id ASC
+       LIMIT 1`).get(provider);
+}
+function getDefaultAuthorizationIdForProvider(provider) {
+  return rawDefaultAuthorizationForProvider(provider)?.id ?? null;
+}
+function getOAuthApp(provider) {
+  const row = rawOAuthAppByProvider(provider);
+  return row ? normalizeOAuthApp(row) : null;
+}
+function getOAuthAppById(id) {
+  const row = getDb().query("SELECT * FROM oauth_apps WHERE id = ?").get(id);
+  return row ? normalizeOAuthApp(row) : null;
+}
+function getOAuthAppIdByProvider(provider) {
+  return rawOAuthAppByProvider(provider)?.id ?? null;
+}
+function writeOAuthApp(existing, provider, data) {
+  const metadataProvided = data.metadata !== undefined;
+  const lifted = metadataProvided ? storageMetadata(data.metadata) : null;
+  const encryptedSecret = encryptSecret(data.clientSecret, getEncryptionKey());
+  const scopeSeparator = data.scopeSeparator ?? existing?.scopeSeparator ?? (provider === "linear" ? "," : " ");
+  const rotation = data.requiresRefreshTokenRotation ?? (existing ? existing.requiresRefreshTokenRotation === 1 : provider === "jira");
+  const tokenAuthStyle = data.tokenAuthStyle ?? lifted?.tokenAuthStyle ?? existing?.tokenAuthStyle ?? "body";
+  const tokenBodyFormat = data.tokenBodyFormat ?? lifted?.tokenBodyFormat ?? existing?.tokenBodyFormat ?? "form";
+  const extraParamsJson = data.extraParams !== undefined ? data.extraParams == null ? null : JSON.stringify(data.extraParams) : lifted ? lifted.extraParamsJson : existing?.extraParamsJson ?? null;
+  const revocationUrl = data.revocationUrl !== undefined ? data.revocationUrl : lifted ? lifted.revocationUrl : existing?.revocationUrl ?? null;
+  if (existing) {
+    getDb().query(`UPDATE oauth_apps SET
+           displayName = ?, clientId = ?, clientSecret = ?, clientSecretEncrypted = 1,
+           authorizeUrl = ?, tokenUrl = ?, revocationUrl = ?, userinfoUrl = ?,
+           redirectUri = ?, scopes = ?, scopeSeparator = ?, tokenAuthStyle = ?,
+           tokenBodyFormat = ?, requiresRefreshTokenRotation = ?, extraParamsJson = ?,
+           source = ?, metadata = ?, updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+         WHERE id = ?`).run(data.displayName !== undefined ? data.displayName : existing.displayName, data.clientId, encryptedSecret, data.authorizeUrl, data.tokenUrl, revocationUrl, data.userinfoUrl !== undefined ? data.userinfoUrl : existing.userinfoUrl, data.redirectUri, storeScopeList(data.scopes), scopeSeparator, tokenAuthStyle, tokenBodyFormat, rotation ? 1 : 0, extraParamsJson, data.source ?? existing.source, lifted?.metadata ?? existing.metadata, existing.id);
+    return existing.id;
+  }
+  const inserted = getDb().query(`INSERT INTO oauth_apps (
+         provider, displayName, clientId, clientSecret, clientSecretEncrypted,
+         authorizeUrl, tokenUrl, revocationUrl, userinfoUrl, redirectUri, scopes,
+         scopeSeparator, tokenAuthStyle, tokenBodyFormat,
+         requiresRefreshTokenRotation, extraParamsJson, source, metadata
+       ) VALUES (?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       RETURNING id`).get(provider, data.displayName ?? null, data.clientId, encryptedSecret, data.authorizeUrl, data.tokenUrl, revocationUrl, data.userinfoUrl ?? null, data.redirectUri, storeScopeList(data.scopes), scopeSeparator, tokenAuthStyle, tokenBodyFormat, rotation ? 1 : 0, extraParamsJson, data.source ?? "manual", lifted?.metadata ?? "{}");
+  return inserted.id;
+}
+function createOAuthApp(provider, data) {
+  return writeOAuthApp(null, provider, data);
+}
+function updateOAuthAppById(id, data) {
+  const existing = rawOAuthAppById(id);
+  if (!existing) {
+    throw new Error(`OAuth app ${id} not found.`);
+  }
+  writeOAuthApp(existing, existing.provider, data);
+}
+function upsertOAuthApp(provider, data) {
+  writeOAuthApp(rawOAuthAppByProvider(provider), provider, data);
+}
+function listAuthorizationsForApp(appId) {
+  const rows = getDb().query("SELECT * FROM oauth_authorizations WHERE appId = ? ORDER BY createdAt ASC, id ASC").all(appId);
+  return rows.map(normalizeAuthorization);
+}
+function getAuthorizationById(id) {
+  const row = getDb().query("SELECT * FROM oauth_authorizations WHERE id = ?").get(id);
+  return row ? normalizeAuthorization(row) : null;
+}
+function upsertAuthorization(data) {
+  const label = data.label ?? "default";
+  const existing = data.id ? getAuthorizationById(data.id) : listAuthorizationsForApp(data.appId).find((row) => row.label === label);
+  const key = getEncryptionKey();
+  const accessToken = encryptSecret(data.accessToken, key);
+  const refreshToken = data.refreshToken === undefined ? undefined : data.refreshToken == null ? null : encryptSecret(data.refreshToken, key);
+  if (existing) {
+    getDb().query(`UPDATE oauth_authorizations SET
+           userId = ?, accountEmail = ?, identityJson = ?, accessToken = ?,
+           refreshToken = ?, tokenType = ?, expiresAt = ?, scope = ?,
+           tokensEncrypted = 1, tokenVersion = tokenVersion + 1, status = ?,
+           lastErrorMessage = ?, lastRefreshedAt = ?, connectedByUserId = ?,
+           updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+         WHERE id = ?`).run(data.userId !== undefined ? data.userId : existing.userId, data.accountEmail !== undefined ? data.accountEmail : existing.accountEmail, data.identityJson !== undefined ? data.identityJson : existing.identityJson, accessToken, refreshToken === undefined ? existing.refreshToken == null ? null : encryptSecret(existing.refreshToken, key) : refreshToken, data.tokenType ?? existing.tokenType, data.expiresAt !== undefined ? data.expiresAt : existing.expiresAt, data.scope !== undefined ? data.scope : existing.scope, data.status ?? existing.status, data.lastErrorMessage !== undefined ? data.lastErrorMessage : existing.lastErrorMessage, data.lastRefreshedAt !== undefined ? data.lastRefreshedAt : existing.lastRefreshedAt, data.connectedByUserId !== undefined ? data.connectedByUserId : existing.connectedByUserId, existing.id);
+    return getAuthorizationById(existing.id);
+  }
+  const id = data.id ?? crypto.randomUUID();
+  getDb().query(`INSERT INTO oauth_authorizations (
+         id, appId, label, userId, accountEmail, identityJson,
+         accessToken, refreshToken, tokenType, expiresAt, scope,
+         tokensEncrypted, tokenVersion, status, lastErrorMessage,
+         lastRefreshedAt, connectedByUserId
+       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, 1, ?, ?, ?, ?)`).run(id, data.appId, label, data.userId ?? null, data.accountEmail ?? null, data.identityJson ?? null, accessToken, refreshToken ?? null, data.tokenType ?? "Bearer", data.expiresAt ?? null, data.scope ?? null, data.status ?? "active", data.lastErrorMessage ?? null, data.lastRefreshedAt ?? null, data.connectedByUserId ?? null);
+  return getAuthorizationById(id);
+}
+function updateAuthorizationTokens(id, data) {
+  const existing = getAuthorizationById(id);
+  if (!existing)
+    return null;
+  const expectedVersion = data.expectedTokenVersion ?? existing.tokenVersion;
+  const key = getEncryptionKey();
+  const encryptedRefresh = data.refreshToken === undefined ? existing.refreshToken == null ? null : encryptSecret(existing.refreshToken, key) : data.refreshToken == null ? null : encryptSecret(data.refreshToken, key);
+  const result = getDb().query(`UPDATE oauth_authorizations SET
+         accessToken = ?, refreshToken = ?, expiresAt = ?, scope = ?,
+         tokensEncrypted = 1, tokenVersion = tokenVersion + 1,
+         status = 'active', lastErrorMessage = NULL,
+         lastRefreshedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
+         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+       WHERE id = ? AND tokenVersion = ?`).run(encryptSecret(data.accessToken, key), encryptedRefresh, data.expiresAt !== undefined ? data.expiresAt : existing.expiresAt, data.scope !== undefined ? data.scope : existing.scope, id, expectedVersion);
+  return result.changes === 1 ? getAuthorizationById(id) : null;
+}
+function updateAuthorizationIdentity(id, data) {
+  getDb().query(`UPDATE oauth_authorizations SET
+         accountEmail = ?, identityJson = ?,
+         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+       WHERE id = ?`).run(data.accountEmail ?? null, data.identityJson ?? null, id);
+}
+function deleteAuthorizationById(id) {
+  const result = getDb().query("DELETE FROM oauth_authorizations WHERE id = ?").run(id);
+  return result.changes > 0;
+}
+function deleteAuthorizationsForApp(appId) {
+  return getDb().query("DELETE FROM oauth_authorizations WHERE appId = ?").run(appId).changes;
+}
+var OAUTH_PENDING_TTL_MS = 10 * 60 * 1000;
+function createOAuthPending(input) {
+  getDb().query(`INSERT INTO oauth_pending (
+         state, appId, label, flow, codeVerifier, nonce,
+         redirectUri, finalRedirect, userId, contextJson
+       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(input.state, input.appId, input.label ?? "default", input.flow ?? "generic", encryptSecret(input.codeVerifier, getEncryptionKey()), input.nonce ?? null, input.redirectUri, input.finalRedirect ?? null, input.userId ?? null, input.contextJson ?? "{}");
+}
+function consumeOAuthPending(state) {
+  return getDb().transaction(() => {
+    const row = getDb().query(`SELECT state, appId, label, flow, codeVerifier, nonce, redirectUri,
+                finalRedirect, userId, contextJson, createdAt
+         FROM oauth_pending
+         WHERE state = ? AND flow IN ('generic', 'tracker')`).get(state);
+    if (!row)
+      return null;
+    getDb().query("DELETE FROM oauth_pending WHERE state = ?").run(state);
+    const createdAt = normalizeDateRequired(row.createdAt);
+    const createdMs = new Date(createdAt).getTime();
+    if (Number.isNaN(createdMs) || Date.now() - createdMs > OAUTH_PENDING_TTL_MS) {
+      return null;
+    }
+    return {
+      ...row,
+      codeVerifier: decryptSecret(row.codeVerifier, getEncryptionKey()),
+      createdAt
+    };
+  })();
+}
+function gcOAuthPending(olderThanMs = 10 * 60 * 1000) {
+  const cutoff = new Date(Date.now() - olderThanMs).toISOString();
+  return getDb().query("DELETE FROM oauth_pending WHERE flow IN ('generic', 'tracker') AND createdAt < ?").run(cutoff).changes;
+}
+function markAuthorizationRefreshFailed(id, message) {
+  const result = getDb().query(`UPDATE oauth_authorizations SET
+         status = 'refresh-failed', lastErrorMessage = ?,
+         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+       WHERE id = ? AND status != 'revoked'`).run(message, id);
+  return result.changes === 1 ? getAuthorizationById(id) : null;
+}
+function getOAuthTokens(provider) {
+  const row = rawDefaultAuthorizationForProvider(provider);
+  if (!row)
+    return null;
+  const authorization = normalizeAuthorization(row);
+  if (authorization.status === "revoked")
+    return null;
+  return {
+    id: authorization.id,
+    provider,
+    accessToken: authorization.accessToken,
+    refreshToken: authorization.refreshToken,
+    expiresAt: authorization.expiresAt ?? "",
+    scope: authorization.scope,
+    tokenVersion: authorization.tokenVersion,
+    createdAt: authorization.createdAt,
+    updatedAt: authorization.updatedAt
+  };
+}
+function listAuthorizationSweepRows() {
+  const rows = getDb().query(`SELECT z.id AS authorizationId,
+              z.appId AS appId,
+              a.provider AS provider,
+              z.label AS label,
+              z.status AS status,
+              CASE WHEN z.refreshToken IS NOT NULL AND z.refreshToken != '' THEN 1 ELSE 0 END AS hasRefreshToken,
+              COALESCE(z.expiresAt, '') AS expiresAt,
+              z.updatedAt AS updatedAt
+       FROM oauth_authorizations z
+       JOIN oauth_apps a ON a.id = z.appId
+       WHERE a.mcpServerId IS NULL
+       ORDER BY a.provider ASC, z.label ASC`).all();
+  return rows.map((row) => ({
+    authorizationId: row.authorizationId,
+    appId: row.appId,
+    provider: row.provider,
+    label: row.label,
+    status: row.status,
+    hasRefreshToken: row.hasRefreshToken === 1,
+    expiresAt: normalizeDateRequired(row.expiresAt),
+    updatedAt: normalizeDateRequired(row.updatedAt)
+  }));
+}
+function listKeepAliveAuthorizations() {
+  const rows = getDb().query(`SELECT z.id AS authorizationId,
+              z.appId AS appId,
+              a.provider AS provider,
+              z.label AS label,
+              a.displayName AS displayName
+       FROM oauth_authorizations z
+       JOIN oauth_apps a ON a.id = z.appId
+       WHERE a.mcpServerId IS NULL
+         AND z.status = 'active'
+         AND z.refreshToken IS NOT NULL AND z.refreshToken != ''
+         AND (
+           a.requiresRefreshTokenRotation = 1
+           OR (json_valid(a.metadata) = 1 AND json_extract(a.metadata, '$.keepAlive') IN (1, 'true'))
+         )
+       ORDER BY a.provider ASC, z.label ASC`).all();
+  return rows.map((row) => ({
+    authorizationId: row.authorizationId,
+    appId: row.appId,
+    provider: row.provider,
+    label: row.label,
+    displayName: row.displayName
+  }));
+}
+function deleteOAuthTokens(provider) {
+  const app = rawOAuthAppByProvider(provider);
+  if (!app)
+    return;
+  const existing = rawDefaultAuthorizationForApp(app.id);
+  if (!existing)
+    return;
+  getDb().query(`UPDATE oauth_authorizations SET
+         accessToken = ?, refreshToken = NULL, expiresAt = NULL, scope = NULL,
+         tokensEncrypted = 1, tokenVersion = tokenVersion + 1,
+         status = 'revoked', lastErrorMessage = NULL, lastRefreshedAt = NULL,
+         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+       WHERE id = ?`).run(encryptSecret("", getEncryptionKey()), existing.id);
+}
+function acquireOAuthRefreshLock(lockKey, ttlMs) {
+  const owner = crypto.randomUUID();
+  const now = Date.now();
+  const expiresAt = new Date(now + ttlMs).toISOString();
+  const nowIso = new Date(now).toISOString();
+  getDb().query(`INSERT INTO oauth_refresh_locks (lockKey, owner, expiresAt, createdAt, updatedAt)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(lockKey) DO UPDATE SET
+         owner = excluded.owner,
+         expiresAt = excluded.expiresAt,
+         updatedAt = excluded.updatedAt
+       WHERE oauth_refresh_locks.expiresAt <= ?`).run(lockKey, owner, expiresAt, nowIso, nowIso, nowIso);
+  const row = getDb().query("SELECT owner FROM oauth_refresh_locks WHERE lockKey = ?").get(lockKey);
+  return row?.owner === owner ? owner : null;
+}
+function releaseOAuthRefreshLock(lockKey, owner) {
+  getDb().query("DELETE FROM oauth_refresh_locks WHERE lockKey = ? AND owner = ?").run(lockKey, owner);
+}
+
+// node_modules/oauth4webapi/build/index.js
+var USER_AGENT;
+if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
+  const NAME = "oauth4webapi";
+  const VERSION = "v3.8.5";
+  USER_AGENT = `${NAME}/${VERSION}`;
+}
+var ERR_INVALID_ARG_VALUE = "ERR_INVALID_ARG_VALUE";
+var ERR_INVALID_ARG_TYPE = "ERR_INVALID_ARG_TYPE";
+function CodedTypeError(message, code, cause) {
+  const err = new TypeError(message, { cause });
+  Object.assign(err, { code });
+  return err;
+}
+var allowInsecureRequests = Symbol();
+var clockSkew = Symbol();
+var clockTolerance = Symbol();
+var customFetch = Symbol();
+var modifyAssertion = Symbol();
+var jweDecrypt = Symbol();
+var jwksCache = Symbol();
+var encoder = new TextEncoder;
+var decoder = new TextDecoder;
+function buf(input) {
+  if (typeof input === "string") {
+    return encoder.encode(input);
+  }
+  return decoder.decode(input);
+}
+var encodeBase64Url;
+if (Uint8Array.prototype.toBase64) {
+  encodeBase64Url = (input) => {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    return input.toBase64({ alphabet: "base64url", omitPadding: true });
+  };
+} else {
+  const CHUNK_SIZE = 32768;
+  encodeBase64Url = (input) => {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    const arr = [];
+    for (let i = 0;i < input.byteLength; i += CHUNK_SIZE) {
+      arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+    }
+    return btoa(arr.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  };
+}
+var decodeBase64Url;
+if (Uint8Array.fromBase64) {
+  decodeBase64Url = (input) => {
+    try {
+      return Uint8Array.fromBase64(input, { alphabet: "base64url" });
+    } catch (cause) {
+      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+} else {
+  decodeBase64Url = (input) => {
+    try {
+      const binary = atob(input.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, ""));
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0;i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+      }
+      return bytes;
+    } catch (cause) {
+      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+}
+function b64u(input) {
+  if (typeof input === "string") {
+    return decodeBase64Url(input);
+  }
+  return encodeBase64Url(input);
+}
+
+class UnsupportedOperationError extends Error {
+  code;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    this.code = UNSUPPORTED_OPERATION;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+
+class OperationProcessingError extends Error {
+  code;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    if (options?.code) {
+      this.code = options?.code;
+    }
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+function OPE(message, code, cause) {
+  return new OperationProcessingError(message, { code, cause });
+}
+async function calculateJwkThumbprint(jwk) {
+  let components;
+  switch (jwk.kty) {
+    case "EC":
+      components = {
+        crv: jwk.crv,
+        kty: jwk.kty,
+        x: jwk.x,
+        y: jwk.y
+      };
+      break;
+    case "OKP":
+      components = {
+        crv: jwk.crv,
+        kty: jwk.kty,
+        x: jwk.x
+      };
+      break;
+    case "AKP":
+      components = {
+        alg: jwk.alg,
+        kty: jwk.kty,
+        pub: jwk.pub
+      };
+      break;
+    case "RSA":
+      components = {
+        e: jwk.e,
+        kty: jwk.kty,
+        n: jwk.n
+      };
+      break;
+    default:
+      throw new UnsupportedOperationError("unsupported JWK key type", { cause: jwk });
+  }
+  return b64u(await crypto.subtle.digest("SHA-256", buf(JSON.stringify(components))));
+}
+function assertCryptoKey(key, it) {
+  if (!(key instanceof CryptoKey)) {
+    throw CodedTypeError(`${it} must be a CryptoKey`, ERR_INVALID_ARG_TYPE);
+  }
+}
+function assertPrivateKey(key, it) {
+  assertCryptoKey(key, it);
+  if (key.type !== "private") {
+    throw CodedTypeError(`${it} must be a private CryptoKey`, ERR_INVALID_ARG_VALUE);
+  }
+}
+function assertPublicKey(key, it) {
+  assertCryptoKey(key, it);
+  if (key.type !== "public") {
+    throw CodedTypeError(`${it} must be a public CryptoKey`, ERR_INVALID_ARG_VALUE);
+  }
+}
+function assertString(input, it, code, cause) {
+  try {
+    if (typeof input !== "string") {
+      throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE, cause);
+    }
+    if (input.length === 0) {
+      throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE, cause);
+    }
+  } catch (err) {
+    if (code) {
+      throw OPE(err.message, code, cause);
+    }
+    throw err;
+  }
+}
+function randomBytes() {
+  return b64u(crypto.getRandomValues(new Uint8Array(32)));
+}
+function generateRandomCodeVerifier() {
+  return randomBytes();
+}
+function generateRandomState() {
+  return randomBytes();
+}
+async function calculatePKCECodeChallenge(codeVerifier) {
+  assertString(codeVerifier, "codeVerifier");
+  return b64u(await crypto.subtle.digest("SHA-256", buf(codeVerifier)));
+}
+function psAlg(key) {
+  switch (key.algorithm.hash.name) {
+    case "SHA-256":
+      return "PS256";
+    case "SHA-384":
+      return "PS384";
+    case "SHA-512":
+      return "PS512";
+    default:
+      throw new UnsupportedOperationError("unsupported RsaHashedKeyAlgorithm hash name", {
+        cause: key
+      });
+  }
+}
+function rsAlg(key) {
+  switch (key.algorithm.hash.name) {
+    case "SHA-256":
+      return "RS256";
+    case "SHA-384":
+      return "RS384";
+    case "SHA-512":
+      return "RS512";
+    default:
+      throw new UnsupportedOperationError("unsupported RsaHashedKeyAlgorithm hash name", {
+        cause: key
+      });
+  }
+}
+function esAlg(key) {
+  switch (key.algorithm.namedCurve) {
+    case "P-256":
+      return "ES256";
+    case "P-384":
+      return "ES384";
+    case "P-521":
+      return "ES512";
+    default:
+      throw new UnsupportedOperationError("unsupported EcKeyAlgorithm namedCurve", { cause: key });
+  }
+}
+function keyToJws(key) {
+  switch (key.algorithm.name) {
+    case "RSA-PSS":
+      return psAlg(key);
+    case "RSASSA-PKCS1-v1_5":
+      return rsAlg(key);
+    case "ECDSA":
+      return esAlg(key);
+    case "Ed25519":
+    case "ML-DSA-44":
+    case "ML-DSA-65":
+    case "ML-DSA-87":
+      return key.algorithm.name;
+    case "EdDSA":
+      return "Ed25519";
+    default:
+      throw new UnsupportedOperationError("unsupported CryptoKey algorithm name", { cause: key });
+  }
+}
+function getClockSkew(client) {
+  const skew = client?.[clockSkew];
+  return typeof skew === "number" && Number.isFinite(skew) ? skew : 0;
+}
+function epochTime() {
+  return Math.floor(Date.now() / 1000);
+}
+async function signJwt(header, payload, key) {
+  if (!key.usages.includes("sign")) {
+    throw CodedTypeError('CryptoKey instances used for signing assertions must include "sign" in their "usages"', ERR_INVALID_ARG_VALUE);
+  }
+  const input = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(payload)))}`;
+  const signature = b64u(await crypto.subtle.sign(keyToSubtle(key), key, buf(input)));
+  return `${input}.${signature}`;
+}
+var jwkCache;
+async function getSetPublicJwkCache(key, alg) {
+  const { kty, e, n, x, y, crv, pub } = await crypto.subtle.exportKey("jwk", key);
+  const jwk = { kty, e, n, x, y, crv, pub };
+  if (kty === "AKP")
+    jwk.alg = alg;
+  jwkCache.set(key, jwk);
+  return jwk;
+}
+async function publicJwk(key, alg) {
+  jwkCache ||= new WeakMap;
+  return jwkCache.get(key) || getSetPublicJwkCache(key, alg);
+}
+var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) => {
+  try {
+    return new URL(url, base);
+  } catch {
+    return null;
+  }
+};
+class DPoPHandler {
+  #header;
+  #privateKey;
+  #publicKey;
+  #clockSkew;
+  #modifyAssertion;
+  #map;
+  #jkt;
+  constructor(client, keyPair, options) {
+    assertPrivateKey(keyPair?.privateKey, '"DPoP.privateKey"');
+    assertPublicKey(keyPair?.publicKey, '"DPoP.publicKey"');
+    if (!keyPair.publicKey.extractable) {
+      throw CodedTypeError('"DPoP.publicKey.extractable" must be true', ERR_INVALID_ARG_VALUE);
+    }
+    this.#modifyAssertion = options?.[modifyAssertion];
+    this.#clockSkew = getClockSkew(client);
+    this.#privateKey = keyPair.privateKey;
+    this.#publicKey = keyPair.publicKey;
+    branded.add(this);
+  }
+  #get(key) {
+    this.#map ||= new Map;
+    let item = this.#map.get(key);
+    if (item) {
+      this.#map.delete(key);
+      this.#map.set(key, item);
+    }
+    return item;
+  }
+  #set(key, val) {
+    this.#map ||= new Map;
+    this.#map.delete(key);
+    if (this.#map.size === 100) {
+      this.#map.delete(this.#map.keys().next().value);
+    }
+    this.#map.set(key, val);
+  }
+  async calculateThumbprint() {
+    if (!this.#jkt) {
+      const jwk = await crypto.subtle.exportKey("jwk", this.#publicKey);
+      this.#jkt ||= await calculateJwkThumbprint(jwk);
+    }
+    return this.#jkt;
+  }
+  async addProof(url, headers, htm, accessToken) {
+    const alg = keyToJws(this.#privateKey);
+    this.#header ||= {
+      alg,
+      typ: "dpop+jwt",
+      jwk: await publicJwk(this.#publicKey, alg)
+    };
+    const nonce = this.#get(url.origin);
+    const now = epochTime() + this.#clockSkew;
+    const payload = {
+      iat: now,
+      jti: randomBytes(),
+      htm,
+      nonce,
+      htu: `${url.origin}${url.pathname}`,
+      ath: accessToken ? b64u(await crypto.subtle.digest("SHA-256", buf(accessToken))) : undefined
+    };
+    this.#modifyAssertion?.(this.#header, payload);
+    headers.set("dpop", await signJwt(this.#header, payload, this.#privateKey));
+  }
+  cacheNonce(response, url) {
+    try {
+      const nonce = response.headers.get("dpop-nonce");
+      if (nonce) {
+        this.#set(url.origin, nonce);
+      }
+    } catch {}
+  }
+}
+var tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
+var token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
+var quotedMatch = '"((?:[^"\\\\]|\\\\[\\s\\S])*)"';
+var quotedParamMatcher = "(" + tokenMatch + ")\\s*=\\s*" + quotedMatch;
+var paramMatcher = "(" + tokenMatch + ")\\s*=\\s*(" + tokenMatch + ")";
+var schemeRE = new RegExp("^[,\\s]*(" + tokenMatch + ")");
+var quotedParamRE = new RegExp("^[,\\s]*" + quotedParamMatcher + "[,\\s]*(.*)");
+var unquotedParamRE = new RegExp("^[,\\s]*" + paramMatcher + "[,\\s]*(.*)");
+var token68ParamRE = new RegExp("^(" + token68Match + ")(?:$|[,\\s])(.*)");
+var skipSubjectCheck = Symbol();
+var idTokenClaims = new WeakMap;
+var jwtRefs = new WeakMap;
+var branded = new WeakSet;
+var nopkce = Symbol();
+var expectNoNonce = Symbol();
+var skipAuthTimeCheck = Symbol();
+var UNSUPPORTED_OPERATION = "OAUTH_UNSUPPORTED_OPERATION";
+function checkRsaKeyAlgorithm(key) {
+  const { algorithm } = key;
+  if (typeof algorithm.modulusLength !== "number" || algorithm.modulusLength < 2048) {
+    throw new UnsupportedOperationError(`unsupported ${algorithm.name} modulusLength`, {
+      cause: key
+    });
+  }
+}
+function ecdsaHashName(key) {
+  const { algorithm } = key;
+  switch (algorithm.namedCurve) {
+    case "P-256":
+      return "SHA-256";
+    case "P-384":
+      return "SHA-384";
+    case "P-521":
+      return "SHA-512";
+    default:
+      throw new UnsupportedOperationError("unsupported ECDSA namedCurve", { cause: key });
+  }
+}
+function keyToSubtle(key) {
+  switch (key.algorithm.name) {
+    case "ECDSA":
+      return {
+        name: key.algorithm.name,
+        hash: ecdsaHashName(key)
+      };
+    case "RSA-PSS": {
+      checkRsaKeyAlgorithm(key);
+      switch (key.algorithm.hash.name) {
+        case "SHA-256":
+        case "SHA-384":
+        case "SHA-512":
+          return {
+            name: key.algorithm.name,
+            saltLength: parseInt(key.algorithm.hash.name.slice(-3), 10) >> 3
+          };
+        default:
+          throw new UnsupportedOperationError("unsupported RSA-PSS hash name", { cause: key });
+      }
+    }
+    case "RSASSA-PKCS1-v1_5":
+      checkRsaKeyAlgorithm(key);
+      return key.algorithm.name;
+    case "ML-DSA-44":
+    case "ML-DSA-65":
+    case "ML-DSA-87":
+    case "Ed25519":
+      return key.algorithm.name;
+  }
+  throw new UnsupportedOperationError("unsupported CryptoKey algorithm name", { cause: key });
+}
+var skipStateCheck = Symbol();
+var expectNoState = Symbol();
+var _nodiscoverycheck = Symbol();
+var _expectedIssuer = Symbol();
+
+export { getDefaultAuthorizationIdForProvider, getOAuthApp, getOAuthAppById, getOAuthAppIdByProvider, createOAuthApp, updateOAuthAppById, upsertOAuthApp, listAuthorizationsForApp, getAuthorizationById, upsertAuthorization, updateAuthorizationTokens, updateAuthorizationIdentity, deleteAuthorizationById, deleteAuthorizationsForApp, createOAuthPending, consumeOAuthPending, gcOAuthPending, markAuthorizationRefreshFailed, getOAuthTokens, listAuthorizationSweepRows, listKeepAliveAuthorizations, deleteOAuthTokens, acquireOAuthRefreshLock, releaseOAuthRefreshLock, generateRandomCodeVerifier, generateRandomState, calculatePKCECodeChallenge };