@fruggr/zendesk-mcp-server 3.6.0 → 3.7.0

package/dist/{http-DkjvhtQj.js → http-D-Xy9BWD.js}

@@ -848,11 +848,11 @@ function internalServerErrorResponse(id) {
 	}, { status: 500 });
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/buffer_utils.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/buffer_utils.js
 const encoder$1 = new TextEncoder();
 const decoder$2 = new TextDecoder();
 const strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
-const MAX_INT32 = 2 ** 32;
+const UINT32_RANGE = 2 ** 32;
 function concat(...buffers) {
 	const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
 	let i = 0;
@@ -860,7 +860,7 @@ function concat(...buffers) {
 	return buf;
 }
 function writeUInt32BE(buf, value, offset) {
-	if (value < 0 || value >= MAX_INT32) throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);
+	if (value < 0 || value >= UINT32_RANGE) throw new RangeError(`value must be >= 0 and <= ${UINT32_RANGE - 1}. Received ${value}`);
 	buf.set([
 		value >>> 24,
 		value >>> 16,
@@ -869,7 +869,7 @@ function writeUInt32BE(buf, value, offset) {
 	], offset);
 }
 function uint64be(value) {
-	const high = Math.floor(value / MAX_INT32), low = value % MAX_INT32, buf = /* @__PURE__ */ new Uint8Array(8);
+	const high = Math.floor(value / UINT32_RANGE), low = value % UINT32_RANGE, buf = /* @__PURE__ */ new Uint8Array(8);
 	return writeUInt32BE(buf, high, 0), writeUInt32BE(buf, low, 4), buf;
 }
 function uint32be(value) {
@@ -915,7 +915,7 @@ async function digest(algorithm, data) {
 	return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/errors.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/util/errors.js
 var errors_exports$1 = /* @__PURE__ */ __exportAll({
 	JOSEAlgNotAllowed: () => JOSEAlgNotAllowed,
 	JOSEError: () => JOSEError,
@@ -1033,7 +1033,7 @@ var JWSSignatureVerificationFailed$1 = class extends JOSEError {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/base64url.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/util/base64url.js
 const invalid$2 = "The input to be decoded is not correctly encoded.";
 function decode$2(input) {
 	try {
@@ -1046,7 +1046,7 @@ function encode$1(input) {
 	return encodeBase64(typeof input == "string" ? encoder$1.encode(input) : input, !0);
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/validate.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/validate.js
 function assertUint8Array(input, label) {
 	if (!(input instanceof Uint8Array)) throw new TypeError(`${label} must be an instance of Uint8Array`);
 }
@@ -1069,23 +1069,23 @@ function assertNotSet(value, name) {
 function decodeBase64url(value, label, ErrorClass) {
 	try {
 		return decode$2(value);
-	} catch {
-		throw new ErrorClass(`Failed to base64url decode the ${label}`);
+	} catch (cause) {
+		throw new ErrorClass(`Failed to base64url decode the ${label}`, { cause });
 	}
 }
-function encodeBase64url(value, label, ErrorClass) {
+function encodeAsciiMember(value, label, ErrorClass) {
 	try {
 		return encode$2(value);
-	} catch {
-		throw new ErrorClass(`The ${label} is not a valid base64url string`);
+	} catch (cause) {
+		throw new ErrorClass(`The ${label} is not a valid base64url string`, { cause });
 	}
 }
-function parseJoseHeader(b64, ErrorClass, message) {
+function parseJoseHeader(encodedProtectedHeader, ErrorClass, message) {
 	let parsed;
 	try {
-		parsed = JSON.parse(strictDecoder.decode(decode$2(b64)));
-	} catch {
-		throw new ErrorClass(message);
+		parsed = JSON.parse(strictDecoder.decode(decode$2(encodedProtectedHeader)));
+	} catch (cause) {
+		throw new ErrorClass(message, { cause });
 	}
 	if (!isObject(parsed)) throw new ErrorClass(message);
 	return parsed;
@@ -1138,7 +1138,7 @@ function serializeJoseHeader(Err, header) {
 	return [parsed, serialized];
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/key.js
 const tag = (key) => key[Symbol.toStringTag];
 const jwkMatchesOp = (entry, key, usage) => {
 	const { alg } = entry;
@@ -1153,12 +1153,12 @@ const jwkMatchesOp = (entry, key, usage) => {
 	}
 };
 async function prepareKey(entry, key, usage) {
-	const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+	const { alg, secret } = entry, requiresPrivateKey = usage === "decrypt" || usage === "sign";
 	if (secret && key instanceof Uint8Array) return key;
 	let normalized, keyObject;
 	if (isObject(key)) {
 		if (normalized = normalizeJwk(key), typeof normalized.kty != "string") throw invalidKeyType(alg, key, secret);
-		if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0))) throw new TypeError(secret ? "JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present" : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+		if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (requiresPrivateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0))) throw new TypeError(secret ? "JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present" : `JSON Web Key for this operation must be a ${requiresPrivateKey ? "private" : "public"} JWK`);
 		if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct") return decode$2(normalized.k);
 		if (!Object.isFrozen(key)) {
 			const { key_ops } = key;
@@ -1166,7 +1166,7 @@ async function prepareKey(entry, key, usage) {
 		}
 	} else {
 		if (!isKeyLike(key)) throw invalidKeyType(alg, key, secret);
-		const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+		const expectedType = secret ? "secret" : requiresPrivateKey ? "private" : "public";
 		if (key.type !== expectedType && (secret || [
 			"secret",
 			"public",
@@ -1275,7 +1275,7 @@ async function rawKey(key, expected, usage, extractable = !1) {
 	return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/content_encryption.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/content_encryption.js
 const generateCek = (enc) => crypto.getRandomValues(new Uint8Array(enc.cekBits >> 3));
 function checkCekLength(cek, expected) {
 	const actual = cek.byteLength << 3;
@@ -1287,27 +1287,27 @@ function checkIvLength(enc, iv) {
 }
 async function cbcKeySetup(enc, cek, usage) {
 	if (!(cek instanceof Uint8Array)) throw new TypeError(invalidKeyInput(cek, "Uint8Array"));
-	const keySize = enc.cekBits >> 1;
+	const keyLengthBits = enc.cekBits >> 1;
 	return [
-		await crypto.subtle.importKey("raw", cek.subarray(keySize >> 3), "AES-CBC", !1, [usage]),
-		await crypto.subtle.importKey("raw", cek.subarray(0, keySize >> 3), {
-			hash: `SHA-${keySize << 1}`,
+		await crypto.subtle.importKey("raw", cek.subarray(keyLengthBits >> 3), "AES-CBC", !1, [usage]),
+		await crypto.subtle.importKey("raw", cek.subarray(0, keyLengthBits >> 3), {
+			hash: `SHA-${keyLengthBits << 1}`,
 			name: "HMAC"
 		}, !1, ["sign"]),
-		keySize
+		keyLengthBits
 	];
 }
-async function cbcHmacTag(macKey, macData, keySize) {
-	return new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3));
+async function cbcHmacTag(macKey, macData, keyLengthBits) {
+	return new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keyLengthBits >> 3));
 }
 async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
-	const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, "encrypt"), ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+	const [encKey, macKey, keyLengthBits] = await cbcKeySetup(enc, cek, "encrypt"), ciphertext = new Uint8Array(await crypto.subtle.encrypt({
 		iv,
 		name: "AES-CBC"
 	}, encKey, plaintext));
 	return {
 		ciphertext,
-		tag: await cbcHmacTag(macKey, concat(aad, iv, ciphertext, uint64be(aad.length * 8)), keySize),
+		tag: await cbcHmacTag(macKey, concat(aad, iv, ciphertext, uint64be(aad.length * 8)), keyLengthBits),
 		iv
 	};
 }
@@ -1319,7 +1319,7 @@ async function timingSafeEqual$1(a, b) {
 	return crypto.subtle.verify(algorithm, key, aHmac, b);
 }
 async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-	const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, "decrypt"), expectedTag = await cbcHmacTag(macKey, concat(aad, iv, ciphertext, uint64be(aad.length * 8)), keySize);
+	const [encKey, macKey, keyLengthBits] = await cbcKeySetup(enc, cek, "decrypt"), expectedTag = await cbcHmacTag(macKey, concat(aad, iv, ciphertext, uint64be(aad.length * 8)), keyLengthBits);
 	try {
 		if (await timingSafeEqual$1(tag, expectedTag)) return new Uint8Array(await crypto.subtle.decrypt({
 			iv,
@@ -1362,7 +1362,7 @@ async function decrypt$1(enc, cek, ciphertext, iv, tag, aad) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_descriptor.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/key_descriptor.js
 function table(entries) {
 	const out = { __proto__: null };
 	for (const alg in entries) out[alg] = {
@@ -1372,7 +1372,7 @@ function table(entries) {
 	return out;
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwe_algorithms.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/jwe_algorithms.js
 const wrap = [["encrypt", "wrapKey"], ["decrypt", "unwrapKey"]];
 const derive$1 = [[], ["deriveBits"]];
 const none = [[], []];
@@ -1492,7 +1492,7 @@ function jweEncryption(enc) {
 	return (typeof enc == "string" ? ENC[enc] : void 0) ?? unsupported$1("enc", "Encryption Algorithm");
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_management.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/key_management.js
 function checkEcdhCryptoKey(key, usage) {
 	if (key.algorithm.name !== "ECDH" && key.algorithm.name !== "X25519") throw new TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");
 	checkUsage(key, usage);
@@ -1517,32 +1517,32 @@ function checkRsaKey(alg, key, usage) {
 async function deriveKey(p2s, alg, p2c, key) {
 	if (!(p2s instanceof Uint8Array) || p2s.length < 8) throw new JWEInvalid("PBES2 Salt Input must be 8 or more octets");
 	if (!Number.isSafeInteger(p2c) || Math.sign(p2c) !== 1) throw new JWEInvalid("PBES2 Count Input must be a positive integer");
-	const salt = concat(encode$2(alg), Uint8Array.of(0), p2s), keylen = parseInt(alg.slice(13, 16), 10), subtleAlg = {
+	const salt = concat(encode$2(alg), Uint8Array.of(0), p2s), keyLengthBits = parseInt(alg.slice(13, 16), 10), subtleAlg = {
 		hash: `SHA-${alg.slice(8, 11)}`,
 		iterations: p2c,
 		name: "PBKDF2",
 		salt
 	}, cryptoKey = await rawKey(key, jweAlgorithm(alg).subtle, "deriveBits");
-	return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
+	return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keyLengthBits));
 }
 function lengthAndInput(input) {
 	return concat(uint32be(input.length), input);
 }
-async function concatKdf(Z, L, OtherInfo) {
-	const dkLen = L >> 3, hashLen = 32, reps = Math.ceil(dkLen / hashLen), dk = new Uint8Array(reps * hashLen);
+async function concatKdf(Z, keyDataLength, OtherInfo) {
+	const dkLen = keyDataLength >> 3, hashLen = 32, reps = Math.ceil(dkLen / hashLen), dk = new Uint8Array(reps * hashLen);
 	for (let i = 1; i <= reps; i++) {
 		const hashResult = await digest("sha256", concat(uint32be(i), Z, OtherInfo));
 		dk.set(hashResult, (i - 1) * hashLen);
 	}
 	return dk.slice(0, dkLen);
 }
-async function ecdhesDeriveKey(publicKey, privateKey, algorithm, keyLength, apu = /* @__PURE__ */ new Uint8Array(), apv = /* @__PURE__ */ new Uint8Array()) {
+async function ecdhesDeriveKey(publicKey, privateKey, algorithmId, keyDataLength, apu = /* @__PURE__ */ new Uint8Array(), apv = /* @__PURE__ */ new Uint8Array()) {
 	checkEcdhCryptoKey(publicKey), checkEcdhCryptoKey(privateKey, "deriveBits");
-	const otherInfo = concat(lengthAndInput(encode$2(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
+	const otherInfo = concat(lengthAndInput(encode$2(algorithmId)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyDataLength));
 	return concatKdf(new Uint8Array(await crypto.subtle.deriveBits({
 		name: publicKey.algorithm.name,
 		public: publicKey
-	}, privateKey, publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3)), keyLength, otherInfo);
+	}, privateKey, publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3)), keyDataLength, otherInfo);
 }
 function assertEcdhKey(key) {
 	assertCryptoKey(key);
@@ -1592,9 +1592,9 @@ async function decryptKeyManagement(entry, enc, key, encryptedKey, joseHeader, m
 			assertEcdhKey(key);
 			const ephemeralPublicKey = await jwkToKey(entry, epk), partyUInfo = partyInfo(joseHeader, "apu"), partyVInfo = partyInfo(joseHeader, "apv");
 			checkPartyInfo(partyUInfo, partyVInfo);
-			const sharedSecret = await ecdhesDeriveKey(ephemeralPublicKey, key, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
-			if (direct) return sharedSecret;
-			key = sharedSecret;
+			const derivedKey = await ecdhesDeriveKey(ephemeralPublicKey, key, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
+			if (direct) return derivedKey;
+			key = derivedKey;
 			break;
 		}
 		case "RSA-OAEP": return assertCryptoKey(key), checkRsaKey(alg, key, "decrypt"), new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP", key, encryptedKey));
@@ -1637,25 +1637,25 @@ async function encryptKeyManagement(entry, enc, inputKey, joseHeader, providedCe
 			providedApu !== void 0 && assertUint8Array(providedApu, "\"apu\""), providedApv !== void 0 && assertUint8Array(providedApv, "\"apv\"");
 			const apu = providedApu ?? partyInfo(joseHeader, "apu"), apv = providedApv ?? partyInfo(joseHeader, "apv");
 			checkPartyInfo(apu, apv);
-			let ephemeralKey;
-			providedParameters.epk !== void 0 ? ephemeralKey = await prepareKey(entry, providedParameters.epk, "decrypt") : ephemeralKey = (await crypto.subtle.generateKey(key.algorithm, !0, ["deriveBits"])).privateKey;
+			let ephemeralPrivateKey;
+			providedParameters.epk !== void 0 ? ephemeralPrivateKey = await prepareKey(entry, providedParameters.epk, "decrypt") : ephemeralPrivateKey = (await crypto.subtle.generateKey(key.algorithm, !0, ["deriveBits"])).privateKey;
 			const subtle = crypto.subtle;
-			let exportableEpk = ephemeralKey;
+			let exportableEpk = ephemeralPrivateKey;
 			if (!exportableEpk.extractable) {
 				if (typeof subtle.getPublicKey != "function") throw new TypeError("CryptoKey for \"epk\" must be extractable");
-				exportableEpk = await subtle.getPublicKey(ephemeralKey, []);
+				exportableEpk = await subtle.getPublicKey(ephemeralPrivateKey, []);
 			}
-			const { x, y, crv, kty } = await subtle.exportKey("jwk", exportableEpk), direct = mode === "direct-key-agreement", sharedSecret = await ecdhesDeriveKey(key, ephemeralKey, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), apu, apv), epk = {
+			const { x, y, crv, kty } = await subtle.exportKey("jwk", exportableEpk), direct = mode === "direct-key-agreement", derivedKey = await ecdhesDeriveKey(key, ephemeralPrivateKey, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), apu, apv), epk = {
 				x,
 				crv,
 				kty
 			};
 			if (kty === "EC" && (epk.y = y), parameters = { epk }, providedApu !== void 0 && (parameters.apu = encode$1(providedApu)), providedApv !== void 0 && (parameters.apv = encode$1(providedApv)), direct) return [
-				sharedSecret,
+				derivedKey,
 				void 0,
 				parameters
 			];
-			key = sharedSecret;
+			key = derivedKey;
 			break;
 		}
 		case "RSA-OAEP":
@@ -1687,7 +1687,7 @@ async function encryptKeyManagement(entry, enc, inputKey, joseHeader, providedCe
 	];
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/deflate.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/deflate.js
 function validateZip(joseHeader, protectedHeader) {
 	if (joseHeader.zip !== void 0 && joseHeader.zip !== "DEF") throw new JOSENotSupported("Unsupported JWE \"zip\" (Compression Algorithm) Header Parameter value.");
 	if (joseHeader.zip !== void 0 && !protectedHeader?.zip) throw new JWEInvalid("JWE \"zip\" (Compression Algorithm) Header Parameter MUST be in a protected header.");
@@ -1715,16 +1715,16 @@ async function decompress(input, maxLength) {
 	return supported("DecompressionStream"), transform(new DecompressionStream("deflate-raw"), input, maxLength);
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwe_decrypt.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/jwe_decrypt.js
 function shareJWE(jwe) {
 	const { protected: encodedProtected, ciphertext, iv, tag, aad } = jwe;
-	let parsedProt;
-	return encodedProtected !== void 0 && (parsedProt = parseJoseHeader(encodedProtected, JWEInvalid, "JWE Protected Header is invalid")), [
-		parsedProt,
+	let protectedHeader;
+	return encodedProtected !== void 0 && (protectedHeader = parseJoseHeader(encodedProtected, JWEInvalid, "JWE Protected Header is invalid")), [
+		protectedHeader,
 		decodeBase64url(ciphertext, "ciphertext", JWEInvalid),
 		iv !== void 0 ? decodeBase64url(iv, "iv", JWEInvalid) : void 0,
 		tag !== void 0 ? decodeBase64url(tag, "tag", JWEInvalid) : void 0,
-		encodeBase64url((encodedProtected ?? "") + (aad !== void 0 ? `.${aad}` : ""), "aad", JWEInvalid)
+		encodeAsciiMember((encodedProtected ?? "") + (aad !== void 0 ? `.${aad}` : ""), "aad", JWEInvalid)
 	];
 }
 function prepareDecrypt(options) {
@@ -1737,18 +1737,18 @@ function prepareDecrypt(options) {
 	];
 }
 async function decryptJWE(jwe, shared, key, token = shareJWE(jwe)) {
-	const [parsedProt, ciphertext, iv, tag, additionalData] = token, { header, unprotected, aad } = jwe;
+	const [protectedHeader, ciphertext, iv, tag, additionalAuthenticatedData] = token, { header, unprotected, aad } = jwe;
 	let joseHeader;
 	if (header !== void 0 || unprotected !== void 0) {
-		if (!isDisjoint(parsedProt, header, unprotected)) throw new JWEInvalid("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");
+		if (!isDisjoint(protectedHeader, header, unprotected)) throw new JWEInvalid("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");
 		joseHeader = {
-			...parsedProt,
+			...protectedHeader,
 			...header,
 			...unprotected
 		};
-	} else joseHeader = parsedProt ?? {};
+	} else joseHeader = protectedHeader ?? {};
 	const [keyManagementAlgorithms, contentEncryptionAlgorithms, crit, maxPBES2Count, maxDecompressedLength] = shared, { encrypted_key: encodedKey } = jwe;
-	validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, parsedProt, joseHeader), validateZip(joseHeader, parsedProt);
+	validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, protectedHeader, joseHeader), validateZip(joseHeader, protectedHeader);
 	const { alg, enc } = joseHeader;
 	if (typeof alg != "string" || !alg) throw new JWEInvalid("missing JWE Algorithm (alg) in JWE Header");
 	const selected = JWE[alg];
@@ -1773,12 +1773,12 @@ async function decryptJWE(jwe, shared, key, token = shareJWE(jwe)) {
 		encryptedKey = /* @__PURE__ */ new Uint8Array();
 	}
 	let resolvedKey = !1;
-	typeof key == "function" && (key = await key(parsedProt, jwe), resolvedKey = !0);
+	typeof key == "function" && (key = await key(protectedHeader, jwe), resolvedKey = !0);
 	const algEntry = selected ?? jweAlgorithm(alg);
 	isJWECEKTransport(algEntry) && encryptedKey === void 0 && (encryptedKey = /* @__PURE__ */ new Uint8Array());
 	const k = await prepareKey(algEntry.mode === "direct-encryption" ? encEntry : algEntry, key, "decrypt");
 	let plaintext;
-	if (algEntry.mode === "integrated-encryption") plaintext = await algEntry.decrypt(k, encryptedKey, ciphertext, additionalData, parsedProt, joseHeader);
+	if (algEntry.mode === "integrated-encryption") plaintext = await algEntry.decrypt(k, encryptedKey, ciphertext, additionalAuthenticatedData, protectedHeader, joseHeader);
 	else {
 		const encryption = encEntry;
 		let cek;
@@ -1788,7 +1788,7 @@ async function decryptJWE(jwe, shared, key, token = shareJWE(jwe)) {
 			if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) throw err;
 			cek = generateCek(encryption);
 		}
-		plaintext = await decrypt$1(encryption, cek, ciphertext, iv, tag, additionalData);
+		plaintext = await decrypt$1(encryption, cek, ciphertext, iv, tag, additionalAuthenticatedData);
 	}
 	if (joseHeader.zip === "DEF") {
 		const decompressionLimit = maxDecompressedLength ?? 25e4;
@@ -1800,7 +1800,7 @@ async function decryptJWE(jwe, shared, key, token = shareJWE(jwe)) {
 	}
 	return {
 		plaintext,
-		...parsedProt && { protectedHeader: parsedProt },
+		...protectedHeader && { protectedHeader },
 		...aad !== void 0 && { additionalAuthenticatedData: decodeBase64url(aad, "aad", JWEInvalid) },
 		...unprotected && { sharedUnprotectedHeader: unprotected },
 		...header && { unprotectedHeader: header },
@@ -1820,12 +1820,12 @@ async function decryptCompact(jwe, shared, key) {
 	}, shared, key);
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwe/compact/decrypt.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/jwe/compact/decrypt.js
 async function compactDecrypt(jwe, key, options) {
 	return decryptCompact(jwe, prepareDecrypt(options), key);
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwe_encrypt.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/jwe_encrypt.js
 function checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader) {
 	if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader)) throw new JWEInvalid("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");
 }
@@ -1873,15 +1873,15 @@ async function encryptJWE(input, checked, key) {
 		...protectedHeader,
 		...parameters
 	} : parameters, checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader));
-	const protectedHeaderS = protectedHeader ? encode$1(JSON.stringify(protectedHeader)) : "", aadMember = aad?.byteLength ? encode$1(aad) : void 0, additionalData = encode$2(aadMember ? `${protectedHeaderS}.${aadMember}` : protectedHeaderS);
+	const encodedProtectedHeader = protectedHeader ? encode$1(JSON.stringify(protectedHeader)) : "", encodedAad = aad?.byteLength ? encode$1(aad) : void 0, additionalAuthenticatedData = encode$2(encodedAad ? `${encodedProtectedHeader}.${encodedAad}` : encodedProtectedHeader);
 	let plaintext = inputPlaintext;
 	joseHeader.zip === "DEF" && (plaintext = await compress(plaintext).catch((cause) => {
 		throw new JWEInvalid("Failed to compress plaintext", { cause });
 	}));
 	let ciphertext, tag, iv;
-	algEntry.mode === "integrated-encryption" ? [encryptedKey, ciphertext] = await algEntry.encrypt(cek, plaintext, additionalData, protectedHeader, joseHeader, keyManagementParameters) : {ciphertext, tag, iv} = await encrypt$1(encEntry, plaintext, cek, inputIv, additionalData);
+	algEntry.mode === "integrated-encryption" ? [encryptedKey, ciphertext] = await algEntry.encrypt(cek, plaintext, additionalAuthenticatedData, protectedHeader, joseHeader, keyManagementParameters) : {ciphertext, tag, iv} = await encrypt$1(encEntry, plaintext, cek, inputIv, additionalAuthenticatedData);
 	const jwe = { ciphertext: encode$1(ciphertext) };
-	return iv && (jwe.iv = encode$1(iv)), tag && (jwe.tag = encode$1(tag)), encryptedKey?.byteLength && (jwe.encrypted_key = encode$1(encryptedKey)), aadMember && (jwe.aad = aadMember), protectedHeader && (jwe.protected = protectedHeaderS), sharedUnprotectedHeader && (jwe.unprotected = sharedUnprotectedHeader), unprotectedHeader && (jwe.header = unprotectedHeader), jwe;
+	return iv && (jwe.iv = encode$1(iv)), tag && (jwe.tag = encode$1(tag)), encryptedKey?.byteLength && (jwe.encrypted_key = encode$1(encryptedKey)), encodedAad && (jwe.aad = encodedAad), protectedHeader && (jwe.protected = encodedProtectedHeader), sharedUnprotectedHeader && (jwe.unprotected = sharedUnprotectedHeader), unprotectedHeader && (jwe.header = unprotectedHeader), jwe;
 }
 async function createJWE(input, key, options) {
 	return encryptJWE(input, checkEncryptHeaders(input, options), key);
@@ -1896,7 +1896,7 @@ function compactJWE(jwe) {
 	].join(".");
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_algorithms.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/jws_algorithms.js
 const sig = [["verify"], ["sign"]];
 function hmac(bits) {
 	const subtle = {
@@ -1952,8 +1952,8 @@ function eddsa() {
 		usages: sig
 	};
 }
-function mldsa(bits) {
-	const subtle = { name: `ML-DSA-${bits}` };
+function mldsa(parameterSet) {
+	const subtle = { name: `ML-DSA-${parameterSet}` };
 	return {
 		kty: ["AKP"],
 		subtle,
@@ -1986,27 +1986,27 @@ function jwsAlgorithm(alg) {
 	return entry;
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_verify.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/jws_verify.js
 function prepareVerify(options) {
 	return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
 }
-function parseProtectedHeader(encodedProtected) {
-	return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+function parseProtectedHeader(encodedProtectedHeader) {
+	return encodedProtectedHeader === void 0 ? {} : parseJoseHeader(encodedProtectedHeader, JWSInvalid, "JWS Protected Header is invalid");
 }
 function encodeCompactUnencodedPayload(payload) {
 	try {
 		return encode$2(payload);
-	} catch {
-		throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
+	} catch (cause) {
+		throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters", { cause });
 	}
 }
 async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
-	const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
-	if (!isDisjoint(parsedProt, header)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+	const { protected: encodedProtectedHeader, header, payload: inputPayload } = jws, protectedHeader = parsedProtected ?? parseProtectedHeader(encodedProtectedHeader);
+	if (!isDisjoint(protectedHeader, header)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
 	const joseHeader = {
-		...parsedProt,
+		...protectedHeader,
 		...header
-	}, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+	}, b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], protectedHeader, joseHeader)), { alg } = joseHeader;
 	if (typeof alg != "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
 	if (shared[0] && !shared[0].has(alg)) throw new JOSEAlgNotAllowed("\"alg\" (Algorithm) Header Parameter value not allowed");
 	if (b64) {
@@ -2014,18 +2014,20 @@ async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedP
 	} else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array)) throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
 	const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
 	let resolvedKey = !1;
-	typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = !0);
-	const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode$2(encodedProtected) : /* @__PURE__ */ new Uint8Array(), encode$2("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+	typeof key == "function" && (key = await key(protectedHeader, jws), resolvedKey = !0);
+	const entry = jwsAlgorithm(alg), signingInput = concat(encodedProtectedHeader !== void 0 ? encode$2(encodedProtectedHeader) : /* @__PURE__ */ new Uint8Array(), encode$2("."), typeof signingPayload == "string" ? shared[2] ??= encodeAsciiMember(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), verificationKey = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(verificationKey, entry.subtle, "verify");
 	entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
 	let verified = !1;
 	try {
-		verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
-	} catch {}
+		verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, signingInput);
+	} catch (cause) {
+		throw new JWSSignatureVerificationFailed$1(void 0, { cause });
+	}
 	if (!verified) throw new JWSSignatureVerificationFailed$1();
 	const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
-	return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{
+	return encodedProtectedHeader !== void 0 && (result.protectedHeader = protectedHeader), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{
 		...result,
-		key: k
+		key: verificationKey
 	}, b64] : [result, b64];
 }
 async function verifyCompact(jws, shared, key) {
@@ -2039,13 +2041,13 @@ async function verifyCompact(jws, shared, key) {
 	}, shared, key, encodeCompactUnencodedPayload);
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jws/compact/verify.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/jws/compact/verify.js
 async function compactVerify(jws, key, options) {
 	const [result] = await verifyCompact(jws, prepareVerify(options), key);
 	return result;
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
 const epoch = (date) => Math.floor(date.getTime() / 1e3);
 const multipliers = {
 	s: 1,
@@ -2064,8 +2066,8 @@ function secs(str) {
 	typeof str != "string" && invalidDuration();
 	const matched = REGEX.exec(str);
 	(!matched || matched[4] && matched[1]) && invalidDuration();
-	const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-	return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+	const value = parseFloat(matched[2]), durationSeconds = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+	return Number.isFinite(durationSeconds) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -durationSeconds : durationSeconds;
 }
 function validateInput(label, input) {
 	if (!Number.isFinite(input)) throw new TypeError(`Invalid ${label} input`);
@@ -2085,28 +2087,30 @@ const normalizeTyp = (value) => {
 	return value.includes("/") ? normalized : `application/${normalized}`;
 };
 const checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;
-function validateNumericDate(payload, claim, required = !1) {
-	const value = payload[claim];
+function validateNumericDate(claimsSet, claim, required = !1) {
+	const value = claimsSet[claim];
 	if (!(value === void 0 && !required)) {
-		if (typeof value != "number") throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+		if (typeof value != "number") throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, claimsSet, claim, "invalid");
 		return value;
 	}
 }
-function unexpectedClaim(payload, claim) {
-	throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+function unexpectedClaim(claimsSet, claim) {
+	throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, claimsSet, claim, checkFailed);
 }
-function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
-	let payload;
+function validateClaimsSet(protectedHeader, claimsSetBytes, options = {}) {
+	let claimsSet;
 	try {
-		payload = JSON.parse(strictDecoder.decode(encodedPayload));
-	} catch {}
-	if (!isObject(payload)) throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+		claimsSet = JSON.parse(strictDecoder.decode(claimsSetBytes));
+	} catch (cause) {
+		throw new JWTInvalid("JWT Claims Set must be a top-level JSON object", { cause });
+	}
+	if (!isObject(claimsSet)) throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
 	const { typ } = options;
-	if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) throw new JWTClaimValidationFailed("unexpected \"typ\" JWT header value", payload, "typ", checkFailed);
+	if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) throw new JWTClaimValidationFailed("unexpected \"typ\" JWT header value", claimsSet, "typ", checkFailed);
 	const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
 	maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
-	for (const claim of new Set(presenceCheck.reverse())) if (!Object.hasOwn(payload, claim)) throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
-	issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+	for (const claim of new Set(presenceCheck.reverse())) if (!Object.hasOwn(claimsSet, claim)) throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claimsSet, claim, "missing");
+	issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(claimsSet.iss) && unexpectedClaim(claimsSet, "iss"), subject !== void 0 && claimsSet.sub !== subject && unexpectedClaim(claimsSet, "sub"), audience !== void 0 && !checkAudiencePresence(claimsSet.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(claimsSet, "aud");
 	const { clockTolerance } = options;
 	let tolerance = 0;
 	if (typeof clockTolerance == "string") tolerance = secs(clockTolerance);
@@ -2115,63 +2119,63 @@ function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
 		tolerance = clockTolerance;
 	}
 	validateInput("clockTolerance option", tolerance);
-	const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
-	if (nbf !== void 0 && nbf > now + tolerance) throw new JWTClaimValidationFailed("\"nbf\" claim timestamp check failed", payload, "nbf", checkFailed);
-	const exp = validateNumericDate(payload, "exp");
-	if (exp !== void 0 && exp <= now - tolerance) throw new JWTExpired("\"exp\" claim timestamp check failed", payload, "exp", checkFailed);
+	const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(claimsSet, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(claimsSet, "nbf");
+	if (nbf !== void 0 && nbf > now + tolerance) throw new JWTClaimValidationFailed("\"nbf\" claim timestamp check failed", claimsSet, "nbf", checkFailed);
+	const exp = validateNumericDate(claimsSet, "exp");
+	if (exp !== void 0 && exp <= now - tolerance) throw new JWTExpired("\"exp\" claim timestamp check failed", claimsSet, "exp", checkFailed);
 	if (maxTokenAge !== void 0) {
 		const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
-		if (age - tolerance > max) throw new JWTExpired("\"iat\" claim timestamp check failed (too far in the past)", payload, "iat", checkFailed);
-		if (age < -tolerance) throw new JWTClaimValidationFailed("\"iat\" claim timestamp check failed (it should be in the past)", payload, "iat", checkFailed);
+		if (age - tolerance > max) throw new JWTExpired("\"iat\" claim timestamp check failed (too far in the past)", claimsSet, "iat", checkFailed);
+		if (age < -tolerance) throw new JWTClaimValidationFailed("\"iat\" claim timestamp check failed (it should be in the past)", claimsSet, "iat", checkFailed);
 	}
-	return payload;
+	return claimsSet;
 }
-let producerPayloads;
-function producerPayload(producer) {
-	return producerPayloads.get(producer);
+let producerClaimsSets;
+function producerClaimsSet(producer) {
+	return producerClaimsSets.get(producer);
 }
-function jwtData(producer) {
-	const payload = producerPayload(producer);
+function jwtClaimsSetBytes(producer) {
+	const claimsSet = producerClaimsSet(producer);
 	for (const claim of [
 		"iat",
 		"nbf",
 		"exp"
 	]) {
-		const value = payload[claim];
+		const value = claimsSet[claim];
 		if (typeof value == "number" && !Number.isFinite(value)) throw new TypeError(`"${claim}" claim must be a finite number`);
 	}
-	return encoder$1.encode(JSON.stringify(payload));
+	return encoder$1.encode(JSON.stringify(claimsSet));
 }
 var JWTClaimsBuilder = class {
-	constructor(payload = {}) {
-		if (!isObject(payload)) throw new TypeError("JWT Claims Set MUST be an object");
-		(producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));
+	constructor(claimsSet = {}) {
+		if (!isObject(claimsSet)) throw new TypeError("JWT Claims Set MUST be an object");
+		(producerClaimsSets ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(claimsSet));
 	}
 	setIssuer(value) {
-		return validateStringClaim("iss", value), producerPayload(this).iss = value, this;
+		return validateStringClaim("iss", value), producerClaimsSet(this).iss = value, this;
 	}
 	setSubject(value) {
-		return validateStringClaim("sub", value), producerPayload(this).sub = value, this;
+		return validateStringClaim("sub", value), producerClaimsSet(this).sub = value, this;
 	}
 	setAudience(value) {
-		return validateAudienceClaim(value), producerPayload(this).aud = value, this;
+		return validateAudienceClaim(value), producerClaimsSet(this).aud = value, this;
 	}
 	setJti(value) {
-		return validateStringClaim("jti", value), producerPayload(this).jti = value, this;
+		return validateStringClaim("jti", value), producerClaimsSet(this).jti = value, this;
 	}
 	setNotBefore(value) {
-		return producerPayload(this).nbf = numericDate(value, "setNotBefore"), this;
+		return producerClaimsSet(this).nbf = numericDate(value, "setNotBefore"), this;
 	}
 	setExpirationTime(value) {
-		return producerPayload(this).exp = numericDate(value, "setExpirationTime"), this;
+		return producerClaimsSet(this).exp = numericDate(value, "setExpirationTime"), this;
 	}
 	setIssuedAt(value) {
-		const payload = producerPayload(this);
-		return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, "setIssuedAt"), this;
+		const claimsSet = producerClaimsSet(this);
+		return value === void 0 ? claimsSet.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? claimsSet.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : claimsSet.iat = numericDate(value, "setIssuedAt"), this;
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwt/verify.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/jwt/verify.js
 async function jwtVerify(jwt, key, options) {
 	const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
 	if (!b64) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
@@ -2182,7 +2186,7 @@ async function jwtVerify(jwt, key, options) {
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwe/compact/encrypt.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/jwe/compact/encrypt.js
 var CompactEncrypt = class {
 	#input;
 	constructor(plaintext) {
@@ -2205,12 +2209,12 @@ var CompactEncrypt = class {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_sign.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/jws_sign.js
 async function createSignature(input, key, rejectUnencoded) {
-	let [payload, protectedHeader, unprotectedHeader, crit] = input, protectedHeaderString = "";
+	let [payload, protectedHeader, unprotectedHeader, crit] = input, encodedProtectedHeader = "";
 	if (protectedHeader !== void 0) {
 		const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
-		protectedHeader = normalized[0], protectedHeaderString = encode$1(normalized[1]);
+		protectedHeader = normalized[0], encodedProtectedHeader = encode$1(normalized[1]);
 	}
 	if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader) throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
 	if (!isDisjoint(protectedHeader, unprotectedHeader)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
@@ -2224,19 +2228,19 @@ async function createSignature(input, key, rejectUnencoded) {
 	const { alg } = joseHeader;
 	if (typeof alg != "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
 	const entry = jwsAlgorithm(alg);
-	let payloadS = "", payloadB = payload, data;
+	let encodedPayload = "", signingPayload = payload, signingInput;
 	if (b64) {
-		const encoded = input[4];
-		encoded ? (payloadS = encoded[0] ??= encode$1(payload), payloadB = encoded[1] ??= encode$2(payloadS)) : (payloadS = encode$1(payload), data = encoder$1.encode(`${protectedHeaderString}.${payloadS}`));
+		const encodedPayloadCache = input[4];
+		encodedPayloadCache ? (encodedPayload = encodedPayloadCache[0] ??= encode$1(payload), signingPayload = encodedPayloadCache[1] ??= encode$2(encodedPayload)) : (encodedPayload = encode$1(payload), signingInput = encoder$1.encode(`${encodedProtectedHeader}.${encodedPayload}`));
 	}
-	data ??= concat(encode$2(protectedHeaderString), encode$2("."), payloadB);
-	const k = await rawKey(await prepareKey(entry, key, "sign"), entry.subtle, "sign");
-	entry.minRsaBits && checkModulusLength(entry.alg, k);
+	signingInput ??= concat(encode$2(encodedProtectedHeader), encode$2("."), signingPayload);
+	const signingKey = await rawKey(await prepareKey(entry, key, "sign"), entry.subtle, "sign");
+	entry.minRsaBits && checkModulusLength(entry.alg, signingKey);
 	const jws = {
-		signature: encode$1(new Uint8Array(await crypto.subtle.sign(entry.signing, k, data))),
-		payload: payloadS
+		signature: encode$1(new Uint8Array(await crypto.subtle.sign(entry.signing, signingKey, signingInput))),
+		payload: encodedPayload
 	};
-	return protectedHeader && (jws.protected = protectedHeaderString), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];
+	return protectedHeader && (jws.protected = encodedProtectedHeader), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];
 }
 async function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {
 	const [jws] = await createSignature([
@@ -2248,7 +2252,7 @@ async function createCompactSignature(payload, protectedHeader, crit, key, rejec
 	return `${jws.protected}.${jws.payload}.${jws.signature}`;
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jws/compact/sign.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/jws/compact/sign.js
 var CompactSign = class {
 	#payload;
 	#protectedHeader;
@@ -2265,7 +2269,7 @@ var CompactSign = class {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_algorithm.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/lib/key_algorithm.js
 function unsupportedAlg(source = "JWK \"alg\" (Algorithm) Parameter") {
 	throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
 }
@@ -2273,7 +2277,7 @@ function keyAlgorithm(alg, source) {
 	return (typeof alg == "string" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/key/export.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/key/export.js
 async function exportJWK(key) {
 	if (isKeyObject(key)) if (key.type === "secret") key = key.export();
 	else return key.export({ format: "jwk" });
@@ -2289,7 +2293,7 @@ async function exportJWK(key) {
 	return jwk;
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwk/thumbprint.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/jwk/thumbprint.js
 const check$2 = (value, description) => {
 	if (typeof value != "string" || !value) throw new JWKInvalid(`${description} missing or invalid`);
 };
@@ -2300,17 +2304,17 @@ async function calculateJwkThumbprint(key, digestAlgorithm) {
 	} else if (isKeyLike(key)) jwk = snapshotJwk(await exportJWK(key));
 	else throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
 	if (digestAlgorithm ??= "sha256", digestAlgorithm !== "sha256" && digestAlgorithm !== "sha384" && digestAlgorithm !== "sha512") throw new TypeError("digestAlgorithm must one of \"sha256\", \"sha384\", or \"sha512\"");
-	let components;
+	let requiredMembers;
 	switch (jwk.kty) {
 		case "AKP":
-			check$2(jwk.alg, "\"alg\" (Algorithm) Parameter"), check$2(jwk.pub, "\"pub\" (Public key) Parameter"), components = {
+			check$2(jwk.alg, "\"alg\" (Algorithm) Parameter"), check$2(jwk.pub, "\"pub\" (Public key) Parameter"), requiredMembers = {
 				alg: jwk.alg,
 				kty: jwk.kty,
 				pub: jwk.pub
 			};
 			break;
 		case "EC":
-			check$2(jwk.crv, "\"crv\" (Curve) Parameter"), check$2(jwk.x, "\"x\" (X Coordinate) Parameter"), check$2(jwk.y, "\"y\" (Y Coordinate) Parameter"), components = {
+			check$2(jwk.crv, "\"crv\" (Curve) Parameter"), check$2(jwk.x, "\"x\" (X Coordinate) Parameter"), check$2(jwk.y, "\"y\" (Y Coordinate) Parameter"), requiredMembers = {
 				crv: jwk.crv,
 				kty: jwk.kty,
 				x: jwk.x,
@@ -2318,14 +2322,14 @@ async function calculateJwkThumbprint(key, digestAlgorithm) {
 			};
 			break;
 		case "OKP":
-			check$2(jwk.crv, "\"crv\" (Subtype of Key Pair) Parameter"), check$2(jwk.x, "\"x\" (Public Key) Parameter"), components = {
+			check$2(jwk.crv, "\"crv\" (Subtype of Key Pair) Parameter"), check$2(jwk.x, "\"x\" (Public Key) Parameter"), requiredMembers = {
 				crv: jwk.crv,
 				kty: jwk.kty,
 				x: jwk.x
 			};
 			break;
 		case "RSA":
-			check$2(jwk.e, "\"e\" (Exponent) Parameter"), check$2(jwk.n, "\"n\" (Modulus) Parameter"), components = {
+			check$2(jwk.e, "\"e\" (Exponent) Parameter"), check$2(jwk.n, "\"n\" (Modulus) Parameter"), requiredMembers = {
 				e: jwk.e,
 				kty: jwk.kty,
 				n: jwk.n
@@ -2333,18 +2337,18 @@ async function calculateJwkThumbprint(key, digestAlgorithm) {
 			break;
 		case "oct":
 			if (typeof jwk.k != "string") throw new JWKInvalid("\"k\" (Key Value) Parameter missing or invalid");
-			components = {
+			requiredMembers = {
 				k: jwk.k,
 				kty: jwk.kty
 			};
 			break;
 		default: throw new JOSENotSupported("\"kty\" (Key Type) Parameter missing or unsupported");
 	}
-	const data = encode$2(JSON.stringify(components));
-	return encode$1(await digest(digestAlgorithm, data));
+	const thumbprintInput = encode$2(JSON.stringify(requiredMembers));
+	return encode$1(await digest(digestAlgorithm, thumbprintInput));
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwk/embedded.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/jwk/embedded.js
 async function EmbeddedJWK(protectedHeader, token) {
 	const joseHeader = {
 		...protectedHeader,
@@ -2365,11 +2369,11 @@ async function EmbeddedJWK(protectedHeader, token) {
 	return key;
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwt/unsecured.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/jwt/unsecured.js
 const UnsecuredJWT_base = JWTClaimsBuilder;
 var UnsecuredJWT = class extends UnsecuredJWT_base {
 	encode() {
-		return `${encode$1(JSON.stringify({ alg: "none" }))}.${encode$1(jwtData(this))}.`;
+		return `${encode$1(JSON.stringify({ alg: "none" }))}.${encode$1(jwtClaimsSetBytes(this))}.`;
 	}
 	static decode(jwt, options) {
 		if (typeof jwt != "string") throw new JWTInvalid("Unsecured JWT must be a string");
@@ -2392,7 +2396,7 @@ var UnsecuredJWT = class extends UnsecuredJWT_base {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/key/import.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/key/import.js
 async function importJWK(jwk, alg, options) {
 	if (!isObject(jwk)) throw new TypeError("JWK must be an object");
 	const normalized = normalizeJwk(jwk), extractable = validateExtractableOption(options?.extractable), { alg: jwkAlg } = normalized;
@@ -2412,40 +2416,40 @@ async function importJWK(jwk, alg, options) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/decode_protected_header.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/util/decode_protected_header.js
 function decodeProtectedHeader(token) {
-	let protectedB64u;
+	let encodedProtectedHeader;
 	if (typeof token == "string") {
 		const parts = token.split(".");
-		(parts.length === 3 || parts.length === 5) && ([protectedB64u] = parts);
-	} else if (typeof token == "object" && token) if ("protected" in token) protectedB64u = token.protected;
+		(parts.length === 3 || parts.length === 5) && ([encodedProtectedHeader] = parts);
+	} else if (typeof token == "object" && token) if ("protected" in token) encodedProtectedHeader = token.protected;
 	else throw new TypeError("Token does not contain a Protected Header");
 	const invalid = "Invalid Token or Protected Header formatting";
-	if (typeof protectedB64u != "string" || !protectedB64u) throw new TypeError(invalid);
-	return parseJoseHeader(protectedB64u, TypeError, invalid);
+	if (typeof encodedProtectedHeader != "string" || !encodedProtectedHeader) throw new TypeError(invalid);
+	return parseJoseHeader(encodedProtectedHeader, TypeError, invalid);
 }
 //#endregion
-//#region node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/decode_jwt.js
+//#region node_modules/.pnpm/jose@6.2.13/node_modules/jose/dist/webapi/util/decode_jwt.js
 function decodeJwt(jwt) {
 	if (typeof jwt != "string") throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
-	const { 1: payload, length } = jwt.split(".");
+	const { 1: encodedPayload, length } = jwt.split(".");
 	if (length === 5) throw new JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");
 	if (length !== 3) throw new JWTInvalid("Invalid JWT");
-	if (!payload) throw new JWTInvalid("JWTs must contain a payload");
-	let decoded;
+	if (!encodedPayload) throw new JWTInvalid("JWTs must contain a payload");
+	let claimsSetBytes;
 	try {
-		decoded = decode$2(payload);
-	} catch {
-		throw new JWTInvalid("Failed to base64url decode the payload");
+		claimsSetBytes = decode$2(encodedPayload);
+	} catch (cause) {
+		throw new JWTInvalid("Failed to base64url decode the payload", { cause });
 	}
-	let result;
+	let claimsSet;
 	try {
-		result = JSON.parse(strictDecoder.decode(decoded));
-	} catch {
-		throw new JWTInvalid("Failed to parse the decoded payload as JSON");
+		claimsSet = JSON.parse(strictDecoder.decode(claimsSetBytes));
+	} catch (cause) {
+		throw new JWTInvalid("Failed to parse the decoded payload as JSON", { cause });
 	}
-	if (!isObject(result)) throw new JWTInvalid("Invalid JWT Claims Set");
-	return result;
+	if (!isObject(claimsSet)) throw new JWTInvalid("Invalid JWT Claims Set");
+	return claimsSet;
 }
 //#endregion
 //#region src/auth/server/trusted-clients.ts
@@ -3013,7 +3017,7 @@ const deriveKeyRing = (raw) => {
 	return [deriveKeySet(first), ...rest.map(deriveKeySet)];
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/attention.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/attention.js
 const SET_BOLD_YELLOW_TEXT = "\x1B[33;1m";
 const SET_BOLD_RED_TEXT = "\x1B[31;1m";
 const RESET_ALL_ATTRIBUTES = "\x1B[0m";
@@ -3030,7 +3034,7 @@ function warn(str) {
 	console.warn(stderr ? stderr(warning) : warning);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/lru.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/lru.js
 var LRU = class {
 	#maxSize;
 	#recent = /* @__PURE__ */ new Map();
@@ -24251,7 +24255,7 @@ var import_application = /* @__PURE__ */ __toESM(require_application(), 1);
 var koa_default = import_application.default;
 const HttpError = import_application.default.HttpError;
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/consts/param_list.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/consts/param_list.js
 var param_list_default = [
 	"acr_values",
 	"claims_locales",
@@ -24275,7 +24279,7 @@ var param_list_default = [
 	"ui_locales"
 ];
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/consts/dev_keystore.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/consts/dev_keystore.js
 var dev_keystore_default = { keys: [{
 	alg: "RS256",
 	d: "VEZOsY07JTFzGTqv6cC2Y32vsfChind2I_TTuvV225_-0zrSej3XLRg8iE_u0-3GSgiGi4WImmTwmEgLo4Qp3uEcxCYbt4NMJC7fwT2i3dfRZjtZ4yJwFl0SIj8TgfQ8ptwZbFZUlcHGXZIr4nL8GXyQT0CK8wy4COfmymHrrUoyfZA154ql_OsoiupSUCRcKVvZj2JHL2KILsq_sh_l7g2dqAN8D7jYfJ58MkqlknBMa2-zi5I0-1JUOwztVNml_zGrp27UbEU60RqV3GHjoqwI6m01U7K0a8Q_SQAKYGqgepbAYOA-P4_TLl5KC4-WWBZu_rVfwgSENwWNEhw8oQ",
@@ -24291,7 +24295,7 @@ var dev_keystore_default = { keys: [{
 	use: "sig"
 }] };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/consts/client_attributes.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/consts/client_attributes.js
 var client_attributes_exports = /* @__PURE__ */ __exportAll({
 	ARYS: () => ARYS$1,
 	BOOL: () => BOOL$1,
@@ -24484,7 +24488,7 @@ const CHOICES = {
 	userinfo_signed_response_alg: "userinfo_signing_alg_values_supported"
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/consts/jwa.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/consts/jwa.js
 var jwa_exports = /* @__PURE__ */ __exportAll({
 	attestSigningAlgValues: () => attestSigningAlgValues,
 	authorizationEncryptionAlgValues: () => authorizationEncryptionAlgValues,
@@ -24567,13 +24571,13 @@ const authorizationEncryptionEncValues = [...encryptionEncValues];
 const dPoPSigningAlgValues = [...signingAlgValues].filter((alg) => !alg.startsWith("HS"));
 const attestSigningAlgValues = [...signingAlgValues].filter((alg) => !alg.startsWith("HS"));
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/consts/index.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/consts/index.js
 const PUSHED_REQUEST_URN = "urn:ietf:params:oauth:request_uri:";
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/is_plain_object.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/is_plain_object.js
 var is_plain_object_default = (a) => !!a && a.constructor === Object;
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/merge.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/merge.js
 function merge(target, ...sources) {
 	for (const source of sources) {
 		if (!is_plain_object_default(source)) continue;
@@ -24586,7 +24590,7 @@ function merge(target, ...sources) {
 	return target;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/pick.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/pick.js
 var pick_default = (object = {}, ...properties) => {
 	const result = {};
 	properties.forEach((property) => {
@@ -24595,7 +24599,7 @@ var pick_default = (object = {}, ...properties) => {
 	return result;
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/remove.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/remove.js
 var remove_default = (array, predicate) => {
 	const remove = [];
 	array.forEach((value, index) => {
@@ -24606,7 +24610,7 @@ var remove_default = (array, predicate) => {
 	});
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/set.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/set.js
 var set_default = (object, path, value) => {
 	const properties = path.split(".");
 	if (properties.includes("__proto__") || properties.includes("constructor")) throw new TypeError("__proto__ and constructor cannot be set");
@@ -24618,13 +24622,13 @@ var set_default = (object, path, value) => {
 	});
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/upper_first.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/upper_first.js
 var upper_first_default = (str = "") => `${str.charAt(0).toUpperCase()}${str.slice(1)}`;
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/camel_case.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/camel_case.js
 var camel_case_default = (str = "") => str.replace(/(_\w)/g, (x) => x.replace("_", "").toUpperCase());
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/errors.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/errors.js
 var errors_exports = /* @__PURE__ */ __exportAll({
 	AccessDenied: () => AccessDenied,
 	AuthorizationPending: () => AuthorizationPending,
@@ -24835,7 +24839,7 @@ const UseAttestationChallenge = E("use_attestation_challenge");
 const UseFreshAttestation = E("use_fresh_attestation");
 const InvalidClientAttestation = E("invalid_client_attestation");
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/html_safe.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/html_safe.js
 function htmlSafe(input) {
 	if (typeof input === "number" && Number.isFinite(input)) return `${input}`;
 	if (typeof input === "string") return input.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
@@ -24843,7 +24847,7 @@ function htmlSafe(input) {
 	return "";
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/interaction_policy/check.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/interaction_policy/check.js
 var Check = class {
 	constructor(reason, description, error, check = () => {}, details = () => {}) {
 		if (typeof error === "function") {
@@ -24861,7 +24865,7 @@ var Check = class {
 Check.REQUEST_PROMPT = true;
 Check.NO_NEED_TO_PROMPT = false;
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/interaction_policy/prompt.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/interaction_policy/prompt.js
 var Prompt = class {
 	constructor({ name, requestable = false } = {}, details, ...checks) {
 		if (typeof requestable !== "boolean") throw new Error("requestable argument must be provided as Boolean");
@@ -24915,7 +24919,7 @@ var Prompt = class {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/weak_cache.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/weak_cache.js
 let read = () => void 0;
 function get$2(ctx) {
 	return read(ctx);
@@ -24924,7 +24928,7 @@ function setReader(reader) {
 	read = reader;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/interaction_policy/prompts/login.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/interaction_policy/prompts/login.js
 var login_default = () => new Prompt({
 	name: "login",
 	requestable: true
@@ -24977,7 +24981,7 @@ var login_default = () => new Prompt({
 	return Check.REQUEST_PROMPT;
 }, ({ oidc }) => ({ acr: oidc.claims.id_token.acr })));
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/interaction_policy/prompts/consent.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/interaction_policy/prompts/consent.js
 const missingOIDCScope = Symbol();
 const missingOIDCClaims = Symbol();
 const missingResourceScopes = Symbol();
@@ -25045,7 +25049,7 @@ var consent_default = () => new Prompt({
 	return Check.NO_NEED_TO_PROMPT;
 }, ({ oidc }) => ({ rar: JSON.parse(oidc.params.authorization_details) })));
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/interaction_policy/index.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/interaction_policy/index.js
 const base = () => {
 	const DEFAULT = [];
 	DEFAULT.get = function getPrompt(name) {
@@ -25069,7 +25073,7 @@ const base = () => {
 	return DEFAULT;
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/nanoid.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/nanoid.js
 const urlAlphabet = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict";
 const POOL_SIZE = 4096;
 function customAlphabet(alphabet, defaultSize) {
@@ -25118,7 +25122,7 @@ function customAlphabet(alphabet, defaultSize) {
 }
 var nanoid_default = customAlphabet(urlAlphabet, 43);
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/defaults.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/defaults.js
 const warned$1 = /* @__PURE__ */ new Set();
 function shouldChange(name, msg) {
 	if (!warned$1.has(name)) {
@@ -25896,7 +25900,7 @@ function makeDefaults() {
 }
 const defaults$1 = makeDefaults();
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/features.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/features.js
 const STABLE = /* @__PURE__ */ new Set([
 	"backchannelLogout",
 	"ciba",
@@ -25938,7 +25942,7 @@ const EXPERIMENTS = new Map(Object.entries({
 	},
 	attestClientAuth: {
 		name: "OAuth 2.0 Attestation-Based Client Authentication",
-		version: "draft-10"
+		version: "draft-12"
 	},
 	clientIdMetadataDocument: {
 		name: "OAuth Client ID Metadata Document",
@@ -25946,7 +25950,7 @@ const EXPERIMENTS = new Map(Object.entries({
 	}
 }));
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/formatters.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/formatters.js
 const conjunction = new Intl.ListFormat("en", { type: "conjunction" });
 const disjunction = new Intl.ListFormat("en", { type: "disjunction" });
 const formatter = { format(iterable, { type }) {
@@ -25961,7 +25965,7 @@ function pluralize(word, count) {
 	return `${word}s`;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/configuration.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/configuration.js
 function featuresTypeErrorCheck({ features }) {
 	for (const value of Object.values(features)) if (typeof value === "boolean") throw new TypeError("Features are not enabled/disabled with a boolean value. See the documentation for more details.");
 }
@@ -26350,6 +26354,7 @@ var Configuration = class {
 	checkAttestClientAuth() {
 		const { additionalSecuritySignal } = this.features.attestClientAuth;
 		if (additionalSecuritySignal !== false && additionalSecuritySignal !== "optional" && additionalSecuritySignal !== "required") throw new TypeError("features.attestClientAuth.additionalSecuritySignal must be false, optional, or required");
+		if (this.features.attestClientAuth.enabled && this.features.dPoP.enabled && this.features.dPoP.nonceSecret === void 0) throw new TypeError("features.dPoP.nonceSecret is required when features.attestClientAuth and features.dPoP are enabled");
 	}
 	checkAuthMethods() {
 		const authMethods = /* @__PURE__ */ new Set([
@@ -26361,7 +26366,10 @@ var Configuration = class {
 		]);
 		if (this.features.mTLS.enabled && this.features.mTLS.tlsClientAuth) authMethods.add("tls_client_auth");
 		if (this.features.mTLS.enabled && this.features.mTLS.selfSignedTlsClientAuth) authMethods.add("self_signed_tls_client_auth");
-		if (this.features.attestClientAuth.enabled) authMethods.add("attest_jwt_client_auth");
+		if (this.features.attestClientAuth.enabled) {
+			authMethods.add("attest_jwt_client_auth");
+			if (this.features.dPoP.enabled) authMethods.add("attest_jwt_client_auth_dpop");
+		}
 		if (this.clientAuthMethods) this.clientAuthMethods.forEach((method) => {
 			if (!authMethods.has(method)) throw new TypeError(`only supported clientAuthMethods are ${formatList([...authMethods])}`);
 		});
@@ -26406,7 +26414,7 @@ var Configuration = class {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/keystore.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/keystore.js
 var ExternalSigningKey = class {
 	#publicJwk;
 	#kid;
@@ -26587,7 +26595,7 @@ var KeyStore = class {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/initialize_keystore.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/initialize_keystore.js
 const calculateKid = (jwk) => {
 	let components;
 	switch (jwk.kty) {
@@ -26817,10 +26825,10 @@ function initialize$1(jwks) {
 	get$2(this).jwks = { keys };
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/epoch_time.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/epoch_time.js
 var epoch_time_default = (date = Date.now()) => Math.floor(date / 1e3);
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/adapters/memory_adapter.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/adapters/memory_adapter.js
 function createStorage() {
 	return new LRU({ maxSize: 1e3 });
 }
@@ -26943,12 +26951,12 @@ function createMemoryAdapter(clockTolerance = 0) {
 	return (model) => new MemoryAdapter(model, store, clockTolerance);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/type_validators.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/type_validators.js
 const hasPrototype = (target) => target.prototype !== null && typeof target.prototype === "object";
 const isContructor = (fn) => fn.constructor instanceof Function && fn.constructor.name !== void 0;
 var type_validators_default = (constructable) => constructable instanceof Function && hasPrototype(constructable) && isContructor(constructable.constructor);
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/initialize_adapter.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/initialize_adapter.js
 function initializeAdapter(adapter = MemoryAdapter) {
 	let Adapter = adapter;
 	if (adapter === MemoryAdapter) {
@@ -26962,7 +26970,7 @@ function initializeAdapter(adapter = MemoryAdapter) {
 	get$2(this).Adapter = Adapter;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/router.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/router.js
 function compose(middleware) {
 	return function composed(ctx, next) {
 		let index = -1;
@@ -27124,7 +27132,7 @@ var Router = class {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/selective_body.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/selective_body.js
 let warned;
 const LIMIT = 57344;
 async function readBody(req, length, charset) {
@@ -27176,7 +27184,7 @@ async function urlencoded(ctx, next) {
 	else await next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/views/interaction.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/views/interaction.js
 function interaction$1(it, options) {
 	const include = (template, data) => this.render(template, data, options);
 	const __eta = {
@@ -27274,7 +27282,7 @@ function interaction$1(it, options) {
 	return __eta.res;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/views/layout.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/views/layout.js
 function layout$1(it, options) {
 	const include = (template, data) => this.render(template, data, options);
 	const __eta = {
@@ -27321,7 +27329,7 @@ function layout$1(it, options) {
 	return __eta.res;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/views/login.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/views/login.js
 function login$1(it, options) {
 	const include = (template, data) => this.render(template, data, options);
 	const __eta = {
@@ -27349,7 +27357,7 @@ function login$1(it, options) {
 	return __eta.res;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/views/index.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/views/index.js
 const ESCAPE = {
 	"&": "&amp;",
 	"<": "&lt;",
@@ -27377,13 +27385,13 @@ const interaction = (locals) => render$1(interaction$1, locals);
 const layout = (locals) => render$1(layout$1, locals);
 const login = (locals) => render$1(login$1, locals);
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/no_cache.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/no_cache.js
 async function noCache(ctx, next) {
 	ctx.set("cache-control", "no-store");
 	await next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/interaction.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/interaction.js
 const viewMap = {
 	login,
 	interaction
@@ -27478,7 +27486,7 @@ const submit = [
 	}
 ];
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/configuration_result.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/configuration_result.js
 function invalid$1(path, expected) {
 	return /* @__PURE__ */ new TypeError(`${path} must ${expected}`);
 }
@@ -27519,7 +27527,7 @@ function extraTokenClaims(value, path = "extraTokenClaims") {
 	return value;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/cors.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/cors.js
 const list = (value) => Array.isArray(value) ? value.join(",") : value;
 function corsMiddleware({ allowMethods, maxAge, exposeHeaders }) {
 	const methods = list(allowMethods) ?? "GET,HEAD,PUT,POST,DELETE,PATCH";
@@ -27562,7 +27570,7 @@ var cors_default = ({ clientBased = false, ...options }) => {
 	};
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/validate_presence.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/validate_presence.js
 function validatePresence(ctx, ...required) {
 	const { params } = ctx.oidc;
 	const missing = required.map((param) => {
@@ -27571,7 +27579,7 @@ function validatePresence(ctx, ...required) {
 	if (missing.length) throw new InvalidRequest(`missing required ${pluralize("parameter", missing.length)} ${formatList(missing)}`);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/pkce_format.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/pkce_format.js
 const check = /[^\w.\-~]/;
 var pkce_format_default = (input, param) => {
 	if (input.length < 43) throw new InvalidRequest(`${param} must be a string with a minimum length of 43 characters`);
@@ -27579,7 +27587,7 @@ var pkce_format_default = (input, param) => {
 	if (check.test(input)) throw new InvalidRequest(`${param} contains invalid characters`);
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/constant_equals.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/constant_equals.js
 function paddedBuffer(string, length) {
 	const buffer = Buffer.alloc(length, void 0, "utf8");
 	buffer.write(string);
@@ -27592,7 +27600,7 @@ function constantEquals(a, b, minComp = 0) {
 	return timingSafeEqual(paddedBuffer(a, length), paddedBuffer(b, length));
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/pkce.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/pkce.js
 function checkPKCE$1(verifier, challenge, method) {
 	if (verifier) pkce_format_default(verifier, "code_verifier");
 	if (verifier || challenge) try {
@@ -27606,18 +27614,18 @@ function checkPKCE$1(verifier, challenge, method) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/check_attest_binding.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/check_attest_binding.js
 async function checkAttestBinding(ctx, model) {
 	const { cnf: { jwk } } = decodeJwt(ctx.get("oauth-client-attestation"));
 	if (model.attestationJkt !== await calculateJwkThumbprint(jwk)) throw new InvalidGrant$1("oauth-client-attestation instance public key mismatch");
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/assert_provider_context.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/assert_provider_context.js
 function assertProviderContext(provider, ctx) {
 	if (ctx?.oidc?.provider !== provider) throw new TypeError("provider does not match ctx.oidc.provider");
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/base64url.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/base64url.js
 function encode(input, encoding = "utf8") {
 	return Buffer.from(input, encoding).toString("base64url");
 }
@@ -27625,7 +27633,7 @@ function encodeBuffer(buf) {
 	return Buffer.prototype.base64urlSlice.call(buf);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/challenge.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/challenge.js
 function sixfourbeify(value) {
 	const buf = Buffer.alloc(8);
 	for (let i = buf.length - 1; i >= 0; i--) {
@@ -27685,17 +27693,29 @@ var ServerChallenge = class {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/validate_dpop.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/validate_dpop.js
 const weakMap = /* @__PURE__ */ new WeakMap();
+const combinedReplayChecks = /* @__PURE__ */ new WeakMap();
+function getDpopJwt(provider, ctx) {
+	assertProviderContext(provider, ctx);
+	return weakMap.get(ctx)?.jwt;
+}
 async function checkDpopReplay(provider, ctx, dPoP, clientId, ErrorClass = InvalidGrant$1) {
 	assertProviderContext(provider, ctx);
 	if (!dPoP || get$2(provider).features.dPoP.allowReplay) return;
+	const combined = ctx.oidc.clientAttestation?.method === "dpop_combined" && ctx.oidc.client.clientId === clientId && weakMap.get(ctx)?.result === dPoP;
+	if (combined && combinedReplayChecks.get(ctx) === dPoP) return;
 	const unique = await provider.ReplayDetection.unique(clientId, dPoP.jti, epoch_time_default() + 300);
 	ctx.assert(unique, new ErrorClass("DPoP proof JWT Replay detected"));
+	if (combined) combinedReplayChecks.set(ctx, dPoP);
 }
 async function validateDpop(provider, ctx, accessToken) {
 	assertProviderContext(provider, ctx);
-	if (weakMap.has(ctx)) return weakMap.get(ctx);
+	if (weakMap.has(ctx)) {
+		const { result, jwt } = weakMap.get(ctx);
+		if (accessToken && jwt.payload.ath !== crypto$2.hash("sha256", accessToken, "base64url")) throw new InvalidDpopProof("DPoP proof ath mismatch");
+		return result;
+	}
 	const { features: { dPoP: dPoPConfig }, dPoPSigningAlgValues } = get$2(provider).configuration;
 	if (!dPoPConfig.enabled) return;
 	const proof = ctx.get("DPoP");
@@ -27706,11 +27726,13 @@ async function validateDpop(provider, ctx, accessToken) {
 	const nextNonce = DPoPNonces?.nextChallenge();
 	let payload;
 	let protectedHeader;
+	let jwt;
 	try {
-		({protectedHeader, payload} = await jwtVerify(proof, EmbeddedJWK, {
+		jwt = await jwtVerify(proof, EmbeddedJWK, {
 			algorithms: dPoPSigningAlgValues,
 			typ: "dpop+jwt"
-		}));
+		});
+		({protectedHeader, payload} = jwt);
 		if (typeof payload.iat !== "number" || !payload.iat) throw new InvalidDpopProof("DPoP proof must have a iat number property");
 		if (typeof payload.jti !== "string" || !payload.jti) throw new InvalidDpopProof("DPoP proof must have a jti string property");
 		if (payload.nonce !== void 0 && typeof payload.nonce !== "string") throw new InvalidDpopProof("DPoP proof nonce must be a string");
@@ -27756,11 +27778,14 @@ async function validateDpop(provider, ctx, accessToken) {
 		jti: payload.jti,
 		iat: payload.iat
 	};
-	weakMap.set(ctx, result);
+	weakMap.set(ctx, {
+		result,
+		jwt
+	});
 	return result;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/consts/non_rejectable_claims.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/consts/non_rejectable_claims.js
 const NON_REJECTABLE_CLAIMS = /* @__PURE__ */ new Set([
 	"sub",
 	"sid",
@@ -27770,7 +27795,7 @@ const NON_REJECTABLE_CLAIMS = /* @__PURE__ */ new Set([
 	"iss"
 ]);
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/filter_claims.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/filter_claims.js
 var filter_claims_default = (source, target, grant) => {
 	const claims = { ...source?.[target] };
 	const requested = Object.keys(claims);
@@ -27782,7 +27807,7 @@ var filter_claims_default = (source, target, grant) => {
 	return claims;
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/account_claims.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/account_claims.js
 async function getCtxAccountClaims(ctx, use, scope, claims, rejected) {
 	return {
 		...await ctx.oidc.account.claims(use, scope, claims, rejected),
@@ -27790,7 +27815,7 @@ async function getCtxAccountClaims(ctx, use, scope, claims, rejected) {
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/revoke.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/revoke.js
 async function revoke(ctx, grantId) {
 	if (!grantId) return;
 	const { oidc: { client, provider } } = ctx;
@@ -27812,7 +27837,7 @@ async function revoke(ctx, grantId) {
 	if (revokeGrant) ctx.oidc.provider.emit("grant.revoked", ctx, grantId);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/grant_source.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/grant_source.js
 async function findGrantSource(provider, ctx, Model, value, label) {
 	assertProviderContext(provider, ctx);
 	const source = await Model.find(value, { ignoreExpiration: true });
@@ -27841,18 +27866,19 @@ async function findAccount(provider, ctx, accountId, source) {
 	return account(await get$2(provider).configuration.findAccount(ctx, accountId, source));
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/set_rt_bindings.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/set_rt_bindings.js
 async function setRefreshTokenBindings(ctx, at, rt) {
 	switch (ctx.oidc.client.clientAuthMethod) {
 		case "none":
 			if (at.jkt) rt.jkt = at.jkt;
 			if (at["x5t#S256"]) rt["x5t#S256"] = at["x5t#S256"];
 			break;
-		case "attest_jwt_client_auth": await rt.setAttestBinding(ctx);
+		case "attest_jwt_client_auth":
+		case "attest_jwt_client_auth_dpop": await rt.setAttestBinding(ctx);
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/grant_refresh_token.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/grant_refresh_token.js
 async function shouldIssueRefreshToken(provider, ctx, source) {
 	assertProviderContext(provider, ctx);
 	return boolean(await get$2(provider).configuration.issueRefreshToken(ctx, ctx.oidc.client, source), "issueRefreshToken");
@@ -27862,7 +27888,7 @@ function applyRefreshTokenBindings(provider, ctx, accessToken, refreshToken) {
 	return setRefreshTokenBindings(ctx, accessToken, refreshToken);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/grant_common.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/grant_common.js
 const { InvalidGrant } = errors_exports;
 const errorMap$2 = { ...errors_exports };
 function throwIfAsyncGrantError(entity) {
@@ -27978,7 +28004,7 @@ async function issueIdToken(provider, ctx, source, at, grant, scopeOverride) {
 	return token.issue({ use: "idtoken" });
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/grants/authorization_code.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/grants/authorization_code.js
 var authorization_code_exports = /* @__PURE__ */ __exportAll({
 	grantType: () => grantType$5,
 	handler: () => handler$5,
@@ -28001,7 +28027,7 @@ const handler$5 = async function authorizationCodeHandler(provider, helpers, ctx
 	const cert = checkMtlsCert(ctx);
 	checkDpopRequired(ctx, dPoP);
 	if (code.redirectUri !== ctx.oidc.params.redirect_uri) throw new InvalidGrant$1("authorization code redirect_uri mismatch");
-	if (ctx.oidc.client.clientAuthMethod === "attest_jwt_client_auth" && code.attestationJkt) await checkAttestBinding(ctx, code);
+	if (["attest_jwt_client_auth", "attest_jwt_client_auth_dpop"].includes(ctx.oidc.client.clientAuthMethod) && code.attestationJkt) await checkAttestBinding(ctx, code);
 	await consumeGrantSource(ctx, code, "authorization code");
 	ctx.oidc.entity("AuthorizationCode", code);
 	ctx.oidc.entity("Grant", grant);
@@ -28019,7 +28045,7 @@ const parameters$5 = /* @__PURE__ */ new Set([
 ]);
 const grantType$5 = gty$4;
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/grants/client_credentials.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/grants/client_credentials.js
 var client_credentials_exports = /* @__PURE__ */ __exportAll({
 	grantType: () => grantType$4,
 	handler: () => handler$4,
@@ -28059,10 +28085,10 @@ const handler$4 = async function clientCredentialsHandler(provider, helpers, ctx
 const parameters$4 = /* @__PURE__ */ new Set(["scope"]);
 const grantType$4 = "client_credentials";
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/difference.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/difference.js
 var difference_default = (array, values) => array.filter((value) => values.indexOf(value) === -1);
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/certificate_thumbprint.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/certificate_thumbprint.js
 function certThumbprint(cert) {
 	let data;
 	if (cert instanceof crypto$2.X509Certificate) data = cert.raw;
@@ -28070,7 +28096,7 @@ function certThumbprint(cert) {
 	return crypto$2.hash("sha256", data, "base64url");
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/resolve_resource.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/resolve_resource.js
 var resolve_resource_default = async (ctx, model, config, scopes = model.scopes) => {
 	let resource;
 	if (config.resourceIndicators.enabled) {
@@ -28090,7 +28116,7 @@ var resolve_resource_default = async (ctx, model, config, scopes = model.scopes)
 	return resource;
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/grants/refresh_token.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/grants/refresh_token.js
 var refresh_token_exports = /* @__PURE__ */ __exportAll({
 	grantType: () => grantType$3,
 	handler: () => handler$3,
@@ -28123,7 +28149,7 @@ const handler$3 = async function refreshTokenHandler(provider, helpers, ctx) {
 	}
 	await checkDpopReplay(ctx, dPoP, client.clientId, InvalidGrant$1);
 	if (refreshToken.jkt && (!dPoP || refreshToken.jkt !== dPoP.thumbprint)) throw new InvalidGrant$1("failed jkt verification");
-	if (ctx.oidc.client.clientAuthMethod === "attest_jwt_client_auth") await checkAttestBinding(ctx, refreshToken);
+	if (["attest_jwt_client_auth", "attest_jwt_client_auth_dpop"].includes(ctx.oidc.client.clientAuthMethod)) await checkAttestBinding(ctx, refreshToken);
 	ctx.oidc.entity("RefreshToken", refreshToken);
 	ctx.oidc.entity("Grant", grant);
 	const account = await validateAccount(provider, ctx, refreshToken, "refresh token");
@@ -28202,7 +28228,7 @@ const handler$3 = async function refreshTokenHandler(provider, helpers, ctx) {
 const parameters$3 = /* @__PURE__ */ new Set(["refresh_token", "scope"]);
 const grantType$3 = gty$3;
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/grants/device_code.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/grants/device_code.js
 var device_code_exports = /* @__PURE__ */ __exportAll({
 	grantType: () => grantType$2,
 	gty: () => gty$2,
@@ -28215,7 +28241,7 @@ const handler$2 = async function deviceCodeHandler(provider, helpers, ctx) {
 	validatePresence(ctx, "device_code");
 	const dPoP = await validateDpop(ctx);
 	const code = await findGrantSource(ctx, provider.DeviceCode, ctx.oidc.params.device_code, "device code");
-	if (ctx.oidc.client.clientAuthMethod === "attest_jwt_client_auth") await checkAttestBinding(ctx, code);
+	if (["attest_jwt_client_auth", "attest_jwt_client_auth_dpop"].includes(ctx.oidc.client.clientAuthMethod)) await checkAttestBinding(ctx, code);
 	const cert = checkMtlsCert(ctx);
 	checkDpopRequired(ctx, dPoP);
 	if (code.isExpired) throw new ExpiredToken("device code is expired");
@@ -28235,7 +28261,7 @@ const handler$2 = async function deviceCodeHandler(provider, helpers, ctx) {
 const parameters$2 = /* @__PURE__ */ new Set(["device_code"]);
 const grantType$2 = "urn:ietf:params:oauth:grant-type:device_code";
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/grants/ciba.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/grants/ciba.js
 var ciba_exports = /* @__PURE__ */ __exportAll({
 	grantType: () => grantType$1,
 	gty: () => gty$1,
@@ -28252,7 +28278,7 @@ const handler$1 = async function cibaHandler(provider, helpers, ctx) {
 	checkDpopRequired(ctx, dPoP);
 	if (request.isExpired) throw new ExpiredToken("backchannel authentication request is expired");
 	if (!request.grantId && !request.error) throw new AuthorizationPending();
-	if (ctx.oidc.client.clientAuthMethod === "attest_jwt_client_auth") await checkAttestBinding(ctx, request);
+	if (["attest_jwt_client_auth", "attest_jwt_client_auth_dpop"].includes(ctx.oidc.client.clientAuthMethod)) await checkAttestBinding(ctx, request);
 	await consumeGrantSource(ctx, request, "backchannel authentication request");
 	throwIfAsyncGrantError(request);
 	const grant = await validateGrant(ctx, request.grantId);
@@ -28268,7 +28294,7 @@ const handler$1 = async function cibaHandler(provider, helpers, ctx) {
 const parameters$1 = /* @__PURE__ */ new Set(["auth_req_id"]);
 const grantType$1 = "urn:openid:params:grant-type:ciba";
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/grants/pre_authorized_code.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/grants/pre_authorized_code.js
 var pre_authorized_code_exports = /* @__PURE__ */ __exportAll({
 	grantType: () => grantType,
 	gty: () => gty,
@@ -28304,7 +28330,7 @@ const handler = async function preAuthorizedCodeHandler(provider, helpers, ctx)
 const parameters = /* @__PURE__ */ new Set(["pre-authorized_code", "tx_code"]);
 const grantType = "urn:ietf:params:oauth:grant-type:pre-authorized_code";
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/grants/index.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/grants/index.js
 var grants_exports$1 = /* @__PURE__ */ __exportAll({
 	authorization_code: () => authorization_code_exports,
 	ciba: () => ciba_exports,
@@ -28314,7 +28340,7 @@ var grants_exports$1 = /* @__PURE__ */ __exportAll({
 	refresh_token: () => refresh_token_exports
 });
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/script_src_sha.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/script_src_sha.js
 function pushScriptSrcSha(ctx, script) {
 	const csp = ctx.response.get("content-security-policy");
 	if (csp) {
@@ -28333,7 +28359,7 @@ function pushScriptSrcSha(ctx, script) {
 	return script;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/response_modes/form_post.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/response_modes/form_post.js
 const statusCodes$1 = /* @__PURE__ */ new Set([
 	200,
 	400,
@@ -28364,7 +28390,7 @@ function formPost(ctx, action, inputs) {
 </html>`;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/redirect_uri.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/redirect_uri.js
 function redirectUri(uri, payload, mode) {
 	const parsed = new URL(uri);
 	switch (mode) {
@@ -28376,21 +28402,21 @@ function redirectUri(uri, payload, mode) {
 	return parsed.href;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/response_modes/fragment.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/response_modes/fragment.js
 var fragment_default = (ctx, redirectUri$2, payload) => {
 	const uri = redirectUri(redirectUri$2, payload, "fragment");
 	ctx.status = 303;
 	ctx.redirect(uri);
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/response_modes/query.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/response_modes/query.js
 var query_default = (ctx, redirectUri$1, payload) => {
 	const uri = redirectUri(redirectUri$1, payload, "query");
 	ctx.status = 303;
 	ctx.redirect(uri);
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/response_modes/web_message.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/response_modes/web_message.js
 const statusCodes = /* @__PURE__ */ new Set([
 	200,
 	400,
@@ -28438,7 +28464,7 @@ function webMessage(ctx, redirectUri, response) {
 </html>`;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/response_modes/jwt.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/response_modes/jwt.js
 const modes = {
 	query: query_default,
 	fragment: fragment_default,
@@ -29277,7 +29303,7 @@ var require_src = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	else module.exports = require_node();
 }));
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/user_code_form.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/user_code_form.js
 var import_src = /* @__PURE__ */ __toESM(require_src(), 1);
 function input(action, csrfToken, code, charset) {
 	const attributes = charset === "digits" ? "pattern=\"[0-9]*\" inputmode=\"numeric\" " : "";
@@ -29295,7 +29321,7 @@ function confirm$1(action, csrfToken, code) {
 </form>`;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/re_render_errors.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/re_render_errors.js
 var ReRenderError = class extends Error {
 	constructor(message, userCode, options = void 0) {
 		super(message, options);
@@ -29334,7 +29360,7 @@ var NoCodeError = class extends ReRenderError {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/err_out.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/err_out.js
 var err_out_default = ({ expose, message, error_description: description, scope }, state) => {
 	if (expose) return {
 		error: message,
@@ -29349,7 +29375,7 @@ var err_out_default = ({ expose, message, error_description: description, scope
 	};
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/xsrf.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/xsrf.js
 function generateXsrf(ctx, next) {
 	const secret = crypto$2.randomBytes(24).toString("hex");
 	ctx.oidc.session.state = { secret };
@@ -29363,7 +29389,7 @@ function checkXsrf(missingMessage) {
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/error_handler.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/error_handler.js
 const debugError$1 = (0, import_src.default)("oidc-provider:error");
 const serverError$1 = (0, import_src.default)("oidc-provider:server_error");
 const serverErrorTrace$1 = (0, import_src.default)("oidc-provider:server_error:trace");
@@ -29397,7 +29423,7 @@ function getErrorHandler(eventName) {
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/omit_by.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/omit_by.js
 var omit_by_default = (object, predicate) => {
 	Object.entries(object).forEach(([key, value]) => {
 		if (predicate(value, key)) delete object[key];
@@ -29405,7 +29431,7 @@ var omit_by_default = (object, predicate) => {
 	return object;
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/resolve_response_mode.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/resolve_response_mode.js
 function resolve$1(responseType) {
 	return typeof responseType === "string" && responseType.includes("token") ? "fragment" : "query";
 }
@@ -29413,7 +29439,7 @@ function isFrontChannel(responseType) {
 	return resolve$1(responseType) === "fragment";
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/response_parameters.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/response_parameters.js
 function checkResponseMode(ctx, next) {
 	const { params, client } = ctx.oidc;
 	const frontChannel = isFrontChannel(params.response_type);
@@ -29488,7 +29514,7 @@ function oidcRequired(ctx, next) {
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/authorization_error_handler.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/authorization_error_handler.js
 const debugError = (0, import_src.default)("oidc-provider:authentication:error");
 const serverError = (0, import_src.default)("oidc-provider:server_error");
 const serverErrorTrace = (0, import_src.default)("oidc-provider:server_error:trace");
@@ -29550,7 +29576,7 @@ async function authorizationErrorHandler(ctx, next) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/params.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/params.js
 var Params = class {
 	constructor(allowList, params) {
 		strict(allowList, "allowList must be present");
@@ -29563,14 +29589,14 @@ var Params = class {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/assemble_params.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/assemble_params.js
 function assembleParams(allowList, ctx, next) {
 	const params = ctx.method === "POST" ? ctx.oidc.body : ctx.query;
 	ctx.oidc.params = new Params(allowList, params);
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/session.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/session.js
 async function sessionHandler(ctx, next) {
 	ctx.oidc.session = new Proxy(await ctx.oidc.provider.Session.get(ctx), { set(obj, prop, value) {
 		switch (prop) {
@@ -29624,7 +29650,7 @@ async function sessionHandler(ctx, next) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/normalize_authorization_details.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/normalize_authorization_details.js
 const ARRAY_FIELDS = [
 	"locations",
 	"actions",
@@ -29645,7 +29671,7 @@ function normalizeAuthorizationDetails(details, { ErrorConstructor = TypeError,
 	return details;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/check_rar.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/check_rar.js
 async function checkRar(ctx, next) {
 	const { params, client } = ctx.oidc;
 	if (params.authorization_details !== void 0) {
@@ -29679,7 +29705,7 @@ async function checkRar(ctx, next) {
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/check_resource.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/check_resource.js
 const filterStatics = (ctx) => {
 	if (ctx.oidc.params.scope && !ctx.oidc.params.resource) ctx.oidc.params.scope = [...ctx.oidc.requestParamOIDCScopes].join(" ");
 };
@@ -29719,13 +29745,13 @@ async function checkResource(ctx, next) {
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/append_www_authenticate.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/append_www_authenticate.js
 function appendWWWAuthenticate(ctx, scheme, fields) {
 	const parameters = Object.entries(omit_by_default(fields, (v) => v === void 0)).map(([key, val]) => `${key}="${val.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`).join(", ");
 	ctx.append("WWW-Authenticate", `${scheme} ${parameters}`);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/jwt.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/jwt.js
 const { JWEDecryptionFailed, JWKSNoMatchingKey, JWSSignatureVerificationFailed } = errors_exports$1;
 function verifyAudience({ aud }, expected) {
 	if (Array.isArray(aud)) {
@@ -29849,15 +29875,14 @@ async function decrypt(jwe, keystore) {
 	return Buffer.from(decrypted.plaintext);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/attest_client_auth.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/attest_client_auth.js
 function invalid(ErrorClass, options) {
 	if (ErrorClass === InvalidClientAuth) return new ErrorClass(options);
 	return new ErrorClass(void 0, options);
 }
 async function validateClientAttestationJwtAndPop(ctx, { signal = false } = {}) {
-	const { configuration: { clockTolerance, features: { attestClientAuth }, attestSigningAlgValues }, AttestChallenges } = get$2(ctx.oidc.provider);
+	const { configuration: { clockTolerance, features: { attestClientAuth, dPoP: dPoPConfig }, attestSigningAlgValues }, AttestChallenges, DPoPNonces } = get$2(ctx.oidc.provider);
 	const ErrorClass = signal ? InvalidClientAttestation : InvalidClientAuth;
-	const nextChallenge = AttestChallenges.nextChallenge();
 	const attestation = ctx.get("oauth-client-attestation");
 	if (!attestation) throw invalid(ErrorClass, "oauth-client-attestation missing");
 	let verifiedAttestation;
@@ -29869,6 +29894,7 @@ async function validateClientAttestationJwtAndPop(ctx, { signal = false } = {})
 			algorithms: attestSigningAlgValues,
 			requiredClaims: [
 				"sub",
+				"iat",
 				"exp",
 				"cnf"
 			],
@@ -29882,9 +29908,27 @@ async function validateClientAttestationJwtAndPop(ctx, { signal = false } = {})
 		throw invalid(ErrorClass, { cause });
 	}
 	const pop = ctx.get("oauth-client-attestation-pop");
-	if (!pop) throw invalid(ErrorClass, "oauth-client-attestation-pop missing");
+	const combined = ctx.headers["oauth-client-attestation-pop"] === void 0 && ctx.headers.dpop !== void 0;
+	if (!pop && !combined) throw invalid(ErrorClass, "oauth-client-attestation-pop missing");
 	let verifiedPoP;
-	try {
+	let dPoP;
+	if (combined) {
+		if (!dPoPConfig.enabled) throw invalid(ErrorClass, "DPoP combined mode is not supported");
+		dPoP = await validateDpop(ctx.oidc.provider, ctx);
+		if (!dPoP) throw invalid(ErrorClass, "DPoP proof missing");
+		verifiedPoP = getDpopJwt(ctx.oidc.provider, ctx);
+		if (!verifiedPoP.payload.nonce) {
+			ctx.set("dpop-nonce", DPoPNonces.nextChallenge());
+			throw new UseDpopNonce("nonce is required in the DPoP proof");
+		}
+		let thumbprint;
+		try {
+			thumbprint = await calculateJwkThumbprint(verifiedAttestation.payload.cnf.jwk);
+		} catch (cause) {
+			throw invalid(ErrorClass, { cause });
+		}
+		if (thumbprint !== dPoP.thumbprint) throw invalid(ErrorClass, "DPoP proof key does not match the Client Attestation key");
+	} else try {
 		verifiedPoP = await jwtVerify(pop, async (header) => importJWK(verifiedAttestation.payload.cnf.jwk, header.alg), {
 			algorithms: attestSigningAlgValues,
 			requiredClaims: [
@@ -29902,7 +29946,18 @@ async function validateClientAttestationJwtAndPop(ctx, { signal = false } = {})
 		throw invalid(ErrorClass, { cause });
 	}
 	await attestClientAuth.assertAttestationJwtAndPop(ctx, verifiedAttestation, verifiedPoP, ctx.oidc.client);
+	if (combined) {
+		ctx.oidc.clientAttestation = {
+			method: "dpop_combined",
+			signal,
+			attestation: verifiedAttestation,
+			pop: verifiedPoP
+		};
+		await checkDpopReplay(ctx.oidc.provider, ctx, dPoP, ctx.oidc.client.clientId, InvalidDpopProof);
+		return;
+	}
 	if (!await ctx.oidc.provider.ReplayDetection.unique(ctx.oidc.client.clientId, verifiedPoP.payload.jti, epoch_time_default() + 300)) throw invalid(ErrorClass, "oauth-client-attestation-pop tokens must only be used once");
+	const nextChallenge = AttestChallenges.nextChallenge();
 	if (typeof verifiedPoP.payload.challenge !== "string" || !AttestChallenges.checkChallenge(verifiedPoP.payload.challenge)) {
 		ctx.set("oauth-client-attestation-challenge", nextChallenge);
 		throw new UseAttestationChallenge();
@@ -29919,7 +29974,7 @@ function attestationClientAuth(ctx) {
 	return validateClientAttestationJwtAndPop(ctx);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/jwt_client_auth.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/jwt_client_auth.js
 async function jwtClientAuth(ctx, keystore, filter) {
 	const { clockTolerance, assertJwtClientAuthClaimsAndHeader, clientAuthSigningAlgValues } = get$2(ctx.oidc.provider).configuration;
 	const acceptedAud = ctx.oidc.clientJwtAuthExpectedAudience();
@@ -29953,7 +30008,7 @@ async function jwtClientAuth(ctx, keystore, filter) {
 	if (!await ctx.oidc.provider.ReplayDetection.unique(payload.iss, payload.jti, payload.exp + clockTolerance)) throw new InvalidClientAuth("client assertion tokens must only be used once");
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/reject_dupes.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/reject_dupes.js
 function rejectDupes({ except, only } = {}, ctx, next) {
 	const params = [];
 	for (const [key, value] of Object.entries(ctx.oidc.params)) {
@@ -29966,7 +30021,7 @@ function rejectDupes({ except, only } = {}, ctx, next) {
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/client_auth.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/client_auth.js
 const assertionType = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
 function isValidBase64(input) {
 	const match = /^([A-Za-z0-9+/]*)(={0,2})$/u.exec(input);
@@ -30023,6 +30078,7 @@ async function authenticateClient(ctx, next) {
 	};
 	const hasAttestation = ctx.headers["oauth-client-attestation"] !== void 0;
 	const hasAttestationPop = ctx.headers["oauth-client-attestation-pop"] !== void 0;
+	const attestationAuthMethod = !hasAttestationPop && ctx.headers.dpop !== void 0 ? "attest_jwt_client_auth_dpop" : "attest_jwt_client_auth";
 	const { additionalSecuritySignal } = features.attestClientAuth;
 	const { length } = [
 		ctx.headers.authorization,
@@ -30052,7 +30108,7 @@ async function authenticateClient(ctx, next) {
 		setClientId(basicClientId);
 		if (!clientSecret) throw new InvalidRequest("client_secret must be provided in the Authorization header");
 		methods = ["client_secret_basic", "client_secret_post"];
-	} else if (hasAttestation && (!clientId || !additionalSecuritySignal)) {
+	} else if (hasAttestation && ctx.oidc.params.client_assertion === void 0 && (!clientId || !additionalSecuritySignal)) {
 		let sub;
 		try {
 			({sub} = payload(ctx.headers["oauth-client-attestation"]));
@@ -30061,7 +30117,7 @@ async function authenticateClient(ctx, next) {
 		}
 		if (!sub) throw new InvalidClientAuth("sub (JWT subject) must be provided in the OAuth-Client-Attestation JWT");
 		setClientId(sub);
-		methods = ["attest_jwt_client_auth"];
+		methods = [attestationAuthMethod];
 	} else if (ctx.oidc.params.client_assertion !== void 0) {
 		let sub;
 		try {
@@ -30080,13 +30136,13 @@ async function authenticateClient(ctx, next) {
 			"tls_client_auth",
 			"self_signed_tls_client_auth"
 		];
-		if (hasAttestation && additionalSecuritySignal) methods.push("attest_jwt_client_auth");
+		if (hasAttestation && additionalSecuritySignal) methods.push(attestationAuthMethod);
 	}
 	if (!clientId) throw new InvalidRequest("no client authentication mechanism provided");
 	const client = await provider.Client.find(clientId);
 	if (!client) throw new InvalidClientAuth("client not found");
 	ctx.oidc.entity("Client", client);
-	if ((hasAttestation || hasAttestationPop) && !additionalSecuritySignal && ctx.oidc.params.client_id !== void 0 && ctx.oidc.client.clientAuthMethod !== "attest_jwt_client_auth") throw new InvalidRequest("client authentication must only be provided using one mechanism");
+	if ((hasAttestation || hasAttestationPop) && !additionalSecuritySignal && ctx.oidc.params.client_id !== void 0 && !["attest_jwt_client_auth", "attest_jwt_client_auth_dpop"].includes(ctx.oidc.client.clientAuthMethod)) throw new InvalidRequest("client authentication must only be provided using one mechanism");
 	if (methods?.includes(ctx.oidc.client.clientAuthMethod) !== true) throw new InvalidClientAuth("the provided authentication mechanism does not match the registered client authentication method");
 	switch (ctx.oidc.client.clientAuthMethod) {
 		case "none": break;
@@ -30130,9 +30186,10 @@ async function authenticateClient(ctx, next) {
 			if (![...ctx.oidc.client.asymmetricKeyStore].find(({ "x5t#S256": actual }) => actual === expected)) throw new InvalidClientAuth("unregistered client certificate provided");
 			break;
 		}
-		case "attest_jwt_client_auth": await attestationClientAuth(ctx);
+		case "attest_jwt_client_auth":
+		case "attest_jwt_client_auth_dpop": await attestationClientAuth(ctx);
 	}
-	if (ctx.oidc.client.clientAuthMethod !== "attest_jwt_client_auth" && (additionalSecuritySignal === "required" || additionalSecuritySignal === "optional" && (hasAttestation || hasAttestationPop))) await validateClientAttestationJwtAndPop(ctx, { signal: true });
+	if (!["attest_jwt_client_auth", "attest_jwt_client_auth_dpop"].includes(ctx.oidc.client.clientAuthMethod) && (additionalSecuritySignal === "required" || additionalSecuritySignal === "optional" && (hasAttestation || hasAttestationPop))) await validateClientAttestationJwtAndPop(ctx, { signal: true });
 	await next();
 }
 var client_auth_default = [
@@ -30141,10 +30198,10 @@ var client_auth_default = [
 	authenticateClient
 ];
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/is_json_object.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/is_json_object.js
 var is_json_object_default = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/request_parameters.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/request_parameters.js
 const requestParams = /* @__PURE__ */ new WeakMap();
 const nonFrontchannelRoutes = /* @__PURE__ */ new Set([
 	"device_authorization",
@@ -30252,7 +30309,7 @@ async function checkExtraParams(ctx, next) {
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/process_request_object.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/process_request_object.js
 async function processRequestObject(ctx, next) {
 	const PARAM_LIST = getAuthorizationParams(ctx);
 	const { params, client, route } = ctx.oidc;
@@ -30365,7 +30422,7 @@ function stripOutsideJarParams(ctx, next) {
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/interactions.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/interactions.js
 const errorMap$1 = { ...errors_exports };
 async function interactions(ctx, next) {
 	const { oidc } = ctx;
@@ -30460,7 +30517,7 @@ function interactionEmit(ctx, next) {
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/combined_scope.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/combined_scope.js
 var combined_scope_default = (grant, requestParamScopes, resourceServers) => {
 	const combinedScope = /* @__PURE__ */ new Set();
 	grant.getOIDCScopeFiltered(requestParamScopes).split(" ").filter(Boolean).forEach(Set.prototype.add.bind(combinedScope));
@@ -30468,7 +30525,7 @@ var combined_scope_default = (grant, requestParamScopes, resourceServers) => {
 	return combinedScope;
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/process_response_types.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/process_response_types.js
 async function tokenHandler(ctx) {
 	const { accountId } = ctx.oidc.session;
 	const token = new ctx.oidc.provider.AccessToken({
@@ -30579,7 +30636,7 @@ async function processResponseTypes(ctx) {
 	return response;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/respond.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/respond.js
 async function respond(ctx) {
 	let pushedAuthorizationRequest = ctx.oidc.entities.PushedAuthorizationRequest;
 	if (!pushedAuthorizationRequest && ctx.oidc.entities.Interaction?.parJti) pushedAuthorizationRequest = await ctx.oidc.provider.PushedAuthorizationRequest.find(ctx.oidc.entities.Interaction.parJti, { ignoreExpiration: true });
@@ -30594,7 +30651,7 @@ async function respond(ctx) {
 	await get$2(ctx.oidc.provider).responseModes.get(responseMode)(ctx, params.redirect_uri, omit_by_default(out, (value) => value === void 0));
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/resume.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/resume.js
 const errorMap = { ...errors_exports };
 async function resumeAction(ctx, next) {
 	const resumeRouteName = ctx.oidc.route === "device_resume" ? "device_resume" : "resume";
@@ -30654,7 +30711,7 @@ async function resumeAction(ctx, next) {
 	await next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/client.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/client.js
 function deviceAuthorizationResponse$1(ctx, next) {
 	if (!ctx.oidc.body.client_id) ctx.oidc.body.client_id = ctx.oidc.client.clientId;
 	return next();
@@ -30684,7 +30741,7 @@ function checkClientGrantType({ oidc: { route, client } }, next) {
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/pushed_authorization_requests.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/pushed_authorization_requests.js
 async function loadPushedAuthorizationRequest(ctx, next) {
 	const { pushedAuthorizationRequests } = get$2(ctx.oidc.provider).features;
 	const { params, provider: { PushedAuthorizationRequest } } = ctx.oidc;
@@ -30735,7 +30792,7 @@ async function pushedAuthorizationRequestResponse(ctx) {
 		dpopJkt,
 		trusted: ctx.oidc.client.clientAuthMethod !== "none" || !!ctx.oidc.trusted?.length
 	});
-	if (ctx.oidc.client.clientAuthMethod === "attest_jwt_client_auth") await requestObject.setAttestBinding(ctx);
+	if (["attest_jwt_client_auth", "attest_jwt_client_auth_dpop"].includes(ctx.oidc.client.clientAuthMethod)) await requestObject.setAttestBinding(ctx);
 	const id = await requestObject.save(ttl);
 	ctx.oidc.entity("PushedAuthorizationRequest", requestObject);
 	ctx.status = 201;
@@ -30750,7 +30807,7 @@ function rejectRequestAndUri(ctx, next) {
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/claims.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/claims.js
 async function checkClaims(ctx, next) {
 	const { params } = ctx.oidc;
 	if (params.claims !== void 0) {
@@ -30805,7 +30862,7 @@ async function checkIdTokenHint(ctx, next) {
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/ciba.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/ciba.js
 const CLIENT_NOTIFICATION_TOKEN = /^[A-Za-z0-9._~+\x2F-]+=*$/u;
 function cibaRequired(ctx, next) {
 	const required = /* @__PURE__ */ new Set(["scope"]);
@@ -30877,7 +30934,7 @@ async function backchannelRequestResponse(ctx) {
 		resource: Object.keys(ctx.oidc.resourceServers),
 		scope: [...ctx.oidc.requestParamScopes].join(" ")
 	});
-	if (ctx.oidc.client.clientAuthMethod === "attest_jwt_client_auth") await request.setAttestBinding(ctx);
+	if (["attest_jwt_client_auth", "attest_jwt_client_auth_dpop"].includes(ctx.oidc.client.clientAuthMethod)) await request.setAttestBinding(ctx);
 	switch (request.resource.length) {
 		case 0:
 			delete request.resource;
@@ -30902,13 +30959,13 @@ async function requestObjectRemapErrors(_ctx, next) {
 	});
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/is_valid_scope.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/is_valid_scope.js
 const SCOPE_SYNTAX = /^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$/u;
 function isValidScope(scope) {
 	return scope === void 0 || typeof scope === "string" && SCOPE_SYNTAX.test(scope);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/scopes.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/scopes.js
 async function checkScope(ctx, next) {
 	const PARAM_LIST = getAuthorizationParams(ctx);
 	const { scopes: statics } = get$2(ctx.oidc.provider).configuration;
@@ -30954,7 +31011,7 @@ function checkOpenIdScope(ctx, next) {
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/session.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/session.js
 async function loadAccount(ctx, next) {
 	const { accountId } = ctx.oidc.session;
 	if (accountId) {
@@ -30981,7 +31038,7 @@ async function loadGrant(ctx, next) {
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/sender_constraints.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/sender_constraints.js
 function checkPKCE(ctx, next) {
 	const { params } = ctx.oidc;
 	const { pkce } = get$2(ctx.oidc.provider).configuration;
@@ -31009,7 +31066,7 @@ async function checkDpopJkt(ctx, next) {
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/user_codes.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/user_codes.js
 const CHARSETS = {
 	"base-20": "BCDFGHJKLMNPQRSTVWXZ",
 	digits: "0123456789"
@@ -31034,7 +31091,7 @@ function normalize(input) {
 	return input.replace(/[a-z]/g, (char) => char.toUpperCase()).replace(/\W/g, () => "");
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/device.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/device.js
 async function deviceUserFlow(ctx, next) {
 	if (ctx.oidc.route === "device_resume") {
 		const code = await ctx.oidc.provider.DeviceCode.find(ctx.oidc.entities.Interaction.deviceCode, {
@@ -31110,7 +31167,7 @@ async function deviceAuthorizationResponse(ctx) {
 		params: ctx.oidc.params.toPlainObject(),
 		userCode: normalize(userCode)
 	});
-	if (ctx.oidc.client.clientAuthMethod === "attest_jwt_client_auth") await dc.setAttestBinding(ctx);
+	if (["attest_jwt_client_auth", "attest_jwt_client_auth_dpop"].includes(ctx.oidc.client.clientAuthMethod)) await dc.setAttestBinding(ctx);
 	ctx.oidc.entity("DeviceCode", dc);
 	ctx.body = {
 		device_code: await dc.save(),
@@ -31122,7 +31179,7 @@ async function deviceAuthorizationResponse(ctx) {
 	ctx.oidc.provider.emit("device_authorization.success", ctx, ctx.body);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/index.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/authorization/index.js
 const A = "authorization";
 const R = "resume";
 const DA = "device_authorization";
@@ -31213,7 +31270,7 @@ function authorizationAction(endpoint) {
 	return stack;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/oidc_context.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/oidc_context.js
 const COOKIES = Symbol();
 var NoAccessTokenProvided = class extends InvalidToken {
 	constructor() {
@@ -31377,7 +31434,7 @@ function getContext(provider) {
 	return OIDCContext;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/set_www_authenticate_header.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/set_www_authenticate_header.js
 function getSetWWWAuthenticateHeader({ tokenProperty = "accessToken", includeScope = true, dpop } = {}) {
 	return async function setWWWAuthenticateHeader(ctx, next) {
 		try {
@@ -31417,7 +31474,7 @@ function getSetWWWAuthenticateHeader({ tokenProperty = "accessToken", includeSco
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/access_token.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/access_token.js
 function getValidateAccessToken({ afterFind } = {}) {
 	return async function validateAccessToken(ctx, next) {
 		const value = ctx.oidc.getAccessToken({ acceptDPoP: true });
@@ -31459,7 +31516,7 @@ async function loadAccessTokenGrant(ctx, next) {
 	await next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/userinfo.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/userinfo.js
 const PARAM_LIST$1 = /* @__PURE__ */ new Set(["scope", "access_token"]);
 const validateAccessToken$1 = getValidateAccessToken({ afterFind(_ctx, accessToken) {
 	if (!accessToken.scopes.size || !accessToken.scopes.has("openid")) throw new InsufficientScope("access token missing openid scope", "openid");
@@ -31512,7 +31569,7 @@ var userinfo_default = [
 	}
 ];
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/token.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/token.js
 const grantTypeSet = /* @__PURE__ */ new Set(["grant_type"]);
 var token_default = [
 	noCache,
@@ -31570,14 +31627,14 @@ var token_default = [
 	}
 ];
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/jwks.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/jwks.js
 function renderJWKS(ctx) {
 	const { keys } = get$2(ctx.oidc.provider).jwks;
 	ctx.body = { keys };
 	ctx.type = "application/jwk-set+json; charset=utf-8";
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/fetch_body_check.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/fetch_body_check.js
 async function fetchBodyCheck(provider, purpose, response) {
 	const limit = get$2(provider).configuration.fetchResponseBodyLimits[purpose];
 	if (!Number.isFinite(limit)) return Buffer.from(await response.arrayBuffer());
@@ -31599,7 +31656,7 @@ async function fetchBodyCheck(provider, purpose, response) {
 	return Buffer.concat(chunks);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/fetch_request.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/fetch_request.js
 const SPECIAL_USE_IPV4 = [
 	{
 		prefix: 0,
@@ -31808,7 +31865,7 @@ async function fetchRequest(provider, url, options) {
 	return get$2(provider).configuration.fetch(url, options);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/sector_validate.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/sector_validate.js
 async function sectorValidate(provider, client) {
 	if (!boolean(get$2(provider).configuration.sectorIdentifierUriValidate(client), "sectorIdentifierUriValidate")) return;
 	const response = await fetchRequest(provider, new URL(client.sectorIdentifierUri).href, {
@@ -31843,7 +31900,7 @@ async function sectorValidate(provider, client) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/add_client.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/add_client.js
 async function add(provider, metadata, { ctx, store, cimd } = {}) {
 	const client = new provider.Client(metadata, ctx, { cimd });
 	if (client.sectorIdentifierUri !== void 0) await sectorValidate(provider, client);
@@ -31851,7 +31908,7 @@ async function add(provider, metadata, { ctx, store, cimd } = {}) {
 	return client;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/validate_json_body.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/validate_json_body.js
 function getValidateJsonBody(ErrorClass, errorDescription) {
 	return async function validateJsonBody(ctx, next) {
 		if (ctx.oidc.body === null || typeof ctx.oidc.body !== "object" || Array.isArray(ctx.oidc.body)) throw new ErrorClass(errorDescription);
@@ -31859,7 +31916,7 @@ function getValidateJsonBody(ErrorClass, errorDescription) {
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/registration.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/registration.js
 const setWWWAuthenticate = getSetWWWAuthenticateHeader({ dpop: false });
 const validateRegistrationBody = getValidateJsonBody(InvalidRequest, "client registration request must be a JSON object");
 const validateClientUpdateBody = getValidateJsonBody(InvalidRequest, "client update request must be a JSON object");
@@ -32037,7 +32094,7 @@ const del = [
 	}
 ];
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/token_find.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/token_find.js
 function getClientCredentials(provider, token) {
 	if (!get$2(provider).grantTypeHandlers.has("client_credentials")) return;
 	return provider.ClientCredentials.find(token);
@@ -32063,7 +32120,7 @@ async function findToken(provider, tokenValue, tokenTypeHint) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/reject_structured_tokens.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/shared/reject_structured_tokens.js
 async function rejectStructuredTokens(ctx, next) {
 	const { params } = ctx.oidc;
 	let tokenIsJWT;
@@ -32074,7 +32131,7 @@ async function rejectStructuredTokens(ctx, next) {
 	return next();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/revocation.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/revocation.js
 const revokeable = /* @__PURE__ */ new Set([
 	"AccessToken",
 	"ClientCredentials",
@@ -32108,7 +32165,7 @@ var revocation_default = [
 		if (!token) return;
 		if (revokeable.has(token.kind)) ctx.oidc.entity(token.kind, token);
 		else return;
-		if (token.kind === "RefreshToken" && ctx.oidc.client.clientId === token.clientId && ctx.oidc.client.clientAuthMethod === "attest_jwt_client_auth") try {
+		if (token.kind === "RefreshToken" && ctx.oidc.client.clientId === token.clientId && ["attest_jwt_client_auth", "attest_jwt_client_auth_dpop"].includes(ctx.oidc.client.clientAuthMethod)) try {
 			await checkAttestBinding(ctx, token);
 		} catch {
 			return;
@@ -32119,7 +32176,7 @@ var revocation_default = [
 	}
 ];
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/introspection.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/introspection.js
 const introspectable = /* @__PURE__ */ new Set([
 	"AccessToken",
 	"ClientCredentials",
@@ -32179,7 +32236,7 @@ var introspection_default = [
 		}
 		if (introspectable.has(token.kind)) ctx.oidc.entity(token.kind, token);
 		else return;
-		if (token.kind === "RefreshToken" && ctx.oidc.client.clientId === token.clientId && ctx.oidc.client.clientAuthMethod === "attest_jwt_client_auth") try {
+		if (token.kind === "RefreshToken" && ctx.oidc.client.clientId === token.clientId && ["attest_jwt_client_auth", "attest_jwt_client_auth_dpop"].includes(ctx.oidc.client.clientAuthMethod)) try {
 			await checkAttestBinding(ctx, token);
 		} catch {
 			return;
@@ -32212,7 +32269,7 @@ var introspection_default = [
 	}
 ];
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/defaults.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/defaults.js
 function defaults(deep, target, ...sources) {
 	for (const source of sources) {
 		if (!is_plain_object_default(source)) continue;
@@ -32227,7 +32284,7 @@ function defaults(deep, target, ...sources) {
 var defaults_default = defaults.bind(void 0, false);
 const deep = defaults.bind(void 0, true);
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/discovery.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/discovery.js
 function discovery(ctx) {
 	const { configuration, features } = get$2(ctx.oidc.provider);
 	ctx.body = {
@@ -32321,21 +32378,23 @@ function discovery(ctx) {
 	}
 	if (richAuthorizationRequests.enabled) ctx.body.authorization_details_types_supported = Object.keys(richAuthorizationRequests.types);
 	if (features.attestClientAuth.enabled) {
+		const popMethods = ["attestation_pop_jwt"];
+		if (features.dPoP.enabled) popMethods.push("dpop_combined");
 		ctx.body.challenge_endpoint = ctx.oidc.urlFor("challenge");
 		ctx.body.client_attestation_signing_alg_values_supported = configuration.attestSigningAlgValues;
 		ctx.body.client_attestation_pop_signing_alg_values_supported = configuration.attestSigningAlgValues;
 		switch (features.attestClientAuth.additionalSecuritySignal) {
 			case "optional":
-				ctx.body.client_attestation_pop_methods_supported = ["attestation_pop_jwt", "none"];
+				ctx.body.client_attestation_pop_methods_supported = [...popMethods, "none"];
 				break;
-			case "required": ctx.body.client_attestation_pop_methods_supported = ["attestation_pop_jwt"];
+			case "required": ctx.body.client_attestation_pop_methods_supported = popMethods;
 		}
 	}
 	if (features.clientIdMetadataDocument.enabled) ctx.body.client_id_metadata_document_supported = true;
 	defaults_default(ctx.body, configuration.discovery);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/challenge.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/challenge.js
 var challenge_default = [noCache, function challenge(ctx) {
 	const { DPoPNonces, AttestChallenges, CNonceChallenges } = get$2(ctx.oidc.provider);
 	ctx.body = {};
@@ -32350,7 +32409,7 @@ var challenge_default = [noCache, function challenge(ctx) {
 	}
 }];
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/end_session.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/end_session.js
 async function clientForLogout(ctx, clientId) {
 	try {
 		return await ctx.oidc.provider.Client.find(clientId);
@@ -32489,7 +32548,7 @@ const success = [
 	}
 ];
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/code_verification.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/code_verification.js
 const get = [
 	sessionHandler,
 	assembleParams.bind(void 0, /* @__PURE__ */ new Set(["user_code"])),
@@ -32551,7 +32610,7 @@ const post = [
 	}
 ];
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/openid_credential_issuer.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/openid_credential_issuer.js
 function openidCredentialIssuer(ctx) {
 	const { openid4vci } = get$2(ctx.oidc.provider).configuration.features;
 	const { credentialConfigurationsSupported } = openid4vci;
@@ -32564,7 +32623,7 @@ function openidCredentialIssuer(ctx) {
 	defaults_default(ctx.body, openid4vci.metadata);
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/credential.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/actions/credential.js
 const PARAM_LIST = /* @__PURE__ */ new Set([
 	"credential_identifier",
 	"credential_configuration_id",
@@ -32888,10 +32947,10 @@ var credential_default = [
 	}
 ];
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/als.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/als.js
 var als_default = new AsyncLocalStorage();
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/sender_constraints.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/sender_constraints.js
 function checkMtlsCert(provider, ctx, ErrorClass = InvalidGrant$1) {
 	assertProviderContext(provider, ctx);
 	if (ctx.oidc.client.tlsClientCertificateBoundAccessTokens) {
@@ -32905,7 +32964,7 @@ function checkDpopRequired(provider, ctx, dPoP, ErrorClass = InvalidGrant$1) {
 	if (!dPoP && ctx.oidc.client.dpopBoundAccessTokens) throw new ErrorClass("DPoP proof JWT not provided");
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/grant_authorization.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/grant_authorization.js
 function validateClientScope(provider, ctx, scopes = ctx.oidc.requestParamScopes) {
 	assertProviderContext(provider, ctx);
 	if (typeof scopes === "string") scopes = new Set(scopes.split(" "));
@@ -32946,7 +33005,7 @@ async function applyAuthorizationDetails(provider, ctx, token, source) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/grant_response.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/grant_response.js
 const reserved = /* @__PURE__ */ new Set([
 	"access_token",
 	"authorization_details",
@@ -32976,7 +33035,7 @@ function buildTokenResponse(provider, { accessToken, authorizationDetails, expir
 	}).filter(([, value]) => value !== void 0));
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/grants.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/grants.js
 var grants_exports = /* @__PURE__ */ __exportAll({
 	applyAuthorizationDetails: () => applyAuthorizationDetails,
 	applyRefreshTokenBindings: () => applyRefreshTokenBindings,
@@ -32995,13 +33054,13 @@ var grants_exports = /* @__PURE__ */ __exportAll({
 	validateGrant: () => validateGrant
 });
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/initialize_app.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/initialize_app.js
 const maxAge = 3600;
 function exposeHeaders({ dpop = true, attest = true, wwwAuth = true } = {}) {
 	return (ctx) => {
 		const { features } = get$2(ctx.oidc.provider);
 		return [
-			dpop && features.dPoP.enabled && features.dPoP.nonceSecret ? "DPoP-Nonce" : void 0,
+			(dpop || features.attestClientAuth.enabled) && features.dPoP.enabled && features.dPoP.nonceSecret ? "DPoP-Nonce" : void 0,
 			attest && features.attestClientAuth.enabled ? "OAuth-Client-Attestation-Challenge" : void 0,
 			wwwAuth ? "WWW-Authenticate" : void 0
 		].filter(Boolean);
@@ -33205,7 +33264,7 @@ function initializeApp() {
 	return router.routes();
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/initialize_clients.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/initialize_clients.js
 function initializeClients(clients = []) {
 	let staticClients;
 	for (const metadata of clients) {
@@ -33217,7 +33276,7 @@ function initializeClients(clients = []) {
 	if (staticClients) get$2(this).staticClients = staticClients;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/resource_server.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/resource_server.js
 var ResourceServer = class {
 	constructor(identifier, data) {
 		this._identifier = identifier;
@@ -33235,7 +33294,7 @@ var ResourceServer = class {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/valid_url.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/valid_url.js
 function isHttpsUri(uri) {
 	return URL.parse(uri)?.protocol === "https:";
 }
@@ -33244,7 +33303,7 @@ function isWebUri(uri) {
 	return protocol === "https:" || protocol === "http:";
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/claims.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/claims.js
 function getClaims(provider) {
 	const { claims: claimConfig, claimsSupported, pairwiseIdentifier } = get$2(provider).configuration;
 	return class Claims {
@@ -33291,7 +33350,7 @@ function getClaims(provider) {
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/payload.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/payload.js
 const cache$1 = /* @__PURE__ */ new WeakMap();
 function properties(Model) {
 	let result = cache$1.get(Model);
@@ -33315,7 +33374,7 @@ function pick(Model, input) {
 	return result;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/formats/opaque.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/formats/opaque.js
 const withExtra = /* @__PURE__ */ new Set(["AccessToken", "ClientCredentials"]);
 const bitsPerSymbol = Math.log2(64);
 const tokenLength = (i) => Math.ceil(i / bitsPerSymbol);
@@ -33360,7 +33419,7 @@ async function verify(provider, stored, { ignoreExpiration } = {}) {
 	return stored;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/formats/jwt.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/formats/jwt.js
 async function getResourceServerConfig(provider, token) {
 	const { keystore, configuration } = get$2(provider);
 	const { clientDefaults: { id_token_signed_response_alg: defaultAlg } } = configuration;
@@ -33491,7 +33550,7 @@ async function getValueAndPayload$1(provider, token) {
 	throw new Error("invalid Resource Server jwt configuration");
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/formats/index.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/formats/index.js
 function generateTokenId(provider, token) {
 	const format = token.resourceServer?.accessTokenFormat ?? "opaque";
 	if (format !== "opaque" && format !== "jwt") throw new Error("invalid format resolved");
@@ -33506,7 +33565,7 @@ async function getValueAndPayload(provider, token) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/token_helpers.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/token_helpers.js
 async function checkSessionBinding(provider, token, options) {
 	const ignoreSessionBinding = options && options.ignoreSessionBinding === true;
 	if (!token?.expiresWithSession || ignoreSessionBinding) return token;
@@ -33548,7 +33607,7 @@ function setAudience(token, audience) {
 	token.aud = audience;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/access_token.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/access_token.js
 var access_token_default = (provider) => class AccessToken extends provider.BaseToken {
 	static get IN_PAYLOAD() {
 		return [
@@ -33595,7 +33654,7 @@ var access_token_default = (provider) => class AccessToken extends provider.Base
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/authorization_code.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/authorization_code.js
 var authorization_code_default = (provider) => class AuthorizationCode extends provider.BaseToken {
 	static get IN_PAYLOAD() {
 		return [
@@ -33639,10 +33698,10 @@ var authorization_code_default = (provider) => class AuthorizationCode extends p
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/snake_case.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/snake_case.js
 var snake_case_default = (str = "") => str.replace(/([A-Z][a-z])/g, (x) => `_${x}`.toLowerCase()).replace(/^_+/, "");
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/base_model.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/base_model.js
 const IN_PAYLOAD = [
 	"iat",
 	"exp",
@@ -33744,7 +33803,7 @@ function getBaseModel(provider) {
 	return BaseModel;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/base_token.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/base_token.js
 function getBaseToken(provider) {
 	class BaseToken extends get$2(provider).BaseModel {
 		#client;
@@ -33795,7 +33854,7 @@ function getBaseToken(provider) {
 	return BaseToken;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/map_keys.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/_/map_keys.js
 var map_keys_default = (object, iteratee) => {
 	const result = {};
 	Object.entries(object).forEach(([key, value]) => {
@@ -33804,7 +33863,7 @@ var map_keys_default = (object, iteratee) => {
 	return result;
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/sector_identifier.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/sector_identifier.js
 var sector_identifier_default = (client) => {
 	if (client.subjectType === "pairwise") {
 		if (!client.sectorIdentifierUri) switch (true) {
@@ -33817,7 +33876,7 @@ var sector_identifier_default = (client) => {
 	return client.sectorIdentifierUri ? new URL(client.sectorIdentifierUri).host : void 0;
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/client_schema.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/client_schema.js
 const W3CEmailRegExp = /^[a-zA-Z0-9.!#$%&’*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$/;
 const FORBIDDEN_SCHEMES = /* @__PURE__ */ new Set([
 	"javascript:",
@@ -34202,7 +34261,7 @@ function getSchema(provider) {
 	return Schema;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/client_id_metadata_document.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/helpers/client_id_metadata_document.js
 const FORBIDDEN_AUTH_METHODS = /* @__PURE__ */ new Set([
 	"client_secret_basic",
 	"client_secret_post",
@@ -34345,7 +34404,7 @@ async function resolveClientByMetadataDocument(provider, id) {
 	return client;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/client.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/client.js
 const CLIENT_JWK_REQUIREMENTS = /* @__PURE__ */ new Map([
 	["EC", {
 		required: ["x", "y"],
@@ -34418,7 +34477,8 @@ const nonSecretAuthMethods = /* @__PURE__ */ new Set([
 	"none",
 	"tls_client_auth",
 	"self_signed_tls_client_auth",
-	"attest_jwt_client_auth"
+	"attest_jwt_client_auth",
+	"attest_jwt_client_auth_dpop"
 ]);
 const clientEncryptions = [
 	"id_token_encrypted_response_alg",
@@ -34779,7 +34839,7 @@ function getClient(provider) {
 	return Client;
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/client_credentials.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/client_credentials.js
 var client_credentials_default = (provider) => class ClientCredentials extends provider.BaseToken {
 	static get IN_PAYLOAD() {
 		return [
@@ -34812,7 +34872,7 @@ var client_credentials_default = (provider) => class ClientCredentials extends p
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/device_code.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/device_code.js
 var device_code_default = (provider) => class DeviceCode extends provider.BaseToken {
 	static async findByUserCode(userCode, { ignoreExpiration = false } = {}) {
 		const stored = await this.adapter.findByUserCode(userCode);
@@ -34869,7 +34929,7 @@ var device_code_default = (provider) => class DeviceCode extends provider.BaseTo
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/backchannel_authentication_request.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/backchannel_authentication_request.js
 var backchannel_authentication_request_default = (provider) => class BackchannelAuthenticationRequest extends provider.BaseToken {
 	static get IN_PAYLOAD() {
 		return [
@@ -34912,7 +34972,7 @@ var backchannel_authentication_request_default = (provider) => class Backchannel
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/id_token.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/id_token.js
 const hashes = [
 	"at_hash",
 	"c_hash",
@@ -35143,7 +35203,7 @@ function getIdToken(provider) {
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/initial_access_token.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/initial_access_token.js
 var initial_access_token_default = (provider) => class InitialAccessToken extends provider.BaseToken {
 	static get IN_PAYLOAD() {
 		return [...super.IN_PAYLOAD, "policies"].filter((v) => v !== "clientId");
@@ -35159,7 +35219,7 @@ var initial_access_token_default = (provider) => class InitialAccessToken extend
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/interaction.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/interaction.js
 var interaction_default = (provider) => class Interaction extends get$2(provider).BaseModel {
 	constructor(jti, payload) {
 		if (payload !== void 0) {
@@ -35215,7 +35275,7 @@ var interaction_default = (provider) => class Interaction extends get$2(provider
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/pushed_authorization_request.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/pushed_authorization_request.js
 var pushed_authorization_request_default = (provider) => class PushedAuthorizationRequest extends get$2(provider).BaseModel {
 	static get IN_PAYLOAD() {
 		return [
@@ -35239,7 +35299,7 @@ var pushed_authorization_request_default = (provider) => class PushedAuthorizati
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/pre_authorized_code.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/pre_authorized_code.js
 var pre_authorized_code_default = (provider) => class PreAuthorizedCode extends provider.BaseToken {
 	static get IN_PAYLOAD() {
 		return [
@@ -35266,7 +35326,7 @@ var pre_authorized_code_default = (provider) => class PreAuthorizedCode extends
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/refresh_token.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/refresh_token.js
 var refresh_token_default = (provider) => class RefreshToken extends provider.BaseToken {
 	constructor(...args) {
 		super(...args);
@@ -35327,7 +35387,7 @@ var refresh_token_default = (provider) => class RefreshToken extends provider.Ba
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/registration_access_token.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/registration_access_token.js
 var registration_access_token_default = (provider) => class RegistrationAccessToken extends provider.BaseToken {
 	static get IN_PAYLOAD() {
 		return [...super.IN_PAYLOAD, "policies"];
@@ -35343,7 +35403,7 @@ var registration_access_token_default = (provider) => class RegistrationAccessTo
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/replay_detection.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/replay_detection.js
 var replay_detection_default = (provider) => class ReplayDetection extends get$2(provider).BaseModel {
 	static get IN_PAYLOAD() {
 		return [...super.IN_PAYLOAD, "iss"];
@@ -35359,7 +35419,7 @@ var replay_detection_default = (provider) => class ReplayDetection extends get$2
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/session.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/session.js
 var session_default = (provider) => class Session extends get$2(provider).BaseModel {
 	constructor(payload) {
 		super(payload);
@@ -35473,7 +35533,7 @@ var session_default = (provider) => class Session extends get$2(provider).BaseMo
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/models/grant.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/models/grant.js
 var grant_default = (provider) => class Grant extends provider.BaseToken {
 	static get IN_PAYLOAD() {
 		return [
@@ -35622,7 +35682,7 @@ var grant_default = (provider) => class Grant extends provider.BaseToken {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/provider.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/provider.js
 const featuresDescriptor = {
 	enumerable: true,
 	configurable: true,
@@ -35903,7 +35963,7 @@ Object.defineProperty(Provider.prototype, "app", { get: util.deprecate(function
 	return this;
 }, ".app getter is deprecated. The Provider instance is now the Koa app itself") });
 //#endregion
-//#region node_modules/.pnpm/oidc-provider@9.12.2_supports-color@7.2.0/node_modules/oidc-provider/lib/index.js
+//#region node_modules/.pnpm/oidc-provider@9.13.0_supports-color@7.2.0/node_modules/oidc-provider/lib/index.js
 const deno = typeof Deno !== "undefined";
 const bun = typeof Bun !== "undefined";
 const workerd = typeof navigator !== "undefined" && navigator.userAgent === "Cloudflare-Workers";