npm - @gjermundgaraba/clankerauth-dev - Versions diffs - 0.26.1 → 0.26.2 - Mend

@gjermundgaraba/clankerauth-dev 0.26.1 → 0.26.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/{dist-DtwxKWrg.mjs → dist-BtO0lgmD.mjs} +1 -1
package/dist/index.mjs +1 -1
package/dist/kysely-adapter-BxenTacV.mjs +1 -0
package/dist/{src-YGjwkLyI.mjs → src-mhYy55vF.mjs} +4 -4
package/package.json +3 -3
package/dist/kysely-adapter-DUSfYWk8.mjs +0 -1

package/dist/{src-YGjwkLyI.mjs → src-mhYy55vF.mjs} RENAMED Viewed

@@ -1,4 +1,4 @@
-import{t as e}from"./esm-CdWTLqG7.mjs";import{c as t,r as n,s as r}from"./sqlite-introspector-DSCAP82F-CISODKY3.mjs";import{c as i,i as a,n as o,o as s,r as c,s as l,t as u}from"./dist-DtwxKWrg.mjs";import{t as d}from"./compiled-query-C8AL3JwF.mjs";import{A as f,B as p,C as m,D as h,E as g,F as _,G as v,H as y,I as b,K as x,L as S,N as ee,P as C,R as te,S as ne,T as w,U as T,V as re,W as ie,_ as ae,a as oe,b as se,c as ce,d as le,f as ue,g as de,h as fe,i as pe,j as me,k as he,l as ge,m as _e,o as ve,p as ye,q as be,t as xe,u as Se,v as eee,w as tee,x as Ce,y as we,z as Te}from"./get-id-field-CHlYHt3y.mjs";import{A as nee,C as Ee,D as De,E as Oe,F as ke,I as Ae,L as je,M as E,N as D,O as ree,P as O,S as k,T as iee,_ as Me,a as aee,b as Ne,c as Pe,d as Fe,f as Ie,g as Le,h as Re,i as ze,j as Be,k as Ve,l as He,m as Ue,n as oee,o as We,p as see,r as Ge,s as Ke,t as cee,u as qe,v as A,w as Je,x as Ye,y as Xe}from"./schemas-CYWNDEcx.mjs";import{a as Ze,c as lee,l as uee,o as dee,r as fee,s as pee}from"./schema-check-6AE7KkNs.mjs";import{n as mee,r as Qe}from"./factory-tEOeUNZI.mjs";import{n as $e}from"./access-CoaNEa0I.mjs";import*as et from"node:crypto";import{randomBytes as tt,scrypt as nt}from"node:crypto";import*as rt from"node:path";import it,{dirname as at,join as ot,resolve as st}from"node:path";import*as ct from"node:url";import{fileURLToPath as lt}from"node:url";import ut,*as dt from"node:os";import*as ft from"node:child_process";import{Duplex as hee,PassThrough as pt,Readable as mt,pipeline as gee}from"node:stream";import{IncomingMessage as ht,createServer as gt}from"node:http";import{isIP as _t}from"node:net";import*as vt from"node:fs";import yt,{mkdirSync as bt}from"node:fs";import{request as xt}from"node:https";import*as St from"node:stream/promises";import{pipeline as Ct}from"node:stream/promises";import*as wt from"node:zlib";import*as Tt from"node:readline";import{DatabaseSync as Et}from"node:sqlite";import Dt from"node:fs/promises";import{lookup as _ee}from"node:dns/promises";const Ot=(e,t)=>{switch(t.length){case 0:return e;case 1:return t[0](e);case 2:return t[1](t[0](e));case 3:return t[2](t[1](t[0](e)));case 4:return t[3](t[2](t[1](t[0](e))));case 5:return t[4](t[3](t[2](t[1](t[0](e)))));case 6:return t[5](t[4](t[3](t[2](t[1](t[0](e))))));case 7:return t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))));case 8:return t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e))))))));case 9:return t[8](t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))))));default:{let n=e;for(let e=0,r=t.length;e<r;e++)n=t[e](n);return n}}},kt={pipe(){return Ot(this,arguments)}},At=/*#__PURE__*/ function(){function e(){}return e.prototype=kt,e}(),j=function(e,t){if(typeof e==`function`)return function(){return e(arguments)?t.apply(this,arguments):e=>t(e,...arguments)};switch(e){case 0:case 1:throw RangeError(`Invalid arity ${e}`);case 2:return function(e,n){return arguments.length>=2?t(e,n):function(n){return t(n,e)}};case 3:return function(e,n,r){return arguments.length>=3?t(e,n,r):function(r){return t(r,e,n)}};default:return function(){if(arguments.length>=e)return t.apply(this,arguments);let n=arguments;return function(e){return t(e,...n)}}}},M=e=>e,jt=e=>()=>e,Mt=/*#__PURE__*/ jt(!0),Nt=/*#__PURE__*/ jt(!1),Pt=/*#__PURE__*/ jt(void 0),Ft=Pt;function It(e,...t){return Ot(e,t)}function vee(e,t,n,r,i,a,o,s,c){switch(arguments.length){case 1:return e;case 2:return function(){return t(e.apply(this,arguments))};case 3:return function(){return n(t(e.apply(this,arguments)))};case 4:return function(){return r(n(t(e.apply(this,arguments))))};case 5:return function(){return i(r(n(t(e.apply(this,arguments)))))};case 6:return function(){return a(i(r(n(t(e.apply(this,arguments))))))};case 7:return function(){return o(a(i(r(n(t(e.apply(this,arguments)))))))};case 8:return function(){return s(o(a(i(r(n(t(e.apply(this,arguments))))))))};case 9:return function(){return c(s(o(a(i(r(n(t(e.apply(this,arguments)))))))))}}}function Lt(e){let t=/* @__PURE__ */ new WeakMap;return n=>{let r=t.get(n);if(r!==void 0)return r;let i=e(n);return t.set(n,i),i}}function Rt(e){let t=/* @__PURE__ */ new WeakMap;return n=>{let r=t.get(n);if(r!==void 0)return r;let i=e(n);return t.set(n,i),i!==n&&t.set(i,i),i}}const zt=e=>{let t=new Set(Reflect.ownKeys(e));if(e.constructor===Object)return t;e instanceof Error&&t.delete(`stack`);let n=Object.getPrototypeOf(e),r=n;for(;r!==null&&r!==Object.prototype;){let e=Reflect.ownKeys(r);for(let n=0;n<e.length;n++)t.add(e[n]);r=Object.getPrototypeOf(r)}return t.has(`constructor`)&&typeof e.constructor==`function`&&n===e.constructor.prototype&&t.delete(`constructor`),t},Bt=/*#__PURE__*/ new WeakSet,Vt=e=>new Uint8Array(e.buffer,e.byteOffset,e.byteLength);let Ht=0;const yee=()=>{Ht++};function Ut(e){return typeof e==`string`}function Wt(e){return typeof e==`number`}function Gt(e){return typeof e==`boolean`}function Kt(e){return typeof e==`symbol`}function qt(e){return Ut(e)||Wt(e)||Kt(e)}function Jt(e){return typeof e==`function`}function Yt(e){return e===void 0}function Xt(e){return e!==void 0}function Zt(e){return e!==null}function Qt(e){return e==null}function $t(e){return e!=null}function en(e){return!1}function tn(e){return!0}function nn(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function rn(e){return nn(e)}function an(e){return typeof e==`object`&&!!e||Jt(e)}const N=/*#__PURE__*/ j(2,(e,t)=>an(e)&&t in e),on=/*#__PURE__*/ j(2,(e,t)=>N(e,`_tag`)&&e._tag===t);function sn(e){return e instanceof Error}function cn(e){return N(e,Symbol.iterator)||Ut(e)}const ln=`~effect/Hash`,un=e=>{switch(typeof e){case`number`:return gn(e);case`bigint`:return _n(e.toString(10));case`string`:return _n(e);case`function`:case`object`:if(e===null)break;if(e instanceof Date)return Number.isNaN(e.getTime())?_n(`Invalid Date`):_n(e.toISOString());if(e instanceof RegExp)return _n(e.toString());{if(Bt.has(e))return dn(e);let t=wn.get(e);if(t!==void 0)return t;if(Tn.has(e))return yee(),_n(`[Circular]`);Tn.add(e);let n=Ht,r;try{r=`~effect/Hash`in e?e[ln]():typeof e==`function`?dn(e):e instanceof DataView?bn(Vt(e)):Array.isArray(e)||ArrayBuffer.isView(e)?bn(e):e instanceof Map?xee(e):e instanceof Set?Sn(e):vn(e)}finally{Tn.delete(e)}return n===Ht&&wn.set(e,r),r}}return mn(fn(_n(String(e))))},dn=e=>(Cn.has(e)||Cn.set(e,mn(Math.random()*4294967296|0)),Cn.get(e)),fn=e=>(e^=e>>>16,e=Math.imul(e,2246822507),e^=e>>>13,e=Math.imul(e,3266489909),e^e>>>16),pn=/*#__PURE__*/ j(2,(e,t)=>fn(Math.imul(e,2654435761)+Math.imul(t,2246822507))),mn=e=>e&3221225471|e>>>1&1073741824,hn=/*#__PURE__*/ new DataView(/*#__PURE__*/ new ArrayBuffer(8)),gn=e=>{let t=e|0;return t===e?mn(t):(hn.setFloat64(0,e===e?e:NaN),mn(pn(hn.getInt32(0),hn.getInt32(4))))},_n=e=>{let t=5381,n=e.length;for(;n;)t=t*33^e.charCodeAt(--n);return mn(t)},bee=(e,t)=>{let n=12289;for(let r of t)n^=pn(un(r),un(e[r]));return mn(n)},vn=e=>bee(e,zt(e)),yn=(e,t)=>n=>{let r=e;for(let e of n)r^=t(e);return mn(r)},bn=e=>{let t=6151;for(let n of e)t=pn(t,un(n));return mn(t)},xee=/*#__PURE__*/ yn(/*#__PURE__*/ _n(`Map`),([e,t])=>pn(un(e),un(t))),xn=/*#__PURE__*/ _n(`Set`),Sn=/*#__PURE__*/ yn(xn,e=>pn(xn,un(e))),Cn=/*#__PURE__*/ new WeakMap,wn=/*#__PURE__*/ new WeakMap,Tn=/*#__PURE__*/ new WeakSet,En=`~effect/Equal`;function Dn(){return arguments.length===1?e=>On(e,arguments[0]):On(arguments[0],arguments[1])}function On(e,t){if(e===t)return!0;if(e==null||t==null)return!1;let n=typeof e;return n===typeof t?n===`number`&&e!==e&&t!==t?!0:n!==`object`&&n!==`function`||Bt.has(e)||Bt.has(t)?!1:See(e,t):!1}function See(e,t){let n=An.length;for(let r=n;r-->0;)if(An[r]===e&&jn[r]===t)return!0;if(n)return kn(e,t);let r=Mn.get(e);r||Mn.set(e,r=/* @__PURE__ */ new WeakMap);let i=r.get(t);return i===void 0&&r.set(t,i=kn(e,t)),i}function kn(e,t){An.push(e),jn.push(t);try{return Nn(e,t)}finally{An.pop(),jn.pop()}}const An=[],jn=[],Mn=/*#__PURE__*/ new WeakMap;function Nn(e,t){if(un(e)!==un(t))return!1;if(e instanceof Date){if(!(t instanceof Date))return!1;let n=e.getTime(),r=t.getTime();return n===r||Number.isNaN(n)&&Number.isNaN(r)}if(e instanceof RegExp)return t instanceof RegExp&&e.toString()===t.toString();let n=Rn(e);if(n!==Rn(t)||typeof e==`function`&&!n)return!1;if(n)return e[En](t);if(Array.isArray(e))return!Array.isArray(t)||e.length!==t.length?!1:Cee(e,t);if(ArrayBuffer.isView(e)){let n=e instanceof DataView;return!ArrayBuffer.isView(t)||e.byteLength!==t.byteLength||n!==t instanceof DataView?!1:n?Pn(Vt(e),Vt(t)):Pn(e,t)}return e instanceof Map?!(t instanceof Map)||e.size!==t.size?!1:Fn(e,t,In,Ln):e instanceof Set?!(t instanceof Set)||e.size!==t.size?!1:Fn(e,t,un,On):wee(e,t)}function Cee(e,t){for(let n=0;n<e.length;n++)if(!On(e[n],t[n]))return!1;return!0}function Pn(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n++)if(e[n]!==t[n])return!1;return!0}function wee(e,t){let n=zt(e),r=zt(t);if(n.size!==r.size)return!1;for(let i of n)if(!r.has(i)||!On(e[i],t[i]))return!1;return!0}function Fn(e,t,n,r){let i=/* @__PURE__ */ new Map,a=0;for(let e of t){let t=n(e),r=i.get(t);r?r.push(e):i.set(t,[e]),a++}outer:for(let t of e){let e=i.get(n(t));if(e){for(let n=0;n<e.length;n++)if(r(t,e[n])){e[n]=e[e.length-1],e.pop(),a--;continue outer}}return!1}return a===0}const In=e=>un(e[0]),Ln=(e,t)=>On(e[0],t[0])&&On(e[1],t[1]),Rn=e=>N(e,En),zn=()=>Dn,Bn=/*#__PURE__*/ Symbol.for(`~effect/Redactable`),Vn=e=>N(e,Bn);function Hn(e){return Vn(e)?Un(e):e}function Un(e){return e[Bn](globalThis[`~effect/Fiber/currentFiber`]?.context??Kn)}const Wn=`~effect/Fiber/currentFiber`,Gn=/*#__PURE__*/ new Map,Kn={"~effect/Context":{},base:Gn,depth:0,mapUnsafe:Gn,pipe(){return Ot(this,arguments)}};function qn(e,t){let n=t?.space??0,r=/* @__PURE__ */ new WeakSet,i=n?typeof n==`number`?` `.repeat(n):n:``,a=e=>i.repeat(e),o=(e,t)=>{let n=e?.constructor;return n&&n!==Object.prototype.constructor&&n.name?`${n.name}(${t})`:t},s=e=>{try{return Reflect.ownKeys(e)}catch{return[`[ownKeys threw]`]}};function c(e,t=0){try{return l(e,t)}catch{return(typeof e==`object`&&e||typeof e==`function`)&&r.delete(e),`[inspection threw]`}}function l(e,n=0){if(typeof e==`string`)return JSON.stringify(e);if(typeof e==`number`||e==null||typeof e==`boolean`||typeof e==`symbol`)return String(e);if(typeof e==`bigint`)return String(e)+`n`;if(typeof e==`object`||typeof e==`function`){if(r.has(e))return Jn;r.add(e);let l;if(Bn in e)l=c(Un(e),n);else if(Array.isArray(e))l=!i||e.length<=1?`[${e.map(e=>c(e,n)).join(`,`)}]`:`[\n${a(n+1)}${e.map(e=>c(e,n+1)).join(`,
+import{t as e}from"./esm-CdWTLqG7.mjs";import{c as t,r as n,s as r}from"./sqlite-introspector-DSCAP82F-CISODKY3.mjs";import{c as i,i as a,n as o,o as s,r as c,s as l,t as u}from"./dist-BtO0lgmD.mjs";import{t as d}from"./compiled-query-C8AL3JwF.mjs";import{A as f,B as p,C as m,D as h,E as g,F as _,G as v,H as y,I as b,K as x,L as S,N as ee,P as C,R as te,S as ne,T as w,U as T,V as re,W as ie,_ as ae,a as oe,b as se,c as ce,d as le,f as ue,g as de,h as fe,i as pe,j as me,k as he,l as ge,m as _e,o as ve,p as ye,q as be,t as xe,u as Se,v as eee,w as tee,x as Ce,y as we,z as Te}from"./get-id-field-CHlYHt3y.mjs";import{A as nee,C as Ee,D as De,E as Oe,F as ke,I as Ae,L as je,M as E,N as D,O as ree,P as O,S as k,T as iee,_ as Me,a as aee,b as Ne,c as Pe,d as Fe,f as Ie,g as Le,h as Re,i as ze,j as Be,k as Ve,l as He,m as Ue,n as oee,o as We,p as see,r as Ge,s as Ke,t as cee,u as qe,v as A,w as Je,x as Ye,y as Xe}from"./schemas-CYWNDEcx.mjs";import{a as Ze,c as lee,l as uee,o as dee,r as fee,s as pee}from"./schema-check-6AE7KkNs.mjs";import{n as mee,r as Qe}from"./factory-tEOeUNZI.mjs";import{n as $e}from"./access-CoaNEa0I.mjs";import*as et from"node:crypto";import{randomBytes as tt,scrypt as nt}from"node:crypto";import*as rt from"node:path";import it,{dirname as at,join as ot,resolve as st}from"node:path";import*as ct from"node:url";import{fileURLToPath as lt}from"node:url";import ut,*as dt from"node:os";import*as ft from"node:child_process";import{Duplex as hee,PassThrough as pt,Readable as mt,pipeline as gee}from"node:stream";import{IncomingMessage as ht,createServer as gt}from"node:http";import{isIP as _t}from"node:net";import*as vt from"node:fs";import yt,{mkdirSync as bt}from"node:fs";import{request as xt}from"node:https";import*as St from"node:stream/promises";import{pipeline as Ct}from"node:stream/promises";import*as wt from"node:zlib";import*as Tt from"node:readline";import{DatabaseSync as Et}from"node:sqlite";import Dt from"node:fs/promises";import{lookup as _ee}from"node:dns/promises";const Ot=(e,t)=>{switch(t.length){case 0:return e;case 1:return t[0](e);case 2:return t[1](t[0](e));case 3:return t[2](t[1](t[0](e)));case 4:return t[3](t[2](t[1](t[0](e))));case 5:return t[4](t[3](t[2](t[1](t[0](e)))));case 6:return t[5](t[4](t[3](t[2](t[1](t[0](e))))));case 7:return t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))));case 8:return t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e))))))));case 9:return t[8](t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))))));default:{let n=e;for(let e=0,r=t.length;e<r;e++)n=t[e](n);return n}}},kt={pipe(){return Ot(this,arguments)}},At=/*#__PURE__*/ function(){function e(){}return e.prototype=kt,e}(),j=function(e,t){if(typeof e==`function`)return function(){return e(arguments)?t.apply(this,arguments):e=>t(e,...arguments)};switch(e){case 0:case 1:throw RangeError(`Invalid arity ${e}`);case 2:return function(e,n){return arguments.length>=2?t(e,n):function(n){return t(n,e)}};case 3:return function(e,n,r){return arguments.length>=3?t(e,n,r):function(r){return t(r,e,n)}};default:return function(){if(arguments.length>=e)return t.apply(this,arguments);let n=arguments;return function(e){return t(e,...n)}}}},M=e=>e,jt=e=>()=>e,Mt=/*#__PURE__*/ jt(!0),Nt=/*#__PURE__*/ jt(!1),Pt=/*#__PURE__*/ jt(void 0),Ft=Pt;function It(e,...t){return Ot(e,t)}function vee(e,t,n,r,i,a,o,s,c){switch(arguments.length){case 1:return e;case 2:return function(){return t(e.apply(this,arguments))};case 3:return function(){return n(t(e.apply(this,arguments)))};case 4:return function(){return r(n(t(e.apply(this,arguments))))};case 5:return function(){return i(r(n(t(e.apply(this,arguments)))))};case 6:return function(){return a(i(r(n(t(e.apply(this,arguments))))))};case 7:return function(){return o(a(i(r(n(t(e.apply(this,arguments)))))))};case 8:return function(){return s(o(a(i(r(n(t(e.apply(this,arguments))))))))};case 9:return function(){return c(s(o(a(i(r(n(t(e.apply(this,arguments)))))))))}}}function Lt(e){let t=/* @__PURE__ */ new WeakMap;return n=>{let r=t.get(n);if(r!==void 0)return r;let i=e(n);return t.set(n,i),i}}function Rt(e){let t=/* @__PURE__ */ new WeakMap;return n=>{let r=t.get(n);if(r!==void 0)return r;let i=e(n);return t.set(n,i),i!==n&&t.set(i,i),i}}const zt=e=>{let t=new Set(Reflect.ownKeys(e));if(e.constructor===Object)return t;e instanceof Error&&t.delete(`stack`);let n=Object.getPrototypeOf(e),r=n;for(;r!==null&&r!==Object.prototype;){let e=Reflect.ownKeys(r);for(let n=0;n<e.length;n++)t.add(e[n]);r=Object.getPrototypeOf(r)}return t.has(`constructor`)&&typeof e.constructor==`function`&&n===e.constructor.prototype&&t.delete(`constructor`),t},Bt=/*#__PURE__*/ new WeakSet,Vt=e=>new Uint8Array(e.buffer,e.byteOffset,e.byteLength);let Ht=0;const yee=()=>{Ht++};function Ut(e){return typeof e==`string`}function Wt(e){return typeof e==`number`}function Gt(e){return typeof e==`boolean`}function Kt(e){return typeof e==`symbol`}function qt(e){return Ut(e)||Wt(e)||Kt(e)}function Jt(e){return typeof e==`function`}function Yt(e){return e===void 0}function Xt(e){return e!==void 0}function Zt(e){return e!==null}function Qt(e){return e==null}function $t(e){return e!=null}function en(e){return!1}function tn(e){return!0}function nn(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function rn(e){return nn(e)}function an(e){return typeof e==`object`&&!!e||Jt(e)}const N=/*#__PURE__*/ j(2,(e,t)=>an(e)&&t in e),on=/*#__PURE__*/ j(2,(e,t)=>N(e,`_tag`)&&e._tag===t);function sn(e){return e instanceof Error}function cn(e){return N(e,Symbol.iterator)||Ut(e)}const ln=`~effect/Hash`,un=e=>{switch(typeof e){case`number`:return gn(e);case`bigint`:return _n(e.toString(10));case`string`:return _n(e);case`function`:case`object`:if(e===null)break;if(e instanceof Date)return Number.isNaN(e.getTime())?_n(`Invalid Date`):_n(e.toISOString());if(e instanceof RegExp)return _n(e.toString());{if(Bt.has(e))return dn(e);let t=wn.get(e);if(t!==void 0)return t;if(Tn.has(e))return yee(),_n(`[Circular]`);Tn.add(e);let n=Ht,r;try{r=`~effect/Hash`in e?e[ln]():typeof e==`function`?dn(e):e instanceof DataView?bn(Vt(e)):Array.isArray(e)||ArrayBuffer.isView(e)?bn(e):e instanceof Map?xee(e):e instanceof Set?Sn(e):vn(e)}finally{Tn.delete(e)}return n===Ht&&wn.set(e,r),r}}return mn(fn(_n(String(e))))},dn=e=>(Cn.has(e)||Cn.set(e,mn(Math.random()*4294967296|0)),Cn.get(e)),fn=e=>(e^=e>>>16,e=Math.imul(e,2246822507),e^=e>>>13,e=Math.imul(e,3266489909),e^e>>>16),pn=/*#__PURE__*/ j(2,(e,t)=>fn(Math.imul(e,2654435761)+Math.imul(t,2246822507))),mn=e=>e&3221225471|e>>>1&1073741824,hn=/*#__PURE__*/ new DataView(/*#__PURE__*/ new ArrayBuffer(8)),gn=e=>{let t=e|0;return t===e?mn(t):(hn.setFloat64(0,e===e?e:NaN),mn(pn(hn.getInt32(0),hn.getInt32(4))))},_n=e=>{let t=5381,n=e.length;for(;n;)t=t*33^e.charCodeAt(--n);return mn(t)},bee=(e,t)=>{let n=12289;for(let r of t)n^=pn(un(r),un(e[r]));return mn(n)},vn=e=>bee(e,zt(e)),yn=(e,t)=>n=>{let r=e;for(let e of n)r^=t(e);return mn(r)},bn=e=>{let t=6151;for(let n of e)t=pn(t,un(n));return mn(t)},xee=/*#__PURE__*/ yn(/*#__PURE__*/ _n(`Map`),([e,t])=>pn(un(e),un(t))),xn=/*#__PURE__*/ _n(`Set`),Sn=/*#__PURE__*/ yn(xn,e=>pn(xn,un(e))),Cn=/*#__PURE__*/ new WeakMap,wn=/*#__PURE__*/ new WeakMap,Tn=/*#__PURE__*/ new WeakSet,En=`~effect/Equal`;function Dn(){return arguments.length===1?e=>On(e,arguments[0]):On(arguments[0],arguments[1])}function On(e,t){if(e===t)return!0;if(e==null||t==null)return!1;let n=typeof e;return n===typeof t?n===`number`&&e!==e&&t!==t?!0:n!==`object`&&n!==`function`||Bt.has(e)||Bt.has(t)?!1:See(e,t):!1}function See(e,t){let n=An.length;for(let r=n;r-->0;)if(An[r]===e&&jn[r]===t)return!0;if(n)return kn(e,t);let r=Mn.get(e);r||Mn.set(e,r=/* @__PURE__ */ new WeakMap);let i=r.get(t);return i===void 0&&r.set(t,i=kn(e,t)),i}function kn(e,t){An.push(e),jn.push(t);try{return Nn(e,t)}finally{An.pop(),jn.pop()}}const An=[],jn=[],Mn=/*#__PURE__*/ new WeakMap;function Nn(e,t){if(un(e)!==un(t))return!1;if(e instanceof Date){if(!(t instanceof Date))return!1;let n=e.getTime(),r=t.getTime();return n===r||Number.isNaN(n)&&Number.isNaN(r)}if(e instanceof RegExp)return t instanceof RegExp&&e.toString()===t.toString();let n=Rn(e);if(n!==Rn(t)||typeof e==`function`&&!n)return!1;if(n)return e[En](t);if(Array.isArray(e))return!Array.isArray(t)||e.length!==t.length?!1:Cee(e,t);if(ArrayBuffer.isView(e)){let n=e instanceof DataView;return!ArrayBuffer.isView(t)||e.byteLength!==t.byteLength||n!==t instanceof DataView?!1:n?Pn(Vt(e),Vt(t)):Pn(e,t)}return e instanceof Map?!(t instanceof Map)||e.size!==t.size?!1:Fn(e,t,In,Ln):e instanceof Set?!(t instanceof Set)||e.size!==t.size?!1:Fn(e,t,un,On):wee(e,t)}function Cee(e,t){for(let n=0;n<e.length;n++)if(!On(e[n],t[n]))return!1;return!0}function Pn(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n++)if(e[n]!==t[n])return!1;return!0}function wee(e,t){let n=zt(e),r=zt(t);if(n.size!==r.size)return!1;for(let i of n)if(!r.has(i)||!On(e[i],t[i]))return!1;return!0}function Fn(e,t,n,r){let i=/* @__PURE__ */ new Map,a=0;for(let e of t){let t=n(e),r=i.get(t);r?r.push(e):i.set(t,[e]),a++}outer:for(let t of e){let e=i.get(n(t));if(e){for(let n=0;n<e.length;n++)if(r(t,e[n])){e[n]=e[e.length-1],e.pop(),a--;continue outer}}return!1}return a===0}const In=e=>un(e[0]),Ln=(e,t)=>On(e[0],t[0])&&On(e[1],t[1]),Rn=e=>N(e,En),zn=()=>Dn,Bn=/*#__PURE__*/ Symbol.for(`~effect/Redactable`),Vn=e=>N(e,Bn);function Hn(e){return Vn(e)?Un(e):e}function Un(e){return e[Bn](globalThis[`~effect/Fiber/currentFiber`]?.context??Kn)}const Wn=`~effect/Fiber/currentFiber`,Gn=/*#__PURE__*/ new Map,Kn={"~effect/Context":{},base:Gn,depth:0,mapUnsafe:Gn,pipe(){return Ot(this,arguments)}};function qn(e,t){let n=t?.space??0,r=/* @__PURE__ */ new WeakSet,i=n?typeof n==`number`?` `.repeat(n):n:``,a=e=>i.repeat(e),o=(e,t)=>{let n=e?.constructor;return n&&n!==Object.prototype.constructor&&n.name?`${n.name}(${t})`:t},s=e=>{try{return Reflect.ownKeys(e)}catch{return[`[ownKeys threw]`]}};function c(e,t=0){try{return l(e,t)}catch{return(typeof e==`object`&&e||typeof e==`function`)&&r.delete(e),`[inspection threw]`}}function l(e,n=0){if(typeof e==`string`)return JSON.stringify(e);if(typeof e==`number`||e==null||typeof e==`boolean`||typeof e==`symbol`)return String(e);if(typeof e==`bigint`)return String(e)+`n`;if(typeof e==`object`||typeof e==`function`){if(r.has(e))return Jn;r.add(e);let l;if(Bn in e)l=c(Un(e),n);else if(Array.isArray(e))l=!i||e.length<=1?`[${e.map(e=>c(e,n)).join(`,`)}]`:`[\n${a(n+1)}${e.map(e=>c(e,n+1)).join(`,
 `+a(n+1))}\n${a(n)}]`;else if(e instanceof Date)l=Zn(e);else if(!t?.ignoreToString&&N(e,`toString`)&&typeof e.toString==`function`&&e.toString!==Object.prototype.toString&&e.toString!==Array.prototype.toString){let t=Qn(e);l=e instanceof Error&&e.cause!==void 0?`${t} (cause: ${c(e.cause,n)})`:t}else if(Symbol.iterator in e)l=`${e.constructor.name}(${c(Array.from(e),n)})`;else{let t=s(e);if(!i||t.length<=1){let r=`{${t.map(t=>`${Yn(t)}:${c($n(e,t),n)}`).join(`,`)}}`;l=o(e,r)}else{let r=`{\n${t.map(t=>`${a(n+1)}${Yn(t)}: ${c($n(e,t),n+1)}`).join(`,
 `)}\n${a(n)}}`;l=o(e,r)}}return r.delete(e),l}return String(e)}return c(e,0)}const Jn=`[Circular]`;function Yn(e){return typeof e==`string`?JSON.stringify(e):String(e)}function Xn(e){return e.map(e=>`[${Yn(e)}]`).join(``)}function Zn(e){try{return e.toISOString()}catch{return`Invalid Date`}}function Qn(e){try{let t=e.toString();return typeof t==`string`?t:String(t)}catch{return`[toString threw]`}}function $n(e,t){try{return e[t]}catch{return`[property access threw]`}}function er(e,t){let n=[];return JSON.stringify(e,function(e,t){let r=Object.getOwnPropertyDescriptor(this,e)?.value,i=N(r,Bn)?Hn(r):Hn(t);if(typeof i==`bigint`)return qn(i);if(typeof i!=`object`||!i)return i;let a=i instanceof Error&&!N(i,`toJSON`)?{...i,name:i.name,message:i.message}:i;for(;n.length>0&&n[n.length-1]!==this;)n.pop();if(n.includes(i))return;if(n.push(i),a!==i&&n.push(a),!tr(a)||nr(a))return a;let o=new Proxy(a,{get(e,t){let n=Reflect.get(e,t,e);return Object.getOwnPropertyDescriptor(e,t)?.get===void 0?n:Hn(n)}});return n.push(o),o},t?.space)??`null`}function tr(e){for(let t of Object.getOwnPropertyNames(e))if(Object.getOwnPropertyDescriptor(e,t)?.get!==void 0)return!0;return!1}function nr(e){for(let t of[Number.prototype.valueOf,Boolean.prototype.valueOf,String.prototype.valueOf])try{return Reflect.apply(t,e,[]),!0}catch{}return!1}const rr=/*#__PURE__*/ Symbol.for(`nodejs.util.inspect.custom`),ir=e=>{try{return e=Hn(e),N(e,`toJSON`)&&Jt(e.toJSON)&&e.toJSON.length===0?e.toJSON():Array.isArray(e)?e.map(ir):e}catch{return`[toJSON threw]`}},Tee=(e,t=2)=>{if(typeof e==`string`)return e;try{return typeof e==`object`?er(e,{space:t}):qn(e,{space:t})}catch{return String(e)}},ar={toJSON(){return ir(this)},[rr](){return this.toJSON()},toString(){return qn(this.toJSON())}};var or=class{[rr](){return this.toJSON()}toString(){return qn(this.toJSON())}};const Eee=/*#__PURE__*/ (()=>{let e=Object.getOwnPropertyDescriptor(Error,`stackTraceLimit`);return e===void 0?Object.isExtensible(Error):Object.hasOwn(e,`writable`)?e.writable===!0:e.set!==void 0})(),sr=()=>Error.stackTraceLimit,cr=e=>{Eee&&(Error.stackTraceLimit=e)};var lr=class{constructor(e){this.value=e,this.done=!1}next(e){return this.done?(this.value=e,this):(this.done=!0,{value:this.value,done:!1})}};const ur=/*#__PURE__*/ (()=>{let e=`~effect/Utils/internal`,t={[e]:e=>e()},n={[e]:e=>{try{return e()}finally{}}},r=sr();if(r===0)return n[e];cr(2);let i=t[e](()=>/* @__PURE__ */ Error());return cr(r),i.stack?.includes(e)===!0?t[e]:n[e]})();function dr(e,t,n){t===`__proto__`?Object.defineProperty(e,t,{value:n,writable:!0,enumerable:!0,configurable:!0}):e[t]=n}function fr(e,t){for(let n of Reflect.ownKeys(t))Object.prototype.propertyIsEnumerable.call(t,n)&&dr(e,n,t[n])}const pr=`~effect/Effect`,mr=`~effect/Exit`,Dee={_A:M,_E:M,_R:M},hr=`${pr}/identifier`,gr=`${pr}/args`,_r=`${pr}/evaluate`,vr=`${pr}/successCont`,yr=`${pr}/failureCont`,br=`${pr}/ensureCont`,xr=/*#__PURE__*/ Symbol.for(`effect/Effect/Yield`),Sr={pipe(){return Ot(this,arguments)},toJSON(){return{...this}},toString(){return qn(this.toJSON(),{ignoreToString:!0,space:2})},[rr](){return this.toJSON()}},Oee={[pr]:Dee,...Sr,[Symbol.iterator](){return new lr(this)},toJSON(){return{_id:`Effect`,op:this[hr],...`~effect/Effect/args`in this?{args:this[gr]}:void 0}}},Cr=e=>N(e,pr),wr=e=>N(e,mr),Tr=`~effect/Cause`,Er=`~effect/Cause/Reason`,Dr=e=>N(e,Tr),Or=e=>N(e,Er);var kr=class{constructor(e){this[Tr]=Tr,this.reasons=e}pipe(){return Ot(this,arguments)}toJSON(){return{_id:`Cause`,failures:this.reasons.map(e=>e.toJSON())}}toString(){return`Cause(${qn(this.reasons)})`}[rr](){return this.toJSON()}[En](e){return Dr(e)&&this.reasons.length===e.reasons.length&&this.reasons.every((t,n)=>Dn(t,e.reasons[n]))}[ln](){return bn(this.reasons)}};const Ar=/*#__PURE__*/ new WeakMap;var jr=class{[Er];annotations;_tag;constructor(e,t,n){if(this[Er]=Er,this._tag=e,t!==Mr&&typeof n==`object`&&n&&t.size>0){let e=Ar.get(n);e&&(t=new Map([...e,...t])),Ar.set(n,t)}this.annotations=t}annotate(e,t){if(e.mapUnsafe.size===0)return this;let n=new Map(this.annotations);e.mapUnsafe.forEach((e,r)=>{t?.overwrite!==!0&&n.has(r)||n.set(r,e)});let r=Object.assign(Object.create(Object.getPrototypeOf(this)),this);return r.annotations=n,r}pipe(){return Ot(this,arguments)}toString(){return qn(this)}[rr](){return this.toString()}};const Mr=/*#__PURE__*/ new Map;var Nr=class extends jr{constructor(e,t=Mr){super(`Fail`,t,e),this.error=e}toString(){return`Fail(${qn(this.error)})`}toJSON(){return{_tag:`Fail`,error:this.error}}[En](e){return Ur(e)&&Dn(this.error,e.error)&&Dn(this.annotations,e.annotations)}[ln](){return pn(_n(this._tag))(pn(un(this.error))(un(this.annotations)))}};const Pr=e=>new kr(e),Fr=(e,t)=>{let n=/* @__PURE__ */ new Map,r=[];for(let i of e.concat(t)){let e=un(i),t=n.get(e);if(t===void 0)n.set(e,[i]);else if(t.some(e=>Dn(e,i)))continue;else t.push(i);r.push(i)}return r},Ir=/*#__PURE__*/ j(2,(e,t)=>{if(e.reasons.length===0)return t;if(t.reasons.length===0)return e;let n=new kr(Fr(e.reasons,t.reasons));return Dn(e,n)?e:n}),Lr=(e,t)=>{let n=e.reasons.slice();for(let e of t.reasons)Gr(e)&&!n.some(t=>Gr(t)&&t.fiberId===e.fiberId&&t.annotations===e.annotations)&&n.push(e);return n.length===e.reasons.length?e:new kr(n)},Rr=/*#__PURE__*/ new kr([]),zr=e=>new kr([new Nr(e)]);var Br=class extends jr{constructor(e,t=Mr){super(`Die`,t,e),this.defect=e}toString(){return`Die(${qn(this.defect)})`}toJSON(){return{_tag:`Die`,defect:this.defect}}[En](e){return Wr(e)&&Dn(this.defect,e.defect)&&Dn(this.annotations,e.annotations)}[ln](){return pn(_n(this._tag))(pn(un(this.defect))(un(this.annotations)))}};const Vr=e=>new kr([new Br(e)]),Hr=/*#__PURE__*/ j(e=>Dr(e[0]),(e,t,n)=>t.mapUnsafe.size===0?e:new kr(e.reasons.map(e=>e.annotate(t,n)))),Ur=e=>e._tag===`Fail`,Wr=e=>e._tag===`Die`,Gr=e=>e._tag===`Interrupt`;function Kr(e){return ti(`Effect.evaluate: Not implemented`)}const qr=e=>({...Oee,[hr]:e.op,[_r]:e[`~effect/Effect/evaluate`]??Kr,[vr]:e[vr],[yr]:e[yr],[br]:e[br]}),Jr=e=>{let t=qr(e),n=function(e){this[gr]=e};return n.prototype=t,function(e){return new n(e)}},Yr=e=>{let t={[mr]:mr,_tag:e.op,get[e.prop](){return this[gr]},...qr(e),toString(){return`${e.op}(${qn(this[gr])})`},toJSON(){return{_id:`Exit`,_tag:e.op,[e.prop]:this[gr]}},[En](e){return wr(e)&&e._tag===this._tag&&Dn(this[`~effect/Effect/args`],e[`~effect/Effect/args`])},[ln](){return pn(_n(e.op),un(this[gr]))}},n=function(e){this[gr]=e};return n.prototype=t,function(e){return new n(e)}},Xr=/*#__PURE__*/ Yr({op:`Success`,prop:`value`,[_r](e){let t=e.getCont(vr);return t?t[vr](this[gr],e,this):e.yieldWith(this)}}),Zr={key:`effect/Cause/StackTrace`},Qr={key:`effect/Cause/InterruptorStackTrace`},$r=/*#__PURE__*/ Yr({op:`Failure`,prop:`cause`,[_r](e){let t=this[gr],n=!1;e.cache.stackFrame&&(t=Hr(t,{mapUnsafe:/* @__PURE__ */ new Map([[Zr.key,e.cache.stackFrame]])}),n=!0);let r=e.getCont(yr),i=e._interruptedCause;if(i&&e.interruptible){let a=!1;for(;r&&e.interruptible;)a||=hr in r,r=e.getCont(yr);a&&(t=Pr(t.reasons.filter(e=>e._tag!==`Fail`))),t=Lr(t,i),n=!0}return r?r[yr](t,e,n?void 0:this):e.yieldWith(n?$r(t):this)}}),ei=e=>$r(zr(e)),ti=e=>$r(Vr(e)),ni=/*#__PURE__*/ Jr({op:`WithFiber`,[_r](e){return this[gr](e)}}),ri=/*#__PURE__*/ function(){class e extends globalThis.Error{}let t=/*#__PURE__*/ qr({op:`YieldableError`,[_r](){return ei(this)}});return delete t.toString,Object.assign(e.prototype,t),e}(),ii=/*#__PURE__*/ function(){let e=/*#__PURE__*/ Symbol.for(`effect/Data/Error/plainArgs`);return class extends ri{constructor(t){super(t?.message,t?.cause?{cause:t.cause}:void 0),t&&(fr(this,t),Object.defineProperty(this,e,{value:t,enumerable:!1}))}toJSON(){return{...this[e],...this}}}}(),ai=e=>{class t extends ii{_tag=e}return t.prototype.name=e,t},oi=`~effect/Cause/NoSuchElementError`,si=e=>N(e,oi);var ci=class extends (/*#__PURE__*/ ai(`NoSuchElementError`)){[oi]=oi;constructor(e){super({message:e})}};const li=`~effect/Cause/Done`,kee=e=>N(e,li),ui={[li]:li,_tag:`Done`,value:void 0},di=e=>e===void 0?ui:{[li]:li,_tag:`Done`,value:e},Aee=/*#__PURE__*/ ei(ui),jee=e=>e===void 0?Aee:ei(di(e)),fi=e=>qr({op:e.label,[_r]:e.evaluate}),pi=e=>(t,n)=>t===n||e(t,n),Mee=(e,t)=>e===t,mi=()=>Mee;function Nee(e){return pi((t,n)=>{if(t.length!==n.length)return!1;for(let r=0;r<t.length;r++)if(!e[r](t[r],n[r]))return!1;return!0})}function Pee(e){return pi((t,n)=>{if(t.length!==n.length)return!1;for(let r=0;r<t.length;r++)if(!e(t[r],n[r]))return!1;return!0})}const hi=`~effect/Option`,gi={[hi]:{_A:e=>e},...Sr,[Symbol.iterator](){return new lr(this)}},Fee=/*#__PURE__*/ Object.defineProperty(/*#__PURE__*/ Object.assign(/*#__PURE__*/ Object.create(gi),{_tag:`Some`,_op:`Some`,[En](e){return _i(e)&&yi(e)&&Dn(this.value,e.value)},[ln](){return pn(un(this._tag))(un(this.value))},toString(){return`some(${qn(this.value)})`},toJSON(){return{_id:`Option`,_tag:this._tag,value:ir(this.value)}}}),"valueOrUndefined",{get(){return this.value}}),Iee=/*#__PURE__*/ un(`None`),Lee=/*#__PURE__*/ Object.assign(/*#__PURE__*/ Object.create(gi),{_tag:`None`,_op:`None`,valueOrUndefined:void 0,[En](e){return _i(e)&&vi(e)},[ln](){return Iee},toString(){return`none()`},toJSON(){return{_id:`Option`,_tag:this._tag}}}),_i=e=>N(e,hi),vi=e=>e._tag===`None`,yi=e=>e._tag===`Some`,Ree=/*#__PURE__*/ Object.create(Lee),bi=function(e){this.value=e};bi.prototype=Fee;const zee=e=>new bi(e),xi=`~effect/Result`,Si={[xi]:{
 /* v8 ignore next 2 */
@@ -412,7 +412,7 @@ To resolve this, you can:
 	1. Use only one of the conflicting plugins
 	2. Configure the plugins to use different paths (if supported)
 	3. Ensure plugins use different HTTP methods for the same path
-`)}}function CQ(e,t){let n=oe(t),r=t.plugins?.reduce((e,t)=>({...e,...t.endpoints}),{})??{},i=t.plugins?.map(t=>t.middlewares?.map(r=>{let i=(async i=>{let a=await e;return n(`middleware ${r.path} ${t.id}`,{"better_auth.hook.type":`middleware`,"http.route":r.path,"better_auth.context":`plugin:${t.id}`},()=>r.middleware({...i,context:{...a,...i.context}}))});return i.options=r.middleware.options,{path:r.path,middleware:i}})).filter(e=>e!==void 0).flat()||[];return{api:jpe({signInSocial:mpe(),callbackOAuth:tpe,getSession:IJ(),signOut:_pe,signUpEmail:hQ(),signInEmail:hpe(),resetPassword:dpe,verifyPassword:fpe,verifyEmail:HY,sendVerificationEmail:VY,changeEmail:Epe,changePassword:Cpe,setPassword:wpe,updateSession:bpe(),updateUser:Spe(),deleteUser:Tpe,requestPasswordReset:lpe,requestPasswordResetCallback:upe,listSessions:UJ(),revokeSession:WJ,revokeSessions:GJ,revokeOtherSessions:KJ,linkSocialAccount:Xfe,listUserAccounts:Yfe,deleteUserCallback:gQ,unlinkAccount:Zfe,refreshToken:$fe,getAccessToken:Qfe,accountInfo:epe,...r,ok:ipe,error:rpe},e),middlewares:i}}const Npe=(e,t)=>{let n=oe(t),{api:r,middlewares:i}=CQ(e,t),a=new URL(e.baseURL).pathname;return IK(r,{routerContext:e,openapi:{disabled:!0},basePath:a,routerMiddleware:[{path:`/**`,middleware:$q},...i],allowedMediaTypes:[`application/json`],skipTrailingSlashes:t.advanced?.skipTrailingSlashes??!1,async onRequest(t){let r=e.options.disabledPaths||[],i=_q(t.url,a);if(r.includes(i))return new Response(`Not Found`,{status:404});let o=e.checkSchema?.();o&&await o;let s=t,c=await NJ(s,e);if(c)return c;for(let t of e.options.plugins||[])if(t.onRequest){let r=await n(`onRequest ${t.id}`,{[$J]:`onRequest`,[eY]:`plugin:${t.id}`},()=>t.onRequest(s,e));if(r&&`response`in r)return r.response;r&&`request`in r&&(s=r.request)}return s},async onResponse(t,r){for(let r of e.options.plugins||[])if(r.onResponse){let i=await n(`onResponse ${r.id}`,{[$J]:`onResponse`,[eY]:`plugin:${r.id}`,[ce]:t.status},()=>r.onResponse(t,e));if(i)return i.response}return t},async onError(n){if(Pq(n)&&n.status===`FOUND`)return;if(t.onAPIError?.throw)throw n;if(t.onAPIError?.onError){try{await t.onAPIError.onError(n,e)}catch(t){e.logger.error(`onAPIError.onError threw`,t)}return}let r=t.logger?.level,i=r===`error`||r===`warn`||r===`debug`?f:void 0;if(t.logger?.disabled!==!0){if(n&&typeof n==`object`&&`message`in n&&typeof n.message==`string`&&(n.message.includes(`no column`)||n.message.includes(`column`)||n.message.includes(`relation`)||n.message.includes(`table`)||n.message.includes(`does not exist`))){e.logger?.error(n.message);return}Pq(n)?(n.status===`INTERNAL_SERVER_ERROR`&&e.logger.error(n.status,n),i?.error(n.message)):e.logger?.error(n&&typeof n==`object`&&`name`in n?n.name:``,n)}}})};async function Ppe(e,t){let n;if(e.database)n=typeof e.database==`function`?e.database(e):await t(e);else{let t=p(e),r=Object.keys(t).reduce((e,t)=>(e[t]=[],e),{}),{memoryAdapter:i}=await import(`./dist-Dse7wyrJ.mjs`);n=i(r)(e)}return n.transaction||(f.warn(`Adapter does not correctly implement transaction function, patching it automatically. Please update your adapter implementation.`),n.transaction=async e=>e(n)),n}async function Fpe(e){return Ppe(e,async e=>{let{createKyselyAdapter:t,kyselyAdapter:n}=await import(`./kysely-adapter-DUSfYWk8.mjs`),{kysely:r,databaseType:i,transaction:a}=await t(e);if(!r)throw new D(`Failed to initialize database adapter`);return n(r,{type:i||`sqlite`,debugLogs:e.database&&`debugLogs`in e.database?e.database.debugLogs:!1,transaction:a})(e)})}function Ipe(e){let{indexesByTable:t,tables:n}=re(e),r=/* @__PURE__ */ new Map,i={};for(let e in n){let t=n[e],a=t.fields,o={};Object.entries(a).forEach(([e,t])=>{let i=t.references,a=i?n[i.model]:void 0,s=i&&a?{...t,references:{...i,model:a.modelName}}:t;o[t.fieldName||e]=s,i&&r.set(s,{modelKey:i.model,fieldKey:i.field})}),i[t.modelName]?(i[t.modelName].fields={...i[t.modelName].fields,...o},t.disableMigrations&&(i[t.modelName].disableMigrations=!0)):i[t.modelName]={fields:o,order:t.order||1/0,disableMigrations:t.disableMigrations}}for(let[e,n]of t)i[e]&&(i[e].indexes=n);return{schema:i,tables:n,referenceKeys:r}}const Lpe={postgres:{string:[`character varying`,`varchar`,`text`,`uuid`],number:[`int4`,`integer`,`bigint`,`smallint`,`numeric`,`real`,`double precision`],boolean:[`bool`,`boolean`],date:[`timestamptz`,`timestamp`,`date`],json:[`json`,`jsonb`]},mysql:{string:[`varchar`,`text`,`uuid`],number:[`integer`,`int`,`bigint`,`smallint`,`decimal`,`float`,`double`],boolean:[`boolean`,`tinyint`],date:[`timestamp`,`datetime`,`date`],json:[`json`]},sqlite:{string:[`TEXT`],number:[`INTEGER`,`REAL`,`BIGINT`],boolean:[`INTEGER`,`BOOLEAN`],date:[`DATE`,`INTEGER`],json:[`TEXT`]},mssql:{string:[`varchar`,`nvarchar`,`uniqueidentifier`],number:[`int`,`bigint`,`smallint`,`decimal`,`float`,`double`],boolean:[`bit`,`smallint`],date:[`datetime2`,`date`,`datetime`],json:[`varchar`,`nvarchar`]}};function wQ(e,t){return`${ie(e)}\u0000${ie(t)}`}function TQ(e,t){return`${e}\u0000${t}`}function EQ(e,t){return e.unique===(t.unique??!1)&&e.validFullColumns&&e.columns.length===t.columns.length&&e.columns.every((e,n)=>e===t.columns[n])}function DQ(e){return typeof e==`boolean`?e:typeof e==`number`?e!==0:e===`1`||e?.toLowerCase()===`true`||e===`t`}function OQ(e){return new Map(e.map(e=>{let t=[...e.columns].sort((e,t)=>e.position-t.position);return[wQ(e.table,e.name),{columns:t.flatMap(e=>e.name===null?[]:[e.name]),name:e.name,table:e.table,unique:e.unique,validFullColumns:e.valid&&!e.partial&&t.length>0&&t.every(e=>e.name!==null&&e.fullLength)}]}))}async function Rpe(e,n,r,i){if(i)return OQ(await i(r));let a;switch(n.type){case`sqlite`:a=(await t`
+`)}}function CQ(e,t){let n=oe(t),r=t.plugins?.reduce((e,t)=>({...e,...t.endpoints}),{})??{},i=t.plugins?.map(t=>t.middlewares?.map(r=>{let i=(async i=>{let a=await e;return n(`middleware ${r.path} ${t.id}`,{"better_auth.hook.type":`middleware`,"http.route":r.path,"better_auth.context":`plugin:${t.id}`},()=>r.middleware({...i,context:{...a,...i.context}}))});return i.options=r.middleware.options,{path:r.path,middleware:i}})).filter(e=>e!==void 0).flat()||[];return{api:jpe({signInSocial:mpe(),callbackOAuth:tpe,getSession:IJ(),signOut:_pe,signUpEmail:hQ(),signInEmail:hpe(),resetPassword:dpe,verifyPassword:fpe,verifyEmail:HY,sendVerificationEmail:VY,changeEmail:Epe,changePassword:Cpe,setPassword:wpe,updateSession:bpe(),updateUser:Spe(),deleteUser:Tpe,requestPasswordReset:lpe,requestPasswordResetCallback:upe,listSessions:UJ(),revokeSession:WJ,revokeSessions:GJ,revokeOtherSessions:KJ,linkSocialAccount:Xfe,listUserAccounts:Yfe,deleteUserCallback:gQ,unlinkAccount:Zfe,refreshToken:$fe,getAccessToken:Qfe,accountInfo:epe,...r,ok:ipe,error:rpe},e),middlewares:i}}const Npe=(e,t)=>{let n=oe(t),{api:r,middlewares:i}=CQ(e,t),a=new URL(e.baseURL).pathname;return IK(r,{routerContext:e,openapi:{disabled:!0},basePath:a,routerMiddleware:[{path:`/**`,middleware:$q},...i],allowedMediaTypes:[`application/json`],skipTrailingSlashes:t.advanced?.skipTrailingSlashes??!1,async onRequest(t){let r=e.options.disabledPaths||[],i=_q(t.url,a);if(r.includes(i))return new Response(`Not Found`,{status:404});let o=e.checkSchema?.();o&&await o;let s=t,c=await NJ(s,e);if(c)return c;for(let t of e.options.plugins||[])if(t.onRequest){let r=await n(`onRequest ${t.id}`,{[$J]:`onRequest`,[eY]:`plugin:${t.id}`},()=>t.onRequest(s,e));if(r&&`response`in r)return r.response;r&&`request`in r&&(s=r.request)}return s},async onResponse(t,r){for(let r of e.options.plugins||[])if(r.onResponse){let i=await n(`onResponse ${r.id}`,{[$J]:`onResponse`,[eY]:`plugin:${r.id}`,[ce]:t.status},()=>r.onResponse(t,e));if(i)return i.response}return t},async onError(n){if(Pq(n)&&n.status===`FOUND`)return;if(t.onAPIError?.throw)throw n;if(t.onAPIError?.onError){try{await t.onAPIError.onError(n,e)}catch(t){e.logger.error(`onAPIError.onError threw`,t)}return}let r=t.logger?.level,i=r===`error`||r===`warn`||r===`debug`?f:void 0;if(t.logger?.disabled!==!0){if(n&&typeof n==`object`&&`message`in n&&typeof n.message==`string`&&(n.message.includes(`no column`)||n.message.includes(`column`)||n.message.includes(`relation`)||n.message.includes(`table`)||n.message.includes(`does not exist`))){e.logger?.error(n.message);return}Pq(n)?(n.status===`INTERNAL_SERVER_ERROR`&&e.logger.error(n.status,n),i?.error(n.message)):e.logger?.error(n&&typeof n==`object`&&`name`in n?n.name:``,n)}}})};async function Ppe(e,t){let n;if(e.database)n=typeof e.database==`function`?e.database(e):await t(e);else{let t=p(e),r=Object.keys(t).reduce((e,t)=>(e[t]=[],e),{}),{memoryAdapter:i}=await import(`./dist-Dse7wyrJ.mjs`);n=i(r)(e)}return n.transaction||(f.warn(`Adapter does not correctly implement transaction function, patching it automatically. Please update your adapter implementation.`),n.transaction=async e=>e(n)),n}async function Fpe(e){return Ppe(e,async e=>{let{createKyselyAdapter:t,kyselyAdapter:n}=await import(`./kysely-adapter-BxenTacV.mjs`),{kysely:r,databaseType:i,transaction:a}=await t(e);if(!r)throw new D(`Failed to initialize database adapter`);return n(r,{type:i||`sqlite`,debugLogs:e.database&&`debugLogs`in e.database?e.database.debugLogs:!1,transaction:a})(e)})}function Ipe(e){let{indexesByTable:t,tables:n}=re(e),r=/* @__PURE__ */ new Map,i={};for(let e in n){let t=n[e],a=t.fields,o={};Object.entries(a).forEach(([e,t])=>{let i=t.references,a=i?n[i.model]:void 0,s=i&&a?{...t,references:{...i,model:a.modelName}}:t;o[t.fieldName||e]=s,i&&r.set(s,{modelKey:i.model,fieldKey:i.field})}),i[t.modelName]?(i[t.modelName].fields={...i[t.modelName].fields,...o},t.disableMigrations&&(i[t.modelName].disableMigrations=!0)):i[t.modelName]={fields:o,order:t.order||1/0,disableMigrations:t.disableMigrations}}for(let[e,n]of t)i[e]&&(i[e].indexes=n);return{schema:i,tables:n,referenceKeys:r}}const Lpe={postgres:{string:[`character varying`,`varchar`,`text`,`uuid`],number:[`int4`,`integer`,`bigint`,`smallint`,`numeric`,`real`,`double precision`],boolean:[`bool`,`boolean`],date:[`timestamptz`,`timestamp`,`date`],json:[`json`,`jsonb`]},mysql:{string:[`varchar`,`text`,`uuid`],number:[`integer`,`int`,`bigint`,`smallint`,`decimal`,`float`,`double`],boolean:[`boolean`,`tinyint`],date:[`timestamp`,`datetime`,`date`],json:[`json`]},sqlite:{string:[`TEXT`],number:[`INTEGER`,`REAL`,`BIGINT`],boolean:[`INTEGER`,`BOOLEAN`],date:[`DATE`,`INTEGER`],json:[`TEXT`]},mssql:{string:[`varchar`,`nvarchar`,`uniqueidentifier`],number:[`int`,`bigint`,`smallint`,`decimal`,`float`,`double`],boolean:[`bit`,`smallint`],date:[`datetime2`,`date`,`datetime`],json:[`varchar`,`nvarchar`]}};function wQ(e,t){return`${ie(e)}\u0000${ie(t)}`}function TQ(e,t){return`${e}\u0000${t}`}function EQ(e,t){return e.unique===(t.unique??!1)&&e.validFullColumns&&e.columns.length===t.columns.length&&e.columns.every((e,n)=>e===t.columns[n])}function DQ(e){return typeof e==`boolean`?e:typeof e==`number`?e!==0:e===`1`||e?.toLowerCase()===`true`||e===`t`}function OQ(e){return new Map(e.map(e=>{let t=[...e.columns].sort((e,t)=>e.position-t.position);return[wQ(e.table,e.name),{columns:t.flatMap(e=>e.name===null?[]:[e.name]),name:e.name,table:e.table,unique:e.unique,validFullColumns:e.valid&&!e.partial&&t.length>0&&t.every(e=>e.name!==null&&e.fullLength)}]}))}async function Rpe(e,n,r,i){if(i)return OQ(await i(r));let a;switch(n.type){case`sqlite`:a=(await t`
 				SELECT
 					tables.name AS "tableName",
 					index_list.name AS "indexName",
@@ -508,7 +508,7 @@ To resolve this, you can:
 You are using the memory DB with generateId: false.
 This will cause no id to be generated for any model.
 Most of the features of Better Auth will not work correctly.`);let l=t.secrets??qpe(C.BETTER_AUTH_SECRETS),u=t.secret||C.BETTER_AUTH_SECRET||C.AUTH_SECRET||``,d,f;l?(Jpe(l,o),d=l[0].value,f=Ype(l,u)):(d=u||`better-auth-secret-12345678901234567890`,hme(d,o),f=d),t={...t,secret:d,baseURL:s?t.baseURL:c?new URL(c).origin:``,basePath:t.basePath||`/api/auth`,plugins:i.concat(a)},Mpe(t,o);let m=t.advanced?.ipAddress?.trustedProxies;if(m&&m.length>0){let e=_J(m);e.length>0&&o.warn(`Ignoring invalid \`advanced.ipAddress.trustedProxies\` entries: ${e.join(`, `)}. Each entry must be an IP address or CIDR range.`)}let h=tq(t),g=p(t),_=(await Promise.all(Object.entries(t.socialProviders||{}).map(async([e,t])=>{let n=typeof t==`function`?await t():t;if(n==null||n.enabled===!1)return null;n.clientId||o.warn(`Social provider ${e} is missing clientId or clientSecret`);let r=tQ[e](n);return r.disableImplicitSignUp=n.disableImplicitSignUp,r}))).filter(e=>e!==null),v=({model:e,size:n})=>{if(typeof t.advanced?.generateId==`function`)return t.advanced.generateId({model:e,size:n});let r=t?.advanced?.database?.generateId;return typeof r==`function`?r({model:e,size:n}):r===`uuid`?crypto.randomUUID():r===`serial`||r===!1?!1:pe(n)},{publish:y}=await pme(t,{adapter:e.id,database:typeof t.database==`function`?`adapter`:n(t.database)}),b=new Set(t.plugins.map(e=>e.id)),x=e=>t.plugins.find(t=>t.id===e)??null,S=e=>b.has(e),ee=await TY(t),ne=await AY(t),w={appName:t.appName||`Better Auth`,baseURL:c||``,version:be(),socialProviders:_,options:t,oauthConfig:{storeStateStrategy:t.account?.storeStateStrategy||(r?`database`:`cookie`),skipStateCookieCheck:!!t.account?.skipStateCookieCheck},tables:g,trustedOrigins:ee,trustedProviders:ne,isTrustedOrigin(e,t){return this.trustedOrigins.some(n=>Jq(e,n,t))},sessionConfig:{updateAge:t.session?.updateAge===void 0?86400:t.session.updateAge,expiresIn:t.session?.expiresIn||604800,freshAge:t.session?.freshAge===void 0?86400:t.session.freshAge,cookieRefreshCache:(()=>{let e=t.session?.cookieCache?.refreshCache,n=t.session?.cookieCache?.maxAge||300;return r&&e?(o.warn("[better-auth] `session.cookieCache.refreshCache` is enabled while `database` or `secondaryStorage` is configured. `refreshCache` is meant for stateless (DB-less) setups. Disabling `refreshCache` — remove it from your config to silence this warning."),!1):e===!1||e===void 0?!1:e===!0?{enabled:!0,updateAge:Math.floor(n*.2)}:{enabled:!0,updateAge:e.updateAge===void 0?Math.floor(n*.2):e.updateAge}})()},secret:d,secretConfig:f,rateLimit:{...t.rateLimit,enabled:t.rateLimit?.enabled??te,window:t.rateLimit?.window||10,max:t.rateLimit?.max||100,storage:t.rateLimit?.storage||(t.secondaryStorage?`secondary-storage`:`memory`)},authCookies:h,logger:o,generateId:v,session:null,secondaryStorage:t.secondaryStorage,password:{hash:t.emailAndPassword?.password?.hash||OU,verify:t.emailAndPassword?.password?.verify||kU,config:{minPasswordLength:t.emailAndPassword?.minPasswordLength||8,maxPasswordLength:t.emailAndPassword?.maxPasswordLength||128},checkPassword:spe},setNewSession(e){this.newSession=e},newSession:null,adapter:e,internalAdapter:rY(e,{options:t,logger:o,hooks:t.databaseHooks?[{source:`user`,hooks:t.databaseHooks}]:[],generateId:v}),createAuthCookie:eq(t),async runMigrations(){throw new D(`runMigrations will be set by the specific init implementation`)},publishTelemetry:y,skipCSRFCheck:!!t.advanced?.disableCSRFCheck,skipOriginCheck:t.advanced?.disableOriginCheck===void 0?!!Te():t.advanced.disableOriginCheck,runInBackground:t.advanced?.backgroundTasks?.handler??(e=>{e.catch(()=>{})}),async runInBackgroundOrAwait(e){try{t.advanced?.backgroundTasks?.handler?e instanceof Promise&&t.advanced.backgroundTasks.handler(e.catch(e=>{o.error(`Failed to run background task:`,e)})):await e}catch(e){o.error(`Failed to run background task:`,e)}},getPlugin:x,hasPlugin:S},T=CY(w);return uG(T)&&await T,w.checkSchema=Ze(w.adapter),w.explicitSchemaCheck=dee(w.adapter),w}const _me=async e=>{let t=await gme(await Fpe(e),e,e=>o(e)||`unknown`);return t.runMigrations=async function(){if(!e.database||`updateMany`in e.database)throw new D(`Database is not provided or it's an adapter. Migrations are only supported with a database instance.`);let{runMigrations:t}=await kQ(e);await t()},t},vme=(e,t)=>{let n=t(e).then(e=>{let t=e.options.advanced?.database?.validateSchema;if(!e.checkSchema&&t!==!1){let n=t===!0?`warn`:`debug`;e.logger[n](`Schema validation is not available for adapter "${e.adapter.id}". Skipping schema validation. Database operations will proceed normally.`)}let n=e.checkSchema?.();return n&&n.catch(t=>{e.logger.error(t instanceof pee?t.message:`Could not validate the database schema. Check your database connection.`)}),e}),{api:r}=CQ(n,e),i=e.plugins?.reduce((e,t)=>t.$ERROR_CODES?{...e,...t.$ERROR_CODES}:e,{}),a=async t=>{let r=await n,i=r.options.basePath||`/api/auth`,a;if(BH(e.baseURL))a=await OY(r,t,DY(r.options));else{a=Object.create(Object.getPrototypeOf(r),Object.getOwnPropertyDescriptors(r));let e=r.options;if(!r.options.baseURL){let n=IH(void 0,i,t,void 0,r.options.advanced?.trustedProxyHeaders);if(!n)throw new D(`Could not get base URL from request. Please provide a valid base URL.`);a.baseURL=n,a.options={...r.options,baseURL:LH(n)||void 0},e=a.options}a.trustedOrigins=await TY(e,t),a.trustedProviders=await AY(e,t)}let{handler:o}=Npe(a,e);return SH(a.adapter,()=>o(t))};return{handler:a,fetch:a,api:r,options:e,$context:n,$ERROR_CODES:{...i,...Y}}},yme=e=>vme(e,_me),BQ=yH({INVALID_METADATA_TYPE:`metadata must be an object or undefined`,REFILL_AMOUNT_AND_INTERVAL_REQUIRED:`refillAmount is required when refillInterval is provided`,REFILL_INTERVAL_AND_AMOUNT_REQUIRED:`refillInterval is required when refillAmount is provided`,USER_BANNED:`User is banned`,UNAUTHORIZED_SESSION:`Unauthorized or invalid session`,KEY_NOT_FOUND:`API Key not found`,KEY_DISABLED:`API Key is disabled`,KEY_EXPIRED:`API Key has expired`,USAGE_EXCEEDED:`API Key has reached its usage limit`,KEY_NOT_RECOVERABLE:`API Key is not recoverable`,EXPIRES_IN_IS_TOO_SMALL:`The expiresIn is smaller than the predefined minimum value.`,EXPIRES_IN_IS_TOO_LARGE:`The expiresIn is larger than the predefined maximum value.`,INVALID_REMAINING:`The remaining count is either too large or too small.`,INVALID_PREFIX_LENGTH:`The prefix length is either too large or too small.`,INVALID_NAME_LENGTH:`The name length is either too large or too small.`,METADATA_DISABLED:`Metadata is disabled.`,RATE_LIMIT_EXCEEDED:`Rate limit exceeded.`,NO_VALUES_TO_UPDATE:`No values to update.`,KEY_DISABLED_EXPIRATION:`Custom key expiration values are disabled.`,INVALID_API_KEY:`Invalid API key.`,INVALID_USER_ID_FROM_API_KEY:`The user id from the API key is invalid.`,INVALID_REFERENCE_ID_FROM_API_KEY:`The reference id from the API key is invalid.`,INVALID_API_KEY_GETTER_RETURN_TYPE:`API Key getter returned an invalid key type. Expected string.`,SERVER_ONLY_PROPERTY:`The property you're trying to set can only be set from the server auth instance only.`,FAILED_TO_UPDATE_API_KEY:`Failed to update API key`,NAME_REQUIRED:`API Key name is required.`,ORGANIZATION_ID_REQUIRED:`Organization ID is required for organization-owned API keys.`,USER_NOT_MEMBER_OF_ORGANIZATION:`You are not a member of the organization that owns this API key.`,INSUFFICIENT_API_KEY_PERMISSIONS:`You do not have permission to perform this action on organization API keys.`,NO_DEFAULT_API_KEY_CONFIGURATION_FOUND:`No default api-key configuration found.`,ORGANIZATION_PLUGIN_REQUIRED:`Organization plugin is required for organization-owned API keys. Please install and configure the organization plugin.`});async function VQ(e,t,n){let r=e.length;if(r===0)return[];let{signal:i}=n;if(i?.aborted)throw i.reason;let a=Math.floor(n.concurrency),o=Math.min(r,a>=1?a:1),s=Array(r),c=0,l=!1;return await Promise.all(Array.from({length:o},async()=>{for(;!l&&c<r;){if(i?.aborted)throw i.reason;let n=c++;try{s[n]=await t(e[n],n)}catch(e){throw l=!0,e}}})),s}const bme={proto:/"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,constructor:/"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,protoShort:/"__proto__"\s*:/,constructorShort:/"constructor"\s*:/},xme=/^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/,HQ={true:!0,false:!1,null:null,undefined:void 0,nan:NaN,infinity:1/0,"-infinity":-1/0},Sme=/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,7}))?(?:Z|([+-])(\d{2}):(\d{2}))$/;function Cme(e){return e instanceof Date&&!isNaN(e.getTime())}function wme(e){let t=Sme.exec(e);if(!t)return null;let[,n,r,i,a,o,s,c,l,u,d]=t,f=new Date(Date.UTC(parseInt(n,10),parseInt(r,10)-1,parseInt(i,10),parseInt(a,10),parseInt(o,10),parseInt(s,10),c?parseInt(c.padEnd(3,`0`),10):0));if(l){let e=(parseInt(u,10)*60+parseInt(d,10))*(l===`+`?-1:1);f.setUTCMinutes(f.getUTCMinutes()+e)}return Cme(f)?f:null}function Tme(e,t={}){let{strict:n=!1,warnings:r=!1,reviver:i,parseDates:a=!0}=t;if(typeof e!=`string`)return e;let o=e.trim(),s=o.toLowerCase();if(s.length<=9&&s in HQ)return HQ[s];if(!xme.test(o)){if(n)throw SyntaxError(`[better-json] Invalid JSON`);return e}if(Object.entries(bme).some(([e,t])=>{let n=t.test(o);return n&&r&&console.warn(`[better-json] Detected potential prototype pollution attempt using ${e} pattern`),n})&&n)throw Error(`[better-json] Potential prototype pollution attempt detected`);try{return JSON.parse(o,(e,t)=>{if(e===`__proto__`||e===`constructor`&&t&&typeof t==`object`&&`prototype`in t)r&&console.warn(`[better-json] Dropping "${e}" key to prevent prototype pollution`);else{if(a&&typeof t==`string`){let e=wme(t);if(e)return e}return i?i(e,t):t}})}catch(t){if(n)throw t;return e}}function Eme(e,t={strict:!0}){return Tme(e,t)}function UQ(e){return e==null?null:typeof e==`object`?e:le(e)}function WQ(e){return e!=null&&typeof e==`string`}async function Dme(e,t,n){if(n.storage!==`database`&&!n.fallbackToDatabase)return;let r=t.filter(e=>WQ(e.metadata));if(r.length===0)return;let i=r.map(async t=>{let n=UQ(t.metadata);try{await e.context.adapter.update({model:`apikey`,where:[{field:`id`,value:t.id}],update:{metadata:n}})}catch(n){e.context.logger.warn(`Failed to migrate double-stringified metadata for API key ${t.id}:`,n)}});await Promise.all(i)}async function GQ(e,t,n){let r=UQ(t.metadata);if(WQ(t.metadata)&&(n.storage===`database`||n.fallbackToDatabase))try{await e.context.adapter.update({model:`apikey`,where:[{field:`id`,value:t.id}],update:{metadata:r}})}catch(n){e.context.logger.warn(`Failed to migrate double-stringified metadata for API key ${t.id}:`,n)}return r}function KQ(e){return`api-key:${e}`}function qQ(e){return`api-key:by-id:${e}`}function JQ(e){return`api-key:by-ref:${e}`}function Ome(e){return JSON.stringify({...e,createdAt:e.createdAt.toISOString(),updatedAt:e.updatedAt.toISOString(),expiresAt:e.expiresAt?.toISOString()??null,lastRefillAt:e.lastRefillAt?.toISOString()??null,lastRequest:e.lastRequest?.toISOString()??null})}function YQ(e){if(!e||typeof e!=`string`)return null;try{let t=JSON.parse(e);return{...t,createdAt:new Date(t.createdAt),updatedAt:new Date(t.updatedAt),expiresAt:t.expiresAt?new Date(t.expiresAt):null,lastRefillAt:t.lastRefillAt?new Date(t.lastRefillAt):null,lastRequest:t.lastRequest?new Date(t.lastRequest):null}}catch{return null}}function XQ(e,t){return t.customStorage?t.customStorage:e.context.secondaryStorage||null}function ZQ(e){if(e.expiresAt){let t=Date.now(),n=new Date(e.expiresAt).getTime(),r=Math.floor((n-t)/1e3);if(r>0)return r}}async function QQ(e,t,n){let r=KQ(t);return YQ(await n.get(r))}async function $Q(e,t,n){let r=qQ(t);return YQ(await n.get(r))}const e$=/* @__PURE__ */ new Map;function kme(e,t){let n=(e$.get(e)??Promise.resolve()).then(t,t).finally(()=>{e$.get(e)===n&&e$.delete(e)});return e$.set(e,n),n}async function t$(e,t,n){await kme(t,async()=>{let r=await e.get(t),i=[];if(r&&typeof r==`string`)try{i=JSON.parse(r)}catch{i=[]}else Array.isArray(r)&&(i=r);let a=n(i);a.length===0?await e.delete(t):await e.set(t,JSON.stringify(a))})}async function n$(e,t,n,r,i){let a=Ome(t),o=JQ(t.referenceId);i.fallbackToDatabase?await Promise.all([n.set(KQ(t.key),a,r),n.set(qQ(t.id),a,r),n.delete(o)]):(await Promise.all([n.set(KQ(t.key),a,r),n.set(qQ(t.id),a,r)]),await t$(n,o,e=>e.includes(t.id)?e:[...e,t.id]))}async function Ame(e,t,n,r){let i=JQ(t.referenceId);r.fallbackToDatabase?await Promise.all([n.delete(KQ(t.key)),n.delete(qQ(t.id)),n.delete(i)]):await Promise.all([n.delete(KQ(t.key)),n.delete(qQ(t.id)),t$(n,i,e=>e.filter(e=>e!==t.id))])}async function r$(e,t,n){let r=XQ(e,n);if(n.storage===`database`)return await e.context.adapter.findOne({model:`apikey`,where:[{field:`key`,value:t}]});if(n.storage===`secondary-storage`&&n.fallbackToDatabase){if(r){let n=await QQ(e,t,r);if(n)return n}let i=await e.context.adapter.findOne({model:`apikey`,where:[{field:`key`,value:t}]});return i&&r&&await n$(e,i,r,ZQ(i),n),i}return n.storage===`secondary-storage`?r?await QQ(e,t,r):null:await e.context.adapter.findOne({model:`apikey`,where:[{field:`key`,value:t}]})}async function i$(e,t,n){let r=XQ(e,n);if(n.storage===`database`)return await e.context.adapter.findOne({model:`apikey`,where:[{field:`id`,value:t}]});if(n.storage===`secondary-storage`&&n.fallbackToDatabase){if(r){let n=await $Q(e,t,r);if(n)return n}let i=await e.context.adapter.findOne({model:`apikey`,where:[{field:`id`,value:t}]});return i&&r&&await n$(e,i,r,ZQ(i),n),i}return n.storage===`secondary-storage`?r?await $Q(e,t,r):null:await e.context.adapter.findOne({model:`apikey`,where:[{field:`id`,value:t}]})}async function a$(e,t,n){let r=XQ(e,n),i=ZQ(t);if(n.storage!==`database`&&n.storage===`secondary-storage`){if(!r)throw Error(`Secondary storage is required when storage mode is 'secondary-storage'`);await n$(e,t,r,i,n)}}async function o$(e,t,n){let r=XQ(e,n);if(n.storage!==`database`&&n.storage===`secondary-storage`){if(!r)throw Error(`Secondary storage is required when storage mode is 'secondary-storage'`);await Ame(e,t,r,n)}}function s$(e,t,n,r,i){let a=[...e];if(t){let e=n||`asc`;a.sort((n,r)=>{let i=n[t],a=r[t];return i==null&&a==null?0:i==null?e===`asc`?-1:1:a==null?e===`asc`?1:-1:i<a?e===`asc`?-1:1:i>a?e===`asc`?1:-1:0})}return i!==void 0&&(a=a.slice(i)),r!==void 0&&(a=a.slice(0,r)),a}async function c$(e,t,n,r){let i=XQ(e,n),{limit:a,offset:o,sortBy:s,sortDirection:c}=r||{};if(n.storage===`database`){let[n,r]=await Promise.all([e.context.adapter.findMany({model:`apikey`,where:[{field:`referenceId`,value:t}],limit:a,offset:o,sortBy:s?{field:s,direction:c||`asc`}:void 0}),e.context.adapter.count({model:`apikey`,where:[{field:`referenceId`,value:t}]})]);return{apiKeys:n,total:r}}if(n.storage===`secondary-storage`&&n.fallbackToDatabase){let r=JQ(t);if(i){let t=await i.get(r),n=[];if(t&&typeof t==`string`)try{n=JSON.parse(t)}catch{n=[]}else Array.isArray(t)&&(n=t);if(n.length>0){let t=(await VQ(n,t=>$Q(e,t,i),{concurrency:10})).filter(e=>e!=null);return{apiKeys:s$(t,s,c,a,o),total:t.length}}}let[l,u]=await Promise.all([e.context.adapter.findMany({model:`apikey`,where:[{field:`referenceId`,value:t}],limit:a,offset:o,sortBy:s?{field:s,direction:c||`asc`}:void 0}),e.context.adapter.count({model:`apikey`,where:[{field:`referenceId`,value:t}]})]);if(i&&l.length>0){await VQ(l,t=>n$(e,t,i,ZQ(t),n),{concurrency:10});let t=l.map(e=>e.id);await i.set(r,JSON.stringify(t))}return{apiKeys:l,total:u}}if(n.storage===`secondary-storage`){if(!i)return{apiKeys:[],total:0};let n=JQ(t),r=await i.get(n),l=[];if(r&&typeof r==`string`)try{l=JSON.parse(r)}catch{return{apiKeys:[],total:0}}else if(Array.isArray(r))l=r;else return{apiKeys:[],total:0};let u=(await VQ(l,t=>$Q(e,t,i),{concurrency:10})).filter(e=>e!=null);return{apiKeys:s$(u,s,c,a,o),total:u.length}}let[l,u]=await Promise.all([e.context.adapter.findMany({model:`apikey`,where:[{field:`referenceId`,value:t}],limit:a,offset:o,sortBy:s?{field:s,direction:c||`asc`}:void 0}),e.context.adapter.count({model:`apikey`,where:[{field:`referenceId`,value:t}]})]);return{apiKeys:l,total:u}}function jme(e){let t=e.context;if(`orgOptions`in t&&t.orgOptions)return t.orgOptions;let n=t.getPlugin?.(`organization`);return n&&`options`in n?n.options:null}async function l$(e,t,n,r){let i=jme(e);if(!i){let e=BQ.ORGANIZATION_PLUGIN_REQUIRED;throw E.from(`INTERNAL_SERVER_ERROR`,e)}let a=await e.context.adapter.findOne({model:`member`,where:[{field:`userId`,value:t},{field:`organizationId`,value:n}]});if(!a){let e=BQ.USER_NOT_MEMBER_OF_ORGANIZATION;throw E.from(`FORBIDDEN`,e)}if(!await Mme(e,a.role,n,r,i)){let e=BQ.INSUFFICIENT_API_KEY_PERMISSIONS;throw E.from(`FORBIDDEN`,e)}return a}async function Mme(e,t,n,r,i){let{hasPermission:a}=await import(`./organization-FxrB4RLj.mjs`);try{return await a({role:t,options:i,permissions:{apiKey:[r]},organizationId:n,allowCreatorAllPermissions:!0},e)}catch{return!1}}const u$=(e,t=`ms`)=>new Date(Date.now()+(t===`sec`?e*1e3:e));function Nme(e){return e instanceof E||e instanceof E||e?.name===`APIError`}const Pme=A({configId:k().meta({description:`The configuration ID to use for the API key. If not provided, the default configuration will be used.`}).optional(),name:k().meta({description:`Name of the Api Key`}).optional(),expiresIn:Me().meta({description:`Expiration time of the Api Key in seconds`}).min(1).optional().nullable().default(null),prefix:k().meta({description:`Prefix of the Api Key`}).regex(/^[a-zA-Z0-9_-]+$/,{message:`Invalid prefix format, must be alphanumeric and contain only underscores and hyphens.`}).optional(),remaining:Me().meta({description:`Remaining number of requests. Server side only`}).min(0).optional().nullable().default(null),metadata:Ke().optional(),refillAmount:Me().meta({description:`Amount to refill the remaining count of the Api Key. server-only. Eg: 100`}).min(1).optional(),refillInterval:Me().meta({description:`Interval to refill the Api Key in milliseconds. server-only. Eg: 1000`}).optional(),rateLimitTimeWindow:Me().meta({description:"The duration in milliseconds where each request is counted. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 1000"}).optional(),rateLimitMax:Me().meta({description:"Maximum amount of requests allowed within a window. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 100"}).optional(),rateLimitEnabled:He().meta({description:`Whether the key has rate limiting enabled. server-only. Eg: true`}).optional(),permissions:Ne(k(),Pe(k())).meta({description:`Permissions of the Api Key.`}).optional(),userId:WW().meta({description:`User Id of the user that the Api Key belongs to. server-only. Eg: "user-id"`}).optional(),organizationId:WW().meta({description:`Organization Id of the organization that the Api Key belongs to. Eg: 'org-id'`}).optional()});function Fme({defaultKeyGenerator:e,configurations:t,schema:n,deleteAllExpiredApiKeys:r}){return X(`/api-key/create`,{method:`POST`,body:Pme,metadata:{openapi:{description:`Create a new API key for a user`,responses:{200:{description:`API key created successfully`,content:{"application/json":{schema:{type:`object`,properties:{id:{type:`string`,description:`Unique identifier of the API key`},createdAt:{type:`string`,format:`date-time`,description:`Creation timestamp`},updatedAt:{type:`string`,format:`date-time`,description:`Last update timestamp`},name:{type:`string`,nullable:!0,description:`Name of the API key`},prefix:{type:`string`,nullable:!0,description:`Prefix of the API key`},start:{type:`string`,nullable:!0,description:`Starting characters of the key (if configured)`},key:{type:`string`,description:`The full API key (only returned on creation)`},enabled:{type:`boolean`,description:`Whether the key is enabled`},expiresAt:{type:`string`,format:`date-time`,nullable:!0,description:`Expiration timestamp`},referenceId:{type:`string`,description:`ID of the reference owning the key`},lastRefillAt:{type:`string`,format:`date-time`,nullable:!0,description:`Last refill timestamp`},lastRequest:{type:`string`,format:`date-time`,nullable:!0,description:`Last request timestamp`},metadata:{type:`object`,nullable:!0,additionalProperties:!0,description:`Metadata associated with the key`},rateLimitMax:{type:`number`,nullable:!0,description:`Maximum requests in time window`},rateLimitTimeWindow:{type:`number`,nullable:!0,description:`Rate limit time window in milliseconds`},remaining:{type:`number`,nullable:!0,description:`Remaining requests`},refillAmount:{type:`number`,nullable:!0,description:`Amount to refill`},refillInterval:{type:`number`,nullable:!0,description:`Refill interval in milliseconds`},rateLimitEnabled:{type:`boolean`,description:`Whether rate limiting is enabled`},requestCount:{type:`number`,description:`Current request count in window`},permissions:{type:`object`,nullable:!0,additionalProperties:{type:`array`,items:{type:`string`}},description:`Permissions associated with the key`}},required:[`id`,`createdAt`,`updatedAt`,`key`,`enabled`,`referenceId`,`rateLimitEnabled`,`requestCount`]}}}}}}}},async n=>{let{configId:i,name:a,expiresIn:o,prefix:s,remaining:c,metadata:l,refillAmount:u,refillInterval:d,permissions:f,rateLimitMax:p,rateLimitTimeWindow:m,rateLimitEnabled:h}=n.body,g=m$(n.context,t,i),_=g.customKeyGenerator||e,v=await RJ(n,{disableCookieCache:!0}),y=n.request||n.headers;if(y&&(u!==void 0||d!==void 0||p!==void 0||m!==void 0||h!==void 0||f!==void 0||c!==null))throw E.from(`BAD_REQUEST`,BQ.SERVER_ONLY_PROPERTY);if(n.request&&n.body.userId!==void 0)throw E.from(`UNAUTHORIZED`,BQ.UNAUTHORIZED_SESSION);let b=g.references??`user`,x;if(b===`organization`){let e=n.body.organizationId;if(!e){let e=BQ.ORGANIZATION_ID_REQUIRED;throw E.from(`BAD_REQUEST`,e)}let t=v?.user.id||n.body.userId;if(!t)throw E.from(`UNAUTHORIZED`,BQ.UNAUTHORIZED_SESSION);await l$(n,t,e,`create`),x=e}else if(y){if(!v?.user.id){let e=BQ.UNAUTHORIZED_SESSION;throw E.from(`UNAUTHORIZED`,e)}x=v.user.id}else{let e=n.body.userId,t=v?.user.id;if(!t&&!e||v&&e&&t!==e){let e=BQ.UNAUTHORIZED_SESSION;throw E.from(`UNAUTHORIZED`,e)}x=t||e}if(l){if(g.enableMetadata===!1)throw E.from(`BAD_REQUEST`,BQ.METADATA_DISABLED);if(typeof l!=`object`)throw E.from(`BAD_REQUEST`,BQ.INVALID_METADATA_TYPE)}if(u&&!d){let e=BQ.REFILL_AMOUNT_AND_INTERVAL_REQUIRED;throw E.from(`BAD_REQUEST`,e)}if(d&&!u){let e=BQ.REFILL_INTERVAL_AND_AMOUNT_REQUIRED;throw E.from(`BAD_REQUEST`,e)}if(o){if(g.keyExpiration.disableCustomExpiresTime===!0){let e=BQ.KEY_DISABLED_EXPIRATION;throw E.from(`BAD_REQUEST`,e)}let e=o/86400;if(g.keyExpiration.minExpiresIn>e){let e=BQ.EXPIRES_IN_IS_TOO_SMALL;throw E.from(`BAD_REQUEST`,e)}if(g.keyExpiration.maxExpiresIn<e){let e=BQ.EXPIRES_IN_IS_TOO_LARGE;throw E.from(`BAD_REQUEST`,e)}}if(s&&(s.length<g.minimumPrefixLength||s.length>g.maximumPrefixLength))throw E.from(`BAD_REQUEST`,BQ.INVALID_PREFIX_LENGTH);if(a){if(a.length<g.minimumNameLength||a.length>g.maximumNameLength)throw E.from(`BAD_REQUEST`,BQ.INVALID_NAME_LENGTH)}else if(g.requireName)throw E.from(`BAD_REQUEST`,BQ.NAME_REQUIRED);r(n.context);let S=await _({length:g.defaultKeyLength,prefix:s||g.defaultPrefix}),ee=g.disableKeyHashing?S:await y$(S),C=null;g.startingCharactersConfig.shouldStore&&(C=S.substring(0,g.startingCharactersConfig.charactersLength));let te=g.permissions?.defaultPermissions?typeof g.permissions.defaultPermissions==`function`?await g.permissions.defaultPermissions(x,n):g.permissions.defaultPermissions:void 0,ne=f?JSON.stringify(f):te?JSON.stringify(te):void 0,w={configId:g.configId??`default`,createdAt:/* @__PURE__ */ new Date,updatedAt:/* @__PURE__ */ new Date,name:a??null,prefix:s??g.defaultPrefix??null,start:C,key:ee,enabled:!0,expiresAt:o?u$(o,`sec`):g.keyExpiration.defaultExpiresIn?u$(g.keyExpiration.defaultExpiresIn,`sec`):null,referenceId:x,lastRefillAt:null,lastRequest:null,metadata:null,rateLimitMax:p??g.rateLimit.maxRequests??null,rateLimitTimeWindow:m??g.rateLimit.timeWindow??null,remaining:c===null?c:c??u??null,refillAmount:u??null,refillInterval:d??null,rateLimitEnabled:h===void 0?g.rateLimit.enabled??!0:h,requestCount:0,permissions:ne};l&&(w.metadata=l);let T;if(g.storage===`secondary-storage`&&g.fallbackToDatabase)T=await n.context.adapter.create({model:b$,data:w}),await a$(n,T,g);else if(g.storage===`secondary-storage`){let e=n.context.generateId({model:`apikey`})||pe();T={...w,id:e},await a$(n,T,g)}else T=await n.context.adapter.create({model:b$,data:w});return n.json({...T,key:S,metadata:l??null,permissions:T.permissions?le(T.permissions):null})})}function Ime({deleteAllExpiredApiKeys:e}){return X.serverOnly({method:`POST`},async t=>{try{await e(t.context,!0)}catch(e){return t.context.logger.error(`[API KEY PLUGIN] Failed to delete expired API keys:`,e),t.json({success:!1,error:e})}return t.json({success:!0,error:null})})}const Lme=A({configId:k().meta({description:`The configuration ID to use for the API key lookup. If not provided, the default configuration will be used.`}).optional(),keyId:k().meta({description:`The id of the Api Key`})});function Rme({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return X(`/api-key/delete`,{method:`POST`,body:Lme,use:[BJ],metadata:{openapi:{description:`Delete an existing API key`,requestBody:{content:{"application/json":{schema:{type:`object`,properties:{keyId:{type:`string`,description:`The id of the API key to delete`}},required:[`keyId`]}}}},responses:{200:{description:`API key deleted successfully`,content:{"application/json":{schema:{type:`object`,properties:{success:{type:`boolean`,description:`Indicates if the API key was successfully deleted`}},required:[`success`]}}}}}}}},async t=>{let{configId:r,keyId:i}=t.body,a=t.context.session;if(a.user.banned===!0)throw E.from(`UNAUTHORIZED`,BQ.USER_BANNED);let o=m$(t.context,e,r),s=null;if(s=await i$(t,i,o),!s||!g$(s.configId,o.configId))throw E.from(`NOT_FOUND`,BQ.KEY_NOT_FOUND);let c=m$(t.context,e,s.configId);if((c.references??`user`)===`organization`)await l$(t,a.user.id,s.referenceId,`delete`);else if(s.referenceId!==a.user.id)throw E.from(`NOT_FOUND`,BQ.KEY_NOT_FOUND);try{c.storage===`secondary-storage`&&c.fallbackToDatabase?(await o$(t,s,c),await t.context.adapter.delete({model:b$,where:[{field:`id`,value:s.id}]})):c.storage===`database`?await t.context.adapter.delete({model:b$,where:[{field:`id`,value:s.id}]}):await o$(t,s,c)}catch(e){throw E.fromStatus(`INTERNAL_SERVER_ERROR`,{message:e?.message})}return n(t.context),t.json({success:!0})})}const zme=A({configId:k().meta({description:`The configuration ID to use for the API key lookup. If not provided, the default configuration will be used.`}).optional(),id:k().meta({description:`The id of the Api Key`})});function Bme({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return X(`/api-key/get`,{method:`GET`,query:zme,use:[BJ],metadata:{openapi:{description:`Retrieve an existing API key by ID`,responses:{200:{description:`API key retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{id:{type:`string`,description:`ID`},name:{type:`string`,nullable:!0,description:`The name of the key`},start:{type:`string`,nullable:!0,description:`Shows the first few characters of the API key, including the prefix. This allows you to show those few characters in the UI to make it easier for users to identify the API key.`},prefix:{type:`string`,nullable:!0,description:`The API Key prefix. Stored as plain text.`},userId:{type:`string`,description:`The owner of the user id`},refillInterval:{type:`number`,nullable:!0,description:"The interval in milliseconds between refills of the `remaining` count. Example: 3600000 // refill every hour (3600000ms = 1h)"},refillAmount:{type:`number`,nullable:!0,description:`The amount to refill`},lastRefillAt:{type:`string`,format:`date-time`,nullable:!0,description:`The last refill date`},enabled:{type:`boolean`,description:`Sets if key is enabled or disabled`,default:!0},rateLimitEnabled:{type:`boolean`,description:`Whether the key has rate limiting enabled`},rateLimitTimeWindow:{type:`number`,nullable:!0,description:`The duration in milliseconds`},rateLimitMax:{type:`number`,nullable:!0,description:`Maximum amount of requests allowed within a window`},requestCount:{type:`number`,description:`The number of requests made within the rate limit time window`},remaining:{type:`number`,nullable:!0,description:`Remaining requests (every time api key is used this should updated and should be updated on refill as well)`},lastRequest:{type:`string`,format:`date-time`,nullable:!0,description:`When last request occurred`},expiresAt:{type:`string`,format:`date-time`,nullable:!0,description:`Expiry date of a key`},createdAt:{type:`string`,format:`date-time`,description:`created at`},updatedAt:{type:`string`,format:`date-time`,description:`updated at`},metadata:{type:`object`,nullable:!0,additionalProperties:!0,description:`Extra metadata about the apiKey`},permissions:{type:`string`,nullable:!0,description:`Permissions for the api key (stored as JSON string)`}},required:[`id`,`userId`,`enabled`,`rateLimitEnabled`,`requestCount`,`createdAt`,`updatedAt`]}}}}}}}},async t=>{let{configId:r,id:i}=t.query,a=t.context.session,o=m$(t.context,e,r),s=null;if(s=await i$(t,i,o),!s||!g$(s.configId,o.configId))throw E.from(`NOT_FOUND`,BQ.KEY_NOT_FOUND);let c=m$(t.context,e,s.configId);if((c.references??`user`)===`organization`)await l$(t,a.user.id,s.referenceId,`read`);else if(s.referenceId!==a.user.id)throw E.from(`NOT_FOUND`,BQ.KEY_NOT_FOUND);n(t.context);let l=await GQ(t,s,c),{key:u,...d}=s;return t.json({...d,metadata:l,permissions:d.permissions?le(d.permissions):null})})}function Vme(e){return e.storage===`database`?`database`:e.customStorage?`custom:${e.configId??`default`}`:e.fallbackToDatabase?`secondary-storage-with-fallback`:`secondary-storage`}const Hme=A({configId:k().meta({description:`Filter by configuration ID. If not provided, returns keys from all configurations.`}).optional(),organizationId:k().meta({description:`Organization ID to list keys for. If provided, returns organization-owned keys. If not provided, returns user-owned keys.`}).optional(),limit:GW().int().nonnegative().meta({description:`The number of API keys to return`}).optional(),offset:GW().int().nonnegative().meta({description:`The offset to start from`}).optional(),sortBy:k().meta({description:`The field to sort by (e.g., createdAt, name, expiresAt)`}).optional(),sortDirection:We([`asc`,`desc`]).meta({description:`The direction to sort by`}).optional()}).optional();function Ume({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return X(`/api-key/list`,{method:`GET`,use:[BJ],query:Hme,metadata:{openapi:{description:`List all API keys for the authenticated user or for a specific organization`,responses:{200:{description:`API keys retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{apiKeys:{type:`array`,items:{type:`object`,properties:{id:{type:`string`,description:`ID`},name:{type:`string`,nullable:!0,description:`The name of the key`},start:{type:`string`,nullable:!0,description:`Shows the first few characters of the API key, including the prefix. This allows you to show those few characters in the UI to make it easier for users to identify the API key.`},prefix:{type:`string`,nullable:!0,description:`The API Key prefix. Stored as plain text.`},userId:{type:`string`,description:`The owner of the user id`},refillInterval:{type:`number`,nullable:!0,description:"The interval in milliseconds between refills of the `remaining` count. Example: 3600000 // refill every hour (3600000ms = 1h)"},refillAmount:{type:`number`,nullable:!0,description:`The amount to refill`},lastRefillAt:{type:`string`,format:`date-time`,nullable:!0,description:`The last refill date`},enabled:{type:`boolean`,description:`Sets if key is enabled or disabled`,default:!0},rateLimitEnabled:{type:`boolean`,description:`Whether the key has rate limiting enabled`},rateLimitTimeWindow:{type:`number`,nullable:!0,description:`The duration in milliseconds`},rateLimitMax:{type:`number`,nullable:!0,description:`Maximum amount of requests allowed within a window`},requestCount:{type:`number`,description:`The number of requests made within the rate limit time window`},remaining:{type:`number`,nullable:!0,description:`Remaining requests (every time api key is used this should updated and should be updated on refill as well)`},lastRequest:{type:`string`,format:`date-time`,nullable:!0,description:`When last request occurred`},expiresAt:{type:`string`,format:`date-time`,nullable:!0,description:`Expiry date of a key`},createdAt:{type:`string`,format:`date-time`,description:`created at`},updatedAt:{type:`string`,format:`date-time`,description:`updated at`},metadata:{type:`object`,nullable:!0,additionalProperties:!0,description:`Extra metadata about the apiKey`},permissions:{type:`string`,nullable:!0,description:`Permissions for the api key (stored as JSON string)`}},required:[`id`,`userId`,`enabled`,`rateLimitEnabled`,`requestCount`,`createdAt`,`updatedAt`]}},total:{type:`number`,description:`Total number of API keys`},limit:{type:`number`,nullable:!0,description:`The limit used for pagination`},offset:{type:`number`,nullable:!0,description:`The offset used for pagination`}},required:[`apiKeys`,`total`]}}}}}}}},async t=>{let r=t.context.session,i=t.query?.configId,a=t.query?.organizationId,o=t.query?.limit==null?void 0:Number(t.query.limit),s=t.query?.offset==null?void 0:Number(t.query.offset);a&&await l$(t,r.user.id,a,`read`);let c=a??r.user.id,l=a?`organization`:`user`,u=[];if(i){let{apiKeys:n}=await c$(t,c,m$(t.context,e,i),{limit:void 0,offset:void 0,sortBy:t.query?.sortBy,sortDirection:t.query?.sortDirection});u=n}else{let n=/* @__PURE__ */ new Map;for(let t of e){let e=Vme(t);n.has(e)||n.set(e,t)}let r=await Promise.all([...n.values()].map(e=>c$(t,c,e,{limit:void 0,offset:void 0,sortBy:t.query?.sortBy,sortDirection:t.query?.sortDirection}))),i=/* @__PURE__ */ new Set;for(let{apiKeys:e}of r)for(let t of e)i.has(t.id)||(i.add(t.id),u.push(t))}let d=u.filter(t=>(e.find(e=>h$(t.configId)?h$(e.configId):e.configId===t.configId)?.references??`user`)===l&&t.referenceId===c);i&&(d=d.filter(e=>g$(e.configId,i)));let f=d.length,p=d;s!==void 0&&(p=p.slice(s)),o!==void 0&&(p=p.slice(0,o)),n(t.context);let m=p.map(e=>{let{key:t,...n}=e;return{...n,metadata:UQ(e.metadata),permissions:n.permissions?le(n.permissions):null}}),h=e.find(e=>e.storage===`database`||e.fallbackToDatabase);return h&&await t.context.runInBackgroundOrAwait(Dme(t,p,h)),t.json({apiKeys:m,total:f,limit:o,offset:s})})}const Wme=A({configId:k().meta({description:`The configuration ID to use for the API key lookup. If not provided, the default configuration will be used.`}).optional(),keyId:k().meta({description:`The id of the Api Key`}),userId:WW().meta({description:`The id of the user which the api key belongs to. server-only. Eg: "some-user-id"`}).optional(),name:k().meta({description:`The name of the key`}).optional(),enabled:He().meta({description:`Whether the Api Key is enabled or not`}).optional(),remaining:Me().meta({description:`The number of remaining requests`}).min(1).optional(),refillAmount:Me().meta({description:`The refill amount`}).optional(),refillInterval:Me().meta({description:`The refill interval`}).optional(),metadata:Ke().optional(),expiresIn:Me().meta({description:`Expiration time of the Api Key in seconds`}).min(1).optional().nullable(),rateLimitEnabled:He().meta({description:`Whether the key has rate limiting enabled.`}).optional(),rateLimitTimeWindow:Me().meta({description:`The duration in milliseconds where each request is counted. server-only. Eg: 1000`}).optional(),rateLimitMax:Me().meta({description:"Maximum amount of requests allowed within a window. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 100"}).optional(),permissions:Ne(k(),Pe(k())).meta({description:`Update the permissions on the API Key. server-only.`}).optional().nullable()});function Gme({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return X(`/api-key/update`,{method:`POST`,body:Wme,metadata:{openapi:{description:`Update an existing API key by ID`,responses:{200:{description:`API key updated successfully`,content:{"application/json":{schema:{type:`object`,properties:{id:{type:`string`,description:`ID`},name:{type:`string`,nullable:!0,description:`The name of the key`},start:{type:`string`,nullable:!0,description:`Shows the first few characters of the API key, including the prefix. This allows you to show those few characters in the UI to make it easier for users to identify the API key.`},prefix:{type:`string`,nullable:!0,description:`The API Key prefix. Stored as plain text.`},userId:{type:`string`,description:`The owner of the user id`},refillInterval:{type:`number`,nullable:!0,description:"The interval in milliseconds between refills of the `remaining` count. Example: 3600000 // refill every hour (3600000ms = 1h)"},refillAmount:{type:`number`,nullable:!0,description:`The amount to refill`},lastRefillAt:{type:`string`,format:`date-time`,nullable:!0,description:`The last refill date`},enabled:{type:`boolean`,description:`Sets if key is enabled or disabled`,default:!0},rateLimitEnabled:{type:`boolean`,description:`Whether the key has rate limiting enabled`},rateLimitTimeWindow:{type:`number`,nullable:!0,description:`The duration in milliseconds`},rateLimitMax:{type:`number`,nullable:!0,description:`Maximum amount of requests allowed within a window`},requestCount:{type:`number`,description:`The number of requests made within the rate limit time window`},remaining:{type:`number`,nullable:!0,description:`Remaining requests (every time api key is used this should updated and should be updated on refill as well)`},lastRequest:{type:`string`,format:`date-time`,nullable:!0,description:`When last request occurred`},expiresAt:{type:`string`,format:`date-time`,nullable:!0,description:`Expiry date of a key`},createdAt:{type:`string`,format:`date-time`,description:`created at`},updatedAt:{type:`string`,format:`date-time`,description:`updated at`},metadata:{type:`object`,nullable:!0,additionalProperties:!0,description:`Extra metadata about the apiKey`},permissions:{type:`string`,nullable:!0,description:`Permissions for the api key (stored as JSON string)`}},required:[`id`,`userId`,`enabled`,`rateLimitEnabled`,`requestCount`,`createdAt`,`updatedAt`]}}}}}}}},async t=>{let{configId:r,keyId:i,expiresIn:a,enabled:o,metadata:s,refillAmount:c,refillInterval:l,remaining:u,name:d,permissions:f,rateLimitEnabled:p,rateLimitTimeWindow:m,rateLimitMax:h}=t.body,g=await RJ(t,{disableCookieCache:!0}),_=t.request||t.headers,v=_&&!g?null:g?.user||{id:t.body.userId};if(!v?.id||g&&t.body.userId&&g?.user.id!==t.body.userId)throw E.from(`UNAUTHORIZED`,BQ.UNAUTHORIZED_SESSION);if(_&&(c!==void 0||l!==void 0||h!==void 0||m!==void 0||p!==void 0||u!==void 0||f!==void 0))throw E.from(`BAD_REQUEST`,BQ.SERVER_ONLY_PROPERTY);let y=m$(t.context,e,r),b=null;if(b=await i$(t,i,y),!b||!g$(b.configId,y.configId))throw E.from(`NOT_FOUND`,BQ.KEY_NOT_FOUND);let x=m$(t.context,e,b.configId);if((x.references??`user`)===`organization`)await l$(t,v.id,b.referenceId,`update`);else if(b.referenceId!==v.id)throw E.from(`NOT_FOUND`,BQ.KEY_NOT_FOUND);let S={};if(d!==void 0){if(d.length<x.minimumNameLength||d.length>x.maximumNameLength)throw E.from(`BAD_REQUEST`,BQ.INVALID_NAME_LENGTH);S.name=d}if(o!==void 0&&(S.enabled=o),a!==void 0){if(x.keyExpiration.disableCustomExpiresTime===!0)throw E.from(`BAD_REQUEST`,BQ.KEY_DISABLED_EXPIRATION);if(a!==null){let e=a/86400;if(e<x.keyExpiration.minExpiresIn)throw E.from(`BAD_REQUEST`,BQ.EXPIRES_IN_IS_TOO_SMALL);if(e>x.keyExpiration.maxExpiresIn)throw E.from(`BAD_REQUEST`,BQ.EXPIRES_IN_IS_TOO_LARGE)}S.expiresAt=a?u$(a,`sec`):null}if(s!==void 0&&x.enableMetadata===!0){if(typeof s!=`object`)throw E.from(`BAD_REQUEST`,BQ.INVALID_METADATA_TYPE);S.metadata=s}if(u!==void 0&&(S.remaining=u),c!==void 0||l!==void 0){if(c!==void 0&&l===void 0)throw E.from(`BAD_REQUEST`,BQ.REFILL_AMOUNT_AND_INTERVAL_REQUIRED);if(l!==void 0&&c===void 0)throw E.from(`BAD_REQUEST`,BQ.REFILL_INTERVAL_AND_AMOUNT_REQUIRED);S.refillAmount=c,S.refillInterval=l}if(p!==void 0&&(S.rateLimitEnabled=p),m!==void 0&&(S.rateLimitTimeWindow=m),h!==void 0&&(S.rateLimitMax=h),f!==void 0&&(S.permissions=JSON.stringify(f)),Object.keys(S).length===0)throw E.from(`BAD_REQUEST`,BQ.NO_VALUES_TO_UPDATE);let ee=b;try{if(x.storage===`secondary-storage`&&x.fallbackToDatabase){let e=await t.context.adapter.update({model:b$,where:[{field:`id`,value:b.id}],update:S});e&&(await a$(t,e,x),ee=e)}else if(x.storage===`database`){let e=await t.context.adapter.update({model:b$,where:[{field:`id`,value:b.id}],update:S});e&&(ee=e)}else{let e={...b,...S,updatedAt:/* @__PURE__ */ new Date};await a$(t,e,x),ee=e}}catch(e){throw E.fromStatus(`INTERNAL_SERVER_ERROR`,{message:e?.message})}n(t.context);let C=await GQ(t,ee,x),{key:te,...ne}=ee;return t.json({...ne,metadata:C,permissions:ne.permissions?le(ne.permissions):null})})}function d$(e,t){let n=/* @__PURE__ */ new Date,r=e.lastRequest,i=e.rateLimitTimeWindow,a=e.rateLimitMax;if(t.rateLimit.enabled===!1||e.rateLimitEnabled===!1)return{type:`skip`,lastRequest:n};if(i===null||a===null)return{type:`skip`,lastRequest:null};if(r===null)return{type:`start`,now:n};let o=n.getTime()-new Date(r).getTime();return o>i?{type:`reset`,now:n,windowStart:new Date(n.getTime()-i)}:e.requestCount>=a?{type:`deny`,message:BQ.RATE_LIMIT_EXCEEDED.message,tryAgainIn:Math.ceil(i-o)}:{type:`increment`,now:n,max:a,windowStart:new Date(n.getTime()-i)}}async function f$({key:e,ctx:t,lookupOpts:n,configurations:r,schema:i,permissions:a,expectedConfigId:o,runCustomValidator:s}){let c=n.disableKeyHashing?e:await y$(e),l=await r$(t,c,n);if(!l||o!==void 0&&!g$(l.configId,o))throw E.from(`UNAUTHORIZED`,BQ.INVALID_API_KEY);let u=m$(t.context,r,l.configId);if(s&&u.customAPIKeyValidator&&!await u.customAPIKeyValidator({ctx:t,key:e}))throw E.from(`UNAUTHORIZED`,BQ.KEY_NOT_FOUND);if(l.enabled===!1)throw E.from(`UNAUTHORIZED`,BQ.KEY_DISABLED);if(l.expiresAt&&Date.now()>new Date(l.expiresAt).getTime()){let e=async()=>{u.storage===`secondary-storage`&&u.fallbackToDatabase?(await o$(t,l,u),await t.context.adapter.delete({model:b$,where:[{field:`id`,value:l.id}]})):u.storage===`secondary-storage`?await o$(t,l,u):await t.context.adapter.delete({model:b$,where:[{field:`id`,value:l.id}]})};throw u.deferUpdates?t.context.runInBackground(e().catch(e=>{t.context.logger.error(`Deferred update failed:`,e)})):await e(),E.from(`UNAUTHORIZED`,BQ.KEY_EXPIRED)}if(a){let e=l.permissions?le(l.permissions):null;if(!e||!$e(e).authorize(a).success)throw E.from(`UNAUTHORIZED`,BQ.KEY_NOT_FOUND)}if(l.remaining===0&&l.refillAmount===null){let e=async()=>{u.storage===`secondary-storage`&&u.fallbackToDatabase?(await o$(t,l,u),await t.context.adapter.delete({model:b$,where:[{field:`id`,value:l.id}]})):u.storage===`secondary-storage`?await o$(t,l,u):await t.context.adapter.delete({model:b$,where:[{field:`id`,value:l.id}]})};throw u.deferUpdates?t.context.runInBackground(e().catch(e=>{t.context.logger.error(`Deferred update failed:`,e)})):await e(),E.from(`TOO_MANY_REQUESTS`,BQ.USAGE_EXCEEDED)}return{apiKey:u.storage===`database`||u.storage===`secondary-storage`&&u.fallbackToDatabase?await Kme({ctx:t,apiKey:l,opts:u,hashedKey:c}):await Jme({ctx:t,apiKey:l,opts:u,hashedKey:c}),opts:u}}async function Kme({ctx:e,apiKey:t,opts:n,hashedKey:r}){let i=t;t.remaining!==null&&(i=await qme(e,t)),i=await p$(e,i,n);let a=await e.context.adapter.update({model:b$,where:[{field:`id`,value:i.id}],update:{updatedAt:/* @__PURE__ */ new Date}});if(!a)throw E.from(`UNAUTHORIZED`,BQ.INVALID_API_KEY);return n.storage===`secondary-storage`&&n.fallbackToDatabase&&await a$(e,a,n),a}async function qme(e,t){let n=/* @__PURE__ */ new Date,{refillInterval:r,refillAmount:i}=t;if(r&&i){let a=new Date(t.lastRefillAt??t.createdAt).getTime();if(n.getTime()-a>r){let r=await e.context.adapter.incrementOne({model:b$,where:[{field:`id`,value:t.id},{field:`lastRefillAt`,value:t.lastRefillAt}],increment:{},set:{remaining:i-1,lastRefillAt:n}});if(r)return r}}let a=await e.context.adapter.incrementOne({model:b$,where:[{field:`id`,value:t.id},{field:`remaining`,operator:`gt`,value:0}],increment:{remaining:-1}});if(!a)throw E.from(`TOO_MANY_REQUESTS`,BQ.USAGE_EXCEEDED);return a}async function p$(e,t,n){let r=d$(t,n);if(r.type===`deny`)throw new E(`TOO_MANY_REQUESTS`,{message:r.message,code:`RATE_LIMITED`,details:{tryAgainIn:r.tryAgainIn}});if(r.type===`skip`)return r.lastRequest===null?t:await e.context.adapter.update({model:`apikey`,where:[{field:`id`,value:t.id}],update:{lastRequest:r.lastRequest}})??t;if(r.type===`increment`){let i=await e.context.adapter.incrementOne({model:b$,where:[{field:`id`,value:t.id},{field:`lastRequest`,operator:`gt`,value:r.windowStart},{field:`requestCount`,operator:`lt`,value:r.max}],increment:{requestCount:1},set:{lastRequest:r.now}});if(i)return i;let a=await e.context.adapter.findOne({model:b$,where:[{field:`id`,value:t.id}]});if(!a)throw E.from(`UNAUTHORIZED`,BQ.INVALID_API_KEY);return p$(e,a,n)}let i=r.type===`reset`?{field:`lastRequest`,operator:`lte`,value:r.windowStart}:{field:`lastRequest`,operator:`eq`,value:null},a=await e.context.adapter.incrementOne({model:b$,where:[{field:`id`,value:t.id},i],increment:{},set:{requestCount:1,lastRequest:r.now}});if(a)return a;let o=await e.context.adapter.findOne({model:b$,where:[{field:`id`,value:t.id}]});if(!o)throw E.from(`UNAUTHORIZED`,BQ.INVALID_API_KEY);return p$(e,o,n)}async function Jme({ctx:e,apiKey:t,opts:n,hashedKey:r}){let i=t.remaining,a=t.lastRefillAt;if(i!==null){let e=Date.now(),{refillInterval:n,refillAmount:r}=t,o=new Date(a??t.createdAt).getTime();if(n&&r&&e-o>n&&(i=r,a=/* @__PURE__ */ new Date),i===0)throw E.from(`TOO_MANY_REQUESTS`,BQ.USAGE_EXCEEDED);i--}let o={...Yme(t,n),remaining:i,lastRefillAt:a,updatedAt:/* @__PURE__ */ new Date},s=async()=>{let t=await r$(e,r,n);if(!t)return null;let i={...t,...o};return await a$(e,i,n),i};if(n.deferUpdates)return e.context.runInBackground(s().catch(t=>{e.context.logger.error(`Failed to update API key:`,t)})),{...t,...o};let c=await s();if(!c)throw E.from(`INTERNAL_SERVER_ERROR`,BQ.FAILED_TO_UPDATE_API_KEY);return c}function Yme(e,t){let n=d$(e,t);switch(n.type){case`deny`:throw new E(`TOO_MANY_REQUESTS`,{message:n.message,code:`RATE_LIMITED`,details:{tryAgainIn:n.tryAgainIn}});case`skip`:return n.lastRequest===null?{}:{lastRequest:n.lastRequest};case`start`:case`reset`:return{lastRequest:n.now,requestCount:1};case`increment`:return{lastRequest:n.now,requestCount:e.requestCount+1}}}const Xme=A({configId:k().meta({description:`Configuration ID to scope verification to. When omitted, the key is validated against its own configuration.`}).optional(),key:k().meta({description:`The key to verify`}),permissions:Ne(k(),Pe(k())).meta({description:`The permissions to verify.`}).optional()});function Zme({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return X.serverOnly({method:`POST`,body:Xme},async r=>{let{configId:i,key:a}=r.body,o=m$(r.context,e,i);if(i!==void 0&&o.customAPIKeyValidator&&!await o.customAPIKeyValidator({ctx:r,key:a}))return r.json({valid:!1,error:{message:BQ.INVALID_API_KEY,code:`KEY_NOT_FOUND`},key:null});let s=null,c;try{let l=await f$({key:a,permissions:r.body.permissions,ctx:r,lookupOpts:o,configurations:e,schema:t,expectedConfigId:i,runCustomValidator:i===void 0});s=l.apiKey,c=l.opts,c.deferUpdates&&r.context.runInBackground(n(r.context).catch(e=>{r.context.logger.error(`Failed to delete expired API keys:`,e)}))}catch(e){return r.context.logger.error(`Failed to validate API key:`,e),Nme(e)?r.json({valid:!1,error:{...e.body,message:e.body?.message,code:e.body?.code},key:null}):r.json({valid:!1,error:{message:BQ.INVALID_API_KEY,code:`INVALID_API_KEY`},key:null})}let{key:l,...u}=s??{key:1,permissions:void 0},d=null;return s&&(d=await GQ(r,s,c)),u.permissions=u.permissions?le(u.permissions):null,r.json({valid:!0,error:null,key:s===null?null:{...u,metadata:d}})})}function m$(e,t,n){let r=()=>{let n=t.find(e=>!e.configId||e.configId==="default");if(!n){e.logger.error("No default api-key configuration found. Either provide an api-key configuration with configId 'default' or provide a configuration with no `configId` set.");let t=BQ.NO_DEFAULT_API_KEY_CONFIGURATION_FOUND;throw E.from(`BAD_REQUEST`,t)}return{...n,configId:`default`}};return n?t.find(e=>e.configId===n)??r():r()}function h$(e){return!e||e==="default"}function g$(e,t){return h$(e)&&h$(t)?!0:e===t}let _$=null;async function v$(e,t=!1){_$&&!t&&(/* @__PURE__ */ new Date()).getTime()-_$.getTime()<1e4||(_$=/* @__PURE__ */ new Date,await e.adapter.deleteMany({model:b$,where:[{field:`expiresAt`,operator:`lt`,value:/* @__PURE__ */ new Date},{field:`expiresAt`,operator:`ne`,value:null}]}).catch(t=>{e.logger.error(`Failed to delete expired API keys:`,t)}))}function Qme({defaultKeyGenerator:e,configurations:t,schema:n}){return{createApiKey:Fme({defaultKeyGenerator:e,configurations:t,schema:n,deleteAllExpiredApiKeys:v$}),verifyApiKey:Zme({configurations:t,schema:n,deleteAllExpiredApiKeys:v$}),getApiKey:Bme({configurations:t,schema:n,deleteAllExpiredApiKeys:v$}),updateApiKey:Gme({configurations:t,schema:n,deleteAllExpiredApiKeys:v$}),deleteApiKey:Rme({configurations:t,schema:n,deleteAllExpiredApiKeys:v$}),listApiKeys:Ume({configurations:t,schema:n,deleteAllExpiredApiKeys:v$}),deleteAllExpiredApiKeys:Ime({deleteAllExpiredApiKeys:v$})}}const $me=({defaultRateLimitMax:e,defaultTimeWindow:t})=>({apikey:{fields:{configId:{type:`string`,required:!0,defaultValue:`default`,input:!1,index:!0},name:{type:`string`,required:!1,input:!1},start:{type:`string`,required:!1,input:!1},referenceId:{type:`string`,required:!0,input:!1,index:!0},prefix:{type:`string`,required:!1,input:!1},key:{type:`string`,required:!0,input:!1,index:!0},refillInterval:{type:`number`,required:!1,input:!1},refillAmount:{type:`number`,required:!1,input:!1},lastRefillAt:{type:`date`,required:!1,input:!1},enabled:{type:`boolean`,required:!1,input:!1,defaultValue:!0},rateLimitEnabled:{type:`boolean`,required:!1,input:!1,defaultValue:!0},rateLimitTimeWindow:{type:`number`,required:!1,input:!1,defaultValue:t},rateLimitMax:{type:`number`,required:!1,input:!1,defaultValue:e},requestCount:{type:`number`,required:!1,input:!1,defaultValue:0},remaining:{type:`number`,required:!1,input:!1},lastRequest:{type:`date`,required:!1,input:!1},expiresAt:{type:`date`,required:!1,input:!1},createdAt:{type:`date`,required:!0,input:!1},updatedAt:{type:`date`,required:!0,input:!1},permissions:{type:`string`,required:!1,input:!1},metadata:{type:`string`,required:!1,input:!0,transform:{input(e){return JSON.stringify(e)},output(e){return e?Eme(e):null}}}}}}),y$=async e=>{let t=await jU(`SHA-256`).digest(new TextEncoder().encode(e));return ye.encode(new Uint8Array(t),{padding:!1})},b$=`apikey`;function ehe(e,t){if(Array.isArray(e)&&e.length>0){if(!e.every(e=>e.configId))throw new D(`configId is required for each API key configuration in the api-key plugin.`);let t=e.map(e=>e.configId);if(new Set(t).size!==t.length)throw new D(`configId must be unique for each API key configuration in the api-key plugin.`)}let n=t??{schema:Array.isArray(e)?void 0:e?.schema},r=[...(Array.isArray(e)?e:[e]).map(e=>({...e,apiKeyHeaders:e?.apiKeyHeaders??`x-api-key`,defaultKeyLength:e?.defaultKeyLength||64,maximumPrefixLength:e?.maximumPrefixLength??32,minimumPrefixLength:e?.minimumPrefixLength??1,maximumNameLength:e?.maximumNameLength??32,minimumNameLength:e?.minimumNameLength??1,enableMetadata:e?.enableMetadata??!1,disableKeyHashing:e?.disableKeyHashing??!1,requireName:e?.requireName??!1,storage:e?.storage??`database`,rateLimit:{enabled:e?.rateLimit?.enabled===void 0||e?.rateLimit?.enabled,timeWindow:e?.rateLimit?.timeWindow??864e5,maxRequests:e?.rateLimit?.maxRequests??10},keyExpiration:{defaultExpiresIn:e?.keyExpiration?.defaultExpiresIn??null,disableCustomExpiresTime:e?.keyExpiration?.disableCustomExpiresTime??!1,maxExpiresIn:e?.keyExpiration?.maxExpiresIn??365,minExpiresIn:e?.keyExpiration?.minExpiresIn??1},startingCharactersConfig:{shouldStore:e?.startingCharactersConfig?.shouldStore??!0,charactersLength:e?.startingCharactersConfig?.charactersLength??6},enableSessionForAPIKeys:e?.enableSessionForAPIKeys??!1,fallbackToDatabase:e?.fallbackToDatabase??!1,customStorage:e?.customStorage,deferUpdates:e?.deferUpdates??!1}))],i=cG($me({defaultRateLimitMax:(r.length===1?r[0]?.rateLimit.maxRequests:void 0)??10,defaultTimeWindow:(r.length===1?r[0]?.rateLimit.timeWindow:void 0)??864e5}),n.schema),a=async e=>{let t=qH(e.length,`a-z`,`A-Z`);return`${e.prefix||``}${t}`};function o(e,t){if(t.customAPIKeyGetter)return t.customAPIKeyGetter(e);if(Array.isArray(t.apiKeyHeaders)){for(let n of t.apiKeyHeaders){let t=e.headers?.get(n);if(t)return t}return null}return e.headers?.get(t.apiKeyHeaders)??null}function s(e){for(let t of r){if(!t.enableSessionForAPIKeys)continue;let n=o(e,t);if(n)return{key:n,config:t}}return null}let c=Qme({defaultKeyGenerator:a,configurations:r,schema:i});return{id:`api-key`,version:`1.7.10`,$ERROR_CODES:BQ,hooks:{before:[{matcher:e=>!!s(e),handler:Rq(async e=>{let{key:t,config:n}=s(e);if(typeof t!=`string`)throw E.from(`BAD_REQUEST`,BQ.INVALID_API_KEY_GETTER_RETURN_TYPE);if(t.length<n.defaultKeyLength||n.customAPIKeyValidator&&!await n.customAPIKeyValidator({ctx:e,key:t}))throw E.from(`FORBIDDEN`,BQ.INVALID_API_KEY);let{apiKey:a}=await f$({key:t,ctx:e,lookupOpts:n,configurations:r,schema:i,expectedConfigId:n.configId}),o=v$(e.context).catch(t=>{e.context.logger.error(`Failed to delete expired API keys:`,t)});if(n.deferUpdates&&e.context.runInBackground(o),(n.references??`user`)!==`user`){let e=BQ.INVALID_REFERENCE_ID_FROM_API_KEY;throw E.from(`UNAUTHORIZED`,e)}let c=await e.context.internalAdapter.findUserById(a.referenceId);if(!c){let e=BQ.INVALID_REFERENCE_ID_FROM_API_KEY;throw E.from(`UNAUTHORIZED`,e)}let l={user:c,session:{id:a.id,token:t,userId:a.referenceId,userAgent:e.request?.headers.get(`user-agent`)??null,ipAddress:e.request?bJ(e.request,e.context.options):null,createdAt:/* @__PURE__ */ new Date,updatedAt:/* @__PURE__ */ new Date,expiresAt:a.expiresAt||u$(e.context.options.session?.expiresIn||604800,`ms`)}};return e.context.session=l,e.path===`/get-session`?l:{context:e}})}]},endpoints:{createApiKey:c.createApiKey,verifyApiKey:c.verifyApiKey,getApiKey:c.getApiKey,updateApiKey:c.updateApiKey,deleteApiKey:c.deleteApiKey,listApiKeys:c.listApiKeys,deleteAllExpiredApiKeys:c.deleteAllExpiredApiKeys},schema:i}}const x$=(e,t)=>({getAllKeys:async n=>t?.adapter?.getJwks?await t.adapter.getJwks(n):await(await xH(e)).findMany({model:`jwks`}),getLatestKey:async n=>{let r=/* @__PURE__ */ new Date,i=e=>!e.expiresAt||e.expiresAt>r;return t?.adapter?.getJwks?(await t.adapter.getJwks(n))?.filter(i).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]:(await(await xH(e)).findMany({model:`jwks`}))?.filter(i).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]},getKeyById:async(n,r)=>t?.adapter?.getJwks?(await t.adapter.getJwks(n))?.find(e=>e.id===r):await(await xH(e)).findOne({model:`jwks`,where:[{field:`id`,value:r}]})??void 0,getLatestKeyByAlg:async(n,r)=>{let i=t?.adapter?.getJwks?await t.adapter.getJwks(n):await(await xH(e)).findMany({model:`jwks`});if(!i)return;let a=t?.jwks?.keyPairConfig?.alg??`EdDSA`,o=/* @__PURE__ */ new Date;return i.filter(e=>e.alg===r||e.alg==null&&a===r).filter(e=>!e.expiresAt||e.expiresAt>o).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]},createJwk:async(n,r)=>t?.adapter?.createJwk?await t.adapter.createJwk(r,n):await(await xH(e)).create({model:`jwks`,data:{...r,createdAt:/* @__PURE__ */ new Date}})});function S$(e,t){return typeof e==`number`?e:e instanceof Date?Math.floor(e.getTime()/1e3):t+pG(e)}async function the(e){let{alg:t,...n}=e?.jwks?.keyPairConfig??{alg:`EdDSA`,crv:`Ed25519`},{publicKey:r,privateKey:i}=await Rde(t,{...n,extractable:!0});return{publicWebKey:await sI(r),privateWebKey:await sI(i),alg:t,cfg:n}}async function C$(e,t){let{publicWebKey:n,privateWebKey:r,alg:i,cfg:a}=await the(t),o=a&&`crv`in a?a.crv:void 0,s=typeof n.crv==`string`?n.crv:void 0,c=o??s,l=JSON.stringify(r),u=!t?.jwks?.disablePrivateKeyEncryption,d={alg:i,...c?{crv:c}:{},publicKey:JSON.stringify(n),privateKey:u?JSON.stringify(await LW({key:e.context.secretConfig,data:l})):l,createdAt:/* @__PURE__ */ new Date,...t?.jwks?.rotationInterval?{expiresAt:new Date(Date.now()+t.jwks.rotationInterval*1e3)}:{}};return await x$(e.context.adapter,t).createJwk(e,d)}async function w$(e,t,n){if(t?.jwt?.sign)return null;let r=x$(e.context.adapter,t),i;if(n?.signingKeyId!==void 0){if(i=await r.getKeyById(e,n.signingKeyId),!i)throw new D(`signJWT: signingKeyId "${n.signingKeyId}" not found in JWKS. The key must be provisioned before it can be referenced.`);if(n.signingAlgorithm!==void 0){let e=t?.jwks?.keyPairConfig?.alg??`EdDSA`;if((i.alg??e)!==n.signingAlgorithm)throw new D(`signJWT: signingKeyId "${n.signingKeyId}" has alg "${i.alg??`unset (inherits keyPairConfig.alg "${e}")`}" but signingAlgorithm was set to "${n.signingAlgorithm}".`)}}else if(n?.signingAlgorithm!==void 0){if(i=await r.getLatestKeyByAlg(e,n.signingAlgorithm),!i){let r=t?.jwks?.keyPairConfig?.alg??`EdDSA`,a=t?.jwks?.keyPairConfigs?.find(e=>e.alg===n.signingAlgorithm),o=r===n.signingAlgorithm;if(a||o)i=await C$(e,{...t,jwks:{...t?.jwks,keyPairConfig:a??t?.jwks?.keyPairConfig}});else{let e=t?.jwks?.keyPairConfigs?.map(e=>e.alg).join(`, `)||`none`;throw new D(`signJWT: no key with alg "${n.signingAlgorithm}" found in JWKS. The plugin auto-mints only one key matching keyPairConfig.alg="${r}"; additional algs configured via keyPairConfigs: ${e}. Add "${n.signingAlgorithm}" to jwks.keyPairConfigs so the plugin provisions it on first use, or mint the key explicitly via createJwk().`)}}}else{let n=t?.jwks?.keyPairConfig?.alg??`EdDSA`;i=await r.getLatestKeyByAlg(e,n)??await r.getLatestKey(e)}if(!i||i.expiresAt&&i.expiresAt</* @__PURE__ */ new Date){if(n?.signingKeyId!==void 0||n?.signingAlgorithm!==void 0)throw new D(`signJWT: requested signing key is expired and an explicit kid/alg was provided; not auto-minting a replacement. Rotate the key explicitly.`);i=await C$(e,t)}let a=t?.jwks?.disablePrivateKeyEncryption?i.privateKey:await RW({key:e.context.secretConfig,data:JSON.parse(i.privateKey)}).catch(()=>{throw new D(`Failed to decrypt private key. Make sure the secret currently in use is the same as the one used to encrypt the private key. If you are using a different secret, either clean up your JWKS or disable private key encryption.`)}),o=i.alg??t?.jwks?.keyPairConfig?.alg??`EdDSA`,s=await hI(JSON.parse(a),o);return{alg:o,kid:i.id,privateKey:s}}async function T$(e,t){let{options:n}=t,r=t.payload,i=Math.floor(Date.now()/1e3),a=r.iat,o=r.exp,s=S$(n?.jwt?.expirationTime??`15m`,a??i);o??=s;let c=r.nbf,l=typeof e.context.options.baseURL==`string`?e.context.options.baseURL:``,u=r.iss,d=n?.jwt?.issuer??l,f=r.aud,p=n?.jwt?.audience??l;if(n?.jwt?.sign){let e={...r,iat:a,exp:o,nbf:c,iss:u??d,aud:f??p};return n.jwt.sign(e,t.header,{signingKeyId:t.signingKeyId,signingAlgorithm:t.signingAlgorithm})}let{alg:m,kid:h,privateKey:g}=t.resolvedKey??await w$(e,n,{signingKeyId:t.signingKeyId,signingAlgorithm:t.signingAlgorithm}),_=new iI(r).setProtectedHeader({...t.header,alg:m,kid:h}).setExpirationTime(o).setIssuer(u??d).setAudience(f??p);return a&&_.setIssuedAt(a),r.sub&&_.setSubject(r.sub),r.nbf&&_.setNotBefore(r.nbf),r.jti&&_.setJti(r.jti),await _.sign(g)}async function E$(e,t){let n=t?.jwt?.definePayload?await t.jwt.definePayload(e.context.session):e.context.session.user;return await T$(e,{options:t,payload:{iat:Math.floor(Date.now()/1e3),...n,sub:await t?.jwt?.getSubject?.(e.context.session)??e.context.session.user.id}})}function D$(e){let t=e.context.options.baseURL;return typeof t==`string`?t||`better-auth:session-cache`:e.context.baseURL||`better-auth:session-cache`}async function nhe(e,t,n){let r=gI(t),i=r.kid;if(!i)return e.context.logger.debug(`Cookie-cache JWT missing kid in header`),null;let a=await x$(e.context.adapter,n).getAllKeys(e);if(!a?.length)return e.context.logger.debug(`No JWKS keys available for cookie-cache JWT`),null;let o=a.find(e=>e.id===i);if(!o)return e.context.logger.debug(`No JWKS key found for cookie-cache JWT kid: ${i}`),null;let s=o.alg??n?.jwks?.keyPairConfig?.alg??r.alg;return s?{alg:s,publicKey:await hI(JSON.parse(o.publicKey),s)}:(e.context.logger.debug(`No JWT algorithm available for cookie-cache JWT kid: ${i}`),null)}async function rhe(e,t,n,r){let i=await w$(e,r);if(!i)throw new D("`jwt({ sessionCookieCache: true })` requires locally managed JWT plugin keys and does not support `jwt.sign`.");return await new iI({...t,sid:t.session.token}).setProtectedHeader({alg:i.alg,kid:i.kid,typ:`better-auth.session-cache+jwt`}).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+n).setIssuer(D$(e)).setAudience(`better-auth:session-cache`).setSubject(t.user.id).sign(i.privateKey)}async function ihe(e,t,n){try{if(gI(t).typ!==`better-auth.session-cache+jwt`)return null;let r=await nhe(e,t,n);if(!r)return null;let{payload:i}=await nI(t,r.publicKey,{...EG({issuer:D$(e)}),algorithms:[r.alg]}),a=DG(i);return a?{payload:a,expiresAt:a.exp?a.exp*1e3:Date.now()}:null}catch(t){return e.context.logger.debug(`Cookie-cache JWT verification failed`,t),null}}function ahe(e){return{sign:(t,n,r)=>rhe(t,n,r,e),verify:(t,n)=>ihe(t,n,e)}}const ohe={jwks:{fields:{publicKey:{type:`string`,required:!0},privateKey:{type:`string`,required:!0},createdAt:{type:`date`,required:!0},expiresAt:{type:`date`,required:!1},alg:{type:`string`,required:!1},crv:{type:`string`,required:!1}}}};async function she(e,t){let n=fH();try{let r=e.split(`.`);if(r.length!==3)return null;let i=new TextDecoder().decode(ue.decode(r[0])),a=JSON.parse(i).kid;if(!a)return n.context.logger.debug(`JWT missing kid in header`),null;let o=await x$(n.context.adapter,t).getAllKeys(n);if(!o||o.length===0)return n.context.logger.debug(`No JWKS keys available`),null;let s=o.find(e=>e.id===a);if(!s)return n.context.logger.debug(`No JWKS key found for kid: ${a}`),null;let c=await hI(JSON.parse(s.publicKey),s.alg??t?.jwks?.keyPairConfig?.alg??`EdDSA`),l=typeof n.context.options.baseURL==`string`?n.context.options.baseURL:void 0,{payload:u}=await nI(e,c,{issuer:t?.jwt?.issuer??l,audience:t?.jwt?.audience??l});return!u.sub||!u.aud?null:u}catch(e){return n.context.logger.debug(`JWT verification failed`,e),null}}const che=A({payload:Ne(k(),Ke()),overrideOptions:Ne(k(),Ke()).optional()}),lhe=A({token:k(),issuer:k().optional()}),uhe=e=>{if(e?.jwt?.sign&&!e.jwks?.remoteUrl)throw new D(`options.jwks.remoteUrl must be set when using options.jwt.sign`);if(e?.jwks?.remoteUrl&&!e.jwks?.keyPairConfig?.alg)throw new D(`options.jwks.keyPairConfig.alg must be specified when options.jwks.remoteUrl is used for OpenID metadata`);let t=e?.jwks?.jwksPath??`/jwks`;if(typeof t!=`string`||t.length===0||!t.startsWith(`/`)||t.includes(`..`))throw new D(`options.jwks.jwksPath must be a non-empty string starting with '/' and not contain '..'`);return{id:`jwt`,version:`1.7.10`,options:e,init(t){if(!e?.sessionCookieCache)return;if(t.options.session?.cookieCache?.strategy!==`jwt`)throw new D('`jwt({ sessionCookieCache: true })` requires `session.cookieCache.strategy = "jwt"`.');if(e.jwt?.sign)throw new D("`jwt({ sessionCookieCache: true })` requires locally managed JWT plugin keys and does not support `jwt.sign`.");let n=e.jwks?.gracePeriod,r=t.options.session.cookieCache.maxAge||300;return n!==void 0&&r>n&&t.logger.warn(`[better-auth] \`session.cookieCache.maxAge\` (${r}s) exceeds the JWT plugin JWKS grace period (${n}s). Rotated keys may stop verifying cookie-cache JWTs before the cookie expires.`),{context:{sessionConfig:{...t.sessionConfig,cookieCacheSigner:ahe(e)}}}},endpoints:{getJwks:X(t,{method:`GET`,metadata:{openapi:{operationId:`getJSONWebKeySet`,description:`Get the JSON Web Key Set`,responses:{200:{description:`JSON Web Key Set retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{keys:{type:`array`,description:`Array of public JSON Web Keys`,items:{type:`object`,properties:{kid:{type:`string`,description:`Key ID uniquely identifying the key, corresponds to the 'id' from the stored Jwk`},kty:{type:`string`,description:`Key type (e.g., 'RSA', 'EC', 'OKP')`},alg:{type:`string`,description:`Algorithm intended for use with the key (e.g., 'EdDSA', 'RS256')`},use:{type:`string`,description:`Intended use of the public key (e.g., 'sig' for signature)`,enum:[`sig`],nullable:!0},n:{type:`string`,description:`Modulus for RSA keys (base64url-encoded)`,nullable:!0},e:{type:`string`,description:`Exponent for RSA keys (base64url-encoded)`,nullable:!0},crv:{type:`string`,description:`Curve name for elliptic curve keys (e.g., 'Ed25519', 'P-256')`,nullable:!0},x:{type:`string`,description:`X coordinate for elliptic curve keys (base64url-encoded)`,nullable:!0},y:{type:`string`,description:`Y coordinate for elliptic curve keys (base64url-encoded)`,nullable:!0}},required:[`kid`,`kty`,`alg`]}}},required:[`keys`]}}}}}}}},async t=>{if(e?.jwks?.remoteUrl)throw new E(`NOT_FOUND`);let n=x$(t.context.adapter,e),r=await n.getAllKeys(t);if((!r||r?.length===0)&&(await C$(t,e),r=await n.getAllKeys(t)),!r?.length)throw new D(`No key sets found. Make sure you have a key in your database.`);let i=Date.now(),a=(e?.jwks?.gracePeriod??2592e3)*1e3,o=r.filter(e=>!e.expiresAt||e.expiresAt.getTime()+a>i),s=e?.jwks?.keyPairConfig,c=s&&`crv`in s?s.crv:void 0;return t.json({keys:o.map(t=>({alg:t.alg??e?.jwks?.keyPairConfig?.alg??`EdDSA`,crv:t.crv??c,...JSON.parse(t.publicKey),kid:t.id}))})}),getToken:X(`/token`,{method:`GET`,requireHeaders:!0,use:[BJ],metadata:{openapi:{operationId:`getJSONWebToken`,description:`Get a JWT token`,responses:{200:{description:`Success`,content:{"application/json":{schema:{type:`object`,properties:{token:{type:`string`}}}}}}}}}},async t=>{let n=await E$(t,e);return t.json({token:n})}),signJWT:X.serverOnly({method:`POST`,metadata:{$Infer:{body:{}}},body:che},async t=>{let n=await T$(t,{options:{...e,...t.body.overrideOptions},payload:t.body.payload});return t.json({token:n})}),verifyJWT:X.serverOnly({method:`POST`,metadata:{$Infer:{body:{},response:{}}},body:lhe},async t=>{let n=t.body.issuer?{...e,jwt:{...e?.jwt,issuer:t.body.issuer}}:e,r=await she(t.body.token,n);return t.json({payload:r})})},hooks:{after:[{matcher(e){return e.path===`/get-session`},handler:Rq(async t=>{if(e?.disableSettingJwtHeader)return;let n=t.context.session||t.context.newSession;if(n&&n.session){let n=await E$(t,e),r=t.context.responseHeaders?.get(`access-control-expose-headers`)||``,i=new Set(r.split(`,`).map(e=>e.trim()).filter(Boolean));i.add(`set-auth-jwt`),t.setHeader(`set-auth-jwt`,n),t.setHeader(`Access-Control-Expose-Headers`,Array.from(i).join(`, `))}})}]},schema:cG(ohe,e?.schema)}};var O$=Object.defineProperty,k$=(e,t)=>{let n={};for(var r in e)O$(n,r,{get:e[r],enumerable:!0});return t||O$(n,Symbol.toStringTag,{value:`Module`}),n};const A$=`ba_iat`,j$=`ba_pl`,M$=`ba_param`;function N$(e){let t=new URLSearchParams,n=[...e.entries()].sort(([e,t],[n,r])=>e<n?-1:e>n?1:t<r?-1:+(t>r));for(let[e,r]of n)t.append(e,r);return t}function dhe(e){e.delete(M$);let t=[.../* @__PURE__ */ new Set([...e.keys(),M$])].sort();for(let n of t)e.append(M$,n)}function fhe(e){let t=new URLSearchParams(e).get(A$);if(!t)return null;let n=Number(t);return!Number.isFinite(n)||n<=0?null:new Date(n)}const phe=[`authorization_code`,`client_credentials`,`refresh_token`],P$=[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],mhe=[`none`,...P$],hhe=new Set(mhe);function F$(e,t){if(!(t.trim().length>0))throw new D(`OAuth Provider extension ${e} cannot be empty`)}function I$(e,t){F$(e,t);let n;try{n=new URL(t)}catch{n=void 0}if(!n?.protocol)throw new D(`OAuth Provider extension ${e} must be an absolute URI: ${t}`)}function ghe(e){I$(`grant type`,e)}function _he(e){if(F$(`token_endpoint_auth_method`,e),hhe.has(e))throw new D(`OAuth Provider extension token_endpoint_auth_method is reserved: ${e}`)}function vhe(e){if(I$(`client_assertion_type`,e),e===`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)throw new D(`OAuth Provider extension client_assertion_type is reserved: ${e}`)}function yhe(e){let t=Object.keys(e.grants??{});for(let e of t)ghe(e);let n=[],r=[];for(let[t,i]of Object.entries(e.clientAuthentication??{})){_he(t),n.push(t);let e=i.assertionTypes??[t];if(e.length===0)throw new D(`OAuth Provider extension client_assertion_type list cannot be empty for ${t}`);for(let t of e)vhe(t),r.push(t)}let i=(e.clientDiscovery?Array.isArray(e.clientDiscovery)?e.clientDiscovery:[e.clientDiscovery]:[]).map(e=>e.id);for(let e of i)F$(`client discovery id`,e);return{grantTypes:t,authMethods:n,assertionTypes:r,clientDiscoveryIds:i}}function L$(e,t){let n=/* @__PURE__ */ new Set;for(let r of t){if(n.has(r))throw new D(`OAuth Provider extensions register ${e} "${r}" more than once. Extension contributions must be disjoint.`);n.add(r)}}function R$(e){let t=(e??[]).map(yhe);L$(`grant type`,t.flatMap(e=>e.grantTypes)),L$(`token_endpoint_auth_method`,t.flatMap(e=>e.authMethods)),L$(`client_assertion_type`,t.flatMap(e=>e.assertionTypes)),L$(`client discovery id`,t.flatMap(e=>e.clientDiscoveryIds))}function z$(e){return e.extensions??[]}function B$(e){return z$(e).flatMap(e=>{let t=e.clientDiscovery;return t?Array.isArray(t)?t:[t]:[]})}function bhe(e,t){let n=e.getPlugin(`oauth-provider`);if(!n)throw new D(`extendOAuthProvider requires the oauth-provider plugin.`);let r=n.options.extensions??[];if(r.includes(t))return;let i=[...r,t];R$(i),n.options.extensions=i}function xhe(e){return z$(e).flatMap(e=>Object.keys(e.grants??{}))}function V$(e){return Array.from(/* @__PURE__ */ new Set([...e.grantTypes??phe,...xhe(e)]))}function She(e,t){for(let n of z$(e)){let e=n.grants?.[t];if(e)return e}}function H$(e){return z$(e).flatMap(e=>Object.keys(e.clientAuthentication??{}))}function U$(e,t){return Array.from(/* @__PURE__ */ new Set([...t?.includeNone?[`none`]:[],...P$,...H$(e)]))}function W$(e,t){return t?H$(e).includes(t):!1}function Che(e,t){if(t!==`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)for(let n of z$(e)){let e=n.clientAuthentication??{};for(let[n,r]of Object.entries(e))if((r.assertionTypes??[n]).includes(t))return{method:n,strategy:r}}}function G$(e,t,n,r){let i={...r};for(let a of z$(t)){let o=a.metadata?.({ctx:e,opts:t,type:n,document:r});for(let[e,t]of Object.entries(o??{}))e in i||(i[e]=t)}return i}async function K$(e,t){let n={};for(let r of z$(e)){let e=await t(r)??{};for(let[t,r]of Object.entries(e))t in n?f.warn(`oauth-provider: two extensions contributed the claim "${t}"; keeping the first-registered value.`):n[t]=r}return n}function whe(e,t){return K$(e,e=>e.claims?.accessToken?.(t))}function The(e,t){return K$(e,e=>e.claims?.idToken?.(t))}function Ehe(e,t){return K$(e,e=>e.claims?.userInfo?.(t))}function Dhe(e){return z$(e).some(e=>e.claims?.userInfo)}function Ohe(e){if(!e)return;let[t,n,...r]=e.trim().split(/\s+/);if(t?.toLowerCase()===`bearer`){if(!n||r.length>0)throw new O(`BAD_REQUEST`,{error:`invalid_request`,error_description:`Malformed Bearer Authorization header`});return n}}function khe(){let e=/* @__PURE__ */ new Map;return{get(t){let n=e.get(t);if(n){if(n.expiresAt&&n.expiresAt</* @__PURE__ */ new Date)e.delete(t);else return n}},set(t,n){e.set(t,n)}}}const q$=e=>{let t=e.getPlugin(`jwt`);if(!t)throw new D(`jwt_config`);return t},Ahe=/* @__PURE__ */ new Set([hP.code,fP.code,mP.code]);function J$(e){return e instanceof nP&&!Ahe.has(e.code)}function Y$(e){if(e!=null){if(e instanceof Date)return Number.isFinite(e.getTime())?e:void 0;if(typeof e==`number`){if(!Number.isFinite(e))return;let t=new Date(e);return Number.isFinite(t.getTime())?t:void 0}if(typeof e==`string`){let t=e.trim();if(!t.length)return;let n=Number(t);if(Number.isFinite(n)){let e=new Date(n);return Number.isFinite(e.getTime())?e:void 0}let r=new Date(t);return Number.isFinite(r.getTime())?r:void 0}}}function jhe(e){if(e instanceof Date||!e||typeof e!=`object`)return Y$(e);let t=Y$(e.createdAt)??Y$(e.created_at);if(t)return t;let n=e.session;if(n&&typeof n==`object`)return Y$(n.createdAt)??Y$(n.created_at)}function X$(e){if(typeof e==`string`)return[e];if(e?.length)return e}function Z$(e){if(typeof e==`string`)return e;if(e?.length)return e.length===1?e.at(0):e}const Q$=/* @__PURE__ */ new WeakMap;function Mhe(e){let t=Q$.get(e);if(t)return t;let n=khe();return Q$.set(e,n),n}async function $$(e,t){let n=new URLSearchParams(e),r=n.get(`sig`),i=n.getAll(`sig`),a=Number(n.get(`exp`));n.delete(`sig`);let o=await BW(N$(n).toString(),t);return i.length===1&&!!r&&CU(r,o)&&/* @__PURE__ */ new Date(a*1e3)>=/* @__PURE__ */ new Date}function e1(e,t){if(e.cachedTrustedClients?.has(t))throw new O(`BAD_REQUEST`,{error:`invalid_client`,error_description:`trusted clients must be updated manually`})}async function t1(e,t,n){let r=Mhe(t),i=r.get(n);if(i&&!i.clientDiscoveryId)return Object.assign({},i);let a=await e.context.adapter.findOne({model:t.schema?.oauthClient?.modelName??`oauthClient`,where:[{field:`clientId`,value:n}]}),o=B$(t);if(a?.clientDiscoveryId){let t=a.clientDiscoveryId,r=o.find(e=>e.id===t);if(!r?.matches(n)||(a=await r.resolve(e,n,a),!a))return null}else if(a)return t.cachedTrustedClients?.has(n)&&r.set(n,Object.assign({},a)),a;else for(let t of o){if(!t.matches(n))continue;let r=await t.resolve(e,n,null);if(r){a=r;break}}return a}function n1(e){return e.reduce((e,t)=>({...e,...t.discoveryMetadata??{}}),{})}const r1=async e=>{let t=await jU(`SHA-256`).digest(new TextEncoder().encode(e));return ye.encode(new Uint8Array(t),{padding:!1})};async function i1(e,t,n){if(t===`encrypted`)return await RW({key:e.context.secretConfig,data:n});if(typeof t==`object`&&`decrypt`in t)return await t.decrypt(n);throw new D(`Unsupported decryption storageMethod type '${t}'`)}async function Nhe(e,t,n,r){let i=t.storeClientSecret??(t.disableJwtPlugin?`encrypted`:`hashed`);if(r&&t.prefix?.clientSecret){if(r.startsWith(t.prefix?.clientSecret))r=r.replace(t.prefix.clientSecret,``);else throw new O(`UNAUTHORIZED`,{error_description:`invalid client_secret`,error:`invalid_client`})}if(i===`hashed`){let e=r?await r1(r):void 0;return!!e&&CU(e,n)}if(typeof i==`object`&&`hash`in i){if(i.verify)return!!r&&await i.verify(r,n);{let e=r?await i.hash(r):void 0;return!!e&&CU(e,n)}}if(i===`encrypted`)try{let t=await i1(e,i,n);return!!r&&CU(t,r)}catch{return!1}if(typeof i==`object`&&`decrypt`in i){let t=await i1(e,i,n);return!!r&&CU(t,r)}throw new D(`Unsupported verify storageMethod type '${i}'`)}async function a1(e,t,n){let r=t.storeClientSecret??(t.disableJwtPlugin?`encrypted`:`hashed`);if(r===`encrypted`)return await LW({key:e.context.secretConfig,data:n});if(r===`hashed`)return await r1(n);if(typeof r==`object`&&`hash`in r)return await r.hash(n);if(typeof r==`object`&&`encrypt`in r)return await r.encrypt(n);throw new D(`Unsupported storeClientSecret type '${r}'`)}async function o1(e=`hashed`,t,n){if(e===`hashed`)return await r1(t);if(typeof e==`object`&&`hash`in e)return await e.hash(t,n);throw new D(`storeToken: unsupported storageMethod type '${e}'`)}async function s1(e=`hashed`,t,n){if(e===`hashed`)return await r1(t);if(typeof e==`object`&&`hash`in e)return await e.hash(t,n);throw new D(`getStoredToken: unsupported storageMethod type '${e}'`)}const c1=/^Basic +/i,Phe=/^([!#$%&'*+\-.^_`|~0-9A-Za-z]+)(?=\s|$)/;function Fhe(e){return e.match(Phe)?.[1]}const l1=[`client_secret`,`client_assertion`,`client_assertion_type`];function u1(e){throw new O(`BAD_REQUEST`,{error:`invalid_request`,error_description:e})}async function Ihe(e,t={}){let n;t.client_id!==void 0&&t.client_id!==``&&(typeof t.client_id!=`string`&&u1(`client_id must be a string`),n=t.client_id);let r={},i=(e,t)=>{t!==void 0&&t!==``&&(typeof t!=`string`&&u1(`${e} must be a string`),r[e]=t)};for(let e of l1)Object.hasOwn(t,e)&&i(e,t[e]);let a=!!e?.headers.get(`authorization`);if(e&&(e.headers.get(`content-type`)?.toLowerCase()??``).includes(`application/x-www-form-urlencoded`)){let t=new URLSearchParams(await e.clone().text()),r=t.getAll(`client_id`).filter(e=>e.length>0);r.length>1&&u1(`client_id must not be repeated`),n=r[0];for(let e of l1){let n=t.getAll(e).filter(e=>e.length>0);n.length>1&&u1(`${e} must not be repeated`),n.length===1&&i(e,n[0])}}let o=r.client_secret!==void 0,s=r.client_assertion!==void 0||r.client_assertion_type!==void 0;(a&&(o||s)||o&&s)&&u1(`A request must use only one client authentication method`),t.client_id=n;for(let e of l1)t[e]=r[e];return{detected:a||Object.keys(r).length>0}}function Lhe(e){if(c1.test(e))try{let{clientId:t,clientSecret:n}=nX(e);return{client_id:t,client_secret:n}}catch{throw new O(`UNAUTHORIZED`,{error_description:`invalid authorization header format`,error:`invalid_client`},{"WWW-Authenticate":`Basic`})}}function d1(e,t){let n=e.grantTypes&&e.grantTypes.length>0?e.grantTypes:[`authorization_code`];return t===`refresh_token`&&n.includes(`authorization_code`)?!0:n.includes(t)}function f1(e,t){if(!t||!e.scopes)return;let n=new Set(e.scopes);for(let e of t)if(!n.has(e))throw new O(`BAD_REQUEST`,{error_description:`client does not allow scope ${e}`,error:`invalid_scope`})}function p1(e,t){let n=t?.method===`client_secret_basic`,r=t?.scheme??(n?`Basic`:void 0);throw new O(r?`UNAUTHORIZED`:`BAD_REQUEST`,{error_description:e,error:`invalid_client`},r?{"WWW-Authenticate":r}:void 0)}async function m1(e,t,n,r,i,a,o,s){let c=await t1(e,t,n);c||p1(`client not found`,{method:s}),c.disabled&&p1(`client is disabled`,{method:s});let l=c.tokenEndpointAuthMethod??`client_secret_basic`;if(s&&l!==s&&p1(`client registered for ${l} cannot use ${s}`,{method:s}),(c.tokenEndpointAuthMethod===`private_key_jwt`||W$(t,c.tokenEndpointAuthMethod))&&!a)throw new O(`BAD_REQUEST`,{error_description:`client registered for ${c.tokenEndpointAuthMethod} must use client_assertion`,error:`invalid_client`});if(a||(c.tokenEndpointAuthMethod!==`none`&&!r&&p1(`client secret must be provided`,{method:s}),r&&!c.clientSecret&&p1(`public client, client secret should not be received`,{method:s}),r&&!await Nhe(e,t,c.clientSecret,r)&&p1(`invalid client_secret`,{method:s})),f1(c,i),o&&!d1(c,o))throw new O(`BAD_REQUEST`,{error_description:`client is not authorized to use grant type ${o}`,error:`unauthorized_client`});return c}function h1(e){if(e)return typeof e==`string`?JSON.parse(e):e}function g1(e){return{clientId:e?.clientId,clientSecret:e?.kind===`client_secret`?e.clientSecret:void 0,preVerified:e?.kind===`pre_verified`,authMethod:e?.method,confirmation:e?.kind===`pre_verified`?e.confirmation:void 0}}async function _1(e,t,n){let r={...e.body??{}};await Ihe(e.request,r);let i=e.request?.headers.get(`authorization`)??void 0;if(r.client_assertion_type||r.client_assertion){if(!r.client_assertion||!r.client_assertion_type)throw new O(`BAD_REQUEST`,{error_description:`client_assertion and client_assertion_type must both be provided`,error:`invalid_client`});let i=r.client_assertion,a=r.client_assertion_type,o=Che(t,a);if(o){let s=await o.strategy.authenticate({ctx:e,opts:t,assertion:i,assertionType:a,clientId:r.client_id,expectedAudience:n});return{kind:`pre_verified`,method:o.method,clientId:s.clientId,confirmation:s.confirmation}}let{verifyClientAssertion:s}=await Promise.resolve().then(()=>o_e).then(e=>e.o);return{kind:`pre_verified`,method:`private_key_jwt`,clientId:(await s(e,t,i,a,r.client_id,n)).clientId}}if(i&&!c1.test(i)){let e=Fhe(i);if(!e)throw new O(`BAD_REQUEST`,{error:`invalid_request`,error_description:`Invalid authorization header format`});p1(`unsupported authorization scheme`,{scheme:e})}if(i&&c1.test(i)){let e=Lhe(i);if(e)return{kind:`client_secret`,method:`client_secret_basic`,clientId:e.client_id,clientSecret:e.client_secret}}return r.client_id&&r.client_secret?{kind:`client_secret`,method:`client_secret_post`,clientId:r.client_id,clientSecret:r.client_secret}:r.client_id?{kind:`public`,method:`none`,clientId:r.client_id}:null}function v1(e){let t=e.split(` `).map(e=>e.trim()),n=/* @__PURE__ */ new Set;for(let e of t)(e===`login`||e===`consent`||e===`create`||e===`select_account`||e===`none`)&&n.add(e);return new Set(n)}function Rhe(e){let t=e.redirectUris?.[0];if(!t)throw new D(`Client has no redirect URIs for sector identifier`);return new URL(t).host}async function zhe(e,t,n){return BW(`${Rhe(t)}.${e}`,n)}async function y1(e,t,n){return t.subjectType===`pairwise`&&n.pairwiseSecret?zhe(e,t,n.pairwiseSecret):e}async function b1(e,t){return await e.postLogin?.consentReferenceId?.(t)||void 0}async function x1(e,t,n,r){let i=[{field:`clientId`,value:t},{field:`userId`,value:n}];if(r)return e.context.adapter.findOne({model:`oauthConsent`,where:[...i,{field:`referenceId`,value:r}]});for(let t=0;;t+=100){let n=await e.context.adapter.findMany({model:`oauthConsent`,where:i,limit:100,offset:t,sortBy:{field:`id`,direction:`asc`}}),r=n.find(e=>!e.referenceId);if(r||n.length<100)return r??null}}function S1(e){let t=Object.create(null);for(let n of new Set(e.keys())){let r=e.getAll(n);t[n]=r.length===1?r[0]:r}return t}function C1(e,t){if(!t)return!1;let n=Y$(e);return n?n.getTime()>=t.getTime():!1}function w1(e,t){let n=new URLSearchParams(e),r=n.get(`prompt`)?.split(` `),i=r?.findIndex(e=>e===t)??-1;return i>=0&&(r?.splice(i,1),r?.length?n.set(`prompt`,r.join(` `)):n.delete(`prompt`)),n}function T1(e){let t=new URLSearchParams(e);return t.delete(`max_age`),t}function E1(e,t){if(e.tokenEndpointAuthMethod===`none`)return`pkce is required for public clients`;let n=t?.scopes??[],r=n.includes(`openid`),i=typeof t?.nonce==`string`&&t.nonce.length>0,a=r&&i;return n.includes(`offline_access`)&&!a?`pkce or OIDC nonce is required when requesting offline_access scope`:e.requirePKCE??!0?`pkce is required for this client`:!1}const Bhe=/^[a-z](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/i,Vhe=/* @__PURE__ */ new Set([`http:`,`https:`,`ws:`,`wss:`,`file:`,`ftp:`,`mailto:`,`javascript:`,`data:`,`vbscript:`,`blob:`,`about:`,`view-source:`]);function D1(e){let t=e.protocol.slice(0,-1),n=e.href.slice(e.protocol.length);return e.protocol!==`http:`&&e.protocol!==`https:`&&e.host.length===0&&n.startsWith(`/`)&&!n.startsWith(`//`)&&Bhe.test(t)}function Hhe(e){return Vhe.has(e.protocol)||e.host.length===0?!1:e.pathname.startsWith(`/`)}function O1(e){return D1(e)||Hhe(e)}const k1=iee().superRefine((e,t)=>{let n;try{n=new URL(e)}catch{return t.addIssue({code:`custom`,message:`URL must be parseable`,fatal:!0}),Be}bq.includes(n.protocol)?t.addIssue({code:`custom`,message:`URL cannot use javascript:, data:, or vbscript: scheme`}):(e.includes(`#`)&&t.addIssue({code:`custom`,message:`Redirect URI must not contain a fragment component`}),n.protocol===`http:`&&!xY(n.host)&&t.addIssue({code:`custom`,message:`Redirect URI must use HTTPS (HTTP allowed only for loopback hosts)`}))}),Uhe=/* @__PURE__ */ new Set([`iss`,`sub`,`aud`,`exp`,`nbf`,`iat`,`jti`,`auth_time`,`nonce`,`acr`,`amr`,`azp`,`sid`,`at_hash`,`c_hash`,`s_hash`]);function A1(e){if(!e)return{};let t=[],n=Object.create(null);for(let[r,i]of Object.entries(e))Uhe.has(r)?t.push(r):n[r]=i;return t.length>0&&f.warn(`oauth-provider: stripped reserved id-token claim name(s): ${t.join(`, `)}. The AS owns these claim values.`),n}const j1=Ne(k(),Je()).nullable(),Whe=Re({essential:He().optional(),value:k().optional(),values:Pe(k()).optional()}).nullable(),Ghe=A({acr:Whe.optional()}).catchall(j1),Khe=Re({userinfo:Ne(k(),j1).optional(),id_token:Ghe.optional()});function qhe(e){if(typeof e==`string`)try{return JSON.parse(e)}catch{return}return e}function M1(e){let t=qhe(e),n=Khe.safeParse(t);return n.success?n.data:void 0}const N1=Ee([k(),Ne(k(),Je())]),Jhe=N1,P1=N1.refine(e=>M1(e)!==void 0,{error:`claims must be a valid Claims request object`});function Yhe(e){return e===void 0||M1(e)!==void 0}function F1(e,t){let n=M1(e)?.userinfo;if(!n)return[];let r=Object.keys(n);if(!t)return r;let i=new Set(t);return r.filter(e=>i.has(e))}function Xhe(e,t){let n=M1(e);if(!n)return e===void 0;let r=n.id_token?.acr;if(!r||r.essential!==!0)return!0;let i=r.value===void 0||r.value===t,a=r.values===void 0||r.values.includes(t);return i&&a}function Zhe(e,t){let n=M1(e);if(!n)return;let r=new Set(t),i=Object.fromEntries(Object.entries(n.userinfo??{}).filter(([e])=>r.has(e))),a=Object.keys(i).length?{...n,userinfo:i}:Object.fromEntries(Object.entries(n).filter(([e])=>e!==`userinfo`));return Object.keys(a).length?a:void 0}function I1(e){let t=e.split(` `).filter(e=>e!==``);return t.length<=1?{}:{given:t.slice(0,-1).join(` `),family:t.at(-1)}}const L1={name:{scope:`profile`,resolve:e=>e.name??void 0},picture:{scope:`profile`,resolve:e=>e.image??void 0},given_name:{scope:`profile`,resolve:e=>I1(e.name).given},family_name:{scope:`profile`,resolve:e=>I1(e.name).family},email:{scope:`email`,resolve:e=>e.email??void 0},email_verified:{scope:`email`,resolve:e=>e.emailVerified??!1}},R1=Object.keys(L1);function z1(e){return e.advertisedMetadata?.claims_supported??e.claims??[]}const Qhe=/* @__PURE__ */ new Set([`iss`,`sub`,`aud`,`exp`,`iat`,`jti`,`client_id`,`scope`,`auth_time`,`acr`,`amr`,`cnf`]);function $he(e){if(!e)return{};let t=[],n={};for(let[r,i]of Object.entries(e))Qhe.has(r)?t.push(r):n[r]=i;return t.length>0&&f.warn(`oauth-provider: stripped reserved access-token claim name(s): ${t.join(`, `)}. The AS owns these claim values.`),n}async function B1(e){let{ctx:t,opts:n,user:r,client:i,scopes:a,resources:o,referenceId:s,metadata:c,grantType:l,sessionId:u,perRequestClaims:d,resourcePolicyClaims:f}=e,p=await whe(n,{ctx:t,opts:n,user:r,client:i,scopes:a,grantType:l,referenceId:s,sessionId:u,resources:o,metadata:c}),m=n.customAccessTokenClaims?await n.customAccessTokenClaims({user:r,scopes:a,resources:o,referenceId:s,metadata:c}):{};return $he({...p,...d??{},...m,...f})}const ege=[`javascript:`,`data:`,`vbscript:`],V1=k().superRefine((e,t)=>{if(!URL.canParse(e))return t.addIssue({code:`custom`,message:`resource must be an absolute URI`,fatal:!0}),Be;e.includes(`#`)?t.addIssue({code:`custom`,message:`resource must not contain a fragment`}):ege.includes(new URL(e).protocol)&&t.addIssue({code:`custom`,message:`resource cannot use javascript:, data:, or vbscript: scheme`})}),tge=We([`none`,`consent`,`login`,`create`,`select_account`]),nge=k().superRefine((e,t)=>{let n=e.split(` `).map(e=>e.trim()).filter(Boolean),r=/* @__PURE__ */ new Set;if(!n.length)t.addIssue({code:`custom`,message:`prompt must include at least one value`});else{for(let e of n){let n=tge.safeParse(e);n.success?r.add(n.data):t.addIssue({code:`custom`,message:`unsupported prompt value: ${e}`})}r.has(`none`)&&r.size>1&&t.addIssue({code:`custom`,message:`prompt=none cannot be combined with other prompt values`})}}),H1=A({keys:Pe(Ne(k(),Je())).min(1)}),rge=Ee([Me(),k().trim().min(1)]).transform((e,t)=>{let n=typeof e==`number`?e:Number(e);return!Number.isInteger(n)||n<0?(t.addIssue({code:`custom`,message:`max_age must be a non-negative integer`}),Be):n}),ige=k().regex(/^[A-Za-z0-9_-]{43}$/,`dpop_jkt must be a base64url-encoded SHA-256 JWK thumbprint`),U1=A({response_type:k().pipe(We([`code`])).optional(),request:k().optional(),request_uri:k().optional(),redirect_uri:k1.optional(),scope:k().optional(),state:k().optional(),client_id:k().min(1,`client_id is required`),prompt:nge.optional(),display:k().optional(),ui_locales:k().optional(),max_age:rge.optional(),acr_values:k().optional(),login_hint:k().optional(),id_token_hint:k().optional(),code_challenge:k().optional(),code_challenge_method:k().pipe(We([`S256`])).optional(),nonce:k().optional(),claims:Jhe.optional(),dpop_jkt:ige.optional(),resource:Ee([V1,Pe(V1).min(1)]).optional()}).passthrough(),age=U1.extend({redirect_uri:k1.optional(),claims:P1.optional()}),oge=A({type:Ue(`authorization_code`),query:age,sessionId:k(),userId:k(),referenceId:k().optional(),authTime:Me().optional(),resource:Pe(k()).optional()}).passthrough(),W1=A({redirect_uris:Pe(k1).min(1).optional(),scope:k().optional(),client_name:k().refine(e=>e.trim().length>0,`client_name cannot be empty`).optional(),client_uri:k().optional(),logo_uri:k().optional(),contacts:Pe(k().min(1)).min(1).optional(),tos_uri:k().optional(),policy_uri:k().optional(),software_id:k().optional(),software_version:k().optional(),software_statement:k().optional(),post_logout_redirect_uris:Pe(k1).min(1).optional(),backchannel_logout_uri:k1.optional(),backchannel_logout_session_required:He().optional(),token_endpoint_auth_method:k().trim().min(1).optional(),jwks:H1.optional(),jwks_uri:k().optional(),grant_types:Pe(k().trim().min(1)).min(1).optional(),response_types:Pe(We([`code`])).optional(),application_type:We([`web`,`native`]).optional(),subject_type:We([`public`,`pairwise`]).optional(),dpop_bound_access_tokens:He().optional(),resources:Pe(V1).optional(),skip_consent:Le({error:`skip_consent cannot be set during dynamic client registration`}).optional()}),sge=W1.omit({skip_consent:!0}).extend({client_id:k().refine(e=>e.trim().length>0,`client_id cannot be empty`),client_secret:k().optional(),client_secret_expires_at:Me().int().nonnegative().optional(),client_id_issued_at:Me().int().nonnegative().optional()}).loose(),G1=[`EdDSA`,`ES256`,`ES512`,`PS256`,`RS256`],cge=new Set(G1);async function K1(e,t){let n=e.identifierValidator;if(n)return await n(t)?{ok:!0}:{ok:!1,reason:`resource identifier ${t} failed validation`};let r=V1.safeParse(t);return r.success?{ok:!0}:{ok:!1,reason:`resource identifier ${t} is invalid: ${r.error.issues[0]?.message??`not an absolute URI`}`}}async function lge(e,t){let n=await K1(e,t);if(!n.ok)throw new E(`BAD_REQUEST`,{error:`invalid_target`,error_description:n.reason})}const uge=e=>`${e}/oauth2/userinfo`;async function dge(e){if(!(e.headers.get(`content-type`)?.toLowerCase()??``).includes(`application/x-www-form-urlencoded`))return;let t;try{t=await e.clone().text()}catch{return}if(!t)return;let n=new URLSearchParams(t).getAll(`resource`).filter(e=>e.length>0);return n.length>0?n:void 0}function fge(e){if(e!=null){if(typeof e==`string`)return[e];if(Array.isArray(e)){let t=e.filter(e=>typeof e==`string`&&e.length>0);return t.length>0?t:void 0}}}async function q1(e,t,n,r=[]){if(n===void 0)return!0;let i=Array.isArray(n)?n:[n];if(i.length>64)return!1;let a=new Set(r),o=/* @__PURE__ */ new Set;for(let e of i)a.has(e)||o.add(e);return o.size===0||(await Promise.all(Array.from(o,n=>Q1(e,t,n)))).every(Boolean)}async function J1(e,t,n){let r=fge(n.resource),i=n.requestedScopes.includes(`openid`),a=uge(e.context.baseURL??``);if(!r)return{audienceClaim:void 0,accessTokenTtl:null,refreshTokenTtl:null,signingAlgorithm:null,signingKeyId:null,rawCustomClaims:{},dpopBoundAccessTokensRequired:!1,effectiveScopes:[...n.requestedScopes]};let o=[...new Set(r)],s=[];for(let n of o){if(n===a)continue;let r=await Q1(e,t,n);if(r){if(r.disabled)throw new E(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is disabled`});s.push(r)}else throw new E(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is not configured`})}let{value:c}=Y1(t);c&&s.length>0&&await pge(e,t,n.clientId,s);let l=[...n.requestedScopes];for(let e of s){if(e.allowedScopes===null||e.allowedScopes===void 0)continue;let t=new Set(e.allowedScopes),n=l.filter(e=>t.has(e));if(n.length===0)throw new E(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`none of the requested scopes are allowed for resource ${e.identifier}`});l=n}let u=null,d=null;for(let e of s)e.accessTokenTtl!=null&&(u=u===null?e.accessTokenTtl:Math.min(u,e.accessTokenTtl)),e.refreshTokenTtl!=null&&(d=d===null?e.refreshTokenTtl:Math.min(d,e.refreshTokenTtl));let f=/* @__PURE__ */ new Set,p=/* @__PURE__ */ new Set;for(let e of s)e.signingAlgorithm&&f.add(e.signingAlgorithm),e.signingKeyId&&p.add(e.signingKeyId);if(f.size>1)throw new E(`BAD_REQUEST`,{error:`invalid_request`,error_description:`multi-resource request has conflicting signingAlgorithm pins; a single JWS signature cannot satisfy multiple algorithms`});if(p.size>1)throw new E(`BAD_REQUEST`,{error:`invalid_request`,error_description:`multi-resource request has conflicting signingKeyId pins; a single JWS signature cannot satisfy multiple key ids`});let m=f.values().next().value??null,h=p.values().next().value??null,g={};for(let e of s)e.customClaims&&typeof e.customClaims==`object`&&Object.assign(g,e.customClaims);let _=s.some(e=>e.dpopBoundAccessTokensRequired===!0),v=i?[...o,a]:o,y=[...new Set(v)];return{audienceClaim:y.length===1?y[0]:y,accessTokenTtl:u,refreshTokenTtl:d,signingAlgorithm:m,signingKeyId:h,rawCustomClaims:g,dpopBoundAccessTokensRequired:_,effectiveScopes:l}}async function pge(e,t,n,r){if(r.length===0)return;let i=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,a=await e.context.adapter.findMany({model:i,where:[{field:`clientId`,value:n}]}),o=new Set(a?.map(e=>e.resourceId)??[]),s=r.filter(e=>!o.has(e.identifier));if(s.length>0)throw new E(`BAD_REQUEST`,{error:`invalid_target`,error_description:`client ${n} is not linked to resource(s) ${s.map(e=>e.identifier).join(`, `)}`})}async function mge(e,t,n,r){if(r.length===0)return!1;let i=t.schema?.oauthClientResource?.modelName??`oauthClientResource`;return((await e.context.adapter.findMany({model:i,where:[{field:`clientId`,value:n},{field:`resourceId`,operator:`in`,value:r}],limit:1}))?.length??0)>0}async function hge(e,t,n){if(n.length===0)return{};let r=await e.context.adapter.findMany({model:t.schema?.oauthResource?.modelName??`oauthResource`,where:[{field:`identifier`,operator:`in`,value:n}]}),i=new Map(r.map(e=>[e.identifier,e])),a={};for(let e of n){let t=i.get(e);t?.customClaims&&typeof t.customClaims==`object`&&Object.assign(a,t.customClaims)}return a}function Y1(e){return e.enforcePerClientResources===void 0?{value:!0,source:`default`}:{value:e.enforcePerClientResources,source:`explicit`}}const X1=/* @__PURE__ */ new Map;function Z1(e){e===void 0?X1.clear():X1.delete(e)}async function Q1(e,t,n){if(await t0(e.context,t),t.cachedResources?.has(n)){let e=X1.get(n);if(e)return Object.assign({},e)}let r=await e.context.adapter.findOne({model:t.schema?.oauthResource?.modelName??`oauthResource`,where:[{field:`identifier`,value:n}]});return r&&t.cachedResources?.has(n)&&X1.set(n,Object.assign({},r)),r}function gge(e){return e.name??e.identifier}function _ge(e){let t=[];if(e.resources?.length)for(let n of e.resources)t.push(typeof n==`string`?{identifier:n}:n);return t}function $1(e,t){return{identifier:e.identifier,name:gge(e),accessTokenTtl:e.accessTokenTtl??null,refreshTokenTtl:e.refreshTokenTtl??null,signingAlgorithm:e.signingAlgorithm??null,signingKeyId:e.signingKeyId??null,allowedScopes:e.allowedScopes??null,customClaims:e.customClaims??null,dpopBoundAccessTokensRequired:e.dpopBoundAccessTokensRequired??!1,disabled:e.disabled??!1,policyVersion:1,metadata:e.metadata??null,createdAt:t,updatedAt:t}}function vge(e,t,n){if(t===`overwrite`){let{identifier:t,createdAt:r,...i}=$1(e,n);return i}let r={updatedAt:n};return e.name!==void 0&&(r.name=e.name),e.accessTokenTtl!==void 0&&(r.accessTokenTtl=e.accessTokenTtl),e.refreshTokenTtl!==void 0&&(r.refreshTokenTtl=e.refreshTokenTtl),e.signingAlgorithm!==void 0&&(r.signingAlgorithm=e.signingAlgorithm),e.signingKeyId!==void 0&&(r.signingKeyId=e.signingKeyId),e.allowedScopes!==void 0&&(r.allowedScopes=e.allowedScopes),e.customClaims!==void 0&&(r.customClaims=e.customClaims),e.dpopBoundAccessTokensRequired!==void 0&&(r.dpopBoundAccessTokensRequired=e.dpopBoundAccessTokensRequired),e.disabled!==void 0&&(r.disabled=e.disabled),e.metadata!==void 0&&(r.metadata=e.metadata),r}const yge=/no such table|relation.*does not exist|table.*does(?: not|n'?t) exist|model.*(?:does not exist|was not found in the schema)/i;function bge(e,t){let n=!1,r=t;for(let e=0;r&&!n&&e<5;e++)n=yge.test(r instanceof Error?r.message:String(r)),r=r instanceof Error?r.cause:void 0;n?e.logger.debug(`oauth-provider: oauthResource table not yet created; deferring resource seed to first access.`):e.logger.error("oauth-provider: could not seed `resources` at startup; retrying on first resource access.",t)}let e0=/* @__PURE__ */ new WeakMap;function xge(e,t){let n=e.adapter,r=e0.get(n);r||(r=/* @__PURE__ */ new WeakMap,e0.set(n,r));let i=r.get(t);if(i)return i;let a={completed:!1,promise:null};return r.set(t,a),a}async function Sge(e,t){let n=_ge(t);if(n.length===0)return;let r=t.resourceSeedMode??`insertOnly`,i=t.schema?.oauthResource?.modelName??`oauthResource`;for(let a of n){let n=await K1(t,a.identifier);if(!n.ok){f.warn(`oauth-provider: skipping resource seed for ${a.identifier} — ${n.reason}`);continue}let o=a;if(o.signingAlgorithm!=null&&!cge.has(o.signingAlgorithm)){f.warn(`oauth-provider: dropping unsupported signingAlgorithm "${o.signingAlgorithm}" for resource ${o.identifier} — must be one of ${G1.join(`, `)}. Continuing without an algorithm override.`);let{signingAlgorithm:e,...t}=o;o=t}let s=[{field:`identifier`,value:o.identifier}],c=await e.adapter.findOne({model:i,where:s}),l=/* @__PURE__ */ new Date;if(!c)try{await e.adapter.create({model:i,data:$1(o,l)});continue}catch(t){if(!await e.adapter.findOne({model:i,where:s}).catch(()=>null))throw t}r!==`insertOnly`&&await e.adapter.update({model:i,where:s,update:vge(o,r,l)})}}async function t0(e,t){let n=xge(e,t);if(n.completed!==!0)return n.promise===null&&(n.promise=Sge(e,t).then(()=>{n.completed=!0}).catch(e=>{throw n.promise=null,e})),n.promise}function Cge(e){let t=Y1(e);f.info(`oauth-provider: enforcePerClientResources resolved to ${t.value} (${t.source})`)}function n0(e){return e.headers?.get(`dpop`)??void 0}function r0(e,t){let{baseURL:n}=e.context,r=n.length;for(;r>0&&n[r-1]===`/`;)r--;let i=n.slice(0,r);if(!e.request||!i)return`${i}${t}`;let a=new URL(i).pathname.replace(/\/$/,``),o=new URL(e.request.url).pathname;return`${i}${o.startsWith(`${a}/`)?o.slice(a.length):t}`}const wge=/* @__PURE__ */ new Set([`openid`,`profile`,`email`,`offline_access`]);function i0(e){return wge.has(e)}function a0(e){return[...new Set(e.map(e=>e.trim()).filter(Boolean))]}function o0(e,t,n,r){if(e.length===0)return;if(!t.includes(`client_credentials`))throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`client_credentials_scopes requires the client_credentials grant`});if(n===`none`)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`public clients cannot be assigned client_credentials scopes`});let i=new Set(r.scopes??[]),a=e.filter(e=>!i.has(e)||i0(e));if(a.length>0)throw new E(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`The following client_credentials scopes are invalid: ${a.join(`, `)}`})}function Tge(e,t,n=[]){let r=new Set(n),i={sub:e.id??void 0};for(let[n,a]of Object.entries(L1))(t.includes(a.scope)||r.has(n))&&(i[n]=a.resolve(e));return i}function s0(e,t){let n={};for(let[r,i]of Object.entries(e??{}))i!==void 0&&(t&&r in t||(n[r]=i));return n}function Ege(e){let t=e.headers?.get(`authorization`),n=aZ(t),r=e.request?.method===`POST`?e.body?.access_token??void 0:void 0;if(n&&r)throw new E(`BAD_REQUEST`,{error_description:`Multiple access token transport methods are not allowed`,error:`invalid_request`});let i=n??(r?{scheme:`Bearer`,token:r}:void 0);return{authorization:i,token:i?.token}}async function Dge(e,t){let{authorization:n}=Ege(e);if(!n?.token)throw new E(`UNAUTHORIZED`,{error_description:`access token not found`,error:`invalid_request`});let{payload:r,requestedUserInfoClaims:i}=await k0(e,t,n.token);if(dZ(r)&&!e.request)throw new E(`UNAUTHORIZED`,{error_description:`DPoP-bound access token requires an HTTP request context`,error:`invalid_token`});try{await xZ({payload:r,authorization:n,proofJwt:n0(e),method:e.request?.method??`GET`,url:r0(e,`/oauth2/userinfo`),proofMaxAgeSeconds:t.dpop?.proofMaxAgeSeconds,signingAlgorithms:t.dpop?.signingAlgorithms,replayStore:nZ(e.context.internalAdapter)})}catch(e){throw bZ(e)?new E(`UNAUTHORIZED`,{error_description:e.message,error:e.code}):e}let a=r.scope?.split(` `);if(!a?.includes(`openid`))throw new E(`BAD_REQUEST`,{error_description:`Missing required scope`,error:`invalid_scope`});if(!r.sub)throw new E(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let o=await e.context.internalAdapter.findUserById(r.sub);if(!o)throw new E(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let s=Tge(o,a??[],i),c=r.client_id??r.azp,l=c&&(t.pairwiseSecret||Dhe(t))?await t1(e,t,c):void 0;t.pairwiseSecret&&l&&(s.sub=await y1(o.id,l,t));let u=a?.length?await Ehe(t,{ctx:e,opts:t,user:o,scopes:a,jwt:r,client:l??void 0,requestedClaims:i}):{},d=t.customUserInfoClaims&&a?.length?await t.customUserInfoClaims({user:o,scopes:a,jwt:r,requestedClaims:i}):{};return{...s,...s0(u,s),...s0(d),sub:s.sub}}const Oge=Object.fromEntries(R1.map(e=>[e,void 0]));function c0(e){return uZ(e)?`DPoP`:`Bearer`}async function kge(e,t){let n=e.body.grant_type;if(!V$(t).includes(n))throw new E(`BAD_REQUEST`,{error_description:`unsupported grant_type ${n}`,error:`unsupported_grant_type`});switch(n){case`authorization_code`:return Xge(e,t);case`client_credentials`:return Zge(e,t);case`refresh_token`:return Qge(e,t);default:{let r=She(t,n);if(r)return r({ctx:e,opts:t,grantType:n,provider:Age(e,t,n)});throw new E(`BAD_REQUEST`,{error_description:`unsupported grant_type ${n}`,error:`unsupported_grant_type`})}}}function Age(e,t,n){return{getClient:n=>t1(e,t,n),authenticateClient:async r=>{let{clientId:i,clientSecret:a,preVerified:o,authMethod:s,confirmation:c}=g1(await _1(e,t,`${e.context.baseURL}${e.path??`/oauth2/token`}`));if(!i)throw new E(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});if(r?.requireCredentials!==!1&&!a&&!o)throw new E(`BAD_REQUEST`,{error_description:`Missing required client credentials`,error:`invalid_client`});return{clientId:i,client:await m1(e,t,i,a,r?.scopes,o,n,s),method:s,confirmation:c}},issueTokens:r=>{if(!n)throw new E(`INTERNAL_SERVER_ERROR`,{error_description:`issueTokens requires a grant type; pass it to getOAuthProviderApi(ctx, opts, grantType).`,error:`server_error`});return x0(e,t,{...r,grantType:n})},hashToken:(e,n)=>o1(t.storeTokens,e,n),validateAccessToken:async(n,r)=>{let{validateAccessToken:i}=await Promise.resolve().then(()=>S0);return i(e,t,n,r)},requireActiveAccessToken:async(n,r)=>{let{requireActiveAccessToken:i}=await Promise.resolve().then(()=>S0);return i(e,t,n,r)}}}async function jge(e,t,n,r,i,a,o){let s=o?.iat??Math.floor(Date.now()/1e3),c=o?.exp??s+(t.accessTokenExpiresIn??3600),l=q$(e.context).options,u=n?.id??r.clientId;return T$(e,{options:l,header:{typ:`at+jwt`},signingKeyId:o?.signingKeyId??void 0,signingAlgorithm:o?.signingAlgorithm??void 0,payload:{...o?.accessTokenClaims??{},sub:u,aud:Z$(i),client_id:r.clientId,azp:r.clientId,scope:a.join(` `),sid:o?.sid,iss:l?.jwt?.issuer??e.context.baseURL,iat:s,exp:c,jti:qH(32),...o?.confirmation?{cnf:o.confirmation}:{}}})}async function Mge(e,t){let n;n=t===`EdDSA`?`SHA-512`:t.endsWith(`384`)?`SHA-384`:t.endsWith(`512`)?`SHA-512`:`SHA-256`;let r=new Uint8Array(await crypto.subtle.digest(n,new TextEncoder().encode(e)));return _P(r.slice(0,r.length/2))}async function Nge(e,t,n,r,i,a,o,s,c,l){let u=Math.floor(Date.now()/1e3),d=u+(t.idTokenExpiresIn??36e3),f=await y1(n.id,r,t),p=s==null?void 0:Math.floor(s.getTime()/1e3),m=A1(t.customIdTokenClaims?await t.customIdTokenClaims({user:n,scopes:i,metadata:h1(r.metadata)}):void 0),h=t.disableJwtPlugin?void 0:q$(e.context).options,g=!t.disableJwtPlugin&&!h?.jwt?.sign?await w$(e,h):void 0,_=t.disableJwtPlugin?`HS256`:g?.alg??h?.jwks?.keyPairConfig?.alg,v=c?await Mge(c,_):void 0,y=!!(r.enableEndSession||r.backchannelLogoutUri),b={...Oge,auth_time:p,acr:`0`,...m,at_hash:v,iss:h?.jwt?.issuer??e.context.baseURL,sub:f,aud:r.clientId,nonce:a,iat:u,exp:d,sid:y?o:void 0},x=A1(l);if(Object.assign(b,s0(x,b)),t.disableJwtPlugin&&!r.clientSecret)return;let S=t.disableJwtPlugin?await new iI(b).setProtectedHeader({alg:`HS256`}).sign(new TextEncoder().encode(await i1(e,t.storeClientSecret,r.clientSecret))):await T$(e,{options:h,payload:b,resolvedKey:g??void 0});if(S&&v&&h?.jwt?.sign){let e=gI(S);if(e.alg!==_)throw new E(`INTERNAL_SERVER_ERROR`,{error_description:`ID token signed with "${e.alg}" but at_hash was computed for "${_}". Ensure jwt.sign uses the algorithm declared in keyPairConfig.alg.`,error:`server_error`})}return S}async function l0(e,t,n){return(e.prefix?.refreshToken??``)+(e.formatRefreshToken?.encrypt?e.formatRefreshToken.encrypt(t,n):t)}async function u0(e,t){if(e.prefix?.refreshToken){if(t.startsWith(e.prefix.refreshToken))t=t.replace(e.prefix.refreshToken,``);else throw new E(`BAD_REQUEST`,{error_description:`refresh token not found`,error:`invalid_token`})}return e.formatRefreshToken?.decrypt?e.formatRefreshToken?.decrypt(t):{token:t}}async function Pge(e,t,n,r,i,a,o,s,c,l,u,d){let f=a.iat??Math.floor(Date.now()/1e3),p=a?.exp??f+(t.accessTokenExpiresIn??3600),m=t.generateOpaqueAccessToken?await t.generateOpaqueAccessToken():qH(32,`A-Z`,`a-z`);return await e.context.adapter.create({model:`oauthAccessToken`,data:{token:await o1(t.storeTokens,m,`access_token`),clientId:r.clientId,sessionId:a?.sid,userId:n?.id,referenceId:s,authorizationCodeId:c,resources:o,refreshId:l,confirmation:u,requestedUserInfoClaims:d?.length?d:void 0,scopes:i,createdAt:/* @__PURE__ */ new Date(f*1e3),expiresAt:/* @__PURE__ */ new Date(p*1e3)}}),(t.prefix?.opaqueAccessToken??``)+m}async function d0(e,t,n){let r=await e.context.adapter.findMany({model:`oauthRefreshToken`,where:[{field:`clientId`,value:t},{field:`userId`,value:n}]});r.length&&await e.context.adapter.deleteMany({model:`oauthAccessToken`,where:[{field:`refreshId`,operator:`in`,value:r.map(e=>e.id)}]}),await e.context.adapter.deleteMany({model:`oauthRefreshToken`,where:[{field:`clientId`,value:t},{field:`userId`,value:n}]})}async function Fge(e,t){let n=async n=>{try{await e.context.adapter.deleteMany({model:n,where:[{field:`authorizationCodeId`,value:t}]})}catch(t){e.context.logger.error(`authorization code replay cleanup failed`,t)}};await n(`oauthAccessToken`),await n(`oauthRefreshToken`)}async function f0(e,t,n,r,i,a,o,s,c,l,u,d,f){let p=s.iat??Math.floor(Date.now()/1e3),m=s?.exp??p+(t.refreshTokenExpiresIn??2592e3),h=t.generateRefreshToken?await t.generateRefreshToken():qH(32,`A-Z`,`a-z`),g=s?.sid,_={token:await o1(t.storeTokens,h,`refresh_token`),clientId:a.clientId,sessionId:g,userId:n.id,referenceId:r,authorizationCodeId:i,authTime:l,confirmation:d,requestedUserInfoClaims:f?.length?f:void 0,scopes:o,resources:u,createdAt:/* @__PURE__ */ new Date(p*1e3),expiresAt:/* @__PURE__ */ new Date(m*1e3)};if(!c?.id)return{id:(await e.context.adapter.create({model:`oauthRefreshToken`,data:_})).id,token:await l0(t,h,g)};let v=/* @__PURE__ */ new Date(p*1e3),y={revoked:v,rotatedAt:v},b=t.refreshTokenReuseInterval??0;if(b>0&&(y.rotationReplayExpiresAt=/* @__PURE__ */ new Date((p+b)*1e3)),!await e.context.adapter.incrementOne({model:`oauthRefreshToken`,where:[{field:`id`,value:c.id},{field:`revoked`,operator:`eq`,value:null}],increment:{},set:y}))throw new E(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`});return{id:(await e.context.adapter.create({model:`oauthRefreshToken`,data:_})).id,token:await l0(t,h,g)}}async function p0(e,t,n){let r=await J1(e,t,{resource:n.resources,clientId:n.clientId,requestedScopes:n.requestedScopes}),i=r.accessTokenTtl===null?n.scopeExpiresAtSeconds:n.iat+r.accessTokenTtl,a=t.refreshTokenExpiresIn??2592e3,o=r.refreshTokenTtl===null?a:Math.min(r.refreshTokenTtl,a);return{audienceClaim:r.audienceClaim,effectiveScopes:r.effectiveScopes,accessTokenExpiresAtSeconds:Math.min(n.scopeExpiresAtSeconds,i),refreshTokenExpiresAtSeconds:n.iat+o,refreshResources:n.refreshToken?.resources??n.originalResources??n.resources,signingAlgorithm:r.signingAlgorithm,signingKeyId:r.signingKeyId,resourceCustomClaims:r.rawCustomClaims,dpopBoundAccessTokensRequired:r.dpopBoundAccessTokensRequired}}function m0(e){throw new E(`BAD_REQUEST`,{error:`invalid_dpop_proof`,error_description:e})}function Ige(e){let t=h1(e.metadata)??{};return e.dpopBoundAccessTokens===!0||t.dpop_bound_access_tokens===!0}async function h0(e,t,n){let r=n.verificationValue?.query.dpop_jkt,i=uZ(n.refreshToken?.confirmation),a=i??r,o=n0(e),s=Ige(n.client)||n.grantIssuance.dpopBoundAccessTokensRequired||!!r||!!i;if(!o)s&&m0(`DPoP proof header is required`);else try{return{jkt:(await vZ({proofJwt:o,method:`POST`,url:r0(e,e.path??`/oauth2/token`),expectedJkt:a,proofMaxAgeSeconds:t.dpop?.proofMaxAgeSeconds,signingAlgorithms:t.dpop?.signingAlgorithms,replayStore:nZ(e.context.internalAdapter)})).jkt}}catch(e){throw iZ(e)&&m0(e.message),e}}function g0(e){return e?[...new Set(e)].sort():void 0}function _0(e,t){let n=g0(e),r=g0(t);return n===void 0||r===void 0?n===r:n.length===r.length&&n.every((e,t)=>e===r[t])}function v0(e){if(e)return`jkt`in e?`jkt:${e.jkt}`:`x5t#S256:${e[`x5t#S256`]}`}function Lge(e,t){return v0(e)===v0(t)}function Rge(e){if(!e||typeof e!=`object`)return!1;let t=e;return typeof t.jkt==`string`&&t[`x5t#S256`]===void 0||typeof t[`x5t#S256`]==`string`&&t.jkt===void 0}function zge(e){return e===`Bearer`||e===`DPoP`}function Bge(e){if(!e||typeof e!=`object`)return!1;let t=e;return typeof t.access_token==`string`&&typeof t.expires_in==`number`&&typeof t.expires_at==`number`&&zge(t.token_type)&&typeof t.scope==`string`&&(t.refresh_token===void 0||typeof t.refresh_token==`string`)&&(t.id_token===void 0||typeof t.id_token==`string`)}function Vge(e){if(!e||typeof e!=`object`)return!1;let t=e,n=t.request;return!!n&&Array.isArray(n.effectiveScopes)&&n.effectiveScopes.every(e=>typeof e==`string`)&&(n.requestedResources===void 0||Array.isArray(n.requestedResources)&&n.requestedResources.every(e=>typeof e==`string`))&&(n.confirmation===void 0||Rge(n.confirmation))&&Bge(t.response)}function y0(e){let t=g0(e.requestedResources);return{effectiveScopes:g0(e.effectiveScopes)??[],...t?{requestedResources:t}:{},...e.confirmation?{confirmation:e.confirmation}:{}}}function Hge(e,t){return _0(e.effectiveScopes,t.effectiveScopes)&&_0(e.requestedResources,t.requestedResources)&&Lge(e.confirmation,t.confirmation)}async function Uge(e,t){return LW({key:e.context.secretConfig,data:JSON.stringify(t)})}async function Wge(e,t){let n=await RW({key:e.context.secretConfig,data:t}),r=JSON.parse(n);if(Vge(r))return r}function b0(e){return!!e.rotatedAt&&!!e.rotationReplayExpiresAt&&e.rotationReplayExpiresAt>=/* @__PURE__ */ new Date}async function Gge(e,t,n,r,i){(t.refreshTokenReuseInterval??0)<=0||await e.context.adapter.update({model:`oauthRefreshToken`,where:[{field:`id`,value:n.id}],update:{rotationReplayResponse:await Uge(e,{request:r,response:i})}})}async function Kge(e,t,n){if(b0(t)&&t.rotationReplayResponse)try{let r=await Wge(e,t.rotationReplayResponse);return!r||!Hge(r.request,n)?void 0:r.response}catch(t){e.context.logger.error(`refresh token rotation replay failed`,t);return}}async function qge(e,t,n){let r=Math.floor(Date.now()/1e3),i=await p0(e,t,{clientId:n.client.clientId,requestedScopes:n.scopes,resources:n.resources,refreshToken:n.refreshToken,iat:r,scopeExpiresAtSeconds:r+(t.accessTokenExpiresIn??3600)}),a=await h0(e,t,{client:n.client,grantIssuance:i,refreshToken:n.refreshToken});return y0({effectiveScopes:i.effectiveScopes,requestedResources:n.resources,confirmation:a})}function Jge(e,t){let n=Math.floor(Date.now()/1e3);return e.json({...t,expires_in:Math.max(0,t.expires_at-n)})}async function x0(e,t,n){let{client:r,scopes:i,user:a,grantType:o,referenceId:s,sessionId:c,nonce:l,refreshToken:u,authTime:d,verificationValue:f}=n,p=Math.floor(Date.now()/1e3),m=p+(a?t.accessTokenExpiresIn??3600:t.m2mAccessTokenExpiresIn??3600),h=t.scopeExpirations?i.map(e=>t.scopeExpirations?.[e]?S$(t.scopeExpirations[e],p):m).reduce((e,t)=>e<t?e:t,m):m,g=await p0(e,t,{clientId:r.clientId,requestedScopes:i,resources:n.resources,originalResources:n.originalResources,refreshToken:n.refreshToken,iat:p,scopeExpiresAtSeconds:h}),_=g.audienceClaim,v=g.effectiveScopes,y=g.accessTokenExpiresAtSeconds,b=g.refreshTokenExpiresAtSeconds,x=a&&d1(r,`refresh_token`)&&(u?.scopes?.includes(`offline_access`)||i.includes(`offline_access`)),S=_&&!t.disableJwtPlugin,ee=a&&v.includes(`openid`),C=h1(r.metadata),te=ee&&a?{...await The(t,{ctx:e,opts:t,user:a,client:r,scopes:v,grantType:o,referenceId:s,sessionId:c,resources:n.resources,metadata:C}),...n.idTokenClaims??{}}:void 0,ne=t.customTokenResponseFields?await t.customTokenResponseFields({grantType:o,user:a,scopes:v,metadata:C,verificationValue:f}):void 0,w=g.refreshResources,T=n.confirmation??await h0(e,t,{client:r,grantIssuance:g,verificationValue:f,refreshToken:u}),re=n.requestedUserInfoClaims??u?.requestedUserInfoClaims??[],ie=x&&a&&!S?await f0(e,t,a,s,n.authorizationCodeId,r,v,{iat:p,exp:b,sid:c},u,d,w,T,re):void 0,ae=S?await B1({ctx:e,opts:t,user:a,client:r,scopes:v,grantType:o,sessionId:c,resources:n.resources,referenceId:s,metadata:C,perRequestClaims:n.accessTokenClaims,resourcePolicyClaims:g.resourceCustomClaims}):void 0,[oe,se]=await Promise.all([S?jge(e,t,a,r,_,v,{iat:p,exp:y,sid:c,signingAlgorithm:g.signingAlgorithm,signingKeyId:g.signingKeyId,accessTokenClaims:ae,confirmation:T}):Pge(e,t,a,r,v,{iat:p,exp:y,sid:c},n?.resources,s,n.authorizationCodeId,ie?.id,T,re),ie||(x&&a?f0(e,t,a,s,n.authorizationCodeId,r,v,{iat:p,exp:b,sid:c},u,d,w,T,re):void 0)]),ce=ee?await Nge(e,t,a,r,v,l,c,d,oe,te):void 0,le={...ne,...n.tokenResponse??{},access_token:oe,expires_in:y-p,expires_at:y,token_type:c0(T),refresh_token:se?.token,scope:v.join(` `),id_token:ce};if(u?.id&&se?.id)try{await Gge(e,t,u,y0({effectiveScopes:v,requestedResources:n.resources,confirmation:T}),le)}catch(t){e.context.logger.error(`failed to store refresh token rotation replay`,t)}return e.json(le)}async function Yge(e,t,n,r,i,a){let o=await o1(t.storeTokens,n,`authorization_code`),s=await e.context.internalAdapter.consumeVerificationValue(o);if(!s)throw await Fge(e,o),new E(`BAD_REQUEST`,{error_description:`invalid code`,error:`invalid_grant`});let c;try{c=JSON.parse(s.value)}catch{throw new E(`BAD_REQUEST`,{error_description:`malformed verification value`,error:`invalid_grant`})}let l=oge.safeParse(c);if(!l.success)throw new E(`BAD_REQUEST`,{error_description:`malformed verification value`,error:`invalid_grant`});let u=l.data;if(u.query.client_id!==r)throw new E(`BAD_REQUEST`,{error_description:`invalid client_id`,error:`invalid_grant`});let d=u.query.redirect_uri;if(d){if(!i)throw new E(`BAD_REQUEST`,{error_description:`redirect_uri is required`,error:`invalid_request`});if(d!==i)throw new E(`BAD_REQUEST`,{error_description:`redirect_uri mismatch`,error:`invalid_grant`})}else if(i)throw new E(`BAD_REQUEST`,{error_description:`redirect_uri mismatch`,error:`invalid_grant`});let f=X$(u.resource)??X$(u.query.resource),p=a??f;if(a&&f){let e=new Set(a),t=new Set(f);for(let n of e)if(!t.has(n))throw new E(`BAD_REQUEST`,{error_description:`requested resource not authorized`,error:`invalid_target`})}return{verificationValue:u,effectiveResources:p,authorizedResources:f,authorizationCodeId:o}}async function Xge(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=g1(await _1(e,t,`${e.context.baseURL}/oauth2/token`)),{code:o,code_verifier:s,redirect_uri:c,resource:l}=e.body,u=X$(l);if(!n)throw new E(`BAD_REQUEST`,{error_description:`client_id is required`,error:`invalid_request`});if(!o)throw new E(`BAD_REQUEST`,{error_description:`code is required`,error:`invalid_request`});let d=n&&r,f=n&&o&&s;if(!d&&!f&&!i)throw new E(`BAD_REQUEST`,{error_description:`Either code_verifier or client_secret is required`,error:`invalid_request`});let p=await m1(e,t,n,r,void 0,i,`authorization_code`,a),{verificationValue:m,effectiveResources:h,authorizedResources:g,authorizationCodeId:_}=await Yge(e,t,o,n,c,u),v=m.query.scope?.split(` `);if(!v)throw new E(`INTERNAL_SERVER_ERROR`,{error_description:`verification scope unset`,error:`invalid_scope`});if(f1(p,v),E1(p,{scopes:(m.query?.scope)?.split(` `)||[],nonce:m.query?.nonce})){if(!f)throw new E(`BAD_REQUEST`,{error_description:`PKCE is required for this client`,error:`invalid_request`})}else if(!(f||d||i))throw new E(`BAD_REQUEST`,{error_description:`Either PKCE (code_verifier) or client authentication (client_secret or client_assertion) is required`,error:`invalid_request`});let y=!!m.query?.code_challenge,b=!!s;if(y||b){if(y&&!b)throw new E(`BAD_REQUEST`,{error_description:`code_verifier required because PKCE was used in authorization`,error:`invalid_request`});if(!y&&b)throw new E(`BAD_REQUEST`,{error_description:`code_verifier provided but PKCE was not used in authorization`,error:`invalid_request`});if((m.query?.code_challenge_method===`S256`?await qY(s):void 0)!==m.query?.code_challenge)throw new E(`BAD_REQUEST`,{error_description:`code verification failed`,error:`invalid_grant`})}if(!m.userId)throw new E(`BAD_REQUEST`,{error_description:`missing user, user may have been deleted`,error:`invalid_user`});let x=await e.context.internalAdapter.findUserById(m.userId);if(!x)throw new E(`BAD_REQUEST`,{error_description:`missing user, user may have been deleted`,error:`invalid_user`});let S=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:m.sessionId}]});if(!S||S.expiresAt</* @__PURE__ */ new Date)throw new E(`BAD_REQUEST`,{error_description:`session no longer exists`,error:`invalid_request`});let ee=m.authTime==null?jhe(S):Y$(m.authTime),C=F1(m.query.claims,z1(t));return x0(e,t,{client:p,scopes:m.query.scope?.split(` `)??[],user:x,grantType:`authorization_code`,referenceId:m.referenceId,sessionId:S.id,nonce:m.query?.nonce,authTime:ee,verificationValue:m,authorizationCodeId:_,requestedUserInfoClaims:C,resources:h,originalResources:g})}async function Zge(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=g1(await _1(e,t,`${e.context.baseURL}/oauth2/token`)),{scope:o,resource:s}=e.body,c=X$(s);if(!n)throw new E(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});let l=await m1(e,t,n,r,void 0,i,`client_credentials`,a);if(l.tokenEndpointAuthMethod===`none`)throw new E(`BAD_REQUEST`,{error_description:`public clients cannot use the client_credentials grant`,error:`unauthorized_client`});let u=l.clientCredentialsScopes;if(!u?.length)throw new E(`BAD_REQUEST`,{error_description:`client has no authorized client_credentials scopes`,error:`unauthorized_client`});let d=o?.split(` `);if(d){let e=new Set(u),t=d.filter(t=>!e.has(t)||i0(t));if(t.length)throw new E(`BAD_REQUEST`,{error_description:`The following scopes are invalid: ${t.join(`, `)}`,error:`invalid_scope`})}return d||=[...u],x0(e,t,{client:l,scopes:d,grantType:`client_credentials`,resources:c})}async function Qge(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=g1(await _1(e,t,`${e.context.baseURL}/oauth2/token`)),{refresh_token:o,scope:s,resource:c}=e.body,l=X$(c);if(!n)throw new E(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});if(!o)throw new E(`BAD_REQUEST`,{error_description:`Missing a required refresh_token for refresh_token grant`,error:`invalid_request`});let u=await m1(e,t,n,r,void 0,i,`refresh_token`,a),d=await u0(t,o),f=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await s1(t.storeTokens,d.token,`refresh_token`)}]});if(!f)throw new E(`BAD_REQUEST`,{error_description:`session not found`,error:`invalid_grant`});if(f.clientId!==n||f.expiresAt</* @__PURE__ */ new Date)throw new E(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`});if(l&&f.resources&&!l.every(e=>f.resources?.includes(e)))throw new E(`BAD_REQUEST`,{error_description:`requested resource invalid`,error:`invalid_target`});let p=f?.scopes,m=s?.split(` `);if(m){let e=new Set(p);for(let t of m)if(!e.has(t))throw new E(`BAD_REQUEST`,{error_description:`unable to issue scope ${t}`,error:`invalid_scope`})}if(f1(u,m??p),f.revoked){if(b0(f)){let n=await Kge(e,f,await qge(e,t,{client:u,refreshToken:f,scopes:m??p,resources:l??f.resources}));if(n)return Jge(e,n);throw new E(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`})}throw await d0(e,n,f.userId),new E(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`})}let h=await e.context.internalAdapter.findUserById(f.userId);if(!h)throw new E(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let g=f.authTime==null?void 0:Y$(f.authTime);return x0(e,t,{client:u,scopes:m??p,user:h,grantType:`refresh_token`,referenceId:f.referenceId,authorizationCodeId:f.authorizationCodeId,sessionId:f.sessionId,refreshToken:f,resources:l??f.resources,authTime:g,requestedUserInfoClaims:f.requestedUserInfoClaims})}var S0=/* @__PURE__ */ k$({introspectEndpoint:()=>j0,requireActiveAccessToken:()=>a_e,requireActiveAccessTokenWithClaims:()=>k0,validateAccessToken:()=>O0});const C0=`Invalid access token`,$ge=`Bearer error="invalid_token", error_description="${C0}"`;function w0(){return{payload:{active:!1},requestedUserInfoClaims:[]}}function e_e(e,t){return e==null?[]:(Array.isArray(e)?e:[e]).filter(e=>typeof e==`string`&&e!==t)}async function T0(e,t,n){let{introspectingClientId:r,issuerClientId:i,audienceResources:a}=n;return!r||r===i||a.length!==0&&mge(e,t,r,a)}async function t_e(e,t,n,r){if(t.disableJwtPlugin)throw new O(`BAD_REQUEST`,{error_description:`JWT access tokens are disabled`,error:`invalid_request`});let i=q$(e.context),a=i.options,o=`${e.context.baseURL??``}/oauth2/userinfo`,s=a?.jwt?.issuer??e.context.baseURL,c;try{c=(await nI(n,dI(await RZ(n,{jwksFetch:a?.jwks?.remoteUrl?a.jwks.remoteUrl:async()=>(await i.endpoints.getJwks(e))?.response,jwksCacheKey:i})),{issuer:s})).payload}catch(e){if(e instanceof iP||e instanceof uP)return{active:!1};throw e instanceof TypeError||J$(e)?new O(`BAD_REQUEST`,{error_description:`invalid JWT signature`,error:`invalid_request`}):e}let l=c.aud;if(!await q1(e,t,l,[o])||!c.azp)return{active:!1};let u=await t1(e,t,c.azp);if(!u||u?.disabled||!await T0(e,t,{introspectingClientId:r,issuerClientId:c.azp,audienceResources:e_e(l,o)}))return{active:!1};let d=c.sid;if(d){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:d}]});if(!t||t.expiresAt</* @__PURE__ */ new Date)return{active:!1}}return c.client_id=c.azp,c.active=!0,c.token_type=c0(c.cnf),c}async function n_e(e,t,n,r){let i=n;if(t.prefix?.opaqueAccessToken){if(i.startsWith(t.prefix.opaqueAccessToken))i=i.replace(t.prefix.opaqueAccessToken,``);else throw new O(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`})}let a=await e.context.adapter.findOne({model:`oauthAccessToken`,where:[{field:`token`,value:await s1(t.storeTokens,i,`access_token`)}]});if(!a)throw new O(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_token`});if(!a.expiresAt||a.expiresAt</* @__PURE__ */ new Date||a.revoked)return w0();let o=Array.isArray(a.resources)?a.resources:void 0,s;if(a.clientId&&(s=await t1(e,t,a.clientId),!s||s?.disabled||!await T0(e,t,{introspectingClientId:r,issuerClientId:a.clientId,audienceResources:o??[]})))return w0();let c=a.sessionId??void 0;if(c){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:c}]});if(!t||t.expiresAt</* @__PURE__ */ new Date)return w0()}let l;a.userId&&(l=await e.context.internalAdapter.findUserById(a?.userId));let u=`${e.context.baseURL}/oauth2/userinfo`;if(o?.length&&!await q1(e,t,o,[u]))return w0();let d=o?[...o]:void 0;d?.length&&a.scopes?.includes(`openid`)&&(d.includes(u)||d.push(u));let f=o?.length?await hge(e,t,o):{},p=s?await B1({ctx:e,opts:t,user:l,client:s,scopes:a.scopes??[],grantType:void 0,sessionId:void 0,resources:o,referenceId:a.referenceId,metadata:h1(s.metadata),perRequestClaims:void 0,resourcePolicyClaims:f}):{},m=(t.disableJwtPlugin?void 0:q$(e.context))?.options;return{payload:{...p,active:!0,iss:m?.jwt?.issuer??e.context.baseURL,aud:Z$(d),client_id:a.clientId,azp:a.clientId,sub:l?.id,sid:c,exp:Math.floor(new Date(a.expiresAt).getTime()/1e3),iat:Math.floor(new Date(a.createdAt).getTime()/1e3),scope:a.scopes?.join(` `),token_type:c0(a.confirmation),...a.confirmation?{cnf:a.confirmation}:{}},requestedUserInfoClaims:a.requestedUserInfoClaims??[]}}async function r_e(e,t,n,r){let i=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await s1(t.storeTokens,n,`refresh_token`)}]});if(!i)throw new O(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_token`});if(!i.clientId||i.clientId!==r||!i.expiresAt||i.expiresAt</* @__PURE__ */ new Date||i.revoked)return{active:!1};let a=i.sessionId??void 0;if(a){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:a}]});(!t||t.expiresAt</* @__PURE__ */ new Date)&&(a=void 0)}let o;return i.userId&&(o=await e.context.internalAdapter.findUserById(i?.userId)??void 0),{active:!0,client_id:r,iss:((t.disableJwtPlugin?void 0:q$(e.context))?.options)?.jwt?.issuer??e.context.baseURL,sub:o?.id,sid:a,exp:Math.floor(new Date(i.expiresAt).getTime()/1e3),iat:Math.floor(new Date(i.createdAt).getTime()/1e3),scope:i.scopes?.join(` `),token_type:c0(i.confirmation),...i.confirmation?{cnf:i.confirmation}:{}}}function E0(){return new O(`UNAUTHORIZED`,{error_description:C0,error:`invalid_token`},{"WWW-Authenticate":$ge})}function i_e(e){return e.status===`BAD_REQUEST`||e.body?.error===`invalid_token`}async function D0(e,t,n,r){try{return{payload:await t_e(e,t,n,r),requestedUserInfoClaims:[]}}catch(e){if(!(e instanceof O))throw e instanceof Error?e:Error(e)}try{return await n_e(e,t,n,r)}catch(e){if(!(e instanceof O))throw e instanceof Error?e:Error(`Unknown error validating access token`)}throw E0()}async function O0(e,t,n,r){return(await D0(e,t,n,r)).payload}async function a_e(e,t,n,r){let i=await O0(e,t,n,r);if(i.active)return i;throw E0()}async function k0(e,t,n,r){let{payload:i,requestedUserInfoClaims:a}=await D0(e,t,n,r);if(i.active)return{payload:i,requestedUserInfoClaims:a};throw E0()}async function A0(e,t,n,r){if(!n.active||!n.sub)return n;let i=n.client_id??n.azp;if(!i)return n;let a=i===r.clientId?r:await t1(e,t,i);if(!a)return n;let o=await y1(n.sub,a,t);return{...n,sub:o}}async function j0(e,t){let{token:n,token_type_hint:r}=e.body;r!==`access_token`&&r!==`refresh_token`&&(r=void 0);let{clientId:i,clientSecret:a,preVerified:o,authMethod:s}=g1(await _1(e,t,`${e.context.baseURL}/oauth2/introspect`));if(!i||!a&&!o)throw new O(`UNAUTHORIZED`,{error_description:`missing required credentials`,error:`invalid_client`});if(n&&typeof n==`string`&&(n=oZ(n)),!n?.length)throw new O(`BAD_REQUEST`,{error_description:`missing a required token for introspection`,error:`invalid_request`});let c=await m1(e,t,i,a,void 0,o,void 0,s);try{if(r===void 0||r===`access_token`)try{return A0(e,t,await O0(e,t,n,c.clientId),c)}catch(e){if(e instanceof O){if(r===`access_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}if(r===void 0||r===`refresh_token`)try{return A0(e,t,await r_e(e,t,(await u0(t,n)).token,c.clientId),c)}catch(e){if(e instanceof O){if(r===`refresh_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}throw new O(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`})}catch(e){if(e instanceof O){if(i_e(e))return{active:!1};throw e}throw e instanceof Error?(f.error(`Introspection error:`,e.message,e.stack),new O(`INTERNAL_SERVER_ERROR`)):(f.error(`Introspection error:`,e),new O(`INTERNAL_SERVER_ERROR`))}}function M0(e){return e?.get(`sec-fetch-mode`)===`cors`}var o_e=/* @__PURE__ */ e({a:()=>B2,c:()=>d2,d:()=>t2,f:()=>$0,h:()=>e2,i:()=>o4,l:()=>l2,n:()=>e4,o:()=>z_e,r:()=>r4,s:()=>w2,t:()=>f4,u:()=>Z0});async function s_e(e,t,n){let r=await n4.get(),i=r?.query;if(!i)throw new E(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let a=new URLSearchParams(i),o=a.get(`scope`)?.split(` `)??[],s=z1(t),c=F1(a.get(`claims`),s),l=a.get(`client_id`);if(!l)throw new E(`BAD_REQUEST`,{error_description:`client_id is required`,error:`invalid_client`});let u=e.body.scope?.split(` `);if(u&&!u.every(e=>o?.includes(e)))throw new E(`BAD_REQUEST`,{error_description:`Scope not originally requested`,error:`invalid_request`});let d=e.body.claims,f=d===void 0?c:F1(d,s);if(d!==void 0&&!f.every(e=>c.includes(e)))throw new E(`BAD_REQUEST`,{error_description:`Claim not originally requested`,error:`invalid_request`});if(e.body.accept!==!0)return{redirect:!0,url:s4(a.get(`redirect_uri`)??``,`access_denied`,`User denied access`,a.get(`state`)??void 0,f4(e,t))};let p=await RJ(e),m=v1(a.get(`prompt`)??``).has(`login`),h=m&&C1(p?.session.createdAt,r?.signedQueryIssuedAt);if(m&&!h)return e?.headers?.set(`accept`,`application/json`),e.query=S1(a),await n(e);let g=await b1(t,{user:p?.user,session:p?.session,scopes:u??o}),_=await x1(e,l,p?.user.id,g),v=Math.floor(Date.now()/1e3),y=a.getAll(`resource`),b={clientId:l,userId:p?.user.id,scopes:u??o,requestedUserInfoClaims:f,createdAt:/* @__PURE__ */ new Date(v*1e3),updatedAt:/* @__PURE__ */ new Date(v*1e3),resources:y.length?y:void 0,referenceId:g};if(_?.id?await e.context.adapter.update({model:`oauthConsent`,where:[{field:`id`,value:_.id}],update:{resources:b.resources,scopes:b.scopes,requestedUserInfoClaims:b.requestedUserInfoClaims,updatedAt:/* @__PURE__ */ new Date(v*1e3)}}):await e.context.adapter.create({model:`oauthConsent`,data:{...b,scopes:b.scopes}}),u&&a.set(`scope`,b.scopes.join(` `)),d!==void 0){let e=Zhe(a.get(`claims`),f);e?a.set(`claims`,JSON.stringify(e)):a.delete(`claims`)}e?.headers?.set(`accept`,`application/json`);let x=w1(a,`consent`);return h&&(x=w1(x,`login`),x=T1(x)),e.query=S1(x),await n(e,{postLogin:r?.postLoginClearedForSession!==void 0&&r.postLoginClearedForSession===p?.session.id})}async function c_e(e,t){if(e.body.selected===!0)return await l_e(e,t);if(e.body.created===!0)return await u_e(e,t);if(e.body.postLogin===!0)return await d_e(e,t);throw new E(`BAD_REQUEST`,{error_description:`Missing parameters`,error:`invalid_request`})}async function l_e(e,t){let n=(await n4.get())?.query;if(!n)throw new E(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});return e.headers?.set(`accept`,`application/json`),e.query=S1(w1(new URLSearchParams(n),`select_account`)),await t(e)}async function u_e(e,t){let n=(await n4.get())?.query;if(!n)throw new E(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let r=new URLSearchParams(n);return e.headers?.set(`accept`,`application/json`),e.query=S1(w1(r,`create`)),await t(e)}async function d_e(e,t){let n=await n4.get(),r=n?.query;if(!r)throw new E(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let i=new URLSearchParams(r);e.headers?.set(`accept`,`application/json`),e.query=S1(i);let a=await RJ(e);return await t(e,{postLogin:n?.postLoginClearedForSession!==void 0&&n.postLoginClearedForSession===a?.session.id,isPostLoginContinuation:!0})}async function f_e(e,t,n,r){return T$(e,{options:t,payload:{...r,events:{"http://schemas.openid.net/event/backchannel-logout":{}}},header:{typ:`logout+jwt`},resolvedKey:n??void 0})}async function p_e(e,t,n){let{sessionId:r,userId:i}=n;if(!i)return null;let a=e.context.logger;try{let n=await xH(e.context.adapter),o=[{field:`sessionId`,value:r}],[s,c]=await Promise.all([n.findMany({model:`oauthAccessToken`,where:o}),n.findMany({model:`oauthRefreshToken`,where:o})]),l=/* @__PURE__ */ new Set;for(let e of s)l.add(e.clientId);for(let e of c)l.add(e.clientId);if(l.size===0)return null;let u=await n.findMany({model:`oauthClient`,where:[{field:`clientId`,operator:`in`,value:Array.from(l)}]}),d=s.filter(e=>!e.revoked).map(e=>e.id),f=c.filter(e=>!e.revoked&&!e.scopes?.includes(`offline_access`)).map(e=>e.id),p=t.disableJwtPlugin?[]:u.filter(e=>!!e.backchannelLogoutUri&&!e.disabled);return{accessTokenIds:d,refreshTokenIds:f,sessionId:r,targets:(await Promise.all(p.map(async e=>{try{return{client:e,sub:await y1(i,e,t)}}catch(t){return a.warn(`back-channel logout: unable to resolve subject for client ${e.clientId}`,t),null}}))).filter(e=>e!==null)}}catch(e){return a.error(`back-channel logout planning failed`,e),null}}async function m_e(e,t){let n=/* @__PURE__ */ new Date,r=await xH(e.context.adapter),i=await Promise.allSettled([t.accessTokenIds.length>0?r.updateMany({model:`oauthAccessToken`,where:[{field:`id`,operator:`in`,value:t.accessTokenIds}],update:{revoked:n}}):Promise.resolve(),t.refreshTokenIds.length>0?r.updateMany({model:`oauthRefreshToken`,where:[{field:`id`,operator:`in`,value:t.refreshTokenIds}],update:{revoked:n}}):Promise.resolve()]);for(let t of i)t.status===`rejected`&&e.context.logger.error(`back-channel logout: token revocation update failed`,t.reason);t.targets.length>0&&await h_e(e,t)}async function h_e(e,t){let n=e.context.logger,r=q$(e.context)?.options,i=r?.jwt?.issuer??e.context.baseURL,a=Math.floor(Date.now()/1e3),o=a+120,s=r?.jwt?.sign?null:await w$(e,r);await Promise.allSettled(t.targets.map(async({client:c,sub:l})=>{try{let u=qH(32,`a-z`,`A-Z`,`0-9`),d=await f_e(e,r,s,{iss:i,aud:c.clientId,sub:l,sid:t.sessionId,iat:a,exp:o,jti:u}),f=await fetch(c.backchannelLogoutUri,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`,Accept:`application/json`},body:new URLSearchParams({logout_token:d}),signal:AbortSignal.timeout(5e3),redirect:`error`});f.status!==200&&f.status!==204&&n.warn(`back-channel logout to client ${c.clientId} returned ${f.status}`)}catch(e){n.warn(`back-channel logout to client ${c.clientId} failed`,e)}}))}function N0(e){return e.replace(/[&<>"']/g,e=>{switch(e){case`&`:return`&amp;`;case`<`:return`&lt;`;case`>`:return`&gt;`;case`"`:return`&quot;`;case`'`:return`&#39;`;default:return e}})}function P0(e){let t=e.request?.headers??e.headers;if(!t||M0(t))return!1;let n=t.get(`accept`)??``;return t.get(`sec-fetch-mode`)===`navigate`||n.includes(`text/html`)||n.includes(`application/xhtml+xml`)}function F0(e,t,n=200){return new Response(`<!doctype html><html><head><meta charset="utf-8"><title>${N0(e)}</title></head><body>${t}</body></html>`,{status:n,headers:{"cache-control":`no-store`,"content-security-policy":`default-src 'none'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'`,"content-type":`text/html; charset=utf-8`,pragma:`no-cache`,"x-content-type-options":`nosniff`}})}function I0(e){return`${e.context.baseURL.replace(/\/$/,``)}/oauth2/end-session/confirm`}function g_e(e){try{return new URL(I0(e)).pathname}catch{return`/oauth2/end-session/confirm`}}function L0(e){return F0(`Confirm logout`,`<main><h1>Confirm logout</h1><p>Do you want to log out of this account?</p><form method="post" data-oidc-logout-confirmation action="${N0(I0(e))}"><button type="submit" name="action" value="confirm">Confirm logout</button></form></main>`)}function R0(e){return F0(`Logged out`,`<main><p data-oidc-logout-state="logged-out">${e?`Logged out. ${N0(e)}`:`Logged out.`}</p></main>`)}function __e(e,t){return F0(`Logout error`,`<main><h1>Logout error</h1><p data-oidc-logout-state="error">${N0(e)}</p></main>`,t)}function z0(e,t,n,r){if(P0(e))return __e(r,t===`BAD_REQUEST`?400:t===`UNAUTHORIZED`?401:500);throw new O(t,{error:n,error_description:r})}function B0(e){return`${e.context.authCookies.sessionToken.name}.oauth_logout_confirmation`}function V0(e,t){return{...e.context.authCookies.sessionToken.attributes,httpOnly:!0,maxAge:t,path:g_e(e),sameSite:`lax`}}async function H0(e,t,n={}){let r={...t?{sessionId:t}:{},...n,expiresAt:Date.now()+3e5};await e.setSignedCookie(B0(e),JSON.stringify(r),e.context.secret,V0(e,300))}async function v_e(e){let t=await e.getSignedCookie(B0(e),e.context.secret);if(typeof t!=`string`)return null;try{let e=JSON.parse(t);if(typeof e!=`object`||!e)return null;let n=e;return n.sessionId!==void 0&&(typeof n.sessionId!=`string`||n.sessionId.length===0)||n.clientId!==void 0&&(typeof n.clientId!=`string`||n.clientId.length===0)||n.postLogoutRedirectUri!==void 0&&(typeof n.postLogoutRedirectUri!=`string`||n.postLogoutRedirectUri.length===0)||n.state!==void 0&&typeof n.state!=`string`||n.redirectInvalid!==void 0&&typeof n.redirectInvalid!=`boolean`||n.postLogoutRedirectUri!==void 0&&n.clientId===void 0||typeof n.expiresAt!=`number`||!Number.isFinite(n.expiresAt)?null:{...typeof n.sessionId==`string`?{sessionId:n.sessionId}:{},...typeof n.clientId==`string`?{clientId:n.clientId}:{},...typeof n.postLogoutRedirectUri==`string`?{postLogoutRedirectUri:n.postLogoutRedirectUri}:{},...typeof n.state==`string`?{state:n.state}:{},...typeof n.redirectInvalid==`boolean`?{redirectInvalid:n.redirectInvalid}:{},expiresAt:n.expiresAt}}catch{return null}}function U0(e){e.setCookie(B0(e),``,V0(e,0))}async function W0(e){let t=await e.getSignedCookie(e.context.authCookies.sessionToken.name,e.context.secret);if(typeof t!=`string`||t.length===0)return null;try{let n=await e.context.internalAdapter.findSession(t);return n?{session:n.session}:null}catch(t){throw e.context.logger.error(`Failed to read the current logout session`,t),new O(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to read the current session`})}}async function y_e(e,t){try{return await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:t}]})}catch(t){throw e.context.logger.error(`Failed to read the hinted logout session`,t),new O(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to read the hinted session`})}}async function G0(e,t){if(typeof t.token!=`string`||t.token.length===0)throw new O(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to complete logout`});try{await e.context.internalAdapter.deleteSession(t.token)}catch(t){throw e.context.logger.error(`Failed to delete the logout session`,t),new O(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to complete logout`})}}async function K0(e,t,n){try{return await t1(e,t,n)}catch(t){throw e.context.logger.error(`Failed to resolve the logout client`,t),new O(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to resolve the logout client`})}}function q0(e){return(Array.isArray(e)?e:[e]).filter(e=>typeof e==`string`)}function b_e(e){if(typeof e.aud==`string`&&e.aud.length>0)return e.aud;if(typeof e.azp==`string`&&e.azp.length>0)return e.azp;let t=q0(e.aud);return t.length===1?t[0]:null}async function x_e(e,t,n,r){if(r)return K0(e,t,r);let i;try{i=_I(n)}catch{return null}let a=b_e(i);return a?K0(e,t,a):null}async function S_e(e,t,n,r){try{let i;if(t.disableJwtPlugin){if(!r.clientSecret)return null;let a=await i1(e,t.storeClientSecret,r.clientSecret),{payload:o}=await zF(n,new TextEncoder().encode(a));i=JSON.parse(new TextDecoder().decode(o))}else{let t=q$(e.context).options,{payload:r}=await zF(n,dI(await RZ(n,{jwksFetch:t?.jwks?.remoteUrl??`${e.context.baseURL}${t?.jwks?.jwksPath??`/jwks`}`})));i=JSON.parse(new TextDecoder().decode(r))}return i.iss!==f4(e,t)||!q0(i.aud).includes(r.clientId)||typeof i.sid!=`string`||i.sid.length===0||typeof i.sub!=`string`||i.sub.length===0?null:i}catch{return null}}function J0(e,t,n){if(!t)return{invalid:!1};if(!e.postLogoutRedirectUris?.includes(t))return{invalid:!0};if(!n)return{uri:t,invalid:!1};try{let e=new URL(t);return e.searchParams.set(`state`,n),{uri:e.toString(),invalid:!1}}catch{return{invalid:!0}}}function Y0(e,t){return t.post_logout_redirect_uri?J0(e,t.post_logout_redirect_uri,t.state).invalid?{redirectInvalid:!0}:{clientId:e.clientId,postLogoutRedirectUri:t.post_logout_redirect_uri,...t.state===void 0?{}:{state:t.state}}:{}}async function C_e(e,t,n){if(n.redirectInvalid)return{invalid:!0};if(!n.clientId||!n.postLogoutRedirectUri)return{invalid:!1};let r=await K0(e,t,n.clientId);return!r||r.disabled||!r.enableEndSession?{invalid:!0}:J0(r,n.postLogoutRedirectUri,n.state)}async function X0(e,t,n={}){return t?P0(e)?(await H0(e,t.session.id,n),L0(e)):z0(e,`BAD_REQUEST`,`invalid_request`,`User confirmation is required to complete logout`):P0(e)?(await H0(e,void 0,n),L0(e)):z0(e,`BAD_REQUEST`,`invalid_request`,`No active session is available for logout`)}async function w_e(e,t){let n=await v_e(e),r=await W0(e);if(!n||n.expiresAt<=Date.now())return z0(e,`BAD_REQUEST`,`invalid_request`,`The logout confirmation is invalid or expired`);let i=await C_e(e,t,n);return r?n.sessionId&&n.sessionId!==r.session.id?z0(e,`BAD_REQUEST`,`invalid_request`,`The logout confirmation is invalid or expired`):(await G0(e,r.session),cq(e),U0(e),i.uri?l4(e,i.uri):P0(e)?R0(i.invalid?`The requested post-logout redirect was not registered.`:void 0):null):(U0(e),i.uri?l4(e,i.uri):P0(e)?R0(i.invalid?`The requested post-logout redirect was not registered.`:void 0):z0(e,`BAD_REQUEST`,`invalid_request`,`No active session is available for logout`))}async function T_e(e,t){let n=e.query??{},r=e.body??{},i={...n,...r},a=await W0(e);if(i.id_token_hint===void 0){let n={};if(i.client_id){let r=await K0(e,t,i.client_id);if(!r)return z0(e,`BAD_REQUEST`,`invalid_client`,`The logout client does not exist`);if(r.disabled)return z0(e,`BAD_REQUEST`,`invalid_client`,`The logout client is disabled`);if(!r.enableEndSession)return z0(e,`UNAUTHORIZED`,`invalid_client`,`The client is not allowed to initiate logout`);n=Y0(r,i)}return X0(e,a,n)}let o=await x_e(e,t,i.id_token_hint,i.client_id);if(!o)return a&&P0(e)?X0(e,a):z0(e,`BAD_REQUEST`,`invalid_client`,`The logout client does not exist`);if(o.disabled)return z0(e,`BAD_REQUEST`,`invalid_client`,`The logout client is disabled`);if(!o.enableEndSession)return z0(e,`UNAUTHORIZED`,`invalid_client`,`The client is not allowed to initiate logout`);let s=await S_e(e,t,i.id_token_hint,o);if(!s)return a&&P0(e)?X0(e,a,i.client_id?Y0(o,i):{}):z0(e,`UNAUTHORIZED`,`invalid_token`,`The id_token_hint is invalid`);let c=s.sid,l=await y_e(e,c),u=a?.session.id===c;if(a&&!u)return X0(e,a,Y0(o,i));let d=J0(o,i.post_logout_redirect_uri,i.state),f=l??(u?a?.session:null);return f&&await G0(e,f),u&&cq(e),U0(e),d.uri?l4(e,d.uri):P0(e)?R0(d.invalid?`The requested post-logout redirect was not registered.`:void 0):null}async function E_e(e,t){return w_e(e,t)}function Z0(e,t,n){let r=e.context.baseURL,i=!n?.jwt_disabled;return{scopes_supported:n?.scopes_supported,issuer:d4(t?.jwt?.issuer??r),authorization_endpoint:`${r}/oauth2/authorize`,token_endpoint:`${r}/oauth2/token`,jwks_uri:n?.jwt_disabled?void 0:t?.jwks?.remoteUrl??`${r}${t?.jwks?.jwksPath??`/jwks`}`,registration_endpoint:n?.dynamic_client_registration_supported?`${r}/oauth2/register`:void 0,introspection_endpoint:`${r}/oauth2/introspect`,revocation_endpoint:`${r}/oauth2/revoke`,response_types_supported:n?.grant_types_supported&&!n.grant_types_supported.includes(`authorization_code`)?[]:[`code`],response_modes_supported:[`query`],grant_types_supported:n?.grant_types_supported??[`authorization_code`,`client_credentials`,`refresh_token`],token_endpoint_auth_methods_supported:n?.token_endpoint_auth_methods_supported??[...n?.public_client_supported?[`none`]:[],`client_secret_basic`,`client_secret_post`,`private_key_jwt`],token_endpoint_auth_signing_alg_values_supported:[...rX],introspection_endpoint_auth_methods_supported:n?.endpoint_auth_methods_supported??[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],introspection_endpoint_auth_signing_alg_values_supported:[...rX],revocation_endpoint_auth_methods_supported:n?.endpoint_auth_methods_supported??[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],revocation_endpoint_auth_signing_alg_values_supported:[...rX],code_challenge_methods_supported:[`S256`],authorization_response_iss_parameter_supported:!0,dpop_signing_alg_values_supported:n?.dpop_signing_alg_values_supported??[...eZ],backchannel_logout_supported:i,backchannel_logout_session_supported:i}}function Q0(e,t){let n=t.disableJwtPlugin?void 0:q$(e.context).options,r=B$(t),i=t.allowUnauthenticatedClientRegistration||r.length>0;return{jwtPluginOptions:n,clientDiscoveries:r,authMetadata:Z0(e,n,{scopes_supported:t.advertisedMetadata?.scopes_supported??t.scopes,dynamic_client_registration_supported:t.allowDynamicClientRegistration,public_client_supported:i,grant_types_supported:V$(t),token_endpoint_auth_methods_supported:U$(t,{includeNone:i}),endpoint_auth_methods_supported:U$(t),jwt_disabled:t.disableJwtPlugin,dpop_signing_alg_values_supported:t.dpop?.signingAlgorithms})}}function $0(e,t){let{clientDiscoveries:n,authMetadata:r}=Q0(e,t);return G$(e,t,`oauth-authorization-server`,{...n1(n),...r})}function e2(e,t){let n=e.context.baseURL,{jwtPluginOptions:r,clientDiscoveries:i,authMetadata:a}=Q0(e,t),o={...a,claims_supported:z1(t),claims_parameter_supported:!0,userinfo_endpoint:`${n}/oauth2/userinfo`,subject_types_supported:t.pairwiseSecret?[`public`,`pairwise`]:[`public`],acr_values_supported:[`0`],id_token_signing_alg_values_supported:(()=>{if(t.disableJwtPlugin)return[`HS256`];let e=r?.jwks?.keyPairConfig?.alg??`EdDSA`,n=r?.jwks?.keyPairConfigs?.map(e=>e.alg)??[];return Array.from(/* @__PURE__ */ new Set([e,...n]))})(),end_session_endpoint:`${n}/oauth2/end-session`,request_parameter_supported:!1,request_uri_parameter_supported:!1,prompt_values_supported:[`login`,`consent`,`create`,`select_account`,`none`]};return G$(e,t,`openid-configuration`,{...n1(i),...o})}function t2(e,t){let n=new Headers(t);return n.has(`Cache-Control`)||n.set(`Cache-Control`,`public, max-age=15, stale-while-revalidate=15, stale-if-error=86400`),n.set(`Content-Type`,`application/json`),new Response(JSON.stringify(e),{status:200,headers:n})}function n2(e,t,n){let{redirectOnError:r,onValidationError:i,errorCodesByField:a,defaultError:o=`invalid_request`,...s}=t;if(!r)return X(e,{...s,onValidationError:async e=>{throw i&&await i(e),new O(`BAD_REQUEST`,{...r2(e.issues,a,o)})}},n);let c=r,{body:l,query:u,...d}=s;async function f(e,t,n){if(!n)return{ok:!0};let r=await n.safeParseAsync(e[t]??{});return r.success?(e[t]=r.data,{ok:!0}):(i&&await i({message:r.error.message,issues:r.error.issues}),{ok:!1,response:c({...r2(r.error.issues,a,o),ctx:e})})}return X(e,d,async e=>{let t=await f(e,`body`,l);if(!t.ok)return t.response;let r=await f(e,`query`,u);return r.ok?n(e):r.response})}function r2(e,t,n=`invalid_request`){let r=e[0];if(!r)return{error:n,error_description:`Invalid request.`};let i=r.path?.[0],a=typeof i==`string`?i:void 0,o=a?t?.[a]:void 0,s=r.path?.length?nee(r.path):``;return{error:D_e(r,o,n),error_description:k_e(r,s)}}function D_e(e,t,n){return typeof t==`string`?t:O_e(e)?t?.missing??n:e.code===`invalid_value`?t?.invalid??n:n}function O_e(e){return e.code===`invalid_type`&&e.message.endsWith(`received undefined`)}function k_e(e,t){if(!t)return e.message;if(e.code===`invalid_type`)return e.message.endsWith(`received undefined`)?`${t} is required`:e.message.endsWith(`received array`)?`${t} must not appear more than once`:`${t} must be a ${e.expected??`valid value`}`;if(e.code===`invalid_value`){let n=e.values;if(Array.isArray(n)&&n.length>0)return`${t} must be one of: ${n.join(`, `)}`}return`${t}: ${e.message}`}const A_e=e=>Rq(async t=>{if(!e.allowPublicClientPrelogin)throw new E(`BAD_REQUEST`);let n=t.body.oauth_query;if(!await $$(n,t.context.secret))throw new E(`UNAUTHORIZED`,{error:`invalid_signature`})}),i2={"P-256":`ES256`,"P-384":`ES384`,"P-521":`ES512`},j_e=[`Ed25519`],M_e=[`d`,`p`,`q`,`dp`,`dq`,`qi`,`oth`];function a2(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function o2(e,t){return typeof e[t]==`string`&&e[t].length>0}function s2(e){return typeof e==`string`&&Object.prototype.hasOwnProperty.call(i2,e)}function c2(e){return j_e.some(t=>t===e)}function N_e(e){switch(e.kty){case`RSA`:return o2(e,`n`)&&o2(e,`e`);case`EC`:return s2(e.crv)&&o2(e,`x`)&&o2(e,`y`);case`OKP`:return c2(e.crv)&&o2(e,`x`);default:return!1}}function P_e(e){if(e.alg===void 0)return!0;if(typeof e.alg!=`string`||!rX.some(t=>t===e.alg))return!1;switch(e.kty){case`RSA`:return e.alg.startsWith(`RS`)||e.alg.startsWith(`PS`);case`EC`:return s2(e.crv)&&i2[e.crv]===e.alg;case`OKP`:return c2(e.crv)&&e.alg===`EdDSA`;default:return!1}}function l2(e){let t=a2(e)&&Array.isArray(e.keys)?e.keys:void 0;if(!t?.length)return{valid:!1,error:`jwks must be an RFC 7517 JWK Set object with a non-empty keys array`};for(let e of t){if(!a2(e))return{valid:!1,error:`jwks keys must be supported public JWKs with required key parameters`};if(e.kty===`oct`||`k`in e||M_e.some(t=>t in e))return{valid:!1,error:`jwks must contain only public asymmetric keys`};if(!N_e(e))return{valid:!1,error:`jwks keys must be supported public JWKs with required key parameters`};if(!P_e(e))return{valid:!1,error:`jwks key alg must be supported for private_key_jwt and compatible with its key type and signing curve`}}return{valid:!0,jwks:{keys:t}}}function u2(e){let t=l2(e);if(!t.valid)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:t.error})}const F_e=Object.freeze(Object.keys({clientId:!0,clientSecret:!0,clientDiscoveryId:!0,disabled:!0,scopes:!0,clientCredentialsScopes:!0,userId:!0,createdAt:!0,updatedAt:!0,expiresAt:!0,name:!0,uri:!0,icon:!0,contacts:!0,tos:!0,policy:!0,softwareId:!0,softwareVersion:!0,softwareStatement:!0,redirectUris:!0,postLogoutRedirectUris:!0,backchannelLogoutUri:!0,backchannelLogoutSessionRequired:!0,tokenEndpointAuthMethod:!0,grantTypes:!0,responseTypes:!0,applicationType:!0,jwks:!0,jwksUri:!0,requirePKCE:!0,dpopBoundAccessTokens:!0,skipConsent:!0,enableEndSession:!0,subjectType:!0,referenceId:!0,metadata:!0})),I_e=/* @__PURE__ */ `client_id.client_secret.client_secret_expires_at.scope.user_id.client_id_issued_at.client_name.client_uri.logo_uri.contacts.tos_uri.policy_uri.jwks.jwks_uri.software_id.software_version.software_statement.redirect_uris.post_logout_redirect_uris.backchannel_logout_uri.backchannel_logout_session_required.token_endpoint_auth_method.grant_types.response_types.application_type.disabled.skip_consent.enable_end_session.require_pkce.dpop_bound_access_tokens.subject_type.reference_id`.split(`.`),L_e=/* @__PURE__ */ new Set([...F_e,...I_e,`public`,`type`,`resources`,`client_credentials_scopes`]),R_e=/* @__PURE__ */ new Set(/* @__PURE__ */ `disabled.client_secret.client_secret_expires_at.client_id_issued_at.skip_consent.enable_end_session.require_pkce.reference_id.user_id.resources.clientSecret.clientDiscoveryId.skipConsent.enableEndSession.requirePKCE.referenceId.userId.clientId.applicationType.tokenEndpointAuthMethod.redirectUris.postLogoutRedirectUris.grantTypes.responseTypes.scopes.expiresAt.createdAt.updatedAt.softwareId.softwareVersion.softwareStatement.backchannelLogoutUri.backchannelLogoutSessionRequired.jwksUri.dpopBoundAccessTokens.subjectType`.split(`.`));function d2(e){return R_e.has(e)}function f2(e){if(e)return Object.fromEntries(Object.entries(e).filter(([e])=>!L_e.has(e)))}async function p2(e,t,n,r,i){if(!t)throw new E(`UNAUTHORIZED`);if(!e.headers)throw new E(`BAD_REQUEST`);if(r===`configure-client-credentials-scopes`&&!n.clientPrivileges||n.clientPrivileges&&!await n.clientPrivileges({headers:e.headers,action:r,session:t.session,user:t.user,clientId:i}))throw new E(`UNAUTHORIZED`)}async function m2(e,t,n,r,i){if(!t)throw new E(`UNAUTHORIZED`);if(!e.headers)throw new E(`BAD_REQUEST`);if(n.resourcePrivileges&&!await n.resourcePrivileges({headers:e.headers,action:r,session:t.session,user:t.user,resourceId:i}))throw new E(`UNAUTHORIZED`)}var z_e=/* @__PURE__ */ k$({consumeClientAssertion:()=>w2,isPrivateHostname:()=>x2,verifyClientAssertion:()=>T2});const h2=/* @__PURE__ */ new WeakMap,g2=65536,B_e=/^application\/(?:[-\w.]+\+)?json\s*(?:;|$)/i;function _2(e,t,n,r){if(e.set(t,{jwks:n,fetchedAt:r}),e.size>500){let t=e.keys().next().value;t!==void 0&&e.delete(t)}}function v2(e){let t=h2.get(e);if(t)return t;let n=/* @__PURE__ */ new Map;return h2.set(e,n),n}function y2(e){return`${e.clientDiscoveryId??`managed`}:${e.jwksUri??``}`}const b2=[...rX];function x2(e){return!SY(e)}function V_e(e,t,n){let r=new URL(t);if(r.protocol!==`https:`)throw new O(`BAD_REQUEST`,{error_description:`jwks_uri must use HTTPS`,error:`invalid_client`});if(r.username||r.password)throw new O(`BAD_REQUEST`,{error_description:`jwks_uri must not contain credentials`,error:`invalid_client`});if(t.includes(`#`))throw new O(`BAD_REQUEST`,{error_description:`jwks_uri must not include a fragment component`,error:`invalid_client`});if(x2(r.hostname))throw new O(`BAD_REQUEST`,{error_description:`jwks_uri must not point to a private or reserved address`,error:`invalid_client`});if(!(n&&r.origin===n)&&!e.context.isTrustedOrigin(r.href))throw new O(`BAD_REQUEST`,{error_description:`client jwks_uri is not trusted`,error:`invalid_client`})}function H_e(e){try{let t=new URL(e);return t.protocol!==`https:`&&t.protocol!==`http:`?void 0:t.origin}catch{return}}async function U_e(e){let t=e.headers.get(`content-length`);if(t!==null&&Number.isFinite(Number(t))&&Number(t)>g2)throw await e.body?.cancel(),Error(`JWKS response exceeds 64 KiB`);if(!e.body)return``;let n=e.body.getReader(),r=[],i=0;for(;;){let{done:e,value:t}=await n.read();if(e)break;if(i+=t.byteLength,i>g2)throw await n.cancel(),Error(`JWKS response exceeds 64 KiB`);r.push(t)}let a=new Uint8Array(i),o=0;for(let e of r)a.set(e,o),o+=e.byteLength;return new TextDecoder().decode(a)}async function S2(e,t=globalThis.fetch){let n=new AbortController,r=setTimeout(()=>n.abort(),5e3);try{let r=await t(e,{signal:n.signal,headers:{accept:`application/json`},redirect:`error`});if(r.redirected)throw Error(`JWKS fetch redirected`);if(r.status!==200)throw Error(`JWKS fetch returned ${r.status}`);let i=r.headers.get(`content-type`);if(!i||!B_e.test(i))throw Error(`JWKS response must use a JSON media type`);let a=await U_e(r),o;try{o=JSON.parse(a)}catch{return{valid:!1}}let s=l2(o);return s.valid?{valid:!0,jwks:s.jwks}:{valid:!1}}finally{clearTimeout(r)}}function C2(){return new O(`BAD_REQUEST`,{error_description:`failed to fetch client JWKS`,error:`invalid_client`})}async function W_e(e,t,n){if(n.jwks)return JSON.parse(n.jwks);if(!n.jwksUri)throw new O(`BAD_REQUEST`,{error_description:`client has no JWKS configured`,error:`invalid_client`});let r=n.clientDiscoveryId?B$(t).find(e=>e.id===n.clientDiscoveryId):void 0;if(n.clientDiscoveryId&&!r?.fetchClientMetadataResource)throw new O(`BAD_REQUEST`,{error_description:`client discovery does not provide a metadata resource transport`,error:`invalid_client`});V_e(e,n.jwksUri,n.clientDiscoveryId?H_e(n.clientId):void 0);let i=Date.now(),a=y2(n),o=v2(t),s=o.get(a);if(s&&i-s.fetchedAt<3e5)return s.jwks;let c;try{c=await S2(n.jwksUri,r?.fetchClientMetadataResource)}catch{if(s&&i-s.fetchedAt<6e5)return s.jwks;throw C2()}if(!c.valid)throw C2();return _2(o,a,c.jwks,i),c.jwks}async function G_e(e,t){if(!t.jwksUri)return null;let n=t.clientDiscoveryId?B$(e).find(e=>e.id===t.clientDiscoveryId):void 0;if(t.clientDiscoveryId&&!n?.fetchClientMetadataResource)return null;try{let r=await S2(t.jwksUri,n?.fetchClientMetadataResource);return r.valid?(_2(v2(e),y2(t),r.jwks,Date.now()),r.jwks):null}catch{return null}}async function w2(e,t,n){let{namespace:r,payload:i,expectedAudience:a}=n;if(!(Array.isArray(i.aud)?i.aud:i.aud==null?[]:[i.aud]).includes(a))throw new O(`BAD_REQUEST`,{error_description:`client assertion aud does not match the endpoint`,error:`invalid_client`});let o=t.assertionMaxLifetime??300,s=Math.floor(Date.now()/1e3);if(typeof i.exp!=`number`)throw new O(`BAD_REQUEST`,{error_description:`client assertion must include exp claim`,error:`invalid_client`});if(i.exp<=s)throw new O(`BAD_REQUEST`,{error_description:`client assertion has expired`,error:`invalid_client`});if(i.exp-s>o)throw new O(`BAD_REQUEST`,{error_description:`client assertion exp is too far in the future (max ${o}s)`,error:`invalid_client`});if(typeof i.iat==`number`&&s-i.iat>o)throw new O(`BAD_REQUEST`,{error_description:`client assertion iat is too far in the past (max ${o}s)`,error:`invalid_client`});if(typeof i.jti!=`string`||i.jti.length===0)throw new O(`BAD_REQUEST`,{error_description:`client assertion must include jti claim`,error:`invalid_client`});let c=await jU(`SHA-256`).digest(new TextEncoder().encode(`${r}:${i.jti}`)),l=xe(new Uint8Array(c).slice(0,24),e.context.options);try{await e.context.adapter.create({model:`oauthClientAssertion`,data:{id:l,expiresAt:/* @__PURE__ */ new Date(i.exp*1e3)},forceAllowId:!0})}catch(t){let n=!1;try{n=!!await e.context.adapter.findOne({model:`oauthClientAssertion`,where:[{field:`id`,value:l}]})}catch{}throw n?new O(`BAD_REQUEST`,{error_description:`client assertion jti has already been used`,error:`invalid_client`}):t}}async function T2(e,t,n,r,i,a,o){if(r!==`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)throw new O(`BAD_REQUEST`,{error_description:`unsupported client_assertion_type`,error:`invalid_client`});let s;try{s=gI(n)}catch{throw new O(`BAD_REQUEST`,{error_description:`malformed client assertion: invalid JWT header`,error:`invalid_client`})}if(!s.alg||!b2.includes(s.alg))throw new O(`BAD_REQUEST`,{error_description:`unsupported assertion signing algorithm: ${s.alg}`,error:`invalid_client`});let c;try{c=_I(n)}catch{throw new O(`BAD_REQUEST`,{error_description:`malformed client assertion: invalid JWT payload`,error:`invalid_client`})}let l=c.sub??c.iss;if(!l)throw new O(`BAD_REQUEST`,{error_description:`client assertion must contain sub or iss claim identifying the client`,error:`invalid_client`});if(i&&i!==l)throw new O(`BAD_REQUEST`,{error_description:`client_id in body does not match assertion sub/iss`,error:`invalid_client`});let u=await t1(e,t,l);if(!u)throw new O(`BAD_REQUEST`,{error_description:`client not found`,error:`invalid_client`});if(u.disabled)throw new O(`BAD_REQUEST`,{error_description:`client is disabled`,error:`invalid_client`});if(u.tokenEndpointAuthMethod!==`private_key_jwt`)throw new O(`BAD_REQUEST`,{error_description:`client is not registered for private_key_jwt authentication`,error:`invalid_client`});o?.assertClient?.(u);let d=await W_e(e,t,u),f=a??`${e.context.baseURL}/oauth2/token`,p=f4(e,t),m=o?.endpointAudienceOnly?[f]:[.../* @__PURE__ */ new Set([f,p])],h={issuer:l,subject:l,audience:m,algorithms:b2},g;try{({payload:g}=await nI(n,dI(d),h))}catch(e){if(e instanceof Error&&/no matching key|no applicable key/i.test(e.message)){let e=await G_e(t,u);if(e)try{({payload:g}=await nI(n,dI(e),h))}catch{throw new O(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}else throw new O(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}else throw new O(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}let _=(Array.isArray(g.aud)?g.aud:[g.aud]).find(e=>typeof e==`string`&&m.includes(e));return await w2(e,t,{namespace:`private_key_jwt:${l}`,payload:g,expectedAudience:_}),{clientId:l,client:u}}function E2(e,t,n){return new O(e,{error:t,error_description:n},{"WWW-Authenticate":`Bearer error="${t}"`,...Fq})}async function K_e(e,t,n){let r=e.headers,i;try{i=Ohe(r?.get(`authorization`))}catch{throw E2(`BAD_REQUEST`,`invalid_request`,`Malformed initial access token Authorization header`)}if(!i||!r)return;if(!t.validateInitialAccessToken)throw E2(`UNAUTHORIZED`,`invalid_token`,`Invalid initial access token`);let a;try{a=await t.validateInitialAccessToken({initialAccessToken:i,headers:r,clientMetadata:n})}catch(e){throw e instanceof O?e:new O(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Initial access token validation failed`})}if(!a)throw E2(`UNAUTHORIZED`,`invalid_token`,`Invalid initial access token`);return a}const q_e=[`authorization_code`];function D2(e){return[.../* @__PURE__ */ new Set([...e.clientRegistrationDefaultScopes??e.scopes??[],...e.clientRegistrationAllowedScopes??[]])]}function O2(e){let t=e.grant_types??[...q_e];if(t.length>0)return t;throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`grant_types must contain at least one grant type`})}function J_e(e,t){return e.response_types?e.response_types:t.includes(`authorization_code`)?[`code`]:void 0}function k2(e,t){let n=new Set(V$(e)),r=t.filter(e=>n.has(e));if(r.length===0)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`no mutually supported grant_type among ${t.join(`, `)}`});return r}function A2(e,t=`web`){let n=O2(e);return{...e,token_endpoint_auth_method:e.token_endpoint_auth_method??`client_secret_basic`,application_type:e.application_type??(t===null?void 0:t),grant_types:n,response_types:J_e(e,n)}}function Y_e(e){let t=new URL(e);return t.protocol!==`http:`&&t.protocol!==`https:`&&t.host!==``}function X_e(e){try{let t=new URL(e).protocol;return t!==`http:`&&t!==`https:`}catch{return!1}}function j2(e,t){let n=e.clientRegistrationDefaultApplicationType??`web`;return n===`infer`?(t.redirect_uris??[]).some(e=>X_e(e)||N2(e))?`native`:`web`:n}function M2(e){throw new E(`BAD_REQUEST`,{error:`invalid_redirect_uri`,error_description:e})}function Z_e(e){let t=/^http:\/\/([^/?#]*)/i.exec(e)?.[1];if(!t)return null;let n=t.slice(t.lastIndexOf(`@`)+1);if(n.startsWith(`[`)){let e=n.indexOf(`]`);return e<0?null:n.slice(0,e+1).toLowerCase()}return(n.split(`:`)[0]??``).toLowerCase()}function N2(e){let t=Z_e(e);return t===`localhost`||t===`127.0.0.1`||t===`[::1]`}function Q_e(e,t){let n=/* @__PURE__ */ new Set([...e.clientRegistrationDefaultResources??[],...e.clientRegistrationAllowedResources??[]]);for(let e of t)if(!n.has(e))throw new E(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${e} is not allowed for client registration`})}async function $_e(e,t,n){let r=t.clientRegistrationDefaultResources??[],i=[.../* @__PURE__ */ new Set([...r,...n])];for(let n of i){let r=await Q1(e,t,n);if(!r)throw new E(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} does not exist`});if(r.disabled)throw new E(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is disabled`})}return i}function eve(e,t){let n;try{n=new URL(e)}catch{M2(`redirect URI must be an absolute URI: ${e}`)}(e.includes(`#`)||n.username.length>0||n.password.length>0)&&M2(`redirect URI must not include credentials or a fragment: ${e}`);let r=n.protocol===`http:`,i=n.protocol===`https:`;/^localhost\.+$/i.test(n.hostname)&&M2(`redirect URI localhost must not include trailing dots: ${e}`);let a=bY(n.hostname)||n.hostname===`localhost`;t===`web`?(!i||a)&&M2(`web clients require https redirect URIs on non-loopback hosts: ${e}`):i?a&&M2(`native clients must not use https loopback redirect URIs: ${e}`):r?N2(e)||M2(`native clients may use http only on the exact loopback hosts localhost, 127.0.0.1, or [::1]: ${e}`):O1(n)||M2(`native private-use redirect URI schemes must not use a reserved scheme; they must be an authority-free reverse-domain URI or a custom-scheme URI with a host and a path: ${e}`)}async function tve(e,t){let n=e.body;if(!t.allowDynamicClientRegistration)throw new E(`FORBIDDEN`,{error:`access_denied`,error_description:`Client registration is disabled`});let r=await RJ(e),i=r?void 0:await K_e(e,t,n),a=!!i;if(!(r||a||t.allowUnauthenticatedClientRegistration))throw new E(`UNAUTHORIZED`,{error_description:`Authentication required for client registration`},{"WWW-Authenticate":`Bearer`,...Fq});let o=n.grant_types?.length?k2(t,n.grant_types):n.grant_types,s=n.grant_types?.includes(`authorization_code`)&&!o?.includes(`authorization_code`),c={...n,grant_types:o,response_types:s?void 0:n.response_types};if(!r&&!a&&c.grant_types?.includes(`client_credentials`))throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`client_credentials grant requires authenticated registration`});let l=Array.isArray(n.resources)?n.resources.filter(e=>typeof e==`string`&&e.length>0):[];r&&await p2(e,r,t,`create`);let u=i?.referenceId??(r&&t.clientReference?await t.clientReference({user:r.user,session:r.session}):void 0),d=await z2(e,t,{metadata:c,registrationSource:`dynamic`,userId:u?void 0:r?.session.userId,referenceId:u,requestedResources:l});return e.setStatus(201),e.json(d)}async function P2(e,t,n){let r=n?.registrationSource===`clientMetadataDocument`,i=A2(e,r?null:n?.registrationSource===`dynamic`?j2(t,e):`web`),a=i.token_endpoint_auth_method??`client_secret_basic`;if(!new Set(U$(t,{includeNone:!0})).has(a))throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`unsupported token_endpoint_auth_method ${a}`});if(i.dpop_bound_access_tokens!==void 0&&typeof i.dpop_bound_access_tokens!=`boolean`)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`dpop_bound_access_tokens must be a boolean`});let o=i.grant_types??[],s=i.response_types,c=i.application_type;if(c!==void 0&&c!==`web`&&c!==`native`)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`application_type must be web or native`});if(o.includes(`authorization_code`)&&(!i.redirect_uris||i.redirect_uris.length===0))throw new E(`BAD_REQUEST`,{error:`invalid_redirect_uri`,error_description:`Redirect URIs are required for authorization_code and implicit grant types`});for(let e of i.redirect_uris??[])eve(e,c??(r?`native`:`web`));if(r)k2(t,o);else{let e=new Set(V$(t));for(let t of o)if(!e.has(t))throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`unsupported grant_type ${t}`})}if(o.includes(`authorization_code`)&&!s?.includes(`code`))throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`When 'authorization_code' grant type is used, 'code' response type must be included`});if(!o.includes(`authorization_code`)&&s?.includes(`code`))throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`When 'code' response type is used, 'authorization_code' grant type must be included`});if(i.subject_type!==void 0){if(i.subject_type!==`public`&&i.subject_type!==`pairwise`)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`subject_type must be "public" or "pairwise"`});if(i.subject_type===`pairwise`&&!t.pairwiseSecret)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise subject_type requires server pairwiseSecret configuration`});if(i.subject_type===`pairwise`&&i.redirect_uris?.some(Y_e))throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise clients cannot use custom-scheme redirect URIs that include a host`});if(i.subject_type===`pairwise`&&i.redirect_uris&&i.redirect_uris.length>1&&new Set(i.redirect_uris.map(e=>new URL(e).host)).size>1)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise clients with redirect_uris on different hosts require a sector_identifier_uri, which is not yet supported. All redirect_uris must share the same host.`})}let l=(i?.scope)?.split(` `).filter(e=>e.length),u=n?.registrationSource===`dynamic`||n?.registrationSource===`clientMetadataDocument`,d=u?D2(t):t.scopes;if(d){let e=new Set(d);for(let t of l??[])if(!e?.has(t))throw new E(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`cannot request scope ${t}`})}if(u&&i.require_pkce===!1)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pkce is required for registered clients.`});if(i.jwks||i.jwks_uri){if(i.jwks&&i.jwks_uri)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks and jwks_uri are mutually exclusive`});if(i.jwks_uri)try{let e=new URL(i.jwks_uri);if(e.protocol!==`https:`)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must use HTTPS`});if(e.username||e.password)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not contain credentials`});if(i.jwks_uri.includes(`#`))throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not include a fragment component`});if(x2(e.hostname))throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not point to a private or reserved address`});if(n?.ctx&&!n.ctx.context.isTrustedOrigin(e.href)){let t=typeof i.client_id==`string`?i.client_id:void 0;if(!(r&&t!==void 0&&URL.canParse(t)&&new URL(t).origin===e.origin))throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must belong to a trusted origin or the Client ID Metadata Document origin`})}}catch(e){throw e instanceof E?e:new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must be a valid URL`})}i.jwks&&u2(i.jwks)}if(a===`private_key_jwt`&&!i.jwks&&!i.jwks_uri)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`private_key_jwt requires either jwks or jwks_uri`});if(i.backchannel_logout_uri!==void 0){if(t.disableJwtPlugin)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri requires the jwt plugin (disableJwtPlugin must be false)`});let e;try{e=new URL(i.backchannel_logout_uri)}catch{throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must be an absolute URL`})}if(i.backchannel_logout_uri.includes(`#`))throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not include a fragment component`});if(e.protocol!==`https:`)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must use https`});if(e.username||e.password)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not contain credentials`});if(x2(e.hostname))throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not point to a private or reserved address`})}}const F2=Symbol(`client-registration-collision`);function I2(e){if(!e||typeof e!=`object`)return!1;let t=e;return t[F2]===!0&&(t.kind===`oauth-client-row-unique`||t.kind===`oauth-client-resource-link-unique`)&&`cause`in t}async function L2(e,t,n){let r=n.registrationSource===`dynamic`&&!n.metadata.scope?{...n.metadata,scope:(t.clientRegistrationDefaultScopes??t.scopes)?.join(` `)}:n.metadata,i=A2(r,n.registrationSource===`clientMetadataDocument`?null:n.registrationSource===`dynamic`?j2(t,r):`web`),a=i.token_endpoint_auth_method===`none`,o=i.token_endpoint_auth_method===`private_key_jwt`,s=W$(t,i.token_endpoint_auth_method);await P2(i,t,{registrationSource:n.registrationSource,ctx:e});let c=n.clientId??t.generateClientId?.()??qH(32,`a-z`,`A-Z`),l=a||o||s?void 0:t.generateClientSecret?.()||qH(32,`a-z`,`A-Z`),u=l?await a1(e,t,l):void 0,d=n.registrationSource===`dynamic`&&!a&&t.clientRegistrationRequirePKCE===!1,f=i.require_pkce??(!d&&void 0),p=Math.floor(Date.now()/1e3),{resources:m,...h}=n.registrationSource===`dynamic`||n.registrationSource===`clientMetadataDocument`?{...i,scope:D2(t).join(` `)}:i,g=n.registrationSource===`clientMetadataDocument`?void 0:{userId:n.userId,referenceId:n.referenceId},_=U2({...h,redirect_uris:i.redirect_uris??[],disabled:void 0,client_secret_expires_at:u?n.registrationSource===`dynamic`&&t.clientRegistrationClientSecretExpiration?S$(t.clientRegistrationClientSecretExpiration,p):0:void 0,client_id:c,client_secret:u,client_id_issued_at:p,require_pkce:f,user_id:g?.referenceId?void 0:g?.userId,reference_id:g?.referenceId});_.clientCredentialsScopes=n.registrationSource===`clientMetadataDocument`?n.existingClient?.clientCredentialsScopes??[]:n.registrationSource===`managed`?n.clientCredentialsScopes??[]:[],_.clientDiscoveryId=n.registrationSource===`clientMetadataDocument`?n.clientDiscoveryId:null,n.registrationSource===`clientMetadataDocument`&&i.application_type===void 0&&(_.applicationType=null);let v=n.registrationSource===`clientMetadataDocument`?[]:n.requestedResources??[];n.registrationSource===`dynamic`&&Q_e(t,v);let y=await $_e(e,t,v),b=t.schema?.oauthClient?.modelName??`oauthClient`,x=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,S=n.registrationSource===`clientMetadataDocument`?n.existingClient:void 0,ee=n.registrationSource===`clientMetadataDocument`?n.clientDiscoveryId:null,C=await CH(e.context.adapter,async()=>{let t=await xH(e.context.adapter),r,i=!1;if(S){let e=await t.update({model:b,where:[{field:`clientId`,value:c},{field:`clientDiscoveryId`,value:ee}],update:{..._,disabled:S.disabled,skipConsent:S.skipConsent,enableEndSession:S.enableEndSession,createdAt:S.createdAt,updatedAt:/* @__PURE__ */ new Date(p*1e3)}});if(!e)throw new E(`BAD_REQUEST`,{error:`invalid_client`,error_description:`client no longer exists`});r=e}else{try{r=await t.create({model:b,data:{..._,createdAt:/* @__PURE__ */ new Date(p*1e3),updatedAt:/* @__PURE__ */ new Date(p*1e3)}})}catch(e){throw n.registrationSource===`clientMetadataDocument`&&V2(e)?{[F2]:!0,kind:`oauth-client-row-unique`,clientId:c,cause:e}:e}i=!0}let a=y.length===0?[]:await t.findMany({model:x,where:[{field:`clientId`,value:c}]}),o=new Set(a.map(e=>e.resourceId)),s=/* @__PURE__ */ new Date;for(let e of y)if(!o.has(e))try{await t.create({model:x,data:{clientId:c,resourceId:e,createdAt:s}})}catch(t){throw n.registrationSource===`clientMetadataDocument`&&V2(t)?{[F2]:!0,kind:`oauth-client-resource-link-unique`,clientId:c,resourceId:e,cause:t}:t}return{client:r,created:i}});return{client:C.client,clientSecret:l,resources:y,created:C.created}}function R2(e,t){let n=W2({...e.client,clientSecret:e.clientSecret?(t.prefix?.clientSecret??``)+e.clientSecret:void 0});return e.resources.length>0&&(n.resources=e.resources),n}function nve(e,t){return{...R2(e,t),client_credentials_scopes:[...e.client.clientCredentialsScopes??[]]}}async function z2(e,t,n){return R2(await L2(e,t,n),t)}async function rve(e,t,n){return nve(await L2(e,t,n),t)}function ive(e,t){if(e&&e.clientDiscoveryId!==t)throw new E(`BAD_REQUEST`,{error:`invalid_client`,error_description:`client_id is already owned by a different registration source`})}async function B2(e,t,n){if(ive(n.existingClient,n.clientDiscoveryId),n.metadata.backchannel_logout_uri!==void 0||n.metadata.backchannel_logout_session_required!==void 0)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`Client ID Metadata Documents cannot register a back-channel logout target`});if((n.metadata.token_endpoint_auth_method??`none`)!==`none`&&n.metadata.token_endpoint_auth_method!==`private_key_jwt`)throw new E(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`Client ID Metadata Document clients cannot use a shared secret`});let r={...n,metadata:{...n.metadata,token_endpoint_auth_method:n.metadata.token_endpoint_auth_method??`none`,client_secret:void 0,client_secret_expires_at:void 0},registrationSource:`clientMetadataDocument`};try{return await L2(e,t,r)}catch(i){if(!I2(i))throw i;let a=t.schema?.oauthClient?.modelName??`oauthClient`,o=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,s=await e.context.adapter.findOne({model:a,where:[{field:`clientId`,value:n.clientId}]});if(i.clientId!==n.clientId||!s||s.clientDiscoveryId!==n.clientDiscoveryId||i.kind===`oauth-client-resource-link-unique`&&!await e.context.adapter.findOne({model:o,where:[{field:`clientId`,value:i.clientId},{field:`resourceId`,value:i.resourceId}]}))throw i.cause;try{return await L2(e,t,{...r,existingClient:s})}catch(e){throw I2(e)?e.cause:e}}}function V2(e){if(!e||typeof e!=`object`)return!1;let t=e,n=String(t.code??t.errno??``);return[`1062`,`11000`,`23505`,`ER_DUP_ENTRY`,`P2002`,`SQLITE_CONSTRAINT_UNIQUE`].includes(n)||t.name===`MongoServerError`&&t.code===11e3?!0:typeof t.message==`string`&&/(?:duplicate|unique constraint|unique key)/i.test(t.message)}async function H2(e,t,n){let r=await RJ(e);if(await p2(e,r,t,`create`),!r)throw new E(`UNAUTHORIZED`);let i=t.clientReference?await t.clientReference({user:r.user,session:r.session}):void 0,{client_credentials_scopes:a,...o}=e.body,s=n?.admin?a0(a??[]):[];o0(s,O2(o),o.token_endpoint_auth_method,t),s.length>0&&await p2(e,r,t,`configure-client-credentials-scopes`);let c=n?.admin?o.resources:void 0;for(let n of new Set(c??[]))await m2(e,r,t,`link`,n);let l={metadata:o,registrationSource:`managed`,userId:i?void 0:r.session.userId,referenceId:i,clientCredentialsScopes:s,...c?{requestedResources:c}:{}},u=n?.admin?await rve(e,t,l):await z2(e,t,l);return e.setStatus(201),e.json(u)}function U2(e){let{client_id:t,client_secret:n,client_secret_expires_at:r,scope:i,user_id:a,client_id_issued_at:o,client_name:s,client_uri:c,logo_uri:l,contacts:u,tos_uri:d,policy_uri:f,jwks:p,jwks_uri:m,software_id:h,software_version:g,software_statement:_,redirect_uris:v,post_logout_redirect_uris:y,backchannel_logout_uri:b,backchannel_logout_session_required:x,token_endpoint_auth_method:S,grant_types:ee,response_types:C,application_type:te,disabled:ne,skip_consent:w,enable_end_session:T,require_pkce:re,dpop_bound_access_tokens:ie,subject_type:ae,reference_id:oe,metadata:se}=e,ce=r?/* @__PURE__ */ new Date(Number(r)*1e3):void 0,le=o?/* @__PURE__ */ new Date(o*1e3):void 0,ue=i?.split(` `),de=f2(se??{}),fe=de&&Object.keys(de).length?JSON.stringify(de):void 0;return{clientId:t,clientSecret:n,disabled:ne,scopes:ue,userId:a,createdAt:le,expiresAt:ce,name:s,uri:c,icon:l,contacts:u,tos:d,policy:f,softwareId:h,softwareVersion:g,softwareStatement:_,redirectUris:v,postLogoutRedirectUris:y,backchannelLogoutUri:b,backchannelLogoutSessionRequired:x,tokenEndpointAuthMethod:S,grantTypes:ee,responseTypes:C,jwks:p?JSON.stringify(p):void 0,jwksUri:m,applicationType:te,skipConsent:w,enableEndSession:T,requirePKCE:re,dpopBoundAccessTokens:ie,subjectType:ae,referenceId:oe,metadata:fe}}function W2(e){let{clientId:t,clientSecret:n,disabled:r,scopes:i,userId:a,createdAt:o,updatedAt:s,expiresAt:c,name:l,uri:u,icon:d,contacts:f,tos:p,policy:m,softwareId:h,softwareVersion:g,softwareStatement:_,redirectUris:v,postLogoutRedirectUris:y,backchannelLogoutUri:b,backchannelLogoutSessionRequired:x,tokenEndpointAuthMethod:S,grantTypes:ee,responseTypes:C,applicationType:te,jwks:ne,jwksUri:w,skipConsent:T,enableEndSession:re,requirePKCE:ie,dpopBoundAccessTokens:ae,subjectType:oe,referenceId:se,metadata:ce}=e,le=c?Math.round(new Date(c).getTime()/1e3):void 0,ue=o?Math.round(new Date(o).getTime()/1e3):void 0,de=i?.join(` `);return{...f2(h1(ce)),client_id:t,client_secret:n??void 0,client_secret_expires_at:n?le??0:void 0,scope:de??void 0,user_id:a??void 0,client_id_issued_at:ue??void 0,client_name:l??void 0,client_uri:u??void 0,logo_uri:d??void 0,contacts:f??void 0,tos_uri:p??void 0,policy_uri:m??void 0,jwks:ne?JSON.parse(ne):void 0,jwks_uri:w??void 0,software_id:h??void 0,software_version:g??void 0,software_statement:_??void 0,redirect_uris:v??[],post_logout_redirect_uris:y??void 0,backchannel_logout_uri:b??void 0,backchannel_logout_session_required:x??void 0,token_endpoint_auth_method:S??void 0,grant_types:ee??void 0,response_types:C??void 0,application_type:te??void 0,disabled:r??void 0,skip_consent:T??void 0,enable_end_session:re??void 0,require_pkce:ie??void 0,dpop_bound_access_tokens:ae??void 0,subject_type:oe??void 0,reference_id:se??void 0}}async function ave(e,t){let n=await RJ(e);if(await p2(e,n,t,`read`,e.query.client_id),!n)throw new E(`UNAUTHORIZED`);let r=await t1(e,t,e.query.client_id);if(!r)throw new E(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(r.userId){if(r.userId!==n.user.id)throw new E(`UNAUTHORIZED`)}else if(r.referenceId&&t.clientReference){if(r.referenceId!==await t.clientReference(n))throw new E(`UNAUTHORIZED`)}else throw new E(`UNAUTHORIZED`);let i=W2(r);return i.client_secret=void 0,i}async function G2(e,t,n){let r=await t1(e,t,n);if(!r||r.disabled)throw new E(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});return W2({clientId:r.clientId,name:r.name,uri:r.uri,contacts:r.contacts,icon:r.icon,tos:r.tos,policy:r.policy})}async function ove(e,t){let n=await RJ(e);if(await p2(e,n,t,`list`),!n)throw new E(`UNAUTHORIZED`);let r=await t.clientReference?.(n);if(r)return await e.context.adapter.findMany({model:`oauthClient`,where:[{field:`referenceId`,value:r}]}).then(e=>e?e.map(e=>{let t=W2(e);return t.client_secret=void 0,t}):null);if(n.user.id)return await e.context.adapter.findMany({model:`oauthClient`,where:[{field:`userId`,value:n.user.id}]}).then(e=>e?e.map(e=>{let t=W2(e);return t.client_secret=void 0,t}):null);throw new E(`BAD_REQUEST`,{message:`either user_id or reference_id must be provided`})}async function sve(e,t){let n=await RJ(e);if(await p2(e,n,t,`delete`,e.body.client_id),!n)throw new E(`UNAUTHORIZED`);let r=e.body.client_id;e1(t,r);let i=await t1(e,t,r);if(!i)throw new E(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(i.userId){if(i.userId!==n.user.id)throw new E(`UNAUTHORIZED`)}else if(i.referenceId&&t.clientReference){if(i.referenceId!==await t.clientReference(n))throw new E(`UNAUTHORIZED`)}else throw new E(`UNAUTHORIZED`);await e.context.adapter.delete({model:`oauthClient`,where:[{field:`clientId`,value:r}]})}async function K2(e,t,n){let r=await RJ(e);if(await p2(e,r,t,`update`,e.body.client_id),!r)throw new E(`UNAUTHORIZED`);let i=e.body.client_id;e1(t,i);let a=await t1(e,t,i);if(!a)throw new E(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});let{client_credentials_scopes:o,...s}=e.body.update,c=a.userId?a.userId===r.user.id:a.referenceId&&t.clientReference?a.referenceId===await t.clientReference(r):!1,l=!c&&n?.admin&&o!==void 0&&Object.keys(s).length===0;if(!c&&!l)throw new E(`UNAUTHORIZED`);if(l&&await p2(e,r,t,`configure-client-credentials-scopes`,i),Object.keys(s).length===0&&o===void 0){let e=W2(a);return e.client_secret=void 0,n?.admin?{...e,client_credentials_scopes:[...a.clientCredentialsScopes??[]]}:e}let u=s.grant_types??a.grantTypes??[],d=s.token_endpoint_auth_method??a.tokenEndpointAuthMethod,f=o===void 0?void 0:a0(o);f!==void 0&&(o0(f,u,d,t),f.length>0&&!l&&await p2(e,r,t,`configure-client-credentials-scopes`,i)),await P2({...W2(a),...s},t,{ctx:e});let p={...U2(s)};!u.includes(`client_credentials`)||d===`none`?p.clientCredentialsScopes=[]:f!==void 0&&(p.clientCredentialsScopes=f),s.token_endpoint_auth_method&&(s.token_endpoint_auth_method===`private_key_jwt`?p.clientSecret=null:(p.jwks=null,p.jwksUri=null,p.clientSecret||=await a1(e,t,t.generateClientSecret?.()||qH(32,`a-z`,`A-Z`))));let m=await e.context.adapter.update({model:`oauthClient`,where:[{field:`clientId`,value:i}],update:{...p,updatedAt:/* @__PURE__ */ new Date(Math.floor(Date.now()/1e3)*1e3)}});if(!m)throw new E(`INTERNAL_SERVER_ERROR`,{error_description:`unable to update client`,error:`invalid_client`});let h=W2(m);return h.client_secret=void 0,n?.admin?{...h,client_credentials_scopes:[...m.clientCredentialsScopes??[]]}:h}async function cve(e,t){let n=await RJ(e);if(await p2(e,n,t,`rotate`,e.body.client_id),!n)throw new E(`UNAUTHORIZED`);let r=e.body.client_id;e1(t,r);let i=await t1(e,t,r);if(!i)throw new E(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(i.userId){if(i.userId!==n.user.id)throw new E(`UNAUTHORIZED`)}else if(i.referenceId&&t.clientReference){if(i.referenceId!==await t.clientReference(n))throw new E(`UNAUTHORIZED`)}else throw new E(`UNAUTHORIZED`);if(i.tokenEndpointAuthMethod===`none`||!i.clientSecret)throw new E(`BAD_REQUEST`,{error_description:`secret rotation is only available for clients using client_secret authentication`,error:`invalid_client`});let a=t.generateClientSecret?.()||qH(32,`a-z`,`A-Z`),o=a?await a1(e,t,a):void 0,s=await e.context.adapter.update({model:`oauthClient`,where:[{field:`clientId`,value:r}],update:{clientSecret:o,updatedAt:/* @__PURE__ */ new Date(Math.floor(Date.now()/1e3)*1e3)}});if(!s)throw new E(`INTERNAL_SERVER_ERROR`,{error_description:`unable to update client`,error:`invalid_client`});return W2({...s,clientSecret:(t.prefix?.clientSecret??``)+a})}async function lve(e,t){if(!t.allowClientKeyRotation)throw new E(`FORBIDDEN`,{error:`access_denied`,error_description:`Client key rotation is disabled`});let{body:n}=e;u2(n.jwks);let{client:r}=await T2(e,t,n.client_assertion,n.client_assertion_type,void 0,r0({context:e.context,request:void 0},`/oauth2/client/rotate-keys`),{endpointAudienceOnly:!0,assertClient:e=>uve(t,e)});if(!await e.context.adapter.incrementOne({model:`oauthClient`,where:[{field:`clientId`,value:r.clientId},{field:`jwks`,value:r.jwks}],increment:{},set:{jwks:JSON.stringify(n.jwks),updatedAt:/* @__PURE__ */ new Date}}))throw new E(`CONFLICT`,{error:`invalid_request`,error_description:`client keys changed while rotating; retry with a fresh client assertion`});return{client_id:r.clientId,jwks:n.jwks}}function uve(e,t){if(e1(e,t.clientId),t.clientDiscoveryId||t.jwksUri||!t.jwks)throw new E(`BAD_REQUEST`,{error:`invalid_client`,error_description:`client keys are not stored inline; rotate them where the client publishes them`})}const q2=k().trim().min(1),J2=Pe(k().trim().min(1)).min(1),dve=e=>X(`/admin/oauth2/create-client`,{method:`POST`,body:A({redirect_uris:Pe(k1).min(1).optional(),scope:k().optional(),client_name:k().optional(),client_uri:k().optional(),logo_uri:k().optional(),contacts:Pe(k().min(1)).min(1).optional(),tos_uri:k().optional(),policy_uri:k().optional(),software_id:k().optional(),software_version:k().optional(),software_statement:k().optional(),post_logout_redirect_uris:Pe(k1).min(1).optional(),backchannel_logout_uri:k1.optional(),backchannel_logout_session_required:He().optional(),token_endpoint_auth_method:q2.optional(),application_type:We([`web`,`native`]).optional(),jwks:H1.optional(),jwks_uri:k().optional(),grant_types:J2.optional(),client_credentials_scopes:Pe(k().trim().min(1)).optional(),resources:Pe(V1).optional(),response_types:Pe(We([`code`])).optional(),client_secret_expires_at:Ee([k(),Me()]).optional().default(0),skip_consent:He().optional(),enable_end_session:He().optional(),require_pkce:He().optional(),dpop_bound_access_tokens:He().optional(),subject_type:We([`public`,`pairwise`]).optional(),metadata:Ne(k(),Je()).optional()}),metadata:{noStore:!0,SERVER_ONLY:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},client_credentials_scopes:{type:`array`,items:{type:`string`},description:`Server-authorized scope ceiling for client_credentials tokens`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`URI of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URI for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final server-owned resources linked to the client`},disabled:{type:`boolean`,description:`Whether the client is disabled`},require_pkce:{type:`boolean`,description:`Whether the client requires PKCE`,default:!0},metadata:{type:`object`,additionalProperties:!0,nullable:!0,description:`Additional metadata for the application`}},required:[`client_id`]}}}}}}}},async t=>H2(t,e,{admin:!0})),fve=e=>X(`/oauth2/create-client`,{method:`POST`,use:[BJ],body:A({redirect_uris:Pe(k1).min(1).optional(),scope:k().optional(),client_name:k().optional(),client_uri:k().optional(),logo_uri:k().optional(),contacts:Pe(k().min(1)).min(1).optional(),tos_uri:k().optional(),policy_uri:k().optional(),software_id:k().optional(),software_version:k().optional(),software_statement:k().optional(),post_logout_redirect_uris:Pe(k1).min(1).optional(),backchannel_logout_uri:k1.optional(),backchannel_logout_session_required:He().optional(),token_endpoint_auth_method:q2.optional(),application_type:We([`web`,`native`]).optional(),jwks:H1.optional(),jwks_uri:k().optional(),grant_types:J2.optional(),response_types:Pe(We([`code`])).optional(),dpop_bound_access_tokens:He().optional()}),metadata:{noStore:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`URI of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URI for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final server-owned resources linked to the client`},disabled:{type:`boolean`,description:`Whether the client is disabled`},metadata:{type:`object`,additionalProperties:!0,nullable:!0,description:`Additional metadata for the application`}},required:[`client_id`]}}}}}}}},async t=>H2(t,e)),pve=e=>X(`/oauth2/get-client`,{method:`GET`,use:[BJ],query:A({client_id:k()}),metadata:{openapi:{description:`Get OAuth2 formatted client details`}}},async t=>ave(t,e)),mve=e=>X(`/oauth2/public-client`,{method:`GET`,use:[BJ],query:A({client_id:k()}),metadata:{openapi:{description:`Gets publicly available client fields`}}},async t=>{let n=t.query.client_id;return G2(t,e,n)}),hve=e=>X(`/oauth2/public-client-prelogin`,{method:`POST`,use:[A_e(e)],body:A({client_id:k(),oauth_query:k().optional()}),metadata:{openapi:{description:`Gets publicly available client fields (prior to login)`}}},async t=>{let n=t.body.client_id;return G2(t,e,n)}),gve=e=>X(`/oauth2/get-clients`,{method:`GET`,use:[BJ],metadata:{openapi:{description:`Get OAuth2 formatted client details for a user or organization`}}},async t=>ove(t,e)),_ve=e=>X(`/admin/oauth2/update-client`,{method:`PATCH`,body:A({client_id:k(),update:A({redirect_uris:Pe(k1).min(1).optional(),scope:k().optional(),client_name:k().optional(),client_uri:k().optional(),logo_uri:k().optional(),contacts:Pe(k().min(1)).min(1).optional(),tos_uri:k().optional(),policy_uri:k().optional(),software_id:k().optional(),software_version:k().optional(),software_statement:k().optional(),post_logout_redirect_uris:Pe(k1).min(1).optional(),backchannel_logout_uri:k1.optional(),backchannel_logout_session_required:He().optional(),application_type:We([`web`,`native`]).optional(),grant_types:J2.optional(),client_credentials_scopes:Pe(k().trim().min(1)).optional(),response_types:Pe(We([`code`])).optional(),client_secret_expires_at:Ee([k(),Me()]).optional(),skip_consent:He().optional(),enable_end_session:He().optional(),disabled:He().optional(),dpop_bound_access_tokens:He().optional(),metadata:Ne(k(),Je()).optional()})}),metadata:{SERVER_ONLY:!0,openapi:{description:`Updates OAuth2 formatted client details.`}}},async t=>K2(t,e,{admin:!0})),vve=e=>X(`/oauth2/update-client`,{method:`POST`,use:[BJ],body:A({client_id:k(),update:A({redirect_uris:Pe(k1).min(1).optional(),scope:k().optional(),client_name:k().optional(),client_uri:k().optional(),logo_uri:k().optional(),contacts:Pe(k().min(1)).min(1).optional(),tos_uri:k().optional(),policy_uri:k().optional(),software_id:k().optional(),software_version:k().optional(),software_statement:k().optional(),post_logout_redirect_uris:Pe(k1).min(1).optional(),backchannel_logout_uri:k1.optional(),backchannel_logout_session_required:He().optional(),application_type:We([`web`,`native`]).optional(),grant_types:J2.optional(),response_types:Pe(We([`code`])).optional()})}),metadata:{openapi:{description:`Updates OAuth2 formatted client details.`}}},async t=>K2(t,e)),yve=e=>X(`/oauth2/client/rotate-secret`,{method:`POST`,use:[BJ],body:A({client_id:k()}),metadata:{noStore:!0,openapi:{description:`Rotates a confidential client's secret`}}},async t=>cve(t,e)),bve=e=>n2(`/oauth2/client/rotate-keys`,{method:`POST`,body:A({client_assertion:k(),client_assertion_type:k(),jwks:H1}),errorCodesByField:{client_assertion:`invalid_client`,client_assertion_type:`invalid_client`,jwks:`invalid_client_metadata`},metadata:{noStore:!0,openapi:{description:`Replaces the signing keys of a private_key_jwt client. The request is authenticated by a client assertion signed with one of the client's current keys and addressed to this endpoint. Keys left out of the new set stop verifying at once.`}}},async t=>lve(t,e)),xve=e=>X(`/oauth2/delete-client`,{method:`POST`,use:[BJ],body:A({client_id:k()}),metadata:{openapi:{description:`Deletes an oauth client`}}},async t=>sve(t,e));async function Y2(e,t,n){return await e.context.adapter.findOne({model:`oauthConsent`,where:[{field:`id`,value:n}]})}async function Sve(e,t){let n=await RJ(e);if(!n)throw new E(`UNAUTHORIZED`);let{id:r}=e.query;if(!r)throw new E(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await Y2(e,t,r);if(!i)throw new E(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new E(`UNAUTHORIZED`);return i}async function Cve(e,t){let n=await RJ(e);if(!n)throw new E(`UNAUTHORIZED`);return await e.context.adapter.findMany({model:`oauthConsent`,where:[{field:`userId`,value:n.user.id}]})}async function wve(e,t){let n=await RJ(e);if(!n)throw new E(`UNAUTHORIZED`);let{id:r}=e.body;if(!r)throw new E(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await Y2(e,t,r);if(!i)throw new E(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new E(`UNAUTHORIZED`);await e.context.adapter.delete({model:`oauthConsent`,where:[{field:`id`,value:r}]})}async function Tve(e,t){let n=await RJ(e);if(!n)throw new E(`UNAUTHORIZED`);let{id:r}=e.body;if(!r)throw new E(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await Y2(e,t,r);if(!i)throw new E(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new E(`UNAUTHORIZED`);let a=await t1(e,t,i.clientId);if(!a)throw new E(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});let o=a?.scopes??t.scopes??[],s=e.body.update,c=s.scopes;if(c&&!c.every(e=>o?.includes(e)))throw new E(`BAD_REQUEST`,{error_description:`unable to provide scopes to ${a?.referenceId??a?.userId}`,error:`invalid_request`});let l=Math.floor(Date.now()/1e3);return await e.context.adapter.update({model:`oauthConsent`,where:[{field:`id`,value:r}],update:{...s,updatedAt:/* @__PURE__ */ new Date(l*1e3)}})}const Eve=e=>X(`/oauth2/get-consent`,{method:`GET`,query:A({id:k()}),use:[BJ],metadata:{openapi:{description:`Gets details of a specific OAuth2 consent for a user`}}},async t=>Sve(t,e)),Dve=e=>X(`/oauth2/get-consents`,{method:`GET`,use:[BJ],metadata:{openapi:{description:`Gets all available OAuth2 consents for a user`}}},async t=>Cve(t,e)),Ove=e=>X(`/oauth2/update-consent`,{method:`POST`,use:[BJ],body:A({id:k(),update:A({scopes:Pe(k())})}),metadata:{openapi:{description:`Updates consent granted to a client.`}}},async t=>Tve(t,e)),kve=e=>X(`/oauth2/delete-consent`,{method:`POST`,use:[BJ],body:A({id:k()}),metadata:{openapi:{description:`Deletes consent granted to a client`}}},async t=>wve(t,e)),X2=e=>e.schema?.oauthResource?.modelName??`oauthResource`,Z2=e=>e.schema?.oauthClientResource?.modelName??`oauthClientResource`,Ave=e=>e.schema?.oauthClient?.modelName??`oauthClient`;function Q2(e){try{return decodeURIComponent(e)}catch{return e}}function jve(e,t){return{identifier:e.identifier,name:e.name??e.identifier,accessTokenTtl:e.accessTokenTtl??null,refreshTokenTtl:e.refreshTokenTtl??null,signingAlgorithm:e.signingAlgorithm??null,signingKeyId:e.signingKeyId??null,allowedScopes:e.allowedScopes??null,customClaims:e.customClaims??null,dpopBoundAccessTokensRequired:e.dpopBoundAccessTokensRequired??!1,disabled:e.disabled??!1,policyVersion:1,metadata:e.metadata??null,createdAt:t,updatedAt:t}}async function Mve(e,t){await m2(e,await RJ(e),t,`create`);let n=e.body;if(!n?.identifier)throw new E(`BAD_REQUEST`,{error:`invalid_request`,error_description:`identifier is required`});await lge(t,n.identifier);let r=/* @__PURE__ */ new Date,i;try{i=await e.context.adapter.create({model:X2(t),data:jve(n,r)})}catch(e){let t=e instanceof Error?e.message:String(e);throw/unique|duplicate|UNIQUE/i.test(t)?new E(`BAD_REQUEST`,{error:`invalid_request`,error_description:`resource ${n.identifier} already exists`}):e}if(!i)throw new E(`BAD_REQUEST`,{error:`invalid_request`,error_description:`resource ${n.identifier} could not be created`});return Z1(i.identifier),e.json(i,{status:201})}async function Nve(e,t){await m2(e,await RJ(e),t,`list`);let n=await e.context.adapter.findMany({model:X2(t)});return e.json(n??[])}async function Pve(e,t){let n=Q2(e.params.identifier);await m2(e,await RJ(e),t,`read`,n);let r=await e.context.adapter.findOne({model:X2(t),where:[{field:`identifier`,value:n}]});if(!r)throw new E(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return e.json(r)}async function Fve(e,t){let n=Q2(e.params.identifier);if(await m2(e,await RJ(e),t,`update`,n),!await e.context.adapter.findOne({model:X2(t),where:[{field:`identifier`,value:n}]}))throw new E(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});let r={updatedAt:/* @__PURE__ */ new Date};for(let t of[`name`,`accessTokenTtl`,`refreshTokenTtl`,`signingAlgorithm`,`signingKeyId`,`allowedScopes`,`customClaims`,`dpopBoundAccessTokensRequired`,`disabled`,`metadata`])Object.prototype.hasOwnProperty.call(e.body,t)&&(r[t]=e.body[t]);await e.context.adapter.update({model:X2(t),where:[{field:`identifier`,value:n}],update:r}),Z1(n);let i=await e.context.adapter.findOne({model:X2(t),where:[{field:`identifier`,value:n}]});if(!i)throw new E(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return e.json(i)}async function Ive(e,t){let n=Q2(e.params.identifier);if(await m2(e,await RJ(e),t,`delete`,n),!await e.context.adapter.findOne({model:X2(t),where:[{field:`identifier`,value:n}]}))throw new E(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return await e.context.adapter.delete({model:X2(t),where:[{field:`identifier`,value:n}]}),Z1(n),e.json({deleted:!0})}async function Lve(e,t){let n=await RJ(e),r=Q2(e.params.identifier),i=Q2(e.params.client_id);if(await m2(e,n,t,`link`,r),!await e.context.adapter.findOne({model:X2(t),where:[{field:`identifier`,value:r}]}))throw new E(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${r} not found`});if(!await e.context.adapter.findOne({model:Ave(t),where:[{field:`clientId`,value:i}]}))throw new E(`NOT_FOUND`,{error:`not_found`,error_description:`client ${i} not found`});try{await e.context.adapter.create({model:Z2(t),data:{clientId:i,resourceId:r,createdAt:/* @__PURE__ */ new Date}})}catch(t){let n=t instanceof Error?t.message:String(t);if(/unique|duplicate|UNIQUE/i.test(n))return e.json({linked:!0,alreadyLinked:!0});throw t}return e.json({linked:!0})}async function Rve(e,t){let n=await RJ(e),r=Q2(e.params.identifier),i=Q2(e.params.client_id);return await m2(e,n,t,`unlink`,r),await e.context.adapter.deleteMany({model:Z2(t),where:[{field:`clientId`,value:i},{field:`resourceId`,value:r}]}),e.json({unlinked:!0})}const $2=A({identifier:k().min(1).optional(),name:k().optional(),accessTokenTtl:Me().int().positive().nullable().optional(),refreshTokenTtl:Me().int().positive().nullable().optional(),signingAlgorithm:We(G1).nullable().optional(),signingKeyId:k().nullable().optional(),allowedScopes:Pe(k()).nullable().optional(),customClaims:Ne(k(),Je()).nullable().optional(),dpopBoundAccessTokensRequired:He().optional(),disabled:He().optional(),metadata:Ne(k(),Je()).nullable().optional()}),zve=e=>X(`/admin/oauth2/resources`,{method:`POST`,body:$2.required({identifier:!0}),metadata:{SERVER_ONLY:!0}},async t=>Mve(t,e)),Bve=e=>X(`/admin/oauth2/resources`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async t=>Nve(t,e)),Vve=e=>X(`/admin/oauth2/resources/:identifier`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async t=>Pve(t,e)),Hve=e=>X(`/admin/oauth2/resources/:identifier`,{method:`PATCH`,body:$2,metadata:{SERVER_ONLY:!0}},async t=>Fve(t,e)),Uve=e=>X(`/admin/oauth2/resources/:identifier`,{method:`DELETE`,metadata:{SERVER_ONLY:!0}},async t=>Ive(t,e)),Wve=e=>X(`/admin/oauth2/resources/:identifier/clients/:client_id`,{method:`POST`,metadata:{SERVER_ONLY:!0}},async t=>Lve(t,e)),Gve=e=>X(`/admin/oauth2/resources/:identifier/clients/:client_id`,{method:`DELETE`,metadata:{SERVER_ONLY:!0}},async t=>Rve(t,e));async function Kve(e,t,n){if(t.disableJwtPlugin)throw new O(`BAD_REQUEST`,{error_description:`JWT access tokens are disabled`,error:`invalid_request`});let r=q$(e.context),i=r.options,a;try{a=(await nI(n,dI(await RZ(n,{jwksFetch:i?.jwks?.remoteUrl?i.jwks.remoteUrl:async()=>(await r.endpoints.getJwks(e))?.response,jwksCacheKey:r})),{issuer:i?.jwt?.issuer??e.context.baseURL})).payload}catch(e){if(e instanceof iP||e instanceof uP)return null;throw e instanceof TypeError||J$(e)?new O(`BAD_REQUEST`,{error_description:`invalid JWT signature`,error:`invalid_request`}):e}let o=`${e.context.baseURL}/oauth2/userinfo`;if(!a.azp||!await q1(e,t,a.aud,[o]))return null;throw new O(`BAD_REQUEST`,{error_description:`JWT access tokens are self-contained and cannot be revoked server-side`,error:`unsupported_token_type`})}async function qve(e,t,n,r){let i=n;if(t.prefix?.opaqueAccessToken){if(i.startsWith(t.prefix.opaqueAccessToken))i=i.replace(t.prefix.opaqueAccessToken,``);else throw new O(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`})}let a=await e.context.adapter.findOne({model:`oauthAccessToken`,where:[{field:`token`,value:await s1(t.storeTokens,i,`access_token`)}]});if(!a)throw new O(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`});if(!a.clientId||a.clientId!==r)return null;a.id?await e.context.adapter.delete({model:`oauthAccessToken`,where:[{field:`id`,value:a.id}]}):await e.context.adapter.delete({model:`oauthAccessToken`,where:[{field:`token`,value:a.token}]})}async function Jve(e,t,n,r){let i=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await s1(t.storeTokens,n,`refresh_token`)}]});if(!i)throw new O(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`});if(i.revoked)throw await d0(e,r,i.userId),new O(`BAD_REQUEST`,{error_description:`refresh token revoked`,error:`invalid_request`});if(!i.clientId||i.clientId!==r)return null;let a=Math.floor(Date.now()/1e3);if(!await e.context.adapter.incrementOne({model:`oauthRefreshToken`,where:[{field:`id`,value:i.id},{field:`revoked`,operator:`eq`,value:null}],increment:{},set:{revoked:/* @__PURE__ */ new Date(a*1e3)}}))throw await d0(e,r,i.userId),new O(`BAD_REQUEST`,{error_description:`refresh token revoked`,error:`invalid_request`});await e.context.adapter.deleteMany({model:`oauthAccessToken`,where:[{field:`refreshId`,value:i.id}]})}async function Yve(e,t,n,r){try{return await Kve(e,t,r)}catch(e){if(e instanceof O){if(e.body?.error===`unsupported_token_type`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}try{return await qve(e,t,r,n)}catch(e){if(!(e instanceof O))throw e instanceof Error?e:Error(`Unknown error validating access token`)}throw new O(`BAD_REQUEST`,{error_description:`Invalid access token`,error:`invalid_request`})}async function Xve(e,t){let{token:n,token_type_hint:r}=e.body;r!==`access_token`&&r!==`refresh_token`&&(r=void 0);let{clientId:i,clientSecret:a,preVerified:o,authMethod:s}=g1(await _1(e,t,`${e.context.baseURL}/oauth2/revoke`));if(!i)throw new O(`UNAUTHORIZED`,{error_description:`missing required credentials`,error:`invalid_client`});if(typeof n==`string`&&(n=oZ(n)),!n?.length)throw new O(`BAD_REQUEST`,{error_description:`missing a required token for introspection`,error:`invalid_request`});let c=await m1(e,t,i,a,void 0,o,void 0,s);try{if(r===void 0||r===`access_token`)try{return await Yve(e,t,c.clientId,n)}catch(e){if(e instanceof O){if(r===`access_token`||e.body?.error===`unsupported_token_type`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}if(r===void 0||r===`refresh_token`)try{return await Jve(e,t,(await u0(t,n)).token,c.clientId)}catch(e){if(e instanceof O){if(r===`refresh_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}throw new O(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`})}catch(e){if(e instanceof O){if(e.body?.error===`unsupported_token_type`)throw e;if(e.name===`BAD_REQUEST`)return null;throw e}throw e instanceof Error?(f.error(`Introspection error:`,e.message,e.stack),new O(`INTERNAL_SERVER_ERROR`)):(f.error(`Introspection error:`,e),new O(`INTERNAL_SERVER_ERROR`))}}const Zve={oauthClient:{modelName:`oauthClient`,fields:{clientId:{type:`string`,unique:!0,required:!0},clientSecret:{type:`string`,required:!1},clientDiscoveryId:{type:`string`,required:!1},disabled:{type:`boolean`,defaultValue:!1,required:!1},skipConsent:{type:`boolean`,required:!1},enableEndSession:{type:`boolean`,required:!1},subjectType:{type:`string`,required:!1},scopes:{type:`string[]`,required:!1},clientCredentialsScopes:{type:`string[]`,required:!1,defaultValue:[]},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},createdAt:{type:`date`,required:!1},updatedAt:{type:`date`,required:!1},name:{type:`string`,required:!1},uri:{type:`string`,required:!1},icon:{type:`string`,required:!1},contacts:{type:`string[]`,required:!1},tos:{type:`string`,required:!1},policy:{type:`string`,required:!1},softwareId:{type:`string`,required:!1},softwareVersion:{type:`string`,required:!1},softwareStatement:{type:`string`,required:!1},redirectUris:{type:`string[]`,required:!0},postLogoutRedirectUris:{type:`string[]`,required:!1},backchannelLogoutUri:{type:`string`,required:!1},backchannelLogoutSessionRequired:{type:`boolean`,required:!1},tokenEndpointAuthMethod:{type:`string`,required:!1},applicationType:{type:`string`,required:!1},jwks:{type:`string`,required:!1},jwksUri:{type:`string`,required:!1},grantTypes:{type:`string[]`,required:!1},responseTypes:{type:`string[]`,required:!1},requirePKCE:{type:`boolean`,required:!1},dpopBoundAccessTokens:{type:`boolean`,required:!1,defaultValue:!1},referenceId:{type:`string`,required:!1},metadata:{type:`json`,required:!1}}},oauthResource:{modelName:`oauthResource`,fields:{identifier:{type:`string`,required:!0,unique:!0},name:{type:`string`,required:!0},accessTokenTtl:{type:`number`,required:!1},refreshTokenTtl:{type:`number`,required:!1},signingAlgorithm:{type:`string`,required:!1},signingKeyId:{type:`string`,required:!1},allowedScopes:{type:`string[]`,required:!1},customClaims:{type:`json`,required:!1},dpopBoundAccessTokensRequired:{type:`boolean`,required:!1,defaultValue:!1},disabled:{type:`boolean`,required:!1,defaultValue:!1},createdAt:{type:`date`,required:!1},updatedAt:{type:`date`,required:!1},policyVersion:{type:`number`,required:!1,defaultValue:1},metadata:{type:`json`,required:!1}}},oauthClientResource:{modelName:`oauthClientResource`,fields:{clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`,onDelete:`cascade`},index:!0},resourceId:{type:`string`,required:!0,references:{model:`oauthResource`,field:`identifier`,onDelete:`cascade`},index:!0},metadata:{type:`json`,required:!1},createdAt:{type:`date`,required:!1}},indexes:[{fields:[`clientId`,`resourceId`],unique:!0}]},oauthRefreshToken:{fields:{token:{type:`string`,required:!0,unique:!0},clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},sessionId:{type:`string`,required:!1,references:{model:`session`,field:`id`,onDelete:`set null`},index:!0},userId:{type:`string`,required:!0,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},authorizationCodeId:{type:`string`,required:!1,index:!0},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},expiresAt:{type:`date`},createdAt:{type:`date`},revoked:{type:`date`,required:!1},rotatedAt:{type:`date`,required:!1},rotationReplayResponse:{type:`string`,required:!1},rotationReplayExpiresAt:{type:`date`,required:!1},authTime:{type:`date`,required:!1},confirmation:{type:`json`,required:!1},scopes:{type:`string[]`,required:!0}}},oauthAccessToken:{modelName:`oauthAccessToken`,fields:{token:{type:`string`,unique:!0},clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},sessionId:{type:`string`,required:!1,references:{model:`session`,field:`id`,onDelete:`set null`},index:!0},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},authorizationCodeId:{type:`string`,required:!1,index:!0},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},refreshId:{type:`string`,required:!1,references:{model:`oauthRefreshToken`,field:`id`},index:!0},expiresAt:{type:`date`},createdAt:{type:`date`},revoked:{type:`date`,required:!1},confirmation:{type:`json`,required:!1},scopes:{type:`string[]`,required:!0}}},oauthConsent:{modelName:`oauthConsent`,fields:{clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},scopes:{type:`string[]`,required:!0},createdAt:{type:`date`},updatedAt:{type:`date`}}},oauthClientAssertion:{modelName:`oauthClientAssertion`,fields:{expiresAt:{type:`date`,required:!0}}}},e4=[`openid`,`profile`,`email`,`offline_access`],t4=A({id_token_hint:k().optional(),client_id:k().optional(),post_logout_redirect_uri:k1.optional(),state:k().optional()}),n4=vH(()=>null),r4=n4.get,i4=/* @__PURE__ */ new WeakMap,a4=`signedQueryIssuedAtMs`;function Qve(e){let t=typeof e==`number`?e:typeof e==`string`?Number(e):void 0;if(!(!t||!Number.isFinite(t)||t<=0))return new Date(t)}const o4=e=>{let t=e.clientRegistrationAllowedScopes;if(e.clientRegistrationDefaultScopes){let n=t?/* @__PURE__ */ new Set([...t,...e.clientRegistrationDefaultScopes]):/* @__PURE__ */ new Set([...e.clientRegistrationDefaultScopes]);t=Array.from(n)}let n=new Set((e.scopes??e4).filter(e=>e.length));if(t){for(let e of t)if(!n.has(e))throw new D(`clientRegistrationAllowedScope ${e} not found in scopes`)}for(let t of e.advertisedMetadata?.scopes_supported??[])if(!n?.has(t))throw new D(`advertisedMetadata.scopes_supported ${t} not found in scopes`);let r=new Set((e.resources??[]).map(e=>typeof e==`string`?e:e.identifier));for(let[t,n]of[[`clientRegistrationDefaultResources`,e.clientRegistrationDefaultResources],[`clientRegistrationAllowedResources`,e.clientRegistrationAllowedResources]])for(let e of n??[])if(!r.has(e))throw new D(`${t} resource ${e} not found in resources`);let i=/* @__PURE__ */ new Set([`sub`,`iss`,`aud`,`exp`,`iat`,`sid`,`scope`,`azp`,...R1.filter(e=>n.has(L1[e].scope))]),a={codeExpiresIn:600,accessTokenExpiresIn:3600,m2mAccessTokenExpiresIn:3600,refreshTokenExpiresIn:2592e3,refreshTokenReuseInterval:0,allowUnauthenticatedClientRegistration:!1,allowDynamicClientRegistration:!1,disableJwtPlugin:!1,storeClientSecret:e.disableJwtPlugin?`encrypted`:`hashed`,storeTokens:`hashed`,grantTypes:[`authorization_code`,`client_credentials`,`refresh_token`],...e,scopes:Array.from(n),claims:Array.from(i),clientRegistrationAllowedScopes:t};if(R$(a.extensions),a.pairwiseSecret&&a.pairwiseSecret.length<32)throw new D(`pairwiseSecret must be at least 32 characters long for adequate HMAC-SHA256 security`);if(a.grantTypes&&a.grantTypes.includes(`refresh_token`)&&!a.grantTypes.includes(`authorization_code`))throw new D(`refresh_token grant requires authorization_code grant`);if(a.disableJwtPlugin&&(a.storeClientSecret===`hashed`||typeof a.storeClientSecret==`object`&&`hash`in a.storeClientSecret))throw new D(`unable to store hashed secrets because id tokens will be signed with secret`);if(!a.disableJwtPlugin&&(a.storeClientSecret===`encrypted`||typeof a.storeClientSecret==`object`&&(`encrypt`in a.storeClientSecret||`decrypt`in a.storeClientSecret)))throw new D(`encryption method not recommended, please use 'hashed' or the 'hash' function`);let o=async(e,t)=>{let n=new URL(e.url).pathname,r=t.options.advanced?.skipTrailingSlashes?n.replace(/\/+$/,``)||`/`:n,i=a.disableJwtPlugin?t.baseURL:q$(t)?.options?.jwt?.issuer??t.baseURL,o=`/`;try{o=new URL(i).pathname.replace(/\/$/,``)||``}catch{o=new URL(t.baseURL).pathname.replace(/\/$/,``)||``}let s={context:t},c=/* @__PURE__ */ new Set([`/.well-known/oauth-authorization-server${o}`,`${o}/.well-known/oauth-authorization-server`]),l=`${o}/.well-known/openid-configuration`,u=c.has(r),d=a.scopes?.includes(`openid`)&&r===l,f=t=>{let n=t2(t);return e.method===`HEAD`?new Response(null,{status:n.status,headers:n.headers}):n};if((u||d)&&e.method!==`GET`&&e.method!==`HEAD`)return{response:new Response(null,{status:405,headers:{Allow:`GET, HEAD`}})};if(u)return a.scopes?.includes(`openid`)?{response:f(e2(s,a))}:{response:f($0(s,a))};if(d)return{response:f(e2(s,a))}},s=n2(`/oauth2/authorize`,{method:[`GET`,`POST`],body:A({}).passthrough(),redirectOnError:_4(a),metadata:{allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Authorize an OAuth 2.1 request from query parameters or an application/x-www-form-urlencoded POST body`,parameters:[{name:`response_type`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 response type (e.g., 'code')`},{name:`client_id`,in:`query`,required:!0,schema:{type:`string`},description:`OAuth 2.1 client ID`},{name:`redirect_uri`,in:`query`,required:!1,schema:{type:`string`,format:`uri`},description:`OAuth 2.1 redirect URI`},{name:`scope`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 scopes (space-separated)`},{name:`state`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 state parameter`},{name:`request_uri`,in:`query`,required:!1,schema:{type:`string`},description:`Pushed Authorization Request URI referencing stored parameters`},{name:`code_challenge`,in:`query`,required:!1,schema:{type:`string`},description:`PKCE code challenge`},{name:`code_challenge_method`,in:`query`,required:!1,schema:{type:`string`},description:`PKCE code challenge method`},{name:`nonce`,in:`query`,required:!1,schema:{type:`string`},description:`OpenID Connect nonce`},{name:`max_age`,in:`query`,required:!1,schema:{type:`integer`,minimum:0},description:`Maximum authentication age in seconds; forces re-authentication when exceeded`},{name:`resource`,in:`query`,required:!1,schema:{type:`array`,items:{type:`string`}},description:`Requested protected resource(s) for the access token. May be supplied multiple times as repeated 'resource' query parameters (RFC 8707) or as an array of strings.`},{name:`prompt`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth2 prompt parameter`}],responses:{302:{description:`Redirect to client with code or error`,headers:{Location:{description:`Redirect URI with code or error`,schema:{type:`string`,format:`uri`}}}},400:{description:`Invalid request`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},state:{type:`string`}},required:[`error`]}}}}}}}},async e=>oye(e,a,e.authorizeSettings??{isAuthorize:!0})),c=(e,t)=>SQ(s,{...e,asResponse:!1,returnHeaders:!1,returnStatus:!1,authorizeSettings:t??{}});return{id:`oauth-provider`,version:`1.7.10`,options:a,onRequest:o,init:async e=>{if(e.options.secondaryStorage&&e.options.session?.storeSessionInDatabase!==!0)throw new D("OAuth Provider requires `session.storeSessionInDatabase: true` when using secondaryStorage");if(a.allowClientKeyRotation){let t=e.adapter.id===`memory`?`the memory adapter`:e.options.advanced?.database?.generateId===`serial`?'`advanced.database.generateId: "serial"`':void 0;if(t)throw new D(`\`allowClientKeyRotation\` requires single-use client assertions, which ${t} does not enforce`)}if(await t0(e,a).catch(t=>bge(e,t)),Cge(a),!a.disableJwtPlugin){let t=q$(e)?.options,n=t?.jwt?.issuer??e.baseURL,r=t?.jwt?.issuer==null&&typeof e.options.baseURL==`object`&&e.options.baseURL!==null&&`allowedHosts`in e.options.baseURL;try{new URL(n)}catch(e){if(!r||n!==``)throw e}}return{options:{databaseHooks:{session:{delete:{async before(e,t){if(!t)return;let n=await p_e(t,a,{sessionId:e.id,userId:e.userId});if(!n)return;let r=i4.get(t)??/* @__PURE__ */ new Map;r.set(e.id,n),i4.set(t,r)},async after(e,t){if(!t)return;let n=i4.get(t);if(!n)return;let r=n.get(e.id);if(n.delete(e.id),n.size===0&&i4.delete(t),!r)return;let i=m_e(t,r).catch(e=>{t.context.logger.error(`Back-channel logout failed after session deletion`,e)});await t.context.runInBackgroundOrAwait(i)}}}}}}},hooks:{before:[{matcher(e){return e.body?.oauth_query},handler:Rq(async e=>{let t=e.body.oauth_query;if(!await $$(t,e.context.secret))throw new E(`BAD_REQUEST`,{error:`invalid_signature`});let n=fhe(t),r=new URLSearchParams(t),i=r.get(`ba_pl`)??void 0;r.delete(`sig`),r.delete(`exp`),r.delete(A$),r.delete(j$),await n4.set({query:r.toString(),signedQueryIssuedAt:n??void 0,postLoginClearedForSession:i}),e.path===`/sign-in/social`&&await kq({query:r.toString(),...n?{[a4]:n.getTime()}:{}})})}],after:[{matcher(e){return bG(e.context.responseHeaders?.get(`set-cookie`)||``).has(e.context.authCookies.sessionToken.name)},handler:Rq(async e=>{let t=bG(e.context.responseHeaders?.get(`set-cookie`)||``).get(e.context.authCookies.sessionToken.name)?.value.split(`.`)[0];if(!t)return;let n=await n4.get(),r=(await Eq())?.serverContext,i=n?.query??r?.query;if(!i)return;let a=new URLSearchParams(i),o=await e.context.internalAdapter.findSession(t);if(!o)return;e.context.session=o;let s=e.request?.headers?.get(`sec-fetch-mode`)?.toLowerCase(),l=e.request?.headers?.get(`accept`)?.toLowerCase()??``;s===`navigate`||!s&&(l.includes(`text/html`)||l.includes(`application/xhtml+xml`))||e.headers?.set(`accept`,`application/json`);let u=n?.signedQueryIssuedAt??Qve(r?.[a4]),d=w1(a,`login`);return C1(o.session.createdAt,u)&&(d=T1(d)),e.query=S1(d),await c(e)})}]},endpoints:{getOAuthServerConfig:X(`/.well-known/oauth-authorization-server`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async e=>a.scopes&&a.scopes.includes(`openid`)?e2(e,a):$0(e,a)),getOpenIdConfig:X(`/.well-known/openid-configuration`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async e=>{if(a.scopes&&!a.scopes.includes(`openid`))throw new E(`NOT_FOUND`);return e2(e,a)}),oauth2Authorize:s,oauth2Consent:X(`/oauth2/consent`,{method:`POST`,body:A({accept:He().meta({description:`Accept or deny user consent for a set of scopes`}),scope:k().optional().meta({description:`List of accept of accepted space-separated scopes. If none is provided, then all originally requested scopes are accepted.`}),claims:P1.optional().meta({description:`Accepted OIDC claims request object. If none is provided, then all originally requested claims are accepted.`}),oauth_query:k().optional().meta({description:`The redirected page's query parameters`})}),use:[BJ],metadata:{openapi:{description:`Handle OAuth2 consent`,responses:{200:{description:`Consent processed successfully`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`The URI to redirect to, either with an authorization code or an error`}},required:[`redirect_uri`]}}}}}}}},async e=>s_e(e,a,c)),oauth2Continue:X(`/oauth2/continue`,{method:`POST`,body:A({selected:He().optional().meta({description:`Confirms an account has been selected and authorization can proceed.`}),created:He().optional().meta({description:`Confirms an account was registered`}),postLogin:He().optional().meta({description:`Resumes after the post login page. postLogin.shouldRedirect runs again with isContinuation: true.`}),oauth_query:k().optional().meta({description:`The redirected page's query parameters`})}),use:[BJ],metadata:{openapi:{description:`Continues OAuth2 authorization flow`,responses:{200:{description:`Consent processed successfully`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`The URI to redirect to, either with an authorization code or an error`}},required:[`redirect_uri`]}}}}}}}},async e=>c_e(e,c)),oauth2Token:n2(`/oauth2/token`,{method:`POST`,cloneRequest:!0,body:A({grant_type:k().trim().min(1),client_id:k().optional(),client_secret:k().optional(),client_assertion:k().optional(),client_assertion_type:k().optional(),code:k().optional(),code_verifier:k().optional(),redirect_uri:k1.optional(),refresh_token:k().optional(),resource:Ee([V1,Pe(V1).min(1)]).optional(),scope:k().optional()}).passthrough(),errorCodesByField:{grant_type:{missing:`invalid_request`,invalid:`unsupported_grant_type`},resource:{invalid:`invalid_target`}},metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Obtain an OAuth2.1 access token`,parameters:[{name:`DPoP`,in:`header`,required:!1,schema:{type:`string`},description:`RFC 9449 DPoP proof JWT for issuing DPoP-bound tokens`}],requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{grant_type:{type:`string`,description:`OAuth2 grant type`},client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},code:{type:`string`,description:`Authorization code (for authorization_code grant)`},code_verifier:{type:`string`,description:`PKCE code verifier (for authorization_code grant)`},redirect_uri:{type:`string`,format:`uri`,description:`Redirect URI (for authorization_code grant)`},refresh_token:{type:`string`,description:`Refresh token (for refresh_token grant)`},resource:{oneOf:[{type:`string`,description:`Single resource (URL)`},{type:`array`,items:{type:`string`},description:`Multiple resources (URLs)`}],description:`Requested protected resource(s) for the access token`},scope:{type:`string`,description:`Requested scopes (for client_credentials grant)`}},required:[`grant_type`]}}}},responses:{200:{description:`Access token response`,content:{"application/json":{schema:{type:`object`,properties:{access_token:{type:`string`,description:`The access token issued by the authorization server`},token_type:{type:`string`,description:`The type of the token issued`,enum:[`Bearer`,`DPoP`]},expires_in:{type:`number`,description:`Lifetime in seconds of the access token`},refresh_token:{type:`string`,description:`Refresh token, if issued`},scope:{type:`string`,description:`Scopes granted by the access token`},id_token:{type:`string`,description:`ID Token (if OpenID Connect)`}},required:[`access_token`,`token_type`,`expires_in`]}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>{if(e.request){let t=await dge(e.request);t&&t.length>1&&(e.body.resource=t)}return kge(e,a)}),oauth2Introspect:n2(`/oauth2/introspect`,{method:`POST`,cloneRequest:!0,body:A({client_id:k().optional(),client_secret:k().optional(),client_assertion:k().optional(),client_assertion_type:k().optional(),token:k(),token_type_hint:k().optional()}),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Introspect an OAuth2 access or refresh token`,requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},token:{type:`string`,description:`The token to introspect (access or refresh token)`},token_type_hint:{type:`string`,description:"Hint about the token type. Recognized values: `access_token`, `refresh_token`."}},required:[`token`]}}}},responses:{200:{description:`Token introspection response`,content:{"application/json":{schema:{type:`object`,properties:{active:{type:`boolean`,description:`Whether the token is active`},scope:{type:`string`,description:`Scopes associated with the token`},client_id:{type:`string`,description:`Client ID associated with the token`},username:{type:`string`,description:`Username associated with the token`},token_type:{type:`string`,description:`Type of the token`},exp:{type:`number`,description:`Expiration time of the token (seconds since epoch)`},iat:{type:`number`,description:`Issued at time (seconds since epoch)`},nbf:{type:`number`,description:`Not before time (seconds since epoch)`},sub:{type:`string`,description:`Subject of the token`},aud:{type:`string`,description:`Audience of the token`},iss:{type:`string`,description:`Issuer of the token`},jti:{type:`string`,description:`JWT ID`}},required:[`active`]}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>j0(e,a)),oauth2Revoke:n2(`/oauth2/revoke`,{method:`POST`,cloneRequest:!0,body:A({client_id:k().optional(),client_secret:k().optional(),client_assertion:k().optional(),client_assertion_type:k().optional(),token:k(),token_type_hint:k().optional()}),metadata:{allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Revoke an OAuth2 access or refresh token`,requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},token:{type:`string`,description:`The token to revoke (access or refresh token)`},token_type_hint:{type:`string`,description:"Hint about the token type. Recognized values: `access_token`, `refresh_token`."}},required:[`token`]}}}},responses:{200:{description:`Token revoked successfully. The response body is empty.`,content:{"application/json":{schema:{type:`object`,description:`Empty object on success`}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>Xve(e,a)),oauth2UserInfo:X(`/oauth2/userinfo`,{method:[`GET`,`POST`],body:A({access_token:k().optional()}).passthrough().optional(),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Get OpenID Connect user information (UserInfo endpoint)`,security:[{bearerAuth:[]},{OAuth2:[`openid`,`profile`,`email`]}],parameters:[{name:`Authorization`,in:`header`,required:!1,schema:{type:`string`},description:`Bearer or DPoP access token`},{name:`DPoP`,in:`header`,required:!1,schema:{type:`string`},description:`RFC 9449 DPoP proof JWT when using a DPoP-bound access token`}],responses:{200:{description:`User information retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{sub:{type:`string`,description:`Subject identifier (user ID)`},email:{type:`string`,format:`email`,nullable:!0,description:`User's email address, included if 'email' scope is granted`},name:{type:`string`,nullable:!0,description:`User's full name, included if 'profile' scope is granted`},picture:{type:`string`,format:`uri`,nullable:!0,description:`User's profile picture URL, included if 'profile' scope is granted`},given_name:{type:`string`,nullable:!0,description:`User's given name, included if 'profile' scope is granted`},family_name:{type:`string`,nullable:!0,description:`User's family name, included if 'profile' scope is granted`},email_verified:{type:`boolean`,nullable:!0,description:`Whether the email is verified, included if 'email' scope is granted`}},required:[`sub`]}}}},401:{description:`Unauthorized - invalid or missing access token`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`}},required:[`error`]}}}},403:{description:`Forbidden - insufficient scope`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`}},required:[`error`]}}}}}}}},async e=>Dge(e,a)),oauth2EndSession:n2(`/oauth2/end-session`,{method:[`GET`,`POST`],body:t4.optional(),query:t4.optional(),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`,`application/json`],$Infer:{body:{},query:{}},openapi:{description:`RP-Initiated Logout endpoint. Accepts standard logout parameters through GET or an application/x-www-form-urlencoded POST body, plus JSON for Better Auth generated-client calls. Requests without a usable id_token_hint may require explicit OP confirmation.`,responses:{200:{description:`Logout completed, or an HTML confirmation page was returned for browser navigation. A redirect is used only for an exact registered post_logout_redirect_uri.`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`URI to redirect to after logout (if post_logout_redirect_uri was provided)`},message:{type:`string`,description:`Success message`}}}},"text/html":{schema:{type:`string`}}}}}}}},async e=>T_e(e,a)),oauth2EndSessionConfirmation:n2(`/oauth2/end-session/confirm`,{method:`POST`,body:A({action:Ue(`confirm`)}),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],scope:`http`}},async e=>E_e(e,a)),registerOAuthClient:n2(`/oauth2/register`,{method:`POST`,body:W1,errorCodesByField:{redirect_uris:`invalid_redirect_uri`,post_logout_redirect_uris:`invalid_redirect_uri`,software_statement:`invalid_software_statement`,resources:`invalid_target`},defaultError:`invalid_client_metadata`,metadata:{noStore:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`Name of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URL for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},post_logout_redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed logout redirect uris`},backchannel_logout_uri:{type:`string`,format:`uri`,description:`RP URL to receive signed Logout Tokens when the end-user's OP session terminates`},backchannel_logout_session_required:{type:`boolean`,description:"Whether the RP requires a `sid` claim in every Logout Token"},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final resource identifiers linked to the registered client`},disabled:{type:`boolean`,description:`Whether the client is disabled`}},required:[`client_id`]}}}}}}}},async e=>tve(e,a)),adminCreateOAuthClient:dve(a),createOAuthClient:fve(a),getOAuthClient:pve(a),getOAuthClientPublic:mve(a),getOAuthClientPublicPrelogin:hve(a),getOAuthClients:gve(a),adminUpdateOAuthClient:_ve(a),updateOAuthClient:vve(a),rotateClientSecret:yve(a),rotateClientKeys:bve(a),deleteOAuthClient:xve(a),getOAuthConsent:Eve(a),getOAuthConsents:Dve(a),updateOAuthConsent:Ove(a),deleteOAuthConsent:kve(a),adminCreateOAuthResource:zve(a),adminListOAuthResources:Bve(a),adminGetOAuthResource:Vve(a),adminUpdateOAuthResource:Hve(a),adminDeleteOAuthResource:Uve(a),adminLinkClientResource:Wve(a),adminUnlinkClientResource:Gve(a)},schema:cG(structuredClone(Zve),a?.schema),rateLimit:[...a.rateLimit?.token===!1?[]:[{pathMatcher:e=>e===`/oauth2/token`,window:a.rateLimit?.token?.window??60,max:a.rateLimit?.token?.max??20}],...a.rateLimit?.authorize===!1?[]:[{pathMatcher:e=>e===`/oauth2/authorize`,window:a.rateLimit?.authorize?.window??60,max:a.rateLimit?.authorize?.max??30}],...a.rateLimit?.introspect===!1?[]:[{pathMatcher:e=>e===`/oauth2/introspect`,window:a.rateLimit?.introspect?.window??60,max:a.rateLimit?.introspect?.max??100}],...a.rateLimit?.revoke===!1?[]:[{pathMatcher:e=>e===`/oauth2/revoke`,window:a.rateLimit?.revoke?.window??60,max:a.rateLimit?.revoke?.max??30}],...a.rateLimit?.register===!1?[]:[{pathMatcher:e=>e===`/oauth2/register`,window:a.rateLimit?.register?.window??60,max:a.rateLimit?.register?.max??5}],...a.rateLimit?.rotateClientKeys===!1?[]:[{pathMatcher:e=>e===`/oauth2/client/rotate-keys`,window:a.rateLimit?.rotateClientKeys?.window??60,max:a.rateLimit?.rotateClientKeys?.max??5}],...a.rateLimit?.userinfo===!1?[]:[{pathMatcher:e=>e===`/oauth2/userinfo`,window:a.rateLimit?.userinfo?.window??60,max:a.rateLimit?.userinfo?.max??60}]]}};function $ve(e,t,n){return t!==0&&n.getTime()-e.getTime()<=t*1e3}function eye(e){let{max_age:t,...n}=e;return n}function s4(e,t,n,r,i,a=`query`){let o=new URLSearchParams({error:t,error_description:n});return r&&o.append(`state`,r),i&&o.append(`iss`,i),a===`fragment`?`${e}#${o.toString()}`:yq(e,o)}function tye(e){let t=typeof e.response_mode==`string`?e.response_mode:void 0;if(t===`fragment`)return`fragment`;if(t===`query`)return`query`;let n=typeof e.response_type==`string`?e.response_type:void 0;return n&&/\b(token|id_token)\b/.test(n)?`fragment`:`query`}const nye={response_type:{invalid:`unsupported_response_type`},resource:{invalid:`invalid_target`}};function rye(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function c4(e){return typeof e==`string`?e:void 0}function iye(e,t){let n=e.method===`POST`&&t?.isAuthorize===!0?e.body:e.query;return{...rye(n)?n:{}}}const l4=(e,t)=>{let n=M0(e.request?.headers),r=e.headers?.get(`accept`)?.includes(`application/json`);if(n||r)return{redirect:!0,url:t.toString()};throw e.redirect(t)};function u4(e,t,n,r,i){return l4(e,s4(n.redirect_uri,r,i,n.state,f4(e,t)))}function d4(e){try{let t=new URL(e);return t.protocol!==`https:`&&!xY(t.host)&&(t.protocol=`https:`),t.search=``,t.hash=``,t.toString().replace(/\/$/,``)}catch{return e}}function f4(e,t){let n;if(t.disableJwtPlugin)n=e.context.baseURL;else try{n=q$(e.context).options?.jwt?.issuer??e.context.baseURL}catch{n=e.context.baseURL}return d4(n)}function p4(e,t,n){return s4(e.context.options.onAPIError?.errorURL||`${e.context.baseURL}/error`,t,n)}function m4(e){let t;try{t=new URL(e)}catch{return}let n=bY(t.hostname)||t.hostname===`localhost`;if(t.protocol!==`http:`||!n)return;let r=e.indexOf(`://`);if(r<0)return;let i=r+3,a=e.slice(i).search(/[/?#]/u),o=e.length;a>=0&&(o=i+a);let s=e.slice(i,o),c;if(s.startsWith(`[`)){let t=s.indexOf(`]`);if(t<0)return;if(s[t+1]!==`:`)return e;c=t+1}else if(c=s.lastIndexOf(`:`),c<0)return e;let l=s.slice(c+1);if(!/^\d*$/u.test(l))return;let u=i+c;return`${e.slice(0,u)}${e.slice(o)}`}function h4(e,t){if(!e||!t)return;let n;try{n=new URL(t)}catch{return}let r=t.includes(`#`),i=n.username.length>0||n.password.length>0;if(r||i)return;let a=m4(t);return e.find(e=>e===t?!0:a?m4(e)===a:!1)}function g4(e){if(!k1.safeParse(e).success)return!1;let t=new URL(e);return t.username.length===0&&t.password.length===0}async function aye(e,t,n,r){if(!n||!r)return null;let i;try{i=await t1(e,t,n)}catch{return null}if(!i||i.disabled)return null;let a=i.redirectUris??[],o=h4(a,r);if(t.validateRedirectUri){if(!g4(r))return null;try{return await t.validateRedirectUri(r,a,!!o)?r:null}catch{return null}}return o?r:null}function _4(e){return async({error:t,error_description:n,ctx:r})=>{let i=r.query??{},a=await aye(r,e,typeof i.client_id==`string`?i.client_id:void 0,typeof i.redirect_uri==`string`?i.redirect_uri:void 0);return a?l4(r,s4(a,t,n,typeof i.state==`string`?i.state:void 0,f4(r,e),tye(i))):l4(r,p4(r,t,n))}}async function oye(e,t,n){if(t.grantTypes&&!t.grantTypes.includes(`authorization_code`))throw new O(`NOT_FOUND`);if(!e.request)throw new O(`UNAUTHORIZED`,{error_description:`request not found`,error:`invalid_request`});let r=e.request,i=iye(e,n);e.query=i;let a=c4(i.request),o=c4(i.request_uri);if(a!==void 0&&o!==void 0)return _4(t)({error:`invalid_request`,error_description:`request and request_uri cannot be used together`,ctx:e});if(a!==void 0)return _4(t)({error:`request_not_supported`,error_description:`request object not supported`,ctx:e});if(o!==void 0){let n=c4(i.client_id);if(!n)return _4(t)({error:`invalid_request`,error_description:`client_id is required`,ctx:e});if(!t.requestUriResolver)return _4(t)({error:`request_uri_not_supported`,error_description:`request_uri not supported`,ctx:e});let r=await t.requestUriResolver({requestUri:o,clientId:n,ctx:e});if(!r)return _4(t)({error:`invalid_request_uri`,error_description:`request_uri is invalid or expired`,ctx:e});let a=i.client_id;i=r,a&&(i.client_id=a)}e.query=i;let s=U1.safeParse(i);if(!s.success){let n=r2(s.error.issues,nye);return _4(t)({...n,ctx:e})}if(i=s.data,e.query=i,await n4.set({query:v4(i).toString()}),!i.response_type)return _4(t)({error:`invalid_request`,error_description:`response_type is required`,ctx:e});let c=e.query?.prompt?v1(e.query?.prompt):void 0,l=c?.has(`none`)??!1;if(c?.has(`select_account`)&&!t.selectAccount?.page)return l4(e,p4(e,`unsupported_prompt_select_account`,`unsupported prompt type`));if(i.response_type!==`code`)return l4(e,p4(e,`unsupported_response_type`,`unsupported response type`));let u=await t1(e,t,i.client_id);if(!u)return l4(e,p4(e,`invalid_client`,`client not found`));if(u.disabled)return l4(e,p4(e,`client_disabled`,`client is disabled`));if(!d1(u,`authorization_code`))return l4(e,p4(e,`unauthorized_client`,`client is not authorized to use the authorization_code grant`));let d=u.redirectUris??[],f=!1;if(i.redirect_uri){let e=!!h4(d,i.redirect_uri);if(t.validateRedirectUri&&g4(i.redirect_uri))try{f=await t.validateRedirectUri(i.redirect_uri,d,e)}catch{f=!1}else t.validateRedirectUri||(f=e)}if(!f)return l4(e,p4(e,`invalid_redirect`,`invalid redirect uri`));let p=i.scope?.split(` `).filter(e=>e);if(p){let n=new Set(u.scopes??t.scopes),r=p.filter(e=>!n?.has(e));if(r.length)return l4(e,s4(i.redirect_uri,`invalid_scope`,`The following scopes are invalid: ${r.join(`, `)}`,i.state,f4(e,t)))}p||(p=u.scopes??t.scopes??[],i.scope=p.join(` `));let m=p.includes(`openid`);if(i.claims!==void 0&&!m)return l4(e,s4(i.redirect_uri,`invalid_request`,`openid scope must be requested when using the claims parameter`,i.state,f4(e,t)));if(m&&!Yhe(i.claims))return l4(e,s4(i.redirect_uri,`invalid_request`,`claims must be a valid Claims request object`,i.state,f4(e,t)));if(m&&!Xhe(i.claims,`0`))return l4(e,s4(i.redirect_uri,`access_denied`,`essential acr requirement cannot be met`,i.state,f4(e,t)));let h=F1(i.claims,z1(t));if(i.resource!==void 0)try{await J1(e,t,{resource:i.resource,clientId:u.clientId,requestedScopes:p})}catch(n){if(n instanceof O){let r=n.body?.error??`invalid_target`,a=n.body?.error_description??`requested resource invalid`;return l4(e,s4(i.redirect_uri,r,a,i.state,f4(e,t)))}throw n}let g=E1(u,{scopes:p,nonce:i.nonce});if(g&&(!i.code_challenge||!i.code_challenge_method))return l4(e,s4(i.redirect_uri,`invalid_request`,g.valueOf(),i.state,f4(e,t)));if(i.code_challenge||i.code_challenge_method){if(!i.code_challenge||!i.code_challenge_method)return l4(e,s4(i.redirect_uri,`invalid_request`,`code_challenge and code_challenge_method must both be provided`,i.state,f4(e,t)));if(![`S256`].includes(i.code_challenge_method))return l4(e,s4(i.redirect_uri,`invalid_request`,`invalid code_challenge method, only S256 is supported`,i.state,f4(e,t)))}let _=X$(i.resource)??[],v=await RJ(e),y=i.max_age,b=v!=null&&y!==void 0&&$ve(new Date(v.session.createdAt),y,/* @__PURE__ */ new Date);if(!v||v!=null&&y!==void 0&&!b||c?.has(`login`)||c?.has(`create`))return l?u4(e,t,i,`login_required`,`authentication required`):b4(e,t,c?.has(`create`)?`create`:`login`);if(b&&(i=eye(i),e.query=i),n?.isAuthorize&&c?.has(`select_account`))return b4(e,t,`select_account`);if(n?.isAuthorize&&t.selectAccount&&await t.selectAccount.shouldRedirect({headers:r.headers,user:v.user,session:v.session,scopes:p}))return l?u4(e,t,i,`account_selection_required`,`End-User account selection is required`):b4(e,t,`select_account`);if(t.signup?.shouldRedirect){let n=await t.signup.shouldRedirect({headers:r.headers,user:v.user,session:v.session,scopes:p});if(n)return l?u4(e,t,i,`interaction_required`,`End-User interaction is required`):b4(e,t,`create`,{page:typeof n==`string`?n:void 0})}if(!n?.postLogin&&t.postLogin&&await t.postLogin.shouldRedirect({headers:r.headers,user:v.user,session:v.session,scopes:p,isContinuation:n?.isPostLoginContinuation??!1}))return l?u4(e,t,i,`interaction_required`,`End-User interaction is required`):b4(e,t,`post_login`);if(c?.has(`consent`))return b4(e,t,`consent`,{sessionId:v.session.id});let x=await b1(t,{user:v.user,session:v.session,scopes:p});if(u.skipConsent)return y4(e,t,{query:i,clientId:u.clientId,userId:v.user.id,sessionId:v.session.id,authTime:new Date(v.session.createdAt).getTime(),referenceId:x,resource:_});let S=await x1(e,u.clientId,v.user.id,x);if(!S||!p.every(e=>S.scopes.includes(e))||!h.every(e=>(S.requestedUserInfoClaims??[]).includes(e)))return l?u4(e,t,i,`consent_required`,`End-User consent is required`):b4(e,t,`consent`,{sessionId:v.session.id});let ee=S?.resources??[];return _.some(e=>!ee.includes(e))?l?u4(e,t,i,`consent_required`,`End-User consent is required`):b4(e,t,`consent`,{sessionId:v.session.id}):y4(e,t,{query:i,clientId:u.clientId,userId:v.user.id,sessionId:v.session.id,authTime:new Date(v.session.createdAt).getTime(),referenceId:x,resource:_})}function v4(e){let t=new URLSearchParams;for(let[n,r]of Object.entries(e))if(r!=null){if(Array.isArray(r))for(let e of r)t.append(n,String(e));else n===`claims`&&typeof r==`object`?t.set(n,JSON.stringify(r)):t.set(n,String(r))}return t}async function y4(e,t,n){let r=qH(32,`a-z`,`A-Z`,`0-9`),i=Math.floor(Date.now()/1e3),a=i+(t.codeExpiresIn??600),o={identifier:await o1(t.storeTokens,r,`authorization_code`),updatedAt:/* @__PURE__ */ new Date(i*1e3),expiresAt:/* @__PURE__ */ new Date(a*1e3),value:JSON.stringify({type:`authorization_code`,query:n.query,userId:n.userId,sessionId:n?.sessionId,referenceId:n.referenceId,authTime:n.authTime,resource:n.resource})};await e.context.internalAdapter.createVerificationValue({...o,createdAt:/* @__PURE__ */ new Date(i*1e3)});let s=new URL(n.query.redirect_uri);return s.searchParams.set(`code`,r),n.query.state&&s.searchParams.set(`state`,n.query.state),s.searchParams.set(`iss`,f4(e,t)),l4(e,s.toString())}async function b4(e,t,n,r){let i=await sye(e,t,{postLoginClearedForSession:n===`consent`&&t.postLogin?r?.sessionId:void 0}),a=t.loginPage;if(n===`select_account`)a=t.selectAccount?.page??t.loginPage;else if(n===`post_login`){if(!t.postLogin?.page)throw new O(`INTERNAL_SERVER_ERROR`,{error_description:`postLogin should have been defined`});a=t.postLogin?.page}else n===`consent`?a=t.consentPage:n===`create`&&(a=t.signup?.page??t.loginPage);return l4(e,`${r?.page??a}?${i}`)}async function sye(e,t,n){let r=Date.now(),i=Math.floor(r/1e3)+(t.codeExpiresIn??600),a=v4(e.query);a.set(`exp`,String(i)),a.set(A$,String(r)),a.delete(`sig`),a.delete(j$),n?.postLoginClearedForSession&&a.set(j$,n.postLoginClearedForSession),dhe(a);let o=await BW(N$(a).toString(),e.context.secret);return a.set(`sig`,o),a.toString()}const cye=/\/(?:\.|%2e)(?:\.|%2e)?(?:\/|$|#|\?)/i,lye=/* @__PURE__ */ new Set([`client_secret_post`,`client_secret_basic`,`client_secret_jwt`]);function x4(e){let t;try{t=new URL(e)}catch{return!1}return t.protocol===`https:`}function uye(e){if(cye.test(e))return`client_id URL MUST NOT contain dot segments`;if(e.includes(`#`))return`client_id URL MUST NOT contain a fragment`;let t;try{t=new URL(e)}catch{return`client_id is not a valid URL`}if(t.protocol!==`https:`)return`client_id URL must use HTTPS`;let n=/^https:\/\//i.exec(e);if(!n||e.includes(`\\`))return`client_id URL MUST use an explicit HTTPS authority form`;let r=e.slice(n[0].length),i=r.search(/[/?#]/);return i===0?`client_id URL MUST use an explicit HTTPS authority form`:i<0||r[i]!==`/`?`client_id URL MUST contain an explicit path component`:t.username||t.password?`client_id URL MUST NOT contain credentials`:SY(t.hostname)?null:`client_id URL must not target a private or reserved address`}function dye(e){let t=[];try{let n=new URL(e);n.pathname===`/`&&t.push(`client_id URL path / is NOT RECOMMENDED (§3)`),n.search&&t.push(`client_id URL SHOULD NOT contain a query string (§3)`)}catch{}return t}function fye(e){try{let t=new URL(e);return t.protocol===`http:`||t.protocol===`https:`||O1(t)}catch{return!1}}function pye(e,t,n={}){if(!t||typeof t!=`object`)return{valid:!1,error:`metadata document is not a JSON object`};for(let e of Object.keys(t))if(d2(e))return{valid:!1,error:`metadata document MUST NOT contain "${e}"`};let r=sge.strip().safeParse(t);if(!r.success){let e=r.error.issues[0];return{valid:!1,error:`${e?.path.join(`.`)||`metadata document`}: ${e?.message??`invalid client metadata`}`}}let i=r.data,a=[];if(i.client_id!==e)return{valid:!1,error:`client_id "${String(i.client_id)}" does not match the metadata document URL`};if(n.metadataProfile===`mcp-2026-07-28`&&!i.client_name?.trim())return{valid:!1,error:`client_name must be a non-empty string`};for(let e of[`backchannel_logout_uri`,`backchannel_logout_session_required`])if(i[e]!==void 0)return{valid:!1,error:`metadata document MUST NOT contain "${e}"`};let o=/* @__PURE__ */ new Set([`none`,`private_key_jwt`]);if(typeof i.token_endpoint_auth_method==`string`){if(lye.has(i.token_endpoint_auth_method))return{valid:!1,error:`symmetric auth method "${i.token_endpoint_auth_method}" is prohibited for Client ID Metadata Document clients`};if(!o.has(i.token_endpoint_auth_method))return{valid:!1,error:`token_endpoint_auth_method must be "none" or "private_key_jwt" for Client ID Metadata Document clients`};if(i.token_endpoint_auth_method===`private_key_jwt`&&!i.jwks&&!i.jwks_uri)return{valid:!1,error:`private_key_jwt requires either jwks or jwks_uri in the metadata document`}}if(i.jwks&&!l2(i.jwks).valid)return{valid:!1,error:`jwks must contain only structurally valid public keys`};if(i.jwks_uri)try{let e=new URL(i.jwks_uri);if(e.username||e.password)return{valid:!1,error:`jwks_uri must not contain credentials`};if(i.jwks_uri.includes(`#`))return{valid:!1,error:`jwks_uri must not contain a fragment`}}catch{return{valid:!1,error:`jwks_uri must be a valid URL`}}if(n.metadataProfile===`mcp-2026-07-28`&&!i.redirect_uris||i.redirect_uris&&!i.redirect_uris.every(e=>fye(e)))return{valid:!1,error:`redirect_uris must be a non-empty array of absolute HTTP(S) or private-use URIs`};for(let e of[`client_uri`,`logo_uri`,`tos_uri`,`policy_uri`]){if(i[e]!==void 0&&typeof i[e]!=`string`)return{valid:!1,error:`${e} must be a string`};if(typeof i[e]==`string`)try{let t=new URL(i[e]);if(t.protocol!==`https:`&&t.protocol!==`http:`)return{valid:!1,error:`${e} must use HTTP(S)`};if(t.username||t.password)return{valid:!1,error:`${e} must not contain credentials`};if(!SY(t.hostname))return{valid:!1,error:`${e} must not point to a private or reserved address`}}catch{return{valid:!1,error:`${e} is not a valid URL`}}}let s=n.originBoundFields??[`post_logout_redirect_uris`,`client_uri`],c;try{c=new URL(e).origin}catch{return{valid:!1,error:`client_id is not a valid URL`}}for(let e of s){let t=i[e];if(t===void 0)continue;let n;if(typeof t==`string`)n=[t];else if(Array.isArray(t)){if(!t.every(e=>typeof e==`string`))return{valid:!1,error:`${e} must be a string or an array of strings`};n=t}else return{valid:!1,error:`${e} must be a string or an array of strings`};for(let t of n){let n;try{n=new URL(t)}catch{return{valid:!1,error:`${e} contains an invalid URL: "${t}"`}}let r=e===`redirect_uris`||e===`post_logout_redirect_uris`,i=r&&O1(n);if(n.protocol!==`https:`&&n.protocol!==`http:`&&!i)return{valid:!1,error:`all values for ${e} must use HTTP(S) or a private-use scheme`};if(i&&(e===`redirect_uris`||D1(n)))continue;let a=r&&(n.protocol===`http:`||n.protocol===`https:`)&&xY(n.hostname);if(n.origin!==c&&!a)return{valid:!1,error:`${e} value "${t}" must have the same origin as client_id (${c})`}}}return a.push(...dye(e)),{valid:!0,metadata:{...i,token_endpoint_auth_method:i.token_endpoint_auth_method??`none`},...a.length>0?{warnings:a}:{}}}const S4=5e3,C4=5120,mye=/^application\/(?:[-\w.]+\+)?json\s*(?:;|$)/i,w4=`Failed to fetch metadata document (network error or redirect blocked)`,T4=`cimd`;function E4(e){return new O(`BAD_REQUEST`,{error:`invalid_client`,error_description:e})}function D4(){return E4(`Metadata document exceeds ${C4/1024}KB size limit`)}async function hye(e,t,n){let r=e.body?.getReader();if(!r){let n=await e.text();if(new TextEncoder().encode(n).byteLength>t)throw D4();return n}let i=[],a=0,o,s=new Promise((e,t)=>{o=t}),c=()=>{o?.(/* @__PURE__ */ Error(`Metadata document body read aborted`)),r.cancel().catch(()=>{})};n.aborted?c():n.addEventListener(`abort`,c,{once:!0});try{for(;;){let{done:e,value:n}=await Promise.race([r.read(),s]);if(e)break;if(a+=n.byteLength,a>t)throw await r.cancel(),D4();i.push(n)}}finally{n.removeEventListener(`abort`,c),r.releaseLock()}let l=new Uint8Array(a),u=0;for(let e of i)l.set(e,u),u+=e.byteLength;return new TextDecoder().decode(l)}function gye(e){return{cacheControl:e.get(`cache-control`)??void 0,vary:e.get(`vary`)??void 0,expires:e.get(`expires`)??void 0,date:e.get(`date`)??void 0,age:e.get(`age`)??void 0,etag:e.get(`etag`)??void 0,lastModified:e.get(`last-modified`)??void 0}}async function _ye(e,t,n,r){let i=uye(t);if(i)throw E4(i);if(n.isMetadataDocumentUrlAllowed&&!await n.isMetadataDocumentUrlAllowed(t,e))throw E4(`client_id URL is not permitted by the server's fetch policy`);let a=new Headers({Accept:`application/json`});r?.etag&&a.set(`If-None-Match`,r.etag),r?.lastModified&&a.set(`If-Modified-Since`,r.lastModified);let o,s=new AbortController,c=!1,l=setTimeout(()=>{c=!0,s.abort()},S4);try{try{o=await n.fetchClientMetadataResource(t,{headers:a,redirect:`error`,signal:s.signal})}catch{throw E4(c?`Metadata document fetch timed out after ${S4}ms`:w4)}if(o.redirected)throw E4(`Metadata document fetch must not follow redirects`);let i=gye(o.headers);if(o.status===304){if(!r?.etag&&!r?.lastModified)throw E4(`Metadata document returned 304 without a conditional validator`);return{status:`not-modified`,cacheHeaders:i}}if(o.status!==200)throw E4(`Metadata document fetch returned HTTP ${o.status}`);let l=o.headers.get(`content-type`)??``;if(!mye.test(l))throw E4(`Metadata document must be JSON (got Content-Type "${l||`(none)`}")`);let u;try{let e=o.headers.get(`content-length`);if(e){let t=Number.parseInt(e,10);if(Number.isFinite(t)&&t>C4)throw await o.body?.cancel(),D4()}u=await hye(o,C4,s.signal)}catch(e){throw c?E4(`Metadata document fetch timed out after ${S4}ms`):e instanceof O?e:E4(w4)}let d;try{d=JSON.parse(u)}catch{throw E4(`Metadata document is not valid JSON`)}let f=pye(t,d,{originBoundFields:n.originBoundFields,metadataProfile:n.metadataProfile});if(!f.valid)throw E4(f.error);for(let t of f.warnings??[])e.context.logger.warn(`cimd metadata document warning: ${t}`);return{status:`modified`,metadata:f.metadata,cacheHeaders:i}}finally{clearTimeout(l)}}async function O4(e,t,n,r,i,a){let o=a?{...a}:void 0,s=await B2(e,i,{clientId:t,clientDiscoveryId:T4,metadata:{...n,client_id:n.client_id,redirect_uris:n.redirect_uris??[]},existingClient:a});if(s.created)try{await r.onClientCreated?.({client:s.client,clientMetadataDocument:n,context:e})}catch(t){e.context.logger.error(`cimd onClientCreated notification failed`,t)}else try{o&&await r.onClientRefreshed?.({client:s.client,previousClient:o,clientMetadataDocument:n,context:e})}catch(t){e.context.logger.error(`cimd onClientRefreshed notification failed`,t)}return s.client}const k4={minimumFetchInterval:1,maximumConcurrentFetches:16,maximumConcurrentFetchesPerOrigin:4,maximumFetchesPerMinute:120,maximumFetchesPerOriginPerMinute:30};function vye(e){return new O(`BAD_REQUEST`,{error:`invalid_client`,error_description:e})}function A4(e){return new O(`TOO_MANY_REQUESTS`,{error:`temporarily_unavailable`,error_description:e})}function yye(e,t){if(typeof e==`number`){if(!Number.isFinite(e)||e<0)throw new D(`cimd metadataFetchPolicy.${t} must be a non-negative number of seconds or duration string`);return e*1e3}try{let t=Math.floor(Date.now()/1e3),n=(S$(e,t)-t)*1e3;if(!Number.isFinite(n)||n<0)throw Error(`negative duration`);return n}catch{throw new D(`cimd metadataFetchPolicy.${t} must be a non-negative number of seconds or duration string`)}}function j4(e,t){if(!Number.isInteger(e)||e<1)throw new D(`cimd metadataFetchPolicy.${t} must be a positive integer`);return e}function bye(e){let t=e.metadataFetchPolicy;return{minimumFetchIntervalMs:yye(t?.minimumFetchInterval??k4.minimumFetchInterval,`minimumFetchInterval`),maximumConcurrentFetches:j4(t?.maximumConcurrentFetches??k4.maximumConcurrentFetches,`maximumConcurrentFetches`),maximumConcurrentFetchesPerOrigin:j4(t?.maximumConcurrentFetchesPerOrigin??k4.maximumConcurrentFetchesPerOrigin,`maximumConcurrentFetchesPerOrigin`),maximumFetchesPerMinute:j4(t?.maximumFetchesPerMinute??k4.maximumFetchesPerMinute,`maximumFetchesPerMinute`),maximumFetchesPerOriginPerMinute:j4(t?.maximumFetchesPerOriginPerMinute??k4.maximumFetchesPerOriginPerMinute,`maximumFetchesPerOriginPerMinute`)}}function M4(e,t){let n=t-6e4,r=0;for(;r<e.length&&e[r]<=n;)r+=1;r>0&&e.splice(0,r)}function xye(e,t){if(typeof e==`number`)return Math.max(0,e*1e3);let n=Math.floor(t/1e3);return Math.max(0,(S$(e,n)-n)*1e3)}function Sye(e){let t=/* @__PURE__ */ new Map,n=/* @__PURE__ */ new Set;for(let r of e?.split(`,`)??[]){let[e,...i]=r.trim().split(`=`),a=e?.toLowerCase();if(!a)continue;t.has(a)&&n.add(a);let o=i.join(`=`).trim();t.set(a,!o||o.replace(/^"|"$/g,``))}return{directives:t,duplicates:n}}function N4(e){if(typeof e!=`string`||!/^\d+$/.test(e))return null;let t=Number(e);return Number.isSafeInteger(t)?t:null}function Cye(e,t,n){let{directives:r,duplicates:i}=Sye(e.cacheControl),a=e.vary?.split(`,`).some(e=>e.trim()===`*`);if(r.has(`no-store`)||r.has(`private`)||a)return{cacheable:!1,expiresAt:n};let o=xye(t,n);if(r.has(`no-cache`))return{cacheable:!0,expiresAt:n};let s=N4(e.age)??0,c=e.date?Date.parse(e.date):n,l=Number.isFinite(c)?Math.max(0,n-c):0,u=Math.max(l,s*1e3),d=null,f=r.has(`s-maxage`),p=N4(r.get(`s-maxage`)),m=r.has(`max-age`),h=N4(r.get(`max-age`)),g=f?p===null||i.has(`s-maxage`):m&&(h===null||i.has(`max-age`)),_=f?p:h;if(g)d=0;else if(_!==null)d=Math.max(0,_*1e3-u);else if(e.expires){let t=Date.parse(e.expires);Number.isFinite(t)&&(d=Math.max(0,t-(Number.isFinite(c)?c:n)-u))}return{cacheable:!0,expiresAt:n+Math.min(o,d??o)}}function wye(e,t){return{cacheControl:t.cacheControl??e.cacheControl,vary:t.vary??e.vary,expires:t.expires??e.expires,date:t.date??e.date,age:t.age??e.age,etag:t.etag??e.etag,lastModified:t.lastModified??e.lastModified}}function Tye(e,t,n,r){let i=Cye(t,n,r);return i.cacheable?{metadata:e,expiresAt:i.expiresAt,etag:t.etag,lastModified:t.lastModified,responseCacheHeaders:t}:null}function Eye(e){let t=e.metadataRevalidationInterval??`60m`,n=e.maxCacheEntries??1e3;if(!Number.isInteger(n)||n<1)throw new D(`cimd maxCacheEntries must be a positive integer`);let r=bye(e),i=/* @__PURE__ */ new Map,a=/* @__PURE__ */ new Map,o=/* @__PURE__ */ new Map,s=/* @__PURE__ */ new Map,c=[],l=0,u=e=>{let t=i.get(e);if(t)return i.delete(e),i.set(e,t),t},d=(e,t)=>{for(i.delete(e);i.size>=n;){let e=i.keys().next().value;if(typeof e!=`string`)break;i.delete(e)}i.set(e,t)},f=(e,t)=>{if(!o.has(e))for(;o.size>=n;){let e=!1;for(let[n,i]of o)if(!a.has(n)&&!(r.minimumFetchIntervalMs>0&&t-i<r.minimumFetchIntervalMs)){o.delete(n),e=!0;break}if(!e)throw A4(`metadata fetch client state is at capacity`)}},p=(e,t)=>{let r=s.get(e);if(r)return M4(r.fetchStartTimesMs,t),s.delete(e),s.set(e,r),r;for(;s.size>=n;){let e=!1;for(let[n,r]of s)if(M4(r.fetchStartTimesMs,t),!(r.activeFetchCount>0||r.fetchStartTimesMs.length>0)){s.delete(n),e=!0;break}if(!e)throw A4(`metadata fetch origin state is at capacity`)}let i={activeFetchCount:0,fetchStartTimesMs:[]};return s.set(e,i),i},m=e=>{let t=Date.now(),n=o.get(e);if(r.minimumFetchIntervalMs>0&&n!==void 0&&t-n<r.minimumFetchIntervalMs)throw A4(`metadata document fetch is within the per-client minimum interval`);f(e,t);let i=new URL(e).origin,a=p(i,t);if(M4(c,t),l>=r.maximumConcurrentFetches)throw A4(`global metadata fetch concurrency limit exceeded`);if(a.activeFetchCount>=r.maximumConcurrentFetchesPerOrigin)throw A4(`metadata fetch concurrency limit exceeded for client origin`);if(c.length>=r.maximumFetchesPerMinute)throw A4(`global metadata fetch rate limit exceeded`);if(a.fetchStartTimesMs.length>=r.maximumFetchesPerOriginPerMinute)throw A4(`metadata fetch rate limit exceeded for client origin`);o.delete(e),o.set(e,t),c.push(t),a.fetchStartTimesMs.push(t),l+=1,a.activeFetchCount+=1;let s=!1;return()=>{s||(s=!0,--l,--a.activeFetchCount)}};return async(n,r,s)=>{if(!x4(r))return null;let c=n.context.getPlugin(`oauth-provider`);if(!c)throw new D(`cimd discovery invoked without the oauth-provider plugin installed`);let l=c.options,f=u(r),p=Date.now();if(f&&f.expiresAt>p)return s||O4(n,r,f.metadata,e,l);let h=a.get(r);if(h!==void 0)return h;let g=m(r),_=(async()=>{let a=await _ye(n,r,e,f?{etag:f.etag,lastModified:f.lastModified}:void 0);if(a.status===`not-modified`&&!f)throw vye(`Metadata document returned 304 without a validated cached document`);let c=a.status===`modified`?a.metadata:f.metadata,u=await O4(n,r,c,e,l,s??void 0),p=Tye(c,a.status===`modified`?a.cacheHeaders:wye(f.responseCacheHeaders,a.cacheHeaders),t,Date.now());return p?d(r,p):i.delete(r),o.delete(r),u})();a.set(r,_);try{return await _}catch(e){throw o.delete(r),o.set(r,Date.now()),e}finally{a.get(r)===_&&a.delete(r),g()}}}function Dye(e){return{id:T4,matches:x4,resolve:Eye(e),fetchClientMetadataResource:e.fetchClientMetadataResource,discoveryMetadata:{client_id_metadata_document_supported:!0}}}const Oye=e=>{let t=Dye(e);return{id:`cimd`,version:`1.7.10`,init(e){bhe(e,{clientDiscovery:t})}}},kye=/* @__PURE__ */ new Set([204,205,304]);function Aye(e){let t=new Headers;for(let[n,r]of Object.entries(e))if(Array.isArray(r))for(let e of r)t.append(n,e);else r!==void 0&&t.append(n,r);return t}const jye=async(e,t)=>{let n=new Request(e,t),r=new URL(n.url);if(r.protocol!==`https:`)throw TypeError(`CIMD Node transport requires an HTTPS URL`);if(n.method!==`GET`&&n.method!==`HEAD`)throw TypeError(`CIMD Node transport supports only GET and HEAD`);let i=await _ee(r.hostname,{all:!0,verbatim:!0});if(i.length===0)throw TypeError(`metadata hostname returned no DNS addresses`);for(let e of i)if(!SY(e.address))throw TypeError(`metadata hostname must resolve only to public-routable addresses`);let a=i[0],o=Object.fromEntries(n.headers.entries());o.host=r.host;let s=t?.signal??(e instanceof Request?e.signal:n.signal);return new Promise((e,t)=>{let i=xt(r,{agent:!1,headers:o,method:n.method,servername:_t(r.hostname.replace(/^\[|\]$/g,``))===0?r.hostname:void 0,signal:s,lookup:(e,t,n)=>{t.all?n(null,[a]):n(null,a.address,a.family)}},t=>{let r=t.statusCode??500,i=n.method===`HEAD`||kye.has(r)?null:mt.toWeb(t);e(new Response(i,{headers:Aye(t.headers),status:r,statusText:t.statusMessage}))});i.once(`error`,t),i.end()})};function Mye(e,t=8){let n=0;return(r,i)=>{let a=i?.signal??(r instanceof Request?r.signal:void 0);return a?.aborted?Promise.reject(a.reason):n>=t?Promise.reject(/* @__PURE__ */ Error(`CIMD transport capacity reached`)):(n++,new Promise((t,o)=>{let s=!1,c=()=>{s=!0,o(a?.reason)};a?.addEventListener(`abort`,c,{once:!0});let l=()=>{n--,a?.removeEventListener(`abort`,c)};Promise.resolve().then(()=>(a?.throwIfAborted(),e(r,i))).then(e=>{l(),s?e.body?.cancel().catch(()=>{}):t(e)},e=>{l(),o(e)})}))}}var P4=class e extends P()(`clankerauth/CimdTransport`){static layer=_f(e,{fetch:Mye(jye)});static layerWith=t=>t===void 0?e.layer:_f(e,{fetch:t})};const F4=`x-clankerauth-peer`,Nye=e=>gt({requestTimeout:15e3,headersTimeout:1e4},e),Pye=(e,t)=>{t.writeHead(503).end()},Fye=ym(`NodeHttp.listen`)(function*(e,t){let n=Pye,r=Nye((e,t)=>n(e,t)),i=op(e=>{r.close(()=>e(L)),r.closeAllConnections()});yield*qp(op(n=>{let i=e=>n(z(e));r.once(`error`,i),r.listen(e,t,()=>{r.off(`error`,i),n(L)})}),()=>i);let a=r.address();return a instanceof Object?{port:a.port,serve:e=>Jp(()=>i).pipe(hp(()=>I(()=>n=e)))}:yield*up(/* @__PURE__ */ Error(`Expected a TCP listener`))}),Iye=_h(65536),Lye=/^\/forward-auth(?:\?|$)/,Rye=(e,t,n)=>{let r=(e[`x-forwarded-for`]?.split(`,`).map(e=>e.trim()).filter(Boolean))?.at(-1);return n&&r?r:Ri(t,()=>`unknown`)},zye=({baseURL:e,trustProxy:t})=>n=>R(function*(){let r=yield*pM,i=r.source,a=i instanceof ht?i.url:r.url;if(!a?.startsWith(`/`)||a.startsWith(`//`))return fA({status:400});let o=It(r.headers,Lye.test(a)?kg(`forwarded`):Ag([`forwarded`,`x-forwarded-host`,`x-forwarded-proto`]),Eg(`host`,new URL(e).host),Eg(F4,Rye(r.headers,r.remoteAddress,t)),kg(`x-forwarded-for`)),s=yield*n.pipe(Wp(pM,r.modify({headers:o})),Wp(qO,Iye));return i instanceof ht?HE(s.body).pipe(WE(`Stream`,e=>DA(s,cO(e.stream.pipe(kse(()=>I(()=>i.socket.destroy()))),e.contentType,e.contentLength))),qE(()=>s)):s}).pipe(tm),I4=e=>`${L4}${e}`,L4=`resource:`,R4=(e,t,n)=>e`DELETE FROM verification WHERE json_valid(value) AND json_extract(value, '$.type') = 'authorization_code' AND (${t} IS NULL OR json_extract(value, '$.query.client_id') = ${t}) AND (${n} IS NULL OR json_extract(value, '$.referenceId') = ${n})`,z4=ym(`Authorization.clear`)(function*(e,t){let n=t.clientId??null,r=t.resource===void 0?null:I4(t.resource);yield*e`DELETE FROM oauthConsent WHERE (${n} IS NULL OR clientId = ${n}) AND (${r} IS NULL OR referenceId = ${r})`,yield*R4(e,n,r),yield*e`DELETE FROM oauthAccessToken WHERE (${n} IS NULL OR clientId = ${n}) AND (${r} IS NULL OR referenceId = ${r})`,yield*e`DELETE FROM oauthRefreshToken WHERE (${n} IS NULL OR clientId = ${n}) AND (${r} IS NULL OR referenceId = ${r})`}),Bye=hoe(W({message:Hx(U),error_description:Hx(U)})),Vye=e=>Ri(Wi(Bye(e.body),e=>zi(e.message??e.error_description)),()=>`Request could not be completed`),B4=e=>new tV({message:e}),V4=e=>new YB({message:e}),H4=(e,t={})=>rp({try:e,catch:e=>{if(!Pq(e))return JB.of(e);let n=e.statusCode,r=n===400||n===422?t.refused:n===404?t.missing:n===409?t.conflict:n===503?t.unavailable:void 0;return r?r(Vye(e)):JB.of(e)}}),U4=(e,t)=>new TI({message:t,issues:[{path:e,message:t}]}),Hye=Mx(K(WV)),Uye=on(`RequestParseError`),Wye=e=>Hye(e)?e:rj(e)&&Uye(e.reason)?new nV({message:`Request body could not be read`}):JB.of(e),Gye=new Map(WV.map(e=>[e,gb(`httpApiStatus`)(e.ast)??500])),Kye=_A(K(WV)),W4=e=>{let t=Wye(e),n=WV.find(e=>Mx(e)(t));return Kye(t,{status:Gye.get(n)??500}).pipe(Ep)},G4=(e,t)=>e===t||e.endsWith(`.${t}`),qye=e=>{try{return new URL(`https://${e}`).hostname===e&&e.includes(`.`)&&!_t(e)}catch{return!1}},K4=(e,t)=>e.protocol===`https:`||e.protocol===`http:`&&([`localhost`,`127.0.0.1`,`[::1]`].includes(e.hostname)||t),q4=`HTTPS origins (HTTP allowed on loopback, or anywhere with CLANKERAUTH_ALLOW_INSECURE_HTTP=true)`,J4=(e,t)=>URL.canParse(e)&&new URL(e).origin===e&&K4(new URL(e),t),Y4=H(function*(e){let{allowInsecureHttp:t,baseURL:n,cookieDomain:r}=e;return J4(n,t)?_g(e.secret).length<32?yield*z(/* @__PURE__ */ Error(`CLANKERAUTH_BETTER_AUTH_SECRET must have at least 32 characters`)):e.mcpAllowedOrigins.every(e=>J4(e,t))?r!==void 0&&(!qye(r)||!G4(new URL(n).hostname,r))?yield*z(/* @__PURE__ */ Error(`CLANKERAUTH_COOKIE_DOMAIN must be a bare parent domain of the CLANKERAUTH_BASE_URL host, such as home.example`)):e:yield*z(/* @__PURE__ */ Error(`CLANKERAUTH_MCP_ALLOWED_ORIGINS must contain exact ${q4}`)):yield*z(/* @__PURE__ */ Error(`CLANKERAUTH_BASE_URL must be one of: ${q4}`))}),Jye=R(function*(){let e={baseURL:yield*EE(`CLANKERAUTH_BASE_URL`),secret:yield*pce(`CLANKERAUTH_BETTER_AUTH_SECRET`),database:yield*EE(`CLANKERAUTH_DATABASE`).pipe(vE(`data/clankerauth.sqlite`)),host:yield*EE(`CLANKERAUTH_HOST`).pipe(vE(`127.0.0.1`)),port:yield*fce(`CLANKERAUTH_PORT`).pipe(vE(3e3)),mcpAllowedOrigins:yield*dce(WS,`CLANKERAUTH_MCP_ALLOWED_ORIGINS`).pipe(vE([])),trustProxy:yield*DE(`CLANKERAUTH_TRUST_PROXY`).pipe(vE(!1)),allowInsecureHttp:yield*DE(`CLANKERAUTH_ALLOW_INSECURE_HTTP`).pipe(vE(!1)),cookieDomain:yield*EE(`CLANKERAUTH_COOKIE_DOMAIN`).pipe(vE(void 0))};return yield*Y4(e)});var X4=class e extends P()(`clankerauth/Settings`){static layer=bf(e,Jye)};const Z4=`Exactly one configured resource is required`,Q4=[`offline_access`],Yye=eH(VS(G(U))),Xye=eH(W({identifier:U,name:U,allowedScopes:U})),$4=eH(G(DV)),e3=(e,t)=>[.../* @__PURE__ */ new Set([...Q4,...t.flatMap(t=>e.find(e=>e.identifier===t)?.scopes??[])])],t3=ym(`ResourceCatalog.validateSelection`)(function*(e,t){let n=t.findIndex(t=>!e.some(e=>e.identifier===t));if(n!==-1)return yield*U4([`resources`,n],`Unknown Resource`)}),n3=ym(`ResourceCatalog.accessForClient`)(function*(e,t){return yield*$4(yield*t`SELECT clientId AS client_id, resourceId AS resource FROM oauthClientResource WHERE clientId = ${e} ORDER BY resourceId`)});var r3=class e extends P()(`clankerauth/ResourceCatalog`){static layer=bf(e,R(function*(){let{sql:e}=yield*iH,t=cV((yield*X4).baseURL),n=ym(`ResourceCatalog.decode`)(function*(e){let n=yield*Xye(e),r=yield*Yye(n.allowedScopes);return{identifier:n.identifier,name:n.name,scopes:r.filter(e=>!Q4.includes(e)),builtIn:n.identifier===t}}),r=ym(`ResourceCatalog.list`)(function*(){let t=yield*e`SELECT identifier, name, allowedScopes FROM oauthResource ORDER BY createdAt, identifier`;return yield*ep(t,n)}),i=ym(`ResourceCatalog.get`)(function*(t){let r=yield*e`SELECT identifier, name, allowedScopes FROM oauthResource WHERE identifier = ${t}`;return r[0]?yield*n(r[0]):void 0});return{list:r,get:i,application:e=>V(i(e),e=>e?.builtIn?void 0:e),access:ym(`ResourceCatalog.access`)(function*(){return yield*$4(yield*e`SELECT clientId AS client_id, resourceId AS resource FROM oauthClientResource ORDER BY clientId, resourceId`)}),hasAccess:ym(`ResourceCatalog.hasAccess`)(function*(t,n){return(yield*e`SELECT 1 FROM oauthClient c WHERE c.clientId = ${t} AND (c.userId IS NULL
-            OR EXISTS (SELECT 1 FROM oauthClientResource l WHERE l.clientId = c.clientId AND l.resourceId = ${n}))`).length>0}),scopesFor:ym(`ResourceCatalog.scopesFor`)(function*(e){let t=yield*r();return yield*t3(t,e),e3(t,e)})}}))};const Zye=moe(W({typ:U,payload:tS(U,_C)})),Qye=e=>({id:`signer`,endpoints:{signDocument:X.serverOnly({method:`POST`,body:Zye},async t=>t.json({token:await T$(t,{options:e,header:{typ:t.body.typ},payload:t.body.payload})}))}}),$ye=e=>typeof e==`string`,ebe=(e,t,n,r,i,a)=>{let o={disableSettingJwtHeader:!0,jwt:{issuer:`${e.baseURL}/api/auth`},jwks:{keyPairConfig:{alg:`EdDSA`,crv:`Ed25519`}}},s=o4({loginPage:`/login`,consentPage:`/consent`,scopes:[...Q4],resources:[{identifier:cV(e.baseURL),name:`clankerauth administration`,allowedScopes:[...Q4,lV.read,lV.write]}],resourceSeedMode:`merge`,rateLimit:{register:{window:60,max:10}},postLogin:{page:`/consent`,shouldRedirect:()=>!1,consentReferenceId:async({scopes:e})=>{let t=await r4(),r=new URLSearchParams(t?.query),a=r.getAll(`resource`);if(a.length!==1||!await i(n.get(a[0])))throw new E(`BAD_REQUEST`,{error:`invalid_target`,error_description:Z4});let o=r.get(`client_id`);if(!o||!await i(n.hasAccess(o,a[0])))throw new E(`BAD_REQUEST`,{error:`invalid_target`,error_description:`Client access is required`});let s=await i(n.scopesFor(a));if(e.some(e=>!s.includes(e)))throw new E(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`Resource scopes changed; start authorization again`});return I4(a[0])}},grantTypes:[`authorization_code`,`refresh_token`],allowDynamicClientRegistration:!0,allowUnauthenticatedClientRegistration:!0,clientRegistrationRequirePKCE:!0,enforcePerClientResources:!1,accessTokenExpiresIn:900,refreshTokenExpiresIn:2592e3,refreshTokenReuseInterval:30,codeExpiresIn:120,clientPrivileges:async({user:e,action:t})=>!!e&&t!==`configure-client-credentials-scopes`,resourcePrivileges:async({user:e})=>!!e});return{options:{appName:`clankerauth`,baseURL:e.baseURL,secret:_g(e.secret),database:{db:t,type:`sqlite`,transaction:!0},trustedOrigins:[e.baseURL],logger:{disabled:!0},disabledPaths:[`/token`],emailAndPassword:{enabled:!0,minPasswordLength:8,maxPasswordLength:128},databaseHooks:{user:{create:{before:async()=>{if(await a())throw new E(`CONFLICT`,{message:`Setup already completed`})}}}},hooks:{before:Rq(async e=>{if(e.path===`/oauth2/register`){let t=e.body.redirect_uris;!e.body.application_type&&Array.isArray(t)&&t.some(e=>{if(!$ye(e))return!1;try{return new URL(e).protocol!==`https:`}catch{return!1}})&&(e.body.application_type=`native`),delete e.body.resources}})},session:{expiresIn:2592e3,updateAge:86400},advanced:{ipAddress:{ipAddressHeaders:[F4]}},rateLimit:{enabled:!0,storage:`database`,window:60,max:100,customRules:{"/sign-in/email":{window:60,max:5}}},plugins:[ehe({defaultPrefix:`clankerauth_`,maximumNameLength:100,enableSessionForAPIKeys:!1,keyExpiration:{defaultExpiresIn:null,minExpiresIn:0},rateLimit:{enabled:!1}}),uhe(o),Qye(o),s,Oye({fetchClientMetadataResource:r,metadataProfile:`mcp-2026-07-28`,metadataRevalidationInterval:300,maxCacheEntries:1e3,metadataFetchPolicy:{maximumConcurrentFetches:8,maximumConcurrentFetchesPerOrigin:2,maximumFetchesPerMinute:60,maximumFetchesPerOriginPerMinute:15}})]},oauthPlugin:s}};var i3=class e extends P()(`clankerauth/Issuer`){static layer=bf(e,R(function*(){let e=yield*X4,{kysely:t}=yield*iH,n=yield*r3,{fetch:r}=yield*P4,i=gm(yield*Lp()),{options:a,oauthPlugin:o}=ebe(e,t,n,r,i,async()=>await(await xH((await s.$context).adapter)).count({model:`user`})>0),{auth:s,context:c}=yield*ym(`Auth.initialize`)(function*(){let e=yield*rp(()=>kQ(a));if(e.schemaProblems.length)return yield*z(/* @__PURE__ */ Error(`Database schema requires manual repair`));yield*rp(()=>e.runMigrations());let t=yme(a);return{auth:t,context:yield*rp(()=>t.$context)}},rm)();return{auth:s,context:c,publishScopes:e=>I(()=>{o.options.scopes=[...e]})}}))};const tbe=Nx(AV),nbe=Nx(W({id:U,key:U,referenceId:U,expiresAt:sS(eC),permissions:sS(VS(AV))})),a3=H(function*(e){return{keyId:e.id,name:e.name??``,enabled:e.enabled,permissions:yield*tbe(e.permissions??{}).pipe(bp(()=>vp(Sm(`An API key's stored permissions do not decode; it is listed with none`,{keyId:e.id}),{}))),expiresAt:e.expiresAt?xh(e.expiresAt):null,createdAt:xh(e.createdAt)}});var o3=class e extends P()(`clankerauth/ApiKeys`){static layer=bf(e,R(function*(){let{auth:e}=yield*i3,{sql:t}=yield*iH,n=yield*r3,r=ym(`ApiKeys.validate`)(function*(e){if(e!==void 0)for(let[t,r]of Object.entries(e)){let e=yield*n.get(t);if(e?.builtIn)return yield*U4([`permissions`,t],`Administration requires OAuth access tokens, not API keys`);if(!e||r.some(t=>!e.scopes.includes(t)))return yield*U4([`permissions`,t],`Select explicitly granted, currently available Resource scopes`)}});return{list:ym(`ApiKeys.list`)(function*(){let{providerHeaders:t}=yield*iV,n=yield*t,r=yield*H4(()=>e.api.listApiKeys({headers:n,query:{sortBy:`createdAt`,sortDirection:`asc`}}));return{keys:yield*ep(r.apiKeys,a3)}}),create:ym(`ApiKeys.create`)(function*(t){let n=yield*iV;yield*r(t.permissions);let i=t.expiresAt===null?null:(Th(t.expiresAt)-(yield*Nf))/1e3;if(i!==null&&i<1)return yield*U4([`expiresAt`],`Expiry must be in the future`);let a=yield*H4(()=>e.api.createApiKey({body:{userId:n.userId,name:t.name.trim(),permissions:La(t.permissions,e=>[...e]),expiresIn:i}}),{refused:B4});return{...yield*a3(a),key:a.key}}),update:ym(`ApiKeys.update`)(function*(t){let n=yield*iV;return yield*r(t.permissions),yield*a3(yield*H4(()=>e.api.updateApiKey({body:{userId:n.userId,keyId:t.keyId,name:t.name?.trim(),enabled:t.enabled,permissions:t.permissions&&La(t.permissions,e=>[...e])}}),{refused:B4,missing:()=>QB.of(t.keyId)}))}),delete:ym(`ApiKeys.delete`)(function*({keyId:t}){let{providerHeaders:n}=yield*iV,r=yield*n;return yield*H4(()=>e.api.deleteApiKey({headers:r,body:{keyId:t}}),{missing:()=>QB.of(t)}),{deleted:!0}}),keyList:ym(`ApiKeys.keyList`)(function*(r){let i=yield*Nf,a=(yield*n.application(r))?.scopes??[],o=a.length?yield*t`
+            OR EXISTS (SELECT 1 FROM oauthClientResource l WHERE l.clientId = c.clientId AND l.resourceId = ${n}))`).length>0}),scopesFor:ym(`ResourceCatalog.scopesFor`)(function*(e){let t=yield*r();return yield*t3(t,e),e3(t,e)})}}))};const Zye=moe(W({typ:U,payload:tS(U,_C)})),Qye=e=>({id:`signer`,endpoints:{signDocument:X.serverOnly({method:`POST`,body:Zye},async t=>t.json({token:await T$(t,{options:e,header:{typ:t.body.typ},payload:t.body.payload})}))}}),$ye=e=>typeof e==`string`,ebe=(e,t,n,r,i,a)=>{let o={disableSettingJwtHeader:!0,jwt:{issuer:`${e.baseURL}/api/auth`},jwks:{keyPairConfig:{alg:`EdDSA`,crv:`Ed25519`}}},s=o4({loginPage:`/login`,consentPage:`/consent`,scopes:[...Q4],resources:[{identifier:cV(e.baseURL),name:`clankerauth administration`,allowedScopes:[...Q4,lV.read,lV.write]}],resourceSeedMode:`merge`,rateLimit:{register:{window:60,max:10}},postLogin:{page:`/consent`,shouldRedirect:()=>!1,consentReferenceId:async({scopes:e})=>{let t=await r4(),r=new URLSearchParams(t?.query),a=r.getAll(`resource`);if(a.length!==1||!await i(n.get(a[0])))throw new E(`BAD_REQUEST`,{error:`invalid_target`,error_description:Z4});let o=r.get(`client_id`);if(!o||!await i(n.hasAccess(o,a[0])))throw new E(`BAD_REQUEST`,{error:`invalid_target`,error_description:`Client access is required`});let s=await i(n.scopesFor(a));if(e.some(e=>!s.includes(e)))throw new E(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`Resource scopes changed; start authorization again`});return I4(a[0])}},grantTypes:[`authorization_code`,`refresh_token`],allowDynamicClientRegistration:!0,allowUnauthenticatedClientRegistration:!0,clientRegistrationRequirePKCE:!0,enforcePerClientResources:!1,accessTokenExpiresIn:900,refreshTokenExpiresIn:2592e3,refreshTokenReuseInterval:30,codeExpiresIn:120,clientPrivileges:async({user:e,action:t})=>!!e&&t!==`configure-client-credentials-scopes`,resourcePrivileges:async({user:e})=>!!e});return{options:{appName:`clankerauth`,baseURL:e.baseURL,secret:_g(e.secret),database:{db:t,type:`sqlite`,transaction:!0},trustedOrigins:[e.baseURL],logger:{disabled:!0},disabledPaths:[`/token`],emailAndPassword:{enabled:!0,minPasswordLength:8,maxPasswordLength:128},databaseHooks:{user:{create:{before:async()=>{if(await a())throw new E(`CONFLICT`,{message:`Setup already completed`})}}}},hooks:{before:Rq(async e=>{if(e.path===`/oauth2/register`){let t=e.body.redirect_uris;!e.body.application_type&&Array.isArray(t)&&t.some(e=>{if(!$ye(e))return!1;try{return new URL(e).protocol!==`https:`}catch{return!1}})&&(e.body.application_type=`native`),delete e.body.resources}})},session:{expiresIn:2592e3,updateAge:86400},advanced:{ipAddress:{ipAddressHeaders:[F4]}},rateLimit:{enabled:!0,storage:`database`,window:60,max:100,customRules:{"/sign-in/email":{window:60,max:5}}},plugins:[ehe({defaultPrefix:`clankerauth_`,maximumNameLength:100,enableSessionForAPIKeys:!1,keyExpiration:{defaultExpiresIn:null,minExpiresIn:0},rateLimit:{enabled:!1}}),uhe(o),Qye(o),s,Oye({fetchClientMetadataResource:r,metadataProfile:`mcp-2026-07-28`,metadataRevalidationInterval:300,maxCacheEntries:1e3,metadataFetchPolicy:{maximumConcurrentFetches:8,maximumConcurrentFetchesPerOrigin:2,maximumFetchesPerMinute:60,maximumFetchesPerOriginPerMinute:15}})]},oauthPlugin:s}};var i3=class e extends P()(`clankerauth/Issuer`){static layer=bf(e,R(function*(){let e=yield*X4,{kysely:t}=yield*iH,n=yield*r3,{fetch:r}=yield*P4,i=gm(yield*Lp()),{options:a,oauthPlugin:o}=ebe(e,t,n,r,i,async()=>await(await xH((await s.$context).adapter)).count({model:`user`})>0),{auth:s,context:c}=yield*ym(`Auth.initialize`)(function*(){let e=yield*rp(()=>kQ(a));if(e.schemaProblems.length)return yield*z(/* @__PURE__ */ Error(`Database schema requires manual repair`));yield*rp(()=>e.runMigrations());let t=yme(a),n=yield*rp(()=>t.$context);return yield*rp(()=>t.api.getJwks()),{auth:t,context:n}},rm)();return{auth:s,context:c,publishScopes:e=>I(()=>{o.options.scopes=[...e]})}}))};const tbe=Nx(AV),nbe=Nx(W({id:U,key:U,referenceId:U,expiresAt:sS(eC),permissions:sS(VS(AV))})),a3=H(function*(e){return{keyId:e.id,name:e.name??``,enabled:e.enabled,permissions:yield*tbe(e.permissions??{}).pipe(bp(()=>vp(Sm(`An API key's stored permissions do not decode; it is listed with none`,{keyId:e.id}),{}))),expiresAt:e.expiresAt?xh(e.expiresAt):null,createdAt:xh(e.createdAt)}});var o3=class e extends P()(`clankerauth/ApiKeys`){static layer=bf(e,R(function*(){let{auth:e}=yield*i3,{sql:t}=yield*iH,n=yield*r3,r=ym(`ApiKeys.validate`)(function*(e){if(e!==void 0)for(let[t,r]of Object.entries(e)){let e=yield*n.get(t);if(e?.builtIn)return yield*U4([`permissions`,t],`Administration requires OAuth access tokens, not API keys`);if(!e||r.some(t=>!e.scopes.includes(t)))return yield*U4([`permissions`,t],`Select explicitly granted, currently available Resource scopes`)}});return{list:ym(`ApiKeys.list`)(function*(){let{providerHeaders:t}=yield*iV,n=yield*t,r=yield*H4(()=>e.api.listApiKeys({headers:n,query:{sortBy:`createdAt`,sortDirection:`asc`}}));return{keys:yield*ep(r.apiKeys,a3)}}),create:ym(`ApiKeys.create`)(function*(t){let n=yield*iV;yield*r(t.permissions);let i=t.expiresAt===null?null:(Th(t.expiresAt)-(yield*Nf))/1e3;if(i!==null&&i<1)return yield*U4([`expiresAt`],`Expiry must be in the future`);let a=yield*H4(()=>e.api.createApiKey({body:{userId:n.userId,name:t.name.trim(),permissions:La(t.permissions,e=>[...e]),expiresIn:i}}),{refused:B4});return{...yield*a3(a),key:a.key}}),update:ym(`ApiKeys.update`)(function*(t){let n=yield*iV;return yield*r(t.permissions),yield*a3(yield*H4(()=>e.api.updateApiKey({body:{userId:n.userId,keyId:t.keyId,name:t.name?.trim(),enabled:t.enabled,permissions:t.permissions&&La(t.permissions,e=>[...e])}}),{refused:B4,missing:()=>QB.of(t.keyId)}))}),delete:ym(`ApiKeys.delete`)(function*({keyId:t}){let{providerHeaders:n}=yield*iV,r=yield*n;return yield*H4(()=>e.api.deleteApiKey({headers:r,body:{keyId:t}}),{missing:()=>QB.of(t)}),{deleted:!0}}),keyList:ym(`ApiKeys.keyList`)(function*(r){let i=yield*Nf,a=(yield*n.application(r))?.scopes??[],o=a.length?yield*t`
             SELECT id, key, referenceId, expiresAt, permissions FROM apikey
             WHERE enabled = 1 AND (expiresAt IS NULL OR expiresAt > ${new Date(i).toISOString()})
           `:[],s=yield*ep(o,e=>R(function*(){let t=yield*nbe(e),n=(t.permissions?.[r]??[]).filter(e=>a.includes(e));return n.length?[yield*rp(()=>Vde(new Uint8Array(Buffer.from(t.key,`base64url`)),r,{keyId:t.id,ownerId:t.referenceId,scopes:n,expiresAt:t.expiresAt===null?null:Th(t.expiresAt)}))]:[]}).pipe(bp(()=>vp(Sm(`An API key row cannot be listed; it is left out of key lists`,{keyId:e.id}),[])))),c=Math.floor(i/1e3),{token:l}=yield*H4(()=>e.api.signDocument({body:{typ:vI,payload:{aud:r,iat:c,exp:c+86400,keys:s.flat()}}}));return{list:l}})}}))};const s3=e=>e.userId===null,rbe=eH(G(W({userId:sS(U)}))),c3=ym(`Clients.requireManaged`)(function*(e,t){let[n]=yield*rbe(yield*t`SELECT userId FROM oauthClient WHERE clientId = ${e}`);if(!n)return yield*z(XB.of(e));if(s3(n))return yield*z($B.of(e))}),ibe=eH(G(W({clientId:U}))),l3=e=>({identifier:encodeURIComponent(e)}),abe=e=>{try{return new URL(e).href===e&&!e.includes(`#`)}catch{return!1}},obe=ym(`Resources.validateInput`)(function*(e){let t=e.identifier.trim(),n=e.name.trim(),r=[...new Set(e.scopes.map(e=>e.trim()))];if(!abe(t))return yield*U4([`identifier`],`Resource identifiers must be absolute URIs in canonical form, without a fragment`);let i=e.scopes.findIndex(e=>Q4.includes(e.trim()));return i===-1?{identifier:t,name:n,scopes:r}:yield*U4([`scopes`,i],`offline_access is reserved`)});var u3=class e extends P()(`clankerauth/Resources`){static layer=bf(e,R(function*(){let{sql:e,transaction:t}=yield*iH,{auth:n,publishScopes:r}=yield*i3,i=yield*r3,a=yield*Sw(1),o=e=>a.withPermit(e),s=ym(`Resources.syncClient`)(function*(e,t,n){let r=yield*n3(n,e),i=JSON.stringify(e3(t,r.map(e=>e.resource)));yield*e`UPDATE oauthClient SET scopes = ${i}, updatedAt = ${yield*Nf} WHERE clientId = ${n} AND scopes IS NOT ${i}`}),c=ym(`Resources.synchronize`)(function*(){let t=yield*i.list(),n=e3(t,t.map(e=>e.identifier));yield*r(n),yield*e`UPDATE oauthClient SET scopes = ${JSON.stringify(n)}, updatedAt = ${yield*Nf} WHERE userId IS NULL AND scopes IS NOT ${JSON.stringify(n)}`;for(let n of yield*ibe(yield*e`SELECT clientId FROM oauthClient WHERE userId IS NOT NULL ORDER BY clientId`))yield*s(e,t,n.clientId)}),l=e=>e?.builtIn?z(U4([`identifier`],`The administration Resource is fixed`)):L,u=B(iV,e=>e.providerHeaders);yield*c();let d=ym(`Resources.link`)(function*(n,r){let a=yield*i.list();yield*t3(a,r);let o=yield*Nf;return yield*t(e=>R(function*(){let t=(yield*n3(n,e)).map(e=>e.resource);for(let i of t.filter(e=>!r.includes(e)))yield*e`DELETE FROM oauthClientResource WHERE clientId = ${n} AND resourceId = ${i}`,yield*z4(e,{clientId:n,resource:i});for(let t of r)yield*e`INSERT OR IGNORE INTO oauthClientResource (id, clientId, resourceId, createdAt)
@@ -534,6 +534,6 @@ Most of the features of Better Auth will not work correctly.`);let l=t.secrets??
           `,a=(yield*cbe(n)).map(e=>({client_id:e.clientId,onboarding:e.clientDiscoveryId===null?s3(e)?`dcr`:`managed`:`cimd`,blocked:e.disabled===1,client_name:e.name??void 0,redirect_uris:e.redirectUris,token_endpoint_auth_method:e.tokenEndpointAuthMethod??void 0,application_type:e.applicationType,scope:e.scopes?.join(` `),grant_types:e.grantTypes??void 0})),o=yield*$f({resources:i.list(),clientAccess:i.access(),connections:c()});return{clients:a,resources:o.resources,clientAccess:o.clientAccess,connections:o.connections,email:t,issuer:`${r}/api/auth`}}),create:ym(`Clients.create`)(function*(e){let{providerHeaders:t}=yield*iV,r=yield*i.scopesFor(e.resources),o=yield*t,s=yield*H4(()=>n.api.adminCreateOAuthClient({headers:o,body:{client_name:e.client_name,redirect_uris:[...e.redirect_uris],token_endpoint_auth_method:e.token_endpoint_auth_method,application_type:e.application_type,grant_types:[`authorization_code`,`refresh_token`],scope:r.join(` `),skip_consent:!0}}),{refused:B4});return yield*a.link(s.client_id,e.resources).pipe(Dp(()=>H4(()=>n.api.deleteOAuthClient({headers:o,body:{client_id:s.client_id}})))),s}),update:ym(`Clients.update`)(function*(t){yield*c3(t.client_id,e);let{providerHeaders:r}=yield*iV,i=yield*r;return yield*H4(()=>n.api.updateOAuthClient({headers:i,body:{client_id:t.client_id,update:{client_name:t.client_name,redirect_uris:[...t.redirect_uris],application_type:t.application_type}}}),{refused:B4,missing:()=>XB.of(t.client_id)})}),rotate:ym(`Clients.rotate`)(function*(t){yield*c3(t.client_id,e);let{providerHeaders:r}=yield*iV,i=yield*r;return yield*H4(()=>n.api.rotateClientSecret({headers:i,body:t}),{refused:B4,missing:()=>XB.of(t.client_id)})}),revoke:({client_id:e,resource:n})=>t(t=>s(e,n,t)),delete:({client_id:e})=>t(t=>R(function*(){return yield*o(e,t),yield*R4(t,e,null),yield*t`DELETE FROM oauthClient WHERE clientId = ${e}`,{deleted:!0}})),block:({client_id:e,blocked:n})=>t(t=>R(function*(){return n?yield*s(e,void 0,t):yield*o(e,t),yield*t`UPDATE oauthClient SET disabled = ${+!!n}, updatedAt = ${yield*Nf} WHERE clientId = ${e}`,{blocked:n}}))}}))};const lbe=[`/`,`/resources`,`/keys`,`/login`,`/setup`,`/consent`],ube=({readOnly:e,mcp:t})=>({readOnlyHint:e,destructiveHint:t.destructiveHint??!e,idempotentHint:t.idempotentHint??!1,openWorldHint:t.openWorldHint??!0}),f3=`~effect/ai/AiError/Reason`;var dbe=class extends (/*#__PURE__*/ dC(`effect/ai/AiError/ToolParameterValidationError`)({_tag:/*#__PURE__*/ mS(`ToolParameterValidationError`),toolName:U,description:U})){[f3]=f3;get isRetryable(){return!0}get message(){return`Invalid parameters for tool '${this.toolName}': ${this.description}`}};const p3=`~effect/rpc/RpcMiddleware`,fbe=()=>(e,t)=>{let n=sr(),r;n!==0&&(cr(2),r=new globalThis.Error,cr(n));function i(){}let a=i;return Object.setPrototypeOf(i,Object.getPrototypeOf(P(e))),i.key=e,Object.defineProperty(i,"stack",{get(){return r?.stack}}),a[p3]=p3,a.error=t?.error??qx,a.requiredForClient=t?.requiredForClient??!1,i},m3=(e,t)=>{let n=I(t);return Hx(e).pipe(woe({decode:hv(n),encode:uv()}),pS(n))},Z=e=>Hx(e).pipe(lS(Wx(Ux(e)),{decode:uv(),encode:pv(Wi(Bi))})),pbe=/*#__PURE__*/ K([U,CS]),h3=/*#__PURE__*/ K([U,CS]);var g3=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({_meta:/*#__PURE__*/ Z(/*#__PURE__*/ nS(/*#__PURE__*/ W({progressToken:/*#__PURE__*/ Z(h3)}),[q]))}))){},_3=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({_meta:/*#__PURE__*/ Z(q)}))){},v3=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({_meta:/*#__PURE__*/ Z(q)}))){};const mbe=U;({...g3.fields});var y3=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({..._3.fields,nextCursor:/*#__PURE__*/ Z(mbe)}))){};const b3=/*#__PURE__*/ oS([`user`,`assistant`]);var x3=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({audience:/*#__PURE__*/ Z(/*#__PURE__*/ G(b3)),priority:/*#__PURE__*/ Z(/*#__PURE__*/ CS.check(/*#__PURE__*/ OS({minimum:0,maximum:1}))),lastModified:/*#__PURE__*/ Z(U)}))){},S3=class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/Icon`)({src:U,mimeType:/*#__PURE__*/ Z(U),sizes:/*#__PURE__*/ Z(/*#__PURE__*/ G(U)),theme:/*#__PURE__*/ Z(/*#__PURE__*/ oS([`light`,`dark`]))})){},C3=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({name:U,title:/*#__PURE__*/ Z(U),version:U,icons:/*#__PURE__*/ Z(/*#__PURE__*/ G(S3)),description:/*#__PURE__*/ Z(U),websiteUrl:/*#__PURE__*/ Z(U)}))){},w3=class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/ClientCapabilities`)({experimental:/*#__PURE__*/ Z(/*#__PURE__*/ tS(U,/*#__PURE__*/ W({}))),extensions:/*#__PURE__*/ Z(/*#__PURE__*/ tS(/*#__PURE__*/ Kx([U,`/`,U]),_C)),roots:/*#__PURE__*/ Z(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ Z(Zx)})),sampling:/*#__PURE__*/ Z(/*#__PURE__*/ W({context:/*#__PURE__*/ Z(/*#__PURE__*/ W({})),tools:/*#__PURE__*/ Z(/*#__PURE__*/ W({}))})),elicitation:/*#__PURE__*/ Z(/*#__PURE__*/ W({form:/*#__PURE__*/ Z(/*#__PURE__*/ W({})),url:/*#__PURE__*/ Z(/*#__PURE__*/ W({}))}))})){},hbe=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({experimental:/*#__PURE__*/ Z(/*#__PURE__*/ tS(U,/*#__PURE__*/ W({}))),extensions:/*#__PURE__*/ Z(/*#__PURE__*/ tS(/*#__PURE__*/ Kx([U,`/`,U]),_C)),logging:/*#__PURE__*/ Z(/*#__PURE__*/ W({})),completions:/*#__PURE__*/ Z(/*#__PURE__*/ W({})),prompts:/*#__PURE__*/ Z(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ Z(Zx)})),resources:/*#__PURE__*/ Z(/*#__PURE__*/ W({subscribe:/*#__PURE__*/ Z(Zx),listChanged:/*#__PURE__*/ Z(Zx)})),tools:/*#__PURE__*/ Z(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ Z(Zx)}))}))){},T3=class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/McpErrorBase`)({code:AS,message:U,data:/*#__PURE__*/ Z(Jx)})){};const E3=-32601,D3=-32602,O3=-32603,k3=-32020;var A3=class extends (/*#__PURE__*/ dC(`effect/ai/McpSchema/ParseError`)({...T3.fields,_tag:/*#__PURE__*/ mS(`ParseError`),code:/*#__PURE__*/ mS(-32700)})){},j3=class extends (/*#__PURE__*/ dC(`effect/ai/McpSchema/InvalidRequest`)({...T3.fields,_tag:/*#__PURE__*/ mS(`InvalidRequest`),code:/*#__PURE__*/ mS(-32600)})){},M3=class extends (/*#__PURE__*/ dC(`effect/ai/McpSchema/MethodNotFound`)({...T3.fields,_tag:/*#__PURE__*/ mS(`MethodNotFound`),code:/*#__PURE__*/ mS(E3)})){},N3=class extends (/*#__PURE__*/ dC(`effect/ai/McpSchema/InvalidParams`)({...T3.fields,_tag:/*#__PURE__*/ mS(`InvalidParams`),code:/*#__PURE__*/ mS(D3)})){},P3=class e extends (/*#__PURE__*/ dC(`effect/ai/McpSchema/InternalError`)({...T3.fields,_tag:/*#__PURE__*/ mS(`InternalError`),code:/*#__PURE__*/ mS(O3)})){static notImplemented=/*#__PURE__*/ new e({message:`Not implemented`})};const F3=/*#__PURE__*/ K([A3,j3,M3,N3,P3,T3]);var gbe=class extends (/*#__PURE__*/ J(`ping`,{success:/*#__PURE__*/ W({}),error:F3,payload:/*#__PURE__*/ cS(g3)})){},_be=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({..._3.fields,protocolVersion:U,capabilities:hbe,serverInfo:C3,instructions:/*#__PURE__*/ Z(U)}))){},vbe=class extends (/*#__PURE__*/ J(`initialize`,{success:_be,error:F3,payload:{...g3.fields,protocolVersion:U,capabilities:w3,clientInfo:C3}})){},I3=class extends (/*#__PURE__*/ J(`notifications/cancelled`,{payload:{...v3.fields,requestId:pbe,reason:/*#__PURE__*/ Z(U)}})){},L3=class extends (/*#__PURE__*/ J(`notifications/progress`,{payload:{...v3.fields,progressToken:h3,progress:CS,total:/*#__PURE__*/ Z(CS),message:/*#__PURE__*/ Z(U)}})){},ybe=class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/Resource`)({uri:U,name:U,title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),mimeType:/*#__PURE__*/ Z(U),annotations:/*#__PURE__*/ Z(x3),icons:/*#__PURE__*/ Z(/*#__PURE__*/ G(S3)),size:/*#__PURE__*/ Z(AS),_meta:/*#__PURE__*/ Z(q)})){},R3=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({uri:U,mimeType:/*#__PURE__*/ Z(U),_meta:/*#__PURE__*/ Z(q)}))){},bbe=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({...R3.fields,text:U}))){},xbe=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({...R3.fields,blob:qS}))){};({...y3.fields}),{...y3.fields},{..._3.fields},{...g3.fields};var z3=class extends (/*#__PURE__*/ J(`notifications/resources/list_changed`,{payload:/*#__PURE__*/ cS(v3)})){};({...g3.fields}),{...g3.fields};var B3=class extends (/*#__PURE__*/ J(`notifications/resources/updated`,{payload:{...v3.fields,uri:U}})){},Sbe=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({name:U,title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),required:/*#__PURE__*/ Z(Zx)}))){},Cbe=class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/Prompt`)({name:U,title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),arguments:/*#__PURE__*/ Z(/*#__PURE__*/ G(Sbe)),icons:/*#__PURE__*/ Z(/*#__PURE__*/ G(S3)),_meta:/*#__PURE__*/ Z(q)})){},V3=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({type:/*#__PURE__*/ mS(`text`),text:U,annotations:/*#__PURE__*/ Z(x3),_meta:/*#__PURE__*/ Z(q)}))){},H3=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({type:/*#__PURE__*/ mS(`image`),data:qS,mimeType:U,annotations:/*#__PURE__*/ Z(x3),_meta:/*#__PURE__*/ Z(q)}))){},U3=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({type:/*#__PURE__*/ mS(`audio`),data:qS,mimeType:U,annotations:/*#__PURE__*/ Z(x3),_meta:/*#__PURE__*/ Z(q)}))){};const W3=/*#__PURE__*/ K([V3,H3,U3,class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({type:/*#__PURE__*/ mS(`resource`),resource:/*#__PURE__*/ K([bbe,xbe]),annotations:/*#__PURE__*/ Z(x3),_meta:/*#__PURE__*/ Z(q)}))){},class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({...ybe.fields,type:/*#__PURE__*/ mS(`resource_link`)}))){}]);({...y3.fields}),{..._3.fields},{...g3.fields};var G3=class extends (/*#__PURE__*/ J(`notifications/prompts/list_changed`,{payload:/*#__PURE__*/ cS(v3)})){},wbe=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({title:/*#__PURE__*/ Z(U),readOnlyHint:/*#__PURE__*/ m3(Zx,Nt),destructiveHint:/*#__PURE__*/ m3(Zx,Mt),idempotentHint:/*#__PURE__*/ m3(Zx,Nt),openWorldHint:/*#__PURE__*/ m3(Zx,Mt)}))){};const K3=/*#__PURE__*/ nS(/*#__PURE__*/ W({type:/*#__PURE__*/ Gx(`object`),properties:/*#__PURE__*/ Z(/*#__PURE__*/ tS(U,q)),required:/*#__PURE__*/ Z(/*#__PURE__*/ G(U))}),[q]),q3=q;var J3=class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/Tool`)({name:U,title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),inputSchema:K3,outputSchema:/*#__PURE__*/ Z(q3),annotations:/*#__PURE__*/ Z(wbe),icons:/*#__PURE__*/ Z(/*#__PURE__*/ G(S3)),_meta:/*#__PURE__*/ Z(q)})){};({...y3.fields});var Y3=class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/CallToolResult`)({..._3.fields,content:/*#__PURE__*/ G(W3),structuredContent:/*#__PURE__*/ Z(_C),isError:/*#__PURE__*/ Z(Zx)})){};({...g3.fields});var X3=class extends (/*#__PURE__*/ J(`notifications/tools/list_changed`,{payload:/*#__PURE__*/ cS(v3)})){};const Z3=/*#__PURE__*/ oS([`debug`,`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`]);({...g3.fields});var Q3=class extends (/*#__PURE__*/ J(`notifications/message`,{payload:/*#__PURE__*/ W({...v3.fields,level:Z3,logger:/*#__PURE__*/ Z(U),data:Jx})})){};const $3=/*#__PURE__*/ K([V3,H3,U3,class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/ToolUseContent`)({type:/*#__PURE__*/ mS(`tool_use`),id:U,name:U,input:/*#__PURE__*/ tS(U,Yx),_meta:/*#__PURE__*/ Z(q)})){},class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/ToolResultContent`)({type:/*#__PURE__*/ mS(`tool_result`),toolUseId:U,content:/*#__PURE__*/ G(W3),structuredContent:/*#__PURE__*/ Z(_C),isError:/*#__PURE__*/ Z(Zx),_meta:/*#__PURE__*/ Z(q)})){}]);var Tbe=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({role:b3,content:/*#__PURE__*/ K([$3,/*#__PURE__*/ G($3)]),_meta:/*#__PURE__*/ Z(q)}))){},Ebe=class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/ToolChoice`)({mode:/*#__PURE__*/ Z(/*#__PURE__*/ oS([`auto`,`required`,`none`]))})){},Dbe=class extends (/*#__PURE__*/ gS()(/*#__PURE__*/ W({name:/*#__PURE__*/ Z(U)}))){},Obe=class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/ModelPreferences`)({hints:/*#__PURE__*/ Z(/*#__PURE__*/ G(Dbe)),costPriority:/*#__PURE__*/ Z(/*#__PURE__*/ CS.check(/*#__PURE__*/ OS({minimum:0,maximum:1}))),speedPriority:/*#__PURE__*/ Z(/*#__PURE__*/ CS.check(/*#__PURE__*/ OS({minimum:0,maximum:1}))),intelligencePriority:/*#__PURE__*/ Z(/*#__PURE__*/ CS.check(/*#__PURE__*/ OS({minimum:0,maximum:1})))})){},kbe=class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/CreateMessageResult`)({role:b3,content:/*#__PURE__*/ K([$3,/*#__PURE__*/ G($3)]),_meta:/*#__PURE__*/ Z(q),model:U,stopReason:/*#__PURE__*/ Z(U)})){},e6=class extends (/*#__PURE__*/ J(`sampling/createMessage`,{success:kbe,error:F3,payload:{messages:/*#__PURE__*/ G(Tbe),modelPreferences:/*#__PURE__*/ Z(/*#__PURE__*/ W(Obe.fields)),systemPrompt:/*#__PURE__*/ Z(U),includeContext:/*#__PURE__*/ Z(/*#__PURE__*/ oS([`none`,`thisServer`,`allServers`])),temperature:/*#__PURE__*/ Z(CS),maxTokens:AS,stopSequences:/*#__PURE__*/ Z(/*#__PURE__*/ G(U)),metadata:/*#__PURE__*/ Z(/*#__PURE__*/ tS(U,Yx)),tools:/*#__PURE__*/ Z(/*#__PURE__*/ G(/*#__PURE__*/ W(J3.fields))),toolChoice:/*#__PURE__*/ Z(/*#__PURE__*/ W(Ebe.fields))}})){};({..._3.fields});var Abe=class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/Root`)({uri:U,name:/*#__PURE__*/ Z(U),_meta:/*#__PURE__*/ Z(q)})){},t6=class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/ListRootsResult`)({roots:/*#__PURE__*/ G(Abe)})){},n6=class extends (/*#__PURE__*/ J(`roots/list`,{success:t6,error:F3,payload:/*#__PURE__*/ cS(g3)})){};const jbe=/*#__PURE__*/ W({$schema:/*#__PURE__*/ Z(U),type:/*#__PURE__*/ mS(`object`),properties:/*#__PURE__*/ tS(U,/* @__PURE__ */ K([/* @__PURE__ */ K([class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/LegacyTitledEnum`)({type:/*#__PURE__*/ mS(`string`),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),enum:/*#__PURE__*/ G(U),enumNames:/*#__PURE__*/ Z(/*#__PURE__*/ G(U)),default:/*#__PURE__*/ Z(U)})){},/* @__PURE__ */ K([class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/UntitledSingleSelectEnum`)({type:/*#__PURE__*/ mS(`string`),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),enum:/*#__PURE__*/ G(U),default:/*#__PURE__*/ Z(U)})){},class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/TitledSingleSelectEnum`)({type:/*#__PURE__*/ mS(`string`),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),oneOf:/*#__PURE__*/ G(/*#__PURE__*/ W({const:U,title:U})),default:/*#__PURE__*/ Z(U)})){}]),/* @__PURE__ */ K([class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/UntitledMultiSelectEnum`)({type:/*#__PURE__*/ mS(`array`),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),minItems:/*#__PURE__*/ Z(AS),maxItems:/*#__PURE__*/ Z(AS),items:/*#__PURE__*/ W({type:/*#__PURE__*/ mS(`string`),enum:/*#__PURE__*/ G(U)}),default:/*#__PURE__*/ Z(/*#__PURE__*/ G(U))})){},class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/TitledMultiSelectEnum`)({type:/*#__PURE__*/ mS(`array`),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),minItems:/*#__PURE__*/ Z(AS),maxItems:/*#__PURE__*/ Z(AS),items:/*#__PURE__*/ W({anyOf:/*#__PURE__*/ G(/*#__PURE__*/ W({const:U,title:U}))}),default:/*#__PURE__*/ Z(/*#__PURE__*/ G(U))})){}])]),class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/ElicitationString`)({type:/*#__PURE__*/ mS(`string`),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),minLength:/*#__PURE__*/ Z(AS),maxLength:/*#__PURE__*/ Z(AS),format:/*#__PURE__*/ Z(/*#__PURE__*/ oS([`email`,`uri`,`date`,`date-time`])),default:/*#__PURE__*/ Z(U)})){},class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/ElicitationNumber`)({type:/*#__PURE__*/ oS([`number`,`integer`]),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),minimum:/*#__PURE__*/ Z(CS),maximum:/*#__PURE__*/ Z(CS),default:/*#__PURE__*/ Z(CS)})){},class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/ElicitationBoolean`)({type:/*#__PURE__*/ mS(`boolean`),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),default:/*#__PURE__*/ Z(Zx)})){}])),required:/*#__PURE__*/ Z(/*#__PURE__*/ G(U))}),Mbe=/*#__PURE__*/ K([class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/ElicitRequestFormParams`)({...g3.fields,mode:/*#__PURE__*/ Z(/*#__PURE__*/ Gx(`form`)),message:U,requestedSchema:jbe})){},class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/ElicitRequestURLParams`)({...g3.fields,mode:/*#__PURE__*/ Gx(`url`),message:U,elicitationId:U,url:U})){}]),Nbe=/*#__PURE__*/ K([class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/ElicitAcceptResult`)({..._3.fields,action:/*#__PURE__*/ Gx(`accept`),content:/*#__PURE__*/ Z(/*#__PURE__*/ tS(U,/*#__PURE__*/ K([U,CS,Zx,/*#__PURE__*/ G(U)])))})){},class extends (/*#__PURE__*/ uC(`@effect/ai/McpSchema/ElicitDeclineResult`)({..._3.fields,action:/*#__PURE__*/ oS([`cancel`,`decline`])})){}]);var r6=class extends (/*#__PURE__*/ J(`elicitation/create`,{success:Nbe,error:F3,payload:Mbe})){},Pbe=class extends (/*#__PURE__*/ J(`notifications/elicitation/complete`,{payload:{elicitationId:U}})){};r6.payloadSchema;var i6=class extends (/*#__PURE__*/ jo(`McpReverseOperationUnsupported`)){},Fbe=class extends (/*#__PURE__*/ jo(`McpReverseOperationError`)){},a6=class extends (/*#__PURE__*/ P()(`effect/ai/McpSchema/McpRequestContext`)){},o6=class extends (/*#__PURE__*/ P()(`effect/ai/McpSchema/McpServerClient`)){},s6=class extends (/*#__PURE__*/ fbe()(`effect/ai/McpSchema/McpServerClientMiddleware`)){},Ibe=class extends (/*#__PURE__*/ _N(I3,L3,Q3,B3,z3,X3,G3,Pbe)){},c6=class extends (/*#__PURE__*/ P()(`effect/ai/McpSchema/EnabledWhen`)){};const l6={Complete:e=>({_tag:`Complete`,value:e}),InputRequired:e=>({_tag:`InputRequired`,...e})};var Lbe=class extends (/*#__PURE__*/ jo(`ResourceNotFound`)){},Rbe=class extends (/*#__PURE__*/ jo(`ToolNotFound`)){},zbe=class extends (/*#__PURE__*/ jo(`InvalidToolInput`)){},Bbe=class extends (/*#__PURE__*/ jo(`InvalidToolContinuation`)){},Vbe=class extends (/*#__PURE__*/ jo(`ToolExecutionError`)){},u6=class extends (/*#__PURE__*/ jo(`UnsupportedByProtocol`)){},Hbe=class extends (/*#__PURE__*/ jo(`PromptNotFound`)){};const d6=/*#__PURE__*/ Oo(),f6=/*#__PURE__*/ Oo(),Ube=/*#__PURE__*/ I(()=>{let e=/* @__PURE__ */ new Map,t=[],n=[],r=/* @__PURE__ */ new Map,i=/* @__PURE__ */ new Map;return{tools:{register:t=>I(()=>{e.set(t.descriptor.name,t)}),list:t=>I(()=>{let n=[];for(let r of e.values())r.isVisible(t)&&n.push(r.descriptor);return n}),call:(t,n)=>ap(()=>{let r=e.get(t.name);return r===void 0||!r.isVisible(n.protocol)?new Rbe({name:t.name}):r.handle(t,n)})},resources:{register:e=>I(()=>{let n=t.findIndex(t=>t.descriptor.uri===e.descriptor.uri);n===-1?t.push(e):t[n]=e}),registerTemplate:e=>I(()=>{let t=n.findIndex(t=>t.descriptor.uriTemplate===e.descriptor.uriTemplate);t===-1?n.push(e):n[t]=e}),list:e=>I(()=>t.filter(t=>t.isVisible(e)).map(e=>e.descriptor)),listTemplates:e=>I(()=>n.filter(t=>t.isVisible(e)).map(e=>e.descriptor)),read:H(function*(e,r){let i=t.find(t=>t.descriptor.uri===e);if(i!==void 0&&i.isVisible(r.protocol))return yield*i.read(r);for(let t of n){let n=t.match(e);if(n!==void 0&&t.isVisible(r.protocol))return yield*t.read(e,n,r)}return yield*new Lbe({uri:e})})},prompts:{register:e=>I(()=>{r.set(e.descriptor.name,e)}),list:e=>I(()=>Array.from(r.values()).filter(t=>t.isVisible(e)).map(e=>e.descriptor)),get:H(function*(e,t,n){let i=r.get(e);return i===void 0||!i.isVisible(n.protocol)?yield*new Hbe({name:e}):yield*i.get(t,n)})},completions:{register:(e,t)=>I(()=>{i.set(e,t)}),complete:H(function*(e,t){let n=e.reference.type===`prompt`?`prompt/${e.reference.name}/${e.argument.name}`:`resource/${e.reference.uriTemplate}/${e.argument.name}`,r=i.get(n);if(r===void 0)return yield*new N3({message:`Unknown completion reference or argument`});let a=yield*r(e,t),o=ste(a.values,100);return{...a,values:o,hasMore:a.hasMore===!0||o.length<a.values.length}})},registrationPresence:I(()=>({tools:e.size>0,resources:t.length>0||n.length>0,prompts:r.size>0}))}}),Wbe=/*#__PURE__*/ new TextDecoder(`utf-8`,{fatal:!0,ignoreBOM:!0}),p6={debug:{effect:`Debug`,order:0},info:{effect:`Info`,order:1},notice:{effect:`Info`,order:2},warning:{effect:`Warn`,order:3},error:{effect:`Error`,order:4},critical:{effect:`Fatal`,order:5},alert:{effect:`Fatal`,order:6},emergency:{effect:`Fatal`,order:7}},m6=e=>{let t=e.startsWith(`=?base64?`),n=e.endsWith(`?=`);if(!t||!n)return/^[\t\x20-\x7e]*$/.test(e)?e:void 0;let r=Oh(e.slice(9,-2));if(!Na(r))try{return Wbe.decode(r.success)}catch{return}},h6=e=>({protocolVersion:e.protocolVersion,clientCapabilities:e.clientCapabilities,clientInfo:e.clientInfo,requestMetadata:e.initializePayload._meta}),g6=e=>({clientId:e.clientId,protocol:h6(e),requestContext:a6.of({clientId:e.clientId,protocolVersion:e.protocolVersion,clientCapabilities:e.clientCapabilities,clientInfo:e.clientInfo,requestMetadata:e.requestMetadata}),serverClient:e}),_6=e=>({clientId:e.clientId,protocol:{protocolVersion:e.protocolVersion,clientCapabilities:e.clientCapabilities,clientInfo:e.clientInfo,requestMetadata:e.requestMetadata},requestContext:e}),v6=(e,t)=>t._tag===`Complete`?F(t.value):z(new u6({protocolVersion:e,feature:`Client input`})),y6=e=>{let{content:t,structuredContent:n}=e;if(typeof n!=`string`||t.length!==1)return t;let[r]=t;return r.type===`text`&&r.text===JSON.stringify(n)?[{...r,text:n}]:t},b6=e=>rn(e)&&(e.type===`tool_use`||e.type===`tool_result`),x6=e=>rn(e)?e.tools!==void 0||e.toolChoice!==void 0?!0:Array.isArray(e.messages)?e.messages.some(e=>{if(!rn(e))return!1;let t=e.content;return Array.isArray(t)?t.some(b6):b6(t)}):!1:!1;var S6=class e extends (/*#__PURE__*/ jo(`ProtocolError`)){static fromTool(t){let n=HE(t).pipe(WE(`ToolNotFound`,e=>`Tool '${e.name}' not found`),WE(`UnsupportedByProtocol`,e=>`${e.feature} is not supported by MCP ${e.protocolVersion}`),GE({InvalidToolInput:e=>e.message,InvalidToolContinuation:e=>e.message,ToolExecutionError:e=>e.message}),JE);return new e({code:t._tag===`ToolExecutionError`?O3:D3,message:n})}static fromFeature(t){if(N(t,`_tag`)){if(t._tag===`PromptNotFound`&&N(t,`name`)&&Ut(t.name))return new e({code:D3,message:`Prompt '${t.name}' not found`});if(t._tag===`ResourceNotFound`&&N(t,`uri`)&&Ut(t.uri))return new e({code:-32002,message:`Resource '${t.uri}' not found`})}let n=Gbe(t);return Pa(n)?new e(n.success):new e({code:O3,message:`MCP feature handler failed`})}};const Gbe=/*#__PURE__*/ goe(/* @__PURE__ */ W({code:CS,message:U,data:/*#__PURE__*/ Hx(Yx)})),Kbe=e=>on(e,`McpReverseOperationUnsupported`),C6=e=>t=>Kbe(t)?t:new Fbe({operation:e,cause:t}),w6=(e,t,n)=>Lx(e)(n).pipe(B(Nx(t))),qbe=(e,t,n)=>Lx(e)(n).pipe(B(Nx(t,{onExcessProperty:`error`}))),T6=/*#__PURE__*/ ym(function*(e,t){return f6.$match(t,{Cancelled:e=>({tag:I3._tag,payload:I3.payloadSchema.make({_meta:e.metadata,requestId:e.requestId,reason:e.reason})}),Progress:t=>({tag:L3._tag,payload:L3.payloadSchema.make({_meta:t.metadata,progressToken:t.progressToken,progress:t.progress,total:t.total,message:e.supportsProgressMessage?t.message:void 0})}),LoggingMessage:e=>({tag:Q3._tag,payload:Q3.payloadSchema.make({_meta:e.metadata,level:e.level,logger:e.logger,data:e.data})}),ResourceUpdated:e=>({tag:B3._tag,payload:B3.payloadSchema.make({_meta:e.metadata,uri:e.uri})}),ResourcesChanged:e=>({tag:z3._tag,payload:z3.payloadSchema.make({_meta:e.metadata})}),ToolsChanged:e=>({tag:X3._tag,payload:X3.payloadSchema.make({_meta:e.metadata})}),PromptsChanged:e=>({tag:G3._tag,payload:G3.payloadSchema.make({_meta:e.metadata})}),ElicitationComplete:()=>void 0})}),E6=e=>{switch(e._tag){case`ToolsChanged`:case`PromptsChanged`:case`ResourcesChanged`:case`ResourceUpdated`:return!0;default:return!1}},D6=e=>{let t=/* @__PURE__ */ new WeakMap,n=e=>{let n=t.get(e);if(n===void 0){let r=mC(e.payloadSchema);n={decode:Nx(r),encode:Ix(r)},t.set(e,n)}return n},r=(t,n,r)=>e.handlerRpcs===void 0||e.makeHandlers===void 0?L:n===void 0&&e.runtime._tag===`Stateful`?up(`MCP sessionful handler installation requires a lifecycle runtime`):r.install(e,e.handlerRpcs,e.makeHandlers(t,e.runtime._tag===`Stateful`?n:void 0,r.context)),i=t=>Ale(e.serverRequestRpcs,{spanPrefix:`McpServer/Client`}).pipe(V(n=>e.toReverseClient(t,n)));return{...e,payloadCodecs:n,installHandlers:r,makeReverseClient:i}},O6=e=>`@effect/mcp/${encodeURIComponent(e.protocolVersion)}/`,Jbe=/*#__PURE__*/ H(function*(e){if(e.length===0)return yield*new hd(`MCP protocol declaration must contain at least one MCP protocol`);let t=Object.freeze(Array.from(e)),n=/* @__PURE__ */ new Map;for(let e of t){if(n.has(e.protocolVersion))return yield*new hd(`Duplicate MCP protocol version: ${e.protocolVersion}`);n.set(e.protocolVersion,e)}let r=t[0].clientRpcs.prefix(O6(t[0]));for(let e=1;e<t.length;e++)r=r.merge(t[e].clientRpcs.prefix(O6(t[e])));return{protocols:t,clientRpcs:r,select:e=>n.get(e)??t[0],protocolForInternalTag:e=>t.find(t=>e.startsWith(O6(t)))??t[0],routeClientRequest:(e,t)=>({...t,tag:`${O6(e)}${t.tag}`}),handlerTarget:(e,t)=>({context:t,install:H(function*(t,n,i){let a=yield*n.toHandlers(i);for(let i of n.requests.values()){let n=r.requests.get(`${O6(t)}${i._tag}`),o=a.mapUnsafe.get(i.key);if(n===void 0||o===void 0)return yield*up(`MCP handler registration invariant failed for ${t.protocolVersion}/${i._tag}`);e.set(n.key,o)}})})}}),k6=e=>({initializePayload:e.initializePayload,negotiatedProfile:e.negotiatedProfile,protocol:e.protocol,resourceSubscriptions:e.supportsResourceSubscriptions?/* @__PURE__ */ new Set:void 0,logLevel:{_tag:`Effect`,level:e.logLevel}}),Ybe=()=>{let e=/* @__PURE__ */ new Map,t=/* @__PURE__ */ new Map,n=/* @__PURE__ */ new Set,r=(n,r)=>{let i=r[`mcp-session-id`];return i===void 0?t.get(n):e.get(i)};return{registerHttp:(t,n)=>{let r=k6(n);return e.set(t,r),r},registerConnection:(e,n)=>{let r=k6(n);return t.set(e,r),r},resolve:r,resolveSessionId:t=>e.get(t),terminateSession:t=>e.delete(t),setLogLevel:(e,t,n)=>I(()=>{let i=r(t,n);i!==void 0&&(i.logLevel={_tag:`Mcp`,level:e})}),subscribe:(e,t,n)=>{let i=r(t,n)?.resourceSubscriptions;return i===void 0?z(new S6({code:E3,message:`Resource subscriptions are not supported`})):I(()=>i.add(e)).pipe(yp)},unsubscribe:(e,t,n)=>{let i=r(t,n)?.resourceSubscriptions;return i===void 0?z(new S6({code:E3,message:`Resource subscriptions are not supported`})):I(()=>i.delete(e)).pipe(yp)},effectLogLevel:(e,t,n)=>{let i=r(e,t);return i?.logLevel._tag===`Mcp`?p6[i.logLevel.level].effect:i?.logLevel.level??n},canDeliver:(e,t,n,i)=>{let a=r(e,t);if(n._tag===`LoggingMessage`){let e=a?.logLevel;return e?._tag===`Mcp`?p6[n.level].order>=p6[e.level].order:rce(p6[n.level].effect,e?.level??i)}return n._tag!==`ResourceUpdated`||a?.resourceSubscriptions?.has(n.uri)===!0},markInitialized:e=>{n.add(e)},initializedClientIds:()=>n.values(),disconnect:e=>{t.delete(e),n.delete(e)}}},A6=`mcp-session-id`,j6=`mcp-protocol-version`,M6=`io.modelcontextprotocol/protocolVersion`,N6=`io.modelcontextprotocol/clientCapabilities`,P6=-32022,F6=e=>typeof e==`object`&&e?e:void 0,I6=e=>{let t=F6(e);return t!==void 0&&M6 in t?{present:!0,value:t[M6]}:{present:!1,value:void 0}},Xbe=e=>I6(F6(F6(e)?.params)?._meta).present,Zbe=e=>{switch(e){case`tools/call`:case`prompts/get`:return`name`;case`resources/read`:return`uri`;default:return}},L6=e=>({_tag:`Rejected`,status:400,error:{code:k3,message:e}}),R6=/*#__PURE__*/ _N(gbe),z6=e=>({_tag:`Stateful`,transport:e});var B6=class extends (/*#__PURE__*/ P()(`effect/ai/McpRuntime/ServerRuntime`)){};const V6=(e,t)=>e.find(e=>e.runtime._tag===`Stateful`&&e.protocolVersion===t)??e.find(e=>e.runtime._tag===`Stateful`),Qbe=/*#__PURE__*/ H(function*(e){let t=e.find(e=>e.runtime._tag===`Stateful`)===void 0?void 0:Ybe(),n=e.map(e=>e.protocolVersion),r,i;for(let t of e)if(t.runtime._tag===`Stateless`){if(r!==void 0)return yield*new hd(`MCP runtime supports at most one stateless protocol`);r=t.runtime,i=t}let a=yield*Jbe(e),o=/* @__PURE__ */ new Set,s=e=>({code:P6,message:`Unsupported protocol version '${e}'`,data:{supported:n,requested:e}}),c=(e,r)=>{let i=e[j6],a=e[A6],o=a===void 0?void 0:t?.resolveSessionId(a);if(a!==void 0&&o===void 0)return{_tag:`Rejected`,status:404};if(!r&&i!==void 0){if(!n.includes(i))return{_tag:`Rejected`,status:400,error:s(i)};if(o?.protocol.runtime.transport.http.requiresVersionHeader===!0&&i!==o.protocol.protocolVersion)return L6(`MCP-Protocol-Version header '${i}' does not match negotiated protocol version '${o.protocol.protocolVersion}'`)}return{_tag:`Accepted`,binding:o,protocol:o?.protocol}},l=(e,n)=>{let r=e[j6],a=F6(n),o=F6(F6(a?.params)?._meta),l=I6(o),u=a?.id,d=a?.jsonrpc===`2.0`&&a.method===`initialize`&&(typeof u==`string`||typeof u==`number`),f=a?.jsonrpc===`2.0`&&a.method===`notifications/cancelled`&&u===void 0;if(l.present||(!d||t===void 0)&&i!==void 0&&(r===i.protocolVersion||t===void 0&&a?.jsonrpc===`2.0`&&typeof a.method==`string`&&(typeof u==`string`||typeof u==`number`))){if(r===void 0)return L6(`MCP-Protocol-Version header is required`);if(!f&&(o===void 0||typeof l.value!=`string`))return{_tag:`Rejected`,status:400,error:{code:D3,message:`Required request metadata is missing`}};if((!f||l.present)&&l.value!==r)return L6(`MCP-Protocol-Version header does not match request metadata`);if(!f&&F6(o?.[N6])===void 0)return{_tag:`Rejected`,status:400,error:{code:D3,message:`${N6} request metadata is required`}};if(i===void 0||r!==i.protocolVersion)return{_tag:`Rejected`,status:400,error:s(r)};let t=a?.method;if(typeof t!=`string`||e[`mcp-method`]!==t)return L6(`Mcp-Method header does not match request method`);let n=Zbe(t);if(n!==void 0){let t=F6(a?.params)?.[n],r=e[`mcp-name`];if(typeof t!=`string`||r===void 0||m6(r)!==t)return L6(`Mcp-Name header does not match request parameters`)}return{_tag:`Accepted`,binding:void 0,protocol:i}}return c(e,d)};return B6.of({protocols:a.protocols,clientRpcs:a.clientRpcs,selectProtocol:a.select,protocolForInternalTag:a.protocolForInternalTag,routeClientRequest:a.routeClientRequest,prepareRequest:H(function*(e,n,o){let c=F6(o.payload)?._meta,l=I6(c),u=typeof l.value==`string`?l.value:void 0,d=l.present?void 0:t?.resolve(e,n),f;if(l.present)f=a.protocols.find(e=>e.protocolVersion===u)??i??a.protocols[0];else if(d!==void 0)f=d.protocol;else if(o.tag===`initialize`){let e=o.payload?.protocolVersion,t=V6(a.protocols,e);if(t===void 0)return yield*new S6({code:P6,message:`initialize is not supported by the configured MCP protocols (requested '${e}')`});f=t}else f=o.tag===`ping`?V6(a.protocols,void 0)??a.protocols[0]:a.protocols[0];if(f.runtime._tag===`Stateful`)return{protocol:f,binding:d};if(o.isNotification&&o.tag===`notifications/cancelled`)return{protocol:f};if(r===void 0)return yield*up(`MCP stateless runtime invariant failed`);if(u!==void 0&&u!==f.protocolVersion)return yield*new S6(s(u));let p=yield*r.profileFromRequestMetadata(c),m={protocolVersion:p.protocolVersion,clientCapabilities:p.clientCapabilities,clientInfo:p.clientInfo,requestMetadata:p.requestMetadata},h=a6.of({clientId:e,protocolVersion:m.protocolVersion,clientCapabilities:m.clientCapabilities,clientInfo:m.clientInfo,requestMetadata:m.requestMetadata});return{protocol:f,profile:m,requestContext:h}}),resolveRequest:(e,n)=>t?.resolve(e,n),admitHttp:(e,r)=>{let i=(e,t,n=null)=>({_tag:`Rejected`,response:t===void 0?fA({status:e}):vA({jsonrpc:`2.0`,id:n,error:t},{status:e})});if(Na(r)){let t=e[j6];if(t!==void 0&&!n.includes(t))return i(400,s(t));let r=l(e,void 0);return r._tag===`Rejected`&&(r.error===void 0||r.error.code===-32020)?i(r.status,r.error):i(200,new A3({message:`Parse error`}))}let a=r.success;if(Array.isArray(a)){if(a.length===0)return i(400,new j3({message:`Invalid Request`}));let t=l(e,a);return t._tag===`Rejected`||a.some(Xbe)||a.some(e=>N(e,`method`)&&e.method===`initialize`)||t.binding?.protocol.runtime.transport.jsonRpc.acceptsBatches!==!0?i(400):{_tag:`Accepted`,acknowledge:!a.some(e=>N(e,`method`)&&N(e,`id`)),isSubscription:!1}}let o=N(a,`id`),c=o&&(typeof a.id==`string`||typeof a.id==`number`)?a.id:null,u=N(a,`jsonrpc`)&&a.jsonrpc===`2.0`,d=!o||typeof a.id==`string`||typeof a.id==`number`,f=u&&d&&N(a,`method`)&&typeof a.method==`string`,p=o&&(typeof a.id==`string`||typeof a.id==`number`||a.id===null),m=N(a,`result`),h=N(a,`error`),g=u&&p&&m!==h,_=l(e,a);if(_._tag===`Rejected`)return i(_.status,_.error,c);if(!f&&!g)return i(200,new j3({message:`Invalid Request`}),c);let v=N(a,`method`)&&a.method===`initialize`,y=e[A6]!==void 0;return v&&y?i(400,new j3({message:`initialize must not include an MCP-Session-Id header`}),c):!v&&!y&&_.protocol?.runtime._tag!==`Stateless`?i(400,t===void 0?void 0:new j3({message:`MCP-Session-Id header is required; send initialize to start a session`}),c):f&&_.protocol?.runtime._tag===`Stateless`&&!(_.protocol.handlerRpcs?.requests.has(a.method)??_.protocol.clientRpcs.requests.has(a.method))?i(404,new M3({message:`Method not found: ${a.method}`}),c):{_tag:`Accepted`,acknowledge:!f||!o,isSubscription:N(a,`method`)&&a.method===`subscriptions/listen`}},effectLogLevel:(e,n,r)=>t?.effectLogLevel(e,n,r)??r,disconnect:e=>t?.disconnect(e),terminateHttpSession:e=>ap(()=>{let n=e[A6];if(n===void 0)return F(fA({status:400}));let r=c(e,!1);if(r._tag===`Rejected`)return F(fA({status:r.status}));let i=r.binding;return t.terminateSession(n),vp(ep(o,e=>e(i),{discard:!0}),fA({status:204}))}),onSessionTerminated:e=>qp(I(()=>{o.add(e)}),()=>I(()=>{o.delete(e)})),deliveryClientIds:()=>t?.initializedClientIds()??[],canDeliver:(e,n,r,i)=>t?.canDeliver(e,n,r,i)??!0,installHandlers:H(function*(e){let r=/* @__PURE__ */ new Map,i={subscribeServerNotifications:e.subscribeServerNotifications,getListChangeRevision:e.getListChangeRevision,...e.sendNotification===void 0?{}:{sendNotification:e.sendNotification},...e.markSubscriptionCancelled===void 0?{}:{markSubscriptionCancelled:e.markSubscriptionCancelled},...e.terminateSubscription===void 0?{}:{terminateSubscription:e.terminateSubscription},supportedVersions:n,serverInfo:e.serverInfo,registrationPresence:e.core.registrationPresence},o=a.handlerTarget(r,i);for(let n of a.protocols){if(n.runtime._tag===`Stateless`){yield*n.installHandlers(e.core,void 0,o);continue}if(t===void 0)return yield*up(`MCP sessionful runtime invariant failed`);yield*o.install(n,R6,R6.of({ping:()=>F({})}));let r={initialize:H(function*(r,i,a){let o=yield*e.core.registrationPresence;return yield*fp(s=>{let c=ha(s.context,pM),l={completions:!0,logging:!0,...o.tools?{tools:{listChanged:!0}}:{},...o.resources?{resources:{listChanged:!0,subscribe:c===void 0}}:{},...o.prompts?{prompts:{listChanged:!0}}:{},...e.serverInfo.extensions?{extensions:e.serverInfo.extensions}:{}},u={initializePayload:vbe.payloadSchema.make({protocolVersion:r,capabilities:i.clientCapabilities,clientInfo:i.clientInfo,_meta:i.requestMetadata}),negotiatedProfile:i,protocol:n,supportsResourceSubscriptions:c===void 0&&l.resources?.subscribe===!0,logLevel:e.defaultLogLevel};if(c!==void 0){let e=crypto.randomUUID();t.registerHttp(e,u),xM(c,(t,r)=>F(wA(r,{[A6]:e,[j6]:n.protocolVersion})))}else t.registerConnection(a,u);return F({capabilities:l,instructions:e.serverInfo.instructions,serverInfo:C3.make({name:e.serverInfo.name,version:e.serverInfo.version,description:e.serverInfo.description,websiteUrl:e.serverInfo.websiteUrl,icons:e.serverInfo.icons})})})}),setLogLevel:t.setLogLevel,subscribe:t.subscribe,unsubscribe:t.unsubscribe,clientNotification:H(function*(e,n){e._tag===`Initialized`&&t.markInitialized(n)})};yield*n.installHandlers(e.core,r,o)}return ra(r)})})}),H6=e=>bf(B6)(Qbe(e)),U6=e=>Hx(e).pipe(lS(Wx(Ux(e)),{decode:uv(),encode:pv(Wi(Bi))})),W6=q,$be=/*#__PURE__*/ K([U,CS]),G6=/*#__PURE__*/ K([U,CS]),K6=/*#__PURE__*/ oS([`user`,`assistant`]),q6=/*#__PURE__*/ oS([`debug`,`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`]),J6=/*#__PURE__*/ W({_meta:/*#__PURE__*/ U6(/*#__PURE__*/ nS(/*#__PURE__*/ W({progressToken:/*#__PURE__*/ U6(G6)}),[q]))}),Y6=/*#__PURE__*/ W({_meta:/*#__PURE__*/ U6(W6)}),X6=/*#__PURE__*/ W({_meta:/*#__PURE__*/ U6(W6)}),Z6=/*#__PURE__*/ W({...J6.fields,cursor:/*#__PURE__*/ U6(U)}),Q6=/*#__PURE__*/ W({...X6.fields,nextCursor:/*#__PURE__*/ U6(U)}),exe=/*#__PURE__*/ W({extensions:/*#__PURE__*/ U6(/*#__PURE__*/ tS(/*#__PURE__*/ Kx([U,`/`,U]),_C)),experimental:/*#__PURE__*/ U6(/*#__PURE__*/ tS(U,W6)),roots:/*#__PURE__*/ U6(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ U6(Zx)})),sampling:/*#__PURE__*/ U6(W6)}),txe=/*#__PURE__*/ W({extensions:/*#__PURE__*/ U6(/*#__PURE__*/ tS(/*#__PURE__*/ Kx([U,`/`,U]),_C)),experimental:/*#__PURE__*/ U6(/*#__PURE__*/ tS(U,W6)),logging:/*#__PURE__*/ U6(W6),prompts:/*#__PURE__*/ U6(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ U6(Zx)})),resources:/*#__PURE__*/ U6(/*#__PURE__*/ W({subscribe:/*#__PURE__*/ U6(Zx),listChanged:/*#__PURE__*/ U6(Zx)})),tools:/*#__PURE__*/ U6(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ U6(Zx)}))}),$6=/*#__PURE__*/ W({code:AS,message:U,data:/*#__PURE__*/ U6(Jx)}),e8=/*#__PURE__*/ W({audience:/*#__PURE__*/ U6(/*#__PURE__*/ G(K6)),priority:/*#__PURE__*/ U6(/*#__PURE__*/ CS.check(/*#__PURE__*/ OS({minimum:0,maximum:1})))}),nxe=/*#__PURE__*/ W({uri:U,mimeType:/*#__PURE__*/ U6(U),text:U}),rxe=/*#__PURE__*/ W({uri:U,mimeType:/*#__PURE__*/ U6(U),blob:U}),ixe=/*#__PURE__*/ W({type:/*#__PURE__*/ Gx(`text`),text:U,annotations:/*#__PURE__*/ U6(e8)}),axe=/*#__PURE__*/ W({type:/*#__PURE__*/ Gx(`image`),data:U,mimeType:U,annotations:/*#__PURE__*/ U6(e8)}),oxe=/*#__PURE__*/ W({uri:U,name:U,description:/*#__PURE__*/ U6(U),mimeType:/*#__PURE__*/ U6(U),size:/*#__PURE__*/ U6(CS),annotations:/*#__PURE__*/ U6(e8)}),sxe=/*#__PURE__*/ W({uriTemplate:U,name:U,description:/*#__PURE__*/ U6(U),mimeType:/*#__PURE__*/ U6(U),annotations:/*#__PURE__*/ U6(e8)}),t8=/*#__PURE__*/ W({name:U,description:/*#__PURE__*/ U6(U),required:/*#__PURE__*/ U6(Zx)}),cxe=/*#__PURE__*/ W({name:U,description:/*#__PURE__*/ U6(U),arguments:/*#__PURE__*/ U6(/*#__PURE__*/ G(t8))}),lxe=/*#__PURE__*/ W({name:U,description:/*#__PURE__*/ U6(U),inputSchema:/* @__PURE__ */ W({type:/*#__PURE__*/ Gx(`object`),properties:/*#__PURE__*/ U6(/*#__PURE__*/ tS(U,W6)),required:/*#__PURE__*/ U6(/*#__PURE__*/ G(U))})}),n8=/*#__PURE__*/ W({hints:/*#__PURE__*/ U6(/*#__PURE__*/ G(/* @__PURE__ */ W({name:/*#__PURE__*/ U6(U)}))),costPriority:/*#__PURE__*/ U6(/*#__PURE__*/ CS.check(/*#__PURE__*/ OS({minimum:0,maximum:1}))),speedPriority:/*#__PURE__*/ U6(/*#__PURE__*/ CS.check(/*#__PURE__*/ OS({minimum:0,maximum:1}))),intelligencePriority:/*#__PURE__*/ U6(/*#__PURE__*/ CS.check(/*#__PURE__*/ OS({minimum:0,maximum:1})))}),uxe=/*#__PURE__*/ W({type:/*#__PURE__*/ Gx(`ref/prompt`),name:U}),r8=/*#__PURE__*/ W({uri:U,name:/*#__PURE__*/ U6(U)});({...X6.fields}),{...Q6.fields},{...Q6.fields},{...X6.fields},{...Q6.fields},{...X6.fields},{...Q6.fields},{...X6.fields},{...X6.fields};const dxe=/*#__PURE__*/ W({...X6.fields,completion:/*#__PURE__*/ W({values:/*#__PURE__*/ G(U),total:/*#__PURE__*/ U6(CS),hasMore:/*#__PURE__*/ U6(Zx)})}),fxe=/*#__PURE__*/ W({...X6.fields,roots:/*#__PURE__*/ G(r8)});var i8=class extends (/*#__PURE__*/ J(`ping`,{success:X6,error:$6,payload:/*#__PURE__*/ cS(J6)})){};({...J6.fields}),{...J6.fields};var a8=class extends (/*#__PURE__*/ J(`logging/setLevel`,{success:X6,error:$6,payload:{...J6.fields,level:q6}})){};({...J6.fields}),{...J6.fields};var o8=class extends (/*#__PURE__*/ J(`resources/subscribe`,{success:X6,error:$6,payload:{...J6.fields,uri:U}})){},s8=class extends (/*#__PURE__*/ J(`resources/unsubscribe`,{success:X6,error:$6,payload:{...J6.fields,uri:U}})){};({...J6.fields}),{...J6.fields};var c8=class extends (/*#__PURE__*/ J(`roots/list`,{success:fxe,error:$6,payload:/*#__PURE__*/ cS(J6)})){},l8=class extends (/*#__PURE__*/ J(`notifications/cancelled`,{payload:{...Y6.fields,requestId:$be,reason:/*#__PURE__*/ U6(U)}})){};({...Y6.fields});var u8=class extends (/*#__PURE__*/ J(`notifications/initialized`,{payload:/*#__PURE__*/ cS(Y6)})){},d8=class extends (/*#__PURE__*/ J(`notifications/roots/list_changed`,{payload:/*#__PURE__*/ cS(Y6)})){},f8=class extends (/*#__PURE__*/ J(`notifications/message`,{payload:{...Y6.fields,level:q6,logger:/*#__PURE__*/ U6(U),data:Jx}})){},p8=class extends (/*#__PURE__*/ J(`notifications/resources/updated`,{payload:{...Y6.fields,uri:U}})){},m8=class extends (/*#__PURE__*/ J(`notifications/resources/list_changed`,{payload:/*#__PURE__*/ cS(Y6)})){},h8=class extends (/*#__PURE__*/ J(`notifications/tools/list_changed`,{payload:/*#__PURE__*/ cS(Y6)})){},g8=class extends (/*#__PURE__*/ J(`notifications/prompts/list_changed`,{payload:/*#__PURE__*/ cS(Y6)})){};const _8=U6,pxe=/*#__PURE__*/ W({...txe.fields,completions:/*#__PURE__*/ _8(/*#__PURE__*/ W({}))}),mxe=/*#__PURE__*/ W({type:/*#__PURE__*/ Gx(`audio`),data:U,mimeType:U,annotations:/*#__PURE__*/ _8(e8)}),v8=/*#__PURE__*/ W({title:/*#__PURE__*/ _8(U),readOnlyHint:/*#__PURE__*/ _8(Zx),destructiveHint:/*#__PURE__*/ _8(Zx),idempotentHint:/*#__PURE__*/ _8(Zx),openWorldHint:/*#__PURE__*/ _8(Zx)});({...lxe.fields}),{...X6.fields},{...X6.fields},{...Q6.fields},{...X6.fields},{...X6.fields},{...J6.fields},{...J6.fields},{...J6.fields},{...J6.fields};var y8=class extends (/*#__PURE__*/ J(`notifications/progress`,{payload:{...Y6.fields,progressToken:G6,progress:CS,total:/*#__PURE__*/ _8(CS),message:/*#__PURE__*/ _8(U)}})){};const b8=`2025-06-18`,x8=U6,S8=q,C8=/*#__PURE__*/ x8(S8),w8=/*#__PURE__*/ W({name:U,title:/*#__PURE__*/ x8(U),version:U}),T8=/*#__PURE__*/ W({...exe.fields,elicitation:/*#__PURE__*/ x8(/*#__PURE__*/ W({}))}),E8=/*#__PURE__*/ W({audience:/*#__PURE__*/ x8(/*#__PURE__*/ G(K6)),priority:/*#__PURE__*/ x8(/*#__PURE__*/ CS.check(/*#__PURE__*/ OS({minimum:0,maximum:1})))}),D8=/*#__PURE__*/ W({...oxe.fields,title:/*#__PURE__*/ x8(U),annotations:/*#__PURE__*/ x8(E8),_meta:C8}),O8=/*#__PURE__*/ W({...sxe.fields,title:/*#__PURE__*/ x8(U),annotations:/*#__PURE__*/ x8(E8),_meta:C8}),k8=/*#__PURE__*/ K([/* @__PURE__ */ W({...nxe.fields,_meta:C8}),/* @__PURE__ */ W({...rxe.fields,_meta:C8})]),hxe=/*#__PURE__*/ W({...t8.fields,title:/*#__PURE__*/ x8(U)}),A8=/*#__PURE__*/ W({...cxe.fields,title:/*#__PURE__*/ x8(U),arguments:/*#__PURE__*/ x8(/*#__PURE__*/ G(hxe)),_meta:C8}),j8=/*#__PURE__*/ W({type:/*#__PURE__*/ Gx(`resource`),resource:k8,annotations:/*#__PURE__*/ x8(E8),_meta:C8}),gxe=/*#__PURE__*/ W({...D8.fields,type:/*#__PURE__*/ Gx(`resource_link`)}),M8=/*#__PURE__*/ W({...ixe.fields,annotations:/*#__PURE__*/ x8(E8),_meta:C8}),N8=/*#__PURE__*/ W({...axe.fields,annotations:/*#__PURE__*/ x8(E8),_meta:C8}),P8=/*#__PURE__*/ W({...mxe.fields,annotations:/*#__PURE__*/ x8(E8),_meta:C8}),F8=/*#__PURE__*/ K([M8,N8,P8,j8,gxe]),I8=/*#__PURE__*/ K([M8,N8,P8]),_xe=/*#__PURE__*/ W({role:K6,content:F8}),vxe=/*#__PURE__*/ W({role:K6,content:I8}),yxe=/*#__PURE__*/ W({...pxe.fields}),L8=/*#__PURE__*/ W({...X6.fields,protocolVersion:U,capabilities:yxe,serverInfo:w8,instructions:/*#__PURE__*/ x8(U)});var R8=class extends (/*#__PURE__*/ J(`initialize`,{success:L8,error:$6,payload:{...J6.fields,protocolVersion:U,capabilities:T8,clientInfo:w8}})){};const z8=/*#__PURE__*/ nS(/*#__PURE__*/ W({type:/*#__PURE__*/ Gx(`object`),properties:/*#__PURE__*/ x8(/*#__PURE__*/ tS(U,S8)),required:/*#__PURE__*/ x8(/*#__PURE__*/ G(U))}),[q]),B8=/*#__PURE__*/ W({name:U,title:/*#__PURE__*/ x8(U),description:/*#__PURE__*/ x8(U),inputSchema:z8,outputSchema:/*#__PURE__*/ x8(z8),annotations:/*#__PURE__*/ x8(v8),_meta:C8}),V8=/*#__PURE__*/ W({...X6.fields,content:/*#__PURE__*/ G(F8),structuredContent:/*#__PURE__*/ x8(S8),isError:/*#__PURE__*/ x8(Zx)}),bxe=/*#__PURE__*/ W({...X6.fields,role:K6,content:I8,model:U,stopReason:/*#__PURE__*/ x8(U)});var H8=class extends (/*#__PURE__*/ J(`sampling/createMessage`,{success:bxe,error:$6,payload:{...J6.fields,messages:/*#__PURE__*/ G(vxe),modelPreferences:/*#__PURE__*/ x8(n8),systemPrompt:/*#__PURE__*/ x8(U),includeContext:/*#__PURE__*/ x8(/*#__PURE__*/ oS([`none`,`thisServer`,`allServers`])),temperature:/*#__PURE__*/ x8(CS),maxTokens:CS,stopSequences:/*#__PURE__*/ x8(/*#__PURE__*/ G(U)),metadata:/*#__PURE__*/ x8(S8)}})){};const U8=/*#__PURE__*/ W({...uxe.fields,title:/*#__PURE__*/ x8(U)}),W8=/*#__PURE__*/ W({type:/*#__PURE__*/ Gx(`ref/resource`),uri:U}),G8=dxe;var K8=class extends (/*#__PURE__*/ J(`completion/complete`,{success:G8,error:$6,payload:{...J6.fields,ref:/*#__PURE__*/ K([U8,W8]),argument:/*#__PURE__*/ W({name:U,value:U}),context:/*#__PURE__*/ x8(/*#__PURE__*/ W({arguments:/*#__PURE__*/ x8(/*#__PURE__*/ tS(U,U))}))}})){};const q8=/*#__PURE__*/ W({...Q6.fields,resources:/*#__PURE__*/ G(D8)}),J8=/*#__PURE__*/ W({...Q6.fields,resourceTemplates:/*#__PURE__*/ G(O8)}),Y8=/*#__PURE__*/ W({...X6.fields,contents:/*#__PURE__*/ G(k8)}),X8=/*#__PURE__*/ W({...Q6.fields,prompts:/*#__PURE__*/ G(A8)}),Z8=/*#__PURE__*/ W({...X6.fields,description:/*#__PURE__*/ x8(U),messages:/*#__PURE__*/ G(_xe)}),Q8=/*#__PURE__*/ W({...Q6.fields,tools:/*#__PURE__*/ G(B8)});var xxe=class extends (/*#__PURE__*/ J(`resources/list`,{success:q8,error:$6,payload:/*#__PURE__*/ cS(Z6)})){},Sxe=class extends (/*#__PURE__*/ J(`resources/templates/list`,{success:J8,error:$6,payload:/*#__PURE__*/ cS(Z6)})){},$8=class extends (/*#__PURE__*/ J(`resources/read`,{success:Y8,error:$6,payload:{...J6.fields,uri:U}})){},Cxe=class extends (/*#__PURE__*/ J(`prompts/list`,{success:X8,error:$6,payload:/*#__PURE__*/ cS(Z6)})){},wxe=class extends (/*#__PURE__*/ J(`prompts/get`,{success:Z8,error:$6,payload:{...J6.fields,name:U,arguments:/*#__PURE__*/ x8(/*#__PURE__*/ tS(U,U))}})){},Txe=class extends (/*#__PURE__*/ J(`tools/list`,{success:Q8,error:$6,payload:/*#__PURE__*/ cS(Z6)})){},e5=class extends (/*#__PURE__*/ J(`tools/call`,{success:V8,error:$6,payload:{...J6.fields,name:U,arguments:/*#__PURE__*/ x8(S8)}})){};const Exe=/*#__PURE__*/ W({...X6.fields,action:/*#__PURE__*/ oS([`accept`,`decline`,`cancel`]),content:/*#__PURE__*/ x8(/*#__PURE__*/ tS(U,/*#__PURE__*/ K([U,CS,Zx])))}),Dxe=/*#__PURE__*/ W({type:/*#__PURE__*/ Gx(`object`),properties:/*#__PURE__*/ tS(U,/*#__PURE__*/ K([/* @__PURE__ */ W({type:/*#__PURE__*/ Gx(`string`),title:/*#__PURE__*/ x8(U),description:/*#__PURE__*/ x8(U),minLength:/*#__PURE__*/ x8(AS),maxLength:/*#__PURE__*/ x8(AS),format:/*#__PURE__*/ x8(/*#__PURE__*/ oS([`email`,`uri`,`date`,`date-time`]))}),/* @__PURE__ */ W({type:/*#__PURE__*/ oS([`number`,`integer`]),title:/*#__PURE__*/ x8(U),description:/*#__PURE__*/ x8(U),minimum:/*#__PURE__*/ x8(CS),maximum:/*#__PURE__*/ x8(CS)}),/* @__PURE__ */ W({type:/*#__PURE__*/ Gx(`boolean`),title:/*#__PURE__*/ x8(U),description:/*#__PURE__*/ x8(U),default:/*#__PURE__*/ x8(Zx)}),/* @__PURE__ */ W({type:/*#__PURE__*/ Gx(`string`),title:/*#__PURE__*/ x8(U),description:/*#__PURE__*/ x8(U),enum:/*#__PURE__*/ G(U),enumNames:/*#__PURE__*/ x8(/*#__PURE__*/ G(U))})])),required:/*#__PURE__*/ x8(/*#__PURE__*/ G(U))});var t5=class extends (/*#__PURE__*/ J(`elicitation/create`,{success:Exe,error:$6,payload:{...J6.fields,message:U,requestedSchema:Dxe}})){},Oxe=class extends (/*#__PURE__*/ _N(i8,R8,K8,a8,wxe,Cxe,xxe,Sxe,$8,o8,s8,e5,Txe)){},n5=class extends (/*#__PURE__*/ _N(l8,y8,u8,d8)){},kxe=class extends (/*#__PURE__*/ _N(i8,H8,c8,t5)){},Axe=class extends (/*#__PURE__*/ _N(l8,y8,f8,p8,m8,h8,g8)){};const r5=/*#__PURE__*/ (/* @__PURE__ */ Oxe.omit(`ping`).middleware(s6).add(i8)).merge(n5),i5=/*#__PURE__*/ r5.omit(`ping`),jxe=e=>{if(e?.type!==`object`)return!1;let t=e.properties===void 0||rn(e.properties)&&Object.values(e.properties).every(rn),n=e.required===void 0||Array.isArray(e.required)&&e.required.every(Ut);return t&&n},Mxe=e=>({protocolVersion:b8,clientCapabilities:w3.make(e.capabilities),clientInfo:C3.make(e.clientInfo),requestMetadata:e._meta}),a5=(e,t)=>new i6({operation:e,protocolVersion:b8,reason:t}),o5=(e,t,n)=>Object.hasOwn(e.clientCapabilities,n)&&e.clientCapabilities[n]!==void 0?L:z(a5(t,`Client did not advertise the ${n} capability`)),s5=/*#__PURE__*/ H(function*(e){return HE(e).pipe(UE({type:KE(`text`,`resource_link`)},e=>e),UE({type:KE(`image`,`audio`)},e=>({type:e.type,mimeType:e.mimeType,data:Dh(e.data),annotations:e.annotations,_meta:e._meta})),UE({type:`resource`},e=>{let t=e.resource;return`text`in t?j8.make({type:`resource`,resource:{uri:t.uri,mimeType:t.mimeType,_meta:t._meta,text:t.text},annotations:e.annotations,_meta:e._meta}):j8.make({type:`resource`,resource:{uri:t.uri,mimeType:t.mimeType,_meta:t._meta,blob:Dh(t.blob)},annotations:e.annotations,_meta:e._meta})}),JE)}),Nxe=e=>`text`in e?{uri:e.uri,mimeType:e.mimeType,_meta:e._meta,text:e.text}:{uri:e.uri,mimeType:e.mimeType,_meta:e._meta,blob:Dh(e.blob)},Pxe=e=>e===void 0||Fxe(e)?e:void 0,Fxe=e=>rn(e),Ixe=/*#__PURE__*/ D6({protocolVersion:b8,runtime:/*#__PURE__*/ z6({jsonRpc:{acceptsBatches:!1},http:{requiresVersionHeader:!0}}),clientRpcs:r5,clientNotificationRpcs:n5,serverRequestRpcs:kxe,serverNotificationRpcs:Axe,handlerRpcs:i5,makeHandlers:(e,t)=>i5.of({initialize:(e,{client:n})=>t.initialize(b8,Mxe(e),n.id).pipe(V(e=>L8.make({protocolVersion:b8,capabilities:{experimental:e.capabilities.experimental,extensions:e.capabilities.extensions,logging:e.capabilities.logging?{}:void 0,completions:e.capabilities.completions?{}:void 0,prompts:e.capabilities.prompts,resources:e.capabilities.resources,tools:e.capabilities.tools},serverInfo:e.serverInfo,instructions:e.instructions}))),"logging/setLevel":({level:e},{client:n,headers:r})=>t.setLogLevel(e,n.id,r).pipe(vp({})),"notifications/cancelled":()=>L,"notifications/initialized":(e,{client:n,headers:r})=>t.clientNotification(d6.Initialized(),n.id,r),"notifications/progress":(e,{client:n,headers:r})=>t.clientNotification(d6.Progress({progressToken:e.progressToken,progress:e.progress,total:e.total,message:e.message,metadata:e._meta}),n.id,r),"notifications/roots/list_changed":(e,{client:n,headers:r})=>t.clientNotification(d6.RootsChanged(),n.id,r),"resources/list":t=>o6.use(t=>e.resources.list(h6(t))).pipe(V(e=>q8.make({resources:e}))),"resources/templates/list":t=>o6.use(t=>e.resources.listTemplates(h6(t))).pipe(V(e=>J8.make({resourceTemplates:e}))),"resources/read":H(function*({uri:t}){let n=yield*o6,r=yield*e.resources.read(t,g6(n)).pipe(Tp(S6.fromFeature));return Y8.make({contents:r.contents.map(Nxe),_meta:r._meta})}),"resources/subscribe":({uri:e},{client:n,headers:r})=>t.subscribe(e,n.id,r).pipe(vp({})),"resources/unsubscribe":({uri:e},{client:n,headers:r})=>t.unsubscribe(e,n.id,r).pipe(vp({})),"prompts/list":t=>o6.use(t=>e.prompts.list(h6(t))).pipe(V(e=>X8.make({prompts:e}))),"prompts/get":H(function*({arguments:t,name:n}){let r=yield*o6,i=yield*e.prompts.get(n,t??{},g6(r)).pipe(Tp(S6.fromFeature));if(i._tag===`InputRequired`)return yield*S6.fromFeature(new u6({protocolVersion:b8,feature:`prompt input requirements`}));let a=i.value,o=yield*ep(a.messages,e=>s5(e.content).pipe(V(t=>({role:e.role,content:t})),Tp(S6.fromTool)));return Z8.make({description:a.description,messages:o,_meta:a._meta})}),"completion/complete":H(function*(t){let n=yield*o6,r=yield*e.completions.complete({reference:t.ref.type===`ref/prompt`?{type:`prompt`,name:t.ref.name,title:t.ref.title}:{type:`resourceTemplate`,uriTemplate:t.ref.uri},argument:t.argument,context:t.context?.arguments===void 0?void 0:{arguments:t.context.arguments},metadata:t._meta},g6(n)).pipe(Tp(S6.fromFeature));return G8.make({completion:{values:Array.from(r.values),total:r.total,hasMore:r.hasMore},_meta:r.metadata})}),"tools/list":H(function*(){let t=yield*o6,n=yield*e.tools.list(h6(t));return Q8.make({tools:n.map(e=>B8.make({name:e.name,title:e.title,description:e.description,inputSchema:e.inputSchema,outputSchema:jxe(e.outputSchema)?e.outputSchema:void 0,annotations:e.annotations===void 0?void 0:v8.make({title:e.annotations.title,readOnlyHint:e.annotations.readOnlyHint,destructiveHint:e.annotations.destructiveHint,idempotentHint:e.annotations.idempotentHint,openWorldHint:e.annotations.openWorldHint}),_meta:e._meta}))})}),"tools/call":H(function*(t){let n=yield*o6,r=yield*e.tools.call({...t,arguments:t.arguments??{}},g6(n)).pipe(B(e=>v6(b8,e)),Tp(S6.fromTool)),i=yield*ep(y6(r),s5).pipe(Tp(S6.fromTool)),a=Pxe(r.structuredContent);return V8.make({content:i,structuredContent:a,isError:r.isError,_meta:r._meta})})}),toReverseClient:(e,t)=>({listRoots:H(function*(n){yield*o5(e,`roots/list`,`roots`);let r=yield*w6(n6.payloadSchema,c8.payloadSchema,n).pipe(Tp(()=>a5(`roots/list`,`Request is not representable by this protocol`))),{roots:i}=yield*t[`roots/list`](r).pipe(Tp(C6(`roots/list`)));return new t6({roots:i})}),createMessage:H(function*(n){yield*o5(e,`sampling/createMessage`,`sampling`);let r=yield*qbe(e6.payloadSchema,H8.payloadSchema,n).pipe(Tp(()=>a5(`sampling/createMessage`,`Request is not representable by this protocol`))),i=yield*t[`sampling/createMessage`](r).pipe(Tp(C6(`sampling/createMessage`)));return yield*w6(H8.successSchema,e6.successSchema,i).pipe(Tp(()=>a5(`sampling/createMessage`,`Response is not representable by the canonical model`)))}),elicit:H(function*(n){yield*o5(e,`elicitation/create`,`elicitation`);let r=n.mode===`form`?soe(n,[`mode`]):n,i=yield*Nx(t5.payloadSchema,{onExcessProperty:`error`})(r).pipe(Tp(()=>a5(`elicitation/create`,`Request is not representable by this protocol`))),a=yield*t[`elicitation/create`](i).pipe(Tp(C6(`elicitation/create`)));return yield*w6(t5.successSchema,r6.successSchema,a).pipe(Tp(()=>a5(`elicitation/create`,`Response is not representable by the canonical model`)))})}),projectNotification:e=>T6({supportsProgressMessage:!0},e),normalizeCancellation:e=>Nx(l8.payloadSchema)(e).pipe(V(e=>({requestId:e.requestId,reason:e.reason,metadata:e._meta})))}),c5=`2025-11-25`,Q=U6,l5=q,u5=/*#__PURE__*/ Q(l5),d5=/*#__PURE__*/ W({src:U,mimeType:/*#__PURE__*/ Q(U),sizes:/*#__PURE__*/ Q(/*#__PURE__*/ G(U)),theme:/*#__PURE__*/ Q(/*#__PURE__*/ oS([`light`,`dark`]))}),f5=/*#__PURE__*/ W({...w8.fields,description:/*#__PURE__*/ Q(U),websiteUrl:/*#__PURE__*/ Q(U),icons:/*#__PURE__*/ Q(/*#__PURE__*/ G(d5))}),Lxe=/*#__PURE__*/ W({...T8.fields,sampling:/*#__PURE__*/ Q(/*#__PURE__*/ W({context:/*#__PURE__*/ Q(l5),tools:/*#__PURE__*/ Q(l5)})),elicitation:/*#__PURE__*/ Q(/*#__PURE__*/ W({form:/*#__PURE__*/ Q(l5),url:/*#__PURE__*/ Q(l5)}))}),p5=/*#__PURE__*/ W({...E8.fields,lastModified:/*#__PURE__*/ Q(U)}),m5=/*#__PURE__*/ W({...D8.fields,annotations:/*#__PURE__*/ Q(p5),icons:/*#__PURE__*/ Q(/*#__PURE__*/ G(d5))}),h5=/*#__PURE__*/ W({...O8.fields,annotations:/*#__PURE__*/ Q(p5),icons:/*#__PURE__*/ Q(/*#__PURE__*/ G(d5))}),g5=/*#__PURE__*/ W({...A8.fields,icons:/*#__PURE__*/ Q(/*#__PURE__*/ G(d5))}),_5=/*#__PURE__*/ W({...M8.fields,annotations:/*#__PURE__*/ Q(p5)}),v5=/*#__PURE__*/ W({...N8.fields,annotations:/*#__PURE__*/ Q(p5)}),y5=/*#__PURE__*/ W({...P8.fields,annotations:/*#__PURE__*/ Q(p5)}),b5=/*#__PURE__*/ W({...j8.fields,annotations:/*#__PURE__*/ Q(p5)}),x5=/*#__PURE__*/ K([_5,v5,y5,/* @__PURE__ */ W({...m5.fields,type:/*#__PURE__*/ Gx(`resource_link`)}),b5]),Rxe=/*#__PURE__*/ W({role:K6,content:x5}),S5=/*#__PURE__*/ W({...B8.fields,icons:/*#__PURE__*/ Q(/*#__PURE__*/ G(d5))}),C5=/*#__PURE__*/ W({...V8.fields,content:/*#__PURE__*/ G(x5)});var zxe=class extends (/*#__PURE__*/ J(`tools/call`,{success:C5,error:$6,payload:e5.payloadSchema})){};const w5=/*#__PURE__*/ W({type:/*#__PURE__*/ Gx(`tool_use`),id:U,name:U,input:l5,_meta:u5}),T5=/*#__PURE__*/ K([_5,v5,y5,w5,/* @__PURE__ */ W({type:/*#__PURE__*/ Gx(`tool_result`),toolUseId:U,content:/*#__PURE__*/ G(x5),structuredContent:/*#__PURE__*/ Q(l5),isError:/*#__PURE__*/ Q(Zx),_meta:u5})]),E5=/*#__PURE__*/ W({role:K6,content:/*#__PURE__*/ K([T5,/*#__PURE__*/ G(T5)]),_meta:u5}),D5=/*#__PURE__*/ W({mode:/*#__PURE__*/ Q(/*#__PURE__*/ oS([`auto`,`required`,`none`]))}),Bxe=/*#__PURE__*/ W({...X6.fields,...E5.fields,model:U,stopReason:/*#__PURE__*/ Q(U)});var O5=class extends (/*#__PURE__*/ J(`sampling/createMessage`,{success:Bxe,error:$6,payload:{...H8.payloadSchema.fields,messages:/*#__PURE__*/ G(E5),maxTokens:AS,tools:/*#__PURE__*/ Q(/*#__PURE__*/ G(S5)),toolChoice:/*#__PURE__*/ Q(D5)}})){};const k5=/*#__PURE__*/ W({...r8.fields,_meta:u5}),Vxe=/*#__PURE__*/ W({...X6.fields,roots:/*#__PURE__*/ G(k5)});var A5=class extends (/*#__PURE__*/ J(`roots/list`,{success:Vxe,error:$6,payload:/*#__PURE__*/ cS(J6)})){};const j5=/*#__PURE__*/ W({type:/*#__PURE__*/ Gx(`string`),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),minLength:/*#__PURE__*/ Q(AS),maxLength:/*#__PURE__*/ Q(AS),format:/*#__PURE__*/ Q(/*#__PURE__*/ oS([`email`,`uri`,`date`,`date-time`])),default:/*#__PURE__*/ Q(U)}),M5=/*#__PURE__*/ W({type:/*#__PURE__*/ oS([`number`,`integer`]),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),minimum:/*#__PURE__*/ Q(CS),maximum:/*#__PURE__*/ Q(CS),default:/*#__PURE__*/ Q(CS)}),N5=/*#__PURE__*/ W({type:/*#__PURE__*/ Gx(`boolean`),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),default:/*#__PURE__*/ Q(Zx)}),P5=/*#__PURE__*/ W({const:U,title:U}),F5=/*#__PURE__*/ K([/* @__PURE__ */ W({type:/*#__PURE__*/ Gx(`string`),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),enum:/*#__PURE__*/ G(U),default:/*#__PURE__*/ Q(U)}),/* @__PURE__ */ W({type:/*#__PURE__*/ Gx(`string`),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),oneOf:/*#__PURE__*/ G(P5),default:/*#__PURE__*/ Q(U)})]),I5=/*#__PURE__*/ K([/* @__PURE__ */ W({type:/*#__PURE__*/ Gx(`array`),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),minItems:/*#__PURE__*/ Q(AS),maxItems:/*#__PURE__*/ Q(AS),items:/*#__PURE__*/ W({type:/*#__PURE__*/ Gx(`string`),enum:/*#__PURE__*/ G(U)}),default:/*#__PURE__*/ Q(/*#__PURE__*/ G(U))}),/* @__PURE__ */ W({type:/*#__PURE__*/ Gx(`array`),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),minItems:/*#__PURE__*/ Q(AS),maxItems:/*#__PURE__*/ Q(AS),items:/*#__PURE__*/ W({anyOf:/*#__PURE__*/ G(P5)}),default:/*#__PURE__*/ Q(/*#__PURE__*/ G(U))})]),L5=/*#__PURE__*/ W({type:/*#__PURE__*/ Gx(`string`),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),enum:/*#__PURE__*/ G(U),enumNames:/*#__PURE__*/ Q(/*#__PURE__*/ G(U)),default:/*#__PURE__*/ Q(U)}),Hxe=/*#__PURE__*/ W({$schema:/*#__PURE__*/ Q(U),type:/*#__PURE__*/ Gx(`object`),properties:/*#__PURE__*/ tS(U,/* @__PURE__ */ K([/* @__PURE__ */ K([L5,F5,I5]),j5,M5,N5])),required:/*#__PURE__*/ Q(/*#__PURE__*/ G(U))}),Uxe=/*#__PURE__*/ K([/* @__PURE__ */ W({...J6.fields,mode:/*#__PURE__*/ Q(/*#__PURE__*/ Gx(`form`)),message:U,requestedSchema:Hxe}),/* @__PURE__ */ W({...J6.fields,mode:/*#__PURE__*/ Gx(`url`),message:U,elicitationId:U,url:U})]),Wxe=/*#__PURE__*/ W({...X6.fields,action:/*#__PURE__*/ oS([`accept`,`decline`,`cancel`]),content:/*#__PURE__*/ Q(/*#__PURE__*/ tS(U,/*#__PURE__*/ K([U,CS,Zx,/*#__PURE__*/ G(U)])))});var R5=class extends (/*#__PURE__*/ J(`elicitation/create`,{success:Wxe,error:$6,payload:Uxe})){},Gxe=class extends (/*#__PURE__*/ J(`notifications/elicitation/complete`,{payload:{elicitationId:U}})){};const z5=/*#__PURE__*/ W({...L8.fields,serverInfo:f5});var Kxe=class extends (/*#__PURE__*/ J(`initialize`,{success:z5,error:$6,payload:{...R8.payloadSchema.fields,capabilities:Lxe,clientInfo:f5}})){};const B5=/*#__PURE__*/ W({...Q6.fields,resources:/*#__PURE__*/ G(m5)}),V5=/*#__PURE__*/ W({...Q6.fields,resourceTemplates:/*#__PURE__*/ G(h5)}),H5=/*#__PURE__*/ W({...Q6.fields,prompts:/*#__PURE__*/ G(g5)}),U5=/*#__PURE__*/ W({...Z8.fields,messages:/*#__PURE__*/ G(Rxe)}),W5=/*#__PURE__*/ W({...Q6.fields,tools:/*#__PURE__*/ G(S5)});var qxe=class extends (/*#__PURE__*/ J(`resources/list`,{success:B5,error:$6,payload:/*#__PURE__*/ cS(Z6)})){},Jxe=class extends (/*#__PURE__*/ J(`resources/templates/list`,{success:V5,error:$6,payload:/*#__PURE__*/ cS(Z6)})){},Yxe=class extends (/*#__PURE__*/ J(`prompts/list`,{success:H5,error:$6,payload:/*#__PURE__*/ cS(Z6)})){},Xxe=class extends (/*#__PURE__*/ J(`prompts/get`,{success:U5,error:$6,payload:{...J6.fields,name:U,arguments:/*#__PURE__*/ Q(/*#__PURE__*/ tS(U,U))}})){},Zxe=class extends (/*#__PURE__*/ J(`tools/list`,{success:W5,error:$6,payload:/*#__PURE__*/ cS(Z6)})){},Qxe=class extends (/*#__PURE__*/ _N(i8,Kxe,K8,a8,Xxe,Yxe,qxe,Jxe,$8,o8,s8,zxe,Zxe)){},G5=class extends (/*#__PURE__*/ _N(l8,y8,u8,d8)){},$xe=class extends (/*#__PURE__*/ _N(i8,O5,A5,R5)){},eSe=class extends (/*#__PURE__*/ _N(l8,y8,f8,p8,m8,h8,g8,Gxe)){};const K5=/*#__PURE__*/ (/* @__PURE__ */ Qxe.omit(`ping`).middleware(s6).add(i8)).merge(G5),q5=/*#__PURE__*/ K5.omit(`ping`),tSe=e=>{if(e?.type!==`object`)return!1;let t=e.properties===void 0||rn(e.properties)&&Object.values(e.properties).every(rn),n=e.required===void 0||Array.isArray(e.required)&&e.required.every(Ut);return t&&n},J5=(e,t)=>new i6({operation:e,protocolVersion:c5,reason:t}),Y5=(e,t,n)=>Object.hasOwn(e.clientCapabilities,n)&&e.clientCapabilities[n]!==void 0?L:z(J5(t,`Client did not advertise the ${n} capability`)),nSe=e=>e.stopReason===`toolUse`||(`type`in e.content?e.content.type===`tool_use`||e.content.type===`tool_result`:e.content.some(e=>e.type===`tool_use`||e.type===`tool_result`)),rSe=(e,t)=>{let n=e.clientCapabilities.elicitation;return n===void 0?!1:t===`form`?n.form!==void 0||n.url===void 0:n.url!==void 0},X5=/*#__PURE__*/ H(function*(e){return HE(e).pipe(UE({type:KE(`text`,`resource_link`)},e=>e),UE({type:KE(`image`,`audio`)},e=>({type:e.type,mimeType:e.mimeType,data:Dh(e.data),annotations:e.annotations,_meta:e._meta})),UE({type:`resource`},e=>{let t=e.resource;return`text`in t?b5.make({type:`resource`,resource:{uri:t.uri,mimeType:t.mimeType,_meta:t._meta,text:t.text},annotations:e.annotations,_meta:e._meta}):b5.make({type:`resource`,resource:{uri:t.uri,mimeType:t.mimeType,_meta:t._meta,blob:Dh(t.blob)},annotations:e.annotations,_meta:e._meta})}),JE)}),iSe=e=>e===void 0||aSe(e)?e:void 0,aSe=e=>rn(e),oSe=/*#__PURE__*/ D6({protocolVersion:c5,runtime:/*#__PURE__*/ z6({jsonRpc:{acceptsBatches:!1},http:{requiresVersionHeader:!0}}),clientRpcs:K5,clientNotificationRpcs:G5,serverRequestRpcs:$xe,serverNotificationRpcs:eSe,handlerRpcs:q5,makeHandlers:(e,t)=>q5.of({initialize:(e,{client:n})=>t.initialize(c5,{protocolVersion:c5,clientCapabilities:w3.make(e.capabilities),clientInfo:C3.make(e.clientInfo),requestMetadata:e._meta},n.id).pipe(V(e=>z5.make({protocolVersion:c5,capabilities:{experimental:e.capabilities.experimental,extensions:e.capabilities.extensions,logging:e.capabilities.logging?{}:void 0,completions:e.capabilities.completions?{}:void 0,prompts:e.capabilities.prompts,resources:e.capabilities.resources,tools:e.capabilities.tools},serverInfo:e.serverInfo,instructions:e.instructions}))),"logging/setLevel":({level:e},{client:n,headers:r})=>t.setLogLevel(e,n.id,r).pipe(vp({})),"notifications/cancelled":()=>L,"notifications/initialized":(e,{client:n,headers:r})=>t.clientNotification(d6.Initialized(),n.id,r),"notifications/progress":(e,{client:n,headers:r})=>t.clientNotification(d6.Progress({progressToken:e.progressToken,progress:e.progress,total:e.total,message:e.message,metadata:e._meta}),n.id,r),"notifications/roots/list_changed":(e,{client:n,headers:r})=>t.clientNotification(d6.RootsChanged(),n.id,r),"resources/list":()=>o6.use(t=>e.resources.list(h6(t))).pipe(V(e=>B5.make({resources:e.map(e=>m5.make(e))}))),"resources/templates/list":()=>o6.use(t=>e.resources.listTemplates(h6(t))).pipe(V(e=>V5.make({resourceTemplates:e.map(e=>h5.make(e))}))),"resources/read":H(function*({uri:t}){let n=yield*o6,r=yield*e.resources.read(t,g6(n)).pipe(Tp(S6.fromFeature));return Y8.make({contents:r.contents.map(e=>`text`in e?{uri:e.uri,mimeType:e.mimeType,_meta:e._meta,text:e.text}:{uri:e.uri,mimeType:e.mimeType,_meta:e._meta,blob:Dh(e.blob)}),_meta:r._meta})}),"resources/subscribe":({uri:e},{client:n,headers:r})=>t.subscribe(e,n.id,r).pipe(vp({})),"resources/unsubscribe":({uri:e},{client:n,headers:r})=>t.unsubscribe(e,n.id,r).pipe(vp({})),"prompts/list":()=>o6.use(t=>e.prompts.list(h6(t))).pipe(V(e=>H5.make({prompts:e.map(e=>g5.make(e))}))),"prompts/get":H(function*({arguments:t,name:n}){let r=yield*o6,i=yield*e.prompts.get(n,t??{},g6(r)).pipe(Tp(S6.fromFeature));if(i._tag===`InputRequired`)return yield*S6.fromFeature(new u6({protocolVersion:c5,feature:`prompt input requirements`}));let a=i.value,o=yield*ep(a.messages,e=>X5(e.content).pipe(V(t=>({role:e.role,content:t})),Tp(S6.fromTool)));return U5.make({description:a.description,messages:o,_meta:a._meta})}),"completion/complete":H(function*(t){let n=yield*o6,r=yield*e.completions.complete({reference:t.ref.type===`ref/prompt`?{type:`prompt`,name:t.ref.name,title:t.ref.title}:{type:`resourceTemplate`,uriTemplate:t.ref.uri},argument:t.argument,context:t.context?.arguments===void 0?void 0:{arguments:t.context.arguments},metadata:t._meta},g6(n)).pipe(Tp(S6.fromFeature));return G8.make({completion:{values:Array.from(r.values),total:r.total,hasMore:r.hasMore},_meta:r.metadata})}),"tools/list":H(function*(){let t=yield*o6,n=yield*e.tools.list(h6(t));return W5.make({tools:n.map(e=>S5.make({name:e.name,title:e.title,description:e.description,inputSchema:e.inputSchema,outputSchema:tSe(e.outputSchema)?e.outputSchema:void 0,icons:e.icons,annotations:e.annotations===void 0?void 0:v8.make({title:e.annotations.title,readOnlyHint:e.annotations.readOnlyHint,destructiveHint:e.annotations.destructiveHint,idempotentHint:e.annotations.idempotentHint,openWorldHint:e.annotations.openWorldHint}),_meta:e._meta}))})}),"tools/call":H(function*(t){let n=yield*o6,r=yield*e.tools.call({...t,arguments:t.arguments??{}},g6(n)).pipe(B(e=>v6(c5,e)),xp([`InvalidToolInput`,`ToolExecutionError`],e=>F(Y3.make({content:[V3.make({type:`text`,text:e.message})],isError:!0}))),Tp(S6.fromTool)),i=yield*ep(y6(r),X5).pipe(Tp(S6.fromTool)),a=iSe(r.structuredContent);return C5.make({content:i,structuredContent:a,isError:r.isError,_meta:r._meta})})}),toReverseClient:(e,t)=>({listRoots:H(function*(n){yield*Y5(e,`roots/list`,`roots`);let r=yield*w6(n6.payloadSchema,A5.payloadSchema,n).pipe(Tp(()=>J5(`roots/list`,`Request is not representable by this protocol`))),{roots:i}=yield*t[`roots/list`](r).pipe(Tp(C6(`roots/list`)));return new t6({roots:i})}),createMessage:H(function*(n){if(yield*Y5(e,`sampling/createMessage`,`sampling`),x6(n)&&e.clientCapabilities.sampling?.tools==null)return yield*J5(`sampling/createMessage`,`Client did not advertise the sampling.tools capability`);if((n.includeContext===`thisServer`||n.includeContext===`allServers`)&&e.clientCapabilities.sampling?.context==null)return yield*J5(`sampling/createMessage`,`Client did not advertise the sampling.context capability`);let r=yield*w6(e6.payloadSchema,O5.payloadSchema,n).pipe(Tp(()=>J5(`sampling/createMessage`,`Request is not representable by this protocol`))),i=yield*t[`sampling/createMessage`](r).pipe(Tp(C6(`sampling/createMessage`)));return nSe(i)&&e.clientCapabilities.sampling?.tools==null?yield*J5(`sampling/createMessage`,`Client did not advertise the sampling.tools capability`):yield*w6(O5.successSchema,e6.successSchema,i).pipe(Tp(()=>J5(`sampling/createMessage`,`Response is not representable by the canonical model`)))}),elicit:H(function*(n){yield*Y5(e,`elicitation/create`,`elicitation`);let r=n.mode===`url`?`url`:`form`;if(!rSe(e,r))return yield*J5(`elicitation/create`,`Client did not advertise the elicitation.${r} capability`);let i=yield*w6(r6.payloadSchema,R5.payloadSchema,n).pipe(Tp(()=>J5(`elicitation/create`,`Request is not representable by this protocol`))),a=yield*t[`elicitation/create`](i).pipe(Tp(C6(`elicitation/create`)));return yield*w6(R5.successSchema,r6.successSchema,a).pipe(Tp(()=>J5(`elicitation/create`,`Response is not representable by the canonical model`)))})}),projectNotification:e=>e._tag===`ElicitationComplete`?F({tag:`notifications/elicitation/complete`,payload:{elicitationId:e.elicitationId}}):T6({supportsProgressMessage:!0},e),normalizeCancellation:e=>Nx(l8.payloadSchema)(e).pipe(V(e=>({requestId:e.requestId,reason:e.reason,metadata:e._meta})))}),Z5=`2026-07-28`,$=U6,Q5=/*#__PURE__*/ $(q),$5=/*#__PURE__*/ K([U,AS]),e7=$5,t7=K6,n7=q6,r7=f5,sSe=/*#__PURE__*/ nS(/*#__PURE__*/ W({experimental:/*#__PURE__*/ $(/*#__PURE__*/ tS(U,q)),roots:/*#__PURE__*/ $(/*#__PURE__*/ W({})),sampling:/*#__PURE__*/ $(/*#__PURE__*/ W({context:/*#__PURE__*/ $(q),tools:/*#__PURE__*/ $(q)})),elicitation:/*#__PURE__*/ $(/*#__PURE__*/ W({form:/*#__PURE__*/ $(q),url:/*#__PURE__*/ $(q)})),extensions:/*#__PURE__*/ $(/*#__PURE__*/ tS(U,q))}),[q]),cSe=/*#__PURE__*/ nS(/*#__PURE__*/ W({experimental:/*#__PURE__*/ $(/*#__PURE__*/ tS(U,q)),logging:/*#__PURE__*/ $(q),completions:/*#__PURE__*/ $(q),prompts:/*#__PURE__*/ $(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ $(Zx)})),resources:/*#__PURE__*/ $(/*#__PURE__*/ W({subscribe:/*#__PURE__*/ $(Zx),listChanged:/*#__PURE__*/ $(Zx)})),tools:/*#__PURE__*/ $(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ $(Zx)})),extensions:/*#__PURE__*/ $(/*#__PURE__*/ tS(U,q))}),[q]),i7=/*#__PURE__*/ nS(/*#__PURE__*/ W({progressToken:/*#__PURE__*/ $(e7),"io.modelcontextprotocol/protocolVersion":U,"io.modelcontextprotocol/clientInfo":/*#__PURE__*/ $(r7),"io.modelcontextprotocol/clientCapabilities":sSe,"io.modelcontextprotocol/logLevel":/*#__PURE__*/ $(n7)}),[q]),a7=/*#__PURE__*/ W({_meta:i7}),o7=/*#__PURE__*/ W({_meta:/*#__PURE__*/ $(/* @__PURE__ */ nS(/*#__PURE__*/ W({"io.modelcontextprotocol/subscriptionId":/*#__PURE__*/ $($5)}),[q]))}),s7=/*#__PURE__*/ nS(/*#__PURE__*/ W({"io.modelcontextprotocol/serverInfo":r7}),[q]),c7={_meta:s7,resultType:/*#__PURE__*/ Gx(`complete`)},l7=/*#__PURE__*/ W({code:AS,message:U,data:/*#__PURE__*/ $(_C)}),lSe=p5,u7=/*#__PURE__*/ W({...m5.fields,size:/*#__PURE__*/ $(AS),annotations:/*#__PURE__*/ $(lSe)}),d7=h5,uSe=k8,f7=_5,p7=v5,m7=y5,h7=/*#__PURE__*/ K([f7,p7,m7,/* @__PURE__ */ W({...u7.fields,type:/*#__PURE__*/ Gx(`resource_link`)}),b5]),g7=g5,dSe=/*#__PURE__*/ W({role:t7,content:h7}),fSe=/*#__PURE__*/ nS(/*#__PURE__*/ W({$schema:/*#__PURE__*/ $(U),type:/*#__PURE__*/ Gx(`object`)}),[q]),pSe=/*#__PURE__*/ nS(/*#__PURE__*/ W({$schema:/*#__PURE__*/ $(U)}),[q]),mSe=v8,_7=/*#__PURE__*/ W({...S5.fields,inputSchema:fSe,outputSchema:/*#__PURE__*/ $(pSe),annotations:/*#__PURE__*/ $(mSe)}),v7=/*#__PURE__*/ K([f7,p7,m7,w5,/* @__PURE__ */ W({type:/*#__PURE__*/ Gx(`tool_result`),toolUseId:U,content:/*#__PURE__*/ G(h7),structuredContent:/*#__PURE__*/ $(_C),isError:/*#__PURE__*/ $(Zx),_meta:Q5})]),y7=/*#__PURE__*/ W({role:t7,content:/*#__PURE__*/ K([v7,/*#__PURE__*/ G(v7)]),_meta:Q5}),hSe=/*#__PURE__*/ nS(/*#__PURE__*/ W({name:/*#__PURE__*/ $(U)}),[q]),b7=/*#__PURE__*/ CS.check(/*#__PURE__*/ OS({minimum:0,maximum:1})),gSe=/*#__PURE__*/ W({...n8.fields,hints:/*#__PURE__*/ $(/*#__PURE__*/ G(hSe)),costPriority:/*#__PURE__*/ $(b7),speedPriority:/*#__PURE__*/ $(b7),intelligencePriority:/*#__PURE__*/ $(b7)}),_Se=/*#__PURE__*/ W({method:/*#__PURE__*/ Gx(`sampling/createMessage`),params:/*#__PURE__*/ W({messages:/*#__PURE__*/ G(y7),modelPreferences:/*#__PURE__*/ $(gSe),systemPrompt:/*#__PURE__*/ $(U),includeContext:/*#__PURE__*/ $(/*#__PURE__*/ oS([`none`,`thisServer`,`allServers`])),temperature:/*#__PURE__*/ $(CS),maxTokens:AS,stopSequences:/*#__PURE__*/ $(/*#__PURE__*/ G(U)),metadata:/*#__PURE__*/ $(q),tools:/*#__PURE__*/ $(/*#__PURE__*/ G(_7)),toolChoice:/*#__PURE__*/ $(D5)})}),vSe=/*#__PURE__*/ W({...y7.fields,model:U,stopReason:/*#__PURE__*/ $(U)}),ySe=k5,bSe=/*#__PURE__*/ W({method:/*#__PURE__*/ Gx(`roots/list`),params:/*#__PURE__*/ $(/*#__PURE__*/ W({_meta:Q5}))}),xSe=/*#__PURE__*/ W({roots:/*#__PURE__*/ G(ySe)}),SSe=/*#__PURE__*/ W({method:/*#__PURE__*/ Gx(`elicitation/create`),params:/* @__PURE__ */ K([/* @__PURE__ */ W({mode:/*#__PURE__*/ $(/*#__PURE__*/ Gx(`form`)),message:U,requestedSchema:/* @__PURE__ */ W({$schema:/*#__PURE__*/ $(U),type:/*#__PURE__*/ Gx(`object`),properties:/*#__PURE__*/ tS(U,/* @__PURE__ */ K([/* @__PURE__ */ K([L5,F5,I5]),j5,M5,N5])),required:/*#__PURE__*/ $(/*#__PURE__*/ G(U))})}),/* @__PURE__ */ W({mode:/*#__PURE__*/ Gx(`url`),message:U,url:U})])}),CSe=/*#__PURE__*/ W({action:/*#__PURE__*/ oS([`accept`,`decline`,`cancel`]),content:/*#__PURE__*/ $(/*#__PURE__*/ tS(U,/*#__PURE__*/ K([U,CS,Zx,/*#__PURE__*/ G(U)])))}),wSe=/*#__PURE__*/ K([_Se,bSe,SSe]),TSe=/*#__PURE__*/ K([vSe,xSe,CSe]),x7=/*#__PURE__*/ tS(U,wSe),ESe=/*#__PURE__*/ tS(U,TSe),S7={_meta:s7,resultType:/*#__PURE__*/ Gx(`input_required`)},C7=/*#__PURE__*/ K([/*#__PURE__*/ nS(/*#__PURE__*/ W({...S7,inputRequests:x7,requestState:/*#__PURE__*/ $(U)}),[q]),/*#__PURE__*/ nS(/*#__PURE__*/ W({...S7,inputRequests:/*#__PURE__*/ $(x7),requestState:U}),[q])]),w7={...a7.fields,inputResponses:/*#__PURE__*/ $(ESe),requestState:/*#__PURE__*/ $(U)},T7={...c7,ttlMs:/*#__PURE__*/ AS.check(/*#__PURE__*/ DS(0)),cacheScope:/*#__PURE__*/ oS([`public`,`private`])},E7={...a7.fields,cursor:/*#__PURE__*/ $(U)},D7={...c7,nextCursor:/*#__PURE__*/ $(U)},O7=/*#__PURE__*/ nS(/*#__PURE__*/ W({...T7,supportedVersions:/*#__PURE__*/ G(U),capabilities:cSe,instructions:/*#__PURE__*/ $(U)}),[q]);var DSe=class extends (/*#__PURE__*/ J(`server/discover`,{success:O7,error:l7,payload:a7})){};const k7=/*#__PURE__*/ nS(/*#__PURE__*/ W({...D7,...T7,resources:/*#__PURE__*/ G(u7)}),[q]);var OSe=class extends (/*#__PURE__*/ J(`resources/list`,{success:k7,error:l7,payload:E7})){};const A7=/*#__PURE__*/ nS(/*#__PURE__*/ W({...D7,...T7,resourceTemplates:/*#__PURE__*/ G(d7)}),[q]);var kSe=class extends (/*#__PURE__*/ J(`resources/templates/list`,{success:A7,error:l7,payload:E7})){};const j7=/*#__PURE__*/ nS(/*#__PURE__*/ W({...T7,contents:/*#__PURE__*/ G(uSe)}),[q]);var ASe=class extends (/*#__PURE__*/ J(`resources/read`,{success:/*#__PURE__*/ K([j7,C7]),error:l7,payload:{...w7,uri:U}})){};const M7=/*#__PURE__*/ nS(/*#__PURE__*/ W({...D7,...T7,prompts:/*#__PURE__*/ G(g7)}),[q]);var jSe=class extends (/*#__PURE__*/ J(`prompts/list`,{success:M7,error:l7,payload:E7})){};const N7=/*#__PURE__*/ nS(/*#__PURE__*/ W({...c7,description:/*#__PURE__*/ $(U),messages:/*#__PURE__*/ G(dSe)}),[q]);var MSe=class extends (/*#__PURE__*/ J(`prompts/get`,{success:/*#__PURE__*/ K([N7,C7]),error:l7,payload:{...w7,name:U,arguments:/*#__PURE__*/ $(/*#__PURE__*/ tS(U,U))}})){};const P7=/*#__PURE__*/ nS(/*#__PURE__*/ W({...D7,...T7,tools:/*#__PURE__*/ G(_7)}),[q]);var NSe=class extends (/*#__PURE__*/ J(`tools/list`,{success:P7,error:l7,payload:E7})){};const F7=/*#__PURE__*/ nS(/*#__PURE__*/ W({...c7,content:/*#__PURE__*/ G(h7),structuredContent:/*#__PURE__*/ $(_C),isError:/*#__PURE__*/ $(Zx)}),[q]);var PSe=class extends (/*#__PURE__*/ J(`tools/call`,{success:/*#__PURE__*/ K([F7,C7]),error:l7,payload:{...w7,name:U,arguments:/*#__PURE__*/ $(q)}})){};const FSe=U8,ISe=W8,I7=/*#__PURE__*/ nS(/*#__PURE__*/ W({...c7,completion:/*#__PURE__*/ W({values:/*#__PURE__*/ G(U).check(/*#__PURE__*/ NS(100)),total:/*#__PURE__*/ $(AS),hasMore:/*#__PURE__*/ $(Zx)})}),[q]);var LSe=class extends (/*#__PURE__*/ J(`completion/complete`,{success:I7,error:l7,payload:{...a7.fields,ref:/*#__PURE__*/ K([FSe,ISe]),argument:/*#__PURE__*/ W({name:U,value:U}),context:/*#__PURE__*/ $(/*#__PURE__*/ W({arguments:/*#__PURE__*/ $(/*#__PURE__*/ tS(U,U))}))}})){};const L7=/*#__PURE__*/ W({toolsListChanged:/*#__PURE__*/ $(Zx),promptsListChanged:/*#__PURE__*/ $(Zx),resourcesListChanged:/*#__PURE__*/ $(Zx),resourceSubscriptions:/*#__PURE__*/ $(/*#__PURE__*/ G(U))}),R7=/*#__PURE__*/ nS(/*#__PURE__*/ W({_meta:/* @__PURE__ */ nS(/*#__PURE__*/ W({"io.modelcontextprotocol/serverInfo":r7,"io.modelcontextprotocol/subscriptionId":$5}),[q]),resultType:/*#__PURE__*/ Gx(`complete`)}),[q]);var RSe=class extends (/*#__PURE__*/ J(`subscriptions/listen`,{success:R7,error:l7,payload:{...a7.fields,notifications:L7}})){},z7=class extends (/*#__PURE__*/ J(`notifications/cancelled`,{payload:{...o7.fields,requestId:$5,reason:/*#__PURE__*/ $(U)}})){},zSe=class extends (/*#__PURE__*/ J(`notifications/progress`,{payload:{...o7.fields,progressToken:e7,progress:CS,total:/*#__PURE__*/ $(CS),message:/*#__PURE__*/ $(U)}})){},BSe=class extends (/*#__PURE__*/ J(`notifications/message`,{payload:{...o7.fields,level:n7,logger:/*#__PURE__*/ $(U),data:_C}})){},B7=class extends (/*#__PURE__*/ J(`notifications/resources/updated`,{payload:{...o7.fields,uri:U}})){},V7=class extends (/*#__PURE__*/ J(`notifications/resources/list_changed`,{payload:/*#__PURE__*/ cS(o7)})){},H7=class extends (/*#__PURE__*/ J(`notifications/tools/list_changed`,{payload:/*#__PURE__*/ cS(o7)})){},U7=class extends (/*#__PURE__*/ J(`notifications/prompts/list_changed`,{payload:/*#__PURE__*/ cS(o7)})){},W7=class extends (/*#__PURE__*/ J(`notifications/subscriptions/acknowledged`,{payload:{...o7.fields,notifications:L7}})){},G7=class extends (/*#__PURE__*/ _N(DSe,LSe,MSe,jSe,OSe,kSe,ASe,RSe,PSe,NSe)){},K7=class extends (/*#__PURE__*/ _N(z7)){},VSe=class extends (/*#__PURE__*/ G7.merge(K7)){},HSe=class extends (/*#__PURE__*/ _N()){},USe=class extends (/*#__PURE__*/ _N(z7,zSe,BSe,B7,V7,H7,U7,W7)){};const WSe=/*#__PURE__*/ tS(U,q),GSe=/*#__PURE__*/ Nx(i7),KSe=/*#__PURE__*/ Nx(z7.payloadSchema),qSe=/*#__PURE__*/ Mx(_C),q7=/*#__PURE__*/ Lx(r7),J7=e=>{let t={};for(let n in e)e[n]!==void 0&&(t[n]=e[n]);return t},JSe=(e,t)=>{if(Qt(t))return e===void 0;if(e===void 0)return!1;let n=m6(e);return n!==void 0&&HE(t).pipe(UE(Fce,e=>n===e),UE(Lce,e=>n===String(e)),UE(Ice,e=>Number.isSafeInteger(e)&&n.trim().length>0&&Number(n)===e),qE(()=>!1))},YSe=/*#__PURE__*/ H(function*(e){let t=yield*GSe(e);return{protocolVersion:Z5,clientCapabilities:t[`io.modelcontextprotocol/clientCapabilities`],clientInfo:t[`io.modelcontextprotocol/clientInfo`],requestMetadata:t}}),Y7=(e,t)=>{let n=e._meta;return{...rn(n)?n:{},"io.modelcontextprotocol/serverInfo":t}},X7=(e,t)=>J7({_meta:{"io.modelcontextprotocol/serverInfo":t},resultType:`input_required`,inputRequests:e.inputRequests,requestState:e.requestState}),Z7=/*#__PURE__*/ Nx(/*#__PURE__*/ K([F7,C7])),Q7=/*#__PURE__*/ H(function*(e,t){let n=yield*q7(t);return e._tag===`Complete`?yield*Z7({...J7(e.value),_meta:Y7(e.value,n),resultType:`complete`}):yield*Z7(X7(e,n))}),XSe=(e,t)=>{let n={};for(let r of Object.values(e??{}))HE(r).pipe(UE({method:`roots/list`},()=>{t.roots===void 0&&(n.roots={})}),UE({method:`sampling/createMessage`},e=>{let r=n.sampling??{};x6(e.params)&&t.sampling?.tools===void 0&&(r.tools={}),(e.params.includeContext===`thisServer`||e.params.includeContext===`allServers`)&&t.sampling?.context===void 0&&(r.context={}),(t.sampling===void 0||Object.keys(r).length>0)&&(n.sampling=r)}),UE({method:`elicitation/create`},e=>{let r=e.params.mode===`url`?`url`:`form`,i=t.elicitation;i!==void 0&&(r===`url`?i.url!==void 0:i.form!==void 0||Object.keys(i).length===0)||((n.elicitation??={})[r]={})}),JE);return n},$7=e=>J7({uri:e.uri,mimeType:e.mimeType,_meta:e._meta,...`text`in e?{text:e.text}:{blob:Dh(e.blob)}}),e9=/*#__PURE__*/ VE().pipe(/*#__PURE__*/ UE({type:/*#__PURE__*/ KE(`text`,`resource_link`)},e=>e),/*#__PURE__*/ UE({type:/*#__PURE__*/ KE(`image`,`audio`)},e=>J7({type:e.type,mimeType:e.mimeType,data:Dh(e.data),annotations:e.annotations,_meta:e._meta})),/*#__PURE__*/ UE({type:`resource`},e=>J7({type:`resource`,resource:$7(e.resource),annotations:e.annotations,_meta:e._meta})),JE),ZSe=e=>u7.make(e),QSe=e=>d7.make(e),$Se=e=>w6(Cbe,g7,e),eCe=e=>w6(J3,_7,e),t9={ttlMs:0,cacheScope:`private`},n9=/*#__PURE__*/ H(function*(e,t){let n=yield*q7(t);return{...J7(e),_meta:Y7(e,n),resultType:`complete`}}),tCe=/*#__PURE__*/ VE().pipe(/*#__PURE__*/ WE(`ResourceNotFound`,e=>new S6({code:-32602,message:`Resource '${e.uri}' not found`,data:{uri:e.uri}})),/*#__PURE__*/ WE(`ToolNotFound`,`InvalidToolInput`,`InvalidToolContinuation`,`ToolExecutionError`,`UnsupportedByProtocol`,S6.fromTool),/*#__PURE__*/ qE(S6.fromFeature)),r9=e=>{let t=tCe(e);return l7.make({code:t.code,message:t.message,...qSe(t.data)?{data:t.data}:{}})},i9=/*#__PURE__*/ H(function*(e,t){let n=yield*Hp(pM);return Ii(n)&&xM(n.value,(t,n)=>F(OA(n,e))),yield*t}),nCe=e=>KSe(e).pipe(V(e=>({requestId:e.requestId,reason:e.reason,metadata:e._meta}))),a9=e=>new i6({operation:e,protocolVersion:Z5,reason:`MCP 2026-07-28 carries server input requests in multi round-trip results`}),o9=/* @__PURE__ */ D6({protocolVersion:Z5,runtime:{_tag:`Stateless`,transport:{jsonRpc:{acceptsBatches:!1},http:{}},profileFromRequestMetadata:YSe},clientRpcs:VSe,clientNotificationRpcs:K7,serverRequestRpcs:HSe,serverNotificationRpcs:USe,handlerRpcs:/* @__PURE__ */ G7.merge(K7),makeHandlers:(e,t,n)=>{let r=Nx(WSe),i=Nx(O7),a=Nx(k7),o=Nx(A7),s=Nx(j7),c=Nx(M7),l=Nx(N7),u=Nx(K([N7,C7])),d=Nx(I7),f=Nx(P7),p=n.sendNotification,m=p!==void 0,h=n.serverInfo.extensions===void 0?void 0:tte(n.serverInfo.extensions,e=>rn(e)),g=V(n.registrationPresence,e=>{let t={completions:{},logging:{}};return h!==void 0&&(t.extensions=h),e.tools&&(t.tools={listChanged:m}),e.resources&&(t.resources={listChanged:m,subscribe:m}),e.prompts&&(t.prompts={listChanged:m}),{supportedVersions:n.supportedVersions,capabilities:t,serverInfo:n.serverInfo}}),_=a6.useSync(_6),v=H(function*(e){let t=yield*a6,n=e.inputResponses===void 0?void 0:yield*r(e.inputResponses).pipe(Ep);return _6(a6.of({...t,inputResponses:n,requestState:e.requestState}))}),y=H(function*(e,t){let n=XSe(e.inputRequests,t);if(Object.keys(n).length!==0)return yield*i9(400,new S6({code:-32021,message:`The request requires client capabilities that were not declared`,data:{requiredCapabilities:n}}))});return{"subscriptions/listen":H(function*(e,{client:t,requestId:r}){if(p===void 0)return yield*new S6({code:-32601,message:`Method not found: subscriptions/listen`});let i=yield*n.registrationPresence,a=yield*ef(yield*Gp),o=n.getListChangeRevision?.()??0,s=yield*Zd(n.subscribeServerNotifications,a),c={...i.tools&&e.notifications.toolsListChanged===!0?{toolsListChanged:!0}:{},...i.prompts&&e.notifications.promptsListChanged===!0?{promptsListChanged:!0}:{},...i.resources&&e.notifications.resourcesListChanged===!0?{resourcesListChanged:!0}:{},...i.resources&&e.notifications.resourceSubscriptions!==void 0?{resourceSubscriptions:e.notifications.resourceSubscriptions}:{}},l={"io.modelcontextprotocol/subscriptionId":r},u=new Set(c.resourceSubscriptions),d=yield*zC(64),f=yield*Id();yield*R(function*(){for(;;){let e=yield*Hoe(s);if(e.listChangeRevision!==void 0&&e.listChangeRevision<=o||e.targetClientId!==void 0&&e.targetClientId!==t.id)continue;let n=e.notification,r=HE(n).pipe(GE({ToolsChanged:()=>c.toolsListChanged===!0?H7:void 0,PromptsChanged:()=>c.promptsListChanged===!0?U7:void 0,ResourcesChanged:()=>c.resourcesListChanged===!0?V7:void 0,ResourceUpdated:e=>u.has(e.uri)?B7:void 0}),JE);if(r===void 0)continue;let i={tag:r._tag,payload:r.payloadSchema.make({_meta:{...n.metadata,...l},...n._tag===`ResourceUpdated`?{uri:n.uri}:{}})};if(!(yield*BC(d,i)))break}}).pipe(af(a),mp(ap(()=>n.markSubscriptionCancelled?.(t.id,r)??L)),mp(Ud(f,void 0)),fm),yield*p(Z5,t.id,{tag:W7._tag,payload:W7.payloadSchema.make({_meta:l,notifications:c})});let m=am($C(d).pipe(B(e=>p(Z5,t.id,e))));yield*Qre(m,Ld(f)),yield*n.terminateSubscription?.(`2026-07-28`,t.id,r,`Pending notification limit exceeded`)??L;let h=yield*q7(n.serverInfo);return R7.make({_meta:{...l,"io.modelcontextprotocol/serverInfo":h},resultType:`complete`})},Tp(r9)),"server/discover":H(function*(e){let t=yield*g,r=yield*n9({...t9,supportedVersions:Array.from(t.supportedVersions),capabilities:t.capabilities,instructions:n.serverInfo.instructions},n.serverInfo);return yield*i(r)},Tp(r9)),"resources/list":H(function*(t){let r=yield*_,i=yield*e.resources.list(r.protocol),o=yield*n9({...t9,resources:i.map(ZSe)},n.serverInfo);return yield*a(o)},Tp(r9)),"resources/templates/list":H(function*(t){let r=yield*_,i=yield*e.resources.listTemplates(r.protocol),a=yield*n9({...t9,resourceTemplates:i.map(QSe)},n.serverInfo);return yield*o(a)},Tp(r9)),"resources/read":H(function*(t){let r=yield*v(t),i=yield*e.resources.read(t.uri,r),a=i.contents.map($7),o=yield*n9({...t9,contents:a,_meta:i._meta},n.serverInfo);return yield*s(o)},Tp(r9)),"prompts/list":H(function*(t){if(!(yield*n.registrationPresence).prompts)return yield*i9(404,new S6({code:E3,message:`Method not found`}));let r=yield*_,i=yield*e.prompts.list(r.protocol),a=yield*ep(i,$Se),o=yield*n9({...t9,prompts:a},n.serverInfo);return yield*c(o)},Tp(r9)),"prompts/get":H(function*(t){let r=yield*v(t),i=yield*e.prompts.get(t.name,t.arguments??{},r);if(i._tag===`InputRequired`){yield*y(i,r.protocol.clientCapabilities);let e=yield*q7(n.serverInfo);return yield*u(X7(i,e))}let a=i.value,o=a.messages.map(e=>({role:e.role,content:e9(e.content)})),s=yield*n9({description:a.description,messages:o,_meta:a._meta},n.serverInfo);return yield*l(s)},Tp(r9)),"completion/complete":H(function*(t){let r=yield*_,i=yield*e.completions.complete({reference:t.ref.type===`ref/prompt`?{type:`prompt`,name:t.ref.name,title:t.ref.title}:{type:`resourceTemplate`,uriTemplate:t.ref.uri},argument:t.argument,context:t.context?.arguments===void 0?void 0:{arguments:t.context.arguments},metadata:t._meta},r),a=yield*n9({completion:J7({values:Array.from(i.values),total:i.total,hasMore:i.hasMore}),_meta:i.metadata},n.serverInfo);return yield*d(a)},Tp(r9)),"tools/list":H(function*(t){let r=yield*_,i=yield*e.tools.list(r.protocol),a=yield*ep(i,eCe),o=yield*n9({...t9,tools:a},n.serverInfo);return yield*f(o)},Tp(r9)),"tools/call":H(function*(t){let r=yield*v(t),i=(yield*e.tools.list(r.protocol)).find(e=>e.name===t.name),a=yield*Hp(pM);if(i!==void 0&&Ii(a)){let e=[{schema:i.inputSchema,argument:t.arguments,path:``}];for(;e.length>0;){let{schema:t,argument:n,path:r}=e.pop();if(!rn(t))continue;let i=t[`x-mcp-header`];if(typeof i==`string`){let e=`mcp-param-${i.toLowerCase()}`;if(!JSe(a.value.headers[e],n))return yield*i9(400,new S6({code:k3,message:`${e} does not match argument '${r}'`}))}if(rn(t.properties))for(let[i,a]of Object.entries(t.properties))e.push({schema:a,argument:rn(n)&&Object.hasOwn(n,i)?n[i]:void 0,path:r===``?i:`${r}.${i}`})}}let o=yield*e.tools.call({name:t.name,arguments:t.arguments??{}},r).pipe(xp([`ToolExecutionError`,`InvalidToolInput`],e=>F(l6.Complete(Y3.make({content:[V3.make({type:`text`,text:e.message})],isError:!0})))));if(o._tag===`InputRequired`)return yield*y(o,r.protocol.clientCapabilities),yield*Q7(o,n.serverInfo);let s=o.value,c=s.content.map(e9);return yield*Q7(l6.Complete({content:c,structuredContent:s.structuredContent,isError:s.isError,_meta:s._meta}),n.serverInfo)},Tp(r9)),"notifications/cancelled":H(function*(e){return yield*L})}},toReverseClient:()=>({listRoots:()=>z(a9(`roots/list`)),createMessage:()=>z(a9(`sampling/createMessage`)),elicit:()=>z(a9(`elicitation/create`))}),projectNotification:e=>E6(e)?F(void 0):T6({supportsProgressMessage:!0},e),normalizeCancellation:nCe}),rCe=oSe,iCe=Ixe,s9=/*#__PURE__*/ new WeakMap,c9=/*#__PURE__*/ Ea(`effect/ai/McpServer/RequestNotificationQueue`,{defaultValue:()=>void 0}),l9=e=>e._tag===`Progress`||e._tag===`LoggingMessage`,aCe=/*#__PURE__*/ Ibe.omit(`notifications/elicitation/complete`),u9=/*#__PURE__*/ Mx(Z3),oCe=e=>{switch(e.tag){case`notifications/cancelled`:return f6.Cancelled({requestId:e.payload.requestId,reason:e.payload.reason,metadata:e.payload._meta});case`notifications/progress`:return f6.Progress({progressToken:e.payload.progressToken,progress:e.payload.progress,total:e.payload.total,message:e.payload.message,metadata:e.payload._meta});case`notifications/message`:return f6.LoggingMessage({level:e.payload.level,logger:e.payload.logger,data:e.payload.data,metadata:e.payload._meta});case`notifications/resources/updated`:return f6.ResourceUpdated({uri:e.payload.uri,metadata:e.payload._meta});case`notifications/resources/list_changed`:return f6.ResourcesChanged({metadata:e.payload?._meta});case`notifications/tools/list_changed`:return f6.ToolsChanged({metadata:e.payload?._meta});case`notifications/prompts/list_changed`:return f6.PromptsChanged({metadata:e.payload?._meta});default:return}},d9=(e,t)=>{let n=Wp(e,a6,t.requestContext),r=t.requestContext.requestMetadata,i=N(r,`io.modelcontextprotocol/logLevel`)?r[`io.modelcontextprotocol/logLevel`]:void 0;return u9(i)&&(n=Wp(n,Kd,p6[i].effect)),t.serverClient===void 0?n:Wp(n,o6,t.serverClient)};var f9=class e extends (/*#__PURE__*/ P()(`effect/ai/McpServer`)){static make=/*#__PURE__*/ R(function*(){let t=yield*Ube,n=Ga(),r=[],i=[],a=[],o=yield*LC(),s={consumers:0,listChangeRevision:0,requestEndpoints:0},c=()=>s.consumers===0&&s.requestEndpoints>0,l=/* @__PURE__ */ new Map,u=(yield*Co).makeDispatcher(),d=yield*aN(aCe,{spanPrefix:`McpServer/Notifications`,onFromClient:e=>Id().pipe(B(t=>fp(n=>{let r=e.message;if(r._tag!==`Request`)return L;let i=oCe(r);if(i===void 0)return L;let a={notification:i,delivered:t,requestContext:ha(n.context,a6),requestHeaders:ha(n.context,pM)?.headers},f=ap(()=>d.write({clientId:0,requestId:r.id,_tag:`Exit`,exit:Ed})),p=va(n.context,c9);if(p!==void 0&&a.requestContext!==void 0&&l9(i))return VC(p,a),mp(Ld(t),f);if(c())return f;let m=!1;if(r.tag.includes(`list_changed`)){let e=++s.listChangeRevision,t=l.get(r.tag);t===void 0?(a.listChangeRevision=e,m=!0,l.set(r.tag,a),u.scheduleTask(()=>{l.delete(r.tag),VC(o,a)},0)):t.listChangeRevision=e}else m=!0,VC(o,a);return m&&a.requestContext!==void 0&&s.consumers>0?mp(Ld(t),f):f})))}),f=e.of({notifications:d.client,notifyElicitationComplete:({clientId:e,elicitationId:t})=>c()?L:Id().pipe(B(n=>BC(o,{notification:f6.ElicitationComplete({elicitationId:t}),targetClientId:e,delivered:n}).pipe(mp(ap(()=>s.consumers>0?Ld(n):L))))),get tools(){return n},addTool:e=>R(function*(){let r=n.findIndex(({tool:t})=>t.name===e.tool.name);r===-1?n.push(e):n[r]=e;let i=ha(e.annotations,c6);yield*t.tools.register({descriptor:new J3({...e.tool,title:e.tool.title??e.tool.annotations?.title}),isVisible:e=>i===void 0||i({protocolVersion:e.protocolVersion,capabilities:e.clientCapabilities,clientInfo:e.clientInfo}),handle:(t,n)=>d9(e.handle(t.arguments),n).pipe(qre({InternalError:t=>z(new Vbe({name:e.tool.name,message:t.message})),InvalidParams:t=>z(new(n.requestContext.requestState===void 0&&n.requestContext.inputResponses===void 0?zbe:Bbe)({name:e.tool.name,message:t.message}))}),V(e=>on(e,`InputRequired`)?l6.InputRequired(e):l6.Complete(e)))}),yield*d.client[`notifications/tools/list_changed`]({})}),callTool:e=>R(function*(){let n=yield*o6,r=yield*t.tools.call(e,g6(n)).pipe(Tp(e=>new N3({message:e._tag===`ToolNotFound`?`Tool '${e.name}' not found`:e.message})));return r._tag===`InputRequired`?yield*new N3({message:`Client input is not supported by this MCP protocol`}):r.value}),get resources(){return r},get resourceTemplates(){return i},addResource:e=>R(function*(){let n=r.findIndex(({resource:t})=>t.uri===e.resource.uri);n===-1?r.push(e):r[n]=e,yield*t.resources.register({descriptor:e.resource,isVisible:t=>{let n=ha(e.annotations,c6);return n===void 0||n({protocolVersion:t.protocolVersion,capabilities:t.clientCapabilities,clientInfo:t.clientInfo})},read:t=>d9(e.handle,t)}),yield*d.client[`notifications/resources/list_changed`]({})}),addResourceTemplate:({annotations:e,completions:n,handle:r,routerPath:a,template:o})=>R(function*(){let s=i.findIndex(({template:e})=>e.uriTemplate===o.uriTemplate);s===-1?i.push({template:o,annotations:e}):i[s]={template:o,annotations:e};let c=mCe();c.add(a,!0),yield*t.resources.registerTemplate({descriptor:o,isVisible:t=>{let n=ha(e,c6);return n===void 0||n({protocolVersion:t.protocolVersion,capabilities:t.clientCapabilities,clientInfo:t.clientInfo})},match:e=>{let t=c.find(e);if(t===void 0)return;let n=[];for(let e of Object.keys(t.params))n[Number(e)]=t.params[e];return n},read:(e,t,n)=>d9(r(e,Array.from(t)),n)});for(let[e,r]of Object.entries(n))yield*t.completions.register(`resource/${o.uriTemplate}/${e}`,(e,t)=>d9(r(e.argument.value,e.context),t).pipe(V(e=>({values:e.completion.values,total:e.completion.total,hasMore:e.completion.hasMore,metadata:e._meta}))));yield*d.client[`notifications/resources/list_changed`]({})}),findResource:e=>R(function*(){let n=yield*o6;return yield*t.resources.read(e,g6(n)).pipe(xp(`ResourceNotFound`,e=>z(new N3({message:`Resource '${e.uri}' not found`}))))}),get prompts(){return a},addPrompt:e=>R(function*(){let n=a.findIndex(({prompt:t})=>t.name===e.prompt.name);n===-1?a.push(e):a[n]=e,yield*t.prompts.register({descriptor:e.prompt,isVisible:t=>{let n=ha(e.annotations,c6);return n===void 0||n({protocolVersion:t.protocolVersion,capabilities:t.clientCapabilities,clientInfo:t.clientInfo})},get:(t,n)=>d9(e.handle(t),n).pipe(V(e=>on(e,`InputRequired`)?l6.InputRequired(e):l6.Complete(e)))});for(let[n,r]of Object.entries(e.completions))yield*t.completions.register(`prompt/${e.prompt.name}/${n}`,(e,t)=>d9(r(e.argument.value,e.context),t).pipe(V(e=>({values:e.completion.values,total:e.completion.total,hasMore:e.completion.hasMore,metadata:e._meta}))));yield*d.client[`notifications/prompts/list_changed`]({})}),getPromptResult:H(function*({arguments:e,name:n}){let r=yield*o6,i=yield*t.prompts.get(n,e??{},g6(r)).pipe(xp(`PromptNotFound`,()=>new N3({message:`Prompt '${n}' not found`})));return i._tag===`Complete`?i.value:yield*new N3({message:`Client input is not supported by this MCP protocol`})}),completion:H(function*(e){let n=yield*o6,r=e.ref,i=yield*t.completions.complete({reference:r.type===`ref/resource`?{type:`resourceTemplate`,uriTemplate:r.uri}:{type:`prompt`,name:r.name},argument:e.argument,context:e.context},g6(n));return{_meta:i.metadata,completion:{values:i.values,total:i.total,hasMore:i.hasMore}}})});return s9.set(f,{core:t,notifications:o,notificationDelivery:s}),f});static layer=/*#__PURE__*/ bf(e)(e.make)};const p9=`mcp-session-id`,m9=/*#__PURE__*/ new WeakMap,h9=/*#__PURE__*/ new WeakMap,g9=e=>`${typeof e}:${e}`;var _9=class extends Do{};const v9=/*#__PURE__*/ H(function*(e,t,n,r){let i=yield*mN,a=yield*f9,o=yield*Kd,s=n===`http`,c=/* @__PURE__ */ new Map,l=/* @__PURE__ */ new Map,u=/* @__PURE__ */ new Map,d=e=>{l.delete(e),c.delete(e),t.disconnect(e)},f=(e,t,n)=>i.send(e,{_tag:`Exit`,requestId:t,exit:{_tag:`Failure`,cause:[{_tag:`Fail`,error:n}]}}),p=(e,t)=>{let n=u.get(e);if(n===void 0)return;let r=n.filter(e=>e!==t);r.length===0?u.delete(e):u.set(e,r)},m=yield*Loe(),h=(e,n,r)=>ap(()=>{let a=t.selectProtocol(e),o=a.serverNotificationRpcs.requests.get(r.tag);return o===void 0?up(`MCP protocol ${e} does not define server notification ${r.tag}`):a.payloadCodecs(o).encode(r.payload).pipe(Ep,B(e=>i.send(n,{_tag:`Request`,id:``,tag:r.tag,payload:e,headers:[],isNotification:!0})))}),g=(e,t)=>{let n=l.get(e),r=g9(t),i=n?.get(r);return i!==void 0&&(n.set(r,{...i,cancelled:!0}),!0)},_=(e,t,n,r)=>ap(()=>g(t,n)?s?i.end(t):h(e,t,{tag:`notifications/cancelled`,payload:{requestId:n,reason:r}}):L),v,{core:y,notificationDelivery:b,notifications:x}=s9.get(a),S=r?.handlers??(yield*t.installHandlers({core:y,subscribeServerNotifications:Boe(m),getListChangeRevision:()=>b.listChangeRevision,...!i.supportsNotifications||e.allowSubscriptions===!1?{}:{sendNotification:h,markSubscriptionCancelled:(e,t)=>I(()=>{g(e,t)}),terminateSubscription:_},defaultLogLevel:o,serverInfo:e})),ee=yield*use({lookup:H(function*(e){let n=t.selectProtocol(e.profile.protocolVersion),r,a=yield*sN.make(H(function*(t){let n=0;return r=e=>t(n,e),{send(t,r,a){if(n=t,r._tag===`Request`){let t=g9(r.id),n=u.get(t)??[];return n.push(e),u.set(t,n),i.send(e.clientId,{_tag:`Request`,id:r.id,tag:r.tag,payload:r.payload,headers:[]}).pipe(Xp(()=>I(()=>p(t,e))))}return r._tag===`Interrupt`?(p(g9(r.requestId),e),h(e.profile.protocolVersion,e.clientId,{tag:`notifications/cancelled`,payload:{requestId:r.requestId}})):L},supportsAck:!0,supportsTransferables:!1,supportsStructuredClone:!1,codecFor:i.codecFor}}));return{client:yield*n.makeReverseClient(e.profile).pipe(Wp(sN,a)),write:r}}),idleTimeToLive:1e4}),C=s6.of((e,{client:n,headers:r,payload:i,rpc:a})=>{let s=t.resolveRequest(n.id,r);if(!a._tag.endsWith(`/initialize`)&&!s){let e=xC(),t=ha(e.context,pM);return t&&xM(t,()=>F(fA({status:r[p9]===void 0?400:404}))),up(/* @__PURE__ */ Error(`Mcp-Session-Id does not exist`))}let l=s?.initializePayload??i,u=c.get(n.id),d=s?.protocol??u?.protocol??t.protocolForInternalTag(a._tag);if(!hCe(d.protocolVersion)||d.protocolVersion===`2026-07-28`)return up(`Unsupported selected MCP protocol version: ${d.protocolVersion}`);let f=s?.negotiatedProfile??{protocolVersion:d.protocolVersion,clientCapabilities:l.capabilities,clientInfo:l.clientInfo};u!==void 0&&(u.profile=f);let p=a6.of({clientId:n.id,protocolVersion:f.protocolVersion,clientCapabilities:f.clientCapabilities,clientInfo:f.clientInfo,requestMetadata:l._meta});return Wp(Wp(Wp(e,o6,o6.of({clientId:n.id,protocolVersion:f.protocolVersion,clientCapabilities:f.clientCapabilities,clientInfo:f.clientInfo,initializePayload:l,requestMetadata:rn(i)&&rn(i._meta)?i._meta:void 0,getClient:RT(ee,new _9({clientId:n.id,profile:f})).pipe(V(({client:e})=>e))})),a6,p),Kd,t.effectLogLevel(n.id,r,o))}),te=mN.of({...i,send:(e,t)=>{if(t._tag===`Exit`){let r=l.get(e),a=g9(t.requestId),o=r?.get(a);if(r!==void 0&&r.delete(a)&&r.size===0&&l.delete(e),o?.cancelled===!0)return n===`custom`?L:(o.httpPost!==void 0&&o.httpPost.expected--,m9.set(t,t.requestId),i.send(e,t));if(t.exit._tag===`Failure`&&!t.exit.cause.some(e=>e._tag===`Fail`))return i.send(e,{_tag:`Exit`,requestId:t.requestId,exit:{_tag:`Failure`,cause:[{_tag:`Fail`,error:new P3({message:`Internal error`})}]}})}return i.send(e,t)},run:e=>(v=e,i.run((n,r)=>{let i=xC(),a=r,o=s?ha(i.context,pM):void 0;switch(o!==void 0&&a._tag!==`Eof`&&xM(o,(e,t)=>F(t.status===200&&t.body._tag===`Uint8Array`&&t.body.contentLength===0?fA({headers:kg(t.headers,`content-type`),status:202}):t)),a._tag){case`Request`:{if(o!==void 0&&a.isNotification!==!0){let e=h9.get(o)??{expected:0};e.expected++,h9.set(o,e)}let r=s?_a(xC().context,pM).headers:wg(a.headers),u=a.tag===`notifications/cancelled`&&typeof a.payload==`object`&&a.payload!==null&&`requestId`in a.payload&&(typeof a.payload.requestId==`string`||typeof a.payload.requestId==`number`)?l.get(n)?.get(g9(a.payload.requestId)):void 0,p=u===void 0?t.prepareRequest(n,r,a):F(u.prepared);return R(function*(){let u=yield*p,m=c.get(n);s&&m===void 0&&(yield*$d(_a(i.context,Jd),I(()=>d(n))));let h=u.binding,_=u.protocol;if(c.set(n,{protocol:_,profile:u.profile??m?.profile,sessionHeaders:s&&r[p9]!==void 0?wg({[p9]:r[p9]}):m?.sessionHeaders}),a.tag===`invalid/json-rpc-batch`)return yield*f(n,a.id,new j3({message:`JSON-RPC batches are not supported`}));o!==void 0&&h!==void 0&&xM(o,(e,i)=>F(t.resolveRequest(n,r)===void 0?fA({status:404}):SA(i,`mcp-protocol-version`,h.protocol.protocolVersion)));let v=t.routeClientRequest(_,a),y=t.clientRpcs.requests.get(v.tag),b=_.clientNotificationRpcs.requests.has(a.tag);if(y&&b&&a.isNotification){if(!h&&_.runtime._tag===`Stateful`){o&&xM(o,()=>F(fA({status:r[p9]===void 0?400:404})));return}let t=_.payloadCodecs(y).decode(a.payload);return yield*R(function*(){let i=yield*t;if(a.tag===`notifications/cancelled`){let t=yield*_.normalizeCancellation(i),r=g9(t.requestId),a=n;if(s){if(h===void 0)return;let e=Array.from(l).find(([,e])=>e.get(r)?.prepared.binding===h);if(e===void 0)return;a=e[0]}return g(a,t.requestId)?yield*e(a,{_tag:`Interrupt`,requestId:t.requestId}):void 0}let o=S.mapUnsafe.get(y.key),c=o?o.handler(i,{rpc:y,requestId:XM(a.id),client:new GM(n),headers:r}):L;return yield*u.requestContext===void 0?c:Wp(c,a6,u.requestContext)}).pipe(Ap)}if(!y||b)return a.isNotification?void 0:yield*f(n,a.id,new M3({message:`Method not found: ${a.tag}`}));let x=yield*gp(_.payloadCodecs(y).decode(a.payload));if(Na(x))return yield*a.isNotification?L:f(n,a.id,new N3({message:`Invalid method parameters`}));if(a.isNotification!==!0){let e=l.get(n)??/* @__PURE__ */ new Map;e.set(g9(a.id),{requestId:XM(a.id),prepared:u,cancelled:!1,httpPost:o===void 0?void 0:h9.get(o)}),l.set(n,e)}let ee=e(n,v);return yield*u.requestContext===void 0?ee:Wp(ee,a6,u.requestContext)}).pipe(bp(e=>a.isNotification?L:f(n,a.id,on(e,`ProtocolError`)?S6.fromFeature(e):new N3({message:`Invalid request metadata`}))))}case`Ping`:case`Ack`:case`Interrupt`:return e(n,a);case`Eof`:return s||d(n),e(n,a);case`Pong`:case`Exit`:case`Chunk`:case`ClientProtocolError`:case`Defect`:{let e=a._tag===`Exit`?g9(a.requestId):void 0,r=s?t.resolveRequest(n,_a(xC().context,pM).headers):void 0,i=(e===void 0?void 0:u.get(e))?.find(e=>s?e.profile===r?.negotiatedProfile:e.clientId===n);if(a._tag===`Exit`&&i===void 0)return L;i!==void 0&&e!==void 0&&p(e,i);let o=i?.clientId??n,l=c.get(o),d=l?.protocol??t.protocols[0],f=i?.profile??l?.profile??{protocolVersion:d.protocolVersion,clientCapabilities:{},clientInfo:{name:`unknown`,version:`unknown`}};return RT(ee,new _9({clientId:o,profile:f})).pipe(B(({write:e})=>e(a)),Kp)}}}))});s&&(yield*t.onSessionTerminated(e=>{let t=[];for(let[n,r]of l)for(let{prepared:i,requestId:a}of r.values())i.binding===e&&g(n,a)&&t.push(v(n,{_tag:`Interrupt`,requestId:a}));return $f(t,{discard:!0})})),r===void 0&&(yield*qp(I(()=>{b.consumers++}),()=>I(()=>{b.consumers--})));let ne=/* @__PURE__ */ new Map;return yield*$C(r?.notifications??x).pipe(B(H(function*(e){let{delivered:n,listChangeRevision:r,notification:i,targetClientId:a,requestContext:l,requestHeaders:u}=e;E6(i)&&(yield*zoe(m,{notification:i,targetClientId:a,listChangeRevision:r}));let d=yield*te.clientIds;for(let e of c.keys())d.has(e)||(c.delete(e),t.disconnect(e));let f=l9(i),p=f&&l!==void 0?[l.clientId]:a===void 0?s?c.keys():t.deliveryClientIds():[a],h=[],g=!1;for(let e of p){if(a!==void 0&&e!==a)continue;if(!d.has(e)){t.disconnect(e);continue}if(!te.supportsNotifications)continue;let r=f&&l!==void 0?t.selectProtocol(l.protocolVersion):c.get(e)?.protocol;if(!r)continue;let s=ne.get(e),p=e===(a??l?.clientId);g||=p;let m=p?n:Fd();ne.set(e,m);let _=R(function*(){s!==void 0&&(yield*Ld(s));let n=yield*r.projectNotification(i);if(n===void 0||i._tag===`Progress`&&r.runtime._tag===`Stateless`&&l?.requestMetadata?.progressToken!==i.progressToken)return;if(i._tag===`LoggingMessage`&&r.runtime._tag===`Stateless`){let t=l?.requestMetadata,n=N(t,`io.modelcontextprotocol/logLevel`)?t[`io.modelcontextprotocol/logLevel`]:void 0;if(l?.clientId!==e||!u9(n)||Z3.literals.indexOf(i.level)<Z3.literals.indexOf(n))return}else if(!t.canDeliver(e,(l?.clientId===e?u:void 0)??c.get(e)?.sessionHeaders??Cg,i,o))return;let a=r.serverNotificationRpcs.requests.get(n.tag);if(!a)return;let d=yield*r.payloadCodecs(a).encode(n.payload);yield*te.send(e,{_tag:`Request`,id:``,tag:n.tag,payload:d,headers:[],isNotification:!0})}).pipe(Ap,Yp(I(()=>{Wd(m,Ed),ne.get(e)===m&&ne.delete(e)})));h.push(_)}g||(yield*Ud(n,void 0)),yield*$f(h,{concurrency:`unbounded`,discard:!0}).pipe(fm({startImmediately:!0}))})),Ap,am,fm),yield*Ile(t.clientRpcs,{spanPrefix:`McpServer`,disableFatalDefects:!0}).pipe(Wp(mN,te),Wp(s6,C),zp(S))},Kp),sCe=(e,t)=>Cf(R(function*(){let n=yield*B6;yield*fm(v9(e,n,t))})).pipe(jf(f9.layer)),cCe=e=>{let t=H6(e.protocols);return sCe(e,`http`).pipe(Af(uCe(e)),Af(t),Af(Tle()))},lCe=e=>Cf(R(function*(){let t=yield*B6,n=t.protocols.find(e=>e.runtime._tag===`Stateful`);if(n!==void 0)return yield*new hd(`McpServer.layerHttpRequestScoped does not support the sessionful MCP protocol ${n.protocolVersion}`);let r=yield*f9,{core:i,notificationDelivery:a}=s9.get(r),o=yield*t.installHandlers({core:i,subscribeServerNotifications:up(`Subscriptions are disabled for request-scoped MCP servers`),getListChangeRevision:()=>a.listChangeRevision,defaultLogLevel:yield*Kd,serverInfo:e});yield*qp(I(()=>{a.requestEndpoints++}),()=>I(()=>{a.requestEndpoints--})),yield*y9(e,R(function*(){let{httpEffect:n,protocol:i}=yield*hN().pipe(Wp(eN,b9)),a=yield*LC();return yield*v9(e,t,`http`,{notifications:a,handlers:o}).pipe(Wp(mN,i),Wp(f9,r),fm({startImmediately:!0})),yield*Wp(n,c9,a)}))})).pipe(jf(f9.layer),Af(H6(e.protocols))),uCe=e=>bf(mN)(R(function*(){let{httpEffect:t,protocol:n}=yield*hN().pipe(Wp(eN,b9));return yield*y9(e,t),n})),y9=/*#__PURE__*/ H(function*(e,t){let n=yield*B6,r=yield*CM,i=e.allowSessionTermination===!0&&n.protocols.some(e=>e.runtime._tag===`Stateful`),a=F(fA({status:403})),o=t=>n=>S9(n,e.allowedOrigins)?t(n):a,s=F(fA({status:405,headers:{allow:i?`POST, DELETE`:`POST`}})),c=o(()=>s);for(let t of[`GET`,`PUT`,`PATCH`,`OPTIONS`])yield*r.add(t,e.path,c);yield*r.add(`DELETE`,e.path,i?o(e=>n.terminateHttpSession(e.headers)):c),yield*r.add(`POST`,e.path,r=>{if(!S9(r,e.allowedOrigins))return F(fA({status:403}));if(C9(r.headers[`content-type`])[0]!==`application/json`)return F(fA({status:415}));let i=C9(r.headers.accept);return!i.includes(`application/json`)||!i.includes(`text/event-stream`)?F(fA({status:406})):R(function*(){let e=yield*gp(B(r.text,Px(HS))),i=n.admitHttp(r.headers,e);if(i._tag===`Rejected`)return i.response;let a=e=>{let t=e.body._tag===`Uint8Array`&&e.body.body.subarray(0,-1).includes(10);return i.isSubscription||e.body._tag===`Stream`||t?pCe(e,i.isSubscription):e};return i.acknowledge?yield*Sp(V(t,a),()=>F(fA({status:202}))):yield*B(t,e=>e.body._tag!==`Uint8Array`||e.body.body.length>0?F(a(e)):h9.get(r)?.expected===0?F(xA(YT,{contentType:`text/event-stream`})):up(/* @__PURE__ */ Error(`MCP request ended without writing its response`)))})})}),b9=/*#__PURE__*/ (()=>{let e=/*#__PURE__*/ fCe();return eN.of({contentType:e.contentType,includesFraming:!0,codecFor:e.codecFor,makeUnsafe:()=>{let t=e.makeUnsafe();return{decode:t.decode,encode:e=>{let n=t.encode(e);return typeof n==`string`?`${n}\n`:n}}}})})(),dCe=/*#__PURE__*/ Mx(/*#__PURE__*/ hS(`Cause`,{data:/*#__PURE__*/ Soe([/*#__PURE__*/ hS(`Fail`,{error:/*#__PURE__*/ voe(F3)})])})),x9=e=>Array.isArray(e)?e.map(x9):!rn(e)||!N(e,`error`)?e:dCe(e.error)?{...e,error:e.error.data[0].error}:e;function fCe(e){let t=tN(e);return eN.of({...t,makeUnsafe:()=>{let e=t.makeUnsafe(),n=/* @__PURE__ */ new Set;return{decode:e.decode,encode:t=>{if(rn(t)){let e=m9.get(t);e!==void 0&&(m9.delete(t),n.add(e))}let r=e.encode(t);if(typeof r!=`string`||n.size===0&&!r.includes(`"_tag":"Cause"`))return r;let i=JSON.parse(r);if(n.size>0){let e=e=>!(rn(e)&&!N(e,`method`)&&(typeof e.id==`string`||typeof e.id==`number`)&&n.delete(e.id));if(Array.isArray(i)){let t=i.filter(e);if(t.length===0)return;i=t}else if(!e(i))return}return JSON.stringify(x9(i))}}}})}const pCe=(e,t)=>{let n=new TextEncoder,r=new TextDecoder,i=e=>n.encode(r.decode(e).trimEnd().split(`
 `).map(e=>`data: ${e}\n\n`).join(``)),a={status:e.status,statusText:e.statusText,headers:kg(e.headers,`content-type`),cookies:e.cookies,contentType:`text/event-stream`};if(e.body._tag===`Stream`){let r=e.body.stream.pipe(eE(i));if(!t)return xA(r,a);let o=xse(`15 seconds`).pipe(jse(1),eE(()=>n.encode(`: keepalive
-`)));return xA(nE(r,o,{haltStrategy:`left`}),a)}return e.body._tag===`Uint8Array`?mA(i(e.body.body),a):SA(e,`content-type`,`text/event-stream`)},S9=(e,t)=>{let n=e.headers.origin;return n===void 0||(t??[]).includes(n)},C9=e=>e===void 0?[]:e.split(`,`).flatMap(e=>{let[t,...n]=e.split(`;`),r=n.map(e=>e.trim().toLowerCase()).find(e=>e.startsWith(`q=`));if(r!==void 0){let e=Number(r.slice(2));if(!Number.isFinite(e)||e<=0||e>1)return[]}return[t.trim().toLowerCase()]}),mCe=()=>{let e=tA({ignoreTrailingSlash:!0,ignoreDuplicateSlashes:!0,caseSensitive:!0});return{add:(t,n)=>{e.on(`GET`,`/${t}`,n)},find:t=>e.find(`GET`,`/${t}`)}},hCe=e=>e===`2024-11-05`||e===`2025-03-26`||e===`2025-06-18`||e===`2025-11-25`||e===`2026-07-28`,w9=o9,gCe=[o9,rCe,iCe],_Ce=Mx(JI),vCe=Mx(G(JI)),T9=e=>XI(NI(e)),E9=e=>{let t=NI(e),n=XI(t);if(n!==void 0)return{kind:n,many:!1};if(!Nv(t)||t.encoding!==void 0)return;let[r,...i]=new Set([...t.elements,...t.rest].map(T9));return r===void 0||i.length>0?void 0:{kind:r,many:!0}},yCe=e=>{let t=e.context?.isOptional===!0,n=NI(e);if(t&&Fv(n)&&n.types.length===2){let[e,...t]=n.types.filter(e=>!Sie(e)),r=e===void 0||t.length>0?void 0:T9(e);return r===void 0?void 0:{kind:r,many:!1}}let r=E9(n);return r===void 0||t&&r.many?void 0:r},D9=e=>{let t=NI(e.ast),n=E9(t);if(n!==void 0)return{fields:[{name:void 0,...n}],rest:void 0};if(!Pv(t)||t.encoding!==void 0)return{fields:[],rest:e};let r=t.propertySignatures.flatMap(({name:e,type:t})=>{let n=yCe(t);return n===void 0?[]:[{name:String(e),...n}]});if(r.length===0)return{fields:r,rest:e};let i=new Set(r.map(({name:e})=>e)),a=t.propertySignatures.filter(({name:e})=>!i.has(e)),{identifier:o,...s}=t.annotations??{};return{fields:r,rest:a.length===0&&t.indexSignatures.length===0?void 0:Bx(new ly(a,t.indexSignatures,s))}},bCe=e=>[...kv(e)?e.typeParameters:[],...Nv(e)?[...e.elements,...e.rest]:[],...Pv(e)?[...e.propertySignatures,...e.indexSignatures].map(({type:e})=>e):[],...Fv(e)?e.types:[],...Iv(e)?[e.thunk()]:[],...(e.encoding??[]).map(({to:e})=>e)],xCe=e=>{let t=/* @__PURE__ */ new Set,n=[e];for(let e=n.pop();e!==void 0;e=n.pop())if(!t.has(e)){if(t.add(e),YI(e))return!0;n.push(...bCe(e))}return!1},SCe=(e,{rest:t})=>[e.input,...e.error,...t===void 0?[]:[t]].some(({ast:e})=>xCe(e)),CCe=(e,t)=>e.fields.flatMap(({name:e,kind:n,many:r})=>{let i=e===void 0?t:N(t,e)?t[e]:void 0;return(r?vCe(i)?i:[]:_Ce(i)?[i]:[]).map(t=>({kind:n,field:e,value:t}))}),wCe=Mx(K3),O9=(e,t)=>{let n=pC(e,{onExcessProperty:t?`error`:`ignore`}),[r,i]=Ut(n.schema.$ref)?Jb(n.schema.$ref)??[]:[],a=r===`$defs`&&i!==void 0?n.definitions[i]:n.schema;return a===void 0||Object.keys(n.definitions).length===0?a:{...a,$defs:n.definitions}},TCe=e=>{let t=e.map(([e])=>e).filter(e=>!wCe(O9(mC(e.input),!0))).map(({name:e})=>e);if(t.length>0)throw Error(`MCP tool input must be one object with keys, such as a struct: ${t.join(`, `)}`);let n=e.filter(([e,t])=>SCe(e,t)).map(([{name:e}])=>e);if(n.length>0)throw Error(`MCP media must be the success or an array of it, or a top-level field of a struct success, one, optional or a required array: ${n.join(`, `)}`)},ECe=e=>new Y3({isError:!0,content:[{type:`text`,text:e}]}),k9=e=>e===void 0?[]:[{type:`text`,text:JSON.stringify(e)}],DCe=({kind:e,field:t,value:n})=>({type:e,data:n.data,mimeType:n.mimeType,...t===void 0?{}:{_meta:{"effect-actions/field":t}}}),OCe=(e,t)=>V(Nx(K3)(O9(mC(e.input),!0)),n=>new J3({name:e.name,description:e.description,inputSchema:n,outputSchema:t,annotations:{...e.mcp.title===void 0?{}:{title:e.mcp.title},...ube(e)},_meta:e.mcp._meta===void 0?void 0:{...e.mcp._meta}})),kCe=H(function*(e,t){let n=yield*f9,r=yield*GI(e),i=yield*Lp(),a=e=>Cm(e).pipe(mp(Sce(e)),vp(ECe(`Tool execution failed due to an internal server error.`))),o=e=>sd(e)?a(e):cp(e);for(let[e,a]of r){let r=D9(e.success),s=r.fields.length===0?void 0:r,c=s===void 0?mC(e.success):s.rest===void 0?void 0:mC(s.rest),l=c===void 0?void 0:yield*Nx(q3)(O9(c,!1)).pipe(Ep),u=yield*OCe(e,l).pipe(Ep),d=Nx(mC(e.input),KI),f=e=>{let t=Ix(mC(e));return e=>Ep(t(e))},p=f(e.success),m=f(K(II(e))),h=t===void 0||e.caller===SI?a:e=>OB(lfe(t,a(e))),g=new Set(s?.fields.map(({name:e})=>e)),_=(e,t)=>{if(s===void 0)return new Y3({isError:!1,structuredContent:e,content:k9(e)});let n=CCe(s,t).map(DCe);if(c===void 0)return new Y3({isError:!1,content:n});let r=nn(e)?Object.fromEntries(Object.entries(e).filter(([e])=>!g.has(e))):e;return new Y3({isError:!1,structuredContent:r,content:[...k9(r),...n]})};yield*n.addTool({tool:u,annotations:la(),handle:t=>iie({tool:e.name,parameters:t??{}}).pipe(mp(()=>d(t??{})),Tp(({message:t})=>new N3({message:new dbe({toolName:e.name,description:t}).message})),B(e=>h(e).pipe(Ip({onFailure:e=>V(m(e),e=>new Y3({isError:!0,content:k9(e)})),onSuccess:e=>V(p(e),t=>_(t,e))}))),Sp(o),Up(e=>Ca(i,e)))})}}),ACe=(e,t,n=yf,r)=>{MI(`MCP tool`,e.flatMap(e=>e.actions));let i=e.flatMap(e=>e.actions.map(e=>[e,D9(e.success)]));TCe(i);let a=new Set(i.map(([{name:e}])=>e)),o=R(function*(){let t=(yield*f9).tools.flatMap(({tool:e})=>a.has(e.name)?[e.name]:[]);if(t.length>0)return yield*up(/* @__PURE__ */ Error(`Duplicate MCP tool: ${t.join(`, `)}, claimed by an action and a native feature`));yield*kCe(e,r)});return Cf(o).pipe(Af(n),Af(t),Sre,WI(e))},jCe=/* @__PURE__ */ new Set([`server/discover`,`tools/list`,`notifications/cancelled`]),MCe=e=>{let t=new Set(e.filter(({caller:e})=>e===SI).flatMap(({name:e})=>[e,`=?base64?${Dh(e)}?=`]));return e=>{if(t.size===0||e[`mcp-protocol-version`]!==w9.protocolVersion)return!0;let n=e[`mcp-method`];if(n===void 0)return!0;if(jCe.has(n))return!1;if(n!==`tools/call`)return!0;let r=e[`mcp-name`];return r===void 0||!t.has(r)}},NCe=e=>Pp(e.json,{onFailure:()=>!0,onSuccess:t=>!N(t,`method`)||t.method===e.headers[`mcp-method`]});function PCe(e,{actions:t,features:n,path:r=`/mcp`,authentication:i,requestScoped:a,allowSubscriptions:o=n!==void 0,...s}){let c=UI(VI(e),t),l=c.flatMap(e=>e.actions);CI(l,i);let u=ACe(c,a===!0?lCe({...s,path:r,protocols:[w9]}):cCe({...s,path:r,protocols:gCe,allowSessionTermination:!0,allowSubscriptions:o}),n,i);if(i===void 0)return u;let d=MCe(l),f=MM(V(tL(i),e=>t=>B(pM,n=>n.method!==`POST`||d(n.headers)?e.http(t,!1):B(NCe(n),n=>e.http(t,n)))));return u.pipe(Af(f.layer))}var FCe=`0.26.1`;const ICe=(e,t)=>rp(()=>LW({key:e,data:t})),LCe=(e,t)=>rp(()=>RW({key:e,data:t})),RCe=async(e,t)=>(await Promise.all([GG(e.authCookies.sessionToken.name,t,e.secret),GG(e.authCookies.dontRememberToken.name,`true`,e.secret)])).map(e=>e.split(`;`)[0]).join(`; `),zCe=(e,t)=>ym(`OwnerAccount.providerSession`)(function*(n){let r=new Date((yield*Nf)+6e4),i=yield*qp(H4(()=>e.internalAdapter.createSession(n,!0,{expiresAt:r},!0)),t=>np(()=>e.internalAdapter.deleteSession(t.token))),a=yield*H4(()=>RCe(e,i.token));return new Headers({origin:t,cookie:a})}),BCe=eH(W({id:U}));var A9=class e extends P()(`clankerauth/OwnerAccount`){static layer=bf(e,R(function*(){let{sql:e}=yield*iH,{auth:t,context:n}=yield*i3,{baseURL:r}=yield*X4,i=yield*Sw(1),a=zCe(n,r),o=ym(`OwnerAccount.find`)(function*(){let t=yield*e`SELECT id FROM user LIMIT 1`;if(t.length)return(yield*BCe(t[0])).id});return{find:o,create:ym(`OwnerAccount.create`)(function*(e){if(yield*o())return yield*z(eV.of());let{headers:n}=yield*H4(()=>t.api.signUpEmail({body:{name:`Owner`,email:e.email.trim(),password:e.password},returnHeaders:!0}),{refused:B4,conflict:eV.of});return n.getSetCookie()},e=>i.withPermit(e)),caller:(e,t,n)=>({userId:e,email:t,writable:n,providerHeaders:a(e)})}}))},j9=class extends P()(`clankerauth/ResponseCookies`){};const VCe=V(A9,e=>({setupStatus:()=>e.find().pipe(V(e=>({required:!e}))),setupOwner:ym(`Administration.setup`)(function*(t){let n=yield*e.create(t);return yield*(yield*j9).add(n),{created:!0}})}));var M9=class extends jo(`Unauthorized`){constructor(e={}){super({message:e.message??`Authentication required`}),Object.defineProperty(this,"cause",{value:e.cause})}},N9=class extends fC()(`ProviderUnavailable`,{operation:U},{httpApiStatus:503}){constructor(e){super({operation:e.operation}),Object.defineProperty(this,"cause",{value:e.cause})}},P9=class extends jo(`InsufficientScope`){},HCe=class extends fC()(`ConfigurationError`,{message:U}){};const F9=vo(1),I9=(e,t)=>Rp(n=>yk(e).execute(t).pipe(Wp(PN,{...ha(n,PN),redirect:`manual`}),Tp(e=>new N9({operation:`http.request`,cause:e})),$re(e=>e.status<300||e.status>=400,e=>new N9({operation:`http.redirect`,cause:{status:e.status}})))),UCe=W({keys:G(W({kty:U,crv:Hx(U),x:Hx(U),kid:Hx(U),alg:Hx(U),use:Hx(U),key_ops:Hx(G(U))}))}),WCe=W({sub:IS,client_id:IS,scope:U,iat:CS,exp:CS}),GCe=W({list:U}),KCe=zde.pipe(eS({exp:CS})),qCe=()=>({jwks:/* @__PURE__ */ new Map,keyLists:/* @__PURE__ */ new Map}),L9=e=>new M9({cause:e}),JCe=vo(1),R9=_o(5),YCe=_o(3),z9=e=>t=>jp(t,{duration:YCe,orElse:()=>z(new N9({operation:e}))}),B9=ym(`Verifier.make`)(function*(e){let t=yield*fk,n=JSON.stringify([e.issuer,e.resource]),r=yield*dp({try:()=>({jwks:new URL(`${e.issuer}/jwks`).href,keyList:new URL(`/api/keyList`,e.issuer).href}),catch:()=>new HCe({message:`Invalid issuer URL`})}),i=ym(`Verifier.jwks`)(function*(){let e=yield*I9(t,jO(r.jwks));return e.status===200?(yield*KO(UCe)(e).pipe(Tp(e=>new N9({operation:`jwks.decode`,cause:e})))).keys.map(({key_ops:e,...t})=>e?{...t,key_ops:[...e]}:t):yield*new N9({operation:`jwks.fetch`,cause:{status:e.status}})},Kp),a=R(function*(){let t=e.store.jwks.get(e.issuer),n=yield*Nf;if(t!==void 0){let e=`keys`in t?JCe:R9;if(n-t.readAt<yo(e))return`keys`in t?t.keys:yield*new N9({operation:t.failure})}let r=yield*gp(i()),a=yield*Nf;return Pa(r)?(e.store.jwks.set(e.issuer,{readAt:a,keys:r.success}),r.success):((e.store.jwks.get(e.issuer)?.readAt??-1/0)>=n||e.store.jwks.set(e.issuer,{readAt:a,failure:r.failure.operation}),yield*r.failure)}),o=ym(`Verifier.signingKey`)(function*(e,t){let n={keys:[...yield*t]};return yield*rp({try:()=>dI(n)({alg:`EdDSA`,kid:e}),catch:L9})}),s=ym(`Verifier.signed`)(function*(t,n,r=a){let i=yield*dp({try:()=>gI(t),catch:L9});if(i.alg!==`EdDSA`||i.kid===void 0)return yield*L9();let s=yield*o(i.kid,r),c=yield*Nf,{payload:l}=yield*rp({try:()=>nI(t,s,{issuer:e.issuer,audience:e.resource,algorithms:[`EdDSA`],typ:n,currentDate:new Date(c)}),catch:L9});return l}),c=ym(`Verifier.jwt`)(function*(e){let t=yield*s(e,`at+jwt`);if(t.cnf!==void 0)return yield*L9();let n=yield*Nx(WCe)(t).pipe(Tp(L9));return{subject:n.sub,scopes:n.scope.split(` `).filter(Boolean),actor:{kind:`client`,clientId:n.client_id},expiresAt:n.exp*1e3}}),l=ym(`Verifier.keyList`)(function*(){let n=MO(r.keyList).pipe(UO({resource:e.resource})),{list:i}=yield*R(function*(){let e=yield*I9(t,n);return e.status===200?yield*KO(GCe)(e).pipe(Tp(e=>new N9({operation:`key-list.decode`,cause:e}))):yield*new N9({operation:`key-list.fetch`,cause:{status:e.status}})}).pipe(z9(`key-list.timeout`)),o=e=>new N9({operation:`key-list.verify`,cause:e}),c=yield*s(i,vI,a.pipe(z9(`jwks.timeout`))).pipe(xp(`Unauthorized`,e=>z(o(e)))),l=yield*Nx(KCe)(c).pipe(Tp(o));return{readAt:yield*Nf,expiresAt:l.exp*1e3,entries:new Map(l.keys.map(e=>[e.id,e.sealed]))}},Kp),u=R(function*(){let t=e.store.keyLists.get(n),r=yield*Nf;if(t!==void 0&&r-t.readAt<yo(R9))return t.failure===void 0?void 0:yield*new N9({operation:t.failure});let i=yield*gp(l()),a=yield*Nf,o=e.store.keyLists.get(n),s=o?.failure!==void 0;if(Pa(i)){e.store.keyLists.set(n,{readAt:a,failure:void 0,held:i.success}),s&&(yield*wm(`clankerauth key list reads have recovered`));return}if((o?.readAt??-1/0)>=r)return yield*i.failure;let{operation:c}=i.failure;return e.store.keyLists.set(n,{readAt:a,failure:c,held:o?.held}),s||(yield*Sm(`clankerauth key list reads are failing; a held list decides until it expires`,{operation:c})),yield*i.failure}),d=R(function*(){let t=yield*gp(u),r=e.store.keyLists.get(n)?.held;return r!==void 0&&r.expiresAt>(yield*Nf)?r:yield*Na(t)?t.failure:new N9({operation:`key-list.expired`})}),f=ym(`Verifier.apiKey`)(function*(t){let r=n=>rp({try:()=>Hde(t,e.resource,n.entries),catch:L9}),i=yield*Nf,a=e.store.keyLists.get(n)?.held,o=a!==void 0&&i-a.readAt<yo(F9)&&a.expiresAt>i?a:yield*d,s=(yield*r(o))??(yield*B(d,e=>e===o?F(void 0):r(e)));return s===void 0||s.expiresAt!==null&&s.expiresAt<=(yield*Nf)?yield*L9():{subject:s.ownerId,scopes:s.scopes,actor:{kind:`key`,keyId:s.keyId},expiresAt:s.expiresAt??void 0}});return{verifyToken:ym(`Verifier.verifyToken`)(function*(t){let n=yield*t.startsWith(`clankerauth_`)?e.apiKeys===!1?z(L9()):f(t):c(t),r=e.requiredScopes?.find(e=>!n.scopes.includes(e));return r===void 0?n:yield*new P9({scope:r,actor:n.actor})})}}),XCe=ym(`AdministrationResource.make`)(function*(){let{auth:e}=yield*i3,{baseURL:t}=yield*X4,n=`${t}/api/auth`,r=cV(t);return{protectedResource:{resource:r,authorizationServers:[n],scopesSupported:[lV.read,lV.write,...Q4],scopesRequired:[lV.read,lV.write]},verifier:yield*B9({issuer:n,resource:r,store:qCe(),apiKeys:!1}).pipe(zp(FN.pipe(Af(_f(NN,(t,n)=>{let r=new Request(t,n);return r.headers.set(F4,`127.0.0.1`),e.handler(r)})))))}});QI(`whoami`,{description:`The verified subject, issuer and scopes behind this request's credential.`,readOnly:!0,caller:class extends P()(`@clankerauth/CurrentPrincipal`){},success:W({subject:IS,issuer:IS,scopes:G(U)})});const V9=(e,t)=>{let n=`Requires ${e}.`;return t.kind===`client`?new OI({message:n,scopes:[e]}):new OI({message:n})},ZCe=(e,t)=>t===void 0||e.scopes.includes(t)?void 0:V9(t,e.actor),H9=e=>e instanceof M9?new EI({message:e.message}):e instanceof P9?V9(e.scope,e.actor):e,U9=(e,t)=>Tp(e.verifyToken(_g(t)),H9);ym(`Resource.layer`)(function*(e,{scopes:t,required:n},r){let i=new URL(`/`,r.publicUrl).href,a={resource:i,authorizationServers:[r.issuer],scopesSupported:t,scopesRequired:[n]},o=r.discovery===!1?void 0:a,s=yield*B9({issuer:r.issuer,resource:i,store:r.store,requiredScopes:[n],apiKeys:r.apiKeys}),c=e=>jp(e,{duration:`5 seconds`,orElse:()=>z(new N9({operation:`verify.timeout`}))}),l={verifyToken:e=>c(s.verifyToken(e))},u=ym(`Resource.principal`)(function*(e,t){let n=jB(e);if(Fi(n))return yield*new EI({message:`A bearer token is required.`});let r=yield*U9(l,n.value),i=ZCe(r,t);return i===void 0?r:yield*i}),d=ym(`Resource.admit`)(function*(t,n){let r=yield*gp(u(t,n));if(Pa(r))return{ok:!0,principal:r.success};let i=jA(RB(r.failure,{authentication:e,protectedResource:o,authorization:t}));return{ok:!1,refusal:{status:i.status,headers:Object.fromEntries(i.headers),body:yield*np(()=>i.text())}}});return{resource:i,issuer:r.issuer,protectedResource:o,verifier:l,admit:d,watch:(e,t)=>am(R(function*(){let n=yield*u(e,t),r=yield*Nf,i=Math.max(0,(n.expiresAt??1/0)-r);return n.actor.kind===`key`?yield*Mp(Math.min(i,yo(F9))):(yield*Mp(i),yield*H9(new M9))}))}});const QCe=e=>qB(e,V(i3,e=>()=>R(function*(){let t=yield*pM,n=new Headers(t.headers),r=yield*H4(()=>e.auth.api.getSession({headers:n}),{unavailable:V4});return r?{providerHeaders:F(n),userId:r.user.id,email:r.user.email,writable:!0}:yield*new EI({message:`Owner session required`})}))),$Ce=eH(W({id:U,email:U})),ewe=e=>qB(sV,R(function*(){let{sql:t}=yield*iH,n=yield*A9,r=()=>new EI({message:`Owner authorization required`});return i=>R(function*(){let a=yield*U9(e.verifier,i).pipe(xp(`ProviderUnavailable`,()=>z(new YB({message:`Request could not be completed`}))));if(a.actor.kind!==`client`)return yield*r();let o=a.scopes.includes(lV.write);if(!o&&!a.scopes.includes(lV.read))return yield*new OI({message:`Insufficient scope`,scopes:[lV.read]});let s=yield*t`SELECT u.id, u.email FROM user u
+`)));return xA(nE(r,o,{haltStrategy:`left`}),a)}return e.body._tag===`Uint8Array`?mA(i(e.body.body),a):SA(e,`content-type`,`text/event-stream`)},S9=(e,t)=>{let n=e.headers.origin;return n===void 0||(t??[]).includes(n)},C9=e=>e===void 0?[]:e.split(`,`).flatMap(e=>{let[t,...n]=e.split(`;`),r=n.map(e=>e.trim().toLowerCase()).find(e=>e.startsWith(`q=`));if(r!==void 0){let e=Number(r.slice(2));if(!Number.isFinite(e)||e<=0||e>1)return[]}return[t.trim().toLowerCase()]}),mCe=()=>{let e=tA({ignoreTrailingSlash:!0,ignoreDuplicateSlashes:!0,caseSensitive:!0});return{add:(t,n)=>{e.on(`GET`,`/${t}`,n)},find:t=>e.find(`GET`,`/${t}`)}},hCe=e=>e===`2024-11-05`||e===`2025-03-26`||e===`2025-06-18`||e===`2025-11-25`||e===`2026-07-28`,w9=o9,gCe=[o9,rCe,iCe],_Ce=Mx(JI),vCe=Mx(G(JI)),T9=e=>XI(NI(e)),E9=e=>{let t=NI(e),n=XI(t);if(n!==void 0)return{kind:n,many:!1};if(!Nv(t)||t.encoding!==void 0)return;let[r,...i]=new Set([...t.elements,...t.rest].map(T9));return r===void 0||i.length>0?void 0:{kind:r,many:!0}},yCe=e=>{let t=e.context?.isOptional===!0,n=NI(e);if(t&&Fv(n)&&n.types.length===2){let[e,...t]=n.types.filter(e=>!Sie(e)),r=e===void 0||t.length>0?void 0:T9(e);return r===void 0?void 0:{kind:r,many:!1}}let r=E9(n);return r===void 0||t&&r.many?void 0:r},D9=e=>{let t=NI(e.ast),n=E9(t);if(n!==void 0)return{fields:[{name:void 0,...n}],rest:void 0};if(!Pv(t)||t.encoding!==void 0)return{fields:[],rest:e};let r=t.propertySignatures.flatMap(({name:e,type:t})=>{let n=yCe(t);return n===void 0?[]:[{name:String(e),...n}]});if(r.length===0)return{fields:r,rest:e};let i=new Set(r.map(({name:e})=>e)),a=t.propertySignatures.filter(({name:e})=>!i.has(e)),{identifier:o,...s}=t.annotations??{};return{fields:r,rest:a.length===0&&t.indexSignatures.length===0?void 0:Bx(new ly(a,t.indexSignatures,s))}},bCe=e=>[...kv(e)?e.typeParameters:[],...Nv(e)?[...e.elements,...e.rest]:[],...Pv(e)?[...e.propertySignatures,...e.indexSignatures].map(({type:e})=>e):[],...Fv(e)?e.types:[],...Iv(e)?[e.thunk()]:[],...(e.encoding??[]).map(({to:e})=>e)],xCe=e=>{let t=/* @__PURE__ */ new Set,n=[e];for(let e=n.pop();e!==void 0;e=n.pop())if(!t.has(e)){if(t.add(e),YI(e))return!0;n.push(...bCe(e))}return!1},SCe=(e,{rest:t})=>[e.input,...e.error,...t===void 0?[]:[t]].some(({ast:e})=>xCe(e)),CCe=(e,t)=>e.fields.flatMap(({name:e,kind:n,many:r})=>{let i=e===void 0?t:N(t,e)?t[e]:void 0;return(r?vCe(i)?i:[]:_Ce(i)?[i]:[]).map(t=>({kind:n,field:e,value:t}))}),wCe=Mx(K3),O9=(e,t)=>{let n=pC(e,{onExcessProperty:t?`error`:`ignore`}),[r,i]=Ut(n.schema.$ref)?Jb(n.schema.$ref)??[]:[],a=r===`$defs`&&i!==void 0?n.definitions[i]:n.schema;return a===void 0||Object.keys(n.definitions).length===0?a:{...a,$defs:n.definitions}},TCe=e=>{let t=e.map(([e])=>e).filter(e=>!wCe(O9(mC(e.input),!0))).map(({name:e})=>e);if(t.length>0)throw Error(`MCP tool input must be one object with keys, such as a struct: ${t.join(`, `)}`);let n=e.filter(([e,t])=>SCe(e,t)).map(([{name:e}])=>e);if(n.length>0)throw Error(`MCP media must be the success or an array of it, or a top-level field of a struct success, one, optional or a required array: ${n.join(`, `)}`)},ECe=e=>new Y3({isError:!0,content:[{type:`text`,text:e}]}),k9=e=>e===void 0?[]:[{type:`text`,text:JSON.stringify(e)}],DCe=({kind:e,field:t,value:n})=>({type:e,data:n.data,mimeType:n.mimeType,...t===void 0?{}:{_meta:{"effect-actions/field":t}}}),OCe=(e,t)=>V(Nx(K3)(O9(mC(e.input),!0)),n=>new J3({name:e.name,description:e.description,inputSchema:n,outputSchema:t,annotations:{...e.mcp.title===void 0?{}:{title:e.mcp.title},...ube(e)},_meta:e.mcp._meta===void 0?void 0:{...e.mcp._meta}})),kCe=H(function*(e,t){let n=yield*f9,r=yield*GI(e),i=yield*Lp(),a=e=>Cm(e).pipe(mp(Sce(e)),vp(ECe(`Tool execution failed due to an internal server error.`))),o=e=>sd(e)?a(e):cp(e);for(let[e,a]of r){let r=D9(e.success),s=r.fields.length===0?void 0:r,c=s===void 0?mC(e.success):s.rest===void 0?void 0:mC(s.rest),l=c===void 0?void 0:yield*Nx(q3)(O9(c,!1)).pipe(Ep),u=yield*OCe(e,l).pipe(Ep),d=Nx(mC(e.input),KI),f=e=>{let t=Ix(mC(e));return e=>Ep(t(e))},p=f(e.success),m=f(K(II(e))),h=t===void 0||e.caller===SI?a:e=>OB(lfe(t,a(e))),g=new Set(s?.fields.map(({name:e})=>e)),_=(e,t)=>{if(s===void 0)return new Y3({isError:!1,structuredContent:e,content:k9(e)});let n=CCe(s,t).map(DCe);if(c===void 0)return new Y3({isError:!1,content:n});let r=nn(e)?Object.fromEntries(Object.entries(e).filter(([e])=>!g.has(e))):e;return new Y3({isError:!1,structuredContent:r,content:[...k9(r),...n]})};yield*n.addTool({tool:u,annotations:la(),handle:t=>iie({tool:e.name,parameters:t??{}}).pipe(mp(()=>d(t??{})),Tp(({message:t})=>new N3({message:new dbe({toolName:e.name,description:t}).message})),B(e=>h(e).pipe(Ip({onFailure:e=>V(m(e),e=>new Y3({isError:!0,content:k9(e)})),onSuccess:e=>V(p(e),t=>_(t,e))}))),Sp(o),Up(e=>Ca(i,e)))})}}),ACe=(e,t,n=yf,r)=>{MI(`MCP tool`,e.flatMap(e=>e.actions));let i=e.flatMap(e=>e.actions.map(e=>[e,D9(e.success)]));TCe(i);let a=new Set(i.map(([{name:e}])=>e)),o=R(function*(){let t=(yield*f9).tools.flatMap(({tool:e})=>a.has(e.name)?[e.name]:[]);if(t.length>0)return yield*up(/* @__PURE__ */ Error(`Duplicate MCP tool: ${t.join(`, `)}, claimed by an action and a native feature`));yield*kCe(e,r)});return Cf(o).pipe(Af(n),Af(t),Sre,WI(e))},jCe=/* @__PURE__ */ new Set([`server/discover`,`tools/list`,`notifications/cancelled`]),MCe=e=>{let t=new Set(e.filter(({caller:e})=>e===SI).flatMap(({name:e})=>[e,`=?base64?${Dh(e)}?=`]));return e=>{if(t.size===0||e[`mcp-protocol-version`]!==w9.protocolVersion)return!0;let n=e[`mcp-method`];if(n===void 0)return!0;if(jCe.has(n))return!1;if(n!==`tools/call`)return!0;let r=e[`mcp-name`];return r===void 0||!t.has(r)}},NCe=e=>Pp(e.json,{onFailure:()=>!0,onSuccess:t=>!N(t,`method`)||t.method===e.headers[`mcp-method`]});function PCe(e,{actions:t,features:n,path:r=`/mcp`,authentication:i,requestScoped:a,allowSubscriptions:o=n!==void 0,...s}){let c=UI(VI(e),t),l=c.flatMap(e=>e.actions);CI(l,i);let u=ACe(c,a===!0?lCe({...s,path:r,protocols:[w9]}):cCe({...s,path:r,protocols:gCe,allowSessionTermination:!0,allowSubscriptions:o}),n,i);if(i===void 0)return u;let d=MCe(l),f=MM(V(tL(i),e=>t=>B(pM,n=>n.method!==`POST`||d(n.headers)?e.http(t,!1):B(NCe(n),n=>e.http(t,n)))));return u.pipe(Af(f.layer))}var FCe=`0.26.2`;const ICe=(e,t)=>rp(()=>LW({key:e,data:t})),LCe=(e,t)=>rp(()=>RW({key:e,data:t})),RCe=async(e,t)=>(await Promise.all([GG(e.authCookies.sessionToken.name,t,e.secret),GG(e.authCookies.dontRememberToken.name,`true`,e.secret)])).map(e=>e.split(`;`)[0]).join(`; `),zCe=(e,t)=>ym(`OwnerAccount.providerSession`)(function*(n){let r=new Date((yield*Nf)+6e4),i=yield*qp(H4(()=>e.internalAdapter.createSession(n,!0,{expiresAt:r},!0)),t=>np(()=>e.internalAdapter.deleteSession(t.token))),a=yield*H4(()=>RCe(e,i.token));return new Headers({origin:t,cookie:a})}),BCe=eH(W({id:U}));var A9=class e extends P()(`clankerauth/OwnerAccount`){static layer=bf(e,R(function*(){let{sql:e}=yield*iH,{auth:t,context:n}=yield*i3,{baseURL:r}=yield*X4,i=yield*Sw(1),a=zCe(n,r),o=ym(`OwnerAccount.find`)(function*(){let t=yield*e`SELECT id FROM user LIMIT 1`;if(t.length)return(yield*BCe(t[0])).id});return{find:o,create:ym(`OwnerAccount.create`)(function*(e){if(yield*o())return yield*z(eV.of());let{headers:n}=yield*H4(()=>t.api.signUpEmail({body:{name:`Owner`,email:e.email.trim(),password:e.password},returnHeaders:!0}),{refused:B4,conflict:eV.of});return n.getSetCookie()},e=>i.withPermit(e)),caller:(e,t,n)=>({userId:e,email:t,writable:n,providerHeaders:a(e)})}}))},j9=class extends P()(`clankerauth/ResponseCookies`){};const VCe=V(A9,e=>({setupStatus:()=>e.find().pipe(V(e=>({required:!e}))),setupOwner:ym(`Administration.setup`)(function*(t){let n=yield*e.create(t);return yield*(yield*j9).add(n),{created:!0}})}));var M9=class extends jo(`Unauthorized`){constructor(e={}){super({message:e.message??`Authentication required`}),Object.defineProperty(this,"cause",{value:e.cause})}},N9=class extends fC()(`ProviderUnavailable`,{operation:U},{httpApiStatus:503}){constructor(e){super({operation:e.operation}),Object.defineProperty(this,"cause",{value:e.cause})}},P9=class extends jo(`InsufficientScope`){},HCe=class extends fC()(`ConfigurationError`,{message:U}){};const F9=vo(1),I9=(e,t)=>Rp(n=>yk(e).execute(t).pipe(Wp(PN,{...ha(n,PN),redirect:`manual`}),Tp(e=>new N9({operation:`http.request`,cause:e})),$re(e=>e.status<300||e.status>=400,e=>new N9({operation:`http.redirect`,cause:{status:e.status}})))),UCe=W({keys:G(W({kty:U,crv:Hx(U),x:Hx(U),kid:Hx(U),alg:Hx(U),use:Hx(U),key_ops:Hx(G(U))}))}),WCe=W({sub:IS,client_id:IS,scope:U,iat:CS,exp:CS}),GCe=W({list:U}),KCe=zde.pipe(eS({exp:CS})),qCe=()=>({jwks:/* @__PURE__ */ new Map,keyLists:/* @__PURE__ */ new Map}),L9=e=>new M9({cause:e}),JCe=vo(1),R9=_o(5),YCe=_o(3),z9=e=>t=>jp(t,{duration:YCe,orElse:()=>z(new N9({operation:e}))}),B9=ym(`Verifier.make`)(function*(e){let t=yield*fk,n=JSON.stringify([e.issuer,e.resource]),r=yield*dp({try:()=>({jwks:new URL(`${e.issuer}/jwks`).href,keyList:new URL(`/api/keyList`,e.issuer).href}),catch:()=>new HCe({message:`Invalid issuer URL`})}),i=ym(`Verifier.jwks`)(function*(){let e=yield*I9(t,jO(r.jwks));return e.status===200?(yield*KO(UCe)(e).pipe(Tp(e=>new N9({operation:`jwks.decode`,cause:e})))).keys.map(({key_ops:e,...t})=>e?{...t,key_ops:[...e]}:t):yield*new N9({operation:`jwks.fetch`,cause:{status:e.status}})},Kp),a=R(function*(){let t=e.store.jwks.get(e.issuer),n=yield*Nf;if(t!==void 0){let e=`keys`in t?JCe:R9;if(n-t.readAt<yo(e))return`keys`in t?t.keys:yield*new N9({operation:t.failure})}let r=yield*gp(i()),a=yield*Nf;return Pa(r)?(e.store.jwks.set(e.issuer,{readAt:a,keys:r.success}),r.success):((e.store.jwks.get(e.issuer)?.readAt??-1/0)>=n||e.store.jwks.set(e.issuer,{readAt:a,failure:r.failure.operation}),yield*r.failure)}),o=ym(`Verifier.signingKey`)(function*(e,t){let n={keys:[...yield*t]};return yield*rp({try:()=>dI(n)({alg:`EdDSA`,kid:e}),catch:L9})}),s=ym(`Verifier.signed`)(function*(t,n,r=a){let i=yield*dp({try:()=>gI(t),catch:L9});if(i.alg!==`EdDSA`||i.kid===void 0)return yield*L9();let s=yield*o(i.kid,r),c=yield*Nf,{payload:l}=yield*rp({try:()=>nI(t,s,{issuer:e.issuer,audience:e.resource,algorithms:[`EdDSA`],typ:n,currentDate:new Date(c)}),catch:L9});return l}),c=ym(`Verifier.jwt`)(function*(e){let t=yield*s(e,`at+jwt`);if(t.cnf!==void 0)return yield*L9();let n=yield*Nx(WCe)(t).pipe(Tp(L9));return{subject:n.sub,scopes:n.scope.split(` `).filter(Boolean),actor:{kind:`client`,clientId:n.client_id},expiresAt:n.exp*1e3}}),l=ym(`Verifier.keyList`)(function*(){let n=MO(r.keyList).pipe(UO({resource:e.resource})),i=R(function*(){let e=yield*I9(t,n);return e.status===200?yield*KO(GCe)(e).pipe(Tp(e=>new N9({operation:`key-list.decode`,cause:e}))):yield*new N9({operation:`key-list.fetch`,cause:{status:e.status}})}),o=yield*fm(a.pipe(z9(`jwks.timeout`))),{list:c}=yield*i.pipe(z9(`key-list.timeout`)),l=e=>new N9({operation:`key-list.verify`,cause:e}),u=yield*s(c,vI,yC(o)).pipe(xp(`Unauthorized`,e=>z(l(e)))),d=yield*Nx(KCe)(u).pipe(Tp(l));return{readAt:yield*Nf,expiresAt:d.exp*1e3,entries:new Map(d.keys.map(e=>[e.id,e.sealed]))}},Kp),u=R(function*(){let t=e.store.keyLists.get(n),r=yield*Nf;if(t!==void 0&&r-t.readAt<yo(R9))return t.failure===void 0?void 0:yield*new N9({operation:t.failure});let i=yield*gp(l()),a=yield*Nf,o=e.store.keyLists.get(n),s=o?.failure!==void 0;if(Pa(i)){e.store.keyLists.set(n,{readAt:a,failure:void 0,held:i.success}),s&&(yield*wm(`clankerauth key list reads have recovered`));return}if((o?.readAt??-1/0)>=r)return yield*i.failure;let{operation:c}=i.failure;return e.store.keyLists.set(n,{readAt:a,failure:c,held:o?.held}),s||(yield*Sm(`clankerauth key list reads are failing; a held list decides until it expires`,{operation:c})),yield*i.failure}),d=R(function*(){let t=yield*gp(u),r=e.store.keyLists.get(n)?.held;return r!==void 0&&r.expiresAt>(yield*Nf)?r:yield*Na(t)?t.failure:new N9({operation:`key-list.expired`})}),f=ym(`Verifier.apiKey`)(function*(t){let r=n=>rp({try:()=>Hde(t,e.resource,n.entries),catch:L9}),i=yield*Nf,a=e.store.keyLists.get(n)?.held,o=a!==void 0&&i-a.readAt<yo(F9)&&a.expiresAt>i?a:yield*d,s=(yield*r(o))??(yield*B(d,e=>e===o?F(void 0):r(e)));return s===void 0||s.expiresAt!==null&&s.expiresAt<=(yield*Nf)?yield*L9():{subject:s.ownerId,scopes:s.scopes,actor:{kind:`key`,keyId:s.keyId},expiresAt:s.expiresAt??void 0}});return{verifyToken:ym(`Verifier.verifyToken`)(function*(t){let n=yield*t.startsWith(`clankerauth_`)?e.apiKeys===!1?z(L9()):f(t):c(t),r=e.requiredScopes?.find(e=>!n.scopes.includes(e));return r===void 0?n:yield*new P9({scope:r,actor:n.actor})})}}),XCe=ym(`AdministrationResource.make`)(function*(){let{auth:e}=yield*i3,{baseURL:t}=yield*X4,n=`${t}/api/auth`,r=cV(t);return{protectedResource:{resource:r,authorizationServers:[n],scopesSupported:[lV.read,lV.write,...Q4],scopesRequired:[lV.read,lV.write]},verifier:yield*B9({issuer:n,resource:r,store:qCe(),apiKeys:!1}).pipe(zp(FN.pipe(Af(_f(NN,(t,n)=>{let r=new Request(t,n);return r.headers.set(F4,`127.0.0.1`),e.handler(r)})))))}});QI(`whoami`,{description:`The verified subject, issuer and scopes behind this request's credential.`,readOnly:!0,caller:class extends P()(`@clankerauth/CurrentPrincipal`){},success:W({subject:IS,issuer:IS,scopes:G(U)})});const V9=(e,t)=>{let n=`Requires ${e}.`;return t.kind===`client`?new OI({message:n,scopes:[e]}):new OI({message:n})},ZCe=(e,t)=>t===void 0||e.scopes.includes(t)?void 0:V9(t,e.actor),H9=e=>e instanceof M9?new EI({message:e.message}):e instanceof P9?V9(e.scope,e.actor):e,U9=(e,t)=>Tp(e.verifyToken(_g(t)),H9);ym(`Resource.layer`)(function*(e,{scopes:t,required:n},r){let i=new URL(`/`,r.publicUrl).href,a={resource:i,authorizationServers:[r.issuer],scopesSupported:t,scopesRequired:[n]},o=r.discovery===!1?void 0:a,s=yield*B9({issuer:r.issuer,resource:i,store:r.store,requiredScopes:[n],apiKeys:r.apiKeys}),c=e=>jp(e,{duration:`5 seconds`,orElse:()=>z(new N9({operation:`verify.timeout`}))}),l={verifyToken:e=>c(s.verifyToken(e))},u=ym(`Resource.principal`)(function*(e,t){let n=jB(e);if(Fi(n))return yield*new EI({message:`A bearer token is required.`});let r=yield*U9(l,n.value),i=ZCe(r,t);return i===void 0?r:yield*i}),d=ym(`Resource.admit`)(function*(t,n){let r=yield*gp(u(t,n));if(Pa(r))return{ok:!0,principal:r.success};let i=jA(RB(r.failure,{authentication:e,protectedResource:o,authorization:t}));return{ok:!1,refusal:{status:i.status,headers:Object.fromEntries(i.headers),body:yield*np(()=>i.text())}}});return{resource:i,issuer:r.issuer,protectedResource:o,verifier:l,admit:d,watch:(e,t)=>am(R(function*(){let n=yield*u(e,t),r=yield*Nf,i=Math.max(0,(n.expiresAt??1/0)-r);return n.actor.kind===`key`?yield*Mp(Math.min(i,yo(F9))):(yield*Mp(i),yield*H9(new M9))}))}});const QCe=e=>qB(e,V(i3,e=>()=>R(function*(){let t=yield*pM,n=new Headers(t.headers),r=yield*H4(()=>e.auth.api.getSession({headers:n}),{unavailable:V4});return r?{providerHeaders:F(n),userId:r.user.id,email:r.user.email,writable:!0}:yield*new EI({message:`Owner session required`})}))),$Ce=eH(W({id:U,email:U})),ewe=e=>qB(sV,R(function*(){let{sql:t}=yield*iH,n=yield*A9,r=()=>new EI({message:`Owner authorization required`});return i=>R(function*(){let a=yield*U9(e.verifier,i).pipe(xp(`ProviderUnavailable`,()=>z(new YB({message:`Request could not be completed`}))));if(a.actor.kind!==`client`)return yield*r();let o=a.scopes.includes(lV.write);if(!o&&!a.scopes.includes(lV.read))return yield*new OI({message:`Insufficient scope`,scopes:[lV.read]});let s=yield*t`SELECT u.id, u.email FROM user u
       JOIN oauthClient c ON c.clientId = ${a.actor.clientId}
       WHERE u.id = ${a.subject} AND c.disabled IS NOT 1`;if(!s[0])return yield*r();let c=yield*$Ce(s[0]);return n.caller(c.id,c.email,o)})}),{protectedResource:e.protectedResource}),twe=e=>e.readOnly?L:B(iV,({writable:e})=>e?L:z(new OI({message:`This action requires the ${lV.write} scope`,scopes:[lV.write]}))),nwe=MM()(e=>R(function*(){let t=[],n=yield*Wp(e,j9,{add:e=>I(()=>t.push(...e))});return t.length?EA(n,Kh(t)):n}));function rwe(e){return Tf(R(function*(){let{context:t}=yield*i3,n=yield*d3,r=yield*u3,i=yield*VCe,a=yield*o3,o=eL(UV,{listClients:n.list,createClient:n.create,updateClient:n.update,deleteClient:n.delete,revokeClient:n.revoke,blockClient:n.block,rotateClientSecret:n.rotate,setClientAccess:r.setAccess,getResource:r.get,putResource:r.put,deleteResource:r.delete,listApiKeys:a.list,createApiKey:a.create,updateApiKey:a.update,deleteApiKey:a.delete},{authorize:twe}),s=eL(VV,{setupStatus:i.setupStatus,setupOwner:i.setupOwner,keyList:({resource:e})=>a.keyList(e)}),c=yield*XCe(),l=aV(t.authCookies.sessionToken.name),u=GV(l),d=Df(hB(u,o).pipe(Af(QCe(l))),EM(`GET`,`/openapi.json`,vA(KR(u.api))),hB(u,s).pipe(Af(nwe.layer))),f=Df(PCe(o,{name:`clankerauth-admin`,version:FCe,allowedOrigins:e,instructions:`Owner administration. Listing needs ${lV.read} or ${lV.write}; every other action changes authorization policy and needs ${lV.write}. Create and rotate actions return secrets once.`,authentication:sV}),hB(KV,o)).pipe(Af(ewe(c)));return Df(d,f)}))}const W9=`clankerauth_forward`,G9=(e,t)=>vA({error:t},{status:e}),iwe=e=>Tf(R(function*(){let t=yield*X4,{auth:n,context:r}=yield*i3,i=yield*r3,a=n=>{if(!URL.canParse(n))return;let r=new URL(n);return!r.username&&!r.password&&K4(r,t.allowInsecureHttp)&&G4(r.hostname,e)?r:void 0},o=_g(t.secret),s=new URL(`/login`,t.baseURL),c={domain:e,path:`/`,httpOnly:!0,secure:t.baseURL.startsWith(`https:`),sameSite:`lax`},l=r.authCookies.sessionToken.name,u=(e,n)=>{let r=new URL(e,t.baseURL);return r.searchParams.set(`rd`,n.href),r},d=e=>H4(()=>n.api.getSession({headers:new Headers({cookie:e})}),{unavailable:V4}),f=R(function*(){let e=yield*pM,{headers:r}=e,s=r[`x-forwarded-proto`],c=r[`x-forwarded-host`],f=s&&c?a(`${s}://${c}${r[`x-forwarded-uri`]??`/`}`):void 0;if(!f)return G9(400,`invalid_forwarded_request`);let p=new URL(e.url,t.baseURL).searchParams.get(`resource`),m=p&&(yield*i.application(p));if(!m)return G9(403,`unknown_resource`);let h=e.cookies[W9],g=h?yield*Kre(LCe(o,h)):Ni(),_=Ii(g)?yield*d(`${l}=${g.value}`):null;if(!_)return r[`sec-fetch-mode`]===`navigate`?pA(u(`/forward-auth/continue`,f)):G9(401,`unauthenticated`);let v=Math.floor((yield*Nf)/1e3),{token:y}=yield*H4(()=>n.api.signDocument({body:{typ:`at+jwt`,payload:{sub:_.user.id,aud:m.identifier,client_id:`forward-auth`,scope:m.scopes.join(` `),iat:v,exp:v+900}}}));return fA({status:204,headers:{authorization:`Bearer ${y}`}})}),p=R(function*(){let e=yield*pM,n=new URL(e.url,t.baseURL).searchParams.get(`rd`),r=n?a(n):void 0;if(!r)return G9(400,`invalid_return_url`);let i=e.cookies[l];if(!(i&&(yield*d(e.headers.cookie??``)))||!i)return pA(u(`/login`,u(`/forward-auth/continue`,r)));let s=yield*ICe(o,i);return yield*pA(r).pipe(TA(W9,s,c))}),m=R(function*(){let e=yield*pM,r=new URL(e.url,t.baseURL).searchParams.get(`rd`),i=r&&a(r)||s,{headers:o}=yield*H4(()=>n.api.signOut({headers:new Headers({cookie:e.headers.cookie??``}),returnHeaders:!0}),{refused:B4,unavailable:V4});return yield*EA(pA(i),Kh(o.getSetCookie())).pipe(TA(W9,``,{...c,maxAge:0}))});return Df(EM(`GET`,`/forward-auth`,bp(f,W4)),EM(`GET`,`/forward-auth/continue`,bp(p,W4)),EM(`GET`,`/forward-auth/logout`,bp(m,W4)))})),awe=/* @__PURE__ */ new Set([`/sign-in/email`,`/sign-out`,`/get-session`,`/change-password`,`/jwks`,`/oauth2/register`,`/oauth2/authorize`,`/oauth2/token`,`/oauth2/consent`,`/oauth2/continue`,`/oauth2/public-client`,`/oauth2/introspect`,`/oauth2/revoke`,`/.well-known/oauth-authorization-server`]),owe=/* @__PURE__ */ new Set([`/.well-known/oauth-protected-resource`,`/jwks`,`/oauth2/register`,`/oauth2/token`,`/oauth2/revoke`,`/oauth2/introspect`,`/.well-known/oauth-authorization-server`,`/.well-known/oauth-authorization-server/api/auth`]),swe=/* @__PURE__ */ new Set([`/jwks`,`/.well-known/oauth-protected-resource`,`/.well-known/oauth-authorization-server`,`/.well-known/oauth-authorization-server/api/auth`]),cwe=new Set(lbe),lwe=/^\/assets\/[a-zA-Z0-9_.-]+\.(js|css|woff2)$/,K9=(e,t=200)=>vA(e,{status:t}),q9=K9({error:`Not found`},404),J9=[`Authorization`,`Content-Type`,`Accept`,`Mcp-Protocol-Version`,`Mcp-Method`,`Mcp-Name`],uwe=new Set(J9.map(e=>e.toLowerCase())),dwe=(e=lt(new URL(`dist/`,import.meta.resolve(`@clankerauth/web/package.json`))))=>Tf(R(function*(){let t=yield*X4,{auth:n}=yield*i3,{sql:r}=yield*iH,i=yield*r3,a=[.../* @__PURE__ */ new Set([t.baseURL,...t.mcpAllowedOrigins])],o=R(function*(){let e=yield*pM,r=new URL(e.url,t.baseURL),a=r.pathname.replace(/^\/api\/auth/,``);if(!awe.has(a)&&a!==`/.well-known/oauth-authorization-server/api/auth`)return q9;if(a===`/oauth2/authorize`){let t=e.method===`GET`?r.searchParams.getAll(`resource`):new URLSearchParams(yield*e.text).getAll(`resource`);if(t.length!==1||!(yield*i.get(t[0]??``)))return K9({error:`invalid_target`,error_description:Z4},400)}let o=e.method===`GET`||e.method===`HEAD`?void 0:yield*e.arrayBuffer,s=yield*H4(()=>n.handler(new Request(r,{method:e.method,headers:e.headers,body:o})));return FA(s)}).pipe(bp(W4)),s=TM(n=>R(function*(){let r=yield*HA;yield*n.add(`*`,`/*`,R(function*(){let n=yield*pM;if(n.method!==`GET`&&n.method!==`HEAD`)return q9;let i=new URL(n.url,t.baseURL).pathname,a=cwe.has(i)?`index.html`:lwe.test(i)?i.slice(1):void 0;return a?yield*r.fileResponse(st(e,a),{contentType:a.endsWith(`.js`)?`text/javascript`:a.endsWith(`.css`)?`text/css`:a.endsWith(`.woff2`)?`font/woff2`:`text/html; charset=utf-8`}).pipe(bp(()=>F(q9))):q9}))})),c=MM(e=>zye({baseURL:t.baseURL,trustProxy:t.trustProxy})(R(function*(){let n=yield*pM,r=new URL(n.url,t.baseURL).pathname,i=r.replace(/^\/api\/auth/,``),o=r===`/mcp`,s=n.headers.origin,c=s!==void 0&&a.includes(s),l=owe.has(i),u;if(o&&s!==void 0&&!c)u=K9({error:`Invalid origin`},403);else if(o&&n.method===`OPTIONS`){let e=n.headers[`access-control-request-method`],t=(n.headers[`access-control-request-headers`]??``).split(`,`).map(e=>e.trim().toLowerCase()).filter(Boolean);u=c&&e===`POST`&&t.every(e=>uwe.has(e))?fA({status:204}):K9({error:`MCP preflight rejected`},403)}else u=l&&n.method===`OPTIONS`?fA({status:204}):yield*e;l&&(u=u.pipe(wA({"access-control-allow-origin":`*`,"access-control-allow-methods":`GET, POST, OPTIONS`,"access-control-allow-headers":`Authorization, Content-Type, DPoP`,"access-control-expose-headers":`WWW-Authenticate, DPoP-Nonce`}),CA(`access-control-allow-credentials`))),o&&(u=u.pipe(SA(`vary`,u.headers.vary?`${u.headers.vary}, Origin`:`Origin`),CA(`access-control-allow-credentials`)),c&&s!==void 0&&(u=u.pipe(wA({"access-control-allow-origin":s,"access-control-expose-headers":`WWW-Authenticate, Mcp-Protocol-Version`})),n.method===`OPTIONS`&&u.status>=200&&u.status<300&&(u=u.pipe(wA({"access-control-allow-methods":`POST`,"access-control-allow-headers":J9.join(`, `)})))));let d=n.method!==`GET`||u.status!==200?`no-store`:r.startsWith(`/assets/`)?`public, max-age=31536000, immutable`:swe.has(i)?`public, max-age=300`:`no-store`;return u=u.pipe(wA({"cache-control":d,"referrer-policy":`no-referrer`,"x-content-type-options":`nosniff`,"x-frame-options":`DENY`,"content-security-policy":`default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'`})),t.baseURL.startsWith(`https:`)&&(u=u.pipe(SA(`strict-transport-security`,`max-age=31536000`))),u})),{global:!0}),l=MM(e=>rm(e));return Df(rwe(a),t.cookieDomain===void 0?yf:iwe(t.cookieDomain),EM(`GET`,`/healthz`,r`SELECT 1`.pipe(vp(K9({status:`ok`})),bp(W4))),EM(`*`,`/api/auth/*`,o),EM(`*`,`/.well-known/*`,o),s).pipe(Af(l.layer),Af(c),Af(Fue))})),fwe=ym(`Http.nodeHandler`)(function*(e){let t=yield*ule(dwe(e));return yield*Nue(t,{scope:yield*Gp})}),pwe=(e,t)=>{let n=Tf(V(X4,({database:e})=>iH.layer(e)));return Df(A9.layer,d3.layer,o3.layer).pipe(jf(u3.layer),jf(i3.layer),jf(r3.layer),jf(n),jf(Of(e,t)))},Y9=`credentials.json`,X9=W({email:U,password:U,secret:U,clientId:Ux(U),clientSecret:Ux(U)}),mwe=Nx(VS(X9)),hwe=zx(X9),Z9=(e,t)=>B(lE,n=>n.writeFileString(ot(e,Y9),`${JSON.stringify(hwe(t),null,2)}\n`,{mode:384})),gwe=ym(`Dev.identity`)(function*(e,t){let n={email:`owner@example.internal`,password:tt(24).toString(`base64url`),secret:tt(32).toString(`hex`)};if(!t)return n;let r=yield*lE,i=ot(e,Y9);return(yield*r.exists(i))?yield*mwe(yield*r.readFileString(i)):(yield*Z9(e,n),n)}),Q9=e=>Error(`Disposable issuer provisioning failed`,{cause:e}),$9=ym(`Dev.ownerSession`)(function*(e,t,n,r){if(t===void 0)return yield*z(/* @__PURE__ */ Error(`A forward-auth session needs a cookieDomain; the issuer serves none`));let i=yield*fk,a=yield*i.execute(MO(`${e}/api/auth/sign-in/email`,{headers:{origin:e}}).pipe(UO(n)));if(yield*a.text,a.status!==200)return yield*z(/* @__PURE__ */ Error(`Owner sign-in failed with HTTP ${a.status}`));let o=new URL(`/`,r).href,s=yield*i.get(`${e}/forward-auth/continue?rd=${encodeURIComponent(o)}`,{headers:{cookie:og(a.cookies)}});yield*s.text;let c=rg(a.cookies,s.cookies);return{cookie:og(c),cookies:Object.entries(sg(c)).map(([e,t])=>({name:e,value:t}))}}),_we=Df(jN,FN,_f(PN,{redirect:`manual`})),vwe=H(function*(e){let t=yield*lE,n=lt(new URL(`./web/`,import.meta.url));if(!(yield*t.exists(ot(n,`index.html`))))return yield*z(/* @__PURE__ */ Error(`The @gjermundgaraba/clankerauth-dev installation is missing its bundled dashboard assets`));let r=e.dataDir,i=r===void 0?yield*t.makeTempDirectoryScoped({prefix:`clankerauth-disposable-`}):yield*vp(t.makeDirectory(st(r),{recursive:!0,mode:448}),st(r)),a=yield*Fye(e.port??0,`127.0.0.1`),{port:o}=a,s=e.cookieDomain===void 0?`http://127.0.0.1:${o}`:`http://clankerauth.${e.cookieDomain}:${o}`,c=yield*gwe(i,r!==void 0),l=yield*Y4({baseURL:s,secret:hg(c.secret),database:ot(i,`issuer.sqlite`),host:`127.0.0.1`,port:o,mcpAllowedOrigins:[],trustProxy:!1,allowInsecureHttp:e.cookieDomain!==void 0,cookieDomain:e.cookieDomain}),u=yield*yre(pwe(_f(X4,l),P4.layerWith(e.cimdTransport))),d=va(u,A9),f=yield*ef(yield*Gp),p=yield*fwe(n).pipe(zp(u),Wp(Jd,f));yield*a.serve((t,n)=>{try{e.onRequest?.({method:t.method??`GET`,url:new URL(t.url??`/`,`http://127.0.0.1:${t.socket.localPort}`)}),p(t,n)}catch{n.headersSent?n.destroy():n.writeHead(500).end(`Request failed`)}});let m={email:c.email,password:c.password},h=va(u,d3),g=va(u,u3),_=va(u,o3),v=e=>rm(Kp(R(function*(){let t=yield*d.find();return t===void 0?yield*up(/* @__PURE__ */ Error(`Owner setup failed`)):yield*e(t).pipe(Wp(iV,d.caller(t,m.email,!0)))}))).pipe(Tp(Q9));(yield*d.find())||(yield*d.create(m).pipe(Tp(Q9))),yield*v(()=>ep(e.resources,e=>g.put(e),{discard:!0}));let y=yield*v(()=>R(function*(){if(c.clientId!==void 0&&c.clientSecret!==void 0){let{clients:e}=yield*h.list();if(e.some(e=>e.client_id===c.clientId))return{client_id:c.clientId,client_secret:c.clientSecret}}return yield*h.create({client_name:e.client.name,redirect_uris:[e.client.redirect],resources:e.client.resources,token_endpoint_auth_method:`client_secret_basic`,application_type:`native`})})),b=y.client_secret;if(b===void 0)return yield*z(/* @__PURE__ */ Error(`Disposable issuer did not return client credentials`));r!==void 0&&(yield*Z9(i,{...c,clientId:y.client_id,clientSecret:b}));let x=e.cookieDomain===void 0?void 0:s;return{details:{issuer:`${s}/api/auth`,clientId:y.client_id,clientSecret:b,owner:m,url:s,port:o,directory:i},apiKey:e=>v(()=>V(_.create({name:e.name??`development`,permissions:e.permissions,expiresAt:null}),e=>e.key)),ownerSession:e=>$9(s,x,m,e),ownerToken:ym(`Dev.ownerToken`)(function*(e){let{cookie:t}=yield*$9(s,x,m,e.appOrigin),n=yield*fk,r=new URL(e.appOrigin),i=new URL(`/forward-auth`,s);i.searchParams.set(`resource`,e.resource);let a=yield*n.get(i,{headers:{cookie:t,"x-forwarded-proto":r.protocol.slice(0,-1),"x-forwarded-host":r.host,"x-forwarded-uri":`/`}});yield*a.text;let o=a.headers.authorization;return a.status!==204||o===void 0?yield*z(/* @__PURE__ */ Error(`Forward auth issued no token (HTTP ${a.status})`)):o.replace(/^Bearer /iu,``)})}});async function ywe(e){let t=Xd(),n=e=>hm(e.pipe(Wp(Jd,t),zp(_we)),{onFiberStart:SC(t)}),r=_m($p(nf(t,Ed)));try{let t=await n(vwe(e));return{...t.details,apiKey:e=>n(t.apiKey(e)),ownerSession:e=>n(t.ownerSession(e)),ownerToken:e=>n(t.ownerToken(e)),close:()=>hm(r)}}catch(e){throw await hm(r),e}}export{qV as n,ywe as t};