@gjermundgaraba/clankerauth-dev 0.8.0 → 0.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/README.md +4 -4
  2. package/dist/index.d.ts +1 -1
  3. package/dist/index.mjs +4 -4
  4. package/dist/testing.mjs +1 -1
  5. package/dist/web/index.html +1 -1
  6. package/package.json +3 -3
package/dist/index.mjs CHANGED
@@ -412,7 +412,7 @@ To resolve this, you can:
412
412
  3. Ensure plugins use different HTTP methods for the same path
413
413
  `)}}function GJ(e,t){let n=Ce(t),r=t.plugins?.reduce((e,t)=>({...e,...t.endpoints}),{})??{},i=t.plugins?.map(t=>t.middlewares?.map(r=>{let i=(async i=>{let a=await e;return n(`middleware ${r.path} ${t.id}`,{"better_auth.hook.type":`middleware`,"http.route":r.path,"better_auth.context":`plugin:${t.id}`},()=>r.middleware({...i,context:{...a,...i.context}}))});return i.options=r.middleware.options,{path:r.path,middleware:i}})).filter(e=>e!==void 0).flat()||[];return{api:UJ({signInSocial:_J(),callbackOAuth:rJ,getSession:xH(),signOut:xJ,signUpEmail:CJ(),signInEmail:vJ(),resetPassword:mJ,verifyPassword:hJ,verifyEmail:JW,sendVerificationEmail:qW,changeEmail:MJ,changePassword:OJ,setPassword:kJ,updateSession:TJ(),updateUser:DJ(),deleteUser:AJ,requestPasswordReset:fJ,requestPasswordResetCallback:pJ,listSessions:OH(),revokeSession:kH,revokeSessions:AH,revokeOtherSessions:jH,linkSocialAccount:Gq,listUserAccounts:Wq,deleteUserCallback:jJ,unlinkAccount:Kq,refreshToken:$q,getAccessToken:Qq,accountInfo:eJ,...r,ok:sJ,error:oJ},e),middlewares:i}}const KJ=(e,t)=>{let n=Ce(t),{api:r,middlewares:i}=GJ(e,t),a=new URL(e.baseURL).pathname;return iL(r,{routerContext:e,openapi:{disabled:!0},basePath:a,routerMiddleware:[{path:`/**`,middleware:rR},...i],allowedMediaTypes:[`application/json`],skipTrailingSlashes:t.advanced?.skipTrailingSlashes??!1,async onRequest(t){let r=e.options.disabledPaths||[],i=YL(t.url,a);if(r.includes(i))return new Response(`Not Found`,{status:404});let o=e.checkSchema?.();o&&await o;let s=t,c=await LR(s,e);if(c)return c;for(let t of e.options.plugins||[])if(t.onRequest){let r=await n(`onRequest ${t.id}`,{[zH]:`onRequest`,[BH]:`plugin:${t.id}`},()=>t.onRequest(s,e));if(r&&`response`in r)return r.response;r&&`request`in r&&(s=r.request)}return s},async onResponse(t,r){for(let r of e.options.plugins||[])if(r.onResponse){let i=await n(`onResponse ${r.id}`,{[zH]:`onResponse`,[BH]:`plugin:${r.id}`,[he]:t.status},()=>r.onResponse(t,e));if(i)return i.response}return t},onError(n){if(aL(n)&&n.status===`FOUND`)return;if(t.onAPIError?.throw)throw n;if(t.onAPIError?.onError){t.onAPIError.onError(n,e);return}let r=t.logger?.level,i=r===`error`||r===`warn`||r===`debug`?O:void 0;if(t.logger?.disabled!==!0){if(n&&typeof n==`object`&&`message`in n&&typeof n.message==`string`&&(n.message.includes(`no column`)||n.message.includes(`column`)||n.message.includes(`relation`)||n.message.includes(`table`)||n.message.includes(`does not exist`))){e.logger?.error(n.message);return}aL(n)?(n.status===`INTERNAL_SERVER_ERROR`&&e.logger.error(n.status,n),i?.error(n.message)):e.logger?.error(n&&typeof n==`object`&&`name`in n?n.name:``,n)}}})},qJ=e=>[.../* @__PURE__ */ new Set([e.invalid.schema,e.internal.schema])],JJ=/* @__PURE__ */ new Set([`Body`,`ResponseHeaders`]),YJ=(e,t)=>JJ.has(t.kind)?e.internal.make(t):e.invalid.make(t),XJ=(e,t)=>[.../* @__PURE__ */ new Set([...e.errors,...t??[]])],ZJ=/^[A-Za-z0-9_-]+$/,QJ=(e,t)=>{if(!ZJ.test(t)||t===`then`)throw Error(`Invalid ${e}: ${t}`)},$J=(e,t)=>{let n=/* @__PURE__ */ new Set;for(let r of t){if(n.has(r))throw Error(`Duplicate ${e}: ${r}`);n.add(r)}},eY=rD(U,KE);function tY(e,t){QJ(`action name`,e);let{access:n}=t;if(n!==`read`&&n!==`write`)throw Error(`Invalid access: ${String(n)}`);let r=t.mcp===!1?!1:t.mcp?.readOnly??n===`read`,i=t.mcp!==!1&&{name:t.mcp?.name??e,readOnly:r,destructive:t.mcp?.destructive??!r,idempotent:t.mcp?.idempotent??!1,openWorld:t.mcp?.openWorld??!0};if(i!==!1&&i.name.length>128)throw Error(`Invalid MCP name: ${i.name}`);return i!==!1&&QJ(`MCP name`,i.name),{name:e,description:t.description,input:t.input??eY,success:t.success,errors:t.errors??[],access:n,mcp:i}}var nY=class e{group;#e;constructor(e,t){this.group=e,this.#e=t}get build(){return this.#e}static make(t,n){return new e(t,n)}};const rY=(e,t,n,r)=>{let i=Object.hasOwn(n,t.name)?n[t.name]:void 0;if(!Un(i))throw Error(`No handler for ${e.name}.${t.name}`);let a={"action.group":e.name,"action.name":t.name,"action.access":t.access};return n=>{let o=Eg(Vg(dh(()=>i(n)),a),`${e.name}.${t.name}`,{captureStackTrace:!1,attributes:a});return r===void 0?o:z(r(t),()=>o)}},iY=(e,t)=>{let n=e.actions.filter(e=>!(Object.hasOwn(t,e.name)&&Un(t[e.name])));if(n.length>0)throw Error(`Missing handlers for group "${e.name}": ${n.map(e=>e.name).join(`, `)}`);return t};function aY(e,...t){let{name:n}=e;QJ(`action group name`,n);let r=t.map(t=>({...t,errors:[...t.errors,...e.errors??[]]}));$J(`action`,r.map(e=>e.name)),$J(`MCP tool`,r.flatMap(e=>e.mcp===!1?[]:[e.mcp.name]));let i={name:n,actions:r,schemaError:e.schemaError,implement:e=>{let t=rh(e)?B(e,e=>iY(i,e)):F(iY(i,e));return nY.make(i,t)}};return i}const oY={write(e){switch(e._tag){case`Event`:{let t=``;return e.id!==void 0&&(t+=`id: ${e.id}\n`),e.event!==`message`&&(t+=`event: ${e.event}\n`),t+=`data: ${e.data.replace(/\n/g,`
414
414
  data: `)}\n`,t+`
415
- `}case`Retry`:return`retry: ${Xs(e.duration)}\n\n`}}};function sY(e){let t=typeof e==`string`?KF(e):e;return e=>e.annotate({httpApiStatus:t})}const cY=/*#__PURE__*/ (e=>eD.pipe(sY(e)))(204),lY=e=>RE(e)&&M(e,`~effect/httpapi/HttpApiSchema/Stream`),uY=e=>lY(e)&&e._tag===`StreamSse`,dY=e=>lY(e)&&e._tag===`StreamUint8Array`,fY=`~effect/httpapi/HttpApiSchema/WithHeaders`,pY=e=>M(e,`~effect/httpapi/HttpApiSchema/WithHeadersValue`),mY=e=>RE(e)&&M(e,`~effect/httpapi/HttpApiSchema/WithHeaders`);function hY(e,t,n){return LE(e.ast,{[fY]:fY,schema:t,headers:n})}function gY(e,t){return e.annotate({"~httpApiEncoding":{_tag:t._tag,contentType:t.contentType??_Y(t._tag)}})}function _Y(e){switch(e){case`Multipart`:return`multipart/form-data`;case`Json`:return`application/json`;case`FormUrlEncoded`:return`application/x-www-form-urlencoded`;case`Uint8Array`:return`application/octet-stream`;case`Text`:return`text/plain`}}function vY(e){return t=>gY(t,{_tag:`FormUrlEncoded`,...e})}const yY=e=>{if(qv(e))return!0;let t=vb(e);if(qv(t))return!0;let n=e.encoding?.[0].to;return n!==void 0&&qv(n)},bY=/*#__PURE__*/ jb(`~httpApiEncoding`),xY=/*#__PURE__*/ jb(`~httpApiWithHeaders`),SY=/*#__PURE__*/ jb(`httpApiStatus`),CY={_tag:`Json`,contentType:`application/json`},wY={_tag:`FormUrlEncoded`,contentType:`application/x-www-form-urlencoded`};function TY(e){return bY(e)??CY}function EY(e,t){return bY(e)||(yM(t)?CY:wY)}function DY(e){let t=TY(e);if(t._tag===`Multipart`)throw Error(`Multipart is not supported in response`);return t}function OY(e){return SY(e)??200}function kY(e){return mY(e)?SY(e.ast)??OY(e.schema.ast):OY(e.ast)}function AY(e){return mY(e)&&bY(e.ast)===void 0?DY(e.schema.ast):DY(e.ast)}function jY(e){return SY(e)??500}function MY(e){return mY(e)?SY(e.ast)??jY(e.schema.ast):jY(e.ast)}function NY(e){let t=e.toLowerCase().trim(),n=t.indexOf(`;`);return n===-1?t:t.slice(0,n).trim()}const PY=`~effect/httpapi/HttpApiEndpoint`;function FY(e){let t=[];for(let{schemas:n}of e.payload.values())t.push(...n);return t}function IY(e){let t=Array.from(e.success);return lo(t)?t:[cY]}function LY(e){let t=new Set(e.error),n=e.disableCodecs?j:KY;for(let r of e.middlewares){let e=r;for(let r of e.error)t.add(n(r))}return Array.from(t)}const RY={[PY]:PY,pipe(){return Tn(this,arguments)},prefix(e){return BY({...zY(this),path:TP(this.path,e)})},middleware(e){return BY({...zY(this),middlewares:/* @__PURE__ */ new Set([...this.middlewares,e])})},annotate(e,t){return BY({...zY(this),annotations:ds(this.annotations,e,t)})},annotateMerge(e){return BY({...zY(this),annotations:Ss(this.annotations,e)})}},zY=e=>({identifier:e.identifier,path:e.path,method:e.method,params:e.params,query:e.query,headers:e.headers,payload:e.payload,success:e.success,error:e.error,annotations:e.annotations,middlewares:e.middlewares,disableCodecs:e.disableCodecs});function BY(e){function t(){}return Object.setPrototypeOf(t,RY),Object.assign(t,e)}const VY=e=>(t,n,r)=>{let i=r?.disableCodecs??!1,a=i?j:xO;return BY({identifier:t,path:n,method:e,params:HY(r?.params,a),query:HY(r?.query,a),headers:HY(r?.headers,a),payload:UY(r?.payload,e,i),success:GY(r?.success,e,i),error:qY(r?.error,i),annotations:cs(),middlewares:/* @__PURE__ */ new Set,disableCodecs:i})};function HY(e,t){if(e!==void 0)return RE(e)?t(e):t(W(e))}function UY(e,t,n){let r=/* @__PURE__ */ new Map;if(e===void 0)return r;let i=Array.isArray(e)?e:RE(e)?[e]:[W(e).pipe(vY())],a=n?j:rX;for(let e of i){let n=EY(e.ast,t),i=NY(n.contentType),o=r.get(i);if(o){if(o.encoding._tag!==n._tag)throw Error(`Multiple payload encodings for content-type: ${n.contentType}`);if(o.encoding._tag===`Multipart`)throw Error(`Multiple multipart payloads for content-type: ${n.contentType}`);o.schemas.push(a(e,t))}else r.set(i,{encoding:n,schemas:[a(e,t)]})}return r}const WY=`effect/httpapi/stream/failure`;function GY(e,t,n){if(e===void 0)return/* @__PURE__ */ new Set;let r=so(e);return JY(r,t),new Set(n?r:r.map(KY))}const KY=/*#__PURE__*/ Fn(e=>lY(e)?e:mY(e)?hY(e,lY(e.schema)?e.schema:nX(e.schema,AY(e)),xO(e.headers)):tX(e));function qY(e,t){if(e===void 0)return/* @__PURE__ */ new Set;let n=so(e);for(let e of n){let t=mY(e)?e.schema:e;if(lY(t))throw Error(`Streaming schemas are not supported in error responses`)}return XY(n,MY),new Set(t?n:n.map(KY))}function JY(e,t){let n=!1,r=/* @__PURE__ */ new Map;for(let i of e){let e=mY(i)?i.schema:i,a=kY(i);if(lY(e)){if(ZY(e,t),n)throw Error(`Multiple streaming success responses are not supported`);n=!0;let i=YY(r,a);if(i.noContent)throw Error(`Cannot combine no-content and streaming success responses for status: ${a}`);if(i.bufferedContentTypes.has(NY(e.contentType)))throw Error(`Cannot combine buffered and streaming success responses for status ${a} and content-type: ${e.contentType}`);r.set(a,{...i,stream:e})}else{let t=YY(r,a),n=yY(e.ast);if(t.stream!==void 0){if(n)throw Error(`Cannot combine no-content and streaming success responses for status: ${a}`);let e=AY(i);if(NY(e.contentType)===NY(t.stream.contentType))throw Error(`Cannot combine buffered and streaming success responses for status ${a} and content-type: ${e.contentType}`)}n||t.bufferedContentTypes.add(NY(AY(i).contentType)),t.noContent=t.noContent||n}}XY(e,kY)}function YY(e,t){let n=e.get(t);return n===void 0&&(n={bufferedContentTypes:/* @__PURE__ */ new Set,noContent:!1},e.set(t,n)),n}function XY(e,t){let n=/* @__PURE__ */ new Map;for(let r of e){let e=t(r),i=xY(r.ast),a=mY(r)?r.schema:i?.body??r,o=yY(a.ast)?``:NY(lY(a)?a.contentType:AY(r).contentType),s=n.get(e);s===void 0&&(s={headerContentType:void 0,plainContentTypes:/* @__PURE__ */ new Set},n.set(e,s));let c=()=>/* @__PURE__ */ Error(`Cannot combine a response with headers with another response for status ${e} and content-type: ${o||`<no content>`}`);if(mY(r)||i!==void 0){if(s.headerContentType!==void 0)throw Error(`Cannot declare multiple responses with headers for status ${e}`);if(s.plainContentTypes.has(o))throw c();s.headerContentType=o}else{if(s.headerContentType===o)throw c();s.plainContentTypes.add(o)}}}function ZY(e,t){if(t===`HEAD`)throw Error(`HEAD endpoints cannot declare streaming success responses`);if(uY(e)&&QY(e.events.ast))throw Error(`SSE event name is reserved: ${WY}`)}function QY(e){return $Y(vb(e),/* @__PURE__ */ new Set)}function $Y(e,t){if(t.has(e))return!1;if(t.add(e),Qv(e))return e.types.some(e=>$Y(e,t));if($v(e))return $Y(e.thunk(),t);if(!Zv(e))return!1;let n=e.propertySignatures.find(e=>e.name===`event`);return n!==void 0&&eX(n.type,t)}function eX(e,t){if(t.has(e))return!1;t.add(e);let n=vb(e);return n===e?Jv(e)?e.literal===WY:Qv(e)?e.types.some(e=>eX(e,t)):$v(e)?eX(e.thunk(),t):!1:eX(n,t)}function tX(e){let t=DY(e.ast),n=xY(e.ast);if(n===void 0)return nX(e,t);let r=HE(n.headers);return W({body:nX(HE(n.body),t),headers:r}).pipe(fD(e)).annotate({"~httpApiWithHeaders":{...n,headersCodec:xO(r)}})}function nX(e,t){switch(t._tag){case`Json`:return bO(e);case`FormUrlEncoded`:return xO(e);case`Text`:case`Uint8Array`:return e}}function rX(e,t){switch(EY(e.ast,t)._tag){case`Json`:return bO(e);case`FormUrlEncoded`:return xO(e);case`Text`:case`Uint8Array`:case`Multipart`:return e}}const iX=/*#__PURE__*/ VY(`POST`),aX=`~effect/httpapi/HttpApi`,oX={[aX]:aX,pipe(){return Tn(this,arguments)},add(...e){let t={...this.groups};for(let n of e)Hr(t,n.identifier,n);return cX({...sX(this),groups:t})},addHttpApi(e){let t={...this.groups};for(let n of Object.keys(e.groups)){let r=e.groups[n];Hr(t,n,r.annotateMerge(Ss(e.annotations,r.annotations)))}return cX({...sX(this),groups:t})},prefix(e){return cX({...sX(this),groups:$a(this.groups,t=>t.prefix(e))})},middleware(e){return cX({...sX(this),groups:$a(this.groups,t=>t.middleware(e))})},annotate(e,t){return cX({...sX(this),annotations:ds(this.annotations,e,t)})},annotateMerge(e){return cX({...sX(this),annotations:Ss(this.annotations,e)})}},sX=e=>({identifier:e.identifier,groups:e.groups,annotations:e.annotations}),cX=e=>{function t(){}return Object.setPrototypeOf(t,oX),Object.assign(t,e)},lX=e=>cX({identifier:e,groups:{},annotations:cs()}),uX=(e,t)=>{let n=Object.values(e.groups);for(let r of n){let n=Ss(e.annotations,r.annotations);t.onGroup({group:r,mergedAnnotations:n});let i=Object.values(r.endpoints);for(let e of i)(!t.predicate||t.predicate({endpoint:e,group:r}))&&t.onEndpoint({group:r,endpoint:e,middleware:e.middlewares,mergedAnnotations:Ss(n,e.annotations),successes:dX(IY(e),kY),errors:dX(LY(e),MY)})}},dX=(e,t)=>{let n=/* @__PURE__ */ new Map;return e.forEach(r),n;function r(e){let r=mY(e)?e.schema:e;if(lY(r))return;let i=t(e),a=n.get(i);a===void 0?n.set(i,[e]):a.push(e)}};var fX=class extends (/*#__PURE__*/ N()(`effect/httpapi/HttpApi/AdditionalSchemas`)){},pX=class extends (/*#__PURE__*/ N()(`effect/httpapi/HttpApi/ParseOptions`)){};const mX=/*#__PURE__*/ oN({status:400}),hX=`~effect/httpapi/HttpApiError/HttpApiSchemaError`;var gX=class e extends (/*#__PURE__*/ ute(`HttpApiSchemaError`)){[hX]=hX;static is(e){return M(e,hX)}static wrap(t,n){return Wg(n,n=>new e({kind:t,cause:n}))}name=`HttpApiSchemaError`;message=this.kind;[ON](){return F(mX)}};const _X=`~effect/httpapi/HttpApiMiddleware`,vX=`~effect/httpapi/HttpApiMiddleware/Security`,yX=e=>M(e,vX),bX=()=>(e,t)=>{let n=ai(),r;n!==0&&(oi(2),r=new globalThis.Error,oi(n));class i extends N()(e){}let a=i;if(Object.defineProperty(i,"stack",{get(){return r?.stack}}),a[_X]=_X,a.error=xX(t?.error),a.requiredForClient=t?.requiredForClient??!1,t?.security!==void 0){if(Object.keys(t.security).length===0)throw Error(`HttpApiMiddleware.Service: security object must not be empty`);a[vX]=vX,a.security=t.security}return a};function xX(e){return e===void 0?/* @__PURE__ */ new Set:new Set(Array.isArray(e)?e:[e])}const SX=(e,t)=>um(e,(e,n)=>jh(e,e=>gX.is(e)?t(e,n):R(e))),CX=/*#__PURE__*/ new Set;function wX(e){if(e===void 0)return CX;let t=nb(e.ast);return Zv(t)&&t.indexSignatures.length===0?new Set(t.propertySignatures.map(e=>String(e.name))):void 0}function TX(e,t){if(t===void 0||!e.includes(`:`))return e;let n=wX(t);if(n===void 0)return e;let r=``,i=0,a=-1;for(let t=0;t<e.length;t++){let o=e[t];if(i>0||t===a){r+=o,o===`\\`?r+=e[++t]??``:o===`(`?i++:o===`)`&&i--;continue}if(o!==`:`){r+=o;continue}if(e[t+1]===`:`){r+=`::`,t++;continue}let s=/^:(\w+)/.exec(e.slice(t));if(s!==null&&n.has(s[1])){r+=s[0],t+=s[0].length-1;let n=e[t+1];n===`(`?a=t+1:n!==void 0&&!`/.-?`.includes(n)&&(r+=`(.*?)`)}else r+=`::`}return r}var EX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Identifier`)){},DX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Title`)){},OX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Version`)){},kX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Description`)){},AX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/License`)){},jX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/ExternalDocs`)){},MX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Servers`)){},NX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Format`)){},PX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Summary`)){},FX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Deprecated`)){},IX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Override`)){};const LX=/*#__PURE__*/ Ts(`effect/httpapi/OpenApi/Exclude`,{defaultValue:An});var RX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Transform`)){};const zX={},BX=/*#__PURE__*/ new WeakMap,VX=e=>{if(Array.isArray(e))return e.map(VX);if(typeof e==`object`&&e&&!Object.isFrozen(e)){let t={};for(let n of Object.keys(e))Hr(t,n,VX(e[n]));return t}return e};function HX(e,t,n){let r=xs(e,t);Oa(r)&&n(r.value)}function UX(e,t){let n=t??zX,r=BX.get(n);r===void 0&&(r=/* @__PURE__ */ new WeakMap,BX.set(n,r));let i=r.get(e);if(i!==void 0)return VX(i);let a=WX(e,n);return r.set(e,VX(a)),a}function WX(e,t){let n={openapi:`3.1.0`,info:{title:`Api`,version:`0.0.1`},paths:{},components:{schemas:{},securitySchemes:{}},security:[],tags:[]},r=[],i=/* @__PURE__ */ new Set,a=/* @__PURE__ */ new Set,o=[];HX(e.annotations,DX,e=>{n.info.title=e}),HX(e.annotations,OX,e=>{n.info.version=e}),HX(e.annotations,kX,e=>{n.info.description=e}),HX(e.annotations,AX,e=>{n.info.license=e}),HX(e.annotations,PX,e=>{n.info.summary=e}),HX(e.annotations,MX,e=>{n.servers=[...e]}),uX(e,{onGroup({group:e}){if(_s(e.annotations,LX))return;let t={name:ps(e.annotations,DX,()=>e.identifier)};HX(e.annotations,kX,e=>{t.description=e}),HX(e.annotations,jX,e=>{t.externalDocs=e}),HX(e.annotations,IX,e=>{for(let[n,r]of Object.entries(e))Hr(t,n,r)}),HX(e.annotations,RX,e=>{t=e(t)}),n.tags.push(t)},onEndpoint({endpoint:e,group:t,mergedAnnotations:s,middleware:c}){if(_s(s,LX))return;let l={tags:[ps(t.annotations,DX,()=>t.identifier)],operationId:ps(e.annotations,EX,()=>t.topLevel?e.identifier:`${t.identifier}.${e.identifier}`),parameters:[],security:[],responses:{}},u=wX(e.params),d=e.path.replace(/:(\w+)\??/g,(e,t)=>u===void 0||u.has(t)?`{${t}}`:e),f=e.method.toLowerCase(),p=f===`query`,m=p?`QUERY`:f,h=p?[`paths`,d,`x-oai-additionalOperations`,m]:[`paths`,d,m];function g(e,t){for(let[n,{content:i,descriptions:a,headers:o,streamContent:s}]of e){let e=a.size>0?Array.from(a).join(` | `):t();Hr(l.responses,n,{description:e});for(let e of o){let t=nb(e.ast);if(Zv(t))for(let e of t.propertySignatures){let t=String(e.name).toLowerCase();t!==`content-type`&&(l.responses[n].headers??={},Hr(l.responses[n].headers,t,{schema:{},required:!hb(e.type)}),r.push({_tag:`parameter`,ast:e.type,path:[...h,`responses`,String(n),`headers`,t,`schema`]}))}}i!==void 0&&i.forEach((e,t)=>{e.forEach((e,i)=>{let a=Array.from(e,My),o=a.length===1?a[0]:new Vy(a);r.push({_tag:`schema`,ast:XX(o,t),path:[...h,`responses`,String(n),`content`,i,`schema`]}),l.responses[n].content??={},Hr(l.responses[n].content,i,{schema:{}})})}),s!==void 0&&s.forEach((e,t)=>{l.responses[n].content??={},uY(e)?(r.push({_tag:`schema`,ast:My(e.events),path:[...h,`responses`,String(n),`content`,t,`schema`]}),r.push({_tag:`schema`,ast:My(bO(eO(e.error,WD()))),path:[...h,`responses`,String(n),`content`,t,`x-effect-stream`,`causeSchema`]}),r.push({_tag:`schema`,ast:My(e.error),path:[...h,`responses`,String(n),`content`,t,`x-effect-stream`,`errorSchema`]}),Hr(l.responses[n].content,t,{schema:{},"x-effect-stream":{encoding:`sse`,causeSchema:{},errorSchema:{},failureEvent:GX}})):Hr(l.responses[n].content,t,{schema:{type:`string`,format:`binary`},"x-effect-stream":{encoding:`uint8array`}})})}}function _(e,t){if(e){let n=nb(e.ast);if(Zv(n))for(let e of n.propertySignatures)l.parameters.push({name:String(e.name),in:t,schema:{},required:t===`path`||!hb(e.type)}),r.push({_tag:`parameter`,ast:e.type,path:[...h,`parameters`,String(l.parameters.length-1),`schema`]})}}HX(e.annotations,kX,e=>{l.description=e}),HX(e.annotations,PX,e=>{l.summary=e}),HX(e.annotations,FX,e=>{l.deprecated=e}),HX(e.annotations,jX,e=>{l.externalDocs=e}),c.forEach(e=>{if(yX(e))for(let[t,n]of Object.entries(e.security))v(t,n),l.security.push({[t]:[]})});function v(e,t){let r=QX(t);if(!Object.hasOwn(n.components.securitySchemes,e)){Hr(n.components.securitySchemes,e,r);return}if(!Sr($X(n.components.securitySchemes[e]),$X(r)))throw new globalThis.Error(`Conflicting OpenAPI security scheme: ${e}`)}let y=yM(e.method);if(y){let t=/* @__PURE__ */ new Map;for(let n of FY(e)){if(yY(n.ast))continue;let r=EY(n.ast,e.method),i=t.get(r.contentType);i===void 0?t.set(r.contentType,{encoding:r,schemas:[n]}):i.schemas.push(n)}if(t.size>0){let e={};for(let[n,{encoding:i,schemas:a}]of t){let t=a.map(My),o=t.length===1?t[0]:new Vy(t);r.push({_tag:`schema`,ast:XX(o,i._tag),path:[...h,`requestBody`,`content`,n,`schema`]}),Hr(e,n,{schema:{}})}l.requestBody={content:e,required:!0}}}if(_(e.params,`path`),!y&&e.payload.size===1){let t=e.payload.values().next().value;_(t.schemas[0],`query`)}_(e.headers,`header`),_(e.query,`query`),g(KX(e),()=>`Success`),g(qX(LY(e),MY,JX),()=>`Error`);let b=`${f} ${d.replace(/\{[^}]+\}/g,`{}`)}`;if(i.has(b))throw new globalThis.Error(`Duplicate OpenAPI operation for ${e.method} ${d}`);i.add(b),Object.hasOwn(n.paths,d)||Hr(n.paths,d,{});let x=()=>{let e=n.paths[d];return p?e[`x-oai-additionalOperations`]??={}:e};x()[m]=l,o.push(()=>{let t=x(),n=t[m];HX(e.annotations,IX,e=>{for(let[t,r]of Object.entries(e))Hr(n,t,r)}),HX(e.annotations,RX,e=>{n=e(n)});let r=n.operationId;if(r!==void 0){if(a.has(r))throw new globalThis.Error(`Duplicate OpenAPI operationId: ${r}`);a.add(r)}t[m]=n})}}),HX(e.annotations,fX,e=>{e.forEach(e=>{let t=Mb(e.ast);if(t!==void 0){if(Object.hasOwn(n.components.schemas,t))throw new globalThis.Error(`Duplicate component schema identifier: ${t}`);Hr(n.components.schemas,t,{}),r.push({_tag:`schema`,ast:e.ast,path:[`components`,`schemas`,t]})}})});function s(e){return`/`+e.map(UC).join(`/`)}if(lo(r)){let e=XC(Uw(qw(yo(r,e=>lw(e.ast)),t),{onExcessProperty:`error`})),i=r.map((t,n)=>({op:`replace`,path:s(t.path),value:e.schemas[n]}));Object.entries(e.definitions).forEach(([e,t])=>{i.push({op:`add`,path:s([`components`,`schemas`,e]),value:t})}),n=Xw(i,n)}for(let e of o)e();return Object.keys(n.components.schemas).forEach(e=>{if(!ZC.test(e))throw new globalThis.Error(`Invalid component schema key: ${e}`)}),HX(e.annotations,IX,e=>{for(let[t,r]of Object.entries(e))Hr(n,t,r)}),HX(e.annotations,RX,e=>{n=e(n)}),n}const GX=`effect/httpapi/stream/failure`;function KX(e){return qX(IY(e),kY,JX)}function qX(e,t,n){let r=/* @__PURE__ */ new Map;return e.forEach(i),r;function i(e){let i=xY(e.ast),c=mY(e)?e.schema:i?.body??e,l=mY(e)?e.headers:i?.headersCodec,u=t(e),d=c.ast;lY(c)?s(c,u):yY(d)?a(u,n(e.ast)??n(d)??`<No Content>`):o(c,u,AY(e),n(e.ast)??n(d)),l!==void 0&&r.get(u).headers.push(l)}function a(e,t){let n=r.get(e);n===void 0?r.set(e,{descriptions:/* @__PURE__ */ new Set([t]),content:void 0,headers:[],streamContent:void 0}):t!==void 0&&n.descriptions.add(t)}function o(e,t,n,i){let a=r.get(t),{_tag:o,contentType:s}=n;if(a===void 0)r.set(t,{descriptions:new Set(i===void 0?[]:[i]),content:/* @__PURE__ */ new Map([[o,/* @__PURE__ */ new Map([[s,/* @__PURE__ */ new Set([e])]])]]),headers:[],streamContent:void 0});else if(i!==void 0&&a.descriptions.add(i),a.content===void 0)a.content=/* @__PURE__ */ new Map([[o,/* @__PURE__ */ new Map([[s,/* @__PURE__ */ new Set([e])]])]]);else{let t=a.content.get(o);if(t===void 0)a.content.set(o,/* @__PURE__ */ new Map([[s,/* @__PURE__ */ new Set([e])]]));else{let n=t.get(s);n===void 0?t.set(s,/* @__PURE__ */ new Set([e])):n.add(e)}}}function s(e,t){let n=r.get(t);n===void 0?r.set(t,{descriptions:/* @__PURE__ */ new Set,content:void 0,headers:[],streamContent:/* @__PURE__ */ new Map([[e.contentType,e]])}):n.streamContent===void 0?n.streamContent=/* @__PURE__ */ new Map([[e.contentType,e]]):n.streamContent.set(e.contentType,e)}}function JX(e){return Nb(e)??Mb(e)}const YX=/*#__PURE__*/ U.annotate({format:`binary`});function XX(e,t){switch(t){case`Uint8Array`:return YX.ast;case`Text`:return U.ast;case`FormUrlEncoded`:case`Json`:return e;case`Multipart`:return ZX(e)}}function ZX(e){return Kv(e)&&e.annotations?.representation?.id===`effect/http/PersistedFile`?YX.ast:typeof e?.recur==`function`?e.recur(ZX):e}const QX=e=>{let t={};switch(HX(e.annotations,kX,e=>{t.description=e}),e._tag){case`Basic`:return{...t,type:`http`,scheme:`basic`};case`Http`:{let n=xs(e.annotations,NX).pipe(Fa(e=>({bearerFormat:e})),Na);return{...t,type:`http`,scheme:e.scheme,...n}}case`ApiKey`:return{...t,type:`apiKey`,name:e.key,in:e.in}}},$X=e=>e.type===`http`?{...e,scheme:e.scheme.toLowerCase()}:e.in===`header`?{...e,name:e.name.toLowerCase()}:e,eZ=(e,t)=>yP(V(function*(n){let r=yield*Qh(),i=[],a=Array.from(r.mapUnsafe.keys()).filter(e=>e.startsWith(`effect/httpapi/HttpApiGroup/`)),o=Object.values(e.groups);for(let e of o){let t=r.mapUnsafe.get(e.key)?.routes;if(t===void 0){let t=a.length===0?`none`:a.join(`, `);return yield*_h(`HttpApiGroup "${e.identifier}" not found (key: "${e.key}"). Did you forget to provide HttpApiBuilder.group(api, "${e.identifier}", ...)? Available groups: ${t}`)}i.push(...t)}if(yield*n.addAll(i),t?.openapiPath){let r=Fn(e=>dN(UX(e)));yield*n.add(`GET`,t.openapiPath,I(()=>r(e)))}})),tZ=(e,t,n)=>hm(mh(function*(){let r=(yield*Qh()).pipe(ws(zp)),i=e.groups[t],a=n(cZ(i)),o=rh(a)?yield*a:a,s=[];for(let t of o.handlers.values())s.push(fZ(e,i,t,r));return rs(/* @__PURE__ */ new Map([[i.key,{routes:s,handlers:o.handlers}]]))})),nZ=`~effect/httpapi/HttpApiBuilder/Handlers`,rZ=e=>{switch(e._tag){case`Http`:return B(cP,t=>dT(aZ(t.headers.authorization,e.scheme)??``));case`ApiKey`:{let t=e.in===`header`?e.key.toLowerCase():e.key,n=W({[t]:U}),r=e.in===`query`?qoe(n):e.in===`cookie`?Goe(n):Koe(n);return Jh(r,{onFailure:()=>dT(``),onSuccess:e=>dT(e[t])})}case`Basic`:{let e={username:``,password:dT(``)};return B(cP,t=>{let n=aZ(t.headers.authorization,iZ);if(n===void 0)return e;let r=qa(pte(n));if(r===void 0)return e;let i=r.indexOf(`:`);return i===-1?e:{username:r.slice(0,i),password:dT(r.slice(i+1))}})}}},iZ=`Basic`;function aZ(e,t){let n=t.length;if(e===void 0||e.length<=n||e.charCodeAt(n)!==32||e.slice(0,n).toLowerCase()!==t.toLowerCase())return;let r=n+1;for(;e.charCodeAt(r)===32;)r++;return r===e.length?void 0:e.slice(r)}const oZ=(e,t,n,r,i)=>{if(!Object.hasOwn(e.group.endpoints,t))throw Error(`HttpApiEndpoint "${t}" not found in HttpApiGroup "${e.group.identifier}"`);if(e.handlers.has(t))throw Error(`Handler for HttpApiEndpoint "${t}" is already registered in HttpApiGroup "${e.group.identifier}"`);let a=e.group.endpoints[t];return e.handlers.set(t,{endpoint:a,handler:n,isRaw:r,uninterruptible:i?.uninterruptible??!1}),e},sZ={[nZ]:nZ,pipe(){return Tn(this,arguments)},handle(e,t,n){return oZ(this,e,t,!1,n)},handleAll(e){for(let[t,n]of Object.entries(e)){let e=typeof n==`function`?n:n.handler,r=typeof n==`function`?void 0:n.options;oZ(this,t,e,!1,r)}return this},handleRaw(e,t,n){return oZ(this,e,t,!0,n)}},cZ=e=>{let t=Object.create(sZ);return t.group=e,t.handlers=/* @__PURE__ */ new Map,t};function lZ(e,t){let n=/* @__PURE__ */ new Map;return e.forEach(({encoding:e,schemas:r},i)=>{let a=DE(K(r),t);e._tag===`Multipart`?n.set(i,{_tag:`Multipart`,mode:e.mode,limits:e.limits,decode:a}):n.set(i,{_tag:e._tag,decode:a,nullOnEmpty:r.some(e=>Jne(vb(e.ast)))})}),n}function uZ(e,t,n){let r=yM(t.method),i=r?NY(t.headers[`content-type`]??`application/json`):`application/x-www-form-urlencoded`,a=e.get(i);if(!a)return uN(`Unsupported content-type: ${i}`,{status:415});let{_tag:o,decode:s}=a;switch(o){case`Multipart`:if(a.mode===`buffered`){let e=Lh(t.multipart);return a.limits&&(e=tg(e,nP(a.limits))),z(e,s)}return F(a.limits?Vk(t.multipartStream,nP(a.limits)):t.multipartStream);case`Json`:return z(Lh(t.text),e=>{if(e===``)return s(a.nullOnEmpty?null:void 0);try{return s(JSON.parse(e))}catch{return R(new yE(new w_({message:`Expected a valid JSON body`})))}});case`Text`:return z(Lh(t.text),s);case`FormUrlEncoded`:{let e=r?B(Lh(t.urlParamsBody),hE):F(n);return z(e,s)}case`Uint8Array`:return z(B(Lh(t.arrayBuffer),e=>new Uint8Array(e)),s)}}function dZ(e,t,n,r,i,a){let o=Ss(Ss(e.annotations,t.annotations),n.annotations),s=ms(o,pX),c=e=>DE(e,s),l=NE(MZ(n),s),u=NE(NZ(n),s),d=Tj(n.params,c),f=Tj(n.headers,c),p=Tj(n.query,e=>c(SO(e))),m=xZ(n,s),h=bZ(n,s),g=n.payload.size>0&&!a?lZ(n.payload,s):void 0;return pZ(t,n,r,mh(function*(){let e=qb().context,r=gs(e,cP),a=gs(e,vP),o=gs(e,lP),s={request:r,endpoint:n,group:t};if(d&&(s.params=yield*gX.wrap(`Params`,d(a.params))),f&&(s.headers=yield*gX.wrap(`Headers`,f(r.headers))),p&&(s.query=yield*gX.wrap(`Query`,p(o))),g){let e=uZ(g,r,o);if(aN(e))return e;e!==void 0&&(s.payload=yield*gX.wrap(`Payload`,e))}let c=yield*i(s);if(aN(c))return c;let u;h!==void 0&&pY(c)&&(u=c.headers,c=c.body);let _=yield*gX.wrap(`Body`,m?.(c,e)??(u===void 0?l(c):h.encodeBody(c)));if(h===void 0||u===void 0)return _;let v=yield*gX.wrap(`ResponseHeaders`,h.encodeHeaders.get(_.status)(u));return gN(_,v)})).pipe(Hh,jh(e=>gX.is(e)?_h(e):Lh(u(e))),tg(r))}function fZ(e,t,n,r){let i=n.endpoint;return CP(i.method,TX(i.path,i.params),dZ(e,t,i,r,n.handler,n.isRaw),{uninterruptible:n.uninterruptible})}const pZ=(e,t,n,r)=>{let i={group:e,endpoint:t};for(let e of t.middlewares){let t=e,a=gs(n,t);r=(yX(t)?hZ(t,a):a)(r,i)}return r},mZ=/*#__PURE__*/ new WeakMap,hZ=(e,t)=>{let n=mZ.get(t);if(n!==void 0)return n;let r=Object.entries(e.security).map(([e,n])=>({decode:rZ(n),middleware:t[e]}));if(r.length===0)return j;let i=V(function*(e,t){e=Ih(e,e=>new _Z(e));let n;for(let i=0;i<r.length;i++){let{decode:a,middleware:o}=r[i],s=yield*Eh(z(a,n=>o(e,{credential:n,endpoint:t.endpoint,group:t.group})));if(Ha(s)){if(vZ(s.failure))return yield*R(s.failure.error);n=s;continue}return s.success}return yield*xh(n)});return mZ.set(t,i),i},gZ=`~effect/httpapi/HttpApiBuilder/HandlerError`;var _Z=class{[gZ]=gZ;error;constructor(e){this.error=e}};const vZ=e=>M(e,gZ),yZ=/*#__PURE__*/ vE(aN);function bZ(e,t){let n=/* @__PURE__ */ new Map,r=[];for(let i of e.success)mY(i)&&(n.set(kY(i),NE(i.headers,t)),lY(i.schema)||r.push(kZ(i)));return n.size===0?void 0:{encodeBody:NE(r.length===0?KE:r.length===1?r[0]:K(r),t),encodeHeaders:n}}function xZ(e,t){let n=SZ(e);if(n===void 0)return;let r=n.body,i=CZ(e),a=kY(n.schema),o=r.contentType;if(dY(r))return(e,t)=>sk(e)?F(pN(Vk(e,t),{status:a,contentType:o})):i?void 0:new yE(new w_({message:`Expected a streaming response`}));let s=wZ(r,t);return(e,t)=>sk(e)?F(pN(Vk(TZ(e,s),t),{status:a,contentType:o})):i?void 0:new yE(new w_({message:`Expected a streaming response`}))}function SZ(e){for(let t of e.success){let e=mY(t)?t.schema:t;if(lY(e))return{schema:t,body:e}}}function CZ(e){for(let t of e.success){let e=mY(t)?t.schema:t;if(RE(e)&&!lY(e))return!0}return e.success.size===0}function wZ(e,t){let n=bO(eO(e.error,WD()));return{sseMode:e.sseMode,encodeEvents:NE(G(e.events),t),encodeCause:NE(KD(n),t)}}function TZ(e,t){return e.pipe(t.sseMode===`data`?Ck(e=>({id:void 0,event:`message`,data:e})):j,Tk(e=>Lh(t.encodeEvents(e))),Ak(e=>lk(EZ(e,t))),Ck(OZ),Lk)}function EZ(e,t){return t.encodeCause(e).pipe(Lh,B(e=>({id:void 0,event:DZ,data:e})))}const DZ=`effect/httpapi/stream/failure`;function OZ(e){return oY.write({_tag:`Event`,event:e.event,id:e.id,data:e.data})}const kZ=/*#__PURE__*/ PZ(kY),AZ=/*#__PURE__*/ PZ(MY);function jZ(e){if(!mY(e))return AZ(e);let t=NE(e.schema),n=NE(e.headers),r=LZ(MY(e),AY(e),yY(e.schema.ast)),i=IZ((e,n)=>t(e,n).pipe(Ih(e=>e.issue),z(e=>r(e,n))),n);return yZ.pipe(fD(e,i))}function MZ(e){let t=IY(e).map(kZ);return t.length===1?t[0]:K(t)}function NZ(e){let t=LY(e).map(jZ);return t.length===0?KE:t.length===1?t[0]:K(t)}function PZ(e){let t=/* @__PURE__ */ new WeakMap;return n=>{let r=mY(n)?n:n.ast,i=t.get(r);if(i!==void 0)return i;let a=mY(n)?n.schema:n,o=yZ.pipe(fD(a,FZ(e,n)));return t.set(r,o),o}}function FZ(e,t){let n=xY(t.ast);if(n!==void 0)return IZ(LZ(e(n.body),DY(n.body.ast),yY(n.body.ast)),NE(n.headersCodec));let r=mY(t)?t.schema:t;return zv({decode:(e,t)=>R(new E_({message:`Encode only schema`},e,t)),encode:LZ(e(t),AY(t),yY(r.ast))})}function IZ(e,t){return zv({decode:(e,t)=>R(new E_({message:`Encode only schema`},e,t)),encode:(n,r)=>{let i=n;return z(e(i.body,r),e=>B(t(i.headers,r).pipe(Ih(e=>e.issue)),t=>gN(e,t)))}})}function LZ(e,t,n){switch(t._tag){case`Json`:return(r,i)=>{if(r===void 0||n)return F(oN({status:e}));try{let n=JSON.stringify(r);return F(uN(n,{status:e,contentType:t.contentType}))}catch{return R(new w_({expected:`a JSON-serializable response body`},r,i))}};case`Text`:return n=>F(uN(n,{status:e,contentType:t.contentType}));case`Uint8Array`:return n=>F(cN(n,{status:e,contentType:t.contentType}));case`FormUrlEncoded`:return n=>F(eoe(n,{status:e}).pipe(mN(`content-type`,t.contentType)))}}const RZ=`~effect/httpapi/HttpApiGroup`,zZ={[RZ]:RZ,add(...e){let t={...this.endpoints};for(let n of e)Hr(t,n.identifier,n);return VZ({...BZ(this),endpoints:t})},prefix(e){return VZ({...BZ(this),endpoints:$a(this.endpoints,t=>t.prefix(e))})},middleware(e){return VZ({...BZ(this),endpoints:$a(this.endpoints,t=>t.middleware(e))})},annotateMerge(e){return VZ({...BZ(this),annotations:Ss(this.annotations,e)})},annotate(e,t){return VZ({...BZ(this),annotations:ds(this.annotations,e,t)})},annotateEndpointsMerge(e){return VZ({...BZ(this),endpoints:$a(this.endpoints,t=>t.annotateMerge(e))})},annotateEndpoints(e,t){return VZ({...BZ(this),endpoints:$a(this.endpoints,n=>n.annotate(e,t))})},pipe(){return Tn(this,arguments)}},BZ=e=>({identifier:e.identifier,topLevel:e.topLevel,endpoints:e.endpoints,annotations:e.annotations}),VZ=e=>{function t(){}return Object.setPrototypeOf(t,zZ),t.key=`effect/httpapi/HttpApiGroup/${e.identifier}`,Object.assign(t,e)},HZ=(e,t)=>VZ({identifier:e,topLevel:t?.topLevel??!1,endpoints:{},annotations:cs()}),UZ=(e,t,n)=>iX(n.name,`${e.apiPath}/${t.name}/${n.name}`,{payload:n.input,success:n.success,error:XJ(n,e.errors)}).annotate(kX,n.description),WZ=(e,t)=>{class n extends bX()(`effect-actions/http/SchemaErrors/${e}`,{error:qJ(t)}){}return{SchemaErrors:n,layer:SX(n,e=>R(YJ(t,e)))}};function GZ(e,t){let[n,...r]=t.actions.map(n=>UZ(e,t,n));if(n===void 0)return;let i=HZ(t.name).add(n,...r);if(t.schemaError===void 0)return{native:i,middleware:fm};let a=WZ(t.name,t.schemaError);return{native:i.middleware(a.SchemaErrors),middleware:a.layer}}function KZ(e){let[t,...n]=e,r=lX(`actions`).annotate(pX,{errors:`all`});return t===void 0?r:r.add(t,...n)}const qZ=e=>e,JZ=(e,t,n,r)=>{let i=e=>Object.fromEntries(t.group.actions.map(n=>{let i=rY(t.group,n,e,r);return[n.name,e=>i(e.payload)]}));return vm(B(t.build,n=>tZ(e,t.group.name,e=>e.handleAll(i(qZ(n)))))).pipe(Cm(n))};function YZ(e,...t){$J(`action group`,t.map(e=>e.name));let n=new Map(t.flatMap(t=>{let n=GZ(e,t);return n===void 0?[]:[[t,n]]})),r=(e,r={})=>{$J(`implementation group`,e.map(e=>e.group.name));for(let n of e)if(!t.includes(n.group))throw Error(`Implementation of group "${n.group.name}" is not served by this adapter`);let i=e.flatMap(e=>{let t=n.get(e.group);return t===void 0?[]:[{app:e,...t}]}),a=KZ(i.map(({native:e})=>e)),[o,...s]=i.map(({app:e,middleware:t})=>JZ(a,e,t,r.before));return o===void 0?eZ(a):eZ(a).pipe(Cm([o,...s]))},i=KZ([...n.values()].map(({native:e})=>e));return{groups:t,api:i,layer:r,openApi:(t=`${e.apiPath}/openapi.json`)=>bP(`GET`,t,dN(UX(i)))}}var XZ=class extends vO()(`BadRequest`,{error:U},{httpApiStatus:400}){},ZZ=class extends vO()(`Unauthorized`,{error:U},{httpApiStatus:401}){},QZ=class extends vO()(`Forbidden`,{error:U},{httpApiStatus:403}){},$Z=class extends vO()(`NotFound`,{error:U},{httpApiStatus:404}){},eQ=class extends vO()(`Conflict`,{error:U},{httpApiStatus:409}){},tQ=class extends vO()(`TooManyRequests`,{error:U},{httpApiStatus:429}){},nQ=class extends vO()(`InternalServerError`,{error:U},{httpApiStatus:500}){cause},rQ=class extends vO()(`ServiceUnavailable`,{error:U},{httpApiStatus:503}){};const iQ=[XZ,ZZ,QZ,$Z,eQ,tQ,nQ,rQ],aQ=W({email:U,password:U}),oQ=lD([`none`,`client_secret_basic`,`client_secret_post`]),sQ=lD([`web`,`native`]),cQ=W({client_name:U,redirect_uris:G(U),resources:G(U),token_endpoint_auth_method:oQ,application_type:sQ}),lQ=W({client_id:U,client_name:U,redirect_uris:G(U),application_type:sQ}),uQ=W({client_id:U}),dQ=W({client_id:U,blocked:QE}),fQ=W({onboarding:BE(lD([`managed`,`dcr`,`cimd`])),blocked:BE(QE),client_id:U,client_name:BE(U),redirect_uris:G(U),token_endpoint_auth_method:BE(U),application_type:BE(uD(U)),scope:BE(U),grant_types:BE(G(U))}),pQ=fQ.pipe(nD({client_secret:BE(U),client_secret_expires_at:BE(ZE)})),mQ=W({identifier:U,name:U,scopes:G(U)}),hQ=mQ.pipe(nD({builtIn:QE})),gQ=W({identifier:U}),_Q=W({client_id:U,resource:U}),vQ=W({client_id:U,resources:G(U)}),yQ=W({clientAccess:G(_Q)}),bQ=rD(U,G(U)),xQ=aO,SQ=W({name:U,permissions:bQ,expiresAt:uD(xQ)}),CQ=W({keyId:U}),wQ=W({keyId:U,name:BE(U),permissions:BE(bQ),enabled:BE(QE)}),TQ=W({keyId:U,name:U,enabled:QE,permissions:bQ,expiresAt:uD(xQ),createdAt:xQ}),EQ={invalid:{schema:XZ,make:()=>new XZ({error:`Invalid request`})},internal:{schema:nQ,make:()=>new nQ({error:`Request could not be completed`})}},DQ=aY({name:`issuer`,errors:iQ,schemaError:EQ},tY(`setupStatus`,{description:`Check whether the issuer needs its first owner account.`,access:`read`,success:W({required:QE}),mcp:!1}),tY(`setupOwner`,{description:`Create the first owner account.`,access:`write`,input:aQ,success:W({created:QE}).pipe(sY(201)),mcp:!1}),tY(`verifyApiKey`,{description:`Verify the bearer API key against one resource and return its granted scopes.`,access:`read`,input:W({resource:U}),success:W({keyId:U,ownerId:U,resource:U,scopes:G(U),expiresAt:uD(xQ)}),mcp:!1})),OQ=W({clients:G(fQ),resources:G(hQ),clientAccess:G(_Q),email:U,issuer:U}),kQ=aY({name:`administration`,errors:iQ,schemaError:EQ},tY(`listClients`,{description:`List clients, resources and access grants.`,access:`read`,success:OQ}),tY(`createClient`,{description:`Register a first-party OAuth client. Returns its secret once when confidential.`,access:`write`,input:cQ,success:pQ.pipe(sY(201))}),tY(`updateClient`,{description:`Rename a first-party client or change its redirect URIs and application type.`,access:`write`,input:lQ,success:fQ}),tY(`deleteClient`,{description:`Delete a first-party OAuth client.`,access:`write`,input:uQ,success:W({deleted:QE})}),tY(`revokeClient`,{description:`Revoke a client’s authorization grants.`,access:`write`,input:uQ,success:W({revoked:QE})}),tY(`blockClient`,{description:`Block or unblock OAuth authorization for a client.`,access:`write`,input:dQ,success:W({blocked:QE})}),tY(`rotateClientSecret`,{description:`Rotate a confidential client secret. Returns the new secret once.`,access:`write`,input:uQ,success:pQ}),tY(`setClientAccess`,{description:`Set the resources a client may request.`,access:`write`,input:vQ,success:yQ}),tY(`createResource`,{description:`Create an OAuth resource and its scopes.`,access:`write`,input:mQ,success:mQ.pipe(sY(201))}),tY(`updateResource`,{description:`Update an OAuth resource and its scopes.`,access:`write`,input:mQ,success:mQ}),tY(`deleteResource`,{description:`Delete a resource and its client-resource links. Stored authorization grants and API-key permissions are retained; recreating the resource can restore access.`,access:`write`,input:gQ,success:W({deleted:QE})}),tY(`listApiKeys`,{description:`List API key metadata without secret values.`,access:`read`,success:W({keys:G(TQ)})}),tY(`createApiKey`,{description:`Create a scoped API key. Returns its secret once.`,access:`write`,input:SQ,success:TQ.pipe(nD({key:U}),sY(201))}),tY(`updateApiKey`,{description:`Update an API key’s name, permissions or enabled state.`,access:`write`,input:wQ,success:TQ}),tY(`deleteApiKey`,{description:`Delete an API key.`,access:`write`,input:CQ,success:W({deleted:QE})})),AQ=YZ({apiPath:`/api`},kQ,DQ);AQ.api;const jQ=e=>iQ.some(t=>EE(t)(e)),MQ=e=>{let t=new nQ({error:`Request could not be completed`});return t.cause=e,t},NQ=kE(W({message:zE(U),error_description:zE(U)})),PQ=e=>({error:Aa(Ia(NQ(e.body),e=>ja(e.message??e.error_description)),()=>`Request could not be completed`)});function FQ(e){if(jQ(e))return e;if(aL(e)){let t=PQ(e);switch(e.statusCode){case 400:case 422:return new XZ(t);case 401:case 403:return new QZ(t);case 404:return new $Z(t);case 409:return new eQ(t);case 429:return new tQ(t);case 503:return new rQ(t)}}return moe(e)&&IQ(e.reason)?new XZ({error:`Request body could not be read`}):MQ(e)}const IQ=er(`RequestParseError`),LQ=e=>ch({try:e,catch:FQ}),RQ=$ae(K(iQ)),zQ=(e,t={})=>{let n=iQ.find(t=>EE(t)(e));return n===void 0?_h(/* @__PURE__ */ Error(`Undeclared API error`)):RQ(e,{status:jb(`httpApiStatus`)(n.ast)??500,headers:t}).pipe(Lh)},BQ=e=>zQ(FQ(e));var VQ=/* @__PURE__ */ e({NodeSqliteDialect:()=>JQ}),HQ=class{get supportsCreateIfNotExists(){return!0}get supportsTransactionalDdl(){return!1}get supportsReturning(){return!0}async acquireMigrationLock(){}async releaseMigrationLock(){}get supportsOutput(){return!0}},UQ=class{#e;#t=new GQ;#n;#r;constructor(e){this.#e={...e}}async init(){this.#n=this.#e.database,this.#r=new WQ(this.#n),this.#e.onCreateConnection&&await this.#e.onCreateConnection(this.#r)}async acquireConnection(){return await this.#t.lock(),this.#r}async beginTransaction(e){await e.executeQuery(qt.raw(`begin`))}async commitTransaction(e){await e.executeQuery(qt.raw(`commit`))}async rollbackTransaction(e){await e.executeQuery(qt.raw(`rollback`))}async releaseConnection(){this.#t.unlock()}async destroy(){this.#n?.close()}},WQ=class{#e;constructor(e){this.#e=e}executeQuery(e){let{sql:t,parameters:n}=e,r=this.#e.prepare(t),i=n;if(r.columns().length>0)return Promise.resolve({rows:r.all(...i)});let{changes:a,lastInsertRowid:o}=r.run(...i);return Promise.resolve({rows:[],numAffectedRows:BigInt(a),insertId:typeof o==`bigint`?o:BigInt(o)})}async*streamQuery(){throw Error(`Streaming query is not supported by SQLite driver.`)}},GQ=class{#e;#t;async lock(){for(;this.#e!==void 0;)await this.#e;this.#e=new Promise(e=>{this.#t=e})}unlock(){let e=this.#t;this.#e=void 0,this.#t=void 0,e?.()}},KQ=class{#e;constructor(e){this.#e=e}async getSchemas(){return[]}async getTables(e={withInternalKyselyTables:!1}){let t=this.#e.selectFrom(`sqlite_schema`).where(`type`,`=`,`table`).where(`name`,`not like`,`sqlite_%`).select(`name`).$castTo();e.withInternalKyselyTables||(t=t.where(`name`,`!=`,oee).where(`name`,`!=`,see));let n=await t.execute();return Promise.all(n.map(({name:e})=>this.#t(e)))}async getMetadata(e){return{tables:await this.getTables(e)}}async#t(e){let t=this.#e,n=(await t.selectFrom(`sqlite_master`).where(`name`,`=`,e).select(`sql`).$castTo().execute())[0]?.sql?.split(/[\(\),]/)?.find(e=>e.toLowerCase().includes(`autoincrement`))?.split(/\s+/)?.[0]?.replace(/["`]/g,``);return{name:e,columns:(await t.selectFrom(Kt`pragma_table_info(${e})`.as(`table_info`)).select([`name`,`type`,`notnull`,`dflt_value`]).execute()).map(e=>({name:e.name,dataType:e.type,isNullable:!e.notnull,isAutoIncrementing:e.name===n,hasDefaultValue:e.dflt_value!=null})),isView:!1}}},qQ=class extends cee{getCurrentParameterPlaceholder(){return`?`}getLeftIdentifierWrapper(){return`"`}getRightIdentifierWrapper(){return`"`}getAutoIncrement(){return`autoincrement`}},JQ=class{#e;constructor(e){this.#e={...e}}createDriver(){return new UQ(this.#e)}createQueryCompiler(){return new qQ}createAdapter(){return new HQ}createIntrospector(e){return new KQ(e)}};const YQ=e=>{let t=DE(e);return e=>Ih(t(e),MQ)};function XQ(e){return(t,...n)=>ch({try:async()=>(await Kt(t,...n).execute(e)).rows,catch:MQ})}const ZQ=H(`Database.transaction`)(function*(e,t){let n=yield*ch({try:()=>e.startTransaction().execute(),catch:MQ}),r=yield*Oh(t(XQ(n))),i=Bh(ch({try:()=>n.rollback().execute(),catch:MQ})),a=ch({try:()=>n.commit().execute(),catch:MQ}).pipe(Rh(()=>i));return yield*Cp(r)?a:i,yield*r},yg);async function QQ(e){let t=new Sn(e);try{t.exec(`PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON; PRAGMA busy_timeout = 5000;`);let e=new lee({dialect:new JQ({database:t})});return await Kt`SELECT 1`.execute(e),{kysely:e,sql:XQ(e),close:()=>e.destroy()}}catch(e){throw t.close(),e}}const $Q=`admin`,e$=e=>`${e}/mcp`,t$=[`offline_access`],n$=e=>`resource:${e}`,r$=YQ(KD(G(U))),i$=YQ(W({identifier:U,name:U,allowedScopes:U})),a$=YQ(G(_Q)),o$=YQ(G(W({clientId:U}))),s$=e=>({identifier:encodeURIComponent(e)}),c$=(e,t)=>({...s$(t),client_id:encodeURIComponent(e)}),l$=V(function*(e,t,n,r){let i=yield*iS(1),a=e=>i.withPermit(e),o=H(`Resources.decode`)(function*(e){let t=yield*i$(e),n=yield*r$(t.allowedScopes);return{identifier:t.identifier,name:t.name,scopes:n.filter(e=>!t$.includes(e))}}),s=H(`Resources.list`)(function*(){let t=yield*e`SELECT identifier, name, allowedScopes FROM oauthResource ORDER BY createdAt, identifier`;return yield*ah(t,o)}),c=H(`Resources.get`)(function*(t){let n=yield*e`SELECT identifier, name, allowedScopes FROM oauthResource WHERE identifier = ${t}`;return n[0]?yield*o(n[0]):void 0}),l=H(`Resources.access`)(function*(){return yield*a$(yield*e`SELECT clientId AS client_id, resourceId AS resource FROM oauthClientResource ORDER BY clientId, resourceId`)}),u=H(`Resources.accessForClient`)(function*(t){return yield*a$(yield*e`SELECT clientId AS client_id, resourceId AS resource FROM oauthClientResource WHERE clientId = ${t} ORDER BY resourceId`)}),d=H(`Resources.validateSelection`)(function*(e){return new Set(e).size===e.length?yield*ah(e,e=>mh(function*(){return(yield*c(e))||(yield*R(new XZ({error:`Unknown Resource`})))})):yield*R(new XZ({error:`Choose unique Resources`}))}),f=H(`Resources.scopesFor`)(function*(e){let t=yield*d(e);return[.../* @__PURE__ */ new Set([...t$,...t.flatMap(e=>e.scopes)])]}),p=e=>{try{return new URL(e).href===e}catch{return!1}},m=H(`Resources.validateInput`)(function*(e){let t=e.identifier.trim(),n=e.name.trim(),r=[...new Set(e.scopes.map(e=>e.trim()))];return p(t)?!n||r.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)||t$.includes(e))?yield*R(new XZ({error:`Resources require a name and well-formed custom scopes`})):{identifier:t,name:n,scopes:r}:yield*R(new XZ({error:`Resource identifiers must be absolute URIs in canonical form`}))}),h=H(`Resources.syncClient`)(function*(t){let n=yield*u(t),r=yield*f(n.map(e=>e.resource));yield*e`UPDATE oauthClient SET scopes = ${JSON.stringify(r)}, updatedAt = ${yield*Om} WHERE clientId = ${t}`}),g=e=>n([.../* @__PURE__ */ new Set([...t$,...e.flatMap(e=>e.scopes)])],e.map(e=>e.identifier)),_=H(`Resources.synchronize`)(function*(){g(yield*s());for(let t of yield*o$(yield*e`SELECT clientId FROM oauthClient ORDER BY clientId`))yield*h(t.clientId)});return{list:s,get:c,access:l,hasAccess:H(`Resources.hasAccess`)(function*(t,n){return(yield*e`SELECT 1 FROM oauthClientResource WHERE clientId = ${t} AND resourceId = ${n} LIMIT 1`).length>0}),scopesFor:f,synchronize:_,create:H(`Resources.create`)(function*(n,r){let i=yield*m(n);yield*LQ(()=>t().api.adminCreateOAuthResource({headers:r,body:{identifier:i.identifier,name:i.name,allowedScopes:[...t$,...i.scopes]}})),yield*_();let a=yield*o$(yield*e`SELECT clientId FROM oauthClient WHERE userId IS NULL ORDER BY clientId`);for(let e of a)yield*LQ(()=>t().api.adminLinkClientResource({headers:r,params:c$(e.clientId,i.identifier)}));return yield*_(),i},a),update:H(`Resources.update`)(function*(e,n){let i=yield*m(e),a=i.identifier===r;return a&&(i.scopes.length!==1||i.scopes[0]!==`admin`)?yield*R(new XZ({error:`The administration Resource scopes are reserved`})):(yield*LQ(()=>t().api.adminUpdateOAuthResource({headers:n,params:s$(i.identifier),body:a?{name:i.name}:{name:i.name,allowedScopes:[...t$,...i.scopes]}})),a||(yield*_()),i)},a),delete:H(`Resources.delete`)(function*(e,n){return e===r?yield*R(new XZ({error:`The administration Resource is reserved`})):(yield*LQ(()=>t().api.adminDeleteOAuthResource({headers:n,params:s$(e)})),yield*_(),{deleted:!0})},a),setAccess:H(`Resources.setAccess`)(function*(n,r,i){if(!(yield*e`SELECT id FROM oauthClient WHERE clientId = ${n}`).length)return yield*R(new $Z({error:`Client not found`}));yield*d(r);let a=(yield*u(n)).map(e=>e.resource);for(let e of a.filter(e=>!r.includes(e)))yield*LQ(()=>t().api.adminUnlinkClientResource({headers:i,params:c$(n,e)}));for(let e of r.filter(e=>!a.includes(e)))yield*LQ(()=>t().api.adminLinkClientResource({headers:i,params:c$(n,e)}));return yield*h(n),yield*u(n)},a)}}),u$=(e,t)=>EP()(n=>t.pipe(Zh({onFailure:F,onSuccess:t=>ig(n,e,t)}),nse((e,t)=>F(mN(t,`cache-control`,`no-store`))))),d$=e=>`"${e.replace(/["\\]/g,`\\$&`)}"`,f$=e=>{let t=new URL(e.resource),n=`/.well-known/oauth-protected-resource${t.pathname===`/`?``:t.pathname}`,r=new URL(t);r.pathname=n;let i=r.href,a=i.slice(r.origin.length),o=dN({resource:e.resource,authorization_servers:e.authorizationServers,bearer_methods_supported:[`header`],scopes_supported:e.scopesSupported,resource_name:e.resourceName});return{layer:EP(e=>mh(function*(){let n=yield*cP,r=new URL(n.url,t.origin);return(n.method===`GET`||n.method===`HEAD`)&&r.href.slice(r.origin.length)===a?o:yield*e}),{global:!0}),metadataUrl:i,challenge:(e={})=>`Bearer ${[[`resource_metadata`,i],[`error`,e.error],[`error_description`,e.errorDescription],[`scope`,e.scope]].flatMap(([e,t])=>t===void 0?[]:[`${e}=${d$(t)}`]).join(`, `)}`}},p$=H(`Administration.providerSession`)(function*(e,t){let{context:n}=e,r=new Date((yield*Om)+6e4),i=yield*cg(LQ(()=>n.internalAdapter.createSession(t,!0,{expiresAt:r},!0)),e=>sh(()=>n.internalAdapter.deleteSession(e.token))),a=yield*LQ(async()=>(await Promise.all([uI(n.authCookies.sessionToken.name,i.token,n.secret),uI(n.authCookies.dontRememberToken.name,`true`,n.secret)])).map(e=>e.split(`;`)[0]).join(`; `));return new Headers({origin:e.settings.baseURL,cookie:a})});async function m$(e,t){let n;if(e.database)n=typeof e.database==`function`?e.database(e):await t(e);else{let t=_e(e),r=Object.keys(t).reduce((e,t)=>(e[t]=[],e),{}),{memoryAdapter:i}=await import(`./dist-DpbKAALD.mjs`);n=i(r)(e)}return n.transaction||(O.warn(`Adapter does not correctly implement transaction function, patching it automatically. Please update your adapter implementation.`),n.transaction=async e=>e(n)),n}async function h$(e){return m$(e,async e=>{let{createKyselyAdapter:t,kyselyAdapter:n}=await import(`./kysely-adapter-C-VVCuVS.mjs`),{kysely:r,databaseType:i,transaction:a}=await t(e);if(!r)throw new l(`Failed to initialize database adapter`);return n(r,{type:i||`sqlite`,debugLogs:e.database&&`debugLogs`in e.database?e.database.debugLogs:!1,transaction:a})(e)})}function g$(e){let{indexesByTable:t,tables:n}=xe(e),r={};for(let e in n){let t=n[e],i=t.fields,a={};if(Object.entries(i).forEach(([e,t])=>{if(a[t.fieldName||e]=t,t.references){let r=n[t.references.model];r&&(a[t.fieldName||e].references={...t.references,model:r.modelName,field:t.references.field})}}),r[t.modelName]){r[t.modelName].fields={...r[t.modelName].fields,...a},t.disableMigrations&&(r[t.modelName].disableMigrations=!0);continue}r[t.modelName]={fields:a,order:t.order||1/0,disableMigrations:t.disableMigrations}}for(let[e,n]of t)r[e]&&(r[e].indexes=n);return r}const _$={postgres:{string:[`character varying`,`varchar`,`text`,`uuid`],number:[`int4`,`integer`,`bigint`,`smallint`,`numeric`,`real`,`double precision`],boolean:[`bool`,`boolean`],date:[`timestamptz`,`timestamp`,`date`],json:[`json`,`jsonb`]},mysql:{string:[`varchar`,`text`,`uuid`],number:[`integer`,`int`,`bigint`,`smallint`,`decimal`,`float`,`double`],boolean:[`boolean`,`tinyint`],date:[`timestamp`,`datetime`,`date`],json:[`json`]},sqlite:{string:[`TEXT`],number:[`INTEGER`,`REAL`,`BIGINT`],boolean:[`INTEGER`,`BOOLEAN`],date:[`DATE`,`INTEGER`],json:[`TEXT`]},mssql:{string:[`varchar`,`nvarchar`,`uniqueidentifier`],number:[`int`,`bigint`,`smallint`,`decimal`,`float`,`double`],boolean:[`bit`,`smallint`],date:[`datetime2`,`date`,`datetime`],json:[`varchar`,`nvarchar`]}};function v$(e,t){return`${ye(e)}\u0000${ye(t)}`}function y$(e,t){return`${e}\u0000${t}`}function b$(e,t){return e.unique===(t.unique??!1)&&e.validFullColumns&&e.columns.length===t.columns.length&&e.columns.every((e,n)=>e===t.columns[n])}function x$(e){return typeof e==`boolean`?e:typeof e==`number`?e!==0:e===`1`||e?.toLowerCase()===`true`||e===`t`}function S$(e){return new Map(e.map(e=>{let t=[...e.columns].sort((e,t)=>e.position-t.position);return[v$(e.table,e.name),{columns:t.flatMap(e=>e.name===null?[]:[e.name]),name:e.name,table:e.table,unique:e.unique,validFullColumns:e.valid&&!e.partial&&t.length>0&&t.every(e=>e.name!==null&&e.fullLength)}]}))}async function C$(e,t,n,r){if(r)return S$(await r(n));let i;switch(t.type){case`sqlite`:i=(await Kt`
415
+ `}case`Retry`:return`retry: ${Xs(e.duration)}\n\n`}}};function sY(e){let t=typeof e==`string`?KF(e):e;return e=>e.annotate({httpApiStatus:t})}const cY=/*#__PURE__*/ (e=>eD.pipe(sY(e)))(204),lY=e=>RE(e)&&M(e,`~effect/httpapi/HttpApiSchema/Stream`),uY=e=>lY(e)&&e._tag===`StreamSse`,dY=e=>lY(e)&&e._tag===`StreamUint8Array`,fY=`~effect/httpapi/HttpApiSchema/WithHeaders`,pY=e=>M(e,`~effect/httpapi/HttpApiSchema/WithHeadersValue`),mY=e=>RE(e)&&M(e,`~effect/httpapi/HttpApiSchema/WithHeaders`);function hY(e,t,n){return LE(e.ast,{[fY]:fY,schema:t,headers:n})}function gY(e,t){return e.annotate({"~httpApiEncoding":{_tag:t._tag,contentType:t.contentType??_Y(t._tag)}})}function _Y(e){switch(e){case`Multipart`:return`multipart/form-data`;case`Json`:return`application/json`;case`FormUrlEncoded`:return`application/x-www-form-urlencoded`;case`Uint8Array`:return`application/octet-stream`;case`Text`:return`text/plain`}}function vY(e){return t=>gY(t,{_tag:`FormUrlEncoded`,...e})}const yY=e=>{if(qv(e))return!0;let t=vb(e);if(qv(t))return!0;let n=e.encoding?.[0].to;return n!==void 0&&qv(n)},bY=/*#__PURE__*/ jb(`~httpApiEncoding`),xY=/*#__PURE__*/ jb(`~httpApiWithHeaders`),SY=/*#__PURE__*/ jb(`httpApiStatus`),CY={_tag:`Json`,contentType:`application/json`},wY={_tag:`FormUrlEncoded`,contentType:`application/x-www-form-urlencoded`};function TY(e){return bY(e)??CY}function EY(e,t){return bY(e)||(yM(t)?CY:wY)}function DY(e){let t=TY(e);if(t._tag===`Multipart`)throw Error(`Multipart is not supported in response`);return t}function OY(e){return SY(e)??200}function kY(e){return mY(e)?SY(e.ast)??OY(e.schema.ast):OY(e.ast)}function AY(e){return mY(e)&&bY(e.ast)===void 0?DY(e.schema.ast):DY(e.ast)}function jY(e){return SY(e)??500}function MY(e){return mY(e)?SY(e.ast)??jY(e.schema.ast):jY(e.ast)}function NY(e){let t=e.toLowerCase().trim(),n=t.indexOf(`;`);return n===-1?t:t.slice(0,n).trim()}const PY=`~effect/httpapi/HttpApiEndpoint`;function FY(e){let t=[];for(let{schemas:n}of e.payload.values())t.push(...n);return t}function IY(e){let t=Array.from(e.success);return lo(t)?t:[cY]}function LY(e){let t=new Set(e.error),n=e.disableCodecs?j:KY;for(let r of e.middlewares){let e=r;for(let r of e.error)t.add(n(r))}return Array.from(t)}const RY={[PY]:PY,pipe(){return Tn(this,arguments)},prefix(e){return BY({...zY(this),path:TP(this.path,e)})},middleware(e){return BY({...zY(this),middlewares:/* @__PURE__ */ new Set([...this.middlewares,e])})},annotate(e,t){return BY({...zY(this),annotations:ds(this.annotations,e,t)})},annotateMerge(e){return BY({...zY(this),annotations:Ss(this.annotations,e)})}},zY=e=>({identifier:e.identifier,path:e.path,method:e.method,params:e.params,query:e.query,headers:e.headers,payload:e.payload,success:e.success,error:e.error,annotations:e.annotations,middlewares:e.middlewares,disableCodecs:e.disableCodecs});function BY(e){function t(){}return Object.setPrototypeOf(t,RY),Object.assign(t,e)}const VY=e=>(t,n,r)=>{let i=r?.disableCodecs??!1,a=i?j:xO;return BY({identifier:t,path:n,method:e,params:HY(r?.params,a),query:HY(r?.query,a),headers:HY(r?.headers,a),payload:UY(r?.payload,e,i),success:GY(r?.success,e,i),error:qY(r?.error,i),annotations:cs(),middlewares:/* @__PURE__ */ new Set,disableCodecs:i})};function HY(e,t){if(e!==void 0)return RE(e)?t(e):t(W(e))}function UY(e,t,n){let r=/* @__PURE__ */ new Map;if(e===void 0)return r;let i=Array.isArray(e)?e:RE(e)?[e]:[W(e).pipe(vY())],a=n?j:rX;for(let e of i){let n=EY(e.ast,t),i=NY(n.contentType),o=r.get(i);if(o){if(o.encoding._tag!==n._tag)throw Error(`Multiple payload encodings for content-type: ${n.contentType}`);if(o.encoding._tag===`Multipart`)throw Error(`Multiple multipart payloads for content-type: ${n.contentType}`);o.schemas.push(a(e,t))}else r.set(i,{encoding:n,schemas:[a(e,t)]})}return r}const WY=`effect/httpapi/stream/failure`;function GY(e,t,n){if(e===void 0)return/* @__PURE__ */ new Set;let r=so(e);return JY(r,t),new Set(n?r:r.map(KY))}const KY=/*#__PURE__*/ Fn(e=>lY(e)?e:mY(e)?hY(e,lY(e.schema)?e.schema:nX(e.schema,AY(e)),xO(e.headers)):tX(e));function qY(e,t){if(e===void 0)return/* @__PURE__ */ new Set;let n=so(e);for(let e of n){let t=mY(e)?e.schema:e;if(lY(t))throw Error(`Streaming schemas are not supported in error responses`)}return XY(n,MY),new Set(t?n:n.map(KY))}function JY(e,t){let n=!1,r=/* @__PURE__ */ new Map;for(let i of e){let e=mY(i)?i.schema:i,a=kY(i);if(lY(e)){if(ZY(e,t),n)throw Error(`Multiple streaming success responses are not supported`);n=!0;let i=YY(r,a);if(i.noContent)throw Error(`Cannot combine no-content and streaming success responses for status: ${a}`);if(i.bufferedContentTypes.has(NY(e.contentType)))throw Error(`Cannot combine buffered and streaming success responses for status ${a} and content-type: ${e.contentType}`);r.set(a,{...i,stream:e})}else{let t=YY(r,a),n=yY(e.ast);if(t.stream!==void 0){if(n)throw Error(`Cannot combine no-content and streaming success responses for status: ${a}`);let e=AY(i);if(NY(e.contentType)===NY(t.stream.contentType))throw Error(`Cannot combine buffered and streaming success responses for status ${a} and content-type: ${e.contentType}`)}n||t.bufferedContentTypes.add(NY(AY(i).contentType)),t.noContent=t.noContent||n}}XY(e,kY)}function YY(e,t){let n=e.get(t);return n===void 0&&(n={bufferedContentTypes:/* @__PURE__ */ new Set,noContent:!1},e.set(t,n)),n}function XY(e,t){let n=/* @__PURE__ */ new Map;for(let r of e){let e=t(r),i=xY(r.ast),a=mY(r)?r.schema:i?.body??r,o=yY(a.ast)?``:NY(lY(a)?a.contentType:AY(r).contentType),s=n.get(e);s===void 0&&(s={headerContentType:void 0,plainContentTypes:/* @__PURE__ */ new Set},n.set(e,s));let c=()=>/* @__PURE__ */ Error(`Cannot combine a response with headers with another response for status ${e} and content-type: ${o||`<no content>`}`);if(mY(r)||i!==void 0){if(s.headerContentType!==void 0)throw Error(`Cannot declare multiple responses with headers for status ${e}`);if(s.plainContentTypes.has(o))throw c();s.headerContentType=o}else{if(s.headerContentType===o)throw c();s.plainContentTypes.add(o)}}}function ZY(e,t){if(t===`HEAD`)throw Error(`HEAD endpoints cannot declare streaming success responses`);if(uY(e)&&QY(e.events.ast))throw Error(`SSE event name is reserved: ${WY}`)}function QY(e){return $Y(vb(e),/* @__PURE__ */ new Set)}function $Y(e,t){if(t.has(e))return!1;if(t.add(e),Qv(e))return e.types.some(e=>$Y(e,t));if($v(e))return $Y(e.thunk(),t);if(!Zv(e))return!1;let n=e.propertySignatures.find(e=>e.name===`event`);return n!==void 0&&eX(n.type,t)}function eX(e,t){if(t.has(e))return!1;t.add(e);let n=vb(e);return n===e?Jv(e)?e.literal===WY:Qv(e)?e.types.some(e=>eX(e,t)):$v(e)?eX(e.thunk(),t):!1:eX(n,t)}function tX(e){let t=DY(e.ast),n=xY(e.ast);if(n===void 0)return nX(e,t);let r=HE(n.headers);return W({body:nX(HE(n.body),t),headers:r}).pipe(fD(e)).annotate({"~httpApiWithHeaders":{...n,headersCodec:xO(r)}})}function nX(e,t){switch(t._tag){case`Json`:return bO(e);case`FormUrlEncoded`:return xO(e);case`Text`:case`Uint8Array`:return e}}function rX(e,t){switch(EY(e.ast,t)._tag){case`Json`:return bO(e);case`FormUrlEncoded`:return xO(e);case`Text`:case`Uint8Array`:case`Multipart`:return e}}const iX=/*#__PURE__*/ VY(`POST`),aX=`~effect/httpapi/HttpApi`,oX={[aX]:aX,pipe(){return Tn(this,arguments)},add(...e){let t={...this.groups};for(let n of e)Hr(t,n.identifier,n);return cX({...sX(this),groups:t})},addHttpApi(e){let t={...this.groups};for(let n of Object.keys(e.groups)){let r=e.groups[n];Hr(t,n,r.annotateMerge(Ss(e.annotations,r.annotations)))}return cX({...sX(this),groups:t})},prefix(e){return cX({...sX(this),groups:$a(this.groups,t=>t.prefix(e))})},middleware(e){return cX({...sX(this),groups:$a(this.groups,t=>t.middleware(e))})},annotate(e,t){return cX({...sX(this),annotations:ds(this.annotations,e,t)})},annotateMerge(e){return cX({...sX(this),annotations:Ss(this.annotations,e)})}},sX=e=>({identifier:e.identifier,groups:e.groups,annotations:e.annotations}),cX=e=>{function t(){}return Object.setPrototypeOf(t,oX),Object.assign(t,e)},lX=e=>cX({identifier:e,groups:{},annotations:cs()}),uX=(e,t)=>{let n=Object.values(e.groups);for(let r of n){let n=Ss(e.annotations,r.annotations);t.onGroup({group:r,mergedAnnotations:n});let i=Object.values(r.endpoints);for(let e of i)(!t.predicate||t.predicate({endpoint:e,group:r}))&&t.onEndpoint({group:r,endpoint:e,middleware:e.middlewares,mergedAnnotations:Ss(n,e.annotations),successes:dX(IY(e),kY),errors:dX(LY(e),MY)})}},dX=(e,t)=>{let n=/* @__PURE__ */ new Map;return e.forEach(r),n;function r(e){let r=mY(e)?e.schema:e;if(lY(r))return;let i=t(e),a=n.get(i);a===void 0?n.set(i,[e]):a.push(e)}};var fX=class extends (/*#__PURE__*/ N()(`effect/httpapi/HttpApi/AdditionalSchemas`)){},pX=class extends (/*#__PURE__*/ N()(`effect/httpapi/HttpApi/ParseOptions`)){};const mX=/*#__PURE__*/ oN({status:400}),hX=`~effect/httpapi/HttpApiError/HttpApiSchemaError`;var gX=class e extends (/*#__PURE__*/ ute(`HttpApiSchemaError`)){[hX]=hX;static is(e){return M(e,hX)}static wrap(t,n){return Wg(n,n=>new e({kind:t,cause:n}))}name=`HttpApiSchemaError`;message=this.kind;[ON](){return F(mX)}};const _X=`~effect/httpapi/HttpApiMiddleware`,vX=`~effect/httpapi/HttpApiMiddleware/Security`,yX=e=>M(e,vX),bX=()=>(e,t)=>{let n=ai(),r;n!==0&&(oi(2),r=new globalThis.Error,oi(n));class i extends N()(e){}let a=i;if(Object.defineProperty(i,"stack",{get(){return r?.stack}}),a[_X]=_X,a.error=xX(t?.error),a.requiredForClient=t?.requiredForClient??!1,t?.security!==void 0){if(Object.keys(t.security).length===0)throw Error(`HttpApiMiddleware.Service: security object must not be empty`);a[vX]=vX,a.security=t.security}return a};function xX(e){return e===void 0?/* @__PURE__ */ new Set:new Set(Array.isArray(e)?e:[e])}const SX=(e,t)=>um(e,(e,n)=>jh(e,e=>gX.is(e)?t(e,n):R(e))),CX=/*#__PURE__*/ new Set;function wX(e){if(e===void 0)return CX;let t=nb(e.ast);return Zv(t)&&t.indexSignatures.length===0?new Set(t.propertySignatures.map(e=>String(e.name))):void 0}function TX(e,t){if(t===void 0||!e.includes(`:`))return e;let n=wX(t);if(n===void 0)return e;let r=``,i=0,a=-1;for(let t=0;t<e.length;t++){let o=e[t];if(i>0||t===a){r+=o,o===`\\`?r+=e[++t]??``:o===`(`?i++:o===`)`&&i--;continue}if(o!==`:`){r+=o;continue}if(e[t+1]===`:`){r+=`::`,t++;continue}let s=/^:(\w+)/.exec(e.slice(t));if(s!==null&&n.has(s[1])){r+=s[0],t+=s[0].length-1;let n=e[t+1];n===`(`?a=t+1:n!==void 0&&!`/.-?`.includes(n)&&(r+=`(.*?)`)}else r+=`::`}return r}var EX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Identifier`)){},DX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Title`)){},OX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Version`)){},kX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Description`)){},AX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/License`)){},jX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/ExternalDocs`)){},MX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Servers`)){},NX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Format`)){},PX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Summary`)){},FX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Deprecated`)){},IX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Override`)){};const LX=/*#__PURE__*/ Ts(`effect/httpapi/OpenApi/Exclude`,{defaultValue:An});var RX=class extends (/*#__PURE__*/ N()(`effect/httpapi/OpenApi/Transform`)){};const zX={},BX=/*#__PURE__*/ new WeakMap,VX=e=>{if(Array.isArray(e))return e.map(VX);if(typeof e==`object`&&e&&!Object.isFrozen(e)){let t={};for(let n of Object.keys(e))Hr(t,n,VX(e[n]));return t}return e};function HX(e,t,n){let r=xs(e,t);Oa(r)&&n(r.value)}function UX(e,t){let n=t??zX,r=BX.get(n);r===void 0&&(r=/* @__PURE__ */ new WeakMap,BX.set(n,r));let i=r.get(e);if(i!==void 0)return VX(i);let a=WX(e,n);return r.set(e,VX(a)),a}function WX(e,t){let n={openapi:`3.1.0`,info:{title:`Api`,version:`0.0.1`},paths:{},components:{schemas:{},securitySchemes:{}},security:[],tags:[]},r=[],i=/* @__PURE__ */ new Set,a=/* @__PURE__ */ new Set,o=[];HX(e.annotations,DX,e=>{n.info.title=e}),HX(e.annotations,OX,e=>{n.info.version=e}),HX(e.annotations,kX,e=>{n.info.description=e}),HX(e.annotations,AX,e=>{n.info.license=e}),HX(e.annotations,PX,e=>{n.info.summary=e}),HX(e.annotations,MX,e=>{n.servers=[...e]}),uX(e,{onGroup({group:e}){if(_s(e.annotations,LX))return;let t={name:ps(e.annotations,DX,()=>e.identifier)};HX(e.annotations,kX,e=>{t.description=e}),HX(e.annotations,jX,e=>{t.externalDocs=e}),HX(e.annotations,IX,e=>{for(let[n,r]of Object.entries(e))Hr(t,n,r)}),HX(e.annotations,RX,e=>{t=e(t)}),n.tags.push(t)},onEndpoint({endpoint:e,group:t,mergedAnnotations:s,middleware:c}){if(_s(s,LX))return;let l={tags:[ps(t.annotations,DX,()=>t.identifier)],operationId:ps(e.annotations,EX,()=>t.topLevel?e.identifier:`${t.identifier}.${e.identifier}`),parameters:[],security:[],responses:{}},u=wX(e.params),d=e.path.replace(/:(\w+)\??/g,(e,t)=>u===void 0||u.has(t)?`{${t}}`:e),f=e.method.toLowerCase(),p=f===`query`,m=p?`QUERY`:f,h=p?[`paths`,d,`x-oai-additionalOperations`,m]:[`paths`,d,m];function g(e,t){for(let[n,{content:i,descriptions:a,headers:o,streamContent:s}]of e){let e=a.size>0?Array.from(a).join(` | `):t();Hr(l.responses,n,{description:e});for(let e of o){let t=nb(e.ast);if(Zv(t))for(let e of t.propertySignatures){let t=String(e.name).toLowerCase();t!==`content-type`&&(l.responses[n].headers??={},Hr(l.responses[n].headers,t,{schema:{},required:!hb(e.type)}),r.push({_tag:`parameter`,ast:e.type,path:[...h,`responses`,String(n),`headers`,t,`schema`]}))}}i!==void 0&&i.forEach((e,t)=>{e.forEach((e,i)=>{let a=Array.from(e,My),o=a.length===1?a[0]:new Vy(a);r.push({_tag:`schema`,ast:XX(o,t),path:[...h,`responses`,String(n),`content`,i,`schema`]}),l.responses[n].content??={},Hr(l.responses[n].content,i,{schema:{}})})}),s!==void 0&&s.forEach((e,t)=>{l.responses[n].content??={},uY(e)?(r.push({_tag:`schema`,ast:My(e.events),path:[...h,`responses`,String(n),`content`,t,`schema`]}),r.push({_tag:`schema`,ast:My(bO(eO(e.error,WD()))),path:[...h,`responses`,String(n),`content`,t,`x-effect-stream`,`causeSchema`]}),r.push({_tag:`schema`,ast:My(e.error),path:[...h,`responses`,String(n),`content`,t,`x-effect-stream`,`errorSchema`]}),Hr(l.responses[n].content,t,{schema:{},"x-effect-stream":{encoding:`sse`,causeSchema:{},errorSchema:{},failureEvent:GX}})):Hr(l.responses[n].content,t,{schema:{type:`string`,format:`binary`},"x-effect-stream":{encoding:`uint8array`}})})}}function _(e,t){if(e){let n=nb(e.ast);if(Zv(n))for(let e of n.propertySignatures)l.parameters.push({name:String(e.name),in:t,schema:{},required:t===`path`||!hb(e.type)}),r.push({_tag:`parameter`,ast:e.type,path:[...h,`parameters`,String(l.parameters.length-1),`schema`]})}}HX(e.annotations,kX,e=>{l.description=e}),HX(e.annotations,PX,e=>{l.summary=e}),HX(e.annotations,FX,e=>{l.deprecated=e}),HX(e.annotations,jX,e=>{l.externalDocs=e}),c.forEach(e=>{if(yX(e))for(let[t,n]of Object.entries(e.security))v(t,n),l.security.push({[t]:[]})});function v(e,t){let r=QX(t);if(!Object.hasOwn(n.components.securitySchemes,e)){Hr(n.components.securitySchemes,e,r);return}if(!Sr($X(n.components.securitySchemes[e]),$X(r)))throw new globalThis.Error(`Conflicting OpenAPI security scheme: ${e}`)}let y=yM(e.method);if(y){let t=/* @__PURE__ */ new Map;for(let n of FY(e)){if(yY(n.ast))continue;let r=EY(n.ast,e.method),i=t.get(r.contentType);i===void 0?t.set(r.contentType,{encoding:r,schemas:[n]}):i.schemas.push(n)}if(t.size>0){let e={};for(let[n,{encoding:i,schemas:a}]of t){let t=a.map(My),o=t.length===1?t[0]:new Vy(t);r.push({_tag:`schema`,ast:XX(o,i._tag),path:[...h,`requestBody`,`content`,n,`schema`]}),Hr(e,n,{schema:{}})}l.requestBody={content:e,required:!0}}}if(_(e.params,`path`),!y&&e.payload.size===1){let t=e.payload.values().next().value;_(t.schemas[0],`query`)}_(e.headers,`header`),_(e.query,`query`),g(KX(e),()=>`Success`),g(qX(LY(e),MY,JX),()=>`Error`);let b=`${f} ${d.replace(/\{[^}]+\}/g,`{}`)}`;if(i.has(b))throw new globalThis.Error(`Duplicate OpenAPI operation for ${e.method} ${d}`);i.add(b),Object.hasOwn(n.paths,d)||Hr(n.paths,d,{});let x=()=>{let e=n.paths[d];return p?e[`x-oai-additionalOperations`]??={}:e};x()[m]=l,o.push(()=>{let t=x(),n=t[m];HX(e.annotations,IX,e=>{for(let[t,r]of Object.entries(e))Hr(n,t,r)}),HX(e.annotations,RX,e=>{n=e(n)});let r=n.operationId;if(r!==void 0){if(a.has(r))throw new globalThis.Error(`Duplicate OpenAPI operationId: ${r}`);a.add(r)}t[m]=n})}}),HX(e.annotations,fX,e=>{e.forEach(e=>{let t=Mb(e.ast);if(t!==void 0){if(Object.hasOwn(n.components.schemas,t))throw new globalThis.Error(`Duplicate component schema identifier: ${t}`);Hr(n.components.schemas,t,{}),r.push({_tag:`schema`,ast:e.ast,path:[`components`,`schemas`,t]})}})});function s(e){return`/`+e.map(UC).join(`/`)}if(lo(r)){let e=XC(Uw(qw(yo(r,e=>lw(e.ast)),t),{onExcessProperty:`error`})),i=r.map((t,n)=>({op:`replace`,path:s(t.path),value:e.schemas[n]}));Object.entries(e.definitions).forEach(([e,t])=>{i.push({op:`add`,path:s([`components`,`schemas`,e]),value:t})}),n=Xw(i,n)}for(let e of o)e();return Object.keys(n.components.schemas).forEach(e=>{if(!ZC.test(e))throw new globalThis.Error(`Invalid component schema key: ${e}`)}),HX(e.annotations,IX,e=>{for(let[t,r]of Object.entries(e))Hr(n,t,r)}),HX(e.annotations,RX,e=>{n=e(n)}),n}const GX=`effect/httpapi/stream/failure`;function KX(e){return qX(IY(e),kY,JX)}function qX(e,t,n){let r=/* @__PURE__ */ new Map;return e.forEach(i),r;function i(e){let i=xY(e.ast),c=mY(e)?e.schema:i?.body??e,l=mY(e)?e.headers:i?.headersCodec,u=t(e),d=c.ast;lY(c)?s(c,u):yY(d)?a(u,n(e.ast)??n(d)??`<No Content>`):o(c,u,AY(e),n(e.ast)??n(d)),l!==void 0&&r.get(u).headers.push(l)}function a(e,t){let n=r.get(e);n===void 0?r.set(e,{descriptions:/* @__PURE__ */ new Set([t]),content:void 0,headers:[],streamContent:void 0}):t!==void 0&&n.descriptions.add(t)}function o(e,t,n,i){let a=r.get(t),{_tag:o,contentType:s}=n;if(a===void 0)r.set(t,{descriptions:new Set(i===void 0?[]:[i]),content:/* @__PURE__ */ new Map([[o,/* @__PURE__ */ new Map([[s,/* @__PURE__ */ new Set([e])]])]]),headers:[],streamContent:void 0});else if(i!==void 0&&a.descriptions.add(i),a.content===void 0)a.content=/* @__PURE__ */ new Map([[o,/* @__PURE__ */ new Map([[s,/* @__PURE__ */ new Set([e])]])]]);else{let t=a.content.get(o);if(t===void 0)a.content.set(o,/* @__PURE__ */ new Map([[s,/* @__PURE__ */ new Set([e])]]));else{let n=t.get(s);n===void 0?t.set(s,/* @__PURE__ */ new Set([e])):n.add(e)}}}function s(e,t){let n=r.get(t);n===void 0?r.set(t,{descriptions:/* @__PURE__ */ new Set,content:void 0,headers:[],streamContent:/* @__PURE__ */ new Map([[e.contentType,e]])}):n.streamContent===void 0?n.streamContent=/* @__PURE__ */ new Map([[e.contentType,e]]):n.streamContent.set(e.contentType,e)}}function JX(e){return Nb(e)??Mb(e)}const YX=/*#__PURE__*/ U.annotate({format:`binary`});function XX(e,t){switch(t){case`Uint8Array`:return YX.ast;case`Text`:return U.ast;case`FormUrlEncoded`:case`Json`:return e;case`Multipart`:return ZX(e)}}function ZX(e){return Kv(e)&&e.annotations?.representation?.id===`effect/http/PersistedFile`?YX.ast:typeof e?.recur==`function`?e.recur(ZX):e}const QX=e=>{let t={};switch(HX(e.annotations,kX,e=>{t.description=e}),e._tag){case`Basic`:return{...t,type:`http`,scheme:`basic`};case`Http`:{let n=xs(e.annotations,NX).pipe(Fa(e=>({bearerFormat:e})),Na);return{...t,type:`http`,scheme:e.scheme,...n}}case`ApiKey`:return{...t,type:`apiKey`,name:e.key,in:e.in}}},$X=e=>e.type===`http`?{...e,scheme:e.scheme.toLowerCase()}:e.in===`header`?{...e,name:e.name.toLowerCase()}:e,eZ=(e,t)=>yP(V(function*(n){let r=yield*Qh(),i=[],a=Array.from(r.mapUnsafe.keys()).filter(e=>e.startsWith(`effect/httpapi/HttpApiGroup/`)),o=Object.values(e.groups);for(let e of o){let t=r.mapUnsafe.get(e.key)?.routes;if(t===void 0){let t=a.length===0?`none`:a.join(`, `);return yield*_h(`HttpApiGroup "${e.identifier}" not found (key: "${e.key}"). Did you forget to provide HttpApiBuilder.group(api, "${e.identifier}", ...)? Available groups: ${t}`)}i.push(...t)}if(yield*n.addAll(i),t?.openapiPath){let r=Fn(e=>dN(UX(e)));yield*n.add(`GET`,t.openapiPath,I(()=>r(e)))}})),tZ=(e,t,n)=>hm(mh(function*(){let r=(yield*Qh()).pipe(ws(zp)),i=e.groups[t],a=n(cZ(i)),o=rh(a)?yield*a:a,s=[];for(let t of o.handlers.values())s.push(fZ(e,i,t,r));return rs(/* @__PURE__ */ new Map([[i.key,{routes:s,handlers:o.handlers}]]))})),nZ=`~effect/httpapi/HttpApiBuilder/Handlers`,rZ=e=>{switch(e._tag){case`Http`:return B(cP,t=>dT(aZ(t.headers.authorization,e.scheme)??``));case`ApiKey`:{let t=e.in===`header`?e.key.toLowerCase():e.key,n=W({[t]:U}),r=e.in===`query`?qoe(n):e.in===`cookie`?Goe(n):Koe(n);return Jh(r,{onFailure:()=>dT(``),onSuccess:e=>dT(e[t])})}case`Basic`:{let e={username:``,password:dT(``)};return B(cP,t=>{let n=aZ(t.headers.authorization,iZ);if(n===void 0)return e;let r=qa(pte(n));if(r===void 0)return e;let i=r.indexOf(`:`);return i===-1?e:{username:r.slice(0,i),password:dT(r.slice(i+1))}})}}},iZ=`Basic`;function aZ(e,t){let n=t.length;if(e===void 0||e.length<=n||e.charCodeAt(n)!==32||e.slice(0,n).toLowerCase()!==t.toLowerCase())return;let r=n+1;for(;e.charCodeAt(r)===32;)r++;return r===e.length?void 0:e.slice(r)}const oZ=(e,t,n,r,i)=>{if(!Object.hasOwn(e.group.endpoints,t))throw Error(`HttpApiEndpoint "${t}" not found in HttpApiGroup "${e.group.identifier}"`);if(e.handlers.has(t))throw Error(`Handler for HttpApiEndpoint "${t}" is already registered in HttpApiGroup "${e.group.identifier}"`);let a=e.group.endpoints[t];return e.handlers.set(t,{endpoint:a,handler:n,isRaw:r,uninterruptible:i?.uninterruptible??!1}),e},sZ={[nZ]:nZ,pipe(){return Tn(this,arguments)},handle(e,t,n){return oZ(this,e,t,!1,n)},handleAll(e){for(let[t,n]of Object.entries(e)){let e=typeof n==`function`?n:n.handler,r=typeof n==`function`?void 0:n.options;oZ(this,t,e,!1,r)}return this},handleRaw(e,t,n){return oZ(this,e,t,!0,n)}},cZ=e=>{let t=Object.create(sZ);return t.group=e,t.handlers=/* @__PURE__ */ new Map,t};function lZ(e,t){let n=/* @__PURE__ */ new Map;return e.forEach(({encoding:e,schemas:r},i)=>{let a=DE(K(r),t);e._tag===`Multipart`?n.set(i,{_tag:`Multipart`,mode:e.mode,limits:e.limits,decode:a}):n.set(i,{_tag:e._tag,decode:a,nullOnEmpty:r.some(e=>Jne(vb(e.ast)))})}),n}function uZ(e,t,n){let r=yM(t.method),i=r?NY(t.headers[`content-type`]??`application/json`):`application/x-www-form-urlencoded`,a=e.get(i);if(!a)return uN(`Unsupported content-type: ${i}`,{status:415});let{_tag:o,decode:s}=a;switch(o){case`Multipart`:if(a.mode===`buffered`){let e=Lh(t.multipart);return a.limits&&(e=tg(e,nP(a.limits))),z(e,s)}return F(a.limits?Vk(t.multipartStream,nP(a.limits)):t.multipartStream);case`Json`:return z(Lh(t.text),e=>{if(e===``)return s(a.nullOnEmpty?null:void 0);try{return s(JSON.parse(e))}catch{return R(new yE(new w_({message:`Expected a valid JSON body`})))}});case`Text`:return z(Lh(t.text),s);case`FormUrlEncoded`:{let e=r?B(Lh(t.urlParamsBody),hE):F(n);return z(e,s)}case`Uint8Array`:return z(B(Lh(t.arrayBuffer),e=>new Uint8Array(e)),s)}}function dZ(e,t,n,r,i,a){let o=Ss(Ss(e.annotations,t.annotations),n.annotations),s=ms(o,pX),c=e=>DE(e,s),l=NE(MZ(n),s),u=NE(NZ(n),s),d=Tj(n.params,c),f=Tj(n.headers,c),p=Tj(n.query,e=>c(SO(e))),m=xZ(n,s),h=bZ(n,s),g=n.payload.size>0&&!a?lZ(n.payload,s):void 0;return pZ(t,n,r,mh(function*(){let e=qb().context,r=gs(e,cP),a=gs(e,vP),o=gs(e,lP),s={request:r,endpoint:n,group:t};if(d&&(s.params=yield*gX.wrap(`Params`,d(a.params))),f&&(s.headers=yield*gX.wrap(`Headers`,f(r.headers))),p&&(s.query=yield*gX.wrap(`Query`,p(o))),g){let e=uZ(g,r,o);if(aN(e))return e;e!==void 0&&(s.payload=yield*gX.wrap(`Payload`,e))}let c=yield*i(s);if(aN(c))return c;let u;h!==void 0&&pY(c)&&(u=c.headers,c=c.body);let _=yield*gX.wrap(`Body`,m?.(c,e)??(u===void 0?l(c):h.encodeBody(c)));if(h===void 0||u===void 0)return _;let v=yield*gX.wrap(`ResponseHeaders`,h.encodeHeaders.get(_.status)(u));return gN(_,v)})).pipe(Hh,jh(e=>gX.is(e)?_h(e):Lh(u(e))),tg(r))}function fZ(e,t,n,r){let i=n.endpoint;return CP(i.method,TX(i.path,i.params),dZ(e,t,i,r,n.handler,n.isRaw),{uninterruptible:n.uninterruptible})}const pZ=(e,t,n,r)=>{let i={group:e,endpoint:t};for(let e of t.middlewares){let t=e,a=gs(n,t);r=(yX(t)?hZ(t,a):a)(r,i)}return r},mZ=/*#__PURE__*/ new WeakMap,hZ=(e,t)=>{let n=mZ.get(t);if(n!==void 0)return n;let r=Object.entries(e.security).map(([e,n])=>({decode:rZ(n),middleware:t[e]}));if(r.length===0)return j;let i=V(function*(e,t){e=Ih(e,e=>new _Z(e));let n;for(let i=0;i<r.length;i++){let{decode:a,middleware:o}=r[i],s=yield*Eh(z(a,n=>o(e,{credential:n,endpoint:t.endpoint,group:t.group})));if(Ha(s)){if(vZ(s.failure))return yield*R(s.failure.error);n=s;continue}return s.success}return yield*xh(n)});return mZ.set(t,i),i},gZ=`~effect/httpapi/HttpApiBuilder/HandlerError`;var _Z=class{[gZ]=gZ;error;constructor(e){this.error=e}};const vZ=e=>M(e,gZ),yZ=/*#__PURE__*/ vE(aN);function bZ(e,t){let n=/* @__PURE__ */ new Map,r=[];for(let i of e.success)mY(i)&&(n.set(kY(i),NE(i.headers,t)),lY(i.schema)||r.push(kZ(i)));return n.size===0?void 0:{encodeBody:NE(r.length===0?KE:r.length===1?r[0]:K(r),t),encodeHeaders:n}}function xZ(e,t){let n=SZ(e);if(n===void 0)return;let r=n.body,i=CZ(e),a=kY(n.schema),o=r.contentType;if(dY(r))return(e,t)=>sk(e)?F(pN(Vk(e,t),{status:a,contentType:o})):i?void 0:new yE(new w_({message:`Expected a streaming response`}));let s=wZ(r,t);return(e,t)=>sk(e)?F(pN(Vk(TZ(e,s),t),{status:a,contentType:o})):i?void 0:new yE(new w_({message:`Expected a streaming response`}))}function SZ(e){for(let t of e.success){let e=mY(t)?t.schema:t;if(lY(e))return{schema:t,body:e}}}function CZ(e){for(let t of e.success){let e=mY(t)?t.schema:t;if(RE(e)&&!lY(e))return!0}return e.success.size===0}function wZ(e,t){let n=bO(eO(e.error,WD()));return{sseMode:e.sseMode,encodeEvents:NE(G(e.events),t),encodeCause:NE(KD(n),t)}}function TZ(e,t){return e.pipe(t.sseMode===`data`?Ck(e=>({id:void 0,event:`message`,data:e})):j,Tk(e=>Lh(t.encodeEvents(e))),Ak(e=>lk(EZ(e,t))),Ck(OZ),Lk)}function EZ(e,t){return t.encodeCause(e).pipe(Lh,B(e=>({id:void 0,event:DZ,data:e})))}const DZ=`effect/httpapi/stream/failure`;function OZ(e){return oY.write({_tag:`Event`,event:e.event,id:e.id,data:e.data})}const kZ=/*#__PURE__*/ PZ(kY),AZ=/*#__PURE__*/ PZ(MY);function jZ(e){if(!mY(e))return AZ(e);let t=NE(e.schema),n=NE(e.headers),r=LZ(MY(e),AY(e),yY(e.schema.ast)),i=IZ((e,n)=>t(e,n).pipe(Ih(e=>e.issue),z(e=>r(e,n))),n);return yZ.pipe(fD(e,i))}function MZ(e){let t=IY(e).map(kZ);return t.length===1?t[0]:K(t)}function NZ(e){let t=LY(e).map(jZ);return t.length===0?KE:t.length===1?t[0]:K(t)}function PZ(e){let t=/* @__PURE__ */ new WeakMap;return n=>{let r=mY(n)?n:n.ast,i=t.get(r);if(i!==void 0)return i;let a=mY(n)?n.schema:n,o=yZ.pipe(fD(a,FZ(e,n)));return t.set(r,o),o}}function FZ(e,t){let n=xY(t.ast);if(n!==void 0)return IZ(LZ(e(n.body),DY(n.body.ast),yY(n.body.ast)),NE(n.headersCodec));let r=mY(t)?t.schema:t;return zv({decode:(e,t)=>R(new E_({message:`Encode only schema`},e,t)),encode:LZ(e(t),AY(t),yY(r.ast))})}function IZ(e,t){return zv({decode:(e,t)=>R(new E_({message:`Encode only schema`},e,t)),encode:(n,r)=>{let i=n;return z(e(i.body,r),e=>B(t(i.headers,r).pipe(Ih(e=>e.issue)),t=>gN(e,t)))}})}function LZ(e,t,n){switch(t._tag){case`Json`:return(r,i)=>{if(r===void 0||n)return F(oN({status:e}));try{let n=JSON.stringify(r);return F(uN(n,{status:e,contentType:t.contentType}))}catch{return R(new w_({expected:`a JSON-serializable response body`},r,i))}};case`Text`:return n=>F(uN(n,{status:e,contentType:t.contentType}));case`Uint8Array`:return n=>F(cN(n,{status:e,contentType:t.contentType}));case`FormUrlEncoded`:return n=>F(eoe(n,{status:e}).pipe(mN(`content-type`,t.contentType)))}}const RZ=`~effect/httpapi/HttpApiGroup`,zZ={[RZ]:RZ,add(...e){let t={...this.endpoints};for(let n of e)Hr(t,n.identifier,n);return VZ({...BZ(this),endpoints:t})},prefix(e){return VZ({...BZ(this),endpoints:$a(this.endpoints,t=>t.prefix(e))})},middleware(e){return VZ({...BZ(this),endpoints:$a(this.endpoints,t=>t.middleware(e))})},annotateMerge(e){return VZ({...BZ(this),annotations:Ss(this.annotations,e)})},annotate(e,t){return VZ({...BZ(this),annotations:ds(this.annotations,e,t)})},annotateEndpointsMerge(e){return VZ({...BZ(this),endpoints:$a(this.endpoints,t=>t.annotateMerge(e))})},annotateEndpoints(e,t){return VZ({...BZ(this),endpoints:$a(this.endpoints,n=>n.annotate(e,t))})},pipe(){return Tn(this,arguments)}},BZ=e=>({identifier:e.identifier,topLevel:e.topLevel,endpoints:e.endpoints,annotations:e.annotations}),VZ=e=>{function t(){}return Object.setPrototypeOf(t,zZ),t.key=`effect/httpapi/HttpApiGroup/${e.identifier}`,Object.assign(t,e)},HZ=(e,t)=>VZ({identifier:e,topLevel:t?.topLevel??!1,endpoints:{},annotations:cs()}),UZ=(e,t,n)=>iX(n.name,`${e.apiPath}/${t.name}/${n.name}`,{payload:n.input,success:n.success,error:XJ(n,e.errors)}).annotate(kX,n.description),WZ=(e,t)=>{class n extends bX()(`effect-actions/http/SchemaErrors/${e}`,{error:qJ(t)}){}return{SchemaErrors:n,layer:SX(n,e=>R(YJ(t,e)))}};function GZ(e,t){let[n,...r]=t.actions.map(n=>UZ(e,t,n));if(n===void 0)return;let i=HZ(t.name).add(n,...r);if(t.schemaError===void 0)return{native:i,middleware:fm};let a=WZ(t.name,t.schemaError);return{native:i.middleware(a.SchemaErrors),middleware:a.layer}}function KZ(e){let[t,...n]=e,r=lX(`actions`).annotate(pX,{errors:`all`});return t===void 0?r:r.add(t,...n)}const qZ=e=>e,JZ=(e,t,n,r)=>{let i=e=>Object.fromEntries(t.group.actions.map(n=>{let i=rY(t.group,n,e,r);return[n.name,e=>i(e.payload)]}));return vm(B(t.build,n=>tZ(e,t.group.name,e=>e.handleAll(i(qZ(n)))))).pipe(Cm(n))};function YZ(e,...t){$J(`action group`,t.map(e=>e.name));let n=new Map(t.flatMap(t=>{let n=GZ(e,t);return n===void 0?[]:[[t,n]]})),r=(e,r={})=>{$J(`implementation group`,e.map(e=>e.group.name));for(let n of e)if(!t.includes(n.group))throw Error(`Implementation of group "${n.group.name}" is not served by this adapter`);let i=e.flatMap(e=>{let t=n.get(e.group);return t===void 0?[]:[{app:e,...t}]}),a=KZ(i.map(({native:e})=>e)),[o,...s]=i.map(({app:e,middleware:t})=>JZ(a,e,t,r.before));return o===void 0?eZ(a):eZ(a).pipe(Cm([o,...s]))},i=KZ([...n.values()].map(({native:e})=>e));return{groups:t,api:i,layer:r,openApi:(t=`${e.apiPath}/openapi.json`)=>bP(`GET`,t,dN(UX(i)))}}var XZ=class extends vO()(`BadRequest`,{error:U},{httpApiStatus:400}){},ZZ=class extends vO()(`Unauthorized`,{error:U},{httpApiStatus:401}){},QZ=class extends vO()(`Forbidden`,{error:U},{httpApiStatus:403}){},$Z=class extends vO()(`NotFound`,{error:U},{httpApiStatus:404}){},eQ=class extends vO()(`Conflict`,{error:U},{httpApiStatus:409}){},tQ=class extends vO()(`TooManyRequests`,{error:U},{httpApiStatus:429}){},nQ=class extends vO()(`InternalServerError`,{error:U},{httpApiStatus:500}){cause},rQ=class extends vO()(`ServiceUnavailable`,{error:U},{httpApiStatus:503}){};const iQ=[XZ,ZZ,QZ,$Z,eQ,tQ,nQ,rQ],aQ=W({email:U,password:U}),oQ=lD([`none`,`client_secret_basic`,`client_secret_post`]),sQ=lD([`web`,`native`]),cQ=W({client_name:U,redirect_uris:G(U),resources:G(U),token_endpoint_auth_method:oQ,application_type:sQ}),lQ=W({client_id:U,client_name:U,redirect_uris:G(U),application_type:sQ}),uQ=W({client_id:U}),dQ=W({client_id:U,blocked:QE}),fQ=W({onboarding:BE(lD([`managed`,`dcr`,`cimd`])),blocked:BE(QE),client_id:U,client_name:BE(U),redirect_uris:G(U),token_endpoint_auth_method:BE(U),application_type:BE(uD(U)),scope:BE(U),grant_types:BE(G(U))}),pQ=fQ.pipe(nD({client_secret:BE(U),client_secret_expires_at:BE(ZE)})),mQ=W({identifier:U,name:U,scopes:G(U)}),hQ=mQ.pipe(nD({builtIn:QE})),gQ=W({identifier:U}),_Q=W({client_id:U,resource:U}),vQ=W({client_id:U,resources:G(U)}),yQ=W({clientAccess:G(_Q)}),bQ=rD(U,G(U)),xQ=aO,SQ=W({name:U,permissions:bQ,expiresAt:uD(xQ)}),CQ=W({keyId:U}),wQ=W({keyId:U,name:BE(U),permissions:BE(bQ),enabled:BE(QE)}),TQ=W({keyId:U,name:U,enabled:QE,permissions:bQ,expiresAt:uD(xQ),createdAt:xQ}),EQ={invalid:{schema:XZ,make:()=>new XZ({error:`Invalid request`})},internal:{schema:nQ,make:()=>new nQ({error:`Request could not be completed`})}},DQ=aY({name:`issuer`,errors:iQ,schemaError:EQ},tY(`setupStatus`,{description:`Check whether the issuer needs its first owner account.`,access:`read`,success:W({required:QE}),mcp:!1}),tY(`setupOwner`,{description:`Create the first owner account.`,access:`write`,input:aQ,success:W({created:QE}).pipe(sY(201)),mcp:!1}),tY(`verifyApiKey`,{description:`Verify the bearer API key against one resource and return its granted scopes.`,access:`read`,input:W({resource:U}),success:W({keyId:U,ownerId:U,resource:U,scopes:G(U),expiresAt:uD(xQ)}),mcp:!1})),OQ=W({clients:G(fQ),resources:G(hQ),clientAccess:G(_Q),email:U,issuer:U}),kQ=aY({name:`administration`,errors:iQ,schemaError:EQ},tY(`listClients`,{description:`List clients, resources and access grants.`,access:`read`,success:OQ}),tY(`createClient`,{description:`Register a first-party OAuth client. Returns its secret once when confidential.`,access:`write`,input:cQ,success:pQ.pipe(sY(201))}),tY(`updateClient`,{description:`Rename a first-party client or change its redirect URIs and application type.`,access:`write`,input:lQ,success:fQ}),tY(`deleteClient`,{description:`Delete a first-party OAuth client.`,access:`write`,input:uQ,success:W({deleted:QE})}),tY(`revokeClient`,{description:`Revoke a client’s authorization grants.`,access:`write`,input:uQ,success:W({revoked:QE})}),tY(`blockClient`,{description:`Block or unblock OAuth authorization for a client.`,access:`write`,input:dQ,success:W({blocked:QE})}),tY(`rotateClientSecret`,{description:`Rotate a confidential client secret. Returns the new secret once.`,access:`write`,input:uQ,success:pQ}),tY(`setClientAccess`,{description:`Set the resources a client may request.`,access:`write`,input:vQ,success:yQ}),tY(`createResource`,{description:`Create an OAuth resource and its scopes.`,access:`write`,input:mQ,success:mQ.pipe(sY(201))}),tY(`updateResource`,{description:`Update an OAuth resource and its scopes.`,access:`write`,input:mQ,success:mQ}),tY(`deleteResource`,{description:`Delete a resource and its client-resource links. Stored authorization grants and API-key permissions are retained; recreating the resource can restore access.`,access:`write`,input:gQ,success:W({deleted:QE})}),tY(`listApiKeys`,{description:`List API key metadata without secret values.`,access:`read`,success:W({keys:G(TQ)})}),tY(`createApiKey`,{description:`Create a scoped API key. Returns its secret once.`,access:`write`,input:SQ,success:TQ.pipe(nD({key:U}),sY(201))}),tY(`updateApiKey`,{description:`Update an API key’s name, permissions or enabled state.`,access:`write`,input:wQ,success:TQ}),tY(`deleteApiKey`,{description:`Delete an API key.`,access:`write`,input:CQ,success:W({deleted:QE})})),AQ=YZ({apiPath:`/api`},kQ,DQ);AQ.api;const jQ=e=>iQ.some(t=>EE(t)(e)),MQ=e=>{let t=new nQ({error:`Request could not be completed`});return t.cause=e,t},NQ=kE(W({message:zE(U),error_description:zE(U)})),PQ=e=>({error:Aa(Ia(NQ(e.body),e=>ja(e.message??e.error_description)),()=>`Request could not be completed`)});function FQ(e){if(jQ(e))return e;if(aL(e)){let t=PQ(e);switch(e.statusCode){case 400:case 422:return new XZ(t);case 401:case 403:return new QZ(t);case 404:return new $Z(t);case 409:return new eQ(t);case 429:return new tQ(t);case 503:return new rQ(t)}}return moe(e)&&IQ(e.reason)?new XZ({error:`Request body could not be read`}):MQ(e)}const IQ=er(`RequestParseError`),LQ=e=>ch({try:e,catch:FQ}),RQ=$ae(K(iQ)),zQ=(e,t={})=>{let n=iQ.find(t=>EE(t)(e));return n===void 0?_h(/* @__PURE__ */ Error(`Undeclared API error`)):RQ(e,{status:jb(`httpApiStatus`)(n.ast)??500,headers:t}).pipe(Lh)},BQ=e=>zQ(FQ(e));var VQ=/* @__PURE__ */ e({NodeSqliteDialect:()=>JQ}),HQ=class{get supportsCreateIfNotExists(){return!0}get supportsTransactionalDdl(){return!1}get supportsReturning(){return!0}async acquireMigrationLock(){}async releaseMigrationLock(){}get supportsOutput(){return!0}},UQ=class{#e;#t=new GQ;#n;#r;constructor(e){this.#e={...e}}async init(){this.#n=this.#e.database,this.#r=new WQ(this.#n),this.#e.onCreateConnection&&await this.#e.onCreateConnection(this.#r)}async acquireConnection(){return await this.#t.lock(),this.#r}async beginTransaction(e){await e.executeQuery(qt.raw(`begin`))}async commitTransaction(e){await e.executeQuery(qt.raw(`commit`))}async rollbackTransaction(e){await e.executeQuery(qt.raw(`rollback`))}async releaseConnection(){this.#t.unlock()}async destroy(){this.#n?.close()}},WQ=class{#e;constructor(e){this.#e=e}executeQuery(e){let{sql:t,parameters:n}=e,r=this.#e.prepare(t),i=n;if(r.columns().length>0)return Promise.resolve({rows:r.all(...i)});let{changes:a,lastInsertRowid:o}=r.run(...i);return Promise.resolve({rows:[],numAffectedRows:BigInt(a),insertId:typeof o==`bigint`?o:BigInt(o)})}async*streamQuery(){throw Error(`Streaming query is not supported by SQLite driver.`)}},GQ=class{#e;#t;async lock(){for(;this.#e!==void 0;)await this.#e;this.#e=new Promise(e=>{this.#t=e})}unlock(){let e=this.#t;this.#e=void 0,this.#t=void 0,e?.()}},KQ=class{#e;constructor(e){this.#e=e}async getSchemas(){return[]}async getTables(e={withInternalKyselyTables:!1}){let t=this.#e.selectFrom(`sqlite_schema`).where(`type`,`=`,`table`).where(`name`,`not like`,`sqlite_%`).select(`name`).$castTo();e.withInternalKyselyTables||(t=t.where(`name`,`!=`,oee).where(`name`,`!=`,see));let n=await t.execute();return Promise.all(n.map(({name:e})=>this.#t(e)))}async getMetadata(e){return{tables:await this.getTables(e)}}async#t(e){let t=this.#e,n=(await t.selectFrom(`sqlite_master`).where(`name`,`=`,e).select(`sql`).$castTo().execute())[0]?.sql?.split(/[\(\),]/)?.find(e=>e.toLowerCase().includes(`autoincrement`))?.split(/\s+/)?.[0]?.replace(/["`]/g,``);return{name:e,columns:(await t.selectFrom(Kt`pragma_table_info(${e})`.as(`table_info`)).select([`name`,`type`,`notnull`,`dflt_value`]).execute()).map(e=>({name:e.name,dataType:e.type,isNullable:!e.notnull,isAutoIncrementing:e.name===n,hasDefaultValue:e.dflt_value!=null})),isView:!1}}},qQ=class extends cee{getCurrentParameterPlaceholder(){return`?`}getLeftIdentifierWrapper(){return`"`}getRightIdentifierWrapper(){return`"`}getAutoIncrement(){return`autoincrement`}},JQ=class{#e;constructor(e){this.#e={...e}}createDriver(){return new UQ(this.#e)}createQueryCompiler(){return new qQ}createAdapter(){return new HQ}createIntrospector(e){return new KQ(e)}};const YQ=e=>{let t=DE(e);return e=>Ih(t(e),MQ)};function XQ(e){return(t,...n)=>ch({try:async()=>(await Kt(t,...n).execute(e)).rows,catch:MQ})}const ZQ=H(`Database.transaction`)(function*(e,t){let n=yield*ch({try:()=>e.startTransaction().execute(),catch:MQ}),r=yield*Oh(t(XQ(n))),i=Bh(ch({try:()=>n.rollback().execute(),catch:MQ})),a=ch({try:()=>n.commit().execute(),catch:MQ}).pipe(Rh(()=>i));return yield*Cp(r)?a:i,yield*r},yg);async function QQ(e){let t=new Sn(e);try{t.exec(`PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON; PRAGMA busy_timeout = 5000;`);let e=new lee({dialect:new JQ({database:t})});return await Kt`SELECT 1`.execute(e),{kysely:e,sql:XQ(e),close:()=>e.destroy()}}catch(e){throw t.close(),e}}const $Q=`clankerauth:admin`,e$=e=>`${e}/mcp`,t$=[`offline_access`],n$=e=>`resource:${e}`,r$=YQ(KD(G(U))),i$=YQ(W({identifier:U,name:U,allowedScopes:U})),a$=YQ(G(_Q)),o$=YQ(G(W({clientId:U}))),s$=e=>({identifier:encodeURIComponent(e)}),c$=(e,t)=>({...s$(t),client_id:encodeURIComponent(e)}),l$=V(function*(e,t,n,r){let i=yield*iS(1),a=e=>i.withPermit(e),o=H(`Resources.decode`)(function*(e){let t=yield*i$(e),n=yield*r$(t.allowedScopes);return{identifier:t.identifier,name:t.name,scopes:n.filter(e=>!t$.includes(e))}}),s=H(`Resources.list`)(function*(){let t=yield*e`SELECT identifier, name, allowedScopes FROM oauthResource ORDER BY createdAt, identifier`;return yield*ah(t,o)}),c=H(`Resources.get`)(function*(t){let n=yield*e`SELECT identifier, name, allowedScopes FROM oauthResource WHERE identifier = ${t}`;return n[0]?yield*o(n[0]):void 0}),l=H(`Resources.access`)(function*(){return yield*a$(yield*e`SELECT clientId AS client_id, resourceId AS resource FROM oauthClientResource ORDER BY clientId, resourceId`)}),u=H(`Resources.accessForClient`)(function*(t){return yield*a$(yield*e`SELECT clientId AS client_id, resourceId AS resource FROM oauthClientResource WHERE clientId = ${t} ORDER BY resourceId`)}),d=H(`Resources.validateSelection`)(function*(e){return new Set(e).size===e.length?yield*ah(e,e=>mh(function*(){return(yield*c(e))||(yield*R(new XZ({error:`Unknown Resource`})))})):yield*R(new XZ({error:`Choose unique Resources`}))}),f=H(`Resources.scopesFor`)(function*(e){let t=yield*d(e);return[.../* @__PURE__ */ new Set([...t$,...t.flatMap(e=>e.scopes)])]}),p=e=>{try{return new URL(e).href===e}catch{return!1}},m=H(`Resources.validateInput`)(function*(e){let t=e.identifier.trim(),n=e.name.trim(),r=[...new Set(e.scopes.map(e=>e.trim()))];return p(t)?!n||r.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)||t$.includes(e))?yield*R(new XZ({error:`Resources require a name and well-formed custom scopes`})):{identifier:t,name:n,scopes:r}:yield*R(new XZ({error:`Resource identifiers must be absolute URIs in canonical form`}))}),h=H(`Resources.syncClient`)(function*(t){let n=yield*u(t),r=yield*f(n.map(e=>e.resource));yield*e`UPDATE oauthClient SET scopes = ${JSON.stringify(r)}, updatedAt = ${yield*Om} WHERE clientId = ${t}`}),g=e=>n([.../* @__PURE__ */ new Set([...t$,...e.flatMap(e=>e.scopes)])],e.map(e=>e.identifier)),_=H(`Resources.synchronize`)(function*(){g(yield*s());for(let t of yield*o$(yield*e`SELECT clientId FROM oauthClient ORDER BY clientId`))yield*h(t.clientId)});return{list:s,get:c,access:l,hasAccess:H(`Resources.hasAccess`)(function*(t,n){return(yield*e`SELECT 1 FROM oauthClientResource WHERE clientId = ${t} AND resourceId = ${n} LIMIT 1`).length>0}),scopesFor:f,synchronize:_,create:H(`Resources.create`)(function*(n,r){let i=yield*m(n);yield*LQ(()=>t().api.adminCreateOAuthResource({headers:r,body:{identifier:i.identifier,name:i.name,allowedScopes:[...t$,...i.scopes]}})),yield*_();let a=yield*o$(yield*e`SELECT clientId FROM oauthClient WHERE userId IS NULL ORDER BY clientId`);for(let e of a)yield*LQ(()=>t().api.adminLinkClientResource({headers:r,params:c$(e.clientId,i.identifier)}));return yield*_(),i},a),update:H(`Resources.update`)(function*(e,n){let i=yield*m(e),a=i.identifier===r;return a&&(i.scopes.length!==1||i.scopes[0]!==`clankerauth:admin`)?yield*R(new XZ({error:`The administration Resource scopes are reserved`})):(yield*LQ(()=>t().api.adminUpdateOAuthResource({headers:n,params:s$(i.identifier),body:a?{name:i.name}:{name:i.name,allowedScopes:[...t$,...i.scopes]}})),a||(yield*_()),i)},a),delete:H(`Resources.delete`)(function*(e,n){return e===r?yield*R(new XZ({error:`The administration Resource is reserved`})):(yield*LQ(()=>t().api.adminDeleteOAuthResource({headers:n,params:s$(e)})),yield*_(),{deleted:!0})},a),setAccess:H(`Resources.setAccess`)(function*(n,r,i){if(!(yield*e`SELECT id FROM oauthClient WHERE clientId = ${n}`).length)return yield*R(new $Z({error:`Client not found`}));yield*d(r);let a=(yield*u(n)).map(e=>e.resource);for(let e of a.filter(e=>!r.includes(e)))yield*LQ(()=>t().api.adminUnlinkClientResource({headers:i,params:c$(n,e)}));for(let e of r.filter(e=>!a.includes(e)))yield*LQ(()=>t().api.adminLinkClientResource({headers:i,params:c$(n,e)}));return yield*h(n),yield*u(n)},a)}}),u$=(e,t)=>EP()(n=>t.pipe(Zh({onFailure:F,onSuccess:t=>ig(n,e,t)}),nse((e,t)=>F(mN(t,`cache-control`,`no-store`))))),d$=e=>`"${e.replace(/["\\]/g,`\\$&`)}"`,f$=e=>{let t=new URL(e.resource),n=`/.well-known/oauth-protected-resource${t.pathname===`/`?``:t.pathname}`,r=new URL(t);r.pathname=n;let i=r.href,a=i.slice(r.origin.length),o=dN({resource:e.resource,authorization_servers:e.authorizationServers,bearer_methods_supported:[`header`],scopes_supported:e.scopesSupported,resource_name:e.resourceName});return{layer:EP(e=>mh(function*(){let n=yield*cP,r=new URL(n.url,t.origin);return(n.method===`GET`||n.method===`HEAD`)&&r.href.slice(r.origin.length)===a?o:yield*e}),{global:!0}),metadataUrl:i,challenge:(e={})=>`Bearer ${[[`resource_metadata`,i],[`error`,e.error],[`error_description`,e.errorDescription],[`scope`,e.scope]].flatMap(([e,t])=>t===void 0?[]:[`${e}=${d$(t)}`]).join(`, `)}`}},p$=H(`Administration.providerSession`)(function*(e,t){let{context:n}=e,r=new Date((yield*Om)+6e4),i=yield*cg(LQ(()=>n.internalAdapter.createSession(t,!0,{expiresAt:r},!0)),e=>sh(()=>n.internalAdapter.deleteSession(e.token))),a=yield*LQ(async()=>(await Promise.all([uI(n.authCookies.sessionToken.name,i.token,n.secret),uI(n.authCookies.dontRememberToken.name,`true`,n.secret)])).map(e=>e.split(`;`)[0]).join(`; `));return new Headers({origin:e.settings.baseURL,cookie:a})});async function m$(e,t){let n;if(e.database)n=typeof e.database==`function`?e.database(e):await t(e);else{let t=_e(e),r=Object.keys(t).reduce((e,t)=>(e[t]=[],e),{}),{memoryAdapter:i}=await import(`./dist-DpbKAALD.mjs`);n=i(r)(e)}return n.transaction||(O.warn(`Adapter does not correctly implement transaction function, patching it automatically. Please update your adapter implementation.`),n.transaction=async e=>e(n)),n}async function h$(e){return m$(e,async e=>{let{createKyselyAdapter:t,kyselyAdapter:n}=await import(`./kysely-adapter-C-VVCuVS.mjs`),{kysely:r,databaseType:i,transaction:a}=await t(e);if(!r)throw new l(`Failed to initialize database adapter`);return n(r,{type:i||`sqlite`,debugLogs:e.database&&`debugLogs`in e.database?e.database.debugLogs:!1,transaction:a})(e)})}function g$(e){let{indexesByTable:t,tables:n}=xe(e),r={};for(let e in n){let t=n[e],i=t.fields,a={};if(Object.entries(i).forEach(([e,t])=>{if(a[t.fieldName||e]=t,t.references){let r=n[t.references.model];r&&(a[t.fieldName||e].references={...t.references,model:r.modelName,field:t.references.field})}}),r[t.modelName]){r[t.modelName].fields={...r[t.modelName].fields,...a},t.disableMigrations&&(r[t.modelName].disableMigrations=!0);continue}r[t.modelName]={fields:a,order:t.order||1/0,disableMigrations:t.disableMigrations}}for(let[e,n]of t)r[e]&&(r[e].indexes=n);return r}const _$={postgres:{string:[`character varying`,`varchar`,`text`,`uuid`],number:[`int4`,`integer`,`bigint`,`smallint`,`numeric`,`real`,`double precision`],boolean:[`bool`,`boolean`],date:[`timestamptz`,`timestamp`,`date`],json:[`json`,`jsonb`]},mysql:{string:[`varchar`,`text`,`uuid`],number:[`integer`,`int`,`bigint`,`smallint`,`decimal`,`float`,`double`],boolean:[`boolean`,`tinyint`],date:[`timestamp`,`datetime`,`date`],json:[`json`]},sqlite:{string:[`TEXT`],number:[`INTEGER`,`REAL`,`BIGINT`],boolean:[`INTEGER`,`BOOLEAN`],date:[`DATE`,`INTEGER`],json:[`TEXT`]},mssql:{string:[`varchar`,`nvarchar`,`uniqueidentifier`],number:[`int`,`bigint`,`smallint`,`decimal`,`float`,`double`],boolean:[`bit`,`smallint`],date:[`datetime2`,`date`,`datetime`],json:[`varchar`,`nvarchar`]}};function v$(e,t){return`${ye(e)}\u0000${ye(t)}`}function y$(e,t){return`${e}\u0000${t}`}function b$(e,t){return e.unique===(t.unique??!1)&&e.validFullColumns&&e.columns.length===t.columns.length&&e.columns.every((e,n)=>e===t.columns[n])}function x$(e){return typeof e==`boolean`?e:typeof e==`number`?e!==0:e===`1`||e?.toLowerCase()===`true`||e===`t`}function S$(e){return new Map(e.map(e=>{let t=[...e.columns].sort((e,t)=>e.position-t.position);return[v$(e.table,e.name),{columns:t.flatMap(e=>e.name===null?[]:[e.name]),name:e.name,table:e.table,unique:e.unique,validFullColumns:e.valid&&!e.partial&&t.length>0&&t.every(e=>e.name!==null&&e.fullLength)}]}))}async function C$(e,t,n,r){if(r)return S$(await r(n));let i;switch(t.type){case`sqlite`:i=(await Kt`
416
416
  SELECT
417
417
  tables.name AS "tableName",
418
418
  index_list.name AS "indexName",
@@ -507,11 +507,11 @@ data: `)}\n`,t+`
507
507
  `)+`;`}return{toBeCreated:v,toBeAdded:y,toBeAddedIndexes:b,unsafeChanges:a,schemaProblems:_,runMigrations:ie,compileMigrations:ae}}function M$(e){let t=new Set(e).size;return t===0?0:Math.log2(t**+e.length)}function N$(e){return e?e.split(`,`).map(e=>{e=e.trim();let t=e.indexOf(`:`);if(t===-1)throw new l(`Invalid BETTER_AUTH_SECRETS entry: "${e}". Expected format: "<version>:<secret>"`);let n=parseInt(e.slice(0,t),10);if(!Number.isInteger(n)||n<0)throw new l(`Invalid version in BETTER_AUTH_SECRETS: "${e.slice(0,t)}". Version must be a non-negative integer.`);let r=e.slice(t+1).trim();if(!r)throw new l(`Empty secret value for version ${n} in BETTER_AUTH_SECRETS.`);return{version:n,value:r}}):null}function P$(e,t){if(e.length===0)throw new l("`secrets` array must contain at least one entry.");let n=/* @__PURE__ */ new Set;for(let t of e){let e=parseInt(String(t.version),10);if(!Number.isInteger(e)||e<0||String(e)!==String(t.version).trim())throw new l(`Invalid version ${t.version} in \`secrets\`. Version must be a non-negative integer.`);if(!t.value)throw new l(`Empty secret value for version ${e} in \`secrets\`.`);if(n.has(e))throw new l(`Duplicate version ${e} in \`secrets\`. Each version must be unique.`);n.add(e)}let r=e[0];r.value.length<32&&t.warn(`[better-auth] Warning: the current secret (version ${r.version}) should be at least 32 characters long for adequate security.`),M$(r.value)<120&&t.warn(`[better-auth] Warning: the current secret appears low-entropy. Use a randomly generated secret for production.`)}function F$(e,t){let n=/* @__PURE__ */ new Map;for(let t of e)n.set(parseInt(String(t.version),10),t.value);return{keys:n,currentVersion:parseInt(String(e[0].version),10),legacySecret:t&&t!==`better-auth-secret-12345678901234567890`?t:void 0}}async function I$(e,t){return{database:t?.database,adapter:t?.adapter,emailVerification:{sendVerificationEmail:!!e.emailVerification?.sendVerificationEmail,sendOnSignUp:!!e.emailVerification?.sendOnSignUp,sendOnSignIn:!!e.emailVerification?.sendOnSignIn,autoSignInAfterVerification:!!e.emailVerification?.autoSignInAfterVerification,expiresIn:e.emailVerification?.expiresIn,beforeEmailVerification:!!e.emailVerification?.beforeEmailVerification,afterEmailVerification:!!e.emailVerification?.afterEmailVerification},emailAndPassword:{enabled:!!e.emailAndPassword?.enabled,disableSignUp:!!e.emailAndPassword?.disableSignUp,requireEmailVerification:!!e.emailAndPassword?.requireEmailVerification,maxPasswordLength:e.emailAndPassword?.maxPasswordLength,minPasswordLength:e.emailAndPassword?.minPasswordLength,sendResetPassword:!!e.emailAndPassword?.sendResetPassword,resetPasswordTokenExpiresIn:e.emailAndPassword?.resetPasswordTokenExpiresIn,onPasswordReset:!!e.emailAndPassword?.onPasswordReset,password:{hash:!!e.emailAndPassword?.password?.hash,verify:!!e.emailAndPassword?.password?.verify},autoSignIn:!!e.emailAndPassword?.autoSignIn,revokeSessionsOnPasswordReset:!!e.emailAndPassword?.revokeSessionsOnPasswordReset},socialProviders:await Promise.all(Object.keys(e.socialProviders||{}).map(async t=>{let n=e.socialProviders?.[t];if(!n)return{};let r=typeof n==`function`?await n():n;return{id:t,mapProfileToUser:!!r.mapProfileToUser,disableDefaultScope:!!r.disableDefaultScope,disableIdTokenSignIn:!!r.disableIdTokenSignIn,disableImplicitSignUp:r.disableImplicitSignUp,disableSignUp:r.disableSignUp,getUserInfo:!!r.getUserInfo,overrideUserInfoOnSignIn:!!r.overrideUserInfoOnSignIn,prompt:r.prompt,verifyIdToken:!!r.verifyIdToken,scope:r.scope,refreshAccessToken:!!r.refreshAccessToken}})),plugins:e.plugins?.map(e=>e.id.toString()),user:{modelName:e.user?.modelName,fields:e.user?.fields,additionalFields:e.user?.additionalFields,changeEmail:{enabled:e.user?.changeEmail?.enabled,sendChangeEmailConfirmation:!!e.user?.changeEmail?.sendChangeEmailConfirmation}},verification:{modelName:e.verification?.modelName,disableCleanup:e.verification?.disableCleanup,fields:e.verification?.fields},session:{modelName:e.session?.modelName,additionalFields:e.session?.additionalFields,cookieCache:{enabled:e.session?.cookieCache?.enabled,maxAge:e.session?.cookieCache?.maxAge,strategy:e.session?.cookieCache?.strategy},disableSessionRefresh:e.session?.disableSessionRefresh,expiresIn:e.session?.expiresIn,fields:e.session?.fields,freshAge:e.session?.freshAge,preserveSessionInDatabase:e.session?.preserveSessionInDatabase,storeSessionInDatabase:e.session?.storeSessionInDatabase,updateAge:e.session?.updateAge},account:{modelName:e.account?.modelName,fields:e.account?.fields,encryptOAuthTokens:e.account?.encryptOAuthTokens,updateAccountOnSignIn:e.account?.updateAccountOnSignIn,accountLinking:{enabled:e.account?.accountLinking?.enabled,trustedProviders:e.account?.accountLinking?.trustedProviders,updateUserInfoOnLink:e.account?.accountLinking?.updateUserInfoOnLink,allowUnlinkingAll:e.account?.accountLinking?.allowUnlinkingAll}},hooks:{after:!!e.hooks?.after,before:!!e.hooks?.before},secondaryStorage:!!e.secondaryStorage,advanced:{cookiePrefix:!!e.advanced?.cookiePrefix,cookies:!!e.advanced?.cookies,crossSubDomainCookies:{domain:!!e.advanced?.crossSubDomainCookies?.domain,enabled:e.advanced?.crossSubDomainCookies?.enabled,additionalCookies:e.advanced?.crossSubDomainCookies?.additionalCookies},database:{generateId:e.advanced?.database?.generateId,defaultFindManyLimit:e.advanced?.database?.defaultFindManyLimit},useSecureCookies:e.advanced?.useSecureCookies,ipAddress:{disableIpTracking:e.advanced?.ipAddress?.disableIpTracking,ipAddressHeaders:e.advanced?.ipAddress?.ipAddressHeaders},disableCSRFCheck:e.advanced?.disableCSRFCheck,cookieAttributes:{expires:e.advanced?.defaultCookieAttributes?.expires,secure:e.advanced?.defaultCookieAttributes?.secure,sameSite:e.advanced?.defaultCookieAttributes?.sameSite,domain:!!e.advanced?.defaultCookieAttributes?.domain,path:e.advanced?.defaultCookieAttributes?.path,httpOnly:e.advanced?.defaultCookieAttributes?.httpOnly}},trustedOrigins:e.trustedOrigins?.length,rateLimit:{storage:e.rateLimit?.storage,modelName:e.rateLimit?.modelName,window:e.rateLimit?.window,customStorage:!!e.rateLimit?.customStorage,enabled:e.rateLimit?.enabled,max:e.rateLimit?.max},onAPIError:{errorURL:e.onAPIError?.errorURL,onError:!!e.onAPIError?.onError,throw:e.onAPIError?.throw},logger:{disabled:e.logger?.disabled,level:e.logger?.level,log:!!e.logger?.log},databaseHooks:{user:{create:{after:!!e.databaseHooks?.user?.create?.after,before:!!e.databaseHooks?.user?.create?.before},update:{after:!!e.databaseHooks?.user?.update?.after,before:!!e.databaseHooks?.user?.update?.before}},session:{create:{after:!!e.databaseHooks?.session?.create?.after,before:!!e.databaseHooks?.session?.create?.before},update:{after:!!e.databaseHooks?.session?.update?.after,before:!!e.databaseHooks?.session?.update?.before}},account:{create:{after:!!e.databaseHooks?.account?.create?.after,before:!!e.databaseHooks?.account?.create?.before},update:{after:!!e.databaseHooks?.account?.update?.after,before:!!e.databaseHooks?.account?.update?.before}},verification:{create:{after:!!e.databaseHooks?.verification?.create?.after,before:!!e.databaseHooks?.verification?.create?.before},update:{after:!!e.databaseHooks?.verification?.update?.after,before:!!e.databaseHooks?.verification?.update?.before}}}}}function L$(){let e=Me.npm_config_user_agent;if(!e)return;let t=e.split(` `)[0],n=t.lastIndexOf(`/`),r=t.substring(0,n);return{name:r===`npminstall`?`cnpm`:r,version:t.substring(n+1)}}function R$(){return Me.CI!==`false`&&(`BUILD_ID`in Me||`BUILD_NUMBER`in Me||`CI`in Me||`CI_APP_ID`in Me||`CI_BUILD_ID`in Me||`CI_BUILD_NUMBER`in Me||`CI_NAME`in Me||`CONTINUOUS_INTEGRATION`in Me||`RUN_ID`in Me)}function z$(){return typeof Deno<`u`?{name:`deno`,version:Deno?.version?.deno??null}:typeof Bun<`u`?{name:`bun`,version:Bun?.version??null}:typeof process<`u`&&process?.versions?.node?{name:`node`,version:process.versions.node??null}:{name:`edge`,version:null}}function B$(){return je(`NODE_ENV`)===`production`?`production`:R$()?`ci`:Ae()?`test`:`development`}async function V$(e){let t=await PH(`SHA-256`).digest(e);return aH.encode(t)}const H$=e=>De(`a-z`,`A-Z`,`0-9`)(e||32);let U$;async function W$(){if(U$)return U$;try{let e=process.cwd();if(!e)return;let t=await Cn.readFile(Qt.join(e,`package.json`),`utf-8`);return U$=JSON.parse(t),U$}catch{}}async function G$(e){if(U$)return U$.dependencies?.[e]||U$.devDependencies?.[e]||U$.peerDependencies?.[e];try{let t=process.cwd();if(!t)throw Error(`no-cwd`);let n=Qt.join(t,`node_modules`,e,`package.json`),r=await Cn.readFile(n,`utf-8`);return JSON.parse(r).version||await K$(e)||void 0}catch{}return K$(e)}async function K$(e){let t=await W$();if(t)return{...t.dependencies,...t.devDependencies,...t.peerDependencies}[e]}async function q$(){return(await W$())?.name}async function J$(){try{let e=gn.cpus();return{deploymentVendor:Y$(),systemPlatform:gn.platform(),systemRelease:gn.release(),systemArchitecture:gn.arch(),cpuCount:e.length,cpuModel:e.length?e[0].model:null,cpuSpeed:e.length?e[0].speed:null,memory:gn.totalmem(),isWSL:await r1(),isDocker:await $$(),isTTY:process.stdout?process.stdout.isTTY:null}}catch{return{systemPlatform:null,systemRelease:null,systemArchitecture:null,cpuCount:null,cpuModel:null,cpuSpeed:null,memory:null,isWSL:null,isDocker:null,isTTY:null}}}function Y$(){let e=process.env,t=(...t)=>t.some(t=>!!e[t]);return t(`CF_PAGES`,`CF_PAGES_URL`,`CF_ACCOUNT_ID`)||typeof navigator<`u`&&navigator.userAgent===`Cloudflare-Workers`?`cloudflare`:t(`VERCEL`,`VERCEL_URL`,`VERCEL_ENV`)?`vercel`:t(`NETLIFY`,`NETLIFY_URL`)?`netlify`:t(`RENDER`,`RENDER_URL`,`RENDER_INTERNAL_HOSTNAME`,`RENDER_SERVICE_ID`)?`render`:t(`AWS_LAMBDA_FUNCTION_NAME`,`AWS_EXECUTION_ENV`,`LAMBDA_TASK_ROOT`)?`aws`:t(`GOOGLE_CLOUD_FUNCTION_NAME`,`GOOGLE_CLOUD_PROJECT`,`GCP_PROJECT`,`K_SERVICE`)?`gcp`:t(`AZURE_FUNCTION_NAME`,`FUNCTIONS_WORKER_RUNTIME`,`WEBSITE_INSTANCE_ID`,`WEBSITE_SITE_NAME`)?`azure`:t(`DENO_DEPLOYMENT_ID`,`DENO_REGION`)?`deno-deploy`:t(`FLY_APP_NAME`,`FLY_REGION`,`FLY_ALLOC_ID`)?`fly-io`:t(`RAILWAY_STATIC_URL`,`RAILWAY_ENVIRONMENT_NAME`)?`railway`:t(`DYNO`,`HEROKU_APP_NAME`)?`heroku`:t(`DO_DEPLOYMENT_ID`,`DO_APP_NAME`,`DIGITALOCEAN`)?`digitalocean`:t(`KOYEB`,`KOYEB_DEPLOYMENT_ID`,`KOYEB_APP_NAME`)?`koyeb`:null}let X$;async function Z$(){try{return pn.statSync(`/.dockerenv`),!0}catch{return!1}}async function Q$(){try{return pn.readFileSync(`/proc/self/cgroup`,`utf8`).includes(`docker`)}catch{return!1}}async function $$(){return X$===void 0&&(X$=await Z$()||await Q$()),X$}let e1;const t1=async()=>{try{return pn.statSync(`/run/.containerenv`),!0}catch{return!1}};async function n1(){return e1===void 0&&(e1=await t1()||await $$()),e1}async function r1(){try{return process.platform===`linux`&&(gn.release().toLowerCase().includes(`microsoft`)||pn.readFileSync(`/proc/version`,`utf8`).toLowerCase().includes(`microsoft`))?!await n1():!1}catch{return!1}}let i1=null;async function a1(e){if(i1)return i1;let t=await q$();return t?(i1=await V$(e?e+t:t),i1):e?(i1=await V$(e),i1):(i1=H$(32),i1)}async function o1(){for(let[e,t]of Object.entries({pg:`postgresql`,mysql:`mysql`,mariadb:`mariadb`,sqlite3:`sqlite`,"better-sqlite3":`sqlite`,"@prisma/client":`prisma`,mongoose:`mongodb`,mongodb:`mongodb`,"drizzle-orm":`drizzle`})){let n=await G$(e);if(n)return{name:t,version:n}}}async function s1(){for(let[e,t]of Object.entries({next:`next`,nuxt:`nuxt`,"react-router":`react-router`,astro:`astro`,"@sveltejs/kit":`sveltekit`,"solid-start":`solid-start`,"tanstack-start":`tanstack-start`,hono:`hono`,express:`express`,elysia:`elysia`,expo:`expo`})){let n=await G$(e);if(n)return{name:t,version:n}}}const c1=async function(){};async function l1(e,t){let n=e.telemetry?.debug||ge(`BETTER_AUTH_TELEMETRY_DEBUG`,!1),r=ke.BETTER_AUTH_TELEMETRY_ENDPOINT;if(!r&&!t?.customTrack)return{publish:c1};let i=async e=>{t?.customTrack?await t.customTrack(e).catch(O.error):r&&(n?O.info(`telemetry event`,JSON.stringify(e,null,2)):await tK(r,{method:`POST`,body:e}).catch(O.error))},a=await(async()=>{let n=e.telemetry?.enabled!==void 0&&e.telemetry.enabled;return(ge(`BETTER_AUTH_TELEMETRY`,!1)||n)&&(t?.skipTestCheck||!Ae())})(),o;return a&&(o=await a1(typeof e.baseURL==`string`?e.baseURL:void 0),i({type:`init`,payload:{config:await I$(e,t),runtime:z$(),database:await o1(),framework:await s1(),environment:B$(),systemInfo:await J$(),packageManager:L$()},anonymousId:o})),{publish:async t=>{a&&(o||=await a1(typeof e.baseURL==`string`?e.baseURL:void 0),await i({type:t.type,payload:t.payload,anonymousId:o}))}}}function u1(e){let t=new Set(e).size;return t===0?0:Math.log2(t**+e.length)}function d1(e,t){let n=e===`better-auth-secret-12345678901234567890`;if(!Ae()){if(n&&ue)throw new l("You are using the default secret. Please set `BETTER_AUTH_SECRET` in your environment variables or pass `secret` in your auth config.");if(!e)throw new l("BETTER_AUTH_SECRET is missing. Set it in your environment or pass `secret` to betterAuth({ secret }).");e.length<32&&t.warn("[better-auth] Warning: your BETTER_AUTH_SECRET should be at least 32 characters long for adequate security. Generate one with `npx auth secret` or `openssl rand -base64 32`."),u1(e)<120&&t.warn(`[better-auth] Warning: your BETTER_AUTH_SECRET appears low-entropy. Use a randomly generated secret for production.`)}}async function f1(e,t,n){let r=nz(t);r||(t=qH(t,{session:{cookieCache:{enabled:!0,strategy:`jwe`,refreshCache:!0,maxAge:t.session?.expiresIn||604800}}})),t.database||(t=qH(t,{account:{storeAccountCookie:!0}}));let i=t.plugins||[],a=uU(t),o=Se(t.logger),s=FL(t.baseURL);if(FL(t.baseURL)){let{allowedHosts:e}=t.baseURL;if(!e||e.length===0)throw new l(`baseURL.allowedHosts cannot be empty. Provide at least one allowed host pattern (e.g., ["myapp.com", "*.vercel.app"]).`)}let c=s?void 0:jL(typeof t.baseURL==`string`?t.baseURL:void 0,t.basePath);!c&&!s&&o.warn(`[better-auth] Base URL is not set. Set the baseURL option or BETTER_AUTH_URL env, or use a dynamic baseURL with allowedHosts for multi-host setups. Without it the origin is derived from the incoming request, and callbacks and redirects may not work correctly.`),e.id===`memory`&&t.advanced?.database?.generateId===!1&&o.error(`[better-auth] Misconfiguration detected.
508
508
  You are using the memory DB with generateId: false.
509
509
  This will cause no id to be generated for any model.
510
- Most of the features of Better Auth will not work correctly.`);let u=t.secrets??N$(Me.BETTER_AUTH_SECRETS),d=t.secret||Me.BETTER_AUTH_SECRET||Me.AUTH_SECRET||``,f,p;u?(P$(u,o),f=u[0].value,p=F$(u,d)):(f=d||`better-auth-secret-12345678901234567890`,d1(f,o),p=f),t={...t,secret:f,baseURL:s?t.baseURL:c?new URL(c).origin:``,basePath:t.basePath||`/api/auth`,plugins:i.concat(a)},WJ(t,o);let m=t.advanced?.ipAddress?.trustedProxies;if(m&&m.length>0){let e=xR(m);e.length>0&&o.warn(`Ignoring invalid \`advanced.ipAddress.trustedProxies\` entries: ${e.join(`, `)}. Each entry must be an IP address or CIDR range.`)}let h=pH(t),g=_e(t),_=(await Promise.all(Object.entries(t.socialProviders||{}).map(async([e,t])=>{let n=typeof t==`function`?await t():t;if(n==null||n.enabled===!1)return null;n.clientId||o.warn(`Social provider ${e} is missing clientId or clientSecret`);let r=Bq[e](n);return r.disableImplicitSignUp=n.disableImplicitSignUp,r}))).filter(e=>e!==null),v=({model:e,size:n})=>{if(typeof t.advanced?.generateId==`function`)return t.advanced.generateId({model:e,size:n});let r=t?.advanced?.database?.generateId;return typeof r==`function`?r({model:e,size:n}):r===`uuid`?crypto.randomUUID():r===`serial`||r===!1?!1:Gt(n)},{publish:y}=await l1(t,{adapter:e.id,database:typeof t.database==`function`?`adapter`:n(t.database)}),b=new Set(t.plugins.map(e=>e.id)),x=e=>t.plugins.find(t=>t.id===e)??null,S=e=>b.has(e),C=await dU(t),w=await gU(t),T={appName:t.appName||`Better Auth`,baseURL:c||``,version:de(),socialProviders:_,options:t,oauthConfig:{storeStateStrategy:t.account?.storeStateStrategy||(r?`database`:`cookie`),skipStateCookieCheck:!!t.account?.skipStateCookieCheck},tables:g,trustedOrigins:C,trustedProviders:w,isTrustedOrigin(e,t){return this.trustedOrigins.some(n=>JL(e,n,t))},sessionConfig:{updateAge:t.session?.updateAge===void 0?86400:t.session.updateAge,expiresIn:t.session?.expiresIn||604800,freshAge:t.session?.freshAge===void 0?86400:t.session.freshAge,cookieRefreshCache:(()=>{let e=t.session?.cookieCache?.refreshCache,n=t.session?.cookieCache?.maxAge||300;return r&&e?(o.warn("[better-auth] `session.cookieCache.refreshCache` is enabled while `database` or `secondaryStorage` is configured. `refreshCache` is meant for stateless (DB-less) setups. Disabling `refreshCache` — remove it from your config to silence this warning."),!1):e===!1||e===void 0?!1:e===!0?{enabled:!0,updateAge:Math.floor(n*.2)}:{enabled:!0,updateAge:e.updateAge===void 0?Math.floor(n*.2):e.updateAge}})()},secret:f,secretConfig:p,rateLimit:{...t.rateLimit,enabled:t.rateLimit?.enabled??ue,window:t.rateLimit?.window||10,max:t.rateLimit?.max||100,storage:t.rateLimit?.storage||(t.secondaryStorage?`secondary-storage`:`memory`)},authCookies:h,logger:o,generateId:v,session:null,secondaryStorage:t.secondaryStorage,password:{hash:t.emailAndPassword?.password?.hash||OU,verify:t.emailAndPassword?.password?.verify||kU,config:{minPasswordLength:t.emailAndPassword?.minPasswordLength||8,maxPasswordLength:t.emailAndPassword?.maxPasswordLength||128},checkPassword:lJ},setNewSession(e){this.newSession=e},newSession:null,adapter:e,internalAdapter:UH(e,{options:t,logger:o,hooks:t.databaseHooks?[{source:`user`,hooks:t.databaseHooks}]:[],generateId:v}),createAuthCookie:fH(t),async runMigrations(){throw new l(`runMigrations will be set by the specific init implementation`)},publishTelemetry:y,skipCSRFCheck:!!t.advanced?.disableCSRFCheck,skipOriginCheck:t.advanced?.disableOriginCheck===void 0?!!Ae():t.advanced.disableOriginCheck,runInBackground:t.advanced?.backgroundTasks?.handler??(e=>{e.catch(()=>{})}),async runInBackgroundOrAwait(e){try{t.advanced?.backgroundTasks?.handler?e instanceof Promise&&t.advanced.backgroundTasks.handler(e.catch(e=>{o.error(`Failed to run background task:`,e)})):await e}catch(e){o.error(`Failed to run background task:`,e)}},getPlugin:x,hasPlugin:S},ee=lU(T);return KV(ee)&&await ee,T.checkSchema=Ne(T.adapter),T}const p1=async e=>{let t=await f1(await h$(e),e,e=>dee(e)||`unknown`);return t.runMigrations=async function(){if(!e.database||`updateMany`in e.database)throw new l(`Database is not provided or it's an adapter. Migrations are only supported with a database instance.`);let{runMigrations:t}=await j$(e);await t()},t},m1=(e,t)=>{let n=t(e).then(e=>{let t=e.options.advanced?.database?.validateSchema;if(!e.checkSchema&&t!==!1){let n=t===!0?`warn`:`debug`;e.logger[n](`Schema validation is not available for adapter "${e.adapter.id}". Skipping schema validation. Database operations will proceed normally.`)}let n=e.checkSchema?.();return n&&n.catch(t=>{e.logger.error(t instanceof Pe?t.message:`Could not validate the database schema. Check your database connection.`)}),e}),{api:r}=GJ(n,e),i=e.plugins?.reduce((e,t)=>t.$ERROR_CODES?{...e,...t.$ERROR_CODES}:e,{}),a=async t=>{let r=await n,i=r.options.basePath||`/api/auth`,a;if(FL(e.baseURL))a=await mU(r,t,pU(r.options));else{a=Object.create(Object.getPrototypeOf(r),Object.getOwnPropertyDescriptors(r));let e=r.options;if(!r.options.baseURL){let n=jL(void 0,i,t,void 0,r.options.advanced?.trustedProxyHeaders);if(!n)throw new l(`Could not get base URL from request. Please provide a valid base URL.`);a.baseURL=n,a.options={...r.options,baseURL:ML(n)||void 0},e=a.options}a.trustedOrigins=await dU(e,t),a.trustedProviders=await gU(e,t)}let{handler:o}=KJ(a,e);return KR(a.adapter,()=>o(t))};return{handler:a,fetch:a,api:r,options:e,$context:n,$ERROR_CODES:{...i,...J}}},h1=e=>m1(e,p1),X=qF({INVALID_METADATA_TYPE:`metadata must be an object or undefined`,REFILL_AMOUNT_AND_INTERVAL_REQUIRED:`refillAmount is required when refillInterval is provided`,REFILL_INTERVAL_AND_AMOUNT_REQUIRED:`refillInterval is required when refillAmount is provided`,USER_BANNED:`User is banned`,UNAUTHORIZED_SESSION:`Unauthorized or invalid session`,KEY_NOT_FOUND:`API Key not found`,KEY_DISABLED:`API Key is disabled`,KEY_EXPIRED:`API Key has expired`,USAGE_EXCEEDED:`API Key has reached its usage limit`,KEY_NOT_RECOVERABLE:`API Key is not recoverable`,EXPIRES_IN_IS_TOO_SMALL:`The expiresIn is smaller than the predefined minimum value.`,EXPIRES_IN_IS_TOO_LARGE:`The expiresIn is larger than the predefined maximum value.`,INVALID_REMAINING:`The remaining count is either too large or too small.`,INVALID_PREFIX_LENGTH:`The prefix length is either too large or too small.`,INVALID_NAME_LENGTH:`The name length is either too large or too small.`,METADATA_DISABLED:`Metadata is disabled.`,RATE_LIMIT_EXCEEDED:`Rate limit exceeded.`,NO_VALUES_TO_UPDATE:`No values to update.`,KEY_DISABLED_EXPIRATION:`Custom key expiration values are disabled.`,INVALID_API_KEY:`Invalid API key.`,INVALID_USER_ID_FROM_API_KEY:`The user id from the API key is invalid.`,INVALID_REFERENCE_ID_FROM_API_KEY:`The reference id from the API key is invalid.`,INVALID_API_KEY_GETTER_RETURN_TYPE:`API Key getter returned an invalid key type. Expected string.`,SERVER_ONLY_PROPERTY:`The property you're trying to set can only be set from the server auth instance only.`,FAILED_TO_UPDATE_API_KEY:`Failed to update API key`,NAME_REQUIRED:`API Key name is required.`,ORGANIZATION_ID_REQUIRED:`Organization ID is required for organization-owned API keys.`,USER_NOT_MEMBER_OF_ORGANIZATION:`You are not a member of the organization that owns this API key.`,INSUFFICIENT_API_KEY_PERMISSIONS:`You do not have permission to perform this action on organization API keys.`,NO_DEFAULT_API_KEY_CONFIGURATION_FOUND:`No default api-key configuration found.`,ORGANIZATION_PLUGIN_REQUIRED:`Organization plugin is required for organization-owned API keys. Please install and configure the organization plugin.`});async function g1(e,t,n){let r=e.length;if(r===0)return[];let{signal:i}=n;if(i?.aborted)throw i.reason;let a=Math.floor(n.concurrency),o=Math.min(r,a>=1?a:1),s=Array(r),c=0,l=!1;return await Promise.all(Array.from({length:o},async()=>{for(;!l&&c<r;){if(i?.aborted)throw i.reason;let n=c++;try{s[n]=await t(e[n],n)}catch(e){throw l=!0,e}}})),s}const _1={proto:/"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,constructor:/"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,protoShort:/"__proto__"\s*:/,constructorShort:/"constructor"\s*:/},v1=/^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/,y1={true:!0,false:!1,null:null,undefined:void 0,nan:NaN,infinity:1/0,"-infinity":-1/0},b1=/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,7}))?(?:Z|([+-])(\d{2}):(\d{2}))$/;function x1(e){return e instanceof Date&&!isNaN(e.getTime())}function S1(e){let t=b1.exec(e);if(!t)return null;let[,n,r,i,a,o,s,c,l,u,d]=t,f=new Date(Date.UTC(parseInt(n,10),parseInt(r,10)-1,parseInt(i,10),parseInt(a,10),parseInt(o,10),parseInt(s,10),c?parseInt(c.padEnd(3,`0`),10):0));if(l){let e=(parseInt(u,10)*60+parseInt(d,10))*(l===`+`?-1:1);f.setUTCMinutes(f.getUTCMinutes()+e)}return x1(f)?f:null}function C1(e,t={}){let{strict:n=!1,warnings:r=!1,reviver:i,parseDates:a=!0}=t;if(typeof e!=`string`)return e;let o=e.trim(),s=o.toLowerCase();if(s.length<=9&&s in y1)return y1[s];if(!v1.test(o)){if(n)throw SyntaxError(`[better-json] Invalid JSON`);return e}if(Object.entries(_1).some(([e,t])=>{let n=t.test(o);return n&&r&&console.warn(`[better-json] Detected potential prototype pollution attempt using ${e} pattern`),n})&&n)throw Error(`[better-json] Potential prototype pollution attempt detected`);try{return JSON.parse(o,(e,t)=>{if(e===`__proto__`||e===`constructor`&&t&&typeof t==`object`&&`prototype`in t){r&&console.warn(`[better-json] Dropping "${e}" key to prevent prototype pollution`);return}if(a&&typeof t==`string`){let e=S1(t);if(e)return e}return i?i(e,t):t})}catch(t){if(n)throw t;return e}}function w1(e,t={strict:!0}){return C1(e,t)}function T1(e){return e==null?null:typeof e==`object`?e:Ee(e)}function E1(e){return e!=null&&typeof e==`string`}async function D1(e,t,n){if(n.storage!==`database`&&!n.fallbackToDatabase)return;let r=t.filter(e=>E1(e.metadata));if(r.length===0)return;let i=r.map(async t=>{let n=T1(t.metadata);try{await e.context.adapter.update({model:`apikey`,where:[{field:`id`,value:t.id}],update:{metadata:n}})}catch(n){e.context.logger.warn(`Failed to migrate double-stringified metadata for API key ${t.id}:`,n)}});await Promise.all(i)}async function O1(e,t,n){let r=T1(t.metadata);if(E1(t.metadata)&&(n.storage===`database`||n.fallbackToDatabase))try{await e.context.adapter.update({model:`apikey`,where:[{field:`id`,value:t.id}],update:{metadata:r}})}catch(n){e.context.logger.warn(`Failed to migrate double-stringified metadata for API key ${t.id}:`,n)}return r}function k1(e){return`api-key:${e}`}function A1(e){return`api-key:by-id:${e}`}function j1(e){return`api-key:by-ref:${e}`}function M1(e){return JSON.stringify({...e,createdAt:e.createdAt.toISOString(),updatedAt:e.updatedAt.toISOString(),expiresAt:e.expiresAt?.toISOString()??null,lastRefillAt:e.lastRefillAt?.toISOString()??null,lastRequest:e.lastRequest?.toISOString()??null})}function N1(e){if(!e||typeof e!=`string`)return null;try{let t=JSON.parse(e);return{...t,createdAt:new Date(t.createdAt),updatedAt:new Date(t.updatedAt),expiresAt:t.expiresAt?new Date(t.expiresAt):null,lastRefillAt:t.lastRefillAt?new Date(t.lastRefillAt):null,lastRequest:t.lastRequest?new Date(t.lastRequest):null}}catch{return null}}function P1(e,t){return t.customStorage?t.customStorage:e.context.secondaryStorage||null}function F1(e){if(e.expiresAt){let t=Date.now(),n=new Date(e.expiresAt).getTime(),r=Math.floor((n-t)/1e3);if(r>0)return r}}async function I1(e,t,n){let r=k1(t);return N1(await n.get(r))}async function L1(e,t,n){let r=A1(t);return N1(await n.get(r))}const R1=/* @__PURE__ */ new Map;function z1(e,t){let n=(R1.get(e)??Promise.resolve()).then(t,t).finally(()=>{R1.get(e)===n&&R1.delete(e)});return R1.set(e,n),n}async function B1(e,t,n){await z1(t,async()=>{let r=await e.get(t),i=[];if(r&&typeof r==`string`)try{i=JSON.parse(r)}catch{i=[]}else Array.isArray(r)&&(i=r);let a=n(i);a.length===0?await e.delete(t):await e.set(t,JSON.stringify(a))})}async function V1(e,t,n,r,i){let a=M1(t),o=j1(t.referenceId);if(i.fallbackToDatabase){await Promise.all([n.set(k1(t.key),a,r),n.set(A1(t.id),a,r),n.delete(o)]);return}await Promise.all([n.set(k1(t.key),a,r),n.set(A1(t.id),a,r)]),await B1(n,o,e=>e.includes(t.id)?e:[...e,t.id])}async function H1(e,t,n,r){let i=j1(t.referenceId);if(r.fallbackToDatabase){await Promise.all([n.delete(k1(t.key)),n.delete(A1(t.id)),n.delete(i)]);return}await Promise.all([n.delete(k1(t.key)),n.delete(A1(t.id)),B1(n,i,e=>e.filter(e=>e!==t.id))])}async function U1(e,t,n){let r=P1(e,n);if(n.storage===`database`)return await e.context.adapter.findOne({model:`apikey`,where:[{field:`key`,value:t}]});if(n.storage===`secondary-storage`&&n.fallbackToDatabase){if(r){let n=await I1(e,t,r);if(n)return n}let i=await e.context.adapter.findOne({model:`apikey`,where:[{field:`key`,value:t}]});return i&&r&&await V1(e,i,r,F1(i),n),i}return n.storage===`secondary-storage`?r?await I1(e,t,r):null:await e.context.adapter.findOne({model:`apikey`,where:[{field:`key`,value:t}]})}async function W1(e,t,n){let r=P1(e,n);if(n.storage===`database`)return await e.context.adapter.findOne({model:`apikey`,where:[{field:`id`,value:t}]});if(n.storage===`secondary-storage`&&n.fallbackToDatabase){if(r){let n=await L1(e,t,r);if(n)return n}let i=await e.context.adapter.findOne({model:`apikey`,where:[{field:`id`,value:t}]});return i&&r&&await V1(e,i,r,F1(i),n),i}return n.storage===`secondary-storage`?r?await L1(e,t,r):null:await e.context.adapter.findOne({model:`apikey`,where:[{field:`id`,value:t}]})}async function G1(e,t,n){let r=P1(e,n),i=F1(t);if(n.storage!==`database`&&n.storage===`secondary-storage`){if(!r)throw Error(`Secondary storage is required when storage mode is 'secondary-storage'`);await V1(e,t,r,i,n);return}}async function K1(e,t,n){let r=P1(e,n);if(n.storage!==`database`&&n.storage===`secondary-storage`){if(!r)throw Error(`Secondary storage is required when storage mode is 'secondary-storage'`);await H1(e,t,r,n);return}}function q1(e,t,n,r,i){let a=[...e];if(t){let e=n||`asc`;a.sort((n,r)=>{let i=n[t],a=r[t];return i==null&&a==null?0:i==null?e===`asc`?-1:1:a==null?e===`asc`?1:-1:i<a?e===`asc`?-1:1:i>a?e===`asc`?1:-1:0})}return i!==void 0&&(a=a.slice(i)),r!==void 0&&(a=a.slice(0,r)),a}async function J1(e,t,n,r){let i=P1(e,n),{limit:a,offset:o,sortBy:s,sortDirection:c}=r||{};if(n.storage===`database`){let[n,r]=await Promise.all([e.context.adapter.findMany({model:`apikey`,where:[{field:`referenceId`,value:t}],limit:a,offset:o,sortBy:s?{field:s,direction:c||`asc`}:void 0}),e.context.adapter.count({model:`apikey`,where:[{field:`referenceId`,value:t}]})]);return{apiKeys:n,total:r}}if(n.storage===`secondary-storage`&&n.fallbackToDatabase){let r=j1(t);if(i){let t=await i.get(r),n=[];if(t&&typeof t==`string`)try{n=JSON.parse(t)}catch{n=[]}else Array.isArray(t)&&(n=t);if(n.length>0){let t=(await g1(n,t=>L1(e,t,i),{concurrency:10})).filter(e=>e!=null);return{apiKeys:q1(t,s,c,a,o),total:t.length}}}let[l,u]=await Promise.all([e.context.adapter.findMany({model:`apikey`,where:[{field:`referenceId`,value:t}],limit:a,offset:o,sortBy:s?{field:s,direction:c||`asc`}:void 0}),e.context.adapter.count({model:`apikey`,where:[{field:`referenceId`,value:t}]})]);if(i&&l.length>0){await g1(l,t=>V1(e,t,i,F1(t),n),{concurrency:10});let t=l.map(e=>e.id);await i.set(r,JSON.stringify(t))}return{apiKeys:l,total:u}}if(n.storage===`secondary-storage`){if(!i)return{apiKeys:[],total:0};let n=j1(t),r=await i.get(n),l=[];if(r&&typeof r==`string`)try{l=JSON.parse(r)}catch{return{apiKeys:[],total:0}}else if(Array.isArray(r))l=r;else return{apiKeys:[],total:0};let u=(await g1(l,t=>L1(e,t,i),{concurrency:10})).filter(e=>e!=null);return{apiKeys:q1(u,s,c,a,o),total:u.length}}let[l,u]=await Promise.all([e.context.adapter.findMany({model:`apikey`,where:[{field:`referenceId`,value:t}],limit:a,offset:o,sortBy:s?{field:s,direction:c||`asc`}:void 0}),e.context.adapter.count({model:`apikey`,where:[{field:`referenceId`,value:t}]})]);return{apiKeys:l,total:u}}function Y1(e){let t=e.context;if(`orgOptions`in t&&t.orgOptions)return t.orgOptions;let n=t.getPlugin?.(`organization`);return n&&`options`in n?n.options:null}async function X1(e,t,n,r){let i=Y1(e);if(!i){let e=X.ORGANIZATION_PLUGIN_REQUIRED;throw c.from(`INTERNAL_SERVER_ERROR`,e)}let a=await e.context.adapter.findOne({model:`member`,where:[{field:`userId`,value:t},{field:`organizationId`,value:n}]});if(!a){let e=X.USER_NOT_MEMBER_OF_ORGANIZATION;throw c.from(`FORBIDDEN`,e)}if(!await Z1(e,a.role,n,r,i)){let e=X.INSUFFICIENT_API_KEY_PERMISSIONS;throw c.from(`FORBIDDEN`,e)}return a}async function Z1(e,t,n,r,i){let{hasPermission:a}=await import(`./organization-Bz1iQbJ0.mjs`);try{return await a({role:t,options:i,permissions:{apiKey:[r]},organizationId:n,allowCreatorAllPermissions:!0},e)}catch{return!1}}const Q1=(e,t=`ms`)=>new Date(Date.now()+(t===`sec`?e*1e3:e));function $1(e){return e instanceof c||e instanceof c||e?.name===`APIError`}const e0=D({configId:f().meta({description:`The configuration ID to use for the API key. If not provided, the default configuration will be used.`}).optional(),name:f().meta({description:`Name of the Api Key`}).optional(),expiresIn:m().meta({description:`Expiration time of the Api Key in seconds`}).min(1).optional().nullable().default(null),prefix:f().meta({description:`Prefix of the Api Key`}).regex(/^[a-zA-Z0-9_-]+$/,{message:`Invalid prefix format, must be alphanumeric and contain only underscores and hyphens.`}).optional(),remaining:m().meta({description:`Remaining number of requests. Server side only`}).min(0).optional().nullable().default(null),metadata:ie().optional(),refillAmount:m().meta({description:`Amount to refill the remaining count of the Api Key. server-only. Eg: 100`}).min(1).optional(),refillInterval:m().meta({description:`Interval to refill the Api Key in milliseconds. server-only. Eg: 1000`}).optional(),rateLimitTimeWindow:m().meta({description:"The duration in milliseconds where each request is counted. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 1000"}).optional(),rateLimitMax:m().meta({description:"Maximum amount of requests allowed within a window. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 100"}).optional(),rateLimitEnabled:T().meta({description:`Whether the key has rate limiting enabled. server-only. Eg: true`}).optional(),permissions:g(f(),_(f())).meta({description:`Permissions of the Api Key.`}).optional(),userId:wI().meta({description:`User Id of the user that the Api Key belongs to. server-only. Eg: "user-id"`}).optional(),organizationId:wI().meta({description:`Organization Id of the organization that the Api Key belongs to. Eg: 'org-id'`}).optional()});function t0({defaultKeyGenerator:e,configurations:t,schema:n,deleteAllExpiredApiKeys:r}){return Y(`/api-key/create`,{method:`POST`,body:e0,metadata:{openapi:{description:`Create a new API key for a user`,responses:{200:{description:`API key created successfully`,content:{"application/json":{schema:{type:`object`,properties:{id:{type:`string`,description:`Unique identifier of the API key`},createdAt:{type:`string`,format:`date-time`,description:`Creation timestamp`},updatedAt:{type:`string`,format:`date-time`,description:`Last update timestamp`},name:{type:`string`,nullable:!0,description:`Name of the API key`},prefix:{type:`string`,nullable:!0,description:`Prefix of the API key`},start:{type:`string`,nullable:!0,description:`Starting characters of the key (if configured)`},key:{type:`string`,description:`The full API key (only returned on creation)`},enabled:{type:`boolean`,description:`Whether the key is enabled`},expiresAt:{type:`string`,format:`date-time`,nullable:!0,description:`Expiration timestamp`},referenceId:{type:`string`,description:`ID of the reference owning the key`},lastRefillAt:{type:`string`,format:`date-time`,nullable:!0,description:`Last refill timestamp`},lastRequest:{type:`string`,format:`date-time`,nullable:!0,description:`Last request timestamp`},metadata:{type:`object`,nullable:!0,additionalProperties:!0,description:`Metadata associated with the key`},rateLimitMax:{type:`number`,nullable:!0,description:`Maximum requests in time window`},rateLimitTimeWindow:{type:`number`,nullable:!0,description:`Rate limit time window in milliseconds`},remaining:{type:`number`,nullable:!0,description:`Remaining requests`},refillAmount:{type:`number`,nullable:!0,description:`Amount to refill`},refillInterval:{type:`number`,nullable:!0,description:`Refill interval in milliseconds`},rateLimitEnabled:{type:`boolean`,description:`Whether rate limiting is enabled`},requestCount:{type:`number`,description:`Current request count in window`},permissions:{type:`object`,nullable:!0,additionalProperties:{type:`array`,items:{type:`string`}},description:`Permissions associated with the key`}},required:[`id`,`createdAt`,`updatedAt`,`key`,`enabled`,`referenceId`,`rateLimitEnabled`,`requestCount`]}}}}}}}},async n=>{let{configId:i,name:a,expiresIn:o,prefix:s,remaining:l,metadata:u,refillAmount:d,refillInterval:f,permissions:p,rateLimitMax:m,rateLimitTimeWindow:h,rateLimitEnabled:g}=n.body,_=x0(n.context,t,i),v=_.customKeyGenerator||e,y=await CH(n,{disableCookieCache:!0}),b=n.request||n.headers;if(b&&(d!==void 0||f!==void 0||m!==void 0||h!==void 0||g!==void 0||p!==void 0||l!==null))throw c.from(`BAD_REQUEST`,X.SERVER_ONLY_PROPERTY);if(n.request&&n.body.userId!==void 0)throw c.from(`UNAUTHORIZED`,X.UNAUTHORIZED_SESSION);let x=_.references??`user`,S;if(x===`organization`){let e=n.body.organizationId;if(!e){let e=X.ORGANIZATION_ID_REQUIRED;throw c.from(`BAD_REQUEST`,e)}let t=y?.user.id||n.body.userId;if(!t)throw c.from(`UNAUTHORIZED`,X.UNAUTHORIZED_SESSION);await X1(n,t,e,`create`),S=e}else if(b){if(!y?.user.id){let e=X.UNAUTHORIZED_SESSION;throw c.from(`UNAUTHORIZED`,e)}S=y.user.id}else{let e=n.body.userId,t=y?.user.id;if(!t&&!e){let e=X.UNAUTHORIZED_SESSION;throw c.from(`UNAUTHORIZED`,e)}if(y&&e&&t!==e){let e=X.UNAUTHORIZED_SESSION;throw c.from(`UNAUTHORIZED`,e)}S=t||e}if(u){if(_.enableMetadata===!1)throw c.from(`BAD_REQUEST`,X.METADATA_DISABLED);if(typeof u!=`object`)throw c.from(`BAD_REQUEST`,X.INVALID_METADATA_TYPE)}if(d&&!f){let e=X.REFILL_AMOUNT_AND_INTERVAL_REQUIRED;throw c.from(`BAD_REQUEST`,e)}if(f&&!d){let e=X.REFILL_INTERVAL_AND_AMOUNT_REQUIRED;throw c.from(`BAD_REQUEST`,e)}if(o){if(_.keyExpiration.disableCustomExpiresTime===!0){let e=X.KEY_DISABLED_EXPIRATION;throw c.from(`BAD_REQUEST`,e)}let e=o/86400;if(_.keyExpiration.minExpiresIn>e){let e=X.EXPIRES_IN_IS_TOO_SMALL;throw c.from(`BAD_REQUEST`,e)}if(_.keyExpiration.maxExpiresIn<e){let e=X.EXPIRES_IN_IS_TOO_LARGE;throw c.from(`BAD_REQUEST`,e)}}if(s&&(s.length<_.minimumPrefixLength||s.length>_.maximumPrefixLength))throw c.from(`BAD_REQUEST`,X.INVALID_PREFIX_LENGTH);if(a){if(a.length<_.minimumNameLength||a.length>_.maximumNameLength)throw c.from(`BAD_REQUEST`,X.INVALID_NAME_LENGTH)}else if(_.requireName)throw c.from(`BAD_REQUEST`,X.NAME_REQUIRED);r(n.context);let C=await v({length:_.defaultKeyLength,prefix:s||_.defaultPrefix}),w=_.disableKeyHashing?C:await O0(C),T=null;_.startingCharactersConfig.shouldStore&&(T=C.substring(0,_.startingCharactersConfig.charactersLength));let ee=_.permissions?.defaultPermissions?typeof _.permissions.defaultPermissions==`function`?await _.permissions.defaultPermissions(S,n):_.permissions.defaultPermissions:void 0,te=p?JSON.stringify(p):ee?JSON.stringify(ee):void 0,E={configId:_.configId??`default`,createdAt:/* @__PURE__ */ new Date,updatedAt:/* @__PURE__ */ new Date,name:a??null,prefix:s??_.defaultPrefix??null,start:T,key:w,enabled:!0,expiresAt:o?Q1(o,`sec`):_.keyExpiration.defaultExpiresIn?Q1(_.keyExpiration.defaultExpiresIn,`sec`):null,referenceId:S,lastRefillAt:null,lastRequest:null,metadata:null,rateLimitMax:m??_.rateLimit.maxRequests??null,rateLimitTimeWindow:h??_.rateLimit.timeWindow??null,remaining:l===null?l:l??d??null,refillAmount:d??null,refillInterval:f??null,rateLimitEnabled:g===void 0?_.rateLimit.enabled??!0:g,requestCount:0,permissions:te};u&&(E.metadata=u);let ne;if(_.storage===`secondary-storage`&&_.fallbackToDatabase)ne=await n.context.adapter.create({model:k0,data:E}),await G1(n,ne,_);else if(_.storage===`secondary-storage`){let e=n.context.generateId({model:`apikey`})||Gt();ne={...E,id:e},await G1(n,ne,_)}else ne=await n.context.adapter.create({model:k0,data:E});return n.json({...ne,key:C,metadata:u??null,permissions:ne.permissions?Ee(ne.permissions):null})})}function n0({deleteAllExpiredApiKeys:e}){return Y.serverOnly({method:`POST`},async t=>{try{await e(t.context,!0)}catch(e){return t.context.logger.error(`[API KEY PLUGIN] Failed to delete expired API keys:`,e),t.json({success:!1,error:e})}return t.json({success:!0,error:null})})}const r0=D({configId:f().meta({description:`The configuration ID to use for the API key lookup. If not provided, the default configuration will be used.`}).optional(),keyId:f().meta({description:`The id of the Api Key`})});function i0({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return Y(`/api-key/delete`,{method:`POST`,body:r0,use:[TH],metadata:{openapi:{description:`Delete an existing API key`,requestBody:{content:{"application/json":{schema:{type:`object`,properties:{keyId:{type:`string`,description:`The id of the API key to delete`}},required:[`keyId`]}}}},responses:{200:{description:`API key deleted successfully`,content:{"application/json":{schema:{type:`object`,properties:{success:{type:`boolean`,description:`Indicates if the API key was successfully deleted`}},required:[`success`]}}}}}}}},async t=>{let{configId:r,keyId:i}=t.body,a=t.context.session;if(a.user.banned===!0)throw c.from(`UNAUTHORIZED`,X.USER_BANNED);let o=x0(t.context,e,r),s=null;if(s=await W1(t,i,o),!s||!C0(s.configId,o.configId))throw c.from(`NOT_FOUND`,X.KEY_NOT_FOUND);let l=x0(t.context,e,s.configId);if((l.references??`user`)===`organization`)await X1(t,a.user.id,s.referenceId,`delete`);else if(s.referenceId!==a.user.id)throw c.from(`NOT_FOUND`,X.KEY_NOT_FOUND);try{l.storage===`secondary-storage`&&l.fallbackToDatabase?(await K1(t,s,l),await t.context.adapter.delete({model:k0,where:[{field:`id`,value:s.id}]})):l.storage===`database`?await t.context.adapter.delete({model:k0,where:[{field:`id`,value:s.id}]}):await K1(t,s,l)}catch(e){throw c.fromStatus(`INTERNAL_SERVER_ERROR`,{message:e?.message})}return n(t.context),t.json({success:!0})})}const a0=D({configId:f().meta({description:`The configuration ID to use for the API key lookup. If not provided, the default configuration will be used.`}).optional(),id:f().meta({description:`The id of the Api Key`})});function o0({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return Y(`/api-key/get`,{method:`GET`,query:a0,use:[TH],metadata:{openapi:{description:`Retrieve an existing API key by ID`,responses:{200:{description:`API key retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{id:{type:`string`,description:`ID`},name:{type:`string`,nullable:!0,description:`The name of the key`},start:{type:`string`,nullable:!0,description:`Shows the first few characters of the API key, including the prefix. This allows you to show those few characters in the UI to make it easier for users to identify the API key.`},prefix:{type:`string`,nullable:!0,description:`The API Key prefix. Stored as plain text.`},userId:{type:`string`,description:`The owner of the user id`},refillInterval:{type:`number`,nullable:!0,description:"The interval in milliseconds between refills of the `remaining` count. Example: 3600000 // refill every hour (3600000ms = 1h)"},refillAmount:{type:`number`,nullable:!0,description:`The amount to refill`},lastRefillAt:{type:`string`,format:`date-time`,nullable:!0,description:`The last refill date`},enabled:{type:`boolean`,description:`Sets if key is enabled or disabled`,default:!0},rateLimitEnabled:{type:`boolean`,description:`Whether the key has rate limiting enabled`},rateLimitTimeWindow:{type:`number`,nullable:!0,description:`The duration in milliseconds`},rateLimitMax:{type:`number`,nullable:!0,description:`Maximum amount of requests allowed within a window`},requestCount:{type:`number`,description:`The number of requests made within the rate limit time window`},remaining:{type:`number`,nullable:!0,description:`Remaining requests (every time api key is used this should updated and should be updated on refill as well)`},lastRequest:{type:`string`,format:`date-time`,nullable:!0,description:`When last request occurred`},expiresAt:{type:`string`,format:`date-time`,nullable:!0,description:`Expiry date of a key`},createdAt:{type:`string`,format:`date-time`,description:`created at`},updatedAt:{type:`string`,format:`date-time`,description:`updated at`},metadata:{type:`object`,nullable:!0,additionalProperties:!0,description:`Extra metadata about the apiKey`},permissions:{type:`string`,nullable:!0,description:`Permissions for the api key (stored as JSON string)`}},required:[`id`,`userId`,`enabled`,`rateLimitEnabled`,`requestCount`,`createdAt`,`updatedAt`]}}}}}}}},async t=>{let{configId:r,id:i}=t.query,a=t.context.session,o=x0(t.context,e,r),s=null;if(s=await W1(t,i,o),!s||!C0(s.configId,o.configId))throw c.from(`NOT_FOUND`,X.KEY_NOT_FOUND);let l=x0(t.context,e,s.configId);if((l.references??`user`)===`organization`)await X1(t,a.user.id,s.referenceId,`read`);else if(s.referenceId!==a.user.id)throw c.from(`NOT_FOUND`,X.KEY_NOT_FOUND);n(t.context);let u=await O1(t,s,l),{key:d,...f}=s;return t.json({...f,metadata:u,permissions:f.permissions?Ee(f.permissions):null})})}function s0(e){return e.storage===`database`?`database`:e.customStorage?`custom:${e.configId??`default`}`:e.fallbackToDatabase?`secondary-storage-with-fallback`:`secondary-storage`}const c0=D({configId:f().meta({description:`Filter by configuration ID. If not provided, returns keys from all configurations.`}).optional(),organizationId:f().meta({description:`Organization ID to list keys for. If provided, returns organization-owned keys. If not provided, returns user-owned keys.`}).optional(),limit:TI().int().nonnegative().meta({description:`The number of API keys to return`}).optional(),offset:TI().int().nonnegative().meta({description:`The offset to start from`}).optional(),sortBy:f().meta({description:`The field to sort by (e.g., createdAt, name, expiresAt)`}).optional(),sortDirection:E([`asc`,`desc`]).meta({description:`The direction to sort by`}).optional()}).optional();function l0({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return Y(`/api-key/list`,{method:`GET`,use:[TH],query:c0,metadata:{openapi:{description:`List all API keys for the authenticated user or for a specific organization`,responses:{200:{description:`API keys retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{apiKeys:{type:`array`,items:{type:`object`,properties:{id:{type:`string`,description:`ID`},name:{type:`string`,nullable:!0,description:`The name of the key`},start:{type:`string`,nullable:!0,description:`Shows the first few characters of the API key, including the prefix. This allows you to show those few characters in the UI to make it easier for users to identify the API key.`},prefix:{type:`string`,nullable:!0,description:`The API Key prefix. Stored as plain text.`},userId:{type:`string`,description:`The owner of the user id`},refillInterval:{type:`number`,nullable:!0,description:"The interval in milliseconds between refills of the `remaining` count. Example: 3600000 // refill every hour (3600000ms = 1h)"},refillAmount:{type:`number`,nullable:!0,description:`The amount to refill`},lastRefillAt:{type:`string`,format:`date-time`,nullable:!0,description:`The last refill date`},enabled:{type:`boolean`,description:`Sets if key is enabled or disabled`,default:!0},rateLimitEnabled:{type:`boolean`,description:`Whether the key has rate limiting enabled`},rateLimitTimeWindow:{type:`number`,nullable:!0,description:`The duration in milliseconds`},rateLimitMax:{type:`number`,nullable:!0,description:`Maximum amount of requests allowed within a window`},requestCount:{type:`number`,description:`The number of requests made within the rate limit time window`},remaining:{type:`number`,nullable:!0,description:`Remaining requests (every time api key is used this should updated and should be updated on refill as well)`},lastRequest:{type:`string`,format:`date-time`,nullable:!0,description:`When last request occurred`},expiresAt:{type:`string`,format:`date-time`,nullable:!0,description:`Expiry date of a key`},createdAt:{type:`string`,format:`date-time`,description:`created at`},updatedAt:{type:`string`,format:`date-time`,description:`updated at`},metadata:{type:`object`,nullable:!0,additionalProperties:!0,description:`Extra metadata about the apiKey`},permissions:{type:`string`,nullable:!0,description:`Permissions for the api key (stored as JSON string)`}},required:[`id`,`userId`,`enabled`,`rateLimitEnabled`,`requestCount`,`createdAt`,`updatedAt`]}},total:{type:`number`,description:`Total number of API keys`},limit:{type:`number`,nullable:!0,description:`The limit used for pagination`},offset:{type:`number`,nullable:!0,description:`The offset used for pagination`}},required:[`apiKeys`,`total`]}}}}}}}},async t=>{let r=t.context.session,i=t.query?.configId,a=t.query?.organizationId,o=t.query?.limit==null?void 0:Number(t.query.limit),s=t.query?.offset==null?void 0:Number(t.query.offset);a&&await X1(t,r.user.id,a,`read`);let c=a??r.user.id,l=a?`organization`:`user`,u=[];if(i){let{apiKeys:n}=await J1(t,c,x0(t.context,e,i),{limit:void 0,offset:void 0,sortBy:t.query?.sortBy,sortDirection:t.query?.sortDirection});u=n}else{let n=/* @__PURE__ */ new Map;for(let t of e){let e=s0(t);n.has(e)||n.set(e,t)}let r=await Promise.all([...n.values()].map(e=>J1(t,c,e,{limit:void 0,offset:void 0,sortBy:t.query?.sortBy,sortDirection:t.query?.sortDirection}))),i=/* @__PURE__ */ new Set;for(let{apiKeys:e}of r)for(let t of e)i.has(t.id)||(i.add(t.id),u.push(t))}let d=u.filter(t=>(e.find(e=>S0(t.configId)?S0(e.configId):e.configId===t.configId)?.references??`user`)===l&&t.referenceId===c);i&&(d=d.filter(e=>C0(e.configId,i)));let f=d.length,p=d;s!==void 0&&(p=p.slice(s)),o!==void 0&&(p=p.slice(0,o)),n(t.context);let m=p.map(e=>{let{key:t,...n}=e;return{...n,metadata:T1(e.metadata),permissions:n.permissions?Ee(n.permissions):null}}),h=e.find(e=>e.storage===`database`||e.fallbackToDatabase);return h&&await t.context.runInBackgroundOrAwait(D1(t,p,h)),t.json({apiKeys:m,total:f,limit:o,offset:s})})}const u0=D({configId:f().meta({description:`The configuration ID to use for the API key lookup. If not provided, the default configuration will be used.`}).optional(),keyId:f().meta({description:`The id of the Api Key`}),userId:wI().meta({description:`The id of the user which the api key belongs to. server-only. Eg: "some-user-id"`}).optional(),name:f().meta({description:`The name of the key`}).optional(),enabled:T().meta({description:`Whether the Api Key is enabled or not`}).optional(),remaining:m().meta({description:`The number of remaining requests`}).min(1).optional(),refillAmount:m().meta({description:`The refill amount`}).optional(),refillInterval:m().meta({description:`The refill interval`}).optional(),metadata:ie().optional(),expiresIn:m().meta({description:`Expiration time of the Api Key in seconds`}).min(1).optional().nullable(),rateLimitEnabled:T().meta({description:`Whether the key has rate limiting enabled.`}).optional(),rateLimitTimeWindow:m().meta({description:`The duration in milliseconds where each request is counted. server-only. Eg: 1000`}).optional(),rateLimitMax:m().meta({description:"Maximum amount of requests allowed within a window. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 100"}).optional(),permissions:g(f(),_(f())).meta({description:`Update the permissions on the API Key. server-only.`}).optional().nullable()});function d0({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return Y(`/api-key/update`,{method:`POST`,body:u0,metadata:{openapi:{description:`Update an existing API key by ID`,responses:{200:{description:`API key updated successfully`,content:{"application/json":{schema:{type:`object`,properties:{id:{type:`string`,description:`ID`},name:{type:`string`,nullable:!0,description:`The name of the key`},start:{type:`string`,nullable:!0,description:`Shows the first few characters of the API key, including the prefix. This allows you to show those few characters in the UI to make it easier for users to identify the API key.`},prefix:{type:`string`,nullable:!0,description:`The API Key prefix. Stored as plain text.`},userId:{type:`string`,description:`The owner of the user id`},refillInterval:{type:`number`,nullable:!0,description:"The interval in milliseconds between refills of the `remaining` count. Example: 3600000 // refill every hour (3600000ms = 1h)"},refillAmount:{type:`number`,nullable:!0,description:`The amount to refill`},lastRefillAt:{type:`string`,format:`date-time`,nullable:!0,description:`The last refill date`},enabled:{type:`boolean`,description:`Sets if key is enabled or disabled`,default:!0},rateLimitEnabled:{type:`boolean`,description:`Whether the key has rate limiting enabled`},rateLimitTimeWindow:{type:`number`,nullable:!0,description:`The duration in milliseconds`},rateLimitMax:{type:`number`,nullable:!0,description:`Maximum amount of requests allowed within a window`},requestCount:{type:`number`,description:`The number of requests made within the rate limit time window`},remaining:{type:`number`,nullable:!0,description:`Remaining requests (every time api key is used this should updated and should be updated on refill as well)`},lastRequest:{type:`string`,format:`date-time`,nullable:!0,description:`When last request occurred`},expiresAt:{type:`string`,format:`date-time`,nullable:!0,description:`Expiry date of a key`},createdAt:{type:`string`,format:`date-time`,description:`created at`},updatedAt:{type:`string`,format:`date-time`,description:`updated at`},metadata:{type:`object`,nullable:!0,additionalProperties:!0,description:`Extra metadata about the apiKey`},permissions:{type:`string`,nullable:!0,description:`Permissions for the api key (stored as JSON string)`}},required:[`id`,`userId`,`enabled`,`rateLimitEnabled`,`requestCount`,`createdAt`,`updatedAt`]}}}}}}}},async t=>{let{configId:r,keyId:i,expiresIn:a,enabled:o,metadata:s,refillAmount:l,refillInterval:u,remaining:d,name:f,permissions:p,rateLimitEnabled:m,rateLimitTimeWindow:h,rateLimitMax:g}=t.body,_=await CH(t,{disableCookieCache:!0}),v=t.request||t.headers,y=v&&!_?null:_?.user||{id:t.body.userId};if(!y?.id||_&&t.body.userId&&_?.user.id!==t.body.userId)throw c.from(`UNAUTHORIZED`,X.UNAUTHORIZED_SESSION);if(v&&(l!==void 0||u!==void 0||g!==void 0||h!==void 0||m!==void 0||d!==void 0||p!==void 0))throw c.from(`BAD_REQUEST`,X.SERVER_ONLY_PROPERTY);let b=x0(t.context,e,r),x=null;if(x=await W1(t,i,b),!x||!C0(x.configId,b.configId))throw c.from(`NOT_FOUND`,X.KEY_NOT_FOUND);let S=x0(t.context,e,x.configId);if((S.references??`user`)===`organization`)await X1(t,y.id,x.referenceId,`update`);else if(x.referenceId!==y.id)throw c.from(`NOT_FOUND`,X.KEY_NOT_FOUND);let C={};if(f!==void 0){if(f.length<S.minimumNameLength||f.length>S.maximumNameLength)throw c.from(`BAD_REQUEST`,X.INVALID_NAME_LENGTH);C.name=f}if(o!==void 0&&(C.enabled=o),a!==void 0){if(S.keyExpiration.disableCustomExpiresTime===!0)throw c.from(`BAD_REQUEST`,X.KEY_DISABLED_EXPIRATION);if(a!==null){let e=a/86400;if(e<S.keyExpiration.minExpiresIn)throw c.from(`BAD_REQUEST`,X.EXPIRES_IN_IS_TOO_SMALL);if(e>S.keyExpiration.maxExpiresIn)throw c.from(`BAD_REQUEST`,X.EXPIRES_IN_IS_TOO_LARGE)}C.expiresAt=a?Q1(a,`sec`):null}if(s!==void 0&&S.enableMetadata===!0){if(typeof s!=`object`)throw c.from(`BAD_REQUEST`,X.INVALID_METADATA_TYPE);C.metadata=s}if(d!==void 0&&(C.remaining=d),l!==void 0||u!==void 0){if(l!==void 0&&u===void 0)throw c.from(`BAD_REQUEST`,X.REFILL_AMOUNT_AND_INTERVAL_REQUIRED);if(u!==void 0&&l===void 0)throw c.from(`BAD_REQUEST`,X.REFILL_INTERVAL_AND_AMOUNT_REQUIRED);C.refillAmount=l,C.refillInterval=u}if(m!==void 0&&(C.rateLimitEnabled=m),h!==void 0&&(C.rateLimitTimeWindow=h),g!==void 0&&(C.rateLimitMax=g),p!==void 0&&(C.permissions=JSON.stringify(p)),Object.keys(C).length===0)throw c.from(`BAD_REQUEST`,X.NO_VALUES_TO_UPDATE);let w=x;try{if(S.storage===`secondary-storage`&&S.fallbackToDatabase){let e=await t.context.adapter.update({model:k0,where:[{field:`id`,value:x.id}],update:C});e&&(await G1(t,e,S),w=e)}else if(S.storage===`database`){let e=await t.context.adapter.update({model:k0,where:[{field:`id`,value:x.id}],update:C});e&&(w=e)}else{let e={...x,...C,updatedAt:/* @__PURE__ */ new Date};await G1(t,e,S),w=e}}catch(e){throw c.fromStatus(`INTERNAL_SERVER_ERROR`,{message:e?.message})}n(t.context);let T=await O1(t,w,S),{key:ee,...te}=w;return t.json({...te,metadata:T,permissions:te.permissions?Ee(te.permissions):null})})}function f0(e,t){let n=/* @__PURE__ */ new Date,r=e.lastRequest,i=e.rateLimitTimeWindow,a=e.rateLimitMax;if(t.rateLimit.enabled===!1||e.rateLimitEnabled===!1)return{type:`skip`,lastRequest:n};if(i===null||a===null)return{type:`skip`,lastRequest:null};if(r===null)return{type:`start`,now:n};let o=n.getTime()-new Date(r).getTime();return o>i?{type:`reset`,now:n,windowStart:new Date(n.getTime()-i)}:e.requestCount>=a?{type:`deny`,message:X.RATE_LIMIT_EXCEEDED.message,tryAgainIn:Math.ceil(i-o)}:{type:`increment`,now:n,max:a,windowStart:new Date(n.getTime()-i)}}async function p0({key:e,ctx:t,lookupOpts:n,configurations:r,schema:i,permissions:a,expectedConfigId:o,runCustomValidator:s}){let l=n.disableKeyHashing?e:await O0(e),u=await U1(t,l,n);if(!u||o!==void 0&&!C0(u.configId,o))throw c.from(`UNAUTHORIZED`,X.INVALID_API_KEY);let d=x0(t.context,r,u.configId);if(s&&d.customAPIKeyValidator&&!await d.customAPIKeyValidator({ctx:t,key:e}))throw c.from(`UNAUTHORIZED`,X.KEY_NOT_FOUND);if(u.enabled===!1)throw c.from(`UNAUTHORIZED`,X.KEY_DISABLED);if(u.expiresAt&&Date.now()>new Date(u.expiresAt).getTime()){let e=async()=>{d.storage===`secondary-storage`&&d.fallbackToDatabase?(await K1(t,u,d),await t.context.adapter.delete({model:k0,where:[{field:`id`,value:u.id}]})):d.storage===`secondary-storage`?await K1(t,u,d):await t.context.adapter.delete({model:k0,where:[{field:`id`,value:u.id}]})};throw d.deferUpdates?t.context.runInBackground(e().catch(e=>{t.context.logger.error(`Deferred update failed:`,e)})):await e(),c.from(`UNAUTHORIZED`,X.KEY_EXPIRED)}if(a){let e=u.permissions?Ee(u.permissions):null;if(!e||!gee(e).authorize(a).success)throw c.from(`UNAUTHORIZED`,X.KEY_NOT_FOUND)}if(u.remaining===0&&u.refillAmount===null){let e=async()=>{d.storage===`secondary-storage`&&d.fallbackToDatabase?(await K1(t,u,d),await t.context.adapter.delete({model:k0,where:[{field:`id`,value:u.id}]})):d.storage===`secondary-storage`?await K1(t,u,d):await t.context.adapter.delete({model:k0,where:[{field:`id`,value:u.id}]})};throw d.deferUpdates?t.context.runInBackground(e().catch(e=>{t.context.logger.error(`Deferred update failed:`,e)})):await e(),c.from(`TOO_MANY_REQUESTS`,X.USAGE_EXCEEDED)}return{apiKey:d.storage===`database`||d.storage===`secondary-storage`&&d.fallbackToDatabase?await m0({ctx:t,apiKey:u,opts:d,hashedKey:l}):await _0({ctx:t,apiKey:u,opts:d,hashedKey:l}),opts:d}}async function m0({ctx:e,apiKey:t,opts:n,hashedKey:r}){let i=t;t.remaining!==null&&(i=await h0(e,t)),i=await g0(e,i,n);let a=await e.context.adapter.update({model:k0,where:[{field:`id`,value:i.id}],update:{updatedAt:/* @__PURE__ */ new Date}});if(!a)throw c.from(`UNAUTHORIZED`,X.INVALID_API_KEY);return n.storage===`secondary-storage`&&n.fallbackToDatabase&&await G1(e,a,n),a}async function h0(e,t){let n=/* @__PURE__ */ new Date,{refillInterval:r,refillAmount:i}=t;if(r&&i){let a=new Date(t.lastRefillAt??t.createdAt).getTime();if(n.getTime()-a>r){let r=await e.context.adapter.incrementOne({model:k0,where:[{field:`id`,value:t.id},{field:`lastRefillAt`,value:t.lastRefillAt}],increment:{},set:{remaining:i-1,lastRefillAt:n}});if(r)return r}}let a=await e.context.adapter.incrementOne({model:k0,where:[{field:`id`,value:t.id},{field:`remaining`,operator:`gt`,value:0}],increment:{remaining:-1}});if(!a)throw c.from(`TOO_MANY_REQUESTS`,X.USAGE_EXCEEDED);return a}async function g0(e,t,n){let r=f0(t,n);if(r.type===`deny`)throw new c(`TOO_MANY_REQUESTS`,{message:r.message,code:`RATE_LIMITED`,details:{tryAgainIn:r.tryAgainIn}});if(r.type===`skip`)return r.lastRequest===null?t:await e.context.adapter.update({model:`apikey`,where:[{field:`id`,value:t.id}],update:{lastRequest:r.lastRequest}})??t;if(r.type===`increment`){let i=await e.context.adapter.incrementOne({model:k0,where:[{field:`id`,value:t.id},{field:`lastRequest`,operator:`gt`,value:r.windowStart},{field:`requestCount`,operator:`lt`,value:r.max}],increment:{requestCount:1},set:{lastRequest:r.now}});if(i)return i;let a=await e.context.adapter.findOne({model:k0,where:[{field:`id`,value:t.id}]});if(!a)throw c.from(`UNAUTHORIZED`,X.INVALID_API_KEY);return g0(e,a,n)}let i=r.type===`reset`?{field:`lastRequest`,operator:`lte`,value:r.windowStart}:{field:`lastRequest`,operator:`eq`,value:null},a=await e.context.adapter.incrementOne({model:k0,where:[{field:`id`,value:t.id},i],increment:{},set:{requestCount:1,lastRequest:r.now}});if(a)return a;let o=await e.context.adapter.findOne({model:k0,where:[{field:`id`,value:t.id}]});if(!o)throw c.from(`UNAUTHORIZED`,X.INVALID_API_KEY);return g0(e,o,n)}async function _0({ctx:e,apiKey:t,opts:n,hashedKey:r}){let i=t.remaining,a=t.lastRefillAt;if(i!==null){let e=Date.now(),{refillInterval:n,refillAmount:r}=t,o=new Date(a??t.createdAt).getTime();if(n&&r&&e-o>n&&(i=r,a=/* @__PURE__ */ new Date),i===0)throw c.from(`TOO_MANY_REQUESTS`,X.USAGE_EXCEEDED);i--}let o={...v0(t,n),remaining:i,lastRefillAt:a,updatedAt:/* @__PURE__ */ new Date},s=async()=>{let t=await U1(e,r,n);if(!t)return null;let i={...t,...o};return await G1(e,i,n),i};if(n.deferUpdates)return e.context.runInBackground(s().catch(t=>{e.context.logger.error(`Failed to update API key:`,t)})),{...t,...o};let l=await s();if(!l)throw c.from(`INTERNAL_SERVER_ERROR`,X.FAILED_TO_UPDATE_API_KEY);return l}function v0(e,t){let n=f0(e,t);switch(n.type){case`deny`:throw new c(`TOO_MANY_REQUESTS`,{message:n.message,code:`RATE_LIMITED`,details:{tryAgainIn:n.tryAgainIn}});case`skip`:return n.lastRequest===null?{}:{lastRequest:n.lastRequest};case`start`:case`reset`:return{lastRequest:n.now,requestCount:1};case`increment`:return{lastRequest:n.now,requestCount:e.requestCount+1}}}const y0=D({configId:f().meta({description:`Configuration ID to scope verification to. When omitted, the key is validated against its own configuration.`}).optional(),key:f().meta({description:`The key to verify`}),permissions:g(f(),_(f())).meta({description:`The permissions to verify.`}).optional()});function b0({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return Y.serverOnly({method:`POST`,body:y0},async r=>{let{configId:i,key:a}=r.body,o=x0(r.context,e,i);if(i!==void 0&&o.customAPIKeyValidator&&!await o.customAPIKeyValidator({ctx:r,key:a}))return r.json({valid:!1,error:{message:X.INVALID_API_KEY,code:`KEY_NOT_FOUND`},key:null});let s=null,c;try{let l=await p0({key:a,permissions:r.body.permissions,ctx:r,lookupOpts:o,configurations:e,schema:t,expectedConfigId:i,runCustomValidator:i===void 0});s=l.apiKey,c=l.opts,c.deferUpdates&&r.context.runInBackground(n(r.context).catch(e=>{r.context.logger.error(`Failed to delete expired API keys:`,e)}))}catch(e){return r.context.logger.error(`Failed to validate API key:`,e),$1(e)?r.json({valid:!1,error:{...e.body,message:e.body?.message,code:e.body?.code},key:null}):r.json({valid:!1,error:{message:X.INVALID_API_KEY,code:`INVALID_API_KEY`},key:null})}let{key:l,...u}=s??{key:1,permissions:void 0},d=null;return s&&(d=await O1(r,s,c)),u.permissions=u.permissions?Ee(u.permissions):null,r.json({valid:!0,error:null,key:s===null?null:{...u,metadata:d}})})}function x0(e,t,n){let r=()=>{let n=t.find(e=>!e.configId||e.configId==="default");if(!n){e.logger.error("No default api-key configuration found. Either provide an api-key configuration with configId 'default' or provide a configuration with no `configId` set.");let t=X.NO_DEFAULT_API_KEY_CONFIGURATION_FOUND;throw c.from(`BAD_REQUEST`,t)}return{...n,configId:`default`}};return n?t.find(e=>e.configId===n)??r():r()}function S0(e){return!e||e==="default"}function C0(e,t){return S0(e)&&S0(t)?!0:e===t}let w0=null;async function T0(e,t=!1){w0&&!t&&(/* @__PURE__ */ new Date()).getTime()-w0.getTime()<1e4||(w0=/* @__PURE__ */ new Date,await e.adapter.deleteMany({model:k0,where:[{field:`expiresAt`,operator:`lt`,value:/* @__PURE__ */ new Date},{field:`expiresAt`,operator:`ne`,value:null}]}).catch(t=>{e.logger.error(`Failed to delete expired API keys:`,t)}))}function E0({defaultKeyGenerator:e,configurations:t,schema:n}){return{createApiKey:t0({defaultKeyGenerator:e,configurations:t,schema:n,deleteAllExpiredApiKeys:T0}),verifyApiKey:b0({configurations:t,schema:n,deleteAllExpiredApiKeys:T0}),getApiKey:o0({configurations:t,schema:n,deleteAllExpiredApiKeys:T0}),updateApiKey:d0({configurations:t,schema:n,deleteAllExpiredApiKeys:T0}),deleteApiKey:i0({configurations:t,schema:n,deleteAllExpiredApiKeys:T0}),listApiKeys:l0({configurations:t,schema:n,deleteAllExpiredApiKeys:T0}),deleteAllExpiredApiKeys:n0({deleteAllExpiredApiKeys:T0})}}const D0=({defaultRateLimitMax:e,defaultTimeWindow:t})=>({apikey:{fields:{configId:{type:`string`,required:!0,defaultValue:`default`,input:!1,index:!0},name:{type:`string`,required:!1,input:!1},start:{type:`string`,required:!1,input:!1},referenceId:{type:`string`,required:!0,input:!1,index:!0},prefix:{type:`string`,required:!1,input:!1},key:{type:`string`,required:!0,input:!1,index:!0},refillInterval:{type:`number`,required:!1,input:!1},refillAmount:{type:`number`,required:!1,input:!1},lastRefillAt:{type:`date`,required:!1,input:!1},enabled:{type:`boolean`,required:!1,input:!1,defaultValue:!0},rateLimitEnabled:{type:`boolean`,required:!1,input:!1,defaultValue:!0},rateLimitTimeWindow:{type:`number`,required:!1,input:!1,defaultValue:t},rateLimitMax:{type:`number`,required:!1,input:!1,defaultValue:e},requestCount:{type:`number`,required:!1,input:!1,defaultValue:0},remaining:{type:`number`,required:!1,input:!1},lastRequest:{type:`date`,required:!1,input:!1},expiresAt:{type:`date`,required:!1,input:!1},createdAt:{type:`date`,required:!0,input:!1},updatedAt:{type:`date`,required:!0,input:!1},permissions:{type:`string`,required:!1,input:!1},metadata:{type:`string`,required:!1,input:!0,transform:{input(e){return JSON.stringify(e)},output(e){return e?w1(e):null}}}}}}),O0=async e=>{let t=await PH(`SHA-256`).digest(new TextEncoder().encode(e));return oH.encode(new Uint8Array(t),{padding:!1})},k0=`apikey`;function A0(e,t){if(Array.isArray(e)&&e.length>0){if(!e.every(e=>e.configId))throw new l(`configId is required for each API key configuration in the api-key plugin.`);let t=e.map(e=>e.configId);if(new Set(t).size!==t.length)throw new l(`configId must be unique for each API key configuration in the api-key plugin.`)}let n=t??{schema:Array.isArray(e)?void 0:e?.schema},r=[...(Array.isArray(e)?e:[e]).map(e=>({...e,apiKeyHeaders:e?.apiKeyHeaders??`x-api-key`,defaultKeyLength:e?.defaultKeyLength||64,maximumPrefixLength:e?.maximumPrefixLength??32,minimumPrefixLength:e?.minimumPrefixLength??1,maximumNameLength:e?.maximumNameLength??32,minimumNameLength:e?.minimumNameLength??1,enableMetadata:e?.enableMetadata??!1,disableKeyHashing:e?.disableKeyHashing??!1,requireName:e?.requireName??!1,storage:e?.storage??`database`,rateLimit:{enabled:e?.rateLimit?.enabled===void 0||e?.rateLimit?.enabled,timeWindow:e?.rateLimit?.timeWindow??864e5,maxRequests:e?.rateLimit?.maxRequests??10},keyExpiration:{defaultExpiresIn:e?.keyExpiration?.defaultExpiresIn??null,disableCustomExpiresTime:e?.keyExpiration?.disableCustomExpiresTime??!1,maxExpiresIn:e?.keyExpiration?.maxExpiresIn??365,minExpiresIn:e?.keyExpiration?.minExpiresIn??1},startingCharactersConfig:{shouldStore:e?.startingCharactersConfig?.shouldStore??!0,charactersLength:e?.startingCharactersConfig?.charactersLength??6},enableSessionForAPIKeys:e?.enableSessionForAPIKeys??!1,fallbackToDatabase:e?.fallbackToDatabase??!1,customStorage:e?.customStorage,deferUpdates:e?.deferUpdates??!1}))],i=bz(D0({defaultRateLimitMax:(r.length===1?r[0]?.rateLimit.maxRequests:void 0)??10,defaultTimeWindow:(r.length===1?r[0]?.rateLimit.timeWindow:void 0)??864e5}),n.schema),a=async e=>{let t=AU(e.length,`a-z`,`A-Z`);return`${e.prefix||``}${t}`};function o(e,t){if(t.customAPIKeyGetter)return t.customAPIKeyGetter(e);if(Array.isArray(t.apiKeyHeaders)){for(let n of t.apiKeyHeaders){let t=e.headers?.get(n);if(t)return t}return null}return e.headers?.get(t.apiKeyHeaders)??null}function s(e){for(let t of r){if(!t.enableSessionForAPIKeys)continue;let n=o(e,t);if(n)return{key:n,config:t}}return null}let u=E0({defaultKeyGenerator:a,configurations:r,schema:i});return{id:`api-key`,version:`1.7.5`,$ERROR_CODES:X,hooks:{before:[{matcher:e=>!!s(e),handler:gL(async e=>{let{key:t,config:n}=s(e);if(typeof t!=`string`)throw c.from(`BAD_REQUEST`,X.INVALID_API_KEY_GETTER_RETURN_TYPE);if(t.length<n.defaultKeyLength||n.customAPIKeyValidator&&!await n.customAPIKeyValidator({ctx:e,key:t}))throw c.from(`FORBIDDEN`,X.INVALID_API_KEY);let{apiKey:a}=await p0({key:t,ctx:e,lookupOpts:n,configurations:r,schema:i,expectedConfigId:n.configId}),o=T0(e.context).catch(t=>{e.context.logger.error(`Failed to delete expired API keys:`,t)});if(n.deferUpdates&&e.context.runInBackground(o),(n.references??`user`)!==`user`){let e=X.INVALID_REFERENCE_ID_FROM_API_KEY;throw c.from(`UNAUTHORIZED`,e)}let l=await e.context.internalAdapter.findUserById(a.referenceId);if(!l){let e=X.INVALID_REFERENCE_ID_FROM_API_KEY;throw c.from(`UNAUTHORIZED`,e)}let u={user:l,session:{id:a.id,token:t,userId:a.referenceId,userAgent:e.request?.headers.get(`user-agent`)??null,ipAddress:e.request?wR(e.request,e.context.options):null,createdAt:/* @__PURE__ */ new Date,updatedAt:/* @__PURE__ */ new Date,expiresAt:a.expiresAt||Q1(e.context.options.session?.expiresIn||604800,`ms`)}};return e.context.session=u,e.path===`/get-session`?u:{context:e}})}]},endpoints:{createApiKey:u.createApiKey,verifyApiKey:u.verifyApiKey,getApiKey:u.getApiKey,updateApiKey:u.updateApiKey,deleteApiKey:u.deleteApiKey,listApiKeys:u.listApiKeys,deleteAllExpiredApiKeys:u.deleteAllExpiredApiKeys},schema:i}}const j0=(e,t)=>({getAllKeys:async n=>t?.adapter?.getJwks?await t.adapter.getJwks(n):await(await GR(e)).findMany({model:`jwks`}),getLatestKey:async n=>{let r=/* @__PURE__ */ new Date,i=e=>!e.expiresAt||e.expiresAt>r;return t?.adapter?.getJwks?(await t.adapter.getJwks(n))?.filter(i).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]:(await(await GR(e)).findMany({model:`jwks`}))?.filter(i).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]},getKeyById:async(n,r)=>t?.adapter?.getJwks?(await t.adapter.getJwks(n))?.find(e=>e.id===r):await(await GR(e)).findOne({model:`jwks`,where:[{field:`id`,value:r}]})??void 0,getLatestKeyByAlg:async(n,r)=>{let i=t?.adapter?.getJwks?await t.adapter.getJwks(n):await(await GR(e)).findMany({model:`jwks`});if(!i)return;let a=t?.jwks?.keyPairConfig?.alg??`EdDSA`,o=/* @__PURE__ */ new Date;return i.filter(e=>e.alg===r||e.alg==null&&a===r).filter(e=>!e.expiresAt||e.expiresAt>o).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]},createJwk:async(n,r)=>t?.adapter?.createJwk?await t.adapter.createJwk(r,n):await(await GR(e)).create({model:`jwks`,data:{...r,createdAt:/* @__PURE__ */ new Date}})});function M0(e,t){return typeof e==`number`?e:e instanceof Date?Math.floor(e.getTime()/1e3):t+YV(e)}async function N0(e){let{alg:t,...n}=e?.jwks?.keyPairConfig??{alg:`EdDSA`,crv:`Ed25519`},{publicKey:r,privateKey:i}=await It(t,{...n,extractable:!0});return{publicWebKey:await Et(r),privateWebKey:await Et(i),alg:t,cfg:n}}async function P0(e,t){let{publicWebKey:n,privateWebKey:r,alg:i,cfg:a}=await N0(t),o=a&&`crv`in a?a.crv:void 0,s=typeof n.crv==`string`?n.crv:void 0,c=o??s,l=JSON.stringify(r),u=!t?.jwks?.disablePrivateKeyEncryption,d={alg:i,...c?{crv:c}:{},publicKey:JSON.stringify(n),privateKey:u?JSON.stringify(await IW({key:e.context.secretConfig,data:l})):l,createdAt:/* @__PURE__ */ new Date,...t?.jwks?.rotationInterval?{expiresAt:new Date(Date.now()+t.jwks.rotationInterval*1e3)}:{}};return await j0(e.context.adapter,t).createJwk(e,d)}async function F0(e,t,n){if(t?.jwt?.sign)return null;let r=j0(e.context.adapter,t),i;if(n?.signingKeyId!==void 0){if(i=await r.getKeyById(e,n.signingKeyId),!i)throw new l(`signJWT: signingKeyId "${n.signingKeyId}" not found in JWKS. The key must be provisioned before it can be referenced.`);if(n.signingAlgorithm!==void 0){let e=t?.jwks?.keyPairConfig?.alg??`EdDSA`;if((i.alg??e)!==n.signingAlgorithm)throw new l(`signJWT: signingKeyId "${n.signingKeyId}" has alg "${i.alg??`unset (inherits keyPairConfig.alg "${e}")`}" but signingAlgorithm was set to "${n.signingAlgorithm}".`)}}else if(n?.signingAlgorithm!==void 0){if(i=await r.getLatestKeyByAlg(e,n.signingAlgorithm),!i){let r=t?.jwks?.keyPairConfig?.alg??`EdDSA`,a=t?.jwks?.keyPairConfigs?.find(e=>e.alg===n.signingAlgorithm),o=r===n.signingAlgorithm;if(a||o)i=await P0(e,{...t,jwks:{...t?.jwks,keyPairConfig:a??t?.jwks?.keyPairConfig}});else{let e=t?.jwks?.keyPairConfigs?.map(e=>e.alg).join(`, `)||`none`;throw new l(`signJWT: no key with alg "${n.signingAlgorithm}" found in JWKS. The plugin auto-mints only one key matching keyPairConfig.alg="${r}"; additional algs configured via keyPairConfigs: ${e}. Add "${n.signingAlgorithm}" to jwks.keyPairConfigs so the plugin provisions it on first use, or mint the key explicitly via createJwk().`)}}}else{let n=t?.jwks?.keyPairConfig?.alg??`EdDSA`;i=await r.getLatestKeyByAlg(e,n)??await r.getLatestKey(e)}if(!i||i.expiresAt&&i.expiresAt</* @__PURE__ */ new Date){if(n?.signingKeyId!==void 0||n?.signingAlgorithm!==void 0)throw new l(`signJWT: requested signing key is expired and an explicit kid/alg was provided; not auto-minting a replacement. Rotate the key explicitly.`);i=await P0(e,t)}let a=t?.jwks?.disablePrivateKeyEncryption?i.privateKey:await LW({key:e.context.secretConfig,data:JSON.parse(i.privateKey)}).catch(()=>{throw new l(`Failed to decrypt private key. Make sure the secret currently in use is the same as the one used to encrypt the private key. If you are using a different secret, either clean up your JWKS or disable private key encryption.`)}),o=i.alg??t?.jwks?.keyPairConfig?.alg??`EdDSA`,s=await dV(JSON.parse(a),o);return{alg:o,kid:i.id,privateKey:s}}async function I0(e,t){let{options:n}=t,r=t.payload,i=Math.floor(Date.now()/1e3),a=r.iat,o=r.exp,s=M0(n?.jwt?.expirationTime??`15m`,a??i);o??=s;let c=r.nbf,l=typeof e.context.options.baseURL==`string`?e.context.options.baseURL:``,u=r.iss,d=n?.jwt?.issuer??l,f=r.aud,p=n?.jwt?.audience??l;if(n?.jwt?.sign){let e={...r,iat:a,exp:o,nbf:c,iss:u??d,aud:f??p};return n.jwt.sign(e,t.header,{signingKeyId:t.signingKeyId,signingAlgorithm:t.signingAlgorithm})}let{alg:m,kid:h,privateKey:g}=t.resolvedKey??await F0(e,n,{signingKeyId:t.signingKeyId,signingAlgorithm:t.signingAlgorithm}),_=new xt(r).setProtectedHeader({...t.header,alg:m,kid:h}).setExpirationTime(o).setIssuer(u??d).setAudience(f??p);return a&&_.setIssuedAt(a),r.sub&&_.setSubject(r.sub),r.nbf&&_.setNotBefore(r.nbf),r.jti&&_.setJti(r.jti),await _.sign(g)}async function L0(e,t){let n=t?.jwt?.definePayload?await t.jwt.definePayload(e.context.session):e.context.session.user;return await I0(e,{options:t,payload:{iat:Math.floor(Date.now()/1e3),...n,sub:await t?.jwt?.getSubject?.(e.context.session)??e.context.session.user.id}})}function R0(e){let t=e.context.options.baseURL;return typeof t==`string`?t||`better-auth:session-cache`:e.context.baseURL||`better-auth:session-cache`}async function z0(e,t,n){let r=fV(t),i=r.kid;if(!i)return e.context.logger.debug(`Cookie-cache JWT missing kid in header`),null;let a=await j0(e.context.adapter,n).getAllKeys(e);if(!a?.length)return e.context.logger.debug(`No JWKS keys available for cookie-cache JWT`),null;let o=a.find(e=>e.id===i);if(!o)return e.context.logger.debug(`No JWKS key found for cookie-cache JWT kid: ${i}`),null;let s=o.alg??n?.jwks?.keyPairConfig?.alg??r.alg;return s?{alg:s,publicKey:await dV(JSON.parse(o.publicKey),s)}:(e.context.logger.debug(`No JWT algorithm available for cookie-cache JWT kid: ${i}`),null)}async function B0(e,t,n,r){let i=await F0(e,r);if(!i)throw new l("`jwt({ sessionCookieCache: true })` requires locally managed JWT plugin keys and does not support `jwt.sign`.");return await new xt({...t,sid:t.session.token}).setProtectedHeader({alg:i.alg,kid:i.kid,typ:`better-auth.session-cache+jwt`}).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+n).setIssuer(R0(e)).setAudience(`better-auth:session-cache`).setSubject(t.user.id).sign(i.privateKey)}async function V0(e,t,n){try{if(fV(t).typ!==`better-auth.session-cache+jwt`)return null;let r=await z0(e,t,n);if(!r)return null;let{payload:i}=await JB(t,r.publicKey,{...eH({issuer:R0(e)}),algorithms:[r.alg]}),a=tH(i);return a?{payload:a,expiresAt:a.exp?a.exp*1e3:Date.now()}:null}catch(t){return e.context.logger.debug(`Cookie-cache JWT verification failed`,t),null}}function H0(e){return{sign:(t,n,r)=>B0(t,n,r,e),verify:(t,n)=>V0(t,n,e)}}const gce={jwks:{fields:{publicKey:{type:`string`,required:!0},privateKey:{type:`string`,required:!0},createdAt:{type:`date`,required:!0},expiresAt:{type:`date`,required:!1},alg:{type:`string`,required:!1},crv:{type:`string`,required:!1}}}};async function _ce(e,t){let n=dL();try{let r=e.split(`.`);if(r.length!==3)return null;let i=new TextDecoder().decode(aH.decode(r[0])),a=JSON.parse(i).kid;if(!a)return n.context.logger.debug(`JWT missing kid in header`),null;let o=await j0(n.context.adapter,t).getAllKeys(n);if(!o||o.length===0)return n.context.logger.debug(`No JWKS keys available`),null;let s=o.find(e=>e.id===a);if(!s)return n.context.logger.debug(`No JWKS key found for kid: ${a}`),null;let c=await dV(JSON.parse(s.publicKey),s.alg??t?.jwks?.keyPairConfig?.alg??`EdDSA`),l=typeof n.context.options.baseURL==`string`?n.context.options.baseURL:void 0,{payload:u}=await JB(e,c,{issuer:t?.jwt?.issuer??l,audience:t?.jwt?.audience??l});return!u.sub||!u.aud?null:u}catch(e){return n.context.logger.debug(`JWT verification failed`,e),null}}const vce=D({payload:g(f(),ie()),overrideOptions:g(f(),ie()).optional()}),yce=D({token:f(),issuer:f().optional()}),bce=e=>{if(e?.jwt?.sign&&!e.jwks?.remoteUrl)throw new l(`options.jwks.remoteUrl must be set when using options.jwt.sign`);if(e?.jwks?.remoteUrl&&!e.jwks?.keyPairConfig?.alg)throw new l(`options.jwks.keyPairConfig.alg must be specified when options.jwks.remoteUrl is used for OpenID metadata`);let t=e?.jwks?.jwksPath??`/jwks`;if(typeof t!=`string`||t.length===0||!t.startsWith(`/`)||t.includes(`..`))throw new l(`options.jwks.jwksPath must be a non-empty string starting with '/' and not contain '..'`);return{id:`jwt`,version:`1.7.5`,options:e,init(t){if(!e?.sessionCookieCache)return;if(t.options.session?.cookieCache?.strategy!==`jwt`)throw new l('`jwt({ sessionCookieCache: true })` requires `session.cookieCache.strategy = "jwt"`.');if(e.jwt?.sign)throw new l("`jwt({ sessionCookieCache: true })` requires locally managed JWT plugin keys and does not support `jwt.sign`.");let n=e.jwks?.gracePeriod,r=t.options.session.cookieCache.maxAge||300;return n!==void 0&&r>n&&t.logger.warn(`[better-auth] \`session.cookieCache.maxAge\` (${r}s) exceeds the JWT plugin JWKS grace period (${n}s). Rotated keys may stop verifying cookie-cache JWTs before the cookie expires.`),{context:{sessionConfig:{...t.sessionConfig,cookieCacheSigner:H0(e)}}}},endpoints:{getJwks:Y(t,{method:`GET`,metadata:{openapi:{operationId:`getJSONWebKeySet`,description:`Get the JSON Web Key Set`,responses:{200:{description:`JSON Web Key Set retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{keys:{type:`array`,description:`Array of public JSON Web Keys`,items:{type:`object`,properties:{kid:{type:`string`,description:`Key ID uniquely identifying the key, corresponds to the 'id' from the stored Jwk`},kty:{type:`string`,description:`Key type (e.g., 'RSA', 'EC', 'OKP')`},alg:{type:`string`,description:`Algorithm intended for use with the key (e.g., 'EdDSA', 'RS256')`},use:{type:`string`,description:`Intended use of the public key (e.g., 'sig' for signature)`,enum:[`sig`],nullable:!0},n:{type:`string`,description:`Modulus for RSA keys (base64url-encoded)`,nullable:!0},e:{type:`string`,description:`Exponent for RSA keys (base64url-encoded)`,nullable:!0},crv:{type:`string`,description:`Curve name for elliptic curve keys (e.g., 'Ed25519', 'P-256')`,nullable:!0},x:{type:`string`,description:`X coordinate for elliptic curve keys (base64url-encoded)`,nullable:!0},y:{type:`string`,description:`Y coordinate for elliptic curve keys (base64url-encoded)`,nullable:!0}},required:[`kid`,`kty`,`alg`]}}},required:[`keys`]}}}}}}}},async t=>{if(e?.jwks?.remoteUrl)throw new c(`NOT_FOUND`);let n=j0(t.context.adapter,e),r=await n.getAllKeys(t);if((!r||r?.length===0)&&(await P0(t,e),r=await n.getAllKeys(t)),!r?.length)throw new l(`No key sets found. Make sure you have a key in your database.`);let i=Date.now(),a=(e?.jwks?.gracePeriod??2592e3)*1e3,o=r.filter(e=>!e.expiresAt||e.expiresAt.getTime()+a>i),s=e?.jwks?.keyPairConfig,u=s&&`crv`in s?s.crv:void 0;return t.json({keys:o.map(t=>({alg:t.alg??e?.jwks?.keyPairConfig?.alg??`EdDSA`,crv:t.crv??u,...JSON.parse(t.publicKey),kid:t.id}))})}),getToken:Y(`/token`,{method:`GET`,requireHeaders:!0,use:[TH],metadata:{openapi:{operationId:`getJSONWebToken`,description:`Get a JWT token`,responses:{200:{description:`Success`,content:{"application/json":{schema:{type:`object`,properties:{token:{type:`string`}}}}}}}}}},async t=>{let n=await L0(t,e);return t.json({token:n})}),signJWT:Y.serverOnly({method:`POST`,metadata:{$Infer:{body:{}}},body:vce},async t=>{let n=await I0(t,{options:{...e,...t.body.overrideOptions},payload:t.body.payload});return t.json({token:n})}),verifyJWT:Y.serverOnly({method:`POST`,metadata:{$Infer:{body:{},response:{}}},body:yce},async t=>{let n=t.body.issuer?{...e,jwt:{...e?.jwt,issuer:t.body.issuer}}:e,r=await _ce(t.body.token,n);return t.json({payload:r})})},hooks:{after:[{matcher(e){return e.path===`/get-session`},handler:gL(async t=>{if(e?.disableSettingJwtHeader)return;let n=t.context.session||t.context.newSession;if(n&&n.session){let n=await L0(t,e),r=t.context.responseHeaders?.get(`access-control-expose-headers`)||``,i=new Set(r.split(`,`).map(e=>e.trim()).filter(Boolean));i.add(`set-auth-jwt`),t.setHeader(`set-auth-jwt`,n),t.setHeader(`Access-Control-Expose-Headers`,Array.from(i).join(`, `))}})}]},schema:bz(gce,e?.schema)}};var U0=Object.defineProperty,W0=(e,t)=>{let n={};for(var r in e)U0(n,r,{get:e[r],enumerable:!0});return t||U0(n,Symbol.toStringTag,{value:`Module`}),n};const G0=`ba_iat`,K0=`ba_pl`,q0=`ba_param`;function J0(e){let t=new URLSearchParams,n=[...e.entries()].sort(([e,t],[n,r])=>e<n?-1:e>n?1:t<r?-1:+(t>r));for(let[e,r]of n)t.append(e,r);return t}function xce(e){e.delete(q0);let t=[.../* @__PURE__ */ new Set([...e.keys(),q0])].sort();for(let n of t)e.append(q0,n)}function Sce(e){let t=new URLSearchParams(e).get(G0);if(!t)return null;let n=Number(t);return!Number.isFinite(n)||n<=0?null:new Date(n)}const Cce=[`authorization_code`,`client_credentials`,`refresh_token`],Y0=[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],wce=[`none`,...Y0],Tce=new Set(wce);function X0(e,t){if(!(t.trim().length>0))throw new l(`OAuth Provider extension ${e} cannot be empty`)}function Z0(e,t){X0(e,t);let n;try{n=new URL(t)}catch{n=void 0}if(!n?.protocol)throw new l(`OAuth Provider extension ${e} must be an absolute URI: ${t}`)}function Ece(e){Z0(`grant type`,e)}function Dce(e){if(X0(`token_endpoint_auth_method`,e),Tce.has(e))throw new l(`OAuth Provider extension token_endpoint_auth_method is reserved: ${e}`)}function Oce(e){if(Z0(`client_assertion_type`,e),e===`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)throw new l(`OAuth Provider extension client_assertion_type is reserved: ${e}`)}function kce(e){let t=Object.keys(e.grants??{});for(let e of t)Ece(e);let n=[],r=[];for(let[t,i]of Object.entries(e.clientAuthentication??{})){Dce(t),n.push(t);let e=i.assertionTypes??[t];if(e.length===0)throw new l(`OAuth Provider extension client_assertion_type list cannot be empty for ${t}`);for(let t of e)Oce(t),r.push(t)}let i=(e.clientDiscovery?Array.isArray(e.clientDiscovery)?e.clientDiscovery:[e.clientDiscovery]:[]).map(e=>e.id);for(let e of i)X0(`client discovery id`,e);return{grantTypes:t,authMethods:n,assertionTypes:r,clientDiscoveryIds:i}}function Q0(e,t){let n=/* @__PURE__ */ new Set;for(let r of t){if(n.has(r))throw new l(`OAuth Provider extensions register ${e} "${r}" more than once. Extension contributions must be disjoint.`);n.add(r)}}function $0(e){let t=(e??[]).map(kce);Q0(`grant type`,t.flatMap(e=>e.grantTypes)),Q0(`token_endpoint_auth_method`,t.flatMap(e=>e.authMethods)),Q0(`client_assertion_type`,t.flatMap(e=>e.assertionTypes)),Q0(`client discovery id`,t.flatMap(e=>e.clientDiscoveryIds))}function e2(e){return e.extensions??[]}function t2(e){return e2(e).flatMap(e=>{let t=e.clientDiscovery;return t?Array.isArray(t)?t:[t]:[]})}function Ace(e,t){let n=e.getPlugin(`oauth-provider`);if(!n)throw new l(`extendOAuthProvider requires the oauth-provider plugin.`);let r=n.options.extensions??[];if(r.includes(t))return;let i=[...r,t];$0(i),n.options.extensions=i}function jce(e){return e2(e).flatMap(e=>Object.keys(e.grants??{}))}function n2(e){return Array.from(/* @__PURE__ */ new Set([...e.grantTypes??Cce,...jce(e)]))}function Mce(e,t){for(let n of e2(e)){let e=n.grants?.[t];if(e)return e}}function r2(e){return e2(e).flatMap(e=>Object.keys(e.clientAuthentication??{}))}function i2(e,t){return Array.from(/* @__PURE__ */ new Set([...t?.includeNone?[`none`]:[],...Y0,...r2(e)]))}function a2(e,t){return t?r2(e).includes(t):!1}function Nce(e,t){if(t!==`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)for(let n of e2(e)){let e=n.clientAuthentication??{};for(let[n,r]of Object.entries(e))if((r.assertionTypes??[n]).includes(t))return{method:n,strategy:r}}}function o2(e,t,n,r){let i={...r};for(let a of e2(t)){let o=a.metadata?.({ctx:e,opts:t,type:n,document:r});for(let[e,t]of Object.entries(o??{}))e in i||(i[e]=t)}return i}async function s2(e,t){let n={};for(let r of e2(e)){let e=await t(r)??{};for(let[t,r]of Object.entries(e)){if(t in n){O.warn(`oauth-provider: two extensions contributed the claim "${t}"; keeping the first-registered value.`);continue}n[t]=r}}return n}function Pce(e,t){return s2(e,e=>e.claims?.accessToken?.(t))}function Fce(e,t){return s2(e,e=>e.claims?.idToken?.(t))}function Ice(e,t){return s2(e,e=>e.claims?.userInfo?.(t))}function Lce(e){return e2(e).some(e=>e.claims?.userInfo)}function Rce(e){if(!e)return;let[t,n,...r]=e.trim().split(/\s+/);if(t?.toLowerCase()===`bearer`){if(!n||r.length>0)throw new d(`BAD_REQUEST`,{error:`invalid_request`,error_description:`Malformed Bearer Authorization header`});return n}}function zce(){let e=/* @__PURE__ */ new Map;return{get(t){let n=e.get(t);if(n){if(n.expiresAt&&n.expiresAt</* @__PURE__ */ new Date){e.delete(t);return}return n}},set(t,n){e.set(t,n)}}}const c2=e=>{let t=e.getPlugin(`jwt`);if(!t)throw new l(`jwt_config`);return t};function l2(e){if(e!=null){if(e instanceof Date)return Number.isFinite(e.getTime())?e:void 0;if(typeof e==`number`){if(!Number.isFinite(e))return;let t=new Date(e);return Number.isFinite(t.getTime())?t:void 0}if(typeof e==`string`){let t=e.trim();if(!t.length)return;let n=Number(t);if(Number.isFinite(n)){let e=new Date(n);return Number.isFinite(e.getTime())?e:void 0}let r=new Date(t);return Number.isFinite(r.getTime())?r:void 0}}}function Bce(e){if(e instanceof Date||!e||typeof e!=`object`)return l2(e);let t=l2(e.createdAt)??l2(e.created_at);if(t)return t;let n=e.session;if(n&&typeof n==`object`)return l2(n.createdAt)??l2(n.created_at)}function u2(e){if(typeof e==`string`)return[e];if(e?.length)return e}function d2(e){if(typeof e==`string`)return e;if(e?.length)return e.length===1?e.at(0):e}const f2=/* @__PURE__ */ new WeakMap;function Vce(e){let t=f2.get(e);if(t)return t;let n=zce();return f2.set(e,n),n}async function p2(e,t){let n=new URLSearchParams(e),r=n.get(`sig`),i=n.getAll(`sig`),a=Number(n.get(`exp`));n.delete(`sig`);let o=await zW(J0(n).toString(),t);return i.length===1&&!!r&&CU(r,o)&&/* @__PURE__ */ new Date(a*1e3)>=/* @__PURE__ */ new Date}async function m2(e,t,n){let r=Vce(t),i=r.get(n);if(i&&!i.clientDiscoveryId)return Object.assign({},i);let a=await e.context.adapter.findOne({model:t.schema?.oauthClient?.modelName??`oauthClient`,where:[{field:`clientId`,value:n}]}),o=t2(t);if(a?.clientDiscoveryId){let t=a.clientDiscoveryId,r=o.find(e=>e.id===t);if(!r?.matches(n)||(a=await r.resolve(e,n,a),!a))return null}else if(a)return t.cachedTrustedClients?.has(n)&&r.set(n,Object.assign({},a)),a;else for(let t of o){if(!t.matches(n))continue;let r=await t.resolve(e,n,null);if(r){a=r;break}}return a}function h2(e){return e.reduce((e,t)=>({...e,...t.discoveryMetadata??{}}),{})}const g2=async e=>{let t=await PH(`SHA-256`).digest(new TextEncoder().encode(e));return oH.encode(new Uint8Array(t),{padding:!1})};async function _2(e,t,n){if(t===`encrypted`)return await LW({key:e.context.secretConfig,data:n});if(typeof t==`object`&&`decrypt`in t)return await t.decrypt(n);throw new l(`Unsupported decryption storageMethod type '${t}'`)}async function Hce(e,t,n,r){let i=t.storeClientSecret??(t.disableJwtPlugin?`encrypted`:`hashed`);if(r&&t.prefix?.clientSecret){if(r.startsWith(t.prefix?.clientSecret))r=r.replace(t.prefix.clientSecret,``);else throw new d(`UNAUTHORIZED`,{error_description:`invalid client_secret`,error:`invalid_client`})}if(i===`hashed`){let e=r?await g2(r):void 0;return!!e&&CU(e,n)}if(typeof i==`object`&&`hash`in i){if(i.verify)return!!r&&await i.verify(r,n);{let e=r?await i.hash(r):void 0;return!!e&&CU(e,n)}}if(i===`encrypted`)try{let t=await _2(e,i,n);return!!r&&CU(t,r)}catch{return!1}if(typeof i==`object`&&`decrypt`in i){let t=await _2(e,i,n);return!!r&&CU(t,r)}throw new l(`Unsupported verify storageMethod type '${i}'`)}async function v2(e,t,n){let r=t.storeClientSecret??(t.disableJwtPlugin?`encrypted`:`hashed`);if(r===`encrypted`)return await IW({key:e.context.secretConfig,data:n});if(r===`hashed`)return await g2(n);if(typeof r==`object`&&`hash`in r)return await r.hash(n);if(typeof r==`object`&&`encrypt`in r)return await r.encrypt(n);throw new l(`Unsupported storeClientSecret type '${r}'`)}async function y2(e=`hashed`,t,n){if(e===`hashed`)return await g2(t);if(typeof e==`object`&&`hash`in e)return await e.hash(t,n);throw new l(`storeToken: unsupported storageMethod type '${e}'`)}async function b2(e=`hashed`,t,n){if(e===`hashed`)return await g2(t);if(typeof e==`object`&&`hash`in e)return await e.hash(t,n);throw new l(`getStoredToken: unsupported storageMethod type '${e}'`)}const x2=/^Basic +/i,Uce=/^([!#$%&'*+\-.^_`|~0-9A-Za-z]+)(?=\s|$)/;function Wce(e){return e.match(Uce)?.[1]}const S2=[`client_secret`,`client_assertion`,`client_assertion_type`];function C2(e){throw new d(`BAD_REQUEST`,{error:`invalid_request`,error_description:e})}async function Gce(e,t={}){let n;t.client_id!==void 0&&t.client_id!==``&&(typeof t.client_id!=`string`&&C2(`client_id must be a string`),n=t.client_id);let r={},i=(e,t)=>{t!==void 0&&t!==``&&(typeof t!=`string`&&C2(`${e} must be a string`),r[e]=t)};for(let e of S2)Object.hasOwn(t,e)&&i(e,t[e]);let a=!!e?.headers.get(`authorization`);if(e&&(e.headers.get(`content-type`)?.toLowerCase()??``).includes(`application/x-www-form-urlencoded`)){let t=new URLSearchParams(await e.clone().text()),r=t.getAll(`client_id`).filter(e=>e.length>0);r.length>1&&C2(`client_id must not be repeated`),n=r[0];for(let e of S2){let n=t.getAll(e).filter(e=>e.length>0);n.length>1&&C2(`${e} must not be repeated`),n.length===1&&i(e,n[0])}}let o=r.client_secret!==void 0,s=r.client_assertion!==void 0||r.client_assertion_type!==void 0;(a&&(o||s)||o&&s)&&C2(`A request must use only one client authentication method`),t.client_id=n;for(let e of S2)t[e]=r[e];return{detected:a||Object.keys(r).length>0}}function Kce(e){if(x2.test(e))try{let{clientId:t,clientSecret:n}=vG(e);return{client_id:t,client_secret:n}}catch{throw new d(`UNAUTHORIZED`,{error_description:`invalid authorization header format`,error:`invalid_client`},{"WWW-Authenticate":`Basic`})}}function w2(e,t){let n=e.grantTypes&&e.grantTypes.length>0?e.grantTypes:[`authorization_code`];return t===`refresh_token`&&n.includes(`authorization_code`)?!0:n.includes(t)}function qce(e,t){if(!t||!e.scopes)return;let n=new Set(e.scopes);for(let e of t)if(!n.has(e))throw new d(`BAD_REQUEST`,{error_description:`client does not allow scope ${e}`,error:`invalid_scope`})}function T2(e,t){let n=t?.method===`client_secret_basic`,r=t?.scheme??(n?`Basic`:void 0);throw new d(r?`UNAUTHORIZED`:`BAD_REQUEST`,{error_description:e,error:`invalid_client`},r?{"WWW-Authenticate":r}:void 0)}async function E2(e,t,n,r,i,a,o,s){let c=await m2(e,t,n);c||T2(`missing client`,{method:s}),c.disabled&&T2(`client is disabled`,{method:s});let l=c.tokenEndpointAuthMethod??`client_secret_basic`;if(s&&l!==s&&T2(`client registered for ${l} cannot use ${s}`,{method:s}),(c.tokenEndpointAuthMethod===`private_key_jwt`||a2(t,c.tokenEndpointAuthMethod))&&!a)throw new d(`BAD_REQUEST`,{error_description:`client registered for ${c.tokenEndpointAuthMethod} must use client_assertion`,error:`invalid_client`});if(a||(c.tokenEndpointAuthMethod!==`none`&&!r&&T2(`client secret must be provided`,{method:s}),r&&!c.clientSecret&&T2(`public client, client secret should not be received`,{method:s}),r&&!await Hce(e,t,c.clientSecret,r)&&T2(`invalid client_secret`,{method:s})),qce(c,i),o&&!w2(c,o))throw new d(`BAD_REQUEST`,{error_description:`client is not authorized to use grant type ${o}`,error:`unauthorized_client`});return c}function D2(e){if(e)return typeof e==`string`?JSON.parse(e):e}function O2(e){return{clientId:e?.clientId,clientSecret:e?.kind===`client_secret`?e.clientSecret:void 0,preVerified:e?.kind===`pre_verified`,authMethod:e?.method,confirmation:e?.kind===`pre_verified`?e.confirmation:void 0}}async function k2(e,t,n){let r={...e.body??{}};await Gce(e.request,r);let i=e.request?.headers.get(`authorization`)??void 0;if(r.client_assertion_type||r.client_assertion){if(!r.client_assertion||!r.client_assertion_type)throw new d(`BAD_REQUEST`,{error_description:`client_assertion and client_assertion_type must both be provided`,error:`invalid_client`});let i=r.client_assertion,a=r.client_assertion_type,o=Nce(t,a);if(o){let s=await o.strategy.authenticate({ctx:e,opts:t,assertion:i,assertionType:a,clientId:r.client_id,expectedAudience:n});return{kind:`pre_verified`,method:o.method,clientId:s.clientId,confirmation:s.confirmation}}let{verifyClientAssertion:s}=await Promise.resolve().then(()=>fue).then(e=>e.o);return{kind:`pre_verified`,method:`private_key_jwt`,clientId:(await s(e,t,i,a,r.client_id,n)).clientId}}if(i&&!x2.test(i)){let e=Wce(i);if(!e)throw new d(`BAD_REQUEST`,{error:`invalid_request`,error_description:`Invalid authorization header format`});T2(`unsupported authorization scheme`,{scheme:e})}if(i&&x2.test(i)){let e=Kce(i);if(e)return{kind:`client_secret`,method:`client_secret_basic`,clientId:e.client_id,clientSecret:e.client_secret}}return r.client_id&&r.client_secret?{kind:`client_secret`,method:`client_secret_post`,clientId:r.client_id,clientSecret:r.client_secret}:r.client_id?{kind:`public`,method:`none`,clientId:r.client_id}:null}function A2(e){let t=e.split(` `).map(e=>e.trim()),n=/* @__PURE__ */ new Set;for(let e of t)(e===`login`||e===`consent`||e===`create`||e===`select_account`||e===`none`)&&n.add(e);return new Set(n)}function Jce(e){let t=e.redirectUris?.[0];if(!t)throw new l(`Client has no redirect URIs for sector identifier`);return new URL(t).host}async function Yce(e,t,n){return zW(`${Jce(t)}.${e}`,n)}async function j2(e,t,n){return t.subjectType===`pairwise`&&n.pairwiseSecret?Yce(e,t,n.pairwiseSecret):e}function M2(e){let t=Object.create(null);for(let n of new Set(e.keys())){let r=e.getAll(n);t[n]=r.length===1?r[0]:r}return t}function N2(e,t){if(!t)return!1;let n=l2(e);return n?n.getTime()>=t.getTime():!1}function P2(e,t){let n=new URLSearchParams(e),r=n.get(`prompt`)?.split(` `),i=r?.findIndex(e=>e===t)??-1;return i>=0&&(r?.splice(i,1),r?.length?n.set(`prompt`,r.join(` `)):n.delete(`prompt`)),n}function F2(e){let t=new URLSearchParams(e);return t.delete(`max_age`),t}function I2(e,t){if(e.tokenEndpointAuthMethod===`none`)return`pkce is required for public clients`;let n=t?.scopes??[],r=n.includes(`openid`),i=typeof t?.nonce==`string`&&t.nonce.length>0,a=r&&i;return n.includes(`offline_access`)&&!a?`pkce or OIDC nonce is required when requesting offline_access scope`:e.requirePKCE??!0?`pkce is required for this client`:!1}const Xce=/^[a-z](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/i;function L2(e){let t=e.protocol.slice(0,-1),n=e.href.slice(e.protocol.length);return e.protocol!==`http:`&&e.protocol!==`https:`&&e.host.length===0&&n.startsWith(`/`)&&!n.startsWith(`//`)&&Xce.test(t)}const R2=p().superRefine((e,t)=>{let n;try{n=new URL(e)}catch{return t.addIssue({code:`custom`,message:`URL must be parseable`,fatal:!0}),C}if(QL.includes(n.protocol)){t.addIssue({code:`custom`,message:`URL cannot use javascript:, data:, or vbscript: scheme`});return}e.includes(`#`)&&t.addIssue({code:`custom`,message:`Redirect URI must not contain a fragment component`}),n.protocol===`http:`&&!sU(n.host)&&t.addIssue({code:`custom`,message:`Redirect URI must use HTTPS (HTTP allowed only for loopback hosts)`})}),Zce=/* @__PURE__ */ new Set([`iss`,`sub`,`aud`,`exp`,`nbf`,`iat`,`jti`,`auth_time`,`nonce`,`acr`,`amr`,`azp`,`sid`,`at_hash`,`c_hash`,`s_hash`]);function z2(e){if(!e)return{};let t=[],n=Object.create(null);for(let[r,i]of Object.entries(e)){if(Zce.has(r)){t.push(r);continue}n[r]=i}return t.length>0&&O.warn(`oauth-provider: stripped reserved id-token claim name(s): ${t.join(`, `)}. The AS owns these claim values.`),n}const B2=g(f(),se()).nullable(),Qce=x({essential:T().optional(),value:f().optional(),values:_(f()).optional()}).nullable(),$ce=D({acr:Qce.optional()}).catchall(B2),ele=x({userinfo:g(f(),B2).optional(),id_token:$ce.optional()});function tle(e){if(typeof e==`string`)try{return JSON.parse(e)}catch{return}return e}function V2(e){let t=tle(e),n=ele.safeParse(t);return n.success?n.data:void 0}const H2=n([f(),g(f(),se())]),nle=H2,U2=H2.refine(e=>V2(e)!==void 0,{error:`claims must be a valid Claims request object`});function rle(e){return e===void 0||V2(e)!==void 0}function W2(e,t){let n=V2(e)?.userinfo;if(!n)return[];let r=Object.keys(n);if(!t)return r;let i=new Set(t);return r.filter(e=>i.has(e))}function ile(e,t){let n=V2(e);if(!n)return e===void 0;let r=n.id_token?.acr;if(!r||r.essential!==!0)return!0;let i=r.value===void 0||r.value===t,a=r.values===void 0||r.values.includes(t);return i&&a}function ale(e,t){let n=V2(e);if(!n)return;let r=new Set(t),i=Object.fromEntries(Object.entries(n.userinfo??{}).filter(([e])=>r.has(e))),a=Object.keys(i).length?{...n,userinfo:i}:Object.fromEntries(Object.entries(n).filter(([e])=>e!==`userinfo`));return Object.keys(a).length?a:void 0}function G2(e){let t=e.split(` `).filter(e=>e!==``);return t.length<=1?{}:{given:t.slice(0,-1).join(` `),family:t.at(-1)}}const K2={name:{scope:`profile`,resolve:e=>e.name??void 0},picture:{scope:`profile`,resolve:e=>e.image??void 0},given_name:{scope:`profile`,resolve:e=>G2(e.name).given},family_name:{scope:`profile`,resolve:e=>G2(e.name).family},email:{scope:`email`,resolve:e=>e.email??void 0},email_verified:{scope:`email`,resolve:e=>e.emailVerified??!1}},q2=Object.keys(K2);function J2(e){return e.advertisedMetadata?.claims_supported??e.claims??[]}const ole=/* @__PURE__ */ new Set([`iss`,`sub`,`aud`,`exp`,`iat`,`jti`,`client_id`,`scope`,`auth_time`,`acr`,`amr`,`cnf`]);function sle(e){if(!e)return{};let t=[],n={};for(let[r,i]of Object.entries(e)){if(ole.has(r)){t.push(r);continue}n[r]=i}return t.length>0&&O.warn(`oauth-provider: stripped reserved access-token claim name(s): ${t.join(`, `)}. The AS owns these claim values.`),n}async function Y2(e){let{ctx:t,opts:n,user:r,client:i,scopes:a,resources:o,referenceId:s,metadata:c,grantType:l,sessionId:u,perRequestClaims:d,resourcePolicyClaims:f}=e,p=await Pce(n,{ctx:t,opts:n,user:r,client:i,scopes:a,grantType:l,referenceId:s,sessionId:u,resources:o,metadata:c}),m=n.customAccessTokenClaims?await n.customAccessTokenClaims({user:r,scopes:a,resources:o,referenceId:s,metadata:c}):{};return sle({...p,...d??{},...m,...f})}const X2=[`EdDSA`,`ES256`,`ES512`,`PS256`,`RS256`],cle=new Set(X2);async function Z2(e,t){let n=e.identifierValidator;if(n)return await n(t)?{ok:!0}:{ok:!1,reason:`resource identifier ${t} failed validation`};let r;try{r=new URL(t)}catch{return{ok:!1,reason:`resource identifier ${t} must be an absolute URI (RFC 8707 §2)`}}return r.hash?{ok:!1,reason:`resource identifier ${t} must not contain a URI fragment (RFC 8707 §2)`}:{ok:!0}}async function lle(e,t){let n=await Z2(e,t);if(!n.ok)throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:n.reason})}const ule=e=>`${e}/oauth2/userinfo`;async function dle(e){if(!(e.headers.get(`content-type`)?.toLowerCase()??``).includes(`application/x-www-form-urlencoded`))return;let t;try{t=await e.clone().text()}catch{return}if(!t)return;let n=new URLSearchParams(t).getAll(`resource`).filter(e=>e.length>0);return n.length>0?n:void 0}function fle(e){if(e!=null){if(typeof e==`string`)return[e];if(Array.isArray(e)){let t=e.filter(e=>typeof e==`string`&&e.length>0);return t.length>0?t:void 0}}}async function Q2(e,t,n,r=[]){if(n===void 0)return!0;let i=Array.isArray(n)?n:[n];if(i.length>64)return!1;let a=new Set(r),o=/* @__PURE__ */ new Set;for(let e of i)a.has(e)||o.add(e);return o.size===0||(await Promise.all(Array.from(o,n=>r4(e,t,n)))).every(Boolean)}async function $2(e,t,n){let r=fle(n.resource),i=n.requestedScopes.includes(`openid`),a=ule(e.context.baseURL??``);if(!r)return{audienceClaim:void 0,accessTokenTtl:null,refreshTokenTtl:null,signingAlgorithm:null,signingKeyId:null,rawCustomClaims:{},dpopBoundAccessTokensRequired:!1,effectiveScopes:[...n.requestedScopes]};let o=[...new Set(r)],s=[];for(let n of o){if(n===a)continue;let r=await r4(e,t,n);if(r){if(r.disabled)throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is disabled`});s.push(r);continue}throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is not configured`})}let{value:l}=e4(t);l&&s.length>0&&await ple(e,t,n.clientId,s);let u=[...n.requestedScopes];for(let e of s){if(e.allowedScopes===null||e.allowedScopes===void 0)continue;let t=new Set(e.allowedScopes),n=u.filter(e=>t.has(e));if(n.length===0)throw new c(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`none of the requested scopes are allowed for resource ${e.identifier}`});u=n}let d=null,f=null;for(let e of s)e.accessTokenTtl!=null&&(d=d===null?e.accessTokenTtl:Math.min(d,e.accessTokenTtl)),e.refreshTokenTtl!=null&&(f=f===null?e.refreshTokenTtl:Math.min(f,e.refreshTokenTtl));let p=/* @__PURE__ */ new Set,m=/* @__PURE__ */ new Set;for(let e of s)e.signingAlgorithm&&p.add(e.signingAlgorithm),e.signingKeyId&&m.add(e.signingKeyId);if(p.size>1)throw new c(`BAD_REQUEST`,{error:`invalid_request`,error_description:`multi-resource request has conflicting signingAlgorithm pins; a single JWS signature cannot satisfy multiple algorithms`});if(m.size>1)throw new c(`BAD_REQUEST`,{error:`invalid_request`,error_description:`multi-resource request has conflicting signingKeyId pins; a single JWS signature cannot satisfy multiple key ids`});let h=p.values().next().value??null,g=m.values().next().value??null,_={};for(let e of s)e.customClaims&&typeof e.customClaims==`object`&&Object.assign(_,e.customClaims);let v=s.some(e=>e.dpopBoundAccessTokensRequired===!0),y=i?[...o,a]:o,b=[...new Set(y)];return{audienceClaim:b.length===1?b[0]:b,accessTokenTtl:d,refreshTokenTtl:f,signingAlgorithm:h,signingKeyId:g,rawCustomClaims:_,dpopBoundAccessTokensRequired:v,effectiveScopes:u}}async function ple(e,t,n,r){if(r.length===0)return;let i=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,a=await e.context.adapter.findMany({model:i,where:[{field:`clientId`,value:n}]}),o=new Set(a?.map(e=>e.resourceId)??[]),s=r.filter(e=>!o.has(e.identifier));if(s.length>0)throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`client ${n} is not linked to resource(s) ${s.map(e=>e.identifier).join(`, `)}`})}async function mle(e,t,n,r){if(r.length===0)return!1;let i=t.schema?.oauthClientResource?.modelName??`oauthClientResource`;return((await e.context.adapter.findMany({model:i,where:[{field:`clientId`,value:n},{field:`resourceId`,operator:`in`,value:r}],limit:1}))?.length??0)>0}async function hle(e,t,n){if(n.length===0)return{};let r=await e.context.adapter.findMany({model:t.schema?.oauthResource?.modelName??`oauthResource`,where:[{field:`identifier`,operator:`in`,value:n}]}),i=new Map(r.map(e=>[e.identifier,e])),a={};for(let e of n){let t=i.get(e);t?.customClaims&&typeof t.customClaims==`object`&&Object.assign(a,t.customClaims)}return a}function e4(e){return e.enforcePerClientResources===void 0?{value:!0,source:`default`}:{value:e.enforcePerClientResources,source:`explicit`}}const t4=/* @__PURE__ */ new Map;function n4(e){if(e===void 0){t4.clear();return}t4.delete(e)}async function r4(e,t,n){if(await ble(e.context,t),t.cachedResources?.has(n)){let e=t4.get(n);if(e)return Object.assign({},e)}let r=await e.context.adapter.findOne({model:t.schema?.oauthResource?.modelName??`oauthResource`,where:[{field:`identifier`,value:n}]});return r&&t.cachedResources?.has(n)&&t4.set(n,Object.assign({},r)),r}function gle(e){return e.name??e.identifier}function _le(e){let t=[];if(e.resources?.length)for(let n of e.resources)t.push(typeof n==`string`?{identifier:n}:n);return t}function i4(e,t){return{identifier:e.identifier,name:gle(e),accessTokenTtl:e.accessTokenTtl??null,refreshTokenTtl:e.refreshTokenTtl??null,signingAlgorithm:e.signingAlgorithm??null,signingKeyId:e.signingKeyId??null,allowedScopes:e.allowedScopes??null,customClaims:e.customClaims??null,dpopBoundAccessTokensRequired:e.dpopBoundAccessTokensRequired??!1,disabled:e.disabled??!1,policyVersion:1,metadata:e.metadata??null,createdAt:t,updatedAt:t}}function vle(e,t,n){if(t===`overwrite`){let{identifier:t,createdAt:r,...i}=i4(e,n);return i}let r={updatedAt:n};return e.name!==void 0&&(r.name=e.name),e.accessTokenTtl!==void 0&&(r.accessTokenTtl=e.accessTokenTtl),e.refreshTokenTtl!==void 0&&(r.refreshTokenTtl=e.refreshTokenTtl),e.signingAlgorithm!==void 0&&(r.signingAlgorithm=e.signingAlgorithm),e.signingKeyId!==void 0&&(r.signingKeyId=e.signingKeyId),e.allowedScopes!==void 0&&(r.allowedScopes=e.allowedScopes),e.customClaims!==void 0&&(r.customClaims=e.customClaims),e.dpopBoundAccessTokensRequired!==void 0&&(r.dpopBoundAccessTokensRequired=e.dpopBoundAccessTokensRequired),e.disabled!==void 0&&(r.disabled=e.disabled),e.metadata!==void 0&&(r.metadata=e.metadata),r}const a4=/no such table|relation.*does not exist|table.*does(?: not|n[''']?t) exist/i;let o4=/* @__PURE__ */ new WeakMap;function yle(e){let t=e.adapter,n=o4.get(t);if(n)return n;let r={completed:!1,promise:null};return o4.set(t,r),r}async function s4(e,t){let n=_le(t);if(n.length===0)return;let r=t.resourceSeedMode??`insertOnly`,i=t.schema?.oauthResource?.modelName??`oauthResource`;for(let a of n){let n=await Z2(t,a.identifier);if(!n.ok){O.warn(`oauth-provider: skipping resource seed for ${a.identifier} — ${n.reason}`);continue}let o=a;if(o.signingAlgorithm!=null&&!cle.has(o.signingAlgorithm)){O.warn(`oauth-provider: dropping unsupported signingAlgorithm "${o.signingAlgorithm}" for resource ${o.identifier} — must be one of ${X2.join(`, `)}. Continuing without an algorithm override.`);let{signingAlgorithm:e,...t}=o;o=t}let s;try{s=await e.adapter.findOne({model:i,where:[{field:`identifier`,value:o.identifier}]})}catch(e){let t=e instanceof Error?e.message:String(e);if(a4.test(t)){O.debug(`oauth-provider: oauthResource table not yet created; deferring resource seed to first access.`);return}throw e}let c=/* @__PURE__ */ new Date;if(!s){try{await e.adapter.create({model:i,data:i4(o,c)})}catch(e){let t=e instanceof Error?e.message:String(e);if(/unique|duplicate|UNIQUE/i.test(t)){O.debug(`oauth-provider: resource ${o.identifier} already inserted by a concurrent process — skipping.`);continue}if(a4.test(t)){O.debug(`oauth-provider: oauthResource table not yet created; deferring resource seed to first access.`);return}throw e}continue}r!==`insertOnly`&&await e.adapter.update({model:i,where:[{field:`identifier`,value:o.identifier}],update:vle(o,r,c)})}}async function ble(e,t){let n=yle(e);if(n.completed!==!0)return n.promise===null&&(n.promise=s4(e,t).then(()=>{n.completed=!0}).catch(e=>{throw n.promise=null,e})),n.promise}function xle(e){let t=e4(e);O.info(`oauth-provider: enforcePerClientResources resolved to ${t.value} (${t.source})`)}function c4(e){return e.headers?.get(`dpop`)??void 0}function l4(e,t){return e.request?.url??`${e.context.baseURL}${t}`}const Sle=/* @__PURE__ */ new Set([`openid`,`profile`,`email`,`offline_access`]);function u4(e){return Sle.has(e)}function d4(e){return[...new Set(e.map(e=>e.trim()).filter(Boolean))]}function f4(e,t,n,r){if(e.length===0)return;if(!t.includes(`client_credentials`))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`client_credentials_scopes requires the client_credentials grant`});if(n===`none`)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`public clients cannot be assigned client_credentials scopes`});let i=new Set(r.scopes??[]),a=e.filter(e=>!i.has(e)||u4(e));if(a.length>0)throw new c(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`The following client_credentials scopes are invalid: ${a.join(`, `)}`})}const Cle=[`javascript:`,`data:`,`vbscript:`],p4=f().superRefine((e,t)=>{if(!URL.canParse(e))return t.addIssue({code:`custom`,message:`resource must be an absolute URI`,fatal:!0}),C;if(e.includes(`#`)){t.addIssue({code:`custom`,message:`resource must not contain a fragment`});return}Cle.includes(new URL(e).protocol)&&t.addIssue({code:`custom`,message:`resource cannot use javascript:, data:, or vbscript: scheme`})}),wle=E([`none`,`consent`,`login`,`create`,`select_account`]),Tle=f().superRefine((e,t)=>{let n=e.split(` `).map(e=>e.trim()).filter(Boolean),r=/* @__PURE__ */ new Set;if(!n.length){t.addIssue({code:`custom`,message:`prompt must include at least one value`});return}for(let e of n){let n=wle.safeParse(e);if(!n.success){t.addIssue({code:`custom`,message:`unsupported prompt value: ${e}`});continue}r.add(n.data)}r.has(`none`)&&r.size>1&&t.addIssue({code:`custom`,message:`prompt=none cannot be combined with other prompt values`})}),m4=D({keys:_(g(f(),se())).min(1)}),Ele=n([m(),f().trim().min(1)]).transform((e,t)=>{let n=typeof e==`number`?e:Number(e);return!Number.isInteger(n)||n<0?(t.addIssue({code:`custom`,message:`max_age must be a non-negative integer`}),C):n}),Dle=f().regex(/^[A-Za-z0-9_-]{43}$/,`dpop_jkt must be a base64url-encoded SHA-256 JWK thumbprint`),h4=D({response_type:f().pipe(E([`code`])).optional(),request:f().optional(),request_uri:f().optional(),redirect_uri:R2.optional(),scope:f().optional(),state:f().optional(),client_id:f().min(1,`client_id is required`),prompt:Tle.optional(),display:f().optional(),ui_locales:f().optional(),max_age:Ele.optional(),acr_values:f().optional(),login_hint:f().optional(),id_token_hint:f().optional(),code_challenge:f().optional(),code_challenge_method:f().pipe(E([`S256`])).optional(),nonce:f().optional(),claims:nle.optional(),dpop_jkt:Dle.optional(),resource:n([p4,_(p4).min(1)]).optional()}).passthrough(),Ole=h4.extend({redirect_uri:R2.optional(),claims:U2.optional()}),kle=D({type:ee(`authorization_code`),query:Ole,sessionId:f(),userId:f(),referenceId:f().optional(),authTime:m().optional(),resource:_(f()).optional()}).passthrough(),g4=D({redirect_uris:_(R2).min(1).optional(),scope:f().optional(),client_name:f().refine(e=>e.trim().length>0,`client_name cannot be empty`).optional(),client_uri:f().optional(),logo_uri:f().optional(),contacts:_(f().min(1)).min(1).optional(),tos_uri:f().optional(),policy_uri:f().optional(),software_id:f().optional(),software_version:f().optional(),software_statement:f().optional(),post_logout_redirect_uris:_(R2).min(1).optional(),backchannel_logout_uri:R2.optional(),backchannel_logout_session_required:T().optional(),token_endpoint_auth_method:f().trim().min(1).optional(),jwks:m4.optional(),jwks_uri:f().optional(),grant_types:_(f().trim().min(1)).min(1).optional(),response_types:_(E([`code`])).optional(),application_type:E([`web`,`native`]).optional(),subject_type:E([`public`,`pairwise`]).optional(),dpop_bound_access_tokens:T().optional(),resources:_(p4).optional(),skip_consent:b({error:`skip_consent cannot be set during dynamic client registration`}).optional()}),Ale=g4.omit({skip_consent:!0}).extend({client_id:f().refine(e=>e.trim().length>0,`client_id cannot be empty`),client_secret:f().optional(),client_secret_expires_at:m().int().nonnegative().optional(),client_id_issued_at:m().int().nonnegative().optional()}).loose();function jle(e,t,n=[]){let r=new Set(n),i={sub:e.id??void 0};for(let[n,a]of Object.entries(K2))(t.includes(a.scope)||r.has(n))&&(i[n]=a.resolve(e));return i}function _4(e,t){let n={};for(let[r,i]of Object.entries(e??{}))i!==void 0&&(t&&r in t||(n[r]=i));return n}function Mle(e){let t=e.headers?.get(`authorization`),n=xK(t),r=e.request?.method===`POST`?e.body?.access_token??void 0:void 0;if(n&&r)throw new c(`BAD_REQUEST`,{error_description:`Multiple access token transport methods are not allowed`,error:`invalid_request`});let i=n??(r?{scheme:`Bearer`,token:r}:void 0);return{authorization:i,token:i?.token}}async function Nle(e,t){let{authorization:n}=Mle(e);if(!n?.token)throw new c(`UNAUTHORIZED`,{error_description:`access token not found`,error:`invalid_request`});let{payload:r,requestedUserInfoClaims:i}=await z4(e,t,n.token);if(DK(r)&&!e.request)throw new c(`UNAUTHORIZED`,{error_description:`DPoP-bound access token requires an HTTP request context`,error:`invalid_token`});try{await LK({payload:r,authorization:n,proofJwt:c4(e),method:e.request?.method??`GET`,url:l4(e,`/oauth2/userinfo`),proofMaxAgeSeconds:t.dpop?.proofMaxAgeSeconds,signingAlgorithms:t.dpop?.signingAlgorithms,replayStore:vK(e.context.internalAdapter)})}catch(e){throw IK(e)?new c(`UNAUTHORIZED`,{error_description:e.message,error:e.code}):e}let a=r.scope?.split(` `);if(!a?.includes(`openid`))throw new c(`BAD_REQUEST`,{error_description:`Missing required scope`,error:`invalid_scope`});if(!r.sub)throw new c(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let o=await e.context.internalAdapter.findUserById(r.sub);if(!o)throw new c(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let s=jle(o,a??[],i),l=r.client_id??r.azp,u=l&&(t.pairwiseSecret||Lce(t))?await m2(e,t,l):void 0;t.pairwiseSecret&&u&&(s.sub=await j2(o.id,u,t));let d=a?.length?await Ice(t,{ctx:e,opts:t,user:o,scopes:a,jwt:r,client:u??void 0,requestedClaims:i}):{},f=t.customUserInfoClaims&&a?.length?await t.customUserInfoClaims({user:o,scopes:a,jwt:r,requestedClaims:i}):{};return{...s,..._4(d,s),..._4(f),sub:s.sub}}const Ple=Object.fromEntries(q2.map(e=>[e,void 0]));function v4(e){return EK(e)?`DPoP`:`Bearer`}async function Fle(e,t){let n=e.body.grant_type;if(!n2(t).includes(n))throw new c(`BAD_REQUEST`,{error_description:`unsupported grant_type ${n}`,error:`unsupported_grant_type`});switch(n){case`authorization_code`:return nue(e,t);case`client_credentials`:return rue(e,t);case`refresh_token`:return iue(e,t);default:{let r=Mce(t,n);if(r)return r({ctx:e,opts:t,grantType:n,provider:Ile(e,t,n)});throw new c(`BAD_REQUEST`,{error_description:`unsupported grant_type ${n}`,error:`unsupported_grant_type`})}}}function Ile(e,t,n){return{getClient:n=>m2(e,t,n),authenticateClient:async r=>{let{clientId:i,clientSecret:a,preVerified:o,authMethod:s,confirmation:l}=O2(await k2(e,t,`${e.context.baseURL}${e.path??`/oauth2/token`}`));if(!i)throw new c(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});if(r?.requireCredentials!==!1&&!a&&!o)throw new c(`BAD_REQUEST`,{error_description:`Missing required client credentials`,error:`invalid_client`});return{clientId:i,client:await E2(e,t,i,a,r?.scopes,o,n,s),method:s,confirmation:l}},issueTokens:r=>{if(!n)throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`issueTokens requires a grant type; pass it to getOAuthProviderApi(ctx, opts, grantType).`,error:`server_error`});return j4(e,t,{...r,grantType:n})},hashToken:(e,n)=>y2(t.storeTokens,e,n),validateAccessToken:async(n,r)=>{let{validateAccessToken:i}=await Promise.resolve().then(()=>M4);return i(e,t,n,r)},requireActiveAccessToken:async(n,r)=>{let{requireActiveAccessToken:i}=await Promise.resolve().then(()=>M4);return i(e,t,n,r)}}}async function Lle(e,t,n,r,i,a,o){let s=o?.iat??Math.floor(Date.now()/1e3),c=o?.exp??s+(t.accessTokenExpiresIn??3600),l=c2(e.context).options,u=n?.id??r.clientId;return I0(e,{options:l,header:{typ:`at+jwt`},signingKeyId:o?.signingKeyId??void 0,signingAlgorithm:o?.signingAlgorithm??void 0,payload:{...o?.accessTokenClaims??{},sub:u,aud:d2(i),client_id:r.clientId,azp:r.clientId,scope:a.join(` `),sid:o?.sid,iss:l?.jwt?.issuer??e.context.baseURL,iat:s,exp:c,jti:AU(32),...o?.confirmation?{cnf:o.confirmation}:{}}})}async function Rle(e,t){let n;n=t===`EdDSA`?`SHA-512`:t.endsWith(`384`)?`SHA-384`:t.endsWith(`512`)?`SHA-512`:`SHA-256`;let r=new Uint8Array(await crypto.subtle.digest(n,new TextEncoder().encode(e)));return ot(r.slice(0,r.length/2))}async function zle(e,t,n,r,i,a,o,s,l,u){let d=Math.floor(Date.now()/1e3),f=d+(t.idTokenExpiresIn??36e3),p=await j2(n.id,r,t),m=s==null?void 0:Math.floor(s.getTime()/1e3),h=z2(t.customIdTokenClaims?await t.customIdTokenClaims({user:n,scopes:i,metadata:D2(r.metadata)}):void 0),g=t.disableJwtPlugin?void 0:c2(e.context).options,_=!t.disableJwtPlugin&&!g?.jwt?.sign?await F0(e,g):void 0,v=t.disableJwtPlugin?`HS256`:_?.alg??g?.jwks?.keyPairConfig?.alg,y=l?await Rle(l,v):void 0,b=!!(r.enableEndSession||r.backchannelLogoutUri),x={...Ple,auth_time:m,acr:`0`,...h,at_hash:y,iss:g?.jwt?.issuer??e.context.baseURL,sub:p,aud:r.clientId,nonce:a,iat:d,exp:f,sid:b?o:void 0},S=z2(u);if(Object.assign(x,_4(S,x)),t.disableJwtPlugin&&!r.clientSecret)return;let C=t.disableJwtPlugin?await new xt(x).setProtectedHeader({alg:`HS256`}).sign(new TextEncoder().encode(await _2(e,t.storeClientSecret,r.clientSecret))):await I0(e,{options:g,payload:x,resolvedKey:_??void 0});if(C&&y&&g?.jwt?.sign){let e=fV(C);if(e.alg!==v)throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`ID token signed with "${e.alg}" but at_hash was computed for "${v}". Ensure jwt.sign uses the algorithm declared in keyPairConfig.alg.`,error:`server_error`})}return C}async function y4(e,t,n){return(e.prefix?.refreshToken??``)+(e.formatRefreshToken?.encrypt?e.formatRefreshToken.encrypt(t,n):t)}async function b4(e,t){if(e.prefix?.refreshToken){if(t.startsWith(e.prefix.refreshToken))t=t.replace(e.prefix.refreshToken,``);else throw new c(`BAD_REQUEST`,{error_description:`refresh token not found`,error:`invalid_token`})}return e.formatRefreshToken?.decrypt?e.formatRefreshToken?.decrypt(t):{token:t}}async function Ble(e,t,n,r,i,a,o,s,c,l,u,d){let f=a.iat??Math.floor(Date.now()/1e3),p=a?.exp??f+(t.accessTokenExpiresIn??3600),m=t.generateOpaqueAccessToken?await t.generateOpaqueAccessToken():AU(32,`A-Z`,`a-z`);return await e.context.adapter.create({model:`oauthAccessToken`,data:{token:await y2(t.storeTokens,m,`access_token`),clientId:r.clientId,sessionId:a?.sid,userId:n?.id,referenceId:s,authorizationCodeId:c,resources:o,refreshId:l,confirmation:u,requestedUserInfoClaims:d?.length?d:void 0,scopes:i,createdAt:/* @__PURE__ */ new Date(f*1e3),expiresAt:/* @__PURE__ */ new Date(p*1e3)}}),(t.prefix?.opaqueAccessToken??``)+m}async function x4(e,t,n){let r=await e.context.adapter.findMany({model:`oauthRefreshToken`,where:[{field:`clientId`,value:t},{field:`userId`,value:n}]});r.length&&await e.context.adapter.deleteMany({model:`oauthAccessToken`,where:[{field:`refreshId`,operator:`in`,value:r.map(e=>e.id)}]}),await e.context.adapter.deleteMany({model:`oauthRefreshToken`,where:[{field:`clientId`,value:t},{field:`userId`,value:n}]})}async function Vle(e,t){let n=async n=>{try{await e.context.adapter.deleteMany({model:n,where:[{field:`authorizationCodeId`,value:t}]})}catch(t){e.context.logger.error(`authorization code replay cleanup failed`,t)}};await n(`oauthAccessToken`),await n(`oauthRefreshToken`)}async function S4(e,t,n,r,i,a,o,s,l,u,d,f,p){let m=s.iat??Math.floor(Date.now()/1e3),h=s?.exp??m+(t.refreshTokenExpiresIn??2592e3),g=t.generateRefreshToken?await t.generateRefreshToken():AU(32,`A-Z`,`a-z`),_=s?.sid,v={token:await y2(t.storeTokens,g,`refresh_token`),clientId:a.clientId,sessionId:_,userId:n.id,referenceId:r,authorizationCodeId:i,authTime:u,confirmation:f,requestedUserInfoClaims:p?.length?p:void 0,scopes:o,resources:d,createdAt:/* @__PURE__ */ new Date(m*1e3),expiresAt:/* @__PURE__ */ new Date(h*1e3)};if(!l?.id)return{id:(await e.context.adapter.create({model:`oauthRefreshToken`,data:v})).id,token:await y4(t,g,_)};let y=/* @__PURE__ */ new Date(m*1e3),b={revoked:y,rotatedAt:y},x=t.refreshTokenReuseInterval??0;if(x>0&&(b.rotationReplayExpiresAt=/* @__PURE__ */ new Date((m+x)*1e3)),!await e.context.adapter.incrementOne({model:`oauthRefreshToken`,where:[{field:`id`,value:l.id},{field:`revoked`,operator:`eq`,value:null}],increment:{},set:b}))throw new c(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`});return{id:(await e.context.adapter.create({model:`oauthRefreshToken`,data:v})).id,token:await y4(t,g,_)}}async function C4(e,t,n){let r=await $2(e,t,{resource:n.resources,clientId:n.clientId,requestedScopes:n.requestedScopes}),i=r.accessTokenTtl===null?n.scopeExpiresAtSeconds:n.iat+r.accessTokenTtl,a=t.refreshTokenExpiresIn??2592e3,o=r.refreshTokenTtl===null?a:Math.min(r.refreshTokenTtl,a);return{audienceClaim:r.audienceClaim,effectiveScopes:r.effectiveScopes,accessTokenExpiresAtSeconds:Math.min(n.scopeExpiresAtSeconds,i),refreshTokenExpiresAtSeconds:n.iat+o,refreshResources:n.refreshToken?.resources??n.originalResources??n.resources,signingAlgorithm:r.signingAlgorithm,signingKeyId:r.signingKeyId,resourceCustomClaims:r.rawCustomClaims,dpopBoundAccessTokensRequired:r.dpopBoundAccessTokensRequired}}function w4(e){throw new c(`BAD_REQUEST`,{error:`invalid_dpop_proof`,error_description:e})}function Hle(e){let t=D2(e.metadata)??{};return e.dpopBoundAccessTokens===!0||t.dpop_bound_access_tokens===!0}async function T4(e,t,n){let r=n.verificationValue?.query.dpop_jkt,i=EK(n.refreshToken?.confirmation),a=i??r,o=c4(e),s=Hle(n.client)||n.grantIssuance.dpopBoundAccessTokensRequired||!!r||!!i;if(!o){s&&w4(`DPoP proof header is required`);return}try{return{jkt:(await PK({proofJwt:o,method:`POST`,url:l4(e,`/oauth2/token`),expectedJkt:a,proofMaxAgeSeconds:t.dpop?.proofMaxAgeSeconds,signingAlgorithms:t.dpop?.signingAlgorithms,replayStore:vK(e.context.internalAdapter)})).jkt}}catch(e){throw bK(e)&&w4(e.message),e}}function E4(e){return e?[...new Set(e)].sort():void 0}function D4(e,t){let n=E4(e),r=E4(t);return n===void 0||r===void 0?n===r:n.length===r.length&&n.every((e,t)=>e===r[t])}function O4(e){if(e)return`jkt`in e?`jkt:${e.jkt}`:`x5t#S256:${e[`x5t#S256`]}`}function Ule(e,t){return O4(e)===O4(t)}function Wle(e){if(!e||typeof e!=`object`)return!1;let t=e;return typeof t.jkt==`string`&&t[`x5t#S256`]===void 0||typeof t[`x5t#S256`]==`string`&&t.jkt===void 0}function Gle(e){return e===`Bearer`||e===`DPoP`}function Kle(e){if(!e||typeof e!=`object`)return!1;let t=e;return typeof t.access_token==`string`&&typeof t.expires_in==`number`&&typeof t.expires_at==`number`&&Gle(t.token_type)&&typeof t.scope==`string`&&(t.refresh_token===void 0||typeof t.refresh_token==`string`)&&(t.id_token===void 0||typeof t.id_token==`string`)}function qle(e){if(!e||typeof e!=`object`)return!1;let t=e,n=t.request;return!!n&&Array.isArray(n.effectiveScopes)&&n.effectiveScopes.every(e=>typeof e==`string`)&&(n.requestedResources===void 0||Array.isArray(n.requestedResources)&&n.requestedResources.every(e=>typeof e==`string`))&&(n.confirmation===void 0||Wle(n.confirmation))&&Kle(t.response)}function k4(e){let t=E4(e.requestedResources);return{effectiveScopes:E4(e.effectiveScopes)??[],...t?{requestedResources:t}:{},...e.confirmation?{confirmation:e.confirmation}:{}}}function Jle(e,t){return D4(e.effectiveScopes,t.effectiveScopes)&&D4(e.requestedResources,t.requestedResources)&&Ule(e.confirmation,t.confirmation)}async function Yle(e,t){return IW({key:e.context.secretConfig,data:JSON.stringify(t)})}async function Xle(e,t){let n=await LW({key:e.context.secretConfig,data:t}),r=JSON.parse(n);if(qle(r))return r}function A4(e){return!!e.rotatedAt&&!!e.rotationReplayExpiresAt&&e.rotationReplayExpiresAt>=/* @__PURE__ */ new Date}async function Zle(e,t,n,r,i){(t.refreshTokenReuseInterval??0)<=0||await e.context.adapter.update({model:`oauthRefreshToken`,where:[{field:`id`,value:n.id}],update:{rotationReplayResponse:await Yle(e,{request:r,response:i})}})}async function Qle(e,t,n){if(A4(t)&&t.rotationReplayResponse)try{let r=await Xle(e,t.rotationReplayResponse);return!r||!Jle(r.request,n)?void 0:r.response}catch(t){e.context.logger.error(`refresh token rotation replay failed`,t);return}}async function $le(e,t,n){let r=Math.floor(Date.now()/1e3),i=await C4(e,t,{clientId:n.client.clientId,requestedScopes:n.scopes,resources:n.resources,refreshToken:n.refreshToken,iat:r,scopeExpiresAtSeconds:r+(t.accessTokenExpiresIn??3600)}),a=await T4(e,t,{client:n.client,grantIssuance:i,refreshToken:n.refreshToken});return k4({effectiveScopes:i.effectiveScopes,requestedResources:n.resources,confirmation:a})}function eue(e,t){let n=Math.floor(Date.now()/1e3);return e.json({...t,expires_in:Math.max(0,t.expires_at-n)})}async function j4(e,t,n){let{client:r,scopes:i,user:a,grantType:o,referenceId:s,sessionId:c,nonce:l,refreshToken:u,authTime:d,verificationValue:f}=n,p=Math.floor(Date.now()/1e3),m=p+(a?t.accessTokenExpiresIn??3600:t.m2mAccessTokenExpiresIn??3600),h=t.scopeExpirations?i.map(e=>t.scopeExpirations?.[e]?M0(t.scopeExpirations[e],p):m).reduce((e,t)=>e<t?e:t,m):m,g=await C4(e,t,{clientId:r.clientId,requestedScopes:i,resources:n.resources,originalResources:n.originalResources,refreshToken:n.refreshToken,iat:p,scopeExpiresAtSeconds:h}),_=g.audienceClaim,v=g.effectiveScopes,y=g.accessTokenExpiresAtSeconds,b=g.refreshTokenExpiresAtSeconds,x=a&&w2(r,`refresh_token`)&&(u?.scopes?.includes(`offline_access`)||i.includes(`offline_access`)),S=_&&!t.disableJwtPlugin,C=a&&v.includes(`openid`),w=D2(r.metadata),T=C&&a?{...await Fce(t,{ctx:e,opts:t,user:a,client:r,scopes:v,grantType:o,referenceId:s,sessionId:c,resources:n.resources,metadata:w}),...n.idTokenClaims??{}}:void 0,ee=t.customTokenResponseFields?await t.customTokenResponseFields({grantType:o,user:a,scopes:v,metadata:w,verificationValue:f}):void 0,te=g.refreshResources,E=n.confirmation??await T4(e,t,{client:r,grantIssuance:g,verificationValue:f,refreshToken:u}),ne=n.requestedUserInfoClaims??u?.requestedUserInfoClaims??[],re=x&&a&&!S?await S4(e,t,a,s,n.authorizationCodeId,r,v,{iat:p,exp:b,sid:c},u,d,te,E,ne):void 0,ie=S?await Y2({ctx:e,opts:t,user:a,client:r,scopes:v,grantType:o,sessionId:c,resources:n.resources,referenceId:s,metadata:w,perRequestClaims:n.accessTokenClaims,resourcePolicyClaims:g.resourceCustomClaims}):void 0,[ae,oe]=await Promise.all([S?Lle(e,t,a,r,_,v,{iat:p,exp:y,sid:c,signingAlgorithm:g.signingAlgorithm,signingKeyId:g.signingKeyId,accessTokenClaims:ie,confirmation:E}):Ble(e,t,a,r,v,{iat:p,exp:y,sid:c},n?.resources,s,n.authorizationCodeId,re?.id,E,ne),re||(x&&a?S4(e,t,a,s,n.authorizationCodeId,r,v,{iat:p,exp:b,sid:c},u,d,te,E,ne):void 0)]),D=C?await zle(e,t,a,r,v,l,c,d,ae,T):void 0,se={...ee,...n.tokenResponse??{},access_token:ae,expires_in:y-p,expires_at:y,token_type:v4(E),refresh_token:oe?.token,scope:v.join(` `),id_token:D};if(u?.id&&oe?.id)try{await Zle(e,t,u,k4({effectiveScopes:v,requestedResources:n.resources,confirmation:E}),se)}catch(t){e.context.logger.error(`failed to store refresh token rotation replay`,t)}return e.json(se)}async function tue(e,t,n,r,i,a){let o=await y2(t.storeTokens,n,`authorization_code`),s=await e.context.internalAdapter.consumeVerificationValue(o);if(!s)throw await Vle(e,o),new c(`BAD_REQUEST`,{error_description:`invalid code`,error:`invalid_grant`});let l;try{l=JSON.parse(s.value)}catch{throw new c(`BAD_REQUEST`,{error_description:`malformed verification value`,error:`invalid_grant`})}let u=kle.safeParse(l);if(!u.success)throw new c(`BAD_REQUEST`,{error_description:`malformed verification value`,error:`invalid_grant`});let d=u.data;if(d.query.client_id!==r)throw new c(`BAD_REQUEST`,{error_description:`invalid client_id`,error:`invalid_grant`});let f=d.query.redirect_uri;if(f){if(!i)throw new c(`BAD_REQUEST`,{error_description:`redirect_uri is required`,error:`invalid_request`});if(f!==i)throw new c(`BAD_REQUEST`,{error_description:`redirect_uri mismatch`,error:`invalid_grant`})}else if(i)throw new c(`BAD_REQUEST`,{error_description:`redirect_uri mismatch`,error:`invalid_grant`});let p=u2(d.resource)??u2(d.query.resource),m=a??p;if(a&&p){let e=new Set(a),t=new Set(p);for(let n of e)if(!t.has(n))throw new c(`BAD_REQUEST`,{error_description:`requested resource not authorized`,error:`invalid_target`})}return{verificationValue:d,effectiveResources:m,authorizedResources:p,authorizationCodeId:o}}async function nue(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=O2(await k2(e,t,`${e.context.baseURL}/oauth2/token`)),{code:o,code_verifier:s,redirect_uri:l,resource:u}=e.body,d=u2(u);if(!n)throw new c(`BAD_REQUEST`,{error_description:`client_id is required`,error:`invalid_request`});if(!o)throw new c(`BAD_REQUEST`,{error_description:`code is required`,error:`invalid_request`});let f=n&&r,p=n&&o&&s;if(!f&&!p&&!i)throw new c(`BAD_REQUEST`,{error_description:`Either code_verifier or client_secret is required`,error:`invalid_request`});let{verificationValue:m,effectiveResources:h,authorizedResources:g,authorizationCodeId:_}=await tue(e,t,o,n,l,d),v=m.query.scope?.split(` `);if(!v)throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`verification scope unset`,error:`invalid_scope`});let y=await E2(e,t,n,r,v,i,`authorization_code`,a);if(I2(y,{scopes:(m.query?.scope)?.split(` `)||[],nonce:m.query?.nonce})){if(!p)throw new c(`BAD_REQUEST`,{error_description:`PKCE is required for this client`,error:`invalid_request`})}else if(!(p||f||i))throw new c(`BAD_REQUEST`,{error_description:`Either PKCE (code_verifier) or client authentication (client_secret or client_assertion) is required`,error:`invalid_request`});let b=!!m.query?.code_challenge,x=!!s;if(b||x){if(b&&!x)throw new c(`UNAUTHORIZED`,{error_description:`code_verifier required because PKCE was used in authorization`,error:`invalid_request`});if(!b&&x)throw new c(`UNAUTHORIZED`,{error_description:`code_verifier provided but PKCE was not used in authorization`,error:`invalid_request`});if((m.query?.code_challenge_method===`S256`?await lG(s):void 0)!==m.query?.code_challenge)throw new c(`UNAUTHORIZED`,{error_description:`code verification failed`,error:`invalid_request`})}if(!m.userId)throw new c(`BAD_REQUEST`,{error_description:`missing user, user may have been deleted`,error:`invalid_user`});let S=await e.context.internalAdapter.findUserById(m.userId);if(!S)throw new c(`BAD_REQUEST`,{error_description:`missing user, user may have been deleted`,error:`invalid_user`});let C=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:m.sessionId}]});if(!C||C.expiresAt</* @__PURE__ */ new Date)throw new c(`BAD_REQUEST`,{error_description:`session no longer exists`,error:`invalid_request`});let w=m.authTime==null?Bce(C):l2(m.authTime),T=W2(m.query.claims,J2(t));return j4(e,t,{client:y,scopes:m.query.scope?.split(` `)??[],user:S,grantType:`authorization_code`,referenceId:m.referenceId,sessionId:C.id,nonce:m.query?.nonce,authTime:w,verificationValue:m,authorizationCodeId:_,requestedUserInfoClaims:T,resources:h,originalResources:g})}async function rue(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=O2(await k2(e,t,`${e.context.baseURL}/oauth2/token`)),{scope:o,resource:s}=e.body,l=u2(s);if(!n)throw new c(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});let u=await E2(e,t,n,r,void 0,i,`client_credentials`,a);if(u.tokenEndpointAuthMethod===`none`)throw new c(`BAD_REQUEST`,{error_description:`public clients cannot use the client_credentials grant`,error:`unauthorized_client`});let d=u.clientCredentialsScopes;if(!d?.length)throw new c(`BAD_REQUEST`,{error_description:`client has no authorized client_credentials scopes`,error:`unauthorized_client`});let f=o?.split(` `);if(f){let e=new Set(d),t=f.filter(t=>!e.has(t)||u4(t));if(t.length)throw new c(`BAD_REQUEST`,{error_description:`The following scopes are invalid: ${t.join(`, `)}`,error:`invalid_scope`})}return f||=[...d],j4(e,t,{client:u,scopes:f,grantType:`client_credentials`,resources:l})}async function iue(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=O2(await k2(e,t,`${e.context.baseURL}/oauth2/token`)),{refresh_token:o,scope:s,resource:l}=e.body,u=u2(l);if(!n)throw new c(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});if(!o)throw new c(`BAD_REQUEST`,{error_description:`Missing a required refresh_token for refresh_token grant`,error:`invalid_request`});let d=await b4(t,o),f=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await b2(t.storeTokens,d.token,`refresh_token`)}]});if(!f)throw new c(`BAD_REQUEST`,{error_description:`session not found`,error:`invalid_grant`});if(f.clientId!==n||f.expiresAt</* @__PURE__ */ new Date)throw new c(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`});if(u&&f.resources&&!u.every(e=>f.resources?.includes(e)))throw new c(`BAD_REQUEST`,{error_description:`requested resource invalid`,error:`invalid_target`});let p=f?.scopes,m=s?.split(` `);if(m){let e=new Set(p);for(let t of m)if(!e.has(t))throw new c(`BAD_REQUEST`,{error_description:`unable to issue scope ${t}`,error:`invalid_scope`})}let h=await E2(e,t,n,r,m??p,i,`refresh_token`,a);if(f.revoked){if(A4(f)){let n=await Qle(e,f,await $le(e,t,{client:h,refreshToken:f,scopes:m??p,resources:u??f.resources}));if(n)return eue(e,n);throw new c(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`})}throw await x4(e,n,f.userId),new c(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`})}let g=await e.context.internalAdapter.findUserById(f.userId);if(!g)throw new c(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let _=f.authTime==null?void 0:l2(f.authTime);return j4(e,t,{client:h,scopes:m??p,user:g,grantType:`refresh_token`,referenceId:f.referenceId,authorizationCodeId:f.authorizationCodeId,sessionId:f.sessionId,refreshToken:f,resources:u??f.resources,authTime:_,requestedUserInfoClaims:f.requestedUserInfoClaims})}var M4=/* @__PURE__ */ W0({introspectEndpoint:()=>V4,requireActiveAccessToken:()=>due,requireActiveAccessTokenWithClaims:()=>z4,validateAccessToken:()=>R4});const N4=`Invalid access token`,aue=`Bearer error="invalid_token", error_description="${N4}"`;function P4(){return{payload:{active:!1},requestedUserInfoClaims:[]}}function oue(e,t){return e==null?[]:(Array.isArray(e)?e:[e]).filter(e=>typeof e==`string`&&e!==t)}async function F4(e,t,n){let{introspectingClientId:r,issuerClientId:i,audienceResources:a}=n;return!r||r===i||a.length!==0&&mle(e,t,r,a)}async function sue(e,t,n,r){let i=t.disableJwtPlugin?void 0:c2(e.context),a=i?.options,o=`${e.context.baseURL??``}/oauth2/userinfo`,s=a?.jwt?.issuer??e.context.baseURL,c;try{c=(await JB(n,nV(await XK(n,{jwksFetch:a?.jwks?.remoteUrl?a.jwks.remoteUrl:async()=>(await i?.endpoints.getJwks(e))?.response,jwksCacheKey:i})),{issuer:s})).payload}catch(e){if(e instanceof Error){if(e.name===`TypeError`||e.name===`JWSInvalid`)throw new d(`BAD_REQUEST`,{error_description:`invalid JWT signature`,error:`invalid_request`});if(e.name===`JWTExpired`||e.name===`JWTInvalid`)return{active:!1};throw e}throw Error(e)}let l=c.aud;if(!await Q2(e,t,l,[o])||!c.azp)return{active:!1};let u=await m2(e,t,c.azp);if(!u||u?.disabled||!await F4(e,t,{introspectingClientId:r,issuerClientId:c.azp,audienceResources:oue(l,o)}))return{active:!1};let f=c.sid;if(f){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:f}]});if(!t||t.expiresAt</* @__PURE__ */ new Date)return{active:!1}}return c.client_id=c.azp,c.active=!0,c.token_type=v4(c.cnf),c}async function cue(e,t,n,r){let i=n;if(t.prefix?.opaqueAccessToken){if(i.startsWith(t.prefix.opaqueAccessToken))i=i.replace(t.prefix.opaqueAccessToken,``);else throw new d(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`})}let a=await e.context.adapter.findOne({model:`oauthAccessToken`,where:[{field:`token`,value:await b2(t.storeTokens,i,`access_token`)}]});if(!a)throw new d(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_token`});if(!a.expiresAt||a.expiresAt</* @__PURE__ */ new Date||a.revoked)return P4();let o=Array.isArray(a.resources)?a.resources:void 0,s;if(a.clientId&&(s=await m2(e,t,a.clientId),!s||s?.disabled||!await F4(e,t,{introspectingClientId:r,issuerClientId:a.clientId,audienceResources:o??[]})))return P4();let c=a.sessionId??void 0;if(c){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:c}]});if(!t||t.expiresAt</* @__PURE__ */ new Date)return P4()}let l;a.userId&&(l=await e.context.internalAdapter.findUserById(a?.userId));let u=`${e.context.baseURL}/oauth2/userinfo`;if(o?.length&&!await Q2(e,t,o,[u]))return P4();let f=o?[...o]:void 0;f?.length&&a.scopes?.includes(`openid`)&&(f.includes(u)||f.push(u));let p=o?.length?await hle(e,t,o):{},m=s?await Y2({ctx:e,opts:t,user:l,client:s,scopes:a.scopes??[],grantType:void 0,sessionId:void 0,resources:o,referenceId:a.referenceId,metadata:D2(s.metadata),perRequestClaims:void 0,resourcePolicyClaims:p}):{},h=(t.disableJwtPlugin?void 0:c2(e.context))?.options;return{payload:{...m,active:!0,iss:h?.jwt?.issuer??e.context.baseURL,aud:d2(f),client_id:a.clientId,azp:a.clientId,sub:l?.id,sid:c,exp:Math.floor(new Date(a.expiresAt).getTime()/1e3),iat:Math.floor(new Date(a.createdAt).getTime()/1e3),scope:a.scopes?.join(` `),token_type:v4(a.confirmation),...a.confirmation?{cnf:a.confirmation}:{}},requestedUserInfoClaims:a.requestedUserInfoClaims??[]}}async function lue(e,t,n,r){let i=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await b2(t.storeTokens,n,`refresh_token`)}]});if(!i)throw new d(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_token`});if(!i.clientId||i.clientId!==r||!i.expiresAt||i.expiresAt</* @__PURE__ */ new Date||i.revoked)return{active:!1};let a=i.sessionId??void 0;if(a){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:a}]});(!t||t.expiresAt</* @__PURE__ */ new Date)&&(a=void 0)}let o;return i.userId&&(o=await e.context.internalAdapter.findUserById(i?.userId)??void 0),{active:!0,client_id:r,iss:((t.disableJwtPlugin?void 0:c2(e.context))?.options)?.jwt?.issuer??e.context.baseURL,sub:o?.id,sid:a,exp:Math.floor(new Date(i.expiresAt).getTime()/1e3),iat:Math.floor(new Date(i.createdAt).getTime()/1e3),scope:i.scopes?.join(` `),token_type:v4(i.confirmation),...i.confirmation?{cnf:i.confirmation}:{}}}function I4(){return new d(`UNAUTHORIZED`,{error_description:N4,error:`invalid_token`},{"WWW-Authenticate":aue})}function uue(e){return e.status===`BAD_REQUEST`||e.body?.error===`invalid_token`}async function L4(e,t,n,r){try{return{payload:await sue(e,t,n,r),requestedUserInfoClaims:[]}}catch(e){if(!(e instanceof d))throw e instanceof Error?e:Error(e)}try{return await cue(e,t,n,r)}catch(e){if(!(e instanceof d))throw e instanceof Error?e:Error(`Unknown error validating access token`)}throw I4()}async function R4(e,t,n,r){return(await L4(e,t,n,r)).payload}async function due(e,t,n,r){let i=await R4(e,t,n,r);if(i.active)return i;throw I4()}async function z4(e,t,n,r){let{payload:i,requestedUserInfoClaims:a}=await L4(e,t,n,r);if(i.active)return{payload:i,requestedUserInfoClaims:a};throw I4()}async function B4(e,t,n,r){if(!n.active||!n.sub)return n;let i=n.client_id??n.azp;if(!i)return n;let a=i===r.clientId?r:await m2(e,t,i);if(!a)return n;let o=await j2(n.sub,a,t);return{...n,sub:o}}async function V4(e,t){let{token:n,token_type_hint:r}=e.body;r!==`access_token`&&r!==`refresh_token`&&(r=void 0);let{clientId:i,clientSecret:a,preVerified:o,authMethod:s}=O2(await k2(e,t,`${e.context.baseURL}/oauth2/introspect`));if(!i||!a&&!o)throw new d(`UNAUTHORIZED`,{error_description:`missing required credentials`,error:`invalid_client`});if(n&&typeof n==`string`&&(n=SK(n)),!n?.length)throw new d(`BAD_REQUEST`,{error_description:`missing a required token for introspection`,error:`invalid_request`});let c=await E2(e,t,i,a,void 0,o,void 0,s);try{if(r===void 0||r===`access_token`)try{return B4(e,t,await R4(e,t,n,c.clientId),c)}catch(e){if(e instanceof d){if(r===`access_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}if(r===void 0||r===`refresh_token`)try{return B4(e,t,await lue(e,t,(await b4(t,n)).token,c.clientId),c)}catch(e){if(e instanceof d){if(r===`refresh_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}throw new d(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`})}catch(e){if(e instanceof d){if(uue(e))return{active:!1};throw e}throw e instanceof Error?(O.error(`Introspection error:`,e.message,e.stack),new d(`INTERNAL_SERVER_ERROR`)):(O.error(`Introspection error:`,e),new d(`INTERNAL_SERVER_ERROR`))}}function H4(e){return e?.get(`sec-fetch-mode`)===`cors`}var fue=/* @__PURE__ */ e({a:()=>W3,c:()=>b3,d:()=>d3,f:()=>l3,h:()=>u3,i:()=>d6,l:()=>y3,n:()=>a6,o:()=>Gue,r:()=>c6,s:()=>M3,t:()=>_6,u:()=>s3});async function pue(e,t,n){let r=await s6.get(),i=r?.query;if(!i)throw new c(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let a=new URLSearchParams(i),o=a.get(`scope`)?.split(` `)??[],s=J2(t),l=W2(a.get(`claims`),s),u=a.get(`client_id`);if(!u)throw new c(`BAD_REQUEST`,{error_description:`client_id is required`,error:`invalid_client`});let d=e.body.scope?.split(` `);if(d&&!d.every(e=>o?.includes(e)))throw new c(`BAD_REQUEST`,{error_description:`Scope not originally requested`,error:`invalid_request`});let f=e.body.claims,p=f===void 0?l:W2(f,s);if(f!==void 0&&!p.every(e=>l.includes(e)))throw new c(`BAD_REQUEST`,{error_description:`Claim not originally requested`,error:`invalid_request`});if(e.body.accept!==!0)return{redirect:!0,url:f6(a.get(`redirect_uri`)??``,`access_denied`,`User denied access`,a.get(`state`)??void 0,_6(e,t))};let m=await CH(e),h=A2(a.get(`prompt`)??``).has(`login`),g=h&&N2(m?.session.createdAt,r?.signedQueryIssuedAt);if(h&&!g)return e?.headers?.set(`accept`,`application/json`),e.query=M2(a),await n(e);let _=await t.postLogin?.consentReferenceId?.({user:m?.user,session:m?.session,scopes:d??o}),v=await e.context.adapter.findOne({model:`oauthConsent`,where:[{field:`clientId`,value:u},{field:`userId`,value:m?.user.id},..._?[{field:`referenceId`,value:_}]:[]]}),y=Math.floor(Date.now()/1e3),b=a.getAll(`resource`),x={clientId:u,userId:m?.user.id,scopes:d??o,requestedUserInfoClaims:p,createdAt:/* @__PURE__ */ new Date(y*1e3),updatedAt:/* @__PURE__ */ new Date(y*1e3),resources:b.length?b:void 0,referenceId:_};if(v?.id?await e.context.adapter.update({model:`oauthConsent`,where:[{field:`id`,value:v.id}],update:{resources:x.resources,scopes:x.scopes,requestedUserInfoClaims:x.requestedUserInfoClaims,updatedAt:/* @__PURE__ */ new Date(y*1e3)}}):await e.context.adapter.create({model:`oauthConsent`,data:{...x,scopes:x.scopes}}),d&&a.set(`scope`,x.scopes.join(` `)),f!==void 0){let e=ale(a.get(`claims`),p);e?a.set(`claims`,JSON.stringify(e)):a.delete(`claims`)}e?.headers?.set(`accept`,`application/json`);let S=P2(a,`consent`);return g&&(S=P2(S,`login`),S=F2(S)),e.query=M2(S),await n(e,{postLogin:r?.postLoginClearedForSession!==void 0&&r.postLoginClearedForSession===m?.session.id})}async function mue(e,t){if(e.body.selected===!0)return await hue(e,t);if(e.body.created===!0)return await gue(e,t);if(e.body.postLogin===!0)return await _ue(e,t);throw new c(`BAD_REQUEST`,{error_description:`Missing parameters`,error:`invalid_request`})}async function hue(e,t){let n=(await s6.get())?.query;if(!n)throw new c(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});return e.headers?.set(`accept`,`application/json`),e.query=M2(P2(new URLSearchParams(n),`select_account`)),await t(e)}async function gue(e,t){let n=(await s6.get())?.query;if(!n)throw new c(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let r=new URLSearchParams(n);return e.headers?.set(`accept`,`application/json`),e.query=M2(P2(r,`create`)),await t(e)}async function _ue(e,t){let n=await s6.get(),r=n?.query;if(!r)throw new c(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let i=new URLSearchParams(r);e.headers?.set(`accept`,`application/json`),e.query=M2(i);let a=await CH(e);return await t(e,{postLogin:n?.postLoginClearedForSession!==void 0&&n.postLoginClearedForSession===a?.session.id})}async function vue(e,t,n,r){return I0(e,{options:t,payload:{...r,events:{"http://schemas.openid.net/event/backchannel-logout":{}}},header:{typ:`logout+jwt`},resolvedKey:n??void 0})}async function yue(e,t,n){let{sessionId:r,userId:i}=n;if(!i)return null;let a=e.context.logger;try{let n=await GR(e.context.adapter),o=[{field:`sessionId`,value:r}],[s,c]=await Promise.all([n.findMany({model:`oauthAccessToken`,where:o}),n.findMany({model:`oauthRefreshToken`,where:o})]),l=/* @__PURE__ */ new Set;for(let e of s)l.add(e.clientId);for(let e of c)l.add(e.clientId);if(l.size===0)return null;let u=await n.findMany({model:`oauthClient`,where:[{field:`clientId`,operator:`in`,value:Array.from(l)}]}),d=s.filter(e=>!e.revoked).map(e=>e.id),f=c.filter(e=>!e.revoked&&!e.scopes?.includes(`offline_access`)).map(e=>e.id),p=t.disableJwtPlugin?[]:u.filter(e=>!!e.backchannelLogoutUri&&!e.disabled);return{accessTokenIds:d,refreshTokenIds:f,sessionId:r,targets:(await Promise.all(p.map(async e=>{try{return{client:e,sub:await j2(i,e,t)}}catch(t){return a.warn(`back-channel logout: unable to resolve subject for client ${e.clientId}`,t),null}}))).filter(e=>e!==null)}}catch(e){return a.error(`back-channel logout planning failed`,e),null}}async function bue(e,t){let n=/* @__PURE__ */ new Date,r=await GR(e.context.adapter),i=await Promise.allSettled([t.accessTokenIds.length>0?r.updateMany({model:`oauthAccessToken`,where:[{field:`id`,operator:`in`,value:t.accessTokenIds}],update:{revoked:n}}):Promise.resolve(),t.refreshTokenIds.length>0?r.updateMany({model:`oauthRefreshToken`,where:[{field:`id`,operator:`in`,value:t.refreshTokenIds}],update:{revoked:n}}):Promise.resolve()]);for(let t of i)t.status===`rejected`&&e.context.logger.error(`back-channel logout: token revocation update failed`,t.reason);t.targets.length>0&&await xue(e,t)}async function xue(e,t){let n=e.context.logger,r=c2(e.context)?.options,i=r?.jwt?.issuer??e.context.baseURL,a=Math.floor(Date.now()/1e3),o=a+120,s=r?.jwt?.sign?null:await F0(e,r);await Promise.allSettled(t.targets.map(async({client:c,sub:l})=>{try{let u=AU(32,`a-z`,`A-Z`,`0-9`),d=await vue(e,r,s,{iss:i,aud:c.clientId,sub:l,sid:t.sessionId,iat:a,exp:o,jti:u}),f=await fetch(c.backchannelLogoutUri,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`,Accept:`application/json`},body:new URLSearchParams({logout_token:d}),signal:AbortSignal.timeout(5e3),redirect:`error`});f.status!==200&&f.status!==204&&n.warn(`back-channel logout to client ${c.clientId} returned ${f.status}`)}catch(e){n.warn(`back-channel logout to client ${c.clientId} failed`,e)}}))}function U4(e){return e.replace(/[&<>"']/g,e=>{switch(e){case`&`:return`&amp;`;case`<`:return`&lt;`;case`>`:return`&gt;`;case`"`:return`&quot;`;case`'`:return`&#39;`;default:return e}})}function W4(e){let t=e.request?.headers??e.headers;if(!t||H4(t))return!1;let n=t.get(`accept`)??``;return t.get(`sec-fetch-mode`)===`navigate`||n.includes(`text/html`)||n.includes(`application/xhtml+xml`)}function G4(e,t,n=200){return new Response(`<!doctype html><html><head><meta charset="utf-8"><title>${U4(e)}</title></head><body>${t}</body></html>`,{status:n,headers:{"cache-control":`no-store`,"content-security-policy":`default-src 'none'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'`,"content-type":`text/html; charset=utf-8`,pragma:`no-cache`,"x-content-type-options":`nosniff`}})}function K4(e){return`${e.context.baseURL.replace(/\/$/,``)}/oauth2/end-session/confirm`}function Sue(e){try{return new URL(K4(e)).pathname}catch{return`/oauth2/end-session/confirm`}}function q4(e){return G4(`Confirm logout`,`<main><h1>Confirm logout</h1><p>Do you want to log out of this account?</p><form method="post" data-oidc-logout-confirmation action="${U4(K4(e))}"><button type="submit" name="action" value="confirm">Confirm logout</button></form></main>`)}function J4(e){return G4(`Logged out`,`<main><p data-oidc-logout-state="logged-out">${e?`Logged out. ${U4(e)}`:`Logged out.`}</p></main>`)}function Cue(e,t){return G4(`Logout error`,`<main><h1>Logout error</h1><p data-oidc-logout-state="error">${U4(e)}</p></main>`,t)}function Y4(e,t,n,r){if(W4(e))return Cue(r,t===`BAD_REQUEST`?400:t===`UNAUTHORIZED`?401:500);throw new d(t,{error:n,error_description:r})}function X4(e){return`${e.context.authCookies.sessionToken.name}.oauth_logout_confirmation`}function Z4(e,t){return{...e.context.authCookies.sessionToken.attributes,httpOnly:!0,maxAge:t,path:Sue(e),sameSite:`lax`}}async function Q4(e,t,n={}){let r={...t?{sessionId:t}:{},...n,expiresAt:Date.now()+3e5};await e.setSignedCookie(X4(e),JSON.stringify(r),e.context.secret,Z4(e,300))}async function wue(e){let t=await e.getSignedCookie(X4(e),e.context.secret);if(typeof t!=`string`)return null;try{let e=JSON.parse(t);if(typeof e!=`object`||!e)return null;let n=e;return n.sessionId!==void 0&&(typeof n.sessionId!=`string`||n.sessionId.length===0)||n.clientId!==void 0&&(typeof n.clientId!=`string`||n.clientId.length===0)||n.postLogoutRedirectUri!==void 0&&(typeof n.postLogoutRedirectUri!=`string`||n.postLogoutRedirectUri.length===0)||n.state!==void 0&&typeof n.state!=`string`||n.redirectInvalid!==void 0&&typeof n.redirectInvalid!=`boolean`||n.postLogoutRedirectUri!==void 0&&n.clientId===void 0||typeof n.expiresAt!=`number`||!Number.isFinite(n.expiresAt)?null:{...typeof n.sessionId==`string`?{sessionId:n.sessionId}:{},...typeof n.clientId==`string`?{clientId:n.clientId}:{},...typeof n.postLogoutRedirectUri==`string`?{postLogoutRedirectUri:n.postLogoutRedirectUri}:{},...typeof n.state==`string`?{state:n.state}:{},...typeof n.redirectInvalid==`boolean`?{redirectInvalid:n.redirectInvalid}:{},expiresAt:n.expiresAt}}catch{return null}}function $4(e){e.setCookie(X4(e),``,Z4(e,0))}async function e3(e){let t=await e.getSignedCookie(e.context.authCookies.sessionToken.name,e.context.secret);if(typeof t!=`string`||t.length===0)return null;try{let n=await e.context.internalAdapter.findSession(t);return n?{session:n.session}:null}catch(t){throw e.context.logger.error(`Failed to read the current logout session`,t),new d(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to read the current session`})}}async function Tue(e,t){try{return await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:t}]})}catch(t){throw e.context.logger.error(`Failed to read the hinted logout session`,t),new d(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to read the hinted session`})}}async function t3(e,t){if(typeof t.token!=`string`||t.token.length===0)throw new d(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to complete logout`});try{await e.context.internalAdapter.deleteSession(t.token)}catch(t){throw e.context.logger.error(`Failed to delete the logout session`,t),new d(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to complete logout`})}}async function n3(e,t,n){try{return await m2(e,t,n)}catch(t){throw e.context.logger.error(`Failed to resolve the logout client`,t),new d(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to resolve the logout client`})}}function r3(e){return(Array.isArray(e)?e:[e]).filter(e=>typeof e==`string`)}function Eue(e){if(typeof e.aud==`string`&&e.aud.length>0)return e.aud;if(typeof e.azp==`string`&&e.azp.length>0)return e.azp;let t=r3(e.aud);return t.length===1?t[0]:null}async function Due(e,t,n,r){if(r)return n3(e,t,r);let i;try{i=pV(n)}catch{return null}let a=Eue(i);return a?n3(e,t,a):null}async function Oue(e,t,n,r){try{let i;if(t.disableJwtPlugin){if(!r.clientSecret)return null;let a=await _2(e,t.storeClientSecret,r.clientSecret),{payload:o}=await qB(n,new TextEncoder().encode(a));i=JSON.parse(new TextDecoder().decode(o))}else{let t=c2(e.context).options,{payload:r}=await qB(n,nV(await XK(n,{jwksFetch:t?.jwks?.remoteUrl??`${e.context.baseURL}${t?.jwks?.jwksPath??`/jwks`}`})));i=JSON.parse(new TextDecoder().decode(r))}return i.iss!==_6(e,t)||!r3(i.aud).includes(r.clientId)||typeof i.sid!=`string`||i.sid.length===0||typeof i.sub!=`string`||i.sub.length===0?null:i}catch{return null}}function i3(e,t,n){if(!t)return{invalid:!1};if(!e.postLogoutRedirectUris?.includes(t))return{invalid:!0};if(!n)return{uri:t,invalid:!1};try{let e=new URL(t);return e.searchParams.set(`state`,n),{uri:e.toString(),invalid:!1}}catch{return{invalid:!0}}}function a3(e,t){return t.post_logout_redirect_uri?i3(e,t.post_logout_redirect_uri,t.state).invalid?{redirectInvalid:!0}:{clientId:e.clientId,postLogoutRedirectUri:t.post_logout_redirect_uri,...t.state===void 0?{}:{state:t.state}}:{}}async function kue(e,t,n){if(n.redirectInvalid)return{invalid:!0};if(!n.clientId||!n.postLogoutRedirectUri)return{invalid:!1};let r=await n3(e,t,n.clientId);return!r||r.disabled||!r.enableEndSession?{invalid:!0}:i3(r,n.postLogoutRedirectUri,n.state)}async function o3(e,t,n={}){return t?W4(e)?(await Q4(e,t.session.id,n),q4(e)):Y4(e,`BAD_REQUEST`,`invalid_request`,`User confirmation is required to complete logout`):W4(e)?(await Q4(e,void 0,n),q4(e)):Y4(e,`BAD_REQUEST`,`invalid_request`,`No active session is available for logout`)}async function Aue(e,t){let n=await wue(e),r=await e3(e);if(!n||n.expiresAt<=Date.now())return Y4(e,`BAD_REQUEST`,`invalid_request`,`The logout confirmation is invalid or expired`);let i=await kue(e,t,n);return r?n.sessionId&&n.sessionId!==r.session.id?Y4(e,`BAD_REQUEST`,`invalid_request`,`The logout confirmation is invalid or expired`):(await t3(e,r.session),bH(e),$4(e),i.uri?m6(e,i.uri):W4(e)?J4(i.invalid?`The requested post-logout redirect was not registered.`:void 0):null):($4(e),i.uri?m6(e,i.uri):W4(e)?J4(i.invalid?`The requested post-logout redirect was not registered.`:void 0):Y4(e,`BAD_REQUEST`,`invalid_request`,`No active session is available for logout`))}async function jue(e,t){let n=e.query??{},r=e.body??{},i={...n,...r},a=await e3(e);if(i.id_token_hint===void 0){let n={};if(i.client_id){let r=await n3(e,t,i.client_id);if(!r)return Y4(e,`BAD_REQUEST`,`invalid_client`,`The logout client does not exist`);if(r.disabled)return Y4(e,`BAD_REQUEST`,`invalid_client`,`The logout client is disabled`);if(!r.enableEndSession)return Y4(e,`UNAUTHORIZED`,`invalid_client`,`The client is not allowed to initiate logout`);n=a3(r,i)}return o3(e,a,n)}let o=await Due(e,t,i.id_token_hint,i.client_id);if(!o)return a&&W4(e)?o3(e,a):Y4(e,`BAD_REQUEST`,`invalid_client`,`The logout client does not exist`);if(o.disabled)return Y4(e,`BAD_REQUEST`,`invalid_client`,`The logout client is disabled`);if(!o.enableEndSession)return Y4(e,`UNAUTHORIZED`,`invalid_client`,`The client is not allowed to initiate logout`);let s=await Oue(e,t,i.id_token_hint,o);if(!s)return a&&W4(e)?o3(e,a,i.client_id?a3(o,i):{}):Y4(e,`UNAUTHORIZED`,`invalid_token`,`The id_token_hint is invalid`);let c=s.sid,l=await Tue(e,c),u=a?.session.id===c;if(a&&!u)return o3(e,a,a3(o,i));let d=i3(o,i.post_logout_redirect_uri,i.state),f=l??(u?a?.session:null);return f&&await t3(e,f),u&&bH(e),$4(e),d.uri?m6(e,d.uri):W4(e)?J4(d.invalid?`The requested post-logout redirect was not registered.`:void 0):null}async function Mue(e,t){return Aue(e,t)}function s3(e,t,n){let r=e.context.baseURL,i=!n?.jwt_disabled;return{scopes_supported:n?.scopes_supported,issuer:g6(t?.jwt?.issuer??r),authorization_endpoint:`${r}/oauth2/authorize`,token_endpoint:`${r}/oauth2/token`,jwks_uri:n?.jwt_disabled?void 0:t?.jwks?.remoteUrl??`${r}${t?.jwks?.jwksPath??`/jwks`}`,registration_endpoint:n?.dynamic_client_registration_supported?`${r}/oauth2/register`:void 0,introspection_endpoint:`${r}/oauth2/introspect`,revocation_endpoint:`${r}/oauth2/revoke`,response_types_supported:n?.grant_types_supported&&!n.grant_types_supported.includes(`authorization_code`)?[]:[`code`],response_modes_supported:[`query`],grant_types_supported:n?.grant_types_supported??[`authorization_code`,`client_credentials`,`refresh_token`],token_endpoint_auth_methods_supported:n?.token_endpoint_auth_methods_supported??[...n?.public_client_supported?[`none`]:[],`client_secret_basic`,`client_secret_post`,`private_key_jwt`],token_endpoint_auth_signing_alg_values_supported:[...yG],introspection_endpoint_auth_methods_supported:n?.endpoint_auth_methods_supported??[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],introspection_endpoint_auth_signing_alg_values_supported:[...yG],revocation_endpoint_auth_methods_supported:n?.endpoint_auth_methods_supported??[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],revocation_endpoint_auth_signing_alg_values_supported:[...yG],code_challenge_methods_supported:[`S256`],authorization_response_iss_parameter_supported:!0,dpop_signing_alg_values_supported:n?.dpop_signing_alg_values_supported??[...gK],backchannel_logout_supported:i,backchannel_logout_session_supported:i}}function c3(e,t){let n=t.disableJwtPlugin?void 0:c2(e.context).options,r=t2(t),i=t.allowUnauthenticatedClientRegistration||r.length>0;return{jwtPluginOptions:n,clientDiscoveries:r,authMetadata:s3(e,n,{scopes_supported:t.advertisedMetadata?.scopes_supported??t.scopes,dynamic_client_registration_supported:t.allowDynamicClientRegistration,public_client_supported:i,grant_types_supported:n2(t),token_endpoint_auth_methods_supported:i2(t,{includeNone:i}),endpoint_auth_methods_supported:i2(t),jwt_disabled:t.disableJwtPlugin,dpop_signing_alg_values_supported:t.dpop?.signingAlgorithms})}}function l3(e,t){let{clientDiscoveries:n,authMetadata:r}=c3(e,t);return o2(e,t,`oauth-authorization-server`,{...h2(n),...r})}function u3(e,t){let n=e.context.baseURL,{jwtPluginOptions:r,clientDiscoveries:i,authMetadata:a}=c3(e,t),o={...a,claims_supported:J2(t),claims_parameter_supported:!0,userinfo_endpoint:`${n}/oauth2/userinfo`,subject_types_supported:t.pairwiseSecret?[`public`,`pairwise`]:[`public`],acr_values_supported:[`0`],id_token_signing_alg_values_supported:(()=>{if(t.disableJwtPlugin)return[`HS256`];let e=r?.jwks?.keyPairConfig?.alg??`EdDSA`,n=r?.jwks?.keyPairConfigs?.map(e=>e.alg)??[];return Array.from(/* @__PURE__ */ new Set([e,...n]))})(),end_session_endpoint:`${n}/oauth2/end-session`,request_parameter_supported:!1,request_uri_parameter_supported:!1,prompt_values_supported:[`login`,`consent`,`create`,`select_account`,`none`]};return o2(e,t,`openid-configuration`,{...h2(i),...o})}function d3(e,t){let n=new Headers(t);return n.has(`Cache-Control`)||n.set(`Cache-Control`,`public, max-age=15, stale-while-revalidate=15, stale-if-error=86400`),n.set(`Content-Type`,`application/json`),new Response(JSON.stringify(e),{status:200,headers:n})}function f3(e,t,n){let{redirectOnError:r,onValidationError:i,errorCodesByField:a,defaultError:o=`invalid_request`,...s}=t;if(!r)return Y(e,{...s,onValidationError:async e=>{throw i&&await i(e),new d(`BAD_REQUEST`,{...p3(e.issues,a,o)})}},n);let c=r,{body:l,query:u,...f}=s;async function p(e,t,n){if(!n)return{ok:!0};let r=await n.safeParseAsync(e[t]??{});return r.success?(e[t]=r.data,{ok:!0}):(i&&await i({message:r.error.message,issues:r.error.issues}),{ok:!1,response:c({...p3(r.error.issues,a,o),ctx:e})})}return Y(e,f,async e=>{let t=await p(e,`body`,l);if(!t.ok)return t.response;let r=await p(e,`query`,u);return r.ok?n(e):r.response})}function p3(e,n,r=`invalid_request`){let i=e[0];if(!i)return{error:r,error_description:`Invalid request.`};let a=i.path?.[0],o=typeof a==`string`?a:void 0,s=o?n?.[o]:void 0,c=i.path?.length?t(i.path):``;return{error:Nue(i,s,r),error_description:Fue(i,c)}}function Nue(e,t,n){return typeof t==`string`?t:Pue(e)?t?.missing??n:e.code===`invalid_value`?t?.invalid??n:n}function Pue(e){return e.code===`invalid_type`&&e.message.endsWith(`received undefined`)}function Fue(e,t){if(!t)return e.message;if(e.code===`invalid_type`)return e.message.endsWith(`received undefined`)?`${t} is required`:e.message.endsWith(`received array`)?`${t} must not appear more than once`:`${t} must be a ${e.expected??`valid value`}`;if(e.code===`invalid_value`){let n=e.values;if(Array.isArray(n)&&n.length>0)return`${t} must be one of: ${n.join(`, `)}`}return`${t}: ${e.message}`}const Iue=e=>gL(async t=>{if(!e.allowPublicClientPrelogin)throw new c(`BAD_REQUEST`);let n=t.body.oauth_query;if(!await p2(n,t.context.secret))throw new c(`UNAUTHORIZED`,{error:`invalid_signature`})}),m3={"P-256":`ES256`,"P-384":`ES384`,"P-521":`ES512`},Lue=[`Ed25519`],Rue=[`d`,`p`,`q`,`dp`,`dq`,`qi`,`oth`];function h3(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function g3(e,t){return typeof e[t]==`string`&&e[t].length>0}function _3(e){return typeof e==`string`&&Object.prototype.hasOwnProperty.call(m3,e)}function v3(e){return Lue.some(t=>t===e)}function zue(e){switch(e.kty){case`RSA`:return g3(e,`n`)&&g3(e,`e`);case`EC`:return _3(e.crv)&&g3(e,`x`)&&g3(e,`y`);case`OKP`:return v3(e.crv)&&g3(e,`x`);default:return!1}}function Bue(e){if(e.alg===void 0)return!0;if(typeof e.alg!=`string`||!yG.some(t=>t===e.alg))return!1;switch(e.kty){case`RSA`:return e.alg.startsWith(`RS`)||e.alg.startsWith(`PS`);case`EC`:return _3(e.crv)&&m3[e.crv]===e.alg;case`OKP`:return v3(e.crv)&&e.alg===`EdDSA`;default:return!1}}function y3(e){let t=h3(e)&&Array.isArray(e.keys)?e.keys:void 0;if(!t?.length)return{valid:!1,error:`jwks must be an RFC 7517 JWK Set object with a non-empty keys array`};for(let e of t){if(!h3(e))return{valid:!1,error:`jwks keys must be supported public JWKs with required key parameters`};if(e.kty===`oct`||`k`in e||Rue.some(t=>t in e))return{valid:!1,error:`jwks must contain only public asymmetric keys`};if(!zue(e))return{valid:!1,error:`jwks keys must be supported public JWKs with required key parameters`};if(!Bue(e))return{valid:!1,error:`jwks key alg must be supported for private_key_jwt and compatible with its key type and signing curve`}}return{valid:!0,jwks:{keys:t}}}const Vue=Object.freeze(Object.keys({clientId:!0,clientSecret:!0,clientDiscoveryId:!0,disabled:!0,scopes:!0,clientCredentialsScopes:!0,userId:!0,createdAt:!0,updatedAt:!0,expiresAt:!0,name:!0,uri:!0,icon:!0,contacts:!0,tos:!0,policy:!0,softwareId:!0,softwareVersion:!0,softwareStatement:!0,redirectUris:!0,postLogoutRedirectUris:!0,backchannelLogoutUri:!0,backchannelLogoutSessionRequired:!0,tokenEndpointAuthMethod:!0,grantTypes:!0,responseTypes:!0,applicationType:!0,jwks:!0,jwksUri:!0,requirePKCE:!0,dpopBoundAccessTokens:!0,skipConsent:!0,enableEndSession:!0,subjectType:!0,referenceId:!0,metadata:!0})),Hue=/* @__PURE__ */ `client_id.client_secret.client_secret_expires_at.scope.user_id.client_id_issued_at.client_name.client_uri.logo_uri.contacts.tos_uri.policy_uri.jwks.jwks_uri.software_id.software_version.software_statement.redirect_uris.post_logout_redirect_uris.backchannel_logout_uri.backchannel_logout_session_required.token_endpoint_auth_method.grant_types.response_types.application_type.disabled.skip_consent.enable_end_session.require_pkce.dpop_bound_access_tokens.subject_type.reference_id`.split(`.`),Uue=/* @__PURE__ */ new Set([...Vue,...Hue,`public`,`type`,`resources`,`client_credentials_scopes`]),Wue=/* @__PURE__ */ new Set(/* @__PURE__ */ `disabled.client_secret.client_secret_expires_at.client_id_issued_at.skip_consent.enable_end_session.require_pkce.reference_id.user_id.resources.clientSecret.clientDiscoveryId.skipConsent.enableEndSession.requirePKCE.referenceId.userId.clientId.applicationType.tokenEndpointAuthMethod.redirectUris.postLogoutRedirectUris.grantTypes.responseTypes.scopes.expiresAt.createdAt.updatedAt.softwareId.softwareVersion.softwareStatement.backchannelLogoutUri.backchannelLogoutSessionRequired.jwksUri.dpopBoundAccessTokens.subjectType`.split(`.`));function b3(e){return Wue.has(e)}function x3(e){if(e)return Object.fromEntries(Object.entries(e).filter(([e])=>!Uue.has(e)))}async function S3(e,t,n,r){if(!t)throw new c(`UNAUTHORIZED`);if(!e.headers)throw new c(`BAD_REQUEST`);if(r===`configure-client-credentials-scopes`&&!n.clientPrivileges||n.clientPrivileges&&!await n.clientPrivileges({headers:e.headers,action:r,session:t.session,user:t.user}))throw new c(`UNAUTHORIZED`)}var Gue=/* @__PURE__ */ W0({consumeClientAssertion:()=>M3,isPrivateHostname:()=>k3,verifyClientAssertion:()=>Que});const C3=/* @__PURE__ */ new WeakMap,w3=65536,Kue=/^application\/(?:[-\w.]+\+)?json\s*(?:;|$)/i;function T3(e,t,n,r){if(e.set(t,{jwks:n,fetchedAt:r}),e.size>500){let t=e.keys().next().value;t!==void 0&&e.delete(t)}}function E3(e){let t=C3.get(e);if(t)return t;let n=/* @__PURE__ */ new Map;return C3.set(e,n),n}function D3(e){return`${e.clientDiscoveryId??`managed`}:${e.jwksUri??``}`}const O3=[...yG];function k3(e){return!cU(e)}function que(e,t,n){let r=new URL(t);if(r.protocol!==`https:`)throw new d(`BAD_REQUEST`,{error_description:`jwks_uri must use HTTPS`,error:`invalid_client`});if(r.username||r.password)throw new d(`BAD_REQUEST`,{error_description:`jwks_uri must not contain credentials`,error:`invalid_client`});if(t.includes(`#`))throw new d(`BAD_REQUEST`,{error_description:`jwks_uri must not include a fragment component`,error:`invalid_client`});if(k3(r.hostname))throw new d(`BAD_REQUEST`,{error_description:`jwks_uri must not point to a private or reserved address`,error:`invalid_client`});if(!(n&&r.origin===n)&&!e.context.isTrustedOrigin(r.href))throw new d(`BAD_REQUEST`,{error_description:`client jwks_uri is not trusted`,error:`invalid_client`})}function Jue(e){try{let t=new URL(e);return t.protocol!==`https:`&&t.protocol!==`http:`?void 0:t.origin}catch{return}}async function Yue(e){let t=e.headers.get(`content-length`);if(t!==null&&Number.isFinite(Number(t))&&Number(t)>w3)throw await e.body?.cancel(),Error(`JWKS response exceeds 64 KiB`);if(!e.body)return``;let n=e.body.getReader(),r=[],i=0;for(;;){let{done:e,value:t}=await n.read();if(e)break;if(i+=t.byteLength,i>w3)throw await n.cancel(),Error(`JWKS response exceeds 64 KiB`);r.push(t)}let a=new Uint8Array(i),o=0;for(let e of r)a.set(e,o),o+=e.byteLength;return new TextDecoder().decode(a)}async function A3(e,t=globalThis.fetch){let n=new AbortController,r=setTimeout(()=>n.abort(),5e3);try{let r=await t(e,{signal:n.signal,headers:{accept:`application/json`},redirect:`error`});if(r.redirected)throw Error(`JWKS fetch redirected`);if(r.status!==200)throw Error(`JWKS fetch returned ${r.status}`);let i=r.headers.get(`content-type`);if(!i||!Kue.test(i))throw Error(`JWKS response must use a JSON media type`);let a=await Yue(r),o;try{o=JSON.parse(a)}catch{return{valid:!1}}let s=y3(o);return s.valid?{valid:!0,jwks:s.jwks}:{valid:!1}}finally{clearTimeout(r)}}function j3(){return new d(`BAD_REQUEST`,{error_description:`failed to fetch client JWKS`,error:`invalid_client`})}async function Xue(e,t,n){if(n.jwks)return JSON.parse(n.jwks);if(!n.jwksUri)throw new d(`BAD_REQUEST`,{error_description:`client has no JWKS configured`,error:`invalid_client`});let r=n.clientDiscoveryId?t2(t).find(e=>e.id===n.clientDiscoveryId):void 0;if(n.clientDiscoveryId&&!r?.fetchClientMetadataResource)throw new d(`BAD_REQUEST`,{error_description:`client discovery does not provide a metadata resource transport`,error:`invalid_client`});que(e,n.jwksUri,n.clientDiscoveryId?Jue(n.clientId):void 0);let i=Date.now(),a=D3(n),o=E3(t),s=o.get(a);if(s&&i-s.fetchedAt<3e5)return s.jwks;let c;try{c=await A3(n.jwksUri,r?.fetchClientMetadataResource)}catch{if(s&&i-s.fetchedAt<6e5)return s.jwks;throw j3()}if(!c.valid)throw j3();return T3(o,a,c.jwks,i),c.jwks}async function Zue(e,t){if(!t.jwksUri)return null;let n=t.clientDiscoveryId?t2(e).find(e=>e.id===t.clientDiscoveryId):void 0;if(t.clientDiscoveryId&&!n?.fetchClientMetadataResource)return null;try{let r=await A3(t.jwksUri,n?.fetchClientMetadataResource);return r.valid?(T3(E3(e),D3(t),r.jwks,Date.now()),r.jwks):null}catch{return null}}async function M3(e,t,n){let{namespace:r,payload:i,expectedAudience:a}=n;if(!(Array.isArray(i.aud)?i.aud:i.aud==null?[]:[i.aud]).includes(a))throw new d(`BAD_REQUEST`,{error_description:`client assertion aud does not match the endpoint`,error:`invalid_client`});let o=t.assertionMaxLifetime??300,s=Math.floor(Date.now()/1e3);if(typeof i.exp!=`number`)throw new d(`BAD_REQUEST`,{error_description:`client assertion must include exp claim`,error:`invalid_client`});if(i.exp<=s)throw new d(`BAD_REQUEST`,{error_description:`client assertion has expired`,error:`invalid_client`});if(i.exp-s>o)throw new d(`BAD_REQUEST`,{error_description:`client assertion exp is too far in the future (max ${o}s)`,error:`invalid_client`});if(typeof i.iat==`number`&&s-i.iat>o)throw new d(`BAD_REQUEST`,{error_description:`client assertion iat is too far in the past (max ${o}s)`,error:`invalid_client`});if(typeof i.jti!=`string`||i.jti.length===0)throw new d(`BAD_REQUEST`,{error_description:`client assertion must include jti claim`,error:`invalid_client`});let c=await PH(`SHA-256`).digest(new TextEncoder().encode(`${r}:${i.jti}`)),l=oH.encode(new Uint8Array(c).slice(0,24),{padding:!1});try{await e.context.adapter.create({model:`oauthClientAssertion`,data:{id:l,expiresAt:/* @__PURE__ */ new Date(i.exp*1e3)},forceAllowId:!0})}catch(t){let n=!1;try{n=!!await e.context.adapter.findOne({model:`oauthClientAssertion`,where:[{field:`id`,value:l}]})}catch{}throw n?new d(`BAD_REQUEST`,{error_description:`client assertion jti has already been used`,error:`invalid_client`}):t}}async function Que(e,t,n,r,i,a){if(r!==`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)throw new d(`BAD_REQUEST`,{error_description:`unsupported client_assertion_type`,error:`invalid_client`});let o;try{o=fV(n)}catch{throw new d(`BAD_REQUEST`,{error_description:`malformed client assertion: invalid JWT header`,error:`invalid_client`})}if(!o.alg||!O3.includes(o.alg))throw new d(`BAD_REQUEST`,{error_description:`unsupported assertion signing algorithm: ${o.alg}`,error:`invalid_client`});let s;try{s=pV(n)}catch{throw new d(`BAD_REQUEST`,{error_description:`malformed client assertion: invalid JWT payload`,error:`invalid_client`})}let c=s.sub??s.iss;if(!c)throw new d(`BAD_REQUEST`,{error_description:`client assertion must contain sub or iss claim identifying the client`,error:`invalid_client`});if(i&&i!==c)throw new d(`BAD_REQUEST`,{error_description:`client_id in body does not match assertion sub/iss`,error:`invalid_client`});let l=await m2(e,t,c);if(!l)throw new d(`BAD_REQUEST`,{error_description:`unknown client`,error:`invalid_client`});if(l.disabled)throw new d(`BAD_REQUEST`,{error_description:`client is disabled`,error:`invalid_client`});if(l.tokenEndpointAuthMethod!==`private_key_jwt`)throw new d(`BAD_REQUEST`,{error_description:`client is not registered for private_key_jwt authentication`,error:`invalid_client`});let u=await Xue(e,t,l),f=a??`${e.context.baseURL}/oauth2/token`,p=_6(e,t),m=[.../* @__PURE__ */ new Set([f,p])],h={issuer:c,subject:c,audience:m,algorithms:O3},g;try{({payload:g}=await JB(n,nV(u),h))}catch(e){if(e instanceof Error&&/no matching key|no applicable key/i.test(e.message)){let e=await Zue(t,l);if(e)try{({payload:g}=await JB(n,nV(e),h))}catch{throw new d(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}else throw new d(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}else throw new d(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}let _=(Array.isArray(g.aud)?g.aud:[g.aud]).find(e=>typeof e==`string`&&m.includes(e));return await M3(e,t,{namespace:`private_key_jwt:${c}`,payload:g,expectedAudience:_}),{clientId:c}}function N3(e,t,n){return new d(e,{error:t,error_description:n},{"WWW-Authenticate":`Bearer error="${t}"`,...pL})}async function $ue(e,t,n){let r=e.headers,i;try{i=Rce(r?.get(`authorization`))}catch{throw N3(`BAD_REQUEST`,`invalid_request`,`Malformed initial access token Authorization header`)}if(!i||!r)return;if(!t.validateInitialAccessToken)throw N3(`UNAUTHORIZED`,`invalid_token`,`Invalid initial access token`);let a;try{a=await t.validateInitialAccessToken({initialAccessToken:i,headers:r,clientMetadata:n})}catch(e){throw e instanceof d?e:new d(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Initial access token validation failed`})}if(!a)throw N3(`UNAUTHORIZED`,`invalid_token`,`Invalid initial access token`);return a}const ede=[`authorization_code`];function P3(e){return[.../* @__PURE__ */ new Set([...e.clientRegistrationDefaultScopes??e.scopes??[],...e.clientRegistrationAllowedScopes??[]])]}function F3(e){let t=e.grant_types??[...ede];if(t.length>0)return t;throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`grant_types must contain at least one grant type`})}function tde(e,t){return e.response_types?e.response_types:t.includes(`authorization_code`)?[`code`]:void 0}function I3(e,t=`web`){let n=F3(e);return{...e,token_endpoint_auth_method:e.token_endpoint_auth_method??`client_secret_basic`,application_type:e.application_type??(t===null?void 0:t),grant_types:n,response_types:tde(e,n)}}const nde=/* @__PURE__ */ new Set([`file:`,`ftp:`,`mailto:`,`javascript:`,`data:`,`vbscript:`]);function L3(e){throw new c(`BAD_REQUEST`,{error:`invalid_redirect_uri`,error_description:e})}function rde(e){let t=/^http:\/\/([^/?#]*)/i.exec(e)?.[1];if(!t)return null;let n=t.slice(t.lastIndexOf(`@`)+1);if(n.startsWith(`[`)){let e=n.indexOf(`]`);return e<0?null:n.slice(0,e+1).toLowerCase()}return(n.split(`:`)[0]??``).toLowerCase()}async function ide(e,t,n){let r=t.clientRegistrationDefaultResources??[],i=/* @__PURE__ */ new Set([...r,...t.clientRegistrationAllowedResources??[]]);for(let e of n)if(!i.has(e))throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${e} is not allowed for client registration`});let a=[.../* @__PURE__ */ new Set([...r,...n])];for(let n of a){let r=await r4(e,t,n);if(!r)throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} does not exist`});if(r.disabled)throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is disabled`})}return a}function ade(e,t){let n;try{n=new URL(e)}catch{L3(`redirect URI must be an absolute URI: ${e}`)}(e.includes(`#`)||n.username.length>0||n.password.length>0)&&L3(`redirect URI must not include credentials or a fragment: ${e}`);let r=n.protocol===`http:`,i=n.protocol===`https:`;/^localhost\.+$/i.test(n.hostname)&&L3(`redirect URI localhost must not include trailing dots: ${e}`);let a=oU(n.hostname)||n.hostname===`localhost`,o=rde(e),s=o===`localhost`||o===`127.0.0.1`||o===`[::1]`;if(t===`web`){(!i||a)&&L3(`web clients require https redirect URIs on non-loopback hosts: ${e}`);return}if(i){a&&L3(`native clients must not use https loopback redirect URIs: ${e}`);return}if(r){s||L3(`native clients may use http only on the exact loopback hosts localhost, 127.0.0.1, or [::1]: ${e}`);return}(nde.has(n.protocol)||!L2(n))&&L3(`native private-use redirect URI schemes must be well-formed reverse-domain names, omit the naming authority, and must not use a reserved scheme: ${e}`)}function ode(e){let t=y3(e);if(!t.valid)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:t.error})}async function sde(e,t){let n=e.body;if(!t.allowDynamicClientRegistration)throw new c(`FORBIDDEN`,{error:`access_denied`,error_description:`Client registration is disabled`});let r=await CH(e),i=r?void 0:await $ue(e,t,n),a=!!i;if(!(r||a||t.allowUnauthenticatedClientRegistration))throw new c(`UNAUTHORIZED`,{error_description:`Authentication required for client registration`},{"WWW-Authenticate":`Bearer`,...pL});if(!r&&!a&&n.grant_types?.includes(`client_credentials`))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`client_credentials grant requires authenticated registration`});let o=Array.isArray(n.resources)?n.resources.filter(e=>typeof e==`string`&&e.length>0):[];r&&await S3(e,r,t,`create`);let s=i?.referenceId??(r&&t.clientReference?await t.clientReference({user:r.user,session:r.session}):void 0),l=await U3(e,t,{metadata:n,registrationSource:`dynamic`,userId:s?void 0:r?.session.userId,referenceId:s,requestedResources:o});return e.setStatus(201),e.json(l)}async function R3(e,t,n){let r=n?.registrationSource===`clientMetadataDocument`,i=I3(e,r?null:`web`),a=i.token_endpoint_auth_method??`client_secret_basic`;if(!new Set(i2(t,{includeNone:!0})).has(a))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`unsupported token_endpoint_auth_method ${a}`});if(i.dpop_bound_access_tokens!==void 0&&typeof i.dpop_bound_access_tokens!=`boolean`)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`dpop_bound_access_tokens must be a boolean`});let o=i.grant_types??[],s=i.response_types,l=i.application_type;if(l!==void 0&&l!==`web`&&l!==`native`)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`application_type must be web or native`});if(o.includes(`authorization_code`)&&(!i.redirect_uris||i.redirect_uris.length===0))throw new c(`BAD_REQUEST`,{error:`invalid_redirect_uri`,error_description:`Redirect URIs are required for authorization_code and implicit grant types`});for(let e of i.redirect_uris??[])ade(e,l??(r?`native`:`web`));let u=new Set(n2(t));if(r){if(!o.some(e=>u.has(e)))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`no mutually supported grant_type among ${o.join(`, `)}`})}else for(let e of o)if(!u.has(e))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`unsupported grant_type ${e}`});if(o.includes(`authorization_code`)&&!s?.includes(`code`))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`When 'authorization_code' grant type is used, 'code' response type must be included`});if(!o.includes(`authorization_code`)&&s?.includes(`code`))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`When 'code' response type is used, 'authorization_code' grant type must be included`});if(i.subject_type!==void 0){if(i.subject_type!==`public`&&i.subject_type!==`pairwise`)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`subject_type must be "public" or "pairwise"`});if(i.subject_type===`pairwise`&&!t.pairwiseSecret)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise subject_type requires server pairwiseSecret configuration`});if(i.subject_type===`pairwise`&&i.redirect_uris&&i.redirect_uris.length>1&&new Set(i.redirect_uris.map(e=>new URL(e).host)).size>1)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise clients with redirect_uris on different hosts require a sector_identifier_uri, which is not yet supported. All redirect_uris must share the same host.`})}let d=(i?.scope)?.split(` `).filter(e=>e.length),f=n?.registrationSource===`dynamic`||n?.registrationSource===`clientMetadataDocument`,p=f?P3(t):t.scopes;if(p){let e=new Set(p);for(let t of d??[])if(!e?.has(t))throw new c(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`cannot request scope ${t}`})}if(f&&i.require_pkce===!1)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pkce is required for registered clients.`});if(i.jwks||i.jwks_uri){if(i.jwks&&i.jwks_uri)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks and jwks_uri are mutually exclusive`});if(i.jwks_uri)try{let e=new URL(i.jwks_uri);if(e.protocol!==`https:`)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must use HTTPS`});if(e.username||e.password)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not contain credentials`});if(i.jwks_uri.includes(`#`))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not include a fragment component`});if(k3(e.hostname))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not point to a private or reserved address`});if(n?.ctx&&!n.ctx.context.isTrustedOrigin(e.href)){let t=typeof i.client_id==`string`?i.client_id:void 0;if(!(r&&t!==void 0&&URL.canParse(t)&&new URL(t).origin===e.origin))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must belong to a trusted origin or the Client ID Metadata Document origin`})}}catch(e){throw e instanceof c?e:new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must be a valid URL`})}i.jwks&&ode(i.jwks)}if(a===`private_key_jwt`&&!i.jwks&&!i.jwks_uri)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`private_key_jwt requires either jwks or jwks_uri`});if(i.backchannel_logout_uri!==void 0){if(t.disableJwtPlugin)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri requires the jwt plugin (disableJwtPlugin must be false)`});let e;try{e=new URL(i.backchannel_logout_uri)}catch{throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must be an absolute URL`})}if(i.backchannel_logout_uri.includes(`#`))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not include a fragment component`});if(e.protocol!==`https:`)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must use https`});if(e.username||e.password)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not contain credentials`});if(k3(e.hostname))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not point to a private or reserved address`})}}const z3=Symbol(`client-registration-collision`);function B3(e){if(!e||typeof e!=`object`)return!1;let t=e;return t[z3]===!0&&(t.kind===`oauth-client-row-unique`||t.kind===`oauth-client-resource-link-unique`)&&`cause`in t}async function V3(e,t,n){let r=I3(n.registrationSource===`dynamic`&&!n.metadata.scope?{...n.metadata,scope:(t.clientRegistrationDefaultScopes??t.scopes)?.join(` `)}:n.metadata,n.registrationSource===`clientMetadataDocument`?null:`web`),i=r.token_endpoint_auth_method===`none`,a=r.token_endpoint_auth_method===`private_key_jwt`,o=a2(t,r.token_endpoint_auth_method);await R3(r,t,{registrationSource:n.registrationSource,ctx:e});let s=n.clientId??t.generateClientId?.()??AU(32,`a-z`,`A-Z`),l=i||a||o?void 0:t.generateClientSecret?.()||AU(32,`a-z`,`A-Z`),u=l?await v2(e,t,l):void 0,d=n.registrationSource===`dynamic`&&!i&&t.clientRegistrationRequirePKCE===!1,f=r.require_pkce??(!d&&void 0),p=Math.floor(Date.now()/1e3),{resources:m,...h}=n.registrationSource===`dynamic`||n.registrationSource===`clientMetadataDocument`?{...r,scope:P3(t).join(` `)}:r,g=n.registrationSource===`clientMetadataDocument`?void 0:{userId:n.userId,referenceId:n.referenceId},_=q3({...h,redirect_uris:r.redirect_uris??[],disabled:void 0,client_secret_expires_at:u?n.registrationSource===`dynamic`&&t.clientRegistrationClientSecretExpiration?M0(t.clientRegistrationClientSecretExpiration,p):0:void 0,client_id:s,client_secret:u,client_id_issued_at:p,require_pkce:f,user_id:g?.referenceId?void 0:g?.userId,reference_id:g?.referenceId});_.clientCredentialsScopes=n.registrationSource===`clientMetadataDocument`?n.existingClient?.clientCredentialsScopes??[]:n.registrationSource===`managed`?n.clientCredentialsScopes??[]:[],_.clientDiscoveryId=n.registrationSource===`clientMetadataDocument`?n.clientDiscoveryId:null,n.registrationSource===`clientMetadataDocument`&&r.application_type===void 0&&(_.applicationType=null);let v=await ide(e,t,n.registrationSource===`dynamic`?n.requestedResources??[]:[]),y=t.schema?.oauthClient?.modelName??`oauthClient`,b=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,x=n.registrationSource===`clientMetadataDocument`?n.existingClient:void 0,S=n.registrationSource===`clientMetadataDocument`?n.clientDiscoveryId:null,C=await qR(e.context.adapter,async()=>{let t=await GR(e.context.adapter),r,i=!1;if(x){let e=await t.update({model:y,where:[{field:`clientId`,value:s},{field:`clientDiscoveryId`,value:S}],update:{..._,disabled:x.disabled,skipConsent:x.skipConsent,enableEndSession:x.enableEndSession,createdAt:x.createdAt,updatedAt:/* @__PURE__ */ new Date(p*1e3)}});if(!e)throw new c(`BAD_REQUEST`,{error:`invalid_client`,error_description:`client no longer exists`});r=e}else{try{r=await t.create({model:y,data:{..._,createdAt:/* @__PURE__ */ new Date(p*1e3),updatedAt:/* @__PURE__ */ new Date(p*1e3)}})}catch(e){throw n.registrationSource===`clientMetadataDocument`&&G3(e)?{[z3]:!0,kind:`oauth-client-row-unique`,clientId:s,cause:e}:e}i=!0}let a=v.length===0?[]:await t.findMany({model:b,where:[{field:`clientId`,value:s}]}),o=new Set(a.map(e=>e.resourceId)),l=/* @__PURE__ */ new Date;for(let e of v)if(!o.has(e))try{await t.create({model:b,data:{clientId:s,resourceId:e,createdAt:l}})}catch(t){throw n.registrationSource===`clientMetadataDocument`&&G3(t)?{[z3]:!0,kind:`oauth-client-resource-link-unique`,clientId:s,resourceId:e,cause:t}:t}return{client:r,created:i}});return{client:C.client,clientSecret:l,resources:v,created:C.created}}function H3(e,t){let n=J3({...e.client,clientSecret:e.clientSecret?(t.prefix?.clientSecret??``)+e.clientSecret:void 0});return e.resources.length>0&&(n.resources=e.resources),n}function cde(e,t){return{...H3(e,t),client_credentials_scopes:[...e.client.clientCredentialsScopes??[]]}}async function U3(e,t,n){return H3(await V3(e,t,n),t)}async function lde(e,t,n){return cde(await V3(e,t,n),t)}function ude(e,t){if(e&&e.clientDiscoveryId!==t)throw new c(`BAD_REQUEST`,{error:`invalid_client`,error_description:`client_id is already owned by a different registration source`})}async function W3(e,t,n){if(ude(n.existingClient,n.clientDiscoveryId),n.metadata.backchannel_logout_uri!==void 0||n.metadata.backchannel_logout_session_required!==void 0)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`Client ID Metadata Documents cannot register a back-channel logout target`});if((n.metadata.token_endpoint_auth_method??`none`)!==`none`&&n.metadata.token_endpoint_auth_method!==`private_key_jwt`)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`Client ID Metadata Document clients cannot use a shared secret`});let r={...n,metadata:{...n.metadata,token_endpoint_auth_method:n.metadata.token_endpoint_auth_method??`none`,client_secret:void 0,client_secret_expires_at:void 0},registrationSource:`clientMetadataDocument`};try{return await V3(e,t,r)}catch(i){if(!B3(i))throw i;let a=t.schema?.oauthClient?.modelName??`oauthClient`,o=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,s=await e.context.adapter.findOne({model:a,where:[{field:`clientId`,value:n.clientId}]});if(i.clientId!==n.clientId||!s||s.clientDiscoveryId!==n.clientDiscoveryId||i.kind===`oauth-client-resource-link-unique`&&!await e.context.adapter.findOne({model:o,where:[{field:`clientId`,value:i.clientId},{field:`resourceId`,value:i.resourceId}]}))throw i.cause;try{return await V3(e,t,{...r,existingClient:s})}catch(e){throw B3(e)?e.cause:e}}}function G3(e){if(!e||typeof e!=`object`)return!1;let t=e,n=String(t.code??t.errno??``);return[`1062`,`11000`,`23505`,`ER_DUP_ENTRY`,`P2002`,`SQLITE_CONSTRAINT_UNIQUE`].includes(n)||t.name===`MongoServerError`&&t.code===11e3?!0:typeof t.message==`string`&&/(?:duplicate|unique constraint|unique key)/i.test(t.message)}async function K3(e,t,n){let r=await CH(e);if(await S3(e,r,t,`create`),!r)throw new c(`UNAUTHORIZED`);let i=t.clientReference?await t.clientReference({user:r.user,session:r.session}):void 0,{client_credentials_scopes:a,...o}=e.body,s=n?.admin?d4(a??[]):[];f4(s,F3(o),o.token_endpoint_auth_method,t),s.length>0&&await S3(e,r,t,`configure-client-credentials-scopes`);let l={metadata:o,registrationSource:`managed`,userId:i?void 0:r.session.userId,referenceId:i,clientCredentialsScopes:s},u=n?.admin?await lde(e,t,l):await U3(e,t,l);return e.setStatus(201),e.json(u)}function q3(e){let{client_id:t,client_secret:n,client_secret_expires_at:r,scope:i,user_id:a,client_id_issued_at:o,client_name:s,client_uri:c,logo_uri:l,contacts:u,tos_uri:d,policy_uri:f,jwks:p,jwks_uri:m,software_id:h,software_version:g,software_statement:_,redirect_uris:v,post_logout_redirect_uris:y,backchannel_logout_uri:b,backchannel_logout_session_required:x,token_endpoint_auth_method:S,grant_types:C,response_types:w,application_type:T,disabled:ee,skip_consent:te,enable_end_session:E,require_pkce:ne,dpop_bound_access_tokens:re,subject_type:ie,reference_id:ae,metadata:oe}=e,D=r?/* @__PURE__ */ new Date(Number(r)*1e3):void 0,se=o?/* @__PURE__ */ new Date(o*1e3):void 0,ce=i?.split(` `),le=x3(oe??{}),ue=le&&Object.keys(le).length?JSON.stringify(le):void 0;return{clientId:t,clientSecret:n,disabled:ee,scopes:ce,userId:a,createdAt:se,expiresAt:D,name:s,uri:c,icon:l,contacts:u,tos:d,policy:f,softwareId:h,softwareVersion:g,softwareStatement:_,redirectUris:v,postLogoutRedirectUris:y,backchannelLogoutUri:b,backchannelLogoutSessionRequired:x,tokenEndpointAuthMethod:S,grantTypes:C,responseTypes:w,jwks:p?JSON.stringify(p):void 0,jwksUri:m,applicationType:T,skipConsent:te,enableEndSession:E,requirePKCE:ne,dpopBoundAccessTokens:re,subjectType:ie,referenceId:ae,metadata:ue}}function J3(e){let{clientId:t,clientSecret:n,disabled:r,scopes:i,userId:a,createdAt:o,updatedAt:s,expiresAt:c,name:l,uri:u,icon:d,contacts:f,tos:p,policy:m,softwareId:h,softwareVersion:g,softwareStatement:_,redirectUris:v,postLogoutRedirectUris:y,backchannelLogoutUri:b,backchannelLogoutSessionRequired:x,tokenEndpointAuthMethod:S,grantTypes:C,responseTypes:w,applicationType:T,jwks:ee,jwksUri:te,skipConsent:E,enableEndSession:ne,requirePKCE:re,dpopBoundAccessTokens:ie,subjectType:ae,referenceId:oe,metadata:D}=e,se=c?Math.round(new Date(c).getTime()/1e3):void 0,ce=o?Math.round(new Date(o).getTime()/1e3):void 0,le=i?.join(` `);return{...x3(D2(D)),client_id:t,client_secret:n??void 0,client_secret_expires_at:n?se??0:void 0,scope:le??void 0,user_id:a??void 0,client_id_issued_at:ce??void 0,client_name:l??void 0,client_uri:u??void 0,logo_uri:d??void 0,contacts:f??void 0,tos_uri:p??void 0,policy_uri:m??void 0,jwks:ee?JSON.parse(ee):void 0,jwks_uri:te??void 0,software_id:h??void 0,software_version:g??void 0,software_statement:_??void 0,redirect_uris:v??[],post_logout_redirect_uris:y??void 0,backchannel_logout_uri:b??void 0,backchannel_logout_session_required:x??void 0,token_endpoint_auth_method:S??void 0,grant_types:C??void 0,response_types:w??void 0,application_type:T??void 0,disabled:r??void 0,skip_consent:E??void 0,enable_end_session:ne??void 0,require_pkce:re??void 0,dpop_bound_access_tokens:ie??void 0,subject_type:ae??void 0,reference_id:oe??void 0}}async function dde(e,t){let n=await CH(e);if(await S3(e,n,t,`read`),!n)throw new c(`UNAUTHORIZED`);let r=await m2(e,t,e.query.client_id);if(!r)throw new c(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(r.userId){if(r.userId!==n.user.id)throw new c(`UNAUTHORIZED`)}else if(r.referenceId&&t.clientReference){if(r.referenceId!==await t.clientReference(n))throw new c(`UNAUTHORIZED`)}else throw new c(`UNAUTHORIZED`);let i=J3(r);return i.client_secret=void 0,i}async function Y3(e,t,n){let r=await m2(e,t,n);if(!r||r.disabled)throw new c(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});return J3({clientId:r.clientId,name:r.name,uri:r.uri,contacts:r.contacts,icon:r.icon,tos:r.tos,policy:r.policy})}async function fde(e,t){let n=await CH(e);if(await S3(e,n,t,`list`),!n)throw new c(`UNAUTHORIZED`);let r=await t.clientReference?.(n);if(r)return await e.context.adapter.findMany({model:`oauthClient`,where:[{field:`referenceId`,value:r}]}).then(e=>e?e.map(e=>{let t=J3(e);return t.client_secret=void 0,t}):null);if(n.user.id)return await e.context.adapter.findMany({model:`oauthClient`,where:[{field:`userId`,value:n.user.id}]}).then(e=>e?e.map(e=>{let t=J3(e);return t.client_secret=void 0,t}):null);throw new c(`BAD_REQUEST`,{message:`either user_id or reference_id must be provided`})}async function pde(e,t){let n=await CH(e);if(await S3(e,n,t,`delete`),!n)throw new c(`UNAUTHORIZED`);let r=e.body.client_id;if(t.cachedTrustedClients?.has(r))throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`trusted clients must be updated manually`,error:`invalid_client`});let i=await m2(e,t,r);if(!i)throw new c(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(i.userId){if(i.userId!==n.user.id)throw new c(`UNAUTHORIZED`)}else if(i.referenceId&&t.clientReference){if(i.referenceId!==await t.clientReference(n))throw new c(`UNAUTHORIZED`)}else throw new c(`UNAUTHORIZED`);await e.context.adapter.delete({model:`oauthClient`,where:[{field:`clientId`,value:r}]})}async function X3(e,t,n){let r=await CH(e);if(await S3(e,r,t,`update`),!r)throw new c(`UNAUTHORIZED`);let i=e.body.client_id;if(t.cachedTrustedClients?.has(i))throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`trusted clients must be updated manually`,error:`invalid_client`});let a=await m2(e,t,i);if(!a)throw new c(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});let{client_credentials_scopes:o,...s}=e.body.update,l=a.userId?a.userId===r.user.id:a.referenceId&&t.clientReference?a.referenceId===await t.clientReference(r):!1,u=!l&&n?.admin&&o!==void 0&&Object.keys(s).length===0;if(!l&&!u)throw new c(`UNAUTHORIZED`);if(u&&await S3(e,r,t,`configure-client-credentials-scopes`),Object.keys(s).length===0&&o===void 0){let e=J3(a);return e.client_secret=void 0,n?.admin?{...e,client_credentials_scopes:[...a.clientCredentialsScopes??[]]}:e}let d=s.grant_types??a.grantTypes??[],f=s.token_endpoint_auth_method??a.tokenEndpointAuthMethod,p=o===void 0?void 0:d4(o);p!==void 0&&(f4(p,d,f,t),p.length>0&&!u&&await S3(e,r,t,`configure-client-credentials-scopes`)),await R3({...J3(a),...s},t,{ctx:e});let m={...q3(s)};!d.includes(`client_credentials`)||f===`none`?m.clientCredentialsScopes=[]:p!==void 0&&(m.clientCredentialsScopes=p),s.token_endpoint_auth_method&&(s.token_endpoint_auth_method===`private_key_jwt`?m.clientSecret=null:(m.jwks=null,m.jwksUri=null,m.clientSecret||=await v2(e,t,t.generateClientSecret?.()||AU(32,`a-z`,`A-Z`))));let h=await e.context.adapter.update({model:`oauthClient`,where:[{field:`clientId`,value:i}],update:{...m,updatedAt:/* @__PURE__ */ new Date(Math.floor(Date.now()/1e3)*1e3)}});if(!h)throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`unable to update client`,error:`invalid_client`});let g=J3(h);return g.client_secret=void 0,n?.admin?{...g,client_credentials_scopes:[...h.clientCredentialsScopes??[]]}:g}async function mde(e,t){let n=await CH(e);if(await S3(e,n,t,`rotate`),!n)throw new c(`UNAUTHORIZED`);let r=e.body.client_id;if(t.cachedTrustedClients?.has(r))throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`trusted clients must be updated manually`,error:`invalid_client`});let i=await m2(e,t,r);if(!i)throw new c(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(i.userId){if(i.userId!==n.user.id)throw new c(`UNAUTHORIZED`)}else if(i.referenceId&&t.clientReference){if(i.referenceId!==await t.clientReference(n))throw new c(`UNAUTHORIZED`)}else throw new c(`UNAUTHORIZED`);if(i.tokenEndpointAuthMethod===`none`||!i.clientSecret)throw new c(`BAD_REQUEST`,{error_description:`secret rotation is only available for clients using client_secret authentication`,error:`invalid_client`});let a=t.generateClientSecret?.()||AU(32,`a-z`,`A-Z`),o=a?await v2(e,t,a):void 0,s=await e.context.adapter.update({model:`oauthClient`,where:[{field:`clientId`,value:r}],update:{clientSecret:o,updatedAt:/* @__PURE__ */ new Date(Math.floor(Date.now()/1e3)*1e3)}});if(!s)throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`unable to update client`,error:`invalid_client`});return J3({...s,clientSecret:(t.prefix?.clientSecret??``)+a})}const Z3=f().trim().min(1),Q3=_(f().trim().min(1)).min(1),hde=e=>Y(`/admin/oauth2/create-client`,{method:`POST`,body:D({redirect_uris:_(R2).min(1).optional(),scope:f().optional(),client_name:f().optional(),client_uri:f().optional(),logo_uri:f().optional(),contacts:_(f().min(1)).min(1).optional(),tos_uri:f().optional(),policy_uri:f().optional(),software_id:f().optional(),software_version:f().optional(),software_statement:f().optional(),post_logout_redirect_uris:_(R2).min(1).optional(),backchannel_logout_uri:R2.optional(),backchannel_logout_session_required:T().optional(),token_endpoint_auth_method:Z3.optional(),application_type:E([`web`,`native`]).optional(),jwks:m4.optional(),jwks_uri:f().optional(),grant_types:Q3.optional(),client_credentials_scopes:_(f().trim().min(1)).optional(),response_types:_(E([`code`])).optional(),client_secret_expires_at:n([f(),m()]).optional().default(0),skip_consent:T().optional(),enable_end_session:T().optional(),require_pkce:T().optional(),dpop_bound_access_tokens:T().optional(),subject_type:E([`public`,`pairwise`]).optional(),metadata:g(f(),se()).optional()}),metadata:{noStore:!0,SERVER_ONLY:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},client_credentials_scopes:{type:`array`,items:{type:`string`},description:`Server-authorized scope ceiling for client_credentials tokens`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`URI of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URI for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final server-owned resources linked to the client`},disabled:{type:`boolean`,description:`Whether the client is disabled`},require_pkce:{type:`boolean`,description:`Whether the client requires PKCE`,default:!0},metadata:{type:`object`,additionalProperties:!0,nullable:!0,description:`Additional metadata for the application`}},required:[`client_id`]}}}}}}}},async t=>K3(t,e,{admin:!0})),gde=e=>Y(`/oauth2/create-client`,{method:`POST`,use:[TH],body:D({redirect_uris:_(R2).min(1).optional(),scope:f().optional(),client_name:f().optional(),client_uri:f().optional(),logo_uri:f().optional(),contacts:_(f().min(1)).min(1).optional(),tos_uri:f().optional(),policy_uri:f().optional(),software_id:f().optional(),software_version:f().optional(),software_statement:f().optional(),post_logout_redirect_uris:_(R2).min(1).optional(),backchannel_logout_uri:R2.optional(),backchannel_logout_session_required:T().optional(),token_endpoint_auth_method:Z3.optional(),application_type:E([`web`,`native`]).optional(),jwks:m4.optional(),jwks_uri:f().optional(),grant_types:Q3.optional(),response_types:_(E([`code`])).optional(),dpop_bound_access_tokens:T().optional()}),metadata:{noStore:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`URI of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URI for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final server-owned resources linked to the client`},disabled:{type:`boolean`,description:`Whether the client is disabled`},metadata:{type:`object`,additionalProperties:!0,nullable:!0,description:`Additional metadata for the application`}},required:[`client_id`]}}}}}}}},async t=>K3(t,e)),_de=e=>Y(`/oauth2/get-client`,{method:`GET`,use:[TH],query:D({client_id:f()}),metadata:{openapi:{description:`Get OAuth2 formatted client details`}}},async t=>dde(t,e)),vde=e=>Y(`/oauth2/public-client`,{method:`GET`,use:[TH],query:D({client_id:f()}),metadata:{openapi:{description:`Gets publicly available client fields`}}},async t=>{let n=t.query.client_id;return Y3(t,e,n)}),yde=e=>Y(`/oauth2/public-client-prelogin`,{method:`POST`,use:[Iue(e)],body:D({client_id:f(),oauth_query:f().optional()}),metadata:{openapi:{description:`Gets publicly available client fields (prior to login)`}}},async t=>{let n=t.body.client_id;return Y3(t,e,n)}),bde=e=>Y(`/oauth2/get-clients`,{method:`GET`,use:[TH],metadata:{openapi:{description:`Get OAuth2 formatted client details for a user or organization`}}},async t=>fde(t,e)),xde=e=>Y(`/admin/oauth2/update-client`,{method:`PATCH`,body:D({client_id:f(),update:D({redirect_uris:_(R2).min(1).optional(),scope:f().optional(),client_name:f().optional(),client_uri:f().optional(),logo_uri:f().optional(),contacts:_(f().min(1)).min(1).optional(),tos_uri:f().optional(),policy_uri:f().optional(),software_id:f().optional(),software_version:f().optional(),software_statement:f().optional(),post_logout_redirect_uris:_(R2).min(1).optional(),backchannel_logout_uri:R2.optional(),backchannel_logout_session_required:T().optional(),application_type:E([`web`,`native`]).optional(),grant_types:Q3.optional(),client_credentials_scopes:_(f().trim().min(1)).optional(),response_types:_(E([`code`])).optional(),client_secret_expires_at:n([f(),m()]).optional(),skip_consent:T().optional(),enable_end_session:T().optional(),dpop_bound_access_tokens:T().optional(),metadata:g(f(),se()).optional()})}),metadata:{SERVER_ONLY:!0,openapi:{description:`Updates OAuth2 formatted client details.`}}},async t=>X3(t,e,{admin:!0})),Sde=e=>Y(`/oauth2/update-client`,{method:`POST`,use:[TH],body:D({client_id:f(),update:D({redirect_uris:_(R2).min(1).optional(),scope:f().optional(),client_name:f().optional(),client_uri:f().optional(),logo_uri:f().optional(),contacts:_(f().min(1)).min(1).optional(),tos_uri:f().optional(),policy_uri:f().optional(),software_id:f().optional(),software_version:f().optional(),software_statement:f().optional(),post_logout_redirect_uris:_(R2).min(1).optional(),backchannel_logout_uri:R2.optional(),backchannel_logout_session_required:T().optional(),application_type:E([`web`,`native`]).optional(),grant_types:Q3.optional(),response_types:_(E([`code`])).optional()})}),metadata:{openapi:{description:`Updates OAuth2 formatted client details.`}}},async t=>X3(t,e)),Cde=e=>Y(`/oauth2/client/rotate-secret`,{method:`POST`,use:[TH],body:D({client_id:f()}),metadata:{noStore:!0,openapi:{description:`Rotates a confidential client's secret`}}},async t=>mde(t,e)),wde=e=>Y(`/oauth2/delete-client`,{method:`POST`,use:[TH],body:D({client_id:f()}),metadata:{openapi:{description:`Deletes an oauth client`}}},async t=>pde(t,e));async function $3(e,t,n){return await e.context.adapter.findOne({model:`oauthConsent`,where:[{field:`id`,value:n}]})}async function Tde(e,t){let n=await CH(e);if(!n)throw new c(`UNAUTHORIZED`);let{id:r}=e.query;if(!r)throw new c(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await $3(e,t,r);if(!i)throw new c(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new c(`UNAUTHORIZED`);return i}async function Ede(e,t){let n=await CH(e);if(!n)throw new c(`UNAUTHORIZED`);return await e.context.adapter.findMany({model:`oauthConsent`,where:[{field:`userId`,value:n.user.id}]})}async function Dde(e,t){let n=await CH(e);if(!n)throw new c(`UNAUTHORIZED`);let{id:r}=e.body;if(!r)throw new c(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await $3(e,t,r);if(!i)throw new c(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new c(`UNAUTHORIZED`);await e.context.adapter.delete({model:`oauthConsent`,where:[{field:`id`,value:r}]})}async function Ode(e,t){let n=await CH(e);if(!n)throw new c(`UNAUTHORIZED`);let{id:r}=e.body;if(!r)throw new c(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await $3(e,t,r);if(!i)throw new c(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new c(`UNAUTHORIZED`);let a=await m2(e,t,i.clientId);if(!a)throw new c(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});let o=a?.scopes??t.scopes??[],s=e.body.update,l=s.scopes;if(l&&!l.every(e=>o?.includes(e)))throw new c(`BAD_REQUEST`,{error_description:`unable to provide scopes to ${a?.referenceId??a?.userId}`,error:`invalid_request`});let u=Math.floor(Date.now()/1e3);return await e.context.adapter.update({model:`oauthConsent`,where:[{field:`id`,value:r}],update:{...s,updatedAt:/* @__PURE__ */ new Date(u*1e3)}})}const kde=e=>Y(`/oauth2/get-consent`,{method:`GET`,query:D({id:f()}),use:[TH],metadata:{openapi:{description:`Gets details of a specific OAuth2 consent for a user`}}},async t=>Tde(t,e)),Ade=e=>Y(`/oauth2/get-consents`,{method:`GET`,use:[TH],metadata:{openapi:{description:`Gets all available OAuth2 consents for a user`}}},async t=>Ede(t,e)),jde=e=>Y(`/oauth2/update-consent`,{method:`POST`,use:[TH],body:D({id:f(),update:D({scopes:_(f())})}),metadata:{openapi:{description:`Updates consent granted to a client.`}}},async t=>Ode(t,e)),Mde=e=>Y(`/oauth2/delete-consent`,{method:`POST`,use:[TH],body:D({id:f()}),metadata:{openapi:{description:`Deletes consent granted to a client`}}},async t=>Dde(t,e));async function e6(e,t,n,r,i){if(!t)throw new c(`UNAUTHORIZED`);if(!e.headers)throw new c(`BAD_REQUEST`);if(n.resourcePrivileges&&!await n.resourcePrivileges({headers:e.headers,action:r,session:t.session,user:t.user,resourceId:i}))throw new c(`UNAUTHORIZED`)}const t6=e=>e.schema?.oauthResource?.modelName??`oauthResource`,n6=e=>e.schema?.oauthClientResource?.modelName??`oauthClientResource`,Nde=e=>e.schema?.oauthClient?.modelName??`oauthClient`;function r6(e){try{return decodeURIComponent(e)}catch{return e}}function Pde(e,t){return{identifier:e.identifier,name:e.name??e.identifier,accessTokenTtl:e.accessTokenTtl??null,refreshTokenTtl:e.refreshTokenTtl??null,signingAlgorithm:e.signingAlgorithm??null,signingKeyId:e.signingKeyId??null,allowedScopes:e.allowedScopes??null,customClaims:e.customClaims??null,dpopBoundAccessTokensRequired:e.dpopBoundAccessTokensRequired??!1,disabled:e.disabled??!1,policyVersion:1,metadata:e.metadata??null,createdAt:t,updatedAt:t}}async function Fde(e,t){await e6(e,await CH(e),t,`create`);let n=e.body;if(!n?.identifier)throw new c(`BAD_REQUEST`,{error:`invalid_request`,error_description:`identifier is required`});await lle(t,n.identifier);let r=/* @__PURE__ */ new Date,i;try{i=await e.context.adapter.create({model:t6(t),data:Pde(n,r)})}catch(e){let t=e instanceof Error?e.message:String(e);throw/unique|duplicate|UNIQUE/i.test(t)?new c(`BAD_REQUEST`,{error:`invalid_request`,error_description:`resource ${n.identifier} already exists`}):e}if(!i)throw new c(`BAD_REQUEST`,{error:`invalid_request`,error_description:`resource ${n.identifier} could not be created`});return n4(i.identifier),e.json(i,{status:201})}async function Ide(e,t){await e6(e,await CH(e),t,`list`);let n=await e.context.adapter.findMany({model:t6(t)});return e.json(n??[])}async function Lde(e,t){let n=r6(e.params.identifier);await e6(e,await CH(e),t,`read`,n);let r=await e.context.adapter.findOne({model:t6(t),where:[{field:`identifier`,value:n}]});if(!r)throw new c(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return e.json(r)}async function Rde(e,t){let n=r6(e.params.identifier);if(await e6(e,await CH(e),t,`update`,n),!await e.context.adapter.findOne({model:t6(t),where:[{field:`identifier`,value:n}]}))throw new c(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});let r={updatedAt:/* @__PURE__ */ new Date};for(let t of[`name`,`accessTokenTtl`,`refreshTokenTtl`,`signingAlgorithm`,`signingKeyId`,`allowedScopes`,`customClaims`,`dpopBoundAccessTokensRequired`,`disabled`,`metadata`])Object.prototype.hasOwnProperty.call(e.body,t)&&(r[t]=e.body[t]);await e.context.adapter.update({model:t6(t),where:[{field:`identifier`,value:n}],update:r}),n4(n);let i=await e.context.adapter.findOne({model:t6(t),where:[{field:`identifier`,value:n}]});if(!i)throw new c(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return e.json(i)}async function zde(e,t){let n=r6(e.params.identifier);if(await e6(e,await CH(e),t,`delete`,n),!await e.context.adapter.findOne({model:t6(t),where:[{field:`identifier`,value:n}]}))throw new c(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return await e.context.adapter.delete({model:t6(t),where:[{field:`identifier`,value:n}]}),n4(n),e.json({deleted:!0})}async function Bde(e,t){let n=await CH(e),r=r6(e.params.identifier),i=r6(e.params.client_id);if(await e6(e,n,t,`link`,r),!await e.context.adapter.findOne({model:t6(t),where:[{field:`identifier`,value:r}]}))throw new c(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${r} not found`});if(!await e.context.adapter.findOne({model:Nde(t),where:[{field:`clientId`,value:i}]}))throw new c(`NOT_FOUND`,{error:`not_found`,error_description:`client ${i} not found`});try{await e.context.adapter.create({model:n6(t),data:{clientId:i,resourceId:r,createdAt:/* @__PURE__ */ new Date}})}catch(t){let n=t instanceof Error?t.message:String(t);if(/unique|duplicate|UNIQUE/i.test(n))return e.json({linked:!0,alreadyLinked:!0});throw t}return e.json({linked:!0})}async function Vde(e,t){let n=await CH(e),r=r6(e.params.identifier),i=r6(e.params.client_id);return await e6(e,n,t,`unlink`,r),await e.context.adapter.deleteMany({model:n6(t),where:[{field:`clientId`,value:i},{field:`resourceId`,value:r}]}),e.json({unlinked:!0})}const i6=D({identifier:f().min(1).optional(),name:f().optional(),accessTokenTtl:m().int().positive().nullable().optional(),refreshTokenTtl:m().int().positive().nullable().optional(),signingAlgorithm:E(X2).nullable().optional(),signingKeyId:f().nullable().optional(),allowedScopes:_(f()).nullable().optional(),customClaims:g(f(),se()).nullable().optional(),dpopBoundAccessTokensRequired:T().optional(),disabled:T().optional(),metadata:g(f(),se()).nullable().optional()}),Hde=e=>Y(`/admin/oauth2/resources`,{method:`POST`,body:i6.required({identifier:!0}),metadata:{SERVER_ONLY:!0}},async t=>Fde(t,e)),Ude=e=>Y(`/admin/oauth2/resources`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async t=>Ide(t,e)),Wde=e=>Y(`/admin/oauth2/resources/:identifier`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async t=>Lde(t,e)),Gde=e=>Y(`/admin/oauth2/resources/:identifier`,{method:`PATCH`,body:i6,metadata:{SERVER_ONLY:!0}},async t=>Rde(t,e)),Kde=e=>Y(`/admin/oauth2/resources/:identifier`,{method:`DELETE`,metadata:{SERVER_ONLY:!0}},async t=>zde(t,e)),qde=e=>Y(`/admin/oauth2/resources/:identifier/clients/:client_id`,{method:`POST`,metadata:{SERVER_ONLY:!0}},async t=>Bde(t,e)),Jde=e=>Y(`/admin/oauth2/resources/:identifier/clients/:client_id`,{method:`DELETE`,metadata:{SERVER_ONLY:!0}},async t=>Vde(t,e));async function Yde(e,t,n){let r=t.disableJwtPlugin?void 0:c2(e.context),i=r?.options;try{let a=await JB(n,nV(await XK(n,{jwksFetch:i?.jwks?.remoteUrl?i.jwks.remoteUrl:async()=>(await r?.endpoints.getJwks(e))?.response,jwksCacheKey:r})),{issuer:i?.jwt?.issuer??e.context.baseURL}),o=`${e.context.baseURL}/oauth2/userinfo`;if(!a.payload.azp||!await Q2(e,t,a.payload.aud,[o]))return null}catch(e){if(e instanceof Error){if(e.name===`TypeError`||e.name===`JWSInvalid`)throw new d(`BAD_REQUEST`,{error_description:`invalid JWT signature`,error:`invalid_request`});if(e.name===`JWTExpired`||e.name===`JWTInvalid`)return null;throw e}throw Error(e)}throw new d(`BAD_REQUEST`,{error_description:`JWT access tokens are self-contained and cannot be revoked server-side`,error:`unsupported_token_type`})}async function Xde(e,t,n,r){let i=n;if(t.prefix?.opaqueAccessToken){if(i.startsWith(t.prefix.opaqueAccessToken))i=i.replace(t.prefix.opaqueAccessToken,``);else throw new d(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`})}let a=await e.context.adapter.findOne({model:`oauthAccessToken`,where:[{field:`token`,value:await b2(t.storeTokens,i,`access_token`)}]});if(!a)throw new d(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`});if(!a.clientId||a.clientId!==r)return null;a.id?await e.context.adapter.delete({model:`oauthAccessToken`,where:[{field:`id`,value:a.id}]}):await e.context.adapter.delete({model:`oauthAccessToken`,where:[{field:`token`,value:a.token}]})}async function Zde(e,t,n,r){let i=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await b2(t.storeTokens,n,`refresh_token`)}]});if(!i)throw new d(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`});if(i.revoked)throw await x4(e,r,i.userId),new d(`BAD_REQUEST`,{error_description:`refresh token revoked`,error:`invalid_request`});if(!i.clientId||i.clientId!==r)return null;let a=Math.floor(Date.now()/1e3);if(!await e.context.adapter.incrementOne({model:`oauthRefreshToken`,where:[{field:`id`,value:i.id},{field:`revoked`,operator:`eq`,value:null}],increment:{},set:{revoked:/* @__PURE__ */ new Date(a*1e3)}}))throw await x4(e,r,i.userId),new d(`BAD_REQUEST`,{error_description:`refresh token revoked`,error:`invalid_request`});await e.context.adapter.deleteMany({model:`oauthAccessToken`,where:[{field:`refreshId`,value:i.id}]})}async function Qde(e,t,n,r){try{return await Yde(e,t,r)}catch(e){if(e instanceof d){if(e.body?.error===`unsupported_token_type`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}try{return await Xde(e,t,r,n)}catch(e){if(!(e instanceof d))throw e instanceof Error?e:Error(`Unknown error validating access token`)}throw new d(`BAD_REQUEST`,{error_description:`Invalid access token`,error:`invalid_request`})}async function $de(e,t){let{token:n,token_type_hint:r}=e.body;r!==`access_token`&&r!==`refresh_token`&&(r=void 0);let{clientId:i,clientSecret:a,preVerified:o,authMethod:s}=O2(await k2(e,t,`${e.context.baseURL}/oauth2/revoke`));if(!i)throw new d(`UNAUTHORIZED`,{error_description:`missing required credentials`,error:`invalid_client`});if(typeof n==`string`&&(n=SK(n)),!n?.length)throw new d(`BAD_REQUEST`,{error_description:`missing a required token for introspection`,error:`invalid_request`});let c=await E2(e,t,i,a,void 0,o,void 0,s);try{if(r===void 0||r===`access_token`)try{return await Qde(e,t,c.clientId,n)}catch(e){if(e instanceof d){if(r===`access_token`||e.body?.error===`unsupported_token_type`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}if(r===void 0||r===`refresh_token`)try{return await Zde(e,t,(await b4(t,n)).token,c.clientId)}catch(e){if(e instanceof d){if(r===`refresh_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}throw new d(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`})}catch(e){if(e instanceof d){if(e.body?.error===`unsupported_token_type`)throw e;if(e.name===`BAD_REQUEST`)return null;throw e}throw e instanceof Error?(O.error(`Introspection error:`,e.message,e.stack),new d(`INTERNAL_SERVER_ERROR`)):(O.error(`Introspection error:`,e),new d(`INTERNAL_SERVER_ERROR`))}}const efe={oauthClient:{modelName:`oauthClient`,fields:{clientId:{type:`string`,unique:!0,required:!0},clientSecret:{type:`string`,required:!1},clientDiscoveryId:{type:`string`,required:!1},disabled:{type:`boolean`,defaultValue:!1,required:!1},skipConsent:{type:`boolean`,required:!1},enableEndSession:{type:`boolean`,required:!1},subjectType:{type:`string`,required:!1},scopes:{type:`string[]`,required:!1},clientCredentialsScopes:{type:`string[]`,required:!1,defaultValue:[]},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},createdAt:{type:`date`,required:!1},updatedAt:{type:`date`,required:!1},name:{type:`string`,required:!1},uri:{type:`string`,required:!1},icon:{type:`string`,required:!1},contacts:{type:`string[]`,required:!1},tos:{type:`string`,required:!1},policy:{type:`string`,required:!1},softwareId:{type:`string`,required:!1},softwareVersion:{type:`string`,required:!1},softwareStatement:{type:`string`,required:!1},redirectUris:{type:`string[]`,required:!0},postLogoutRedirectUris:{type:`string[]`,required:!1},backchannelLogoutUri:{type:`string`,required:!1},backchannelLogoutSessionRequired:{type:`boolean`,required:!1},tokenEndpointAuthMethod:{type:`string`,required:!1},applicationType:{type:`string`,required:!1},jwks:{type:`string`,required:!1},jwksUri:{type:`string`,required:!1},grantTypes:{type:`string[]`,required:!1},responseTypes:{type:`string[]`,required:!1},requirePKCE:{type:`boolean`,required:!1},dpopBoundAccessTokens:{type:`boolean`,required:!1,defaultValue:!1},referenceId:{type:`string`,required:!1},metadata:{type:`json`,required:!1}}},oauthResource:{modelName:`oauthResource`,fields:{identifier:{type:`string`,required:!0,unique:!0},name:{type:`string`,required:!0},accessTokenTtl:{type:`number`,required:!1},refreshTokenTtl:{type:`number`,required:!1},signingAlgorithm:{type:`string`,required:!1},signingKeyId:{type:`string`,required:!1},allowedScopes:{type:`string[]`,required:!1},customClaims:{type:`json`,required:!1},dpopBoundAccessTokensRequired:{type:`boolean`,required:!1,defaultValue:!1},disabled:{type:`boolean`,required:!1,defaultValue:!1},createdAt:{type:`date`,required:!1},updatedAt:{type:`date`,required:!1},policyVersion:{type:`number`,required:!1,defaultValue:1},metadata:{type:`json`,required:!1}}},oauthClientResource:{modelName:`oauthClientResource`,fields:{clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`,onDelete:`cascade`},index:!0},resourceId:{type:`string`,required:!0,references:{model:`oauthResource`,field:`identifier`,onDelete:`cascade`},index:!0},metadata:{type:`json`,required:!1},createdAt:{type:`date`,required:!1}},indexes:[{fields:[`clientId`,`resourceId`],unique:!0}]},oauthRefreshToken:{fields:{token:{type:`string`,required:!0,unique:!0},clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},sessionId:{type:`string`,required:!1,references:{model:`session`,field:`id`,onDelete:`set null`},index:!0},userId:{type:`string`,required:!0,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},authorizationCodeId:{type:`string`,required:!1,index:!0},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},expiresAt:{type:`date`},createdAt:{type:`date`},revoked:{type:`date`,required:!1},rotatedAt:{type:`date`,required:!1},rotationReplayResponse:{type:`string`,required:!1},rotationReplayExpiresAt:{type:`date`,required:!1},authTime:{type:`date`,required:!1},confirmation:{type:`json`,required:!1},scopes:{type:`string[]`,required:!0}}},oauthAccessToken:{modelName:`oauthAccessToken`,fields:{token:{type:`string`,unique:!0},clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},sessionId:{type:`string`,required:!1,references:{model:`session`,field:`id`,onDelete:`set null`},index:!0},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},authorizationCodeId:{type:`string`,required:!1,index:!0},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},refreshId:{type:`string`,required:!1,references:{model:`oauthRefreshToken`,field:`id`},index:!0},expiresAt:{type:`date`},createdAt:{type:`date`},revoked:{type:`date`,required:!1},confirmation:{type:`json`,required:!1},scopes:{type:`string[]`,required:!0}}},oauthConsent:{modelName:`oauthConsent`,fields:{clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},scopes:{type:`string[]`,required:!0},createdAt:{type:`date`},updatedAt:{type:`date`}}},oauthClientAssertion:{modelName:`oauthClientAssertion`,fields:{expiresAt:{type:`date`,required:!0}}}},a6=[`openid`,`profile`,`email`,`offline_access`],o6=D({id_token_hint:f().optional(),client_id:f().optional(),post_logout_redirect_uri:R2.optional(),state:f().optional()}),s6=UR(()=>null),c6=s6.get,l6=/* @__PURE__ */ new WeakMap,u6=`signedQueryIssuedAtMs`;function tfe(e){let t=typeof e==`number`?e:typeof e==`string`?Number(e):void 0;if(!(!t||!Number.isFinite(t)||t<=0))return new Date(t)}const d6=e=>{let t=e.clientRegistrationAllowedScopes;if(e.clientRegistrationDefaultScopes){let n=t?/* @__PURE__ */ new Set([...t,...e.clientRegistrationDefaultScopes]):/* @__PURE__ */ new Set([...e.clientRegistrationDefaultScopes]);t=Array.from(n)}let r=new Set((e.scopes??a6).filter(e=>e.length));if(t){for(let e of t)if(!r.has(e))throw new l(`clientRegistrationAllowedScope ${e} not found in scopes`)}for(let t of e.advertisedMetadata?.scopes_supported??[])if(!r?.has(t))throw new l(`advertisedMetadata.scopes_supported ${t} not found in scopes`);let i=new Set((e.resources??[]).map(e=>typeof e==`string`?e:e.identifier));for(let[t,n]of[[`clientRegistrationDefaultResources`,e.clientRegistrationDefaultResources],[`clientRegistrationAllowedResources`,e.clientRegistrationAllowedResources]])for(let e of n??[])if(!i.has(e))throw new l(`${t} resource ${e} not found in resources`);let a=/* @__PURE__ */ new Set([`sub`,`iss`,`aud`,`exp`,`iat`,`sid`,`scope`,`azp`,...q2.filter(e=>r.has(K2[e].scope))]),o={codeExpiresIn:600,accessTokenExpiresIn:3600,m2mAccessTokenExpiresIn:3600,refreshTokenExpiresIn:2592e3,refreshTokenReuseInterval:0,allowUnauthenticatedClientRegistration:!1,allowDynamicClientRegistration:!1,disableJwtPlugin:!1,storeClientSecret:e.disableJwtPlugin?`encrypted`:`hashed`,storeTokens:`hashed`,grantTypes:[`authorization_code`,`client_credentials`,`refresh_token`],...e,scopes:Array.from(r),claims:Array.from(a),clientRegistrationAllowedScopes:t};if($0(o.extensions),o.pairwiseSecret&&o.pairwiseSecret.length<32)throw new l(`pairwiseSecret must be at least 32 characters long for adequate HMAC-SHA256 security`);if(o.grantTypes&&o.grantTypes.includes(`refresh_token`)&&!o.grantTypes.includes(`authorization_code`))throw new l(`refresh_token grant requires authorization_code grant`);if(o.disableJwtPlugin&&(o.storeClientSecret===`hashed`||typeof o.storeClientSecret==`object`&&`hash`in o.storeClientSecret))throw new l(`unable to store hashed secrets because id tokens will be signed with secret`);if(!o.disableJwtPlugin&&(o.storeClientSecret===`encrypted`||typeof o.storeClientSecret==`object`&&(`encrypt`in o.storeClientSecret||`decrypt`in o.storeClientSecret)))throw new l(`encryption method not recommended, please use 'hashed' or the 'hash' function`);let s=async(e,t)=>{let n=new URL(e.url).pathname,r=t.options.advanced?.skipTrailingSlashes?n.replace(/\/+$/,``)||`/`:n,i=o.disableJwtPlugin?t.baseURL:c2(t)?.options?.jwt?.issuer??t.baseURL,a=`/`;try{a=new URL(i).pathname.replace(/\/$/,``)||``}catch{a=new URL(t.baseURL).pathname.replace(/\/$/,``)||``}let s={context:t},c=/* @__PURE__ */ new Set([`/.well-known/oauth-authorization-server${a}`,`${a}/.well-known/oauth-authorization-server`]),l=`${a}/.well-known/openid-configuration`,u=c.has(r),d=o.scopes?.includes(`openid`)&&r===l,f=t=>{let n=d3(t);return e.method===`HEAD`?new Response(null,{status:n.status,headers:n.headers}):n};if((u||d)&&e.method!==`GET`&&e.method!==`HEAD`)return{response:new Response(null,{status:405,headers:{Allow:`GET, HEAD`}})};if(u)return o.scopes?.includes(`openid`)?{response:f(u3(s,o))}:{response:f(l3(s,o))};if(d)return{response:f(u3(s,o))}},u=f3(`/oauth2/authorize`,{method:[`GET`,`POST`],body:D({}).passthrough(),redirectOnError:x6(o),metadata:{allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Authorize an OAuth 2.1 request from query parameters or an application/x-www-form-urlencoded POST body`,parameters:[{name:`response_type`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 response type (e.g., 'code')`},{name:`client_id`,in:`query`,required:!0,schema:{type:`string`},description:`OAuth 2.1 client ID`},{name:`redirect_uri`,in:`query`,required:!1,schema:{type:`string`,format:`uri`},description:`OAuth 2.1 redirect URI`},{name:`scope`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 scopes (space-separated)`},{name:`state`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 state parameter`},{name:`request_uri`,in:`query`,required:!1,schema:{type:`string`},description:`Pushed Authorization Request URI referencing stored parameters`},{name:`code_challenge`,in:`query`,required:!1,schema:{type:`string`},description:`PKCE code challenge`},{name:`code_challenge_method`,in:`query`,required:!1,schema:{type:`string`},description:`PKCE code challenge method`},{name:`nonce`,in:`query`,required:!1,schema:{type:`string`},description:`OpenID Connect nonce`},{name:`max_age`,in:`query`,required:!1,schema:{type:`integer`,minimum:0},description:`Maximum authentication age in seconds; forces re-authentication when exceeded`},{name:`resource`,in:`query`,required:!1,schema:{type:`array`,items:{type:`string`}},description:`Requested protected resource(s) for the access token. May be supplied multiple times as repeated 'resource' query parameters (RFC 8707) or as an array of strings.`},{name:`prompt`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth2 prompt parameter`}],responses:{302:{description:`Redirect to client with code or error`,headers:{Location:{description:`Redirect URI with code or error`,schema:{type:`string`,format:`uri`}}}},400:{description:`Invalid request`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},state:{type:`string`}},required:[`error`]}}}}}}}},async e=>lfe(e,o,e.authorizeSettings??{isAuthorize:!0})),d=(e,t)=>VJ(u,{...e,asResponse:!1,returnHeaders:!1,returnStatus:!1,authorizeSettings:t??{}});return{id:`oauth-provider`,version:`1.7.5`,options:o,onRequest:s,init:async e=>{if(e.options.secondaryStorage&&e.options.session?.storeSessionInDatabase!==!0)throw new l("OAuth Provider requires `session.storeSessionInDatabase: true` when using secondaryStorage");if(await s4(e,o),xle(o),!o.disableJwtPlugin){let t=c2(e)?.options,n=t?.jwt?.issuer??e.baseURL,r=t?.jwt?.issuer==null&&typeof e.options.baseURL==`object`&&e.options.baseURL!==null&&`allowedHosts`in e.options.baseURL;try{new URL(n)}catch(e){if(!r||n!==``)throw e}}return{options:{databaseHooks:{session:{delete:{async before(e,t){if(!t)return;let n=await yue(t,o,{sessionId:e.id,userId:e.userId});if(!n)return;let r=l6.get(t)??/* @__PURE__ */ new Map;r.set(e.id,n),l6.set(t,r)},async after(e,t){if(!t)return;let n=l6.get(t);if(!n)return;let r=n.get(e.id);if(n.delete(e.id),n.size===0&&l6.delete(t),!r)return;let i=bue(t,r).catch(e=>{t.context.logger.error(`Back-channel logout failed after session deletion`,e)});await t.context.runInBackgroundOrAwait(i)}}}}}}},hooks:{before:[{matcher(e){return e.body?.oauth_query},handler:gL(async e=>{let t=e.body.oauth_query;if(!await p2(t,e.context.secret))throw new c(`BAD_REQUEST`,{error:`invalid_signature`});let n=Sce(t),r=new URLSearchParams(t),i=r.get(`ba_pl`)??void 0;r.delete(`sig`),r.delete(`exp`),r.delete(G0),r.delete(K0),await s6.set({query:r.toString(),signedQueryIssuedAt:n??void 0,postLoginClearedForSession:i}),e.path===`/sign-in/social`&&await ez({query:r.toString(),...n?{[u6]:n.getTime()}:{}})})}],after:[{matcher(e){return DV(e.context.responseHeaders?.get(`set-cookie`)||``).has(e.context.authCookies.sessionToken.name)},handler:gL(async e=>{let t=DV(e.context.responseHeaders?.get(`set-cookie`)||``).get(e.context.authCookies.sessionToken.name)?.value.split(`.`)[0];if(!t)return;let n=await s6.get(),r=(await ZR())?.serverContext,i=n?.query??r?.query;if(!i)return;let a=new URLSearchParams(i),o=await e.context.internalAdapter.findSession(t);if(!o)return;e.context.session=o;let s=e.request?.headers?.get(`sec-fetch-mode`)?.toLowerCase(),c=e.request?.headers?.get(`accept`)?.toLowerCase()??``;s===`navigate`||!s&&(c.includes(`text/html`)||c.includes(`application/xhtml+xml`))||e.headers?.set(`accept`,`application/json`);let l=n?.signedQueryIssuedAt??tfe(r?.[u6]),u=P2(a,`login`);return N2(o.session.createdAt,l)&&(u=F2(u)),e.query=M2(u),await d(e)})}]},endpoints:{getOAuthServerConfig:Y(`/.well-known/oauth-authorization-server`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async e=>o.scopes&&o.scopes.includes(`openid`)?u3(e,o):l3(e,o)),getOpenIdConfig:Y(`/.well-known/openid-configuration`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async e=>{if(o.scopes&&!o.scopes.includes(`openid`))throw new c(`NOT_FOUND`);return u3(e,o)}),oauth2Authorize:u,oauth2Consent:Y(`/oauth2/consent`,{method:`POST`,body:D({accept:T().meta({description:`Accept or deny user consent for a set of scopes`}),scope:f().optional().meta({description:`List of accept of accepted space-separated scopes. If none is provided, then all originally requested scopes are accepted.`}),claims:U2.optional().meta({description:`Accepted OIDC claims request object. If none is provided, then all originally requested claims are accepted.`}),oauth_query:f().optional().meta({description:`The redirected page's query parameters`})}),use:[TH],metadata:{openapi:{description:`Handle OAuth2 consent`,responses:{200:{description:`Consent processed successfully`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`The URI to redirect to, either with an authorization code or an error`}},required:[`redirect_uri`]}}}}}}}},async e=>pue(e,o,d)),oauth2Continue:Y(`/oauth2/continue`,{method:`POST`,body:D({selected:T().optional().meta({description:`Confirms an account has been selected and authorization can proceed.`}),created:T().optional().meta({description:`Confirms an account was registered`}),postLogin:T().optional().meta({description:`Confirms organization and/or team selection.`}),oauth_query:f().optional().meta({description:`The redirected page's query parameters`})}),use:[TH],metadata:{openapi:{description:`Continues OAuth2 authorization flow`,responses:{200:{description:`Consent processed successfully`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`The URI to redirect to, either with an authorization code or an error`}},required:[`redirect_uri`]}}}}}}}},async e=>mue(e,d)),oauth2Token:f3(`/oauth2/token`,{method:`POST`,cloneRequest:!0,body:D({grant_type:f().trim().min(1),client_id:f().optional(),client_secret:f().optional(),client_assertion:f().optional(),client_assertion_type:f().optional(),code:f().optional(),code_verifier:f().optional(),redirect_uri:R2.optional(),refresh_token:f().optional(),resource:n([p4,_(p4).min(1)]).optional(),scope:f().optional()}).passthrough(),errorCodesByField:{grant_type:{missing:`invalid_request`,invalid:`unsupported_grant_type`},resource:{invalid:`invalid_target`}},metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Obtain an OAuth2.1 access token`,parameters:[{name:`DPoP`,in:`header`,required:!1,schema:{type:`string`},description:`RFC 9449 DPoP proof JWT for issuing DPoP-bound tokens`}],requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{grant_type:{type:`string`,description:`OAuth2 grant type`},client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},code:{type:`string`,description:`Authorization code (for authorization_code grant)`},code_verifier:{type:`string`,description:`PKCE code verifier (for authorization_code grant)`},redirect_uri:{type:`string`,format:`uri`,description:`Redirect URI (for authorization_code grant)`},refresh_token:{type:`string`,description:`Refresh token (for refresh_token grant)`},resource:{oneOf:[{type:`string`,description:`Single resource (URL)`},{type:`array`,items:{type:`string`},description:`Multiple resources (URLs)`}],description:`Requested protected resource(s) for the access token`},scope:{type:`string`,description:`Requested scopes (for client_credentials grant)`}},required:[`grant_type`]}}}},responses:{200:{description:`Access token response`,content:{"application/json":{schema:{type:`object`,properties:{access_token:{type:`string`,description:`The access token issued by the authorization server`},token_type:{type:`string`,description:`The type of the token issued`,enum:[`Bearer`,`DPoP`]},expires_in:{type:`number`,description:`Lifetime in seconds of the access token`},refresh_token:{type:`string`,description:`Refresh token, if issued`},scope:{type:`string`,description:`Scopes granted by the access token`},id_token:{type:`string`,description:`ID Token (if OpenID Connect)`}},required:[`access_token`,`token_type`,`expires_in`]}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>{if(e.request){let t=await dle(e.request);t&&t.length>1&&(e.body.resource=t)}return Fle(e,o)}),oauth2Introspect:f3(`/oauth2/introspect`,{method:`POST`,cloneRequest:!0,body:D({client_id:f().optional(),client_secret:f().optional(),client_assertion:f().optional(),client_assertion_type:f().optional(),token:f(),token_type_hint:f().optional()}),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Introspect an OAuth2 access or refresh token`,requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},token:{type:`string`,description:`The token to introspect (access or refresh token)`},token_type_hint:{type:`string`,description:"Hint about the token type. Recognized values: `access_token`, `refresh_token`."}},required:[`token`]}}}},responses:{200:{description:`Token introspection response`,content:{"application/json":{schema:{type:`object`,properties:{active:{type:`boolean`,description:`Whether the token is active`},scope:{type:`string`,description:`Scopes associated with the token`},client_id:{type:`string`,description:`Client ID associated with the token`},username:{type:`string`,description:`Username associated with the token`},token_type:{type:`string`,description:`Type of the token`},exp:{type:`number`,description:`Expiration time of the token (seconds since epoch)`},iat:{type:`number`,description:`Issued at time (seconds since epoch)`},nbf:{type:`number`,description:`Not before time (seconds since epoch)`},sub:{type:`string`,description:`Subject of the token`},aud:{type:`string`,description:`Audience of the token`},iss:{type:`string`,description:`Issuer of the token`},jti:{type:`string`,description:`JWT ID`}},required:[`active`]}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>V4(e,o)),oauth2Revoke:f3(`/oauth2/revoke`,{method:`POST`,cloneRequest:!0,body:D({client_id:f().optional(),client_secret:f().optional(),client_assertion:f().optional(),client_assertion_type:f().optional(),token:f(),token_type_hint:f().optional()}),metadata:{allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Revoke an OAuth2 access or refresh token`,requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},token:{type:`string`,description:`The token to revoke (access or refresh token)`},token_type_hint:{type:`string`,description:"Hint about the token type. Recognized values: `access_token`, `refresh_token`."}},required:[`token`]}}}},responses:{200:{description:`Token revoked successfully. The response body is empty.`,content:{"application/json":{schema:{type:`object`,description:`Empty object on success`}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>$de(e,o)),oauth2UserInfo:Y(`/oauth2/userinfo`,{method:[`GET`,`POST`],body:D({access_token:f().optional()}).passthrough().optional(),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Get OpenID Connect user information (UserInfo endpoint)`,security:[{bearerAuth:[]},{OAuth2:[`openid`,`profile`,`email`]}],parameters:[{name:`Authorization`,in:`header`,required:!1,schema:{type:`string`},description:`Bearer or DPoP access token`},{name:`DPoP`,in:`header`,required:!1,schema:{type:`string`},description:`RFC 9449 DPoP proof JWT when using a DPoP-bound access token`}],responses:{200:{description:`User information retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{sub:{type:`string`,description:`Subject identifier (user ID)`},email:{type:`string`,format:`email`,nullable:!0,description:`User's email address, included if 'email' scope is granted`},name:{type:`string`,nullable:!0,description:`User's full name, included if 'profile' scope is granted`},picture:{type:`string`,format:`uri`,nullable:!0,description:`User's profile picture URL, included if 'profile' scope is granted`},given_name:{type:`string`,nullable:!0,description:`User's given name, included if 'profile' scope is granted`},family_name:{type:`string`,nullable:!0,description:`User's family name, included if 'profile' scope is granted`},email_verified:{type:`boolean`,nullable:!0,description:`Whether the email is verified, included if 'email' scope is granted`}},required:[`sub`]}}}},401:{description:`Unauthorized - invalid or missing access token`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`}},required:[`error`]}}}},403:{description:`Forbidden - insufficient scope`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`}},required:[`error`]}}}}}}}},async e=>Nle(e,o)),oauth2EndSession:f3(`/oauth2/end-session`,{method:[`GET`,`POST`],body:o6.optional(),query:o6.optional(),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`,`application/json`],$Infer:{body:{},query:{}},openapi:{description:`RP-Initiated Logout endpoint. Accepts standard logout parameters through GET or an application/x-www-form-urlencoded POST body, plus JSON for Better Auth generated-client calls. Requests without a usable id_token_hint may require explicit OP confirmation.`,responses:{200:{description:`Logout completed, or an HTML confirmation page was returned for browser navigation. A redirect is used only for an exact registered post_logout_redirect_uri.`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`URI to redirect to after logout (if post_logout_redirect_uri was provided)`},message:{type:`string`,description:`Success message`}}}},"text/html":{schema:{type:`string`}}}}}}}},async e=>jue(e,o)),oauth2EndSessionConfirmation:f3(`/oauth2/end-session/confirm`,{method:`POST`,body:D({action:ee(`confirm`)}),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],scope:`http`}},async e=>Mue(e,o)),registerOAuthClient:f3(`/oauth2/register`,{method:`POST`,body:g4,errorCodesByField:{redirect_uris:`invalid_redirect_uri`,post_logout_redirect_uris:`invalid_redirect_uri`,software_statement:`invalid_software_statement`,resources:`invalid_target`},defaultError:`invalid_client_metadata`,metadata:{noStore:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`Name of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URL for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},post_logout_redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed logout redirect uris`},backchannel_logout_uri:{type:`string`,format:`uri`,description:`RP URL to receive signed Logout Tokens when the end-user's OP session terminates`},backchannel_logout_session_required:{type:`boolean`,description:"Whether the RP requires a `sid` claim in every Logout Token"},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final resource identifiers linked to the registered client`},disabled:{type:`boolean`,description:`Whether the client is disabled`}},required:[`client_id`]}}}}}}}},async e=>sde(e,o)),adminCreateOAuthClient:hde(o),createOAuthClient:gde(o),getOAuthClient:_de(o),getOAuthClientPublic:vde(o),getOAuthClientPublicPrelogin:yde(o),getOAuthClients:bde(o),adminUpdateOAuthClient:xde(o),updateOAuthClient:Sde(o),rotateClientSecret:Cde(o),deleteOAuthClient:wde(o),getOAuthConsent:kde(o),getOAuthConsents:Ade(o),updateOAuthConsent:jde(o),deleteOAuthConsent:Mde(o),adminCreateOAuthResource:Hde(o),adminListOAuthResources:Ude(o),adminGetOAuthResource:Wde(o),adminUpdateOAuthResource:Gde(o),adminDeleteOAuthResource:Kde(o),adminLinkClientResource:qde(o),adminUnlinkClientResource:Jde(o)},schema:bz(structuredClone(efe),o?.schema),rateLimit:[...o.rateLimit?.token===!1?[]:[{pathMatcher:e=>e===`/oauth2/token`,window:o.rateLimit?.token?.window??60,max:o.rateLimit?.token?.max??20}],...o.rateLimit?.authorize===!1?[]:[{pathMatcher:e=>e===`/oauth2/authorize`,window:o.rateLimit?.authorize?.window??60,max:o.rateLimit?.authorize?.max??30}],...o.rateLimit?.introspect===!1?[]:[{pathMatcher:e=>e===`/oauth2/introspect`,window:o.rateLimit?.introspect?.window??60,max:o.rateLimit?.introspect?.max??100}],...o.rateLimit?.revoke===!1?[]:[{pathMatcher:e=>e===`/oauth2/revoke`,window:o.rateLimit?.revoke?.window??60,max:o.rateLimit?.revoke?.max??30}],...o.rateLimit?.register===!1?[]:[{pathMatcher:e=>e===`/oauth2/register`,window:o.rateLimit?.register?.window??60,max:o.rateLimit?.register?.max??5}],...o.rateLimit?.userinfo===!1?[]:[{pathMatcher:e=>e===`/oauth2/userinfo`,window:o.rateLimit?.userinfo?.window??60,max:o.rateLimit?.userinfo?.max??60}]]}};function nfe(e,t,n){return t!==0&&n.getTime()-e.getTime()<=t*1e3}function rfe(e){let{max_age:t,...n}=e;return n}function f6(e,t,n,r,i,a=`query`){let o=new URLSearchParams({error:t,error_description:n});return r&&o.append(`state`,r),i&&o.append(`iss`,i),a===`fragment`?`${e}#${o.toString()}`:ZL(e,o)}function ife(e){let t=typeof e.response_mode==`string`?e.response_mode:void 0;if(t===`fragment`)return`fragment`;if(t===`query`)return`query`;let n=typeof e.response_type==`string`?e.response_type:void 0;return n&&/\b(token|id_token)\b/.test(n)?`fragment`:`query`}const afe={response_type:{invalid:`unsupported_response_type`},resource:{invalid:`invalid_target`}};function ofe(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function p6(e){return typeof e==`string`?e:void 0}function sfe(e,t){let n=e.method===`POST`&&t?.isAuthorize===!0?e.body:e.query;return{...ofe(n)?n:{}}}const m6=(e,t)=>{let n=H4(e.request?.headers),r=e.headers?.get(`accept`)?.includes(`application/json`);if(n||r)return{redirect:!0,url:t.toString()};throw e.redirect(t)};function h6(e,t,n,r,i){return m6(e,f6(n.redirect_uri,r,i,n.state,_6(e,t)))}function g6(e){try{let t=new URL(e);return t.protocol!==`https:`&&!sU(t.host)&&(t.protocol=`https:`),t.search=``,t.hash=``,t.toString().replace(/\/$/,``)}catch{return e}}function _6(e,t){let n;if(t.disableJwtPlugin)n=e.context.baseURL;else try{n=c2(e.context).options?.jwt?.issuer??e.context.baseURL}catch{n=e.context.baseURL}return g6(n)}function v6(e,t,n){return f6(e.context.options.onAPIError?.errorURL||`${e.context.baseURL}/error`,t,n)}function y6(e){let t;try{t=new URL(e)}catch{return}let n=oU(t.hostname)||t.hostname===`localhost`;if(t.protocol!==`http:`||!n)return;let r=e.indexOf(`://`);if(r<0)return;let i=r+3,a=e.slice(i).search(/[/?#]/u),o=e.length;a>=0&&(o=i+a);let s=e.slice(i,o),c;if(s.startsWith(`[`)){let t=s.indexOf(`]`);if(t<0)return;if(s[t+1]!==`:`)return e;c=t+1}else if(c=s.lastIndexOf(`:`),c<0)return e;let l=s.slice(c+1);if(!/^\d*$/u.test(l))return;let u=i+c;return`${e.slice(0,u)}${e.slice(o)}`}function b6(e,t){if(!e||!t)return;let n;try{n=new URL(t)}catch{return}let r=t.includes(`#`),i=n.username.length>0||n.password.length>0;if(r||i)return;let a=y6(t);return e.find(e=>e===t?!0:a?y6(e)===a:!1)}async function cfe(e,t,n,r){if(!n||!r)return null;let i;try{i=await m2(e,t,n)}catch{return null}return!i||i.disabled?null:b6(i.redirectUris,r)?r:null}function x6(e){return async({error:t,error_description:n,ctx:r})=>{let i=r.query??{},a=await cfe(r,e,typeof i.client_id==`string`?i.client_id:void 0,typeof i.redirect_uri==`string`?i.redirect_uri:void 0);return a?m6(r,f6(a,t,n,typeof i.state==`string`?i.state:void 0,_6(r,e),ife(i))):m6(r,v6(r,t,n))}}async function lfe(e,t,n){if(t.grantTypes&&!t.grantTypes.includes(`authorization_code`))throw new d(`NOT_FOUND`);if(!e.request)throw new d(`UNAUTHORIZED`,{error_description:`request not found`,error:`invalid_request`});let r=e.request,i=sfe(e,n);e.query=i;let a=p6(i.request),o=p6(i.request_uri);if(a!==void 0&&o!==void 0)return x6(t)({error:`invalid_request`,error_description:`request and request_uri cannot be used together`,ctx:e});if(a!==void 0)return x6(t)({error:`request_not_supported`,error_description:`request object not supported`,ctx:e});if(o!==void 0){let n=p6(i.client_id);if(!n)return x6(t)({error:`invalid_request`,error_description:`client_id is required`,ctx:e});if(!t.requestUriResolver)return x6(t)({error:`request_uri_not_supported`,error_description:`request_uri not supported`,ctx:e});let r=await t.requestUriResolver({requestUri:o,clientId:n,ctx:e});if(!r)return x6(t)({error:`invalid_request_uri`,error_description:`request_uri is invalid or expired`,ctx:e});let a=i.client_id;i=r,a&&(i.client_id=a)}e.query=i;let s=h4.safeParse(i);if(!s.success){let n=p3(s.error.issues,afe);return x6(t)({...n,ctx:e})}if(i=s.data,e.query=i,await s6.set({query:S6(i).toString()}),!i.response_type)return x6(t)({error:`invalid_request`,error_description:`response_type is required`,ctx:e});let c=e.query?.prompt?A2(e.query?.prompt):void 0,l=c?.has(`none`)??!1;if(c?.has(`select_account`)&&!t.selectAccount?.page)return m6(e,v6(e,`unsupported_prompt_select_account`,`unsupported prompt type`));if(i.response_type!==`code`)return m6(e,v6(e,`unsupported_response_type`,`unsupported response type`));let u=await m2(e,t,i.client_id);if(!u)return m6(e,v6(e,`invalid_client`,`client_id is required`));if(u.disabled)return m6(e,v6(e,`client_disabled`,`client is disabled`));if(!w2(u,`authorization_code`))return m6(e,v6(e,`unauthorized_client`,`client is not authorized to use the authorization_code grant`));if(!b6(u.redirectUris,i.redirect_uri)||!i.redirect_uri)return m6(e,v6(e,`invalid_redirect`,`invalid redirect uri`));let f=i.scope?.split(` `).filter(e=>e);if(f){let n=new Set(u.scopes??t.scopes),r=f.filter(e=>!n?.has(e));if(r.length)return m6(e,f6(i.redirect_uri,`invalid_scope`,`The following scopes are invalid: ${r.join(`, `)}`,i.state,_6(e,t)))}f||(f=u.scopes??t.scopes??[],i.scope=f.join(` `));let p=f.includes(`openid`);if(i.claims!==void 0&&!p)return m6(e,f6(i.redirect_uri,`invalid_request`,`openid scope must be requested when using the claims parameter`,i.state,_6(e,t)));if(p&&!rle(i.claims))return m6(e,f6(i.redirect_uri,`invalid_request`,`claims must be a valid Claims request object`,i.state,_6(e,t)));if(p&&!ile(i.claims,`0`))return m6(e,f6(i.redirect_uri,`access_denied`,`essential acr requirement cannot be met`,i.state,_6(e,t)));let m=W2(i.claims,J2(t));if(i.resource!==void 0)try{await $2(e,t,{resource:i.resource,clientId:u.clientId,requestedScopes:f})}catch(n){if(n instanceof d){let r=n.body?.error??`invalid_target`,a=n.body?.error_description??`requested resource invalid`;return m6(e,f6(i.redirect_uri,r,a,i.state,_6(e,t)))}throw n}let h=I2(u,{scopes:f,nonce:i.nonce});if(h&&(!i.code_challenge||!i.code_challenge_method))return m6(e,f6(i.redirect_uri,`invalid_request`,h.valueOf(),i.state,_6(e,t)));if(i.code_challenge||i.code_challenge_method){if(!i.code_challenge||!i.code_challenge_method)return m6(e,f6(i.redirect_uri,`invalid_request`,`code_challenge and code_challenge_method must both be provided`,i.state,_6(e,t)));if(![`S256`].includes(i.code_challenge_method))return m6(e,f6(i.redirect_uri,`invalid_request`,`invalid code_challenge method, only S256 is supported`,i.state,_6(e,t)))}let g=u2(i.resource)??[],_=await CH(e),v=i.max_age,y=_!=null&&v!==void 0&&nfe(new Date(_.session.createdAt),v,/* @__PURE__ */ new Date);if(!_||_!=null&&v!==void 0&&!y||c?.has(`login`)||c?.has(`create`))return l?h6(e,t,i,`login_required`,`authentication required`):w6(e,t,c?.has(`create`)?`create`:`login`);if(y&&(i=rfe(i),e.query=i),n?.isAuthorize&&c?.has(`select_account`))return w6(e,t,`select_account`);if(n?.isAuthorize&&t.selectAccount&&await t.selectAccount.shouldRedirect({headers:r.headers,user:_.user,session:_.session,scopes:f}))return l?h6(e,t,i,`account_selection_required`,`End-User account selection is required`):w6(e,t,`select_account`);if(t.signup?.shouldRedirect){let n=await t.signup.shouldRedirect({headers:r.headers,user:_.user,session:_.session,scopes:f});if(n)return l?h6(e,t,i,`interaction_required`,`End-User interaction is required`):w6(e,t,`create`,{page:typeof n==`string`?n:void 0})}if(!n?.postLogin&&t.postLogin&&await t.postLogin.shouldRedirect({headers:r.headers,user:_.user,session:_.session,scopes:f}))return l?h6(e,t,i,`interaction_required`,`End-User interaction is required`):w6(e,t,`post_login`);if(c?.has(`consent`))return w6(e,t,`consent`,{sessionId:_.session.id});let b=await t.postLogin?.consentReferenceId?.({user:_.user,session:_.session,scopes:f});if(u.skipConsent)return C6(e,t,{query:i,clientId:u.clientId,userId:_.user.id,sessionId:_.session.id,authTime:new Date(_.session.createdAt).getTime(),referenceId:b,resource:g});let x=await e.context.adapter.findOne({model:`oauthConsent`,where:[{field:`clientId`,value:u.clientId},{field:`userId`,value:_.user.id},...b?[{field:`referenceId`,value:b}]:[]]});if(!x||!f.every(e=>x.scopes.includes(e))||!m.every(e=>(x.requestedUserInfoClaims??[]).includes(e)))return l?h6(e,t,i,`consent_required`,`End-User consent is required`):w6(e,t,`consent`,{sessionId:_.session.id});let S=x?.resources??[];return g.some(e=>!S.includes(e))?l?h6(e,t,i,`consent_required`,`End-User consent is required`):w6(e,t,`consent`,{sessionId:_.session.id}):C6(e,t,{query:i,clientId:u.clientId,userId:_.user.id,sessionId:_.session.id,authTime:new Date(_.session.createdAt).getTime(),referenceId:b,resource:g})}function S6(e){let t=new URLSearchParams;for(let[n,r]of Object.entries(e))if(r!=null){if(Array.isArray(r))for(let e of r)t.append(n,String(e));else n===`claims`&&typeof r==`object`?t.set(n,JSON.stringify(r)):t.set(n,String(r))}return t}async function C6(e,t,n){let r=AU(32,`a-z`,`A-Z`,`0-9`),i=Math.floor(Date.now()/1e3),a=i+(t.codeExpiresIn??600),o={identifier:await y2(t.storeTokens,r,`authorization_code`),updatedAt:/* @__PURE__ */ new Date(i*1e3),expiresAt:/* @__PURE__ */ new Date(a*1e3),value:JSON.stringify({type:`authorization_code`,query:n.query,userId:n.userId,sessionId:n?.sessionId,referenceId:n.referenceId,authTime:n.authTime,resource:n.resource})};await e.context.internalAdapter.createVerificationValue({...o,createdAt:/* @__PURE__ */ new Date(i*1e3)});let s=new URL(n.query.redirect_uri);return s.searchParams.set(`code`,r),n.query.state&&s.searchParams.set(`state`,n.query.state),s.searchParams.set(`iss`,_6(e,t)),m6(e,s.toString())}async function w6(e,t,n,r){let i=await ufe(e,t,{postLoginClearedForSession:n===`consent`&&t.postLogin?r?.sessionId:void 0}),a=t.loginPage;if(n===`select_account`)a=t.selectAccount?.page??t.loginPage;else if(n===`post_login`){if(!t.postLogin?.page)throw new d(`INTERNAL_SERVER_ERROR`,{error_description:`postLogin should have been defined`});a=t.postLogin?.page}else n===`consent`?a=t.consentPage:n===`create`&&(a=t.signup?.page??t.loginPage);return m6(e,`${r?.page??a}?${i}`)}async function ufe(e,t,n){let r=Date.now(),i=Math.floor(r/1e3)+(t.codeExpiresIn??600),a=S6(e.query);a.set(`exp`,String(i)),a.set(G0,String(r)),a.delete(`sig`),a.delete(K0),n?.postLoginClearedForSession&&a.set(K0,n.postLoginClearedForSession),xce(a);let o=await zW(J0(a).toString(),e.context.secret);return a.set(`sig`,o),a.toString()}const dfe=/\/(?:\.|%2e)(?:\.|%2e)?(?:\/|$|#|\?)/i,ffe=/* @__PURE__ */ new Set([`client_secret_post`,`client_secret_basic`,`client_secret_jwt`]);function T6(e){let t;try{t=new URL(e)}catch{return!1}return t.protocol===`https:`}function pfe(e){if(dfe.test(e))return`client_id URL MUST NOT contain dot segments`;if(e.includes(`#`))return`client_id URL MUST NOT contain a fragment`;let t;try{t=new URL(e)}catch{return`client_id is not a valid URL`}if(t.protocol!==`https:`)return`client_id URL must use HTTPS`;let n=/^https:\/\//i.exec(e);if(!n||e.includes(`\\`))return`client_id URL MUST use an explicit HTTPS authority form`;let r=e.slice(n[0].length),i=r.search(/[/?#]/);return i===0?`client_id URL MUST use an explicit HTTPS authority form`:i<0||r[i]!==`/`?`client_id URL MUST contain an explicit path component`:t.username||t.password?`client_id URL MUST NOT contain credentials`:cU(t.hostname)?null:`client_id URL must not target a private or reserved address`}function mfe(e){let t=[];try{let n=new URL(e);n.pathname===`/`&&t.push(`client_id URL path / is NOT RECOMMENDED (§3)`),n.search&&t.push(`client_id URL SHOULD NOT contain a query string (§3)`)}catch{}return t}function hfe(e){try{let t=new URL(e);return t.protocol===`http:`||t.protocol===`https:`||L2(t)}catch{return!1}}function gfe(e,t,n={}){if(!t||typeof t!=`object`)return{valid:!1,error:`metadata document is not a JSON object`};for(let e of Object.keys(t))if(b3(e))return{valid:!1,error:`metadata document MUST NOT contain "${e}"`};let r=Ale.strip().safeParse(t);if(!r.success){let e=r.error.issues[0];return{valid:!1,error:`${e?.path.join(`.`)||`metadata document`}: ${e?.message??`invalid client metadata`}`}}let i=r.data,a=[];if(i.client_id!==e)return{valid:!1,error:`client_id "${String(i.client_id)}" does not match the metadata document URL`};if(n.metadataProfile===`mcp-2026-07-28`&&!i.client_name?.trim())return{valid:!1,error:`client_name must be a non-empty string`};for(let e of[`backchannel_logout_uri`,`backchannel_logout_session_required`])if(i[e]!==void 0)return{valid:!1,error:`metadata document MUST NOT contain "${e}"`};let o=/* @__PURE__ */ new Set([`none`,`private_key_jwt`]);if(typeof i.token_endpoint_auth_method==`string`){if(ffe.has(i.token_endpoint_auth_method))return{valid:!1,error:`symmetric auth method "${i.token_endpoint_auth_method}" is prohibited for Client ID Metadata Document clients`};if(!o.has(i.token_endpoint_auth_method))return{valid:!1,error:`token_endpoint_auth_method must be "none" or "private_key_jwt" for Client ID Metadata Document clients`};if(i.token_endpoint_auth_method===`private_key_jwt`&&!i.jwks&&!i.jwks_uri)return{valid:!1,error:`private_key_jwt requires either jwks or jwks_uri in the metadata document`}}if(i.jwks&&!y3(i.jwks).valid)return{valid:!1,error:`jwks must contain only structurally valid public keys`};if(i.jwks_uri)try{let e=new URL(i.jwks_uri);if(e.username||e.password)return{valid:!1,error:`jwks_uri must not contain credentials`};if(i.jwks_uri.includes(`#`))return{valid:!1,error:`jwks_uri must not contain a fragment`}}catch{return{valid:!1,error:`jwks_uri must be a valid URL`}}if(n.metadataProfile===`mcp-2026-07-28`&&!i.redirect_uris||i.redirect_uris&&!i.redirect_uris.every(e=>hfe(e)))return{valid:!1,error:`redirect_uris must be a non-empty array of absolute HTTP(S) or private-use URIs`};for(let e of[`client_uri`,`logo_uri`,`tos_uri`,`policy_uri`]){if(i[e]!==void 0&&typeof i[e]!=`string`)return{valid:!1,error:`${e} must be a string`};if(typeof i[e]==`string`)try{let t=new URL(i[e]);if(t.protocol!==`https:`&&t.protocol!==`http:`)return{valid:!1,error:`${e} must use HTTP(S)`};if(t.username||t.password)return{valid:!1,error:`${e} must not contain credentials`};if(!cU(t.hostname))return{valid:!1,error:`${e} must not point to a private or reserved address`}}catch{return{valid:!1,error:`${e} is not a valid URL`}}}let s=n.originBoundFields??[`post_logout_redirect_uris`,`client_uri`],c;try{c=new URL(e).origin}catch{return{valid:!1,error:`client_id is not a valid URL`}}for(let e of s){let t=i[e];if(t===void 0)continue;let n;if(typeof t==`string`)n=[t];else if(Array.isArray(t)){if(!t.every(e=>typeof e==`string`))return{valid:!1,error:`${e} must be a string or an array of strings`};n=t}else return{valid:!1,error:`${e} must be a string or an array of strings`};for(let t of n){let n;try{n=new URL(t)}catch{return{valid:!1,error:`${e} contains an invalid URL: "${t}"`}}let r=e===`redirect_uris`||e===`post_logout_redirect_uris`,i=r&&L2(n);if(n.protocol!==`https:`&&n.protocol!==`http:`&&!i)return{valid:!1,error:`all values for ${e} must use HTTP(S) or an authority-free private-use scheme`};if(i)continue;let a=r&&sU(n.hostname);if(n.origin!==c&&!a)return{valid:!1,error:`${e} value "${t}" must have the same origin as client_id (${c})`}}}return a.push(...mfe(e)),{valid:!0,metadata:{...i,token_endpoint_auth_method:i.token_endpoint_auth_method??`none`},...a.length>0?{warnings:a}:{}}}const E6=5e3,D6=5120,_fe=/^application\/(?:[-\w.]+\+)?json\s*(?:;|$)/i,O6=`Failed to fetch metadata document (network error or redirect blocked)`,k6=`cimd`;function A6(e){return new d(`BAD_REQUEST`,{error:`invalid_client`,error_description:e})}function j6(){return A6(`Metadata document exceeds ${D6/1024}KB size limit`)}async function vfe(e,t,n){let r=e.body?.getReader();if(!r){let n=await e.text();if(new TextEncoder().encode(n).byteLength>t)throw j6();return n}let i=[],a=0,o,s=new Promise((e,t)=>{o=t}),c=()=>{o?.(/* @__PURE__ */ Error(`Metadata document body read aborted`)),r.cancel().catch(()=>{})};n.aborted?c():n.addEventListener(`abort`,c,{once:!0});try{for(;;){let{done:e,value:n}=await Promise.race([r.read(),s]);if(e)break;if(a+=n.byteLength,a>t)throw await r.cancel(),j6();i.push(n)}}finally{n.removeEventListener(`abort`,c),r.releaseLock()}let l=new Uint8Array(a),u=0;for(let e of i)l.set(e,u),u+=e.byteLength;return new TextDecoder().decode(l)}function yfe(e){return{cacheControl:e.get(`cache-control`)??void 0,vary:e.get(`vary`)??void 0,expires:e.get(`expires`)??void 0,date:e.get(`date`)??void 0,age:e.get(`age`)??void 0,etag:e.get(`etag`)??void 0,lastModified:e.get(`last-modified`)??void 0}}async function bfe(e,t,n,r){let i=pfe(t);if(i)throw A6(i);if(n.isMetadataDocumentUrlAllowed&&!await n.isMetadataDocumentUrlAllowed(t,e))throw A6(`client_id URL is not permitted by the server's fetch policy`);let a=new Headers({Accept:`application/json`});r?.etag&&a.set(`If-None-Match`,r.etag),r?.lastModified&&a.set(`If-Modified-Since`,r.lastModified);let o,s=new AbortController,c=!1,l=setTimeout(()=>{c=!0,s.abort()},E6);try{try{o=await n.fetchClientMetadataResource(t,{headers:a,redirect:`error`,signal:s.signal})}catch{throw A6(c?`Metadata document fetch timed out after ${E6}ms`:O6)}if(o.redirected)throw A6(`Metadata document fetch must not follow redirects`);let i=yfe(o.headers);if(o.status===304){if(!r?.etag&&!r?.lastModified)throw A6(`Metadata document returned 304 without a conditional validator`);return{status:`not-modified`,cacheHeaders:i}}if(o.status!==200)throw A6(`Metadata document fetch returned HTTP ${o.status}`);let l=o.headers.get(`content-type`)??``;if(!_fe.test(l))throw A6(`Metadata document must be JSON (got Content-Type "${l||`(none)`}")`);let u;try{let e=o.headers.get(`content-length`);if(e){let t=Number.parseInt(e,10);if(Number.isFinite(t)&&t>D6)throw await o.body?.cancel(),j6()}u=await vfe(o,D6,s.signal)}catch(e){throw c?A6(`Metadata document fetch timed out after ${E6}ms`):e instanceof d?e:A6(O6)}let f;try{f=JSON.parse(u)}catch{throw A6(`Metadata document is not valid JSON`)}let p=gfe(t,f,{originBoundFields:n.originBoundFields,metadataProfile:n.metadataProfile});if(!p.valid)throw A6(p.error);for(let t of p.warnings??[])e.context.logger.warn(`cimd metadata document warning: ${t}`);return{status:`modified`,metadata:p.metadata,cacheHeaders:i}}finally{clearTimeout(l)}}async function M6(e,t,n,r,i,a){let o=a?{...a}:void 0,s=await W3(e,i,{clientId:t,clientDiscoveryId:k6,metadata:{...n,client_id:n.client_id,redirect_uris:n.redirect_uris??[]},existingClient:a});if(s.created)try{await r.onClientCreated?.({client:s.client,clientMetadataDocument:n,context:e})}catch(t){e.context.logger.error(`cimd onClientCreated notification failed`,t)}else try{o&&await r.onClientRefreshed?.({client:s.client,previousClient:o,clientMetadataDocument:n,context:e})}catch(t){e.context.logger.error(`cimd onClientRefreshed notification failed`,t)}return s.client}const N6={minimumFetchInterval:1,maximumConcurrentFetches:16,maximumConcurrentFetchesPerOrigin:4,maximumFetchesPerMinute:120,maximumFetchesPerOriginPerMinute:30};function xfe(e){return new d(`BAD_REQUEST`,{error:`invalid_client`,error_description:e})}function P6(e){return new d(`TOO_MANY_REQUESTS`,{error:`temporarily_unavailable`,error_description:e})}function Sfe(e,t){if(typeof e==`number`){if(!Number.isFinite(e)||e<0)throw new l(`cimd metadataFetchPolicy.${t} must be a non-negative number of seconds or duration string`);return e*1e3}try{let t=Math.floor(Date.now()/1e3),n=(M0(e,t)-t)*1e3;if(!Number.isFinite(n)||n<0)throw Error(`negative duration`);return n}catch{throw new l(`cimd metadataFetchPolicy.${t} must be a non-negative number of seconds or duration string`)}}function F6(e,t){if(!Number.isInteger(e)||e<1)throw new l(`cimd metadataFetchPolicy.${t} must be a positive integer`);return e}function Cfe(e){let t=e.metadataFetchPolicy;return{minimumFetchIntervalMs:Sfe(t?.minimumFetchInterval??N6.minimumFetchInterval,`minimumFetchInterval`),maximumConcurrentFetches:F6(t?.maximumConcurrentFetches??N6.maximumConcurrentFetches,`maximumConcurrentFetches`),maximumConcurrentFetchesPerOrigin:F6(t?.maximumConcurrentFetchesPerOrigin??N6.maximumConcurrentFetchesPerOrigin,`maximumConcurrentFetchesPerOrigin`),maximumFetchesPerMinute:F6(t?.maximumFetchesPerMinute??N6.maximumFetchesPerMinute,`maximumFetchesPerMinute`),maximumFetchesPerOriginPerMinute:F6(t?.maximumFetchesPerOriginPerMinute??N6.maximumFetchesPerOriginPerMinute,`maximumFetchesPerOriginPerMinute`)}}function I6(e,t){let n=t-6e4,r=0;for(;r<e.length&&e[r]<=n;)r+=1;r>0&&e.splice(0,r)}function wfe(e,t){if(typeof e==`number`)return Math.max(0,e*1e3);let n=Math.floor(t/1e3);return Math.max(0,(M0(e,n)-n)*1e3)}function Tfe(e){let t=/* @__PURE__ */ new Map,n=/* @__PURE__ */ new Set;for(let r of e?.split(`,`)??[]){let[e,...i]=r.trim().split(`=`),a=e?.toLowerCase();if(!a)continue;t.has(a)&&n.add(a);let o=i.join(`=`).trim();t.set(a,!o||o.replace(/^"|"$/g,``))}return{directives:t,duplicates:n}}function L6(e){if(typeof e!=`string`||!/^\d+$/.test(e))return null;let t=Number(e);return Number.isSafeInteger(t)?t:null}function Efe(e,t,n){let{directives:r,duplicates:i}=Tfe(e.cacheControl),a=e.vary?.split(`,`).some(e=>e.trim()===`*`);if(r.has(`no-store`)||r.has(`private`)||a)return{cacheable:!1,expiresAt:n};let o=wfe(t,n);if(r.has(`no-cache`))return{cacheable:!0,expiresAt:n};let s=L6(e.age)??0,c=e.date?Date.parse(e.date):n,l=Number.isFinite(c)?Math.max(0,n-c):0,u=Math.max(l,s*1e3),d=null,f=r.has(`s-maxage`),p=L6(r.get(`s-maxage`)),m=r.has(`max-age`),h=L6(r.get(`max-age`)),g=f?p===null||i.has(`s-maxage`):m&&(h===null||i.has(`max-age`)),_=f?p:h;if(g)d=0;else if(_!==null)d=Math.max(0,_*1e3-u);else if(e.expires){let t=Date.parse(e.expires);Number.isFinite(t)&&(d=Math.max(0,t-(Number.isFinite(c)?c:n)-u))}return{cacheable:!0,expiresAt:n+Math.min(o,d??o)}}function Dfe(e,t){return{cacheControl:t.cacheControl??e.cacheControl,vary:t.vary??e.vary,expires:t.expires??e.expires,date:t.date??e.date,age:t.age??e.age,etag:t.etag??e.etag,lastModified:t.lastModified??e.lastModified}}function Ofe(e,t,n,r){let i=Efe(t,n,r);return i.cacheable?{metadata:e,expiresAt:i.expiresAt,etag:t.etag,lastModified:t.lastModified,responseCacheHeaders:t}:null}function kfe(e){let t=e.metadataRevalidationInterval??`60m`,n=e.maxCacheEntries??1e3;if(!Number.isInteger(n)||n<1)throw new l(`cimd maxCacheEntries must be a positive integer`);let r=Cfe(e),i=/* @__PURE__ */ new Map,a=/* @__PURE__ */ new Map,o=/* @__PURE__ */ new Map,s=/* @__PURE__ */ new Map,c=[],u=0,d=e=>{let t=i.get(e);if(t)return i.delete(e),i.set(e,t),t},f=(e,t)=>{for(i.delete(e);i.size>=n;){let e=i.keys().next().value;if(typeof e!=`string`)break;i.delete(e)}i.set(e,t)},p=(e,t)=>{if(!o.has(e))for(;o.size>=n;){let e=!1;for(let[n,i]of o)if(!a.has(n)&&!(r.minimumFetchIntervalMs>0&&t-i<r.minimumFetchIntervalMs)){o.delete(n),e=!0;break}if(!e)throw P6(`metadata fetch client state is at capacity`)}},m=(e,t)=>{let r=s.get(e);if(r)return I6(r.fetchStartTimesMs,t),s.delete(e),s.set(e,r),r;for(;s.size>=n;){let e=!1;for(let[n,r]of s)if(I6(r.fetchStartTimesMs,t),!(r.activeFetchCount>0||r.fetchStartTimesMs.length>0)){s.delete(n),e=!0;break}if(!e)throw P6(`metadata fetch origin state is at capacity`)}let i={activeFetchCount:0,fetchStartTimesMs:[]};return s.set(e,i),i},h=e=>{let t=Date.now(),n=o.get(e);if(r.minimumFetchIntervalMs>0&&n!==void 0&&t-n<r.minimumFetchIntervalMs)throw P6(`metadata document fetch is within the per-client minimum interval`);p(e,t);let i=new URL(e).origin,a=m(i,t);if(I6(c,t),u>=r.maximumConcurrentFetches)throw P6(`global metadata fetch concurrency limit exceeded`);if(a.activeFetchCount>=r.maximumConcurrentFetchesPerOrigin)throw P6(`metadata fetch concurrency limit exceeded for client origin`);if(c.length>=r.maximumFetchesPerMinute)throw P6(`global metadata fetch rate limit exceeded`);if(a.fetchStartTimesMs.length>=r.maximumFetchesPerOriginPerMinute)throw P6(`metadata fetch rate limit exceeded for client origin`);o.delete(e),o.set(e,t),c.push(t),a.fetchStartTimesMs.push(t),u+=1,a.activeFetchCount+=1;let s=!1;return()=>{s||(s=!0,--u,--a.activeFetchCount)}};return async(n,r,s)=>{if(!T6(r))return null;let c=n.context.getPlugin(`oauth-provider`);if(!c)throw new l(`cimd discovery invoked without the oauth-provider plugin installed`);let u=c.options,p=d(r),m=Date.now();if(p&&p.expiresAt>m)return s||M6(n,r,p.metadata,e,u);let g=a.get(r);if(g)return g;let _=h(r),v=(async()=>{let a=await bfe(n,r,e,p?{etag:p.etag,lastModified:p.lastModified}:void 0);if(a.status===`not-modified`&&!p)throw xfe(`Metadata document returned 304 without a validated cached document`);let c=a.status===`modified`?a.metadata:p.metadata,l=await M6(n,r,c,e,u,s??void 0),d=Ofe(c,a.status===`modified`?a.cacheHeaders:Dfe(p.responseCacheHeaders,a.cacheHeaders),t,Date.now());return d?f(r,d):i.delete(r),o.delete(r),l})();a.set(r,v);try{return await v}catch(e){throw o.delete(r),o.set(r,Date.now()),e}finally{a.get(r)===v&&a.delete(r),_()}}}function Afe(e){return{id:k6,matches:T6,resolve:kfe(e),fetchClientMetadataResource:e.fetchClientMetadataResource,discoveryMetadata:{client_id_metadata_document_supported:!0}}}const jfe=e=>{let t=Afe(e);return{id:`cimd`,version:`1.7.5`,init(e){Ace(e,{clientDiscovery:t})}}},R6=(e,t)=>e===t||e.endsWith(`.${t}`),Mfe=e=>{try{return new URL(`https://${e}`).hostname===e&&e.includes(`.`)&&!dn(e)}catch{return!1}},z6=(e,t)=>e.protocol===`https:`||e.protocol===`http:`&&([`localhost`,`127.0.0.1`,`[::1]`].includes(e.hostname)||t),B6=`HTTPS origins (HTTP allowed on loopback, or anywhere with ALLOW_INSECURE_HTTP=true)`,V6=(e,t)=>URL.canParse(e)&&new URL(e).origin===e&&z6(new URL(e),t),H6=V(function*(e){let{allowInsecureHttp:t,baseURL:n,cookieDomain:r}=e;return V6(n,t)?pT(e.secret).length<32?yield*R(/* @__PURE__ */ Error(`BETTER_AUTH_SECRET must have at least 32 characters`)):e.mcpAllowedOrigins.every(e=>V6(e,t))?r!==void 0&&(!Mfe(r)||!R6(new URL(n).hostname,r))?yield*R(/* @__PURE__ */ Error(`AUTH_COOKIE_DOMAIN must be a bare parent domain of the AUTH_BASE_URL host, such as home.example`)):e:yield*R(/* @__PURE__ */ Error(`MCP_ALLOWED_ORIGINS must contain exact ${B6}`)):yield*R(/* @__PURE__ */ Error(`AUTH_BASE_URL must be one of: ${B6}`))});mh(function*(){let e={baseURL:yield*VA(`AUTH_BASE_URL`),secret:yield*GA(`BETTER_AUTH_SECRET`),database:yield*VA(`AUTH_DATABASE`).pipe(kA(`data/auth.sqlite`)),host:yield*VA(`HOST`).pipe(kA(`127.0.0.1`)),port:yield*WA(`PORT`).pipe(kA(3e3)),mcpAllowedOrigins:yield*HA(YD,`MCP_ALLOWED_ORIGINS`).pipe(kA([])),trustProxy:yield*UA(`TRUST_PROXY`).pipe(kA(!1)),allowInsecureHttp:yield*UA(`ALLOW_INSECURE_HTTP`).pipe(kA(!1)),cookieDomain:yield*VA(`AUTH_COOKIE_DOMAIN`).pipe(kA(void 0))};return yield*H6(e)});const U6=`clankerauth_forward`,Nfe=TE(W({subject:U,audience:U,scope:U})),Pfe=(e,t)=>({id:`forward-tokens`,endpoints:{signForwardToken:Y.serverOnly({method:`POST`,body:Nfe},async n=>{let r=Math.floor(Date.now()/1e3),i=await I0(n,{options:e,header:{typ:`at+jwt`},payload:{sub:n.body.subject,aud:n.body.audience,client_id:`forward-auth`,scope:n.body.scope,iat:r,exp:r+t}});return n.json({token:i})})}}),W6=(e,t)=>dN({error:t},{status:e}),Ffe=e=>vm(B(G6,t=>{let{settings:n}=t,r=t=>{if(!URL.canParse(t))return;let r=new URL(t);return!r.username&&!r.password&&z6(r,n.allowInsecureHttp)&&R6(r.hostname,e)?r:void 0},i=pT(n.secret),a=e$(n.baseURL),o=new URL(`/login`,n.baseURL),s={domain:e,path:`/`,httpOnly:!0,secure:n.baseURL.startsWith(`https:`),sameSite:`lax`},c=t.context.authCookies.sessionToken.name,l=(e,t)=>{let r=new URL(e,n.baseURL);return r.searchParams.set(`rd`,t.href),r},u=e=>LQ(()=>t.auth.api.getSession({headers:new Headers({cookie:e})})),d=mh(function*(){let e=yield*cP,{headers:o}=e,s=o[`x-forwarded-proto`],d=o[`x-forwarded-host`],f=s&&d?r(`${s}://${d}${o[`x-forwarded-uri`]??`/`}`):void 0;if(!f)return W6(400,`invalid_forwarded_request`);let p=new URL(e.url,n.baseURL).searchParams.get(`resource`),m=p&&p!==a&&(yield*t.resources.get(p));if(!m)return W6(403,`unknown_resource`);let h=e.cookies[U6],g=h?yield*Dh(ch(()=>LW({key:i,data:h}))):Ta(),_=Oa(g)?yield*u(`${c}=${g.value}`):null;if(!_)return o[`sec-fetch-mode`]===`navigate`?sN(l(`/forward-auth/continue`,f)):W6(401,`unauthenticated`);let{token:v}=yield*LQ(()=>t.auth.api.signForwardToken({body:{subject:_.user.id,audience:m.identifier,scope:m.scopes.join(` `)}}));return oN({status:204,headers:{authorization:`Bearer ${v}`}})}),f=mh(function*(){let e=yield*cP,t=new URL(e.url,n.baseURL).searchParams.get(`rd`),a=t?r(t):void 0;if(!a)return W6(400,`invalid_return_url`);let o=e.cookies[c];if(!(o&&(yield*u(e.headers.cookie??``)))||!o)return sN(l(`/login`,l(`/forward-auth/continue`,a)));let d=yield*ch(()=>IW({key:i,data:o}));return yield*sN(a).pipe(_N(U6,d,s))}),p=mh(function*(){let e=yield*cP,i=new URL(e.url,n.baseURL).searchParams.get(`rd`),a=i&&r(i)||o,{headers:c}=yield*LQ(()=>t.auth.api.signOut({headers:new Headers({cookie:e.headers.cookie??``}),returnHeaders:!0}));return yield*vN(sN(a),wT(c.getSetCookie())).pipe(_N(U6,``,{...s,maxAge:0}))});return bm(bP(`GET`,`/forward-auth`,jh(d,BQ)),bP(`GET`,`/forward-auth/continue`,jh(f,BQ)),bP(`GET`,`/forward-auth/logout`,jh(p,BQ)))})),Ife=/* @__PURE__ */ new Set([204,205,304]);function Lfe(e){let t=new Headers;for(let[n,r]of Object.entries(e))if(Array.isArray(r))for(let e of r)t.append(n,e);else r!==void 0&&t.append(n,r);return t}const Rfe=async(e,t)=>{let n=new Request(e,t),r=new URL(n.url);if(r.protocol!==`https:`)throw TypeError(`CIMD Node transport requires an HTTPS URL`);if(n.method!==`GET`&&n.method!==`HEAD`)throw TypeError(`CIMD Node transport supports only GET and HEAD`);let i=await wn(r.hostname,{all:!0,verbatim:!0});if(i.length===0)throw TypeError(`metadata hostname returned no DNS addresses`);for(let e of i)if(!cU(e.address))throw TypeError(`metadata hostname must resolve only to public-routable addresses`);let a=i[0],o=Object.fromEntries(n.headers.entries());o.host=r.host;let s=t?.signal??(e instanceof Request?e.signal:n.signal);return new Promise((e,t)=>{let i=_n(r,{agent:!1,headers:o,method:n.method,servername:dn(r.hostname.replace(/^\[|\]$/g,``))===0?r.hostname:void 0,signal:s,lookup:(e,t,n)=>{t.all?n(null,[a]):n(null,a.address,a.family)}},t=>{let r=t.statusCode??500,i=n.method===`HEAD`||Ife.has(r)?null:cn.toWeb(t);e(new Response(i,{headers:Lfe(t.headers),status:r,statusText:t.statusMessage}))});i.once(`error`,t),i.end()})};function zfe(e,t=8){let n=0;return(r,i)=>{let a=i?.signal??(r instanceof Request?r.signal:void 0);return a?.aborted?Promise.reject(a.reason):n>=t?Promise.reject(/* @__PURE__ */ Error(`CIMD transport capacity reached`)):(n++,new Promise((t,o)=>{let s=!1,c=()=>{s=!0,o(a?.reason)};a?.addEventListener(`abort`,c,{once:!0});let l=()=>{n--,a?.removeEventListener(`abort`,c)};Promise.resolve().then(()=>(a?.throwIfAborted(),e(r,i))).then(e=>{l(),s?e.body?.cancel().catch(()=>{}):t(e)},e=>{l(),o(e)})}))}}const Bfe=zfe(Rfe);function Vfe(e){let t=H(`Clients.revoke`)(function*(e,t){return(yield*t`SELECT 1 FROM oauthClient WHERE clientId = ${e}`).length?(yield*t`DELETE FROM oauthConsent WHERE clientId = ${e}`,yield*t`DELETE FROM verification WHERE json_valid(value) AND json_extract(value, '$.type') = 'authorization_code' AND json_extract(value, '$.query.client_id') = ${e}`,yield*t`DELETE FROM oauthAccessToken WHERE clientId = ${e}`,yield*t`DELETE FROM oauthRefreshToken WHERE clientId = ${e}`,{revoked:!0}):yield*R(new $Z({error:`Client not found`}))});return{revoke:n=>ZQ(e,e=>t(n,e)),block:(n,r)=>ZQ(e,e=>mh(function*(){if(r)yield*t(n,e);else if(!(yield*e`SELECT 1 FROM oauthClient WHERE clientId = ${n}`).length)return yield*R(new $Z({error:`Client not found`}));return yield*e`UPDATE oauthClient SET disabled = ${+!!r}, updatedAt = ${yield*Om} WHERE clientId = ${n}`,{blocked:r}}))}}const Hfe=e=>typeof e==`string`,Ufe=YQ(W({id:U})),Wfe=H(`Auth.open`)(function*(e,t){let n={disableSettingJwtHeader:!0,jwt:{issuer:`${e.baseURL}/api/auth`},jwks:{keyPairConfig:{alg:`EdDSA`,crv:`Ed25519`}}},r=Pg(yield*Qh());yield*vh(()=>mn($t(e.database),{recursive:!0,mode:448}));let i=yield*cg(ch(()=>QQ(e.database)),e=>sh(()=>e.close())),{sql:a}=i,o=Vfe(i.kysely),s=H(`Auth.owner`)(function*(){let e=yield*a`SELECT id FROM user LIMIT 1`;if(e.length)return(yield*Ufe(e[0])).id}),l=d6({loginPage:`/login`,consentPage:`/consent`,scopes:[...t$],resources:[{identifier:e$(e.baseURL),name:`Clanker Auth administration`,allowedScopes:[...t$,$Q]}],rateLimit:{register:{window:60,max:10}},postLogin:{page:`/consent`,shouldRedirect:()=>!1,consentReferenceId:async({scopes:e})=>{let t=await c6(),n=new URLSearchParams(t?.query),i=n.getAll(`resource`);if(i.length!==1||!await r(u.get(i[0])))throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`Choose exactly one Resource`});let a=n.get(`client_id`);if(!a||!await r(u.hasAccess(a,i[0])))throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`Client access is required`});let o=await r(u.scopesFor(i));if(e.some(e=>!o.includes(e)))throw new c(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`Resource scopes changed; start authorization again`});return n$(i[0])}},grantTypes:[`authorization_code`,`refresh_token`],allowDynamicClientRegistration:!0,allowUnauthenticatedClientRegistration:!0,clientRegistrationRequirePKCE:!0,clientRegistrationDefaultResources:[],enforcePerClientResources:!0,accessTokenExpiresIn:900,refreshTokenExpiresIn:2592e3,refreshTokenReuseInterval:30,codeExpiresIn:120,clientPrivileges:async({user:e,action:t})=>!!e&&t!==`configure-client-credentials-scopes`,resourcePrivileges:async({user:e})=>!!e}),u=yield*l$(a,()=>f,(e,t)=>{l.options.scopes=e,l.options.clientRegistrationDefaultResources=t},e$(e.baseURL)),d={appName:`Clanker Auth`,baseURL:e.baseURL,secret:pT(e.secret),database:{db:i.kysely,type:`sqlite`,transaction:!0},trustedOrigins:[e.baseURL],logger:{disabled:!0},disabledPaths:[`/token`],emailAndPassword:{enabled:!0,minPasswordLength:8,maxPasswordLength:128},databaseHooks:{user:{create:{before:async()=>{if(await(await GR((await f.$context).adapter)).count({model:`user`}))throw new c(`CONFLICT`,{message:`Setup already completed`})}}}},hooks:{before:gL(async e=>{if(e.path===`/oauth2/register`){let t=e.body.redirect_uris;!e.body.application_type&&Array.isArray(t)&&t.some(e=>{if(!Hfe(e))return!1;try{return new URL(e).protocol!==`https:`}catch{return!1}})&&(e.body.application_type=`native`)}})},session:{expiresIn:2592e3,updateAge:86400},advanced:{ipAddress:{ipAddressHeaders:[`x-clankerauth-peer`]}},rateLimit:{enabled:!0,storage:`database`,window:60,max:100,customRules:{"/sign-in/email":{window:60,max:5}}},plugins:[A0({defaultPrefix:`ca_`,maximumNameLength:100,enableSessionForAPIKeys:!1,keyExpiration:{defaultExpiresIn:null,minExpiresIn:0},rateLimit:{enabled:!0,timeWindow:6e4,maxRequests:1e3}}),bce(n),Pfe(n,900),l,jfe({fetchClientMetadataResource:(e,n)=>(t.cimdTransport??Bfe)(e,n),metadataProfile:`mcp-2026-07-28`,metadataRevalidationInterval:300,maxCacheEntries:1e3,metadataFetchPolicy:{maximumConcurrentFetches:8,maximumConcurrentFetchesPerOrigin:2,maximumFetchesPerMinute:60,maximumFetchesPerOriginPerMinute:15}})]},{auth:f,context:p}=yield*H(`Auth.initialize`)(function*(){let e=yield*ch(()=>j$(d));if(e.schemaProblems.length)return yield*R(/* @__PURE__ */ Error(`Database schema requires manual repair`));yield*ch(()=>e.runMigrations());let t=h1(d);return{auth:t,context:yield*ch(()=>t.$context)}},yg)();return yield*u.synchronize(),{auth:f,context:p,sql:a,database:i.kysely,owner:s,settings:e,resources:u,clients:o,setup:yield*iS(1)}});var G6=class e extends N()(`ClankerAuth/Auth`){static layer=(t,n={})=>pm(e,Wfe(t,n))};const K6=H(`Auth.createOwner`)(function*(e,t){if(yield*e.owner())return yield*R(new eQ({error:`Setup already completed`}));let{headers:n}=yield*LQ(()=>e.auth.api.signUpEmail({body:{name:`Owner`,email:t.email.trim(),password:t.password},returnHeaders:!0}));return n.getSetCookie()},(e,t)=>t.setup.withPermit(e));var q6=class extends N()(`ClankerAuth/CurrentOwner`){};const Gfe=e=>z(zQ(e),R),Kfe=B(G6,e=>u$(q6,mh(function*(){let t=yield*cP,n=new Headers(t.headers),r=yield*LQ(()=>e.auth.api.getSession({headers:n}));return r?{providerHeaders:F(n),userId:r.user.id,email:r.user.email}:yield*R(new ZZ({error:`Owner session required`}))}).pipe(jh(Gfe)))),qfe=YQ(W({id:U,email:U})),Jfe=V(function*(e){let t=yield*G6,n=()=>({error:new ZZ({error:`Owner authorization required`}),headers:{"www-authenticate":e.challenge(!0)}}),r=e=>({error:e,headers:{}});return u$(q6,mh(function*(){let i=yield*cP,a=i.headers.authorization!==void 0,o=yield*e.verifier.verify(i.headers.authorization).pipe(Ih(t=>e.refuse(t,a)));if(o.actor.kind!==`client`)return yield*R(n());let s=yield*t.sql`SELECT u.id, u.email FROM user u
510
+ Most of the features of Better Auth will not work correctly.`);let u=t.secrets??N$(Me.BETTER_AUTH_SECRETS),d=t.secret||Me.BETTER_AUTH_SECRET||Me.AUTH_SECRET||``,f,p;u?(P$(u,o),f=u[0].value,p=F$(u,d)):(f=d||`better-auth-secret-12345678901234567890`,d1(f,o),p=f),t={...t,secret:f,baseURL:s?t.baseURL:c?new URL(c).origin:``,basePath:t.basePath||`/api/auth`,plugins:i.concat(a)},WJ(t,o);let m=t.advanced?.ipAddress?.trustedProxies;if(m&&m.length>0){let e=xR(m);e.length>0&&o.warn(`Ignoring invalid \`advanced.ipAddress.trustedProxies\` entries: ${e.join(`, `)}. Each entry must be an IP address or CIDR range.`)}let h=pH(t),g=_e(t),_=(await Promise.all(Object.entries(t.socialProviders||{}).map(async([e,t])=>{let n=typeof t==`function`?await t():t;if(n==null||n.enabled===!1)return null;n.clientId||o.warn(`Social provider ${e} is missing clientId or clientSecret`);let r=Bq[e](n);return r.disableImplicitSignUp=n.disableImplicitSignUp,r}))).filter(e=>e!==null),v=({model:e,size:n})=>{if(typeof t.advanced?.generateId==`function`)return t.advanced.generateId({model:e,size:n});let r=t?.advanced?.database?.generateId;return typeof r==`function`?r({model:e,size:n}):r===`uuid`?crypto.randomUUID():r===`serial`||r===!1?!1:Gt(n)},{publish:y}=await l1(t,{adapter:e.id,database:typeof t.database==`function`?`adapter`:n(t.database)}),b=new Set(t.plugins.map(e=>e.id)),x=e=>t.plugins.find(t=>t.id===e)??null,S=e=>b.has(e),C=await dU(t),w=await gU(t),T={appName:t.appName||`Better Auth`,baseURL:c||``,version:de(),socialProviders:_,options:t,oauthConfig:{storeStateStrategy:t.account?.storeStateStrategy||(r?`database`:`cookie`),skipStateCookieCheck:!!t.account?.skipStateCookieCheck},tables:g,trustedOrigins:C,trustedProviders:w,isTrustedOrigin(e,t){return this.trustedOrigins.some(n=>JL(e,n,t))},sessionConfig:{updateAge:t.session?.updateAge===void 0?86400:t.session.updateAge,expiresIn:t.session?.expiresIn||604800,freshAge:t.session?.freshAge===void 0?86400:t.session.freshAge,cookieRefreshCache:(()=>{let e=t.session?.cookieCache?.refreshCache,n=t.session?.cookieCache?.maxAge||300;return r&&e?(o.warn("[better-auth] `session.cookieCache.refreshCache` is enabled while `database` or `secondaryStorage` is configured. `refreshCache` is meant for stateless (DB-less) setups. Disabling `refreshCache` — remove it from your config to silence this warning."),!1):e===!1||e===void 0?!1:e===!0?{enabled:!0,updateAge:Math.floor(n*.2)}:{enabled:!0,updateAge:e.updateAge===void 0?Math.floor(n*.2):e.updateAge}})()},secret:f,secretConfig:p,rateLimit:{...t.rateLimit,enabled:t.rateLimit?.enabled??ue,window:t.rateLimit?.window||10,max:t.rateLimit?.max||100,storage:t.rateLimit?.storage||(t.secondaryStorage?`secondary-storage`:`memory`)},authCookies:h,logger:o,generateId:v,session:null,secondaryStorage:t.secondaryStorage,password:{hash:t.emailAndPassword?.password?.hash||OU,verify:t.emailAndPassword?.password?.verify||kU,config:{minPasswordLength:t.emailAndPassword?.minPasswordLength||8,maxPasswordLength:t.emailAndPassword?.maxPasswordLength||128},checkPassword:lJ},setNewSession(e){this.newSession=e},newSession:null,adapter:e,internalAdapter:UH(e,{options:t,logger:o,hooks:t.databaseHooks?[{source:`user`,hooks:t.databaseHooks}]:[],generateId:v}),createAuthCookie:fH(t),async runMigrations(){throw new l(`runMigrations will be set by the specific init implementation`)},publishTelemetry:y,skipCSRFCheck:!!t.advanced?.disableCSRFCheck,skipOriginCheck:t.advanced?.disableOriginCheck===void 0?!!Ae():t.advanced.disableOriginCheck,runInBackground:t.advanced?.backgroundTasks?.handler??(e=>{e.catch(()=>{})}),async runInBackgroundOrAwait(e){try{t.advanced?.backgroundTasks?.handler?e instanceof Promise&&t.advanced.backgroundTasks.handler(e.catch(e=>{o.error(`Failed to run background task:`,e)})):await e}catch(e){o.error(`Failed to run background task:`,e)}},getPlugin:x,hasPlugin:S},ee=lU(T);return KV(ee)&&await ee,T.checkSchema=Ne(T.adapter),T}const p1=async e=>{let t=await f1(await h$(e),e,e=>dee(e)||`unknown`);return t.runMigrations=async function(){if(!e.database||`updateMany`in e.database)throw new l(`Database is not provided or it's an adapter. Migrations are only supported with a database instance.`);let{runMigrations:t}=await j$(e);await t()},t},m1=(e,t)=>{let n=t(e).then(e=>{let t=e.options.advanced?.database?.validateSchema;if(!e.checkSchema&&t!==!1){let n=t===!0?`warn`:`debug`;e.logger[n](`Schema validation is not available for adapter "${e.adapter.id}". Skipping schema validation. Database operations will proceed normally.`)}let n=e.checkSchema?.();return n&&n.catch(t=>{e.logger.error(t instanceof Pe?t.message:`Could not validate the database schema. Check your database connection.`)}),e}),{api:r}=GJ(n,e),i=e.plugins?.reduce((e,t)=>t.$ERROR_CODES?{...e,...t.$ERROR_CODES}:e,{}),a=async t=>{let r=await n,i=r.options.basePath||`/api/auth`,a;if(FL(e.baseURL))a=await mU(r,t,pU(r.options));else{a=Object.create(Object.getPrototypeOf(r),Object.getOwnPropertyDescriptors(r));let e=r.options;if(!r.options.baseURL){let n=jL(void 0,i,t,void 0,r.options.advanced?.trustedProxyHeaders);if(!n)throw new l(`Could not get base URL from request. Please provide a valid base URL.`);a.baseURL=n,a.options={...r.options,baseURL:ML(n)||void 0},e=a.options}a.trustedOrigins=await dU(e,t),a.trustedProviders=await gU(e,t)}let{handler:o}=KJ(a,e);return KR(a.adapter,()=>o(t))};return{handler:a,fetch:a,api:r,options:e,$context:n,$ERROR_CODES:{...i,...J}}},h1=e=>m1(e,p1),X=qF({INVALID_METADATA_TYPE:`metadata must be an object or undefined`,REFILL_AMOUNT_AND_INTERVAL_REQUIRED:`refillAmount is required when refillInterval is provided`,REFILL_INTERVAL_AND_AMOUNT_REQUIRED:`refillInterval is required when refillAmount is provided`,USER_BANNED:`User is banned`,UNAUTHORIZED_SESSION:`Unauthorized or invalid session`,KEY_NOT_FOUND:`API Key not found`,KEY_DISABLED:`API Key is disabled`,KEY_EXPIRED:`API Key has expired`,USAGE_EXCEEDED:`API Key has reached its usage limit`,KEY_NOT_RECOVERABLE:`API Key is not recoverable`,EXPIRES_IN_IS_TOO_SMALL:`The expiresIn is smaller than the predefined minimum value.`,EXPIRES_IN_IS_TOO_LARGE:`The expiresIn is larger than the predefined maximum value.`,INVALID_REMAINING:`The remaining count is either too large or too small.`,INVALID_PREFIX_LENGTH:`The prefix length is either too large or too small.`,INVALID_NAME_LENGTH:`The name length is either too large or too small.`,METADATA_DISABLED:`Metadata is disabled.`,RATE_LIMIT_EXCEEDED:`Rate limit exceeded.`,NO_VALUES_TO_UPDATE:`No values to update.`,KEY_DISABLED_EXPIRATION:`Custom key expiration values are disabled.`,INVALID_API_KEY:`Invalid API key.`,INVALID_USER_ID_FROM_API_KEY:`The user id from the API key is invalid.`,INVALID_REFERENCE_ID_FROM_API_KEY:`The reference id from the API key is invalid.`,INVALID_API_KEY_GETTER_RETURN_TYPE:`API Key getter returned an invalid key type. Expected string.`,SERVER_ONLY_PROPERTY:`The property you're trying to set can only be set from the server auth instance only.`,FAILED_TO_UPDATE_API_KEY:`Failed to update API key`,NAME_REQUIRED:`API Key name is required.`,ORGANIZATION_ID_REQUIRED:`Organization ID is required for organization-owned API keys.`,USER_NOT_MEMBER_OF_ORGANIZATION:`You are not a member of the organization that owns this API key.`,INSUFFICIENT_API_KEY_PERMISSIONS:`You do not have permission to perform this action on organization API keys.`,NO_DEFAULT_API_KEY_CONFIGURATION_FOUND:`No default api-key configuration found.`,ORGANIZATION_PLUGIN_REQUIRED:`Organization plugin is required for organization-owned API keys. Please install and configure the organization plugin.`});async function g1(e,t,n){let r=e.length;if(r===0)return[];let{signal:i}=n;if(i?.aborted)throw i.reason;let a=Math.floor(n.concurrency),o=Math.min(r,a>=1?a:1),s=Array(r),c=0,l=!1;return await Promise.all(Array.from({length:o},async()=>{for(;!l&&c<r;){if(i?.aborted)throw i.reason;let n=c++;try{s[n]=await t(e[n],n)}catch(e){throw l=!0,e}}})),s}const _1={proto:/"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,constructor:/"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,protoShort:/"__proto__"\s*:/,constructorShort:/"constructor"\s*:/},v1=/^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/,y1={true:!0,false:!1,null:null,undefined:void 0,nan:NaN,infinity:1/0,"-infinity":-1/0},b1=/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,7}))?(?:Z|([+-])(\d{2}):(\d{2}))$/;function x1(e){return e instanceof Date&&!isNaN(e.getTime())}function S1(e){let t=b1.exec(e);if(!t)return null;let[,n,r,i,a,o,s,c,l,u,d]=t,f=new Date(Date.UTC(parseInt(n,10),parseInt(r,10)-1,parseInt(i,10),parseInt(a,10),parseInt(o,10),parseInt(s,10),c?parseInt(c.padEnd(3,`0`),10):0));if(l){let e=(parseInt(u,10)*60+parseInt(d,10))*(l===`+`?-1:1);f.setUTCMinutes(f.getUTCMinutes()+e)}return x1(f)?f:null}function C1(e,t={}){let{strict:n=!1,warnings:r=!1,reviver:i,parseDates:a=!0}=t;if(typeof e!=`string`)return e;let o=e.trim(),s=o.toLowerCase();if(s.length<=9&&s in y1)return y1[s];if(!v1.test(o)){if(n)throw SyntaxError(`[better-json] Invalid JSON`);return e}if(Object.entries(_1).some(([e,t])=>{let n=t.test(o);return n&&r&&console.warn(`[better-json] Detected potential prototype pollution attempt using ${e} pattern`),n})&&n)throw Error(`[better-json] Potential prototype pollution attempt detected`);try{return JSON.parse(o,(e,t)=>{if(e===`__proto__`||e===`constructor`&&t&&typeof t==`object`&&`prototype`in t){r&&console.warn(`[better-json] Dropping "${e}" key to prevent prototype pollution`);return}if(a&&typeof t==`string`){let e=S1(t);if(e)return e}return i?i(e,t):t})}catch(t){if(n)throw t;return e}}function w1(e,t={strict:!0}){return C1(e,t)}function T1(e){return e==null?null:typeof e==`object`?e:Ee(e)}function E1(e){return e!=null&&typeof e==`string`}async function D1(e,t,n){if(n.storage!==`database`&&!n.fallbackToDatabase)return;let r=t.filter(e=>E1(e.metadata));if(r.length===0)return;let i=r.map(async t=>{let n=T1(t.metadata);try{await e.context.adapter.update({model:`apikey`,where:[{field:`id`,value:t.id}],update:{metadata:n}})}catch(n){e.context.logger.warn(`Failed to migrate double-stringified metadata for API key ${t.id}:`,n)}});await Promise.all(i)}async function O1(e,t,n){let r=T1(t.metadata);if(E1(t.metadata)&&(n.storage===`database`||n.fallbackToDatabase))try{await e.context.adapter.update({model:`apikey`,where:[{field:`id`,value:t.id}],update:{metadata:r}})}catch(n){e.context.logger.warn(`Failed to migrate double-stringified metadata for API key ${t.id}:`,n)}return r}function k1(e){return`api-key:${e}`}function A1(e){return`api-key:by-id:${e}`}function j1(e){return`api-key:by-ref:${e}`}function M1(e){return JSON.stringify({...e,createdAt:e.createdAt.toISOString(),updatedAt:e.updatedAt.toISOString(),expiresAt:e.expiresAt?.toISOString()??null,lastRefillAt:e.lastRefillAt?.toISOString()??null,lastRequest:e.lastRequest?.toISOString()??null})}function N1(e){if(!e||typeof e!=`string`)return null;try{let t=JSON.parse(e);return{...t,createdAt:new Date(t.createdAt),updatedAt:new Date(t.updatedAt),expiresAt:t.expiresAt?new Date(t.expiresAt):null,lastRefillAt:t.lastRefillAt?new Date(t.lastRefillAt):null,lastRequest:t.lastRequest?new Date(t.lastRequest):null}}catch{return null}}function P1(e,t){return t.customStorage?t.customStorage:e.context.secondaryStorage||null}function F1(e){if(e.expiresAt){let t=Date.now(),n=new Date(e.expiresAt).getTime(),r=Math.floor((n-t)/1e3);if(r>0)return r}}async function I1(e,t,n){let r=k1(t);return N1(await n.get(r))}async function L1(e,t,n){let r=A1(t);return N1(await n.get(r))}const R1=/* @__PURE__ */ new Map;function z1(e,t){let n=(R1.get(e)??Promise.resolve()).then(t,t).finally(()=>{R1.get(e)===n&&R1.delete(e)});return R1.set(e,n),n}async function B1(e,t,n){await z1(t,async()=>{let r=await e.get(t),i=[];if(r&&typeof r==`string`)try{i=JSON.parse(r)}catch{i=[]}else Array.isArray(r)&&(i=r);let a=n(i);a.length===0?await e.delete(t):await e.set(t,JSON.stringify(a))})}async function V1(e,t,n,r,i){let a=M1(t),o=j1(t.referenceId);if(i.fallbackToDatabase){await Promise.all([n.set(k1(t.key),a,r),n.set(A1(t.id),a,r),n.delete(o)]);return}await Promise.all([n.set(k1(t.key),a,r),n.set(A1(t.id),a,r)]),await B1(n,o,e=>e.includes(t.id)?e:[...e,t.id])}async function H1(e,t,n,r){let i=j1(t.referenceId);if(r.fallbackToDatabase){await Promise.all([n.delete(k1(t.key)),n.delete(A1(t.id)),n.delete(i)]);return}await Promise.all([n.delete(k1(t.key)),n.delete(A1(t.id)),B1(n,i,e=>e.filter(e=>e!==t.id))])}async function U1(e,t,n){let r=P1(e,n);if(n.storage===`database`)return await e.context.adapter.findOne({model:`apikey`,where:[{field:`key`,value:t}]});if(n.storage===`secondary-storage`&&n.fallbackToDatabase){if(r){let n=await I1(e,t,r);if(n)return n}let i=await e.context.adapter.findOne({model:`apikey`,where:[{field:`key`,value:t}]});return i&&r&&await V1(e,i,r,F1(i),n),i}return n.storage===`secondary-storage`?r?await I1(e,t,r):null:await e.context.adapter.findOne({model:`apikey`,where:[{field:`key`,value:t}]})}async function W1(e,t,n){let r=P1(e,n);if(n.storage===`database`)return await e.context.adapter.findOne({model:`apikey`,where:[{field:`id`,value:t}]});if(n.storage===`secondary-storage`&&n.fallbackToDatabase){if(r){let n=await L1(e,t,r);if(n)return n}let i=await e.context.adapter.findOne({model:`apikey`,where:[{field:`id`,value:t}]});return i&&r&&await V1(e,i,r,F1(i),n),i}return n.storage===`secondary-storage`?r?await L1(e,t,r):null:await e.context.adapter.findOne({model:`apikey`,where:[{field:`id`,value:t}]})}async function G1(e,t,n){let r=P1(e,n),i=F1(t);if(n.storage!==`database`&&n.storage===`secondary-storage`){if(!r)throw Error(`Secondary storage is required when storage mode is 'secondary-storage'`);await V1(e,t,r,i,n);return}}async function K1(e,t,n){let r=P1(e,n);if(n.storage!==`database`&&n.storage===`secondary-storage`){if(!r)throw Error(`Secondary storage is required when storage mode is 'secondary-storage'`);await H1(e,t,r,n);return}}function q1(e,t,n,r,i){let a=[...e];if(t){let e=n||`asc`;a.sort((n,r)=>{let i=n[t],a=r[t];return i==null&&a==null?0:i==null?e===`asc`?-1:1:a==null?e===`asc`?1:-1:i<a?e===`asc`?-1:1:i>a?e===`asc`?1:-1:0})}return i!==void 0&&(a=a.slice(i)),r!==void 0&&(a=a.slice(0,r)),a}async function J1(e,t,n,r){let i=P1(e,n),{limit:a,offset:o,sortBy:s,sortDirection:c}=r||{};if(n.storage===`database`){let[n,r]=await Promise.all([e.context.adapter.findMany({model:`apikey`,where:[{field:`referenceId`,value:t}],limit:a,offset:o,sortBy:s?{field:s,direction:c||`asc`}:void 0}),e.context.adapter.count({model:`apikey`,where:[{field:`referenceId`,value:t}]})]);return{apiKeys:n,total:r}}if(n.storage===`secondary-storage`&&n.fallbackToDatabase){let r=j1(t);if(i){let t=await i.get(r),n=[];if(t&&typeof t==`string`)try{n=JSON.parse(t)}catch{n=[]}else Array.isArray(t)&&(n=t);if(n.length>0){let t=(await g1(n,t=>L1(e,t,i),{concurrency:10})).filter(e=>e!=null);return{apiKeys:q1(t,s,c,a,o),total:t.length}}}let[l,u]=await Promise.all([e.context.adapter.findMany({model:`apikey`,where:[{field:`referenceId`,value:t}],limit:a,offset:o,sortBy:s?{field:s,direction:c||`asc`}:void 0}),e.context.adapter.count({model:`apikey`,where:[{field:`referenceId`,value:t}]})]);if(i&&l.length>0){await g1(l,t=>V1(e,t,i,F1(t),n),{concurrency:10});let t=l.map(e=>e.id);await i.set(r,JSON.stringify(t))}return{apiKeys:l,total:u}}if(n.storage===`secondary-storage`){if(!i)return{apiKeys:[],total:0};let n=j1(t),r=await i.get(n),l=[];if(r&&typeof r==`string`)try{l=JSON.parse(r)}catch{return{apiKeys:[],total:0}}else if(Array.isArray(r))l=r;else return{apiKeys:[],total:0};let u=(await g1(l,t=>L1(e,t,i),{concurrency:10})).filter(e=>e!=null);return{apiKeys:q1(u,s,c,a,o),total:u.length}}let[l,u]=await Promise.all([e.context.adapter.findMany({model:`apikey`,where:[{field:`referenceId`,value:t}],limit:a,offset:o,sortBy:s?{field:s,direction:c||`asc`}:void 0}),e.context.adapter.count({model:`apikey`,where:[{field:`referenceId`,value:t}]})]);return{apiKeys:l,total:u}}function Y1(e){let t=e.context;if(`orgOptions`in t&&t.orgOptions)return t.orgOptions;let n=t.getPlugin?.(`organization`);return n&&`options`in n?n.options:null}async function X1(e,t,n,r){let i=Y1(e);if(!i){let e=X.ORGANIZATION_PLUGIN_REQUIRED;throw c.from(`INTERNAL_SERVER_ERROR`,e)}let a=await e.context.adapter.findOne({model:`member`,where:[{field:`userId`,value:t},{field:`organizationId`,value:n}]});if(!a){let e=X.USER_NOT_MEMBER_OF_ORGANIZATION;throw c.from(`FORBIDDEN`,e)}if(!await Z1(e,a.role,n,r,i)){let e=X.INSUFFICIENT_API_KEY_PERMISSIONS;throw c.from(`FORBIDDEN`,e)}return a}async function Z1(e,t,n,r,i){let{hasPermission:a}=await import(`./organization-Bz1iQbJ0.mjs`);try{return await a({role:t,options:i,permissions:{apiKey:[r]},organizationId:n,allowCreatorAllPermissions:!0},e)}catch{return!1}}const Q1=(e,t=`ms`)=>new Date(Date.now()+(t===`sec`?e*1e3:e));function $1(e){return e instanceof c||e instanceof c||e?.name===`APIError`}const e0=D({configId:f().meta({description:`The configuration ID to use for the API key. If not provided, the default configuration will be used.`}).optional(),name:f().meta({description:`Name of the Api Key`}).optional(),expiresIn:m().meta({description:`Expiration time of the Api Key in seconds`}).min(1).optional().nullable().default(null),prefix:f().meta({description:`Prefix of the Api Key`}).regex(/^[a-zA-Z0-9_-]+$/,{message:`Invalid prefix format, must be alphanumeric and contain only underscores and hyphens.`}).optional(),remaining:m().meta({description:`Remaining number of requests. Server side only`}).min(0).optional().nullable().default(null),metadata:ie().optional(),refillAmount:m().meta({description:`Amount to refill the remaining count of the Api Key. server-only. Eg: 100`}).min(1).optional(),refillInterval:m().meta({description:`Interval to refill the Api Key in milliseconds. server-only. Eg: 1000`}).optional(),rateLimitTimeWindow:m().meta({description:"The duration in milliseconds where each request is counted. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 1000"}).optional(),rateLimitMax:m().meta({description:"Maximum amount of requests allowed within a window. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 100"}).optional(),rateLimitEnabled:T().meta({description:`Whether the key has rate limiting enabled. server-only. Eg: true`}).optional(),permissions:g(f(),_(f())).meta({description:`Permissions of the Api Key.`}).optional(),userId:wI().meta({description:`User Id of the user that the Api Key belongs to. server-only. Eg: "user-id"`}).optional(),organizationId:wI().meta({description:`Organization Id of the organization that the Api Key belongs to. Eg: 'org-id'`}).optional()});function t0({defaultKeyGenerator:e,configurations:t,schema:n,deleteAllExpiredApiKeys:r}){return Y(`/api-key/create`,{method:`POST`,body:e0,metadata:{openapi:{description:`Create a new API key for a user`,responses:{200:{description:`API key created successfully`,content:{"application/json":{schema:{type:`object`,properties:{id:{type:`string`,description:`Unique identifier of the API key`},createdAt:{type:`string`,format:`date-time`,description:`Creation timestamp`},updatedAt:{type:`string`,format:`date-time`,description:`Last update timestamp`},name:{type:`string`,nullable:!0,description:`Name of the API key`},prefix:{type:`string`,nullable:!0,description:`Prefix of the API key`},start:{type:`string`,nullable:!0,description:`Starting characters of the key (if configured)`},key:{type:`string`,description:`The full API key (only returned on creation)`},enabled:{type:`boolean`,description:`Whether the key is enabled`},expiresAt:{type:`string`,format:`date-time`,nullable:!0,description:`Expiration timestamp`},referenceId:{type:`string`,description:`ID of the reference owning the key`},lastRefillAt:{type:`string`,format:`date-time`,nullable:!0,description:`Last refill timestamp`},lastRequest:{type:`string`,format:`date-time`,nullable:!0,description:`Last request timestamp`},metadata:{type:`object`,nullable:!0,additionalProperties:!0,description:`Metadata associated with the key`},rateLimitMax:{type:`number`,nullable:!0,description:`Maximum requests in time window`},rateLimitTimeWindow:{type:`number`,nullable:!0,description:`Rate limit time window in milliseconds`},remaining:{type:`number`,nullable:!0,description:`Remaining requests`},refillAmount:{type:`number`,nullable:!0,description:`Amount to refill`},refillInterval:{type:`number`,nullable:!0,description:`Refill interval in milliseconds`},rateLimitEnabled:{type:`boolean`,description:`Whether rate limiting is enabled`},requestCount:{type:`number`,description:`Current request count in window`},permissions:{type:`object`,nullable:!0,additionalProperties:{type:`array`,items:{type:`string`}},description:`Permissions associated with the key`}},required:[`id`,`createdAt`,`updatedAt`,`key`,`enabled`,`referenceId`,`rateLimitEnabled`,`requestCount`]}}}}}}}},async n=>{let{configId:i,name:a,expiresIn:o,prefix:s,remaining:l,metadata:u,refillAmount:d,refillInterval:f,permissions:p,rateLimitMax:m,rateLimitTimeWindow:h,rateLimitEnabled:g}=n.body,_=x0(n.context,t,i),v=_.customKeyGenerator||e,y=await CH(n,{disableCookieCache:!0}),b=n.request||n.headers;if(b&&(d!==void 0||f!==void 0||m!==void 0||h!==void 0||g!==void 0||p!==void 0||l!==null))throw c.from(`BAD_REQUEST`,X.SERVER_ONLY_PROPERTY);if(n.request&&n.body.userId!==void 0)throw c.from(`UNAUTHORIZED`,X.UNAUTHORIZED_SESSION);let x=_.references??`user`,S;if(x===`organization`){let e=n.body.organizationId;if(!e){let e=X.ORGANIZATION_ID_REQUIRED;throw c.from(`BAD_REQUEST`,e)}let t=y?.user.id||n.body.userId;if(!t)throw c.from(`UNAUTHORIZED`,X.UNAUTHORIZED_SESSION);await X1(n,t,e,`create`),S=e}else if(b){if(!y?.user.id){let e=X.UNAUTHORIZED_SESSION;throw c.from(`UNAUTHORIZED`,e)}S=y.user.id}else{let e=n.body.userId,t=y?.user.id;if(!t&&!e){let e=X.UNAUTHORIZED_SESSION;throw c.from(`UNAUTHORIZED`,e)}if(y&&e&&t!==e){let e=X.UNAUTHORIZED_SESSION;throw c.from(`UNAUTHORIZED`,e)}S=t||e}if(u){if(_.enableMetadata===!1)throw c.from(`BAD_REQUEST`,X.METADATA_DISABLED);if(typeof u!=`object`)throw c.from(`BAD_REQUEST`,X.INVALID_METADATA_TYPE)}if(d&&!f){let e=X.REFILL_AMOUNT_AND_INTERVAL_REQUIRED;throw c.from(`BAD_REQUEST`,e)}if(f&&!d){let e=X.REFILL_INTERVAL_AND_AMOUNT_REQUIRED;throw c.from(`BAD_REQUEST`,e)}if(o){if(_.keyExpiration.disableCustomExpiresTime===!0){let e=X.KEY_DISABLED_EXPIRATION;throw c.from(`BAD_REQUEST`,e)}let e=o/86400;if(_.keyExpiration.minExpiresIn>e){let e=X.EXPIRES_IN_IS_TOO_SMALL;throw c.from(`BAD_REQUEST`,e)}if(_.keyExpiration.maxExpiresIn<e){let e=X.EXPIRES_IN_IS_TOO_LARGE;throw c.from(`BAD_REQUEST`,e)}}if(s&&(s.length<_.minimumPrefixLength||s.length>_.maximumPrefixLength))throw c.from(`BAD_REQUEST`,X.INVALID_PREFIX_LENGTH);if(a){if(a.length<_.minimumNameLength||a.length>_.maximumNameLength)throw c.from(`BAD_REQUEST`,X.INVALID_NAME_LENGTH)}else if(_.requireName)throw c.from(`BAD_REQUEST`,X.NAME_REQUIRED);r(n.context);let C=await v({length:_.defaultKeyLength,prefix:s||_.defaultPrefix}),w=_.disableKeyHashing?C:await O0(C),T=null;_.startingCharactersConfig.shouldStore&&(T=C.substring(0,_.startingCharactersConfig.charactersLength));let ee=_.permissions?.defaultPermissions?typeof _.permissions.defaultPermissions==`function`?await _.permissions.defaultPermissions(S,n):_.permissions.defaultPermissions:void 0,te=p?JSON.stringify(p):ee?JSON.stringify(ee):void 0,E={configId:_.configId??`default`,createdAt:/* @__PURE__ */ new Date,updatedAt:/* @__PURE__ */ new Date,name:a??null,prefix:s??_.defaultPrefix??null,start:T,key:w,enabled:!0,expiresAt:o?Q1(o,`sec`):_.keyExpiration.defaultExpiresIn?Q1(_.keyExpiration.defaultExpiresIn,`sec`):null,referenceId:S,lastRefillAt:null,lastRequest:null,metadata:null,rateLimitMax:m??_.rateLimit.maxRequests??null,rateLimitTimeWindow:h??_.rateLimit.timeWindow??null,remaining:l===null?l:l??d??null,refillAmount:d??null,refillInterval:f??null,rateLimitEnabled:g===void 0?_.rateLimit.enabled??!0:g,requestCount:0,permissions:te};u&&(E.metadata=u);let ne;if(_.storage===`secondary-storage`&&_.fallbackToDatabase)ne=await n.context.adapter.create({model:k0,data:E}),await G1(n,ne,_);else if(_.storage===`secondary-storage`){let e=n.context.generateId({model:`apikey`})||Gt();ne={...E,id:e},await G1(n,ne,_)}else ne=await n.context.adapter.create({model:k0,data:E});return n.json({...ne,key:C,metadata:u??null,permissions:ne.permissions?Ee(ne.permissions):null})})}function n0({deleteAllExpiredApiKeys:e}){return Y.serverOnly({method:`POST`},async t=>{try{await e(t.context,!0)}catch(e){return t.context.logger.error(`[API KEY PLUGIN] Failed to delete expired API keys:`,e),t.json({success:!1,error:e})}return t.json({success:!0,error:null})})}const r0=D({configId:f().meta({description:`The configuration ID to use for the API key lookup. If not provided, the default configuration will be used.`}).optional(),keyId:f().meta({description:`The id of the Api Key`})});function i0({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return Y(`/api-key/delete`,{method:`POST`,body:r0,use:[TH],metadata:{openapi:{description:`Delete an existing API key`,requestBody:{content:{"application/json":{schema:{type:`object`,properties:{keyId:{type:`string`,description:`The id of the API key to delete`}},required:[`keyId`]}}}},responses:{200:{description:`API key deleted successfully`,content:{"application/json":{schema:{type:`object`,properties:{success:{type:`boolean`,description:`Indicates if the API key was successfully deleted`}},required:[`success`]}}}}}}}},async t=>{let{configId:r,keyId:i}=t.body,a=t.context.session;if(a.user.banned===!0)throw c.from(`UNAUTHORIZED`,X.USER_BANNED);let o=x0(t.context,e,r),s=null;if(s=await W1(t,i,o),!s||!C0(s.configId,o.configId))throw c.from(`NOT_FOUND`,X.KEY_NOT_FOUND);let l=x0(t.context,e,s.configId);if((l.references??`user`)===`organization`)await X1(t,a.user.id,s.referenceId,`delete`);else if(s.referenceId!==a.user.id)throw c.from(`NOT_FOUND`,X.KEY_NOT_FOUND);try{l.storage===`secondary-storage`&&l.fallbackToDatabase?(await K1(t,s,l),await t.context.adapter.delete({model:k0,where:[{field:`id`,value:s.id}]})):l.storage===`database`?await t.context.adapter.delete({model:k0,where:[{field:`id`,value:s.id}]}):await K1(t,s,l)}catch(e){throw c.fromStatus(`INTERNAL_SERVER_ERROR`,{message:e?.message})}return n(t.context),t.json({success:!0})})}const a0=D({configId:f().meta({description:`The configuration ID to use for the API key lookup. If not provided, the default configuration will be used.`}).optional(),id:f().meta({description:`The id of the Api Key`})});function o0({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return Y(`/api-key/get`,{method:`GET`,query:a0,use:[TH],metadata:{openapi:{description:`Retrieve an existing API key by ID`,responses:{200:{description:`API key retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{id:{type:`string`,description:`ID`},name:{type:`string`,nullable:!0,description:`The name of the key`},start:{type:`string`,nullable:!0,description:`Shows the first few characters of the API key, including the prefix. This allows you to show those few characters in the UI to make it easier for users to identify the API key.`},prefix:{type:`string`,nullable:!0,description:`The API Key prefix. Stored as plain text.`},userId:{type:`string`,description:`The owner of the user id`},refillInterval:{type:`number`,nullable:!0,description:"The interval in milliseconds between refills of the `remaining` count. Example: 3600000 // refill every hour (3600000ms = 1h)"},refillAmount:{type:`number`,nullable:!0,description:`The amount to refill`},lastRefillAt:{type:`string`,format:`date-time`,nullable:!0,description:`The last refill date`},enabled:{type:`boolean`,description:`Sets if key is enabled or disabled`,default:!0},rateLimitEnabled:{type:`boolean`,description:`Whether the key has rate limiting enabled`},rateLimitTimeWindow:{type:`number`,nullable:!0,description:`The duration in milliseconds`},rateLimitMax:{type:`number`,nullable:!0,description:`Maximum amount of requests allowed within a window`},requestCount:{type:`number`,description:`The number of requests made within the rate limit time window`},remaining:{type:`number`,nullable:!0,description:`Remaining requests (every time api key is used this should updated and should be updated on refill as well)`},lastRequest:{type:`string`,format:`date-time`,nullable:!0,description:`When last request occurred`},expiresAt:{type:`string`,format:`date-time`,nullable:!0,description:`Expiry date of a key`},createdAt:{type:`string`,format:`date-time`,description:`created at`},updatedAt:{type:`string`,format:`date-time`,description:`updated at`},metadata:{type:`object`,nullable:!0,additionalProperties:!0,description:`Extra metadata about the apiKey`},permissions:{type:`string`,nullable:!0,description:`Permissions for the api key (stored as JSON string)`}},required:[`id`,`userId`,`enabled`,`rateLimitEnabled`,`requestCount`,`createdAt`,`updatedAt`]}}}}}}}},async t=>{let{configId:r,id:i}=t.query,a=t.context.session,o=x0(t.context,e,r),s=null;if(s=await W1(t,i,o),!s||!C0(s.configId,o.configId))throw c.from(`NOT_FOUND`,X.KEY_NOT_FOUND);let l=x0(t.context,e,s.configId);if((l.references??`user`)===`organization`)await X1(t,a.user.id,s.referenceId,`read`);else if(s.referenceId!==a.user.id)throw c.from(`NOT_FOUND`,X.KEY_NOT_FOUND);n(t.context);let u=await O1(t,s,l),{key:d,...f}=s;return t.json({...f,metadata:u,permissions:f.permissions?Ee(f.permissions):null})})}function s0(e){return e.storage===`database`?`database`:e.customStorage?`custom:${e.configId??`default`}`:e.fallbackToDatabase?`secondary-storage-with-fallback`:`secondary-storage`}const c0=D({configId:f().meta({description:`Filter by configuration ID. If not provided, returns keys from all configurations.`}).optional(),organizationId:f().meta({description:`Organization ID to list keys for. If provided, returns organization-owned keys. If not provided, returns user-owned keys.`}).optional(),limit:TI().int().nonnegative().meta({description:`The number of API keys to return`}).optional(),offset:TI().int().nonnegative().meta({description:`The offset to start from`}).optional(),sortBy:f().meta({description:`The field to sort by (e.g., createdAt, name, expiresAt)`}).optional(),sortDirection:E([`asc`,`desc`]).meta({description:`The direction to sort by`}).optional()}).optional();function l0({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return Y(`/api-key/list`,{method:`GET`,use:[TH],query:c0,metadata:{openapi:{description:`List all API keys for the authenticated user or for a specific organization`,responses:{200:{description:`API keys retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{apiKeys:{type:`array`,items:{type:`object`,properties:{id:{type:`string`,description:`ID`},name:{type:`string`,nullable:!0,description:`The name of the key`},start:{type:`string`,nullable:!0,description:`Shows the first few characters of the API key, including the prefix. This allows you to show those few characters in the UI to make it easier for users to identify the API key.`},prefix:{type:`string`,nullable:!0,description:`The API Key prefix. Stored as plain text.`},userId:{type:`string`,description:`The owner of the user id`},refillInterval:{type:`number`,nullable:!0,description:"The interval in milliseconds between refills of the `remaining` count. Example: 3600000 // refill every hour (3600000ms = 1h)"},refillAmount:{type:`number`,nullable:!0,description:`The amount to refill`},lastRefillAt:{type:`string`,format:`date-time`,nullable:!0,description:`The last refill date`},enabled:{type:`boolean`,description:`Sets if key is enabled or disabled`,default:!0},rateLimitEnabled:{type:`boolean`,description:`Whether the key has rate limiting enabled`},rateLimitTimeWindow:{type:`number`,nullable:!0,description:`The duration in milliseconds`},rateLimitMax:{type:`number`,nullable:!0,description:`Maximum amount of requests allowed within a window`},requestCount:{type:`number`,description:`The number of requests made within the rate limit time window`},remaining:{type:`number`,nullable:!0,description:`Remaining requests (every time api key is used this should updated and should be updated on refill as well)`},lastRequest:{type:`string`,format:`date-time`,nullable:!0,description:`When last request occurred`},expiresAt:{type:`string`,format:`date-time`,nullable:!0,description:`Expiry date of a key`},createdAt:{type:`string`,format:`date-time`,description:`created at`},updatedAt:{type:`string`,format:`date-time`,description:`updated at`},metadata:{type:`object`,nullable:!0,additionalProperties:!0,description:`Extra metadata about the apiKey`},permissions:{type:`string`,nullable:!0,description:`Permissions for the api key (stored as JSON string)`}},required:[`id`,`userId`,`enabled`,`rateLimitEnabled`,`requestCount`,`createdAt`,`updatedAt`]}},total:{type:`number`,description:`Total number of API keys`},limit:{type:`number`,nullable:!0,description:`The limit used for pagination`},offset:{type:`number`,nullable:!0,description:`The offset used for pagination`}},required:[`apiKeys`,`total`]}}}}}}}},async t=>{let r=t.context.session,i=t.query?.configId,a=t.query?.organizationId,o=t.query?.limit==null?void 0:Number(t.query.limit),s=t.query?.offset==null?void 0:Number(t.query.offset);a&&await X1(t,r.user.id,a,`read`);let c=a??r.user.id,l=a?`organization`:`user`,u=[];if(i){let{apiKeys:n}=await J1(t,c,x0(t.context,e,i),{limit:void 0,offset:void 0,sortBy:t.query?.sortBy,sortDirection:t.query?.sortDirection});u=n}else{let n=/* @__PURE__ */ new Map;for(let t of e){let e=s0(t);n.has(e)||n.set(e,t)}let r=await Promise.all([...n.values()].map(e=>J1(t,c,e,{limit:void 0,offset:void 0,sortBy:t.query?.sortBy,sortDirection:t.query?.sortDirection}))),i=/* @__PURE__ */ new Set;for(let{apiKeys:e}of r)for(let t of e)i.has(t.id)||(i.add(t.id),u.push(t))}let d=u.filter(t=>(e.find(e=>S0(t.configId)?S0(e.configId):e.configId===t.configId)?.references??`user`)===l&&t.referenceId===c);i&&(d=d.filter(e=>C0(e.configId,i)));let f=d.length,p=d;s!==void 0&&(p=p.slice(s)),o!==void 0&&(p=p.slice(0,o)),n(t.context);let m=p.map(e=>{let{key:t,...n}=e;return{...n,metadata:T1(e.metadata),permissions:n.permissions?Ee(n.permissions):null}}),h=e.find(e=>e.storage===`database`||e.fallbackToDatabase);return h&&await t.context.runInBackgroundOrAwait(D1(t,p,h)),t.json({apiKeys:m,total:f,limit:o,offset:s})})}const u0=D({configId:f().meta({description:`The configuration ID to use for the API key lookup. If not provided, the default configuration will be used.`}).optional(),keyId:f().meta({description:`The id of the Api Key`}),userId:wI().meta({description:`The id of the user which the api key belongs to. server-only. Eg: "some-user-id"`}).optional(),name:f().meta({description:`The name of the key`}).optional(),enabled:T().meta({description:`Whether the Api Key is enabled or not`}).optional(),remaining:m().meta({description:`The number of remaining requests`}).min(1).optional(),refillAmount:m().meta({description:`The refill amount`}).optional(),refillInterval:m().meta({description:`The refill interval`}).optional(),metadata:ie().optional(),expiresIn:m().meta({description:`Expiration time of the Api Key in seconds`}).min(1).optional().nullable(),rateLimitEnabled:T().meta({description:`Whether the key has rate limiting enabled.`}).optional(),rateLimitTimeWindow:m().meta({description:`The duration in milliseconds where each request is counted. server-only. Eg: 1000`}).optional(),rateLimitMax:m().meta({description:"Maximum amount of requests allowed within a window. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 100"}).optional(),permissions:g(f(),_(f())).meta({description:`Update the permissions on the API Key. server-only.`}).optional().nullable()});function d0({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return Y(`/api-key/update`,{method:`POST`,body:u0,metadata:{openapi:{description:`Update an existing API key by ID`,responses:{200:{description:`API key updated successfully`,content:{"application/json":{schema:{type:`object`,properties:{id:{type:`string`,description:`ID`},name:{type:`string`,nullable:!0,description:`The name of the key`},start:{type:`string`,nullable:!0,description:`Shows the first few characters of the API key, including the prefix. This allows you to show those few characters in the UI to make it easier for users to identify the API key.`},prefix:{type:`string`,nullable:!0,description:`The API Key prefix. Stored as plain text.`},userId:{type:`string`,description:`The owner of the user id`},refillInterval:{type:`number`,nullable:!0,description:"The interval in milliseconds between refills of the `remaining` count. Example: 3600000 // refill every hour (3600000ms = 1h)"},refillAmount:{type:`number`,nullable:!0,description:`The amount to refill`},lastRefillAt:{type:`string`,format:`date-time`,nullable:!0,description:`The last refill date`},enabled:{type:`boolean`,description:`Sets if key is enabled or disabled`,default:!0},rateLimitEnabled:{type:`boolean`,description:`Whether the key has rate limiting enabled`},rateLimitTimeWindow:{type:`number`,nullable:!0,description:`The duration in milliseconds`},rateLimitMax:{type:`number`,nullable:!0,description:`Maximum amount of requests allowed within a window`},requestCount:{type:`number`,description:`The number of requests made within the rate limit time window`},remaining:{type:`number`,nullable:!0,description:`Remaining requests (every time api key is used this should updated and should be updated on refill as well)`},lastRequest:{type:`string`,format:`date-time`,nullable:!0,description:`When last request occurred`},expiresAt:{type:`string`,format:`date-time`,nullable:!0,description:`Expiry date of a key`},createdAt:{type:`string`,format:`date-time`,description:`created at`},updatedAt:{type:`string`,format:`date-time`,description:`updated at`},metadata:{type:`object`,nullable:!0,additionalProperties:!0,description:`Extra metadata about the apiKey`},permissions:{type:`string`,nullable:!0,description:`Permissions for the api key (stored as JSON string)`}},required:[`id`,`userId`,`enabled`,`rateLimitEnabled`,`requestCount`,`createdAt`,`updatedAt`]}}}}}}}},async t=>{let{configId:r,keyId:i,expiresIn:a,enabled:o,metadata:s,refillAmount:l,refillInterval:u,remaining:d,name:f,permissions:p,rateLimitEnabled:m,rateLimitTimeWindow:h,rateLimitMax:g}=t.body,_=await CH(t,{disableCookieCache:!0}),v=t.request||t.headers,y=v&&!_?null:_?.user||{id:t.body.userId};if(!y?.id||_&&t.body.userId&&_?.user.id!==t.body.userId)throw c.from(`UNAUTHORIZED`,X.UNAUTHORIZED_SESSION);if(v&&(l!==void 0||u!==void 0||g!==void 0||h!==void 0||m!==void 0||d!==void 0||p!==void 0))throw c.from(`BAD_REQUEST`,X.SERVER_ONLY_PROPERTY);let b=x0(t.context,e,r),x=null;if(x=await W1(t,i,b),!x||!C0(x.configId,b.configId))throw c.from(`NOT_FOUND`,X.KEY_NOT_FOUND);let S=x0(t.context,e,x.configId);if((S.references??`user`)===`organization`)await X1(t,y.id,x.referenceId,`update`);else if(x.referenceId!==y.id)throw c.from(`NOT_FOUND`,X.KEY_NOT_FOUND);let C={};if(f!==void 0){if(f.length<S.minimumNameLength||f.length>S.maximumNameLength)throw c.from(`BAD_REQUEST`,X.INVALID_NAME_LENGTH);C.name=f}if(o!==void 0&&(C.enabled=o),a!==void 0){if(S.keyExpiration.disableCustomExpiresTime===!0)throw c.from(`BAD_REQUEST`,X.KEY_DISABLED_EXPIRATION);if(a!==null){let e=a/86400;if(e<S.keyExpiration.minExpiresIn)throw c.from(`BAD_REQUEST`,X.EXPIRES_IN_IS_TOO_SMALL);if(e>S.keyExpiration.maxExpiresIn)throw c.from(`BAD_REQUEST`,X.EXPIRES_IN_IS_TOO_LARGE)}C.expiresAt=a?Q1(a,`sec`):null}if(s!==void 0&&S.enableMetadata===!0){if(typeof s!=`object`)throw c.from(`BAD_REQUEST`,X.INVALID_METADATA_TYPE);C.metadata=s}if(d!==void 0&&(C.remaining=d),l!==void 0||u!==void 0){if(l!==void 0&&u===void 0)throw c.from(`BAD_REQUEST`,X.REFILL_AMOUNT_AND_INTERVAL_REQUIRED);if(u!==void 0&&l===void 0)throw c.from(`BAD_REQUEST`,X.REFILL_INTERVAL_AND_AMOUNT_REQUIRED);C.refillAmount=l,C.refillInterval=u}if(m!==void 0&&(C.rateLimitEnabled=m),h!==void 0&&(C.rateLimitTimeWindow=h),g!==void 0&&(C.rateLimitMax=g),p!==void 0&&(C.permissions=JSON.stringify(p)),Object.keys(C).length===0)throw c.from(`BAD_REQUEST`,X.NO_VALUES_TO_UPDATE);let w=x;try{if(S.storage===`secondary-storage`&&S.fallbackToDatabase){let e=await t.context.adapter.update({model:k0,where:[{field:`id`,value:x.id}],update:C});e&&(await G1(t,e,S),w=e)}else if(S.storage===`database`){let e=await t.context.adapter.update({model:k0,where:[{field:`id`,value:x.id}],update:C});e&&(w=e)}else{let e={...x,...C,updatedAt:/* @__PURE__ */ new Date};await G1(t,e,S),w=e}}catch(e){throw c.fromStatus(`INTERNAL_SERVER_ERROR`,{message:e?.message})}n(t.context);let T=await O1(t,w,S),{key:ee,...te}=w;return t.json({...te,metadata:T,permissions:te.permissions?Ee(te.permissions):null})})}function f0(e,t){let n=/* @__PURE__ */ new Date,r=e.lastRequest,i=e.rateLimitTimeWindow,a=e.rateLimitMax;if(t.rateLimit.enabled===!1||e.rateLimitEnabled===!1)return{type:`skip`,lastRequest:n};if(i===null||a===null)return{type:`skip`,lastRequest:null};if(r===null)return{type:`start`,now:n};let o=n.getTime()-new Date(r).getTime();return o>i?{type:`reset`,now:n,windowStart:new Date(n.getTime()-i)}:e.requestCount>=a?{type:`deny`,message:X.RATE_LIMIT_EXCEEDED.message,tryAgainIn:Math.ceil(i-o)}:{type:`increment`,now:n,max:a,windowStart:new Date(n.getTime()-i)}}async function p0({key:e,ctx:t,lookupOpts:n,configurations:r,schema:i,permissions:a,expectedConfigId:o,runCustomValidator:s}){let l=n.disableKeyHashing?e:await O0(e),u=await U1(t,l,n);if(!u||o!==void 0&&!C0(u.configId,o))throw c.from(`UNAUTHORIZED`,X.INVALID_API_KEY);let d=x0(t.context,r,u.configId);if(s&&d.customAPIKeyValidator&&!await d.customAPIKeyValidator({ctx:t,key:e}))throw c.from(`UNAUTHORIZED`,X.KEY_NOT_FOUND);if(u.enabled===!1)throw c.from(`UNAUTHORIZED`,X.KEY_DISABLED);if(u.expiresAt&&Date.now()>new Date(u.expiresAt).getTime()){let e=async()=>{d.storage===`secondary-storage`&&d.fallbackToDatabase?(await K1(t,u,d),await t.context.adapter.delete({model:k0,where:[{field:`id`,value:u.id}]})):d.storage===`secondary-storage`?await K1(t,u,d):await t.context.adapter.delete({model:k0,where:[{field:`id`,value:u.id}]})};throw d.deferUpdates?t.context.runInBackground(e().catch(e=>{t.context.logger.error(`Deferred update failed:`,e)})):await e(),c.from(`UNAUTHORIZED`,X.KEY_EXPIRED)}if(a){let e=u.permissions?Ee(u.permissions):null;if(!e||!gee(e).authorize(a).success)throw c.from(`UNAUTHORIZED`,X.KEY_NOT_FOUND)}if(u.remaining===0&&u.refillAmount===null){let e=async()=>{d.storage===`secondary-storage`&&d.fallbackToDatabase?(await K1(t,u,d),await t.context.adapter.delete({model:k0,where:[{field:`id`,value:u.id}]})):d.storage===`secondary-storage`?await K1(t,u,d):await t.context.adapter.delete({model:k0,where:[{field:`id`,value:u.id}]})};throw d.deferUpdates?t.context.runInBackground(e().catch(e=>{t.context.logger.error(`Deferred update failed:`,e)})):await e(),c.from(`TOO_MANY_REQUESTS`,X.USAGE_EXCEEDED)}return{apiKey:d.storage===`database`||d.storage===`secondary-storage`&&d.fallbackToDatabase?await m0({ctx:t,apiKey:u,opts:d,hashedKey:l}):await _0({ctx:t,apiKey:u,opts:d,hashedKey:l}),opts:d}}async function m0({ctx:e,apiKey:t,opts:n,hashedKey:r}){let i=t;t.remaining!==null&&(i=await h0(e,t)),i=await g0(e,i,n);let a=await e.context.adapter.update({model:k0,where:[{field:`id`,value:i.id}],update:{updatedAt:/* @__PURE__ */ new Date}});if(!a)throw c.from(`UNAUTHORIZED`,X.INVALID_API_KEY);return n.storage===`secondary-storage`&&n.fallbackToDatabase&&await G1(e,a,n),a}async function h0(e,t){let n=/* @__PURE__ */ new Date,{refillInterval:r,refillAmount:i}=t;if(r&&i){let a=new Date(t.lastRefillAt??t.createdAt).getTime();if(n.getTime()-a>r){let r=await e.context.adapter.incrementOne({model:k0,where:[{field:`id`,value:t.id},{field:`lastRefillAt`,value:t.lastRefillAt}],increment:{},set:{remaining:i-1,lastRefillAt:n}});if(r)return r}}let a=await e.context.adapter.incrementOne({model:k0,where:[{field:`id`,value:t.id},{field:`remaining`,operator:`gt`,value:0}],increment:{remaining:-1}});if(!a)throw c.from(`TOO_MANY_REQUESTS`,X.USAGE_EXCEEDED);return a}async function g0(e,t,n){let r=f0(t,n);if(r.type===`deny`)throw new c(`TOO_MANY_REQUESTS`,{message:r.message,code:`RATE_LIMITED`,details:{tryAgainIn:r.tryAgainIn}});if(r.type===`skip`)return r.lastRequest===null?t:await e.context.adapter.update({model:`apikey`,where:[{field:`id`,value:t.id}],update:{lastRequest:r.lastRequest}})??t;if(r.type===`increment`){let i=await e.context.adapter.incrementOne({model:k0,where:[{field:`id`,value:t.id},{field:`lastRequest`,operator:`gt`,value:r.windowStart},{field:`requestCount`,operator:`lt`,value:r.max}],increment:{requestCount:1},set:{lastRequest:r.now}});if(i)return i;let a=await e.context.adapter.findOne({model:k0,where:[{field:`id`,value:t.id}]});if(!a)throw c.from(`UNAUTHORIZED`,X.INVALID_API_KEY);return g0(e,a,n)}let i=r.type===`reset`?{field:`lastRequest`,operator:`lte`,value:r.windowStart}:{field:`lastRequest`,operator:`eq`,value:null},a=await e.context.adapter.incrementOne({model:k0,where:[{field:`id`,value:t.id},i],increment:{},set:{requestCount:1,lastRequest:r.now}});if(a)return a;let o=await e.context.adapter.findOne({model:k0,where:[{field:`id`,value:t.id}]});if(!o)throw c.from(`UNAUTHORIZED`,X.INVALID_API_KEY);return g0(e,o,n)}async function _0({ctx:e,apiKey:t,opts:n,hashedKey:r}){let i=t.remaining,a=t.lastRefillAt;if(i!==null){let e=Date.now(),{refillInterval:n,refillAmount:r}=t,o=new Date(a??t.createdAt).getTime();if(n&&r&&e-o>n&&(i=r,a=/* @__PURE__ */ new Date),i===0)throw c.from(`TOO_MANY_REQUESTS`,X.USAGE_EXCEEDED);i--}let o={...v0(t,n),remaining:i,lastRefillAt:a,updatedAt:/* @__PURE__ */ new Date},s=async()=>{let t=await U1(e,r,n);if(!t)return null;let i={...t,...o};return await G1(e,i,n),i};if(n.deferUpdates)return e.context.runInBackground(s().catch(t=>{e.context.logger.error(`Failed to update API key:`,t)})),{...t,...o};let l=await s();if(!l)throw c.from(`INTERNAL_SERVER_ERROR`,X.FAILED_TO_UPDATE_API_KEY);return l}function v0(e,t){let n=f0(e,t);switch(n.type){case`deny`:throw new c(`TOO_MANY_REQUESTS`,{message:n.message,code:`RATE_LIMITED`,details:{tryAgainIn:n.tryAgainIn}});case`skip`:return n.lastRequest===null?{}:{lastRequest:n.lastRequest};case`start`:case`reset`:return{lastRequest:n.now,requestCount:1};case`increment`:return{lastRequest:n.now,requestCount:e.requestCount+1}}}const y0=D({configId:f().meta({description:`Configuration ID to scope verification to. When omitted, the key is validated against its own configuration.`}).optional(),key:f().meta({description:`The key to verify`}),permissions:g(f(),_(f())).meta({description:`The permissions to verify.`}).optional()});function b0({configurations:e,schema:t,deleteAllExpiredApiKeys:n}){return Y.serverOnly({method:`POST`,body:y0},async r=>{let{configId:i,key:a}=r.body,o=x0(r.context,e,i);if(i!==void 0&&o.customAPIKeyValidator&&!await o.customAPIKeyValidator({ctx:r,key:a}))return r.json({valid:!1,error:{message:X.INVALID_API_KEY,code:`KEY_NOT_FOUND`},key:null});let s=null,c;try{let l=await p0({key:a,permissions:r.body.permissions,ctx:r,lookupOpts:o,configurations:e,schema:t,expectedConfigId:i,runCustomValidator:i===void 0});s=l.apiKey,c=l.opts,c.deferUpdates&&r.context.runInBackground(n(r.context).catch(e=>{r.context.logger.error(`Failed to delete expired API keys:`,e)}))}catch(e){return r.context.logger.error(`Failed to validate API key:`,e),$1(e)?r.json({valid:!1,error:{...e.body,message:e.body?.message,code:e.body?.code},key:null}):r.json({valid:!1,error:{message:X.INVALID_API_KEY,code:`INVALID_API_KEY`},key:null})}let{key:l,...u}=s??{key:1,permissions:void 0},d=null;return s&&(d=await O1(r,s,c)),u.permissions=u.permissions?Ee(u.permissions):null,r.json({valid:!0,error:null,key:s===null?null:{...u,metadata:d}})})}function x0(e,t,n){let r=()=>{let n=t.find(e=>!e.configId||e.configId==="default");if(!n){e.logger.error("No default api-key configuration found. Either provide an api-key configuration with configId 'default' or provide a configuration with no `configId` set.");let t=X.NO_DEFAULT_API_KEY_CONFIGURATION_FOUND;throw c.from(`BAD_REQUEST`,t)}return{...n,configId:`default`}};return n?t.find(e=>e.configId===n)??r():r()}function S0(e){return!e||e==="default"}function C0(e,t){return S0(e)&&S0(t)?!0:e===t}let w0=null;async function T0(e,t=!1){w0&&!t&&(/* @__PURE__ */ new Date()).getTime()-w0.getTime()<1e4||(w0=/* @__PURE__ */ new Date,await e.adapter.deleteMany({model:k0,where:[{field:`expiresAt`,operator:`lt`,value:/* @__PURE__ */ new Date},{field:`expiresAt`,operator:`ne`,value:null}]}).catch(t=>{e.logger.error(`Failed to delete expired API keys:`,t)}))}function E0({defaultKeyGenerator:e,configurations:t,schema:n}){return{createApiKey:t0({defaultKeyGenerator:e,configurations:t,schema:n,deleteAllExpiredApiKeys:T0}),verifyApiKey:b0({configurations:t,schema:n,deleteAllExpiredApiKeys:T0}),getApiKey:o0({configurations:t,schema:n,deleteAllExpiredApiKeys:T0}),updateApiKey:d0({configurations:t,schema:n,deleteAllExpiredApiKeys:T0}),deleteApiKey:i0({configurations:t,schema:n,deleteAllExpiredApiKeys:T0}),listApiKeys:l0({configurations:t,schema:n,deleteAllExpiredApiKeys:T0}),deleteAllExpiredApiKeys:n0({deleteAllExpiredApiKeys:T0})}}const D0=({defaultRateLimitMax:e,defaultTimeWindow:t})=>({apikey:{fields:{configId:{type:`string`,required:!0,defaultValue:`default`,input:!1,index:!0},name:{type:`string`,required:!1,input:!1},start:{type:`string`,required:!1,input:!1},referenceId:{type:`string`,required:!0,input:!1,index:!0},prefix:{type:`string`,required:!1,input:!1},key:{type:`string`,required:!0,input:!1,index:!0},refillInterval:{type:`number`,required:!1,input:!1},refillAmount:{type:`number`,required:!1,input:!1},lastRefillAt:{type:`date`,required:!1,input:!1},enabled:{type:`boolean`,required:!1,input:!1,defaultValue:!0},rateLimitEnabled:{type:`boolean`,required:!1,input:!1,defaultValue:!0},rateLimitTimeWindow:{type:`number`,required:!1,input:!1,defaultValue:t},rateLimitMax:{type:`number`,required:!1,input:!1,defaultValue:e},requestCount:{type:`number`,required:!1,input:!1,defaultValue:0},remaining:{type:`number`,required:!1,input:!1},lastRequest:{type:`date`,required:!1,input:!1},expiresAt:{type:`date`,required:!1,input:!1},createdAt:{type:`date`,required:!0,input:!1},updatedAt:{type:`date`,required:!0,input:!1},permissions:{type:`string`,required:!1,input:!1},metadata:{type:`string`,required:!1,input:!0,transform:{input(e){return JSON.stringify(e)},output(e){return e?w1(e):null}}}}}}),O0=async e=>{let t=await PH(`SHA-256`).digest(new TextEncoder().encode(e));return oH.encode(new Uint8Array(t),{padding:!1})},k0=`apikey`;function A0(e,t){if(Array.isArray(e)&&e.length>0){if(!e.every(e=>e.configId))throw new l(`configId is required for each API key configuration in the api-key plugin.`);let t=e.map(e=>e.configId);if(new Set(t).size!==t.length)throw new l(`configId must be unique for each API key configuration in the api-key plugin.`)}let n=t??{schema:Array.isArray(e)?void 0:e?.schema},r=[...(Array.isArray(e)?e:[e]).map(e=>({...e,apiKeyHeaders:e?.apiKeyHeaders??`x-api-key`,defaultKeyLength:e?.defaultKeyLength||64,maximumPrefixLength:e?.maximumPrefixLength??32,minimumPrefixLength:e?.minimumPrefixLength??1,maximumNameLength:e?.maximumNameLength??32,minimumNameLength:e?.minimumNameLength??1,enableMetadata:e?.enableMetadata??!1,disableKeyHashing:e?.disableKeyHashing??!1,requireName:e?.requireName??!1,storage:e?.storage??`database`,rateLimit:{enabled:e?.rateLimit?.enabled===void 0||e?.rateLimit?.enabled,timeWindow:e?.rateLimit?.timeWindow??864e5,maxRequests:e?.rateLimit?.maxRequests??10},keyExpiration:{defaultExpiresIn:e?.keyExpiration?.defaultExpiresIn??null,disableCustomExpiresTime:e?.keyExpiration?.disableCustomExpiresTime??!1,maxExpiresIn:e?.keyExpiration?.maxExpiresIn??365,minExpiresIn:e?.keyExpiration?.minExpiresIn??1},startingCharactersConfig:{shouldStore:e?.startingCharactersConfig?.shouldStore??!0,charactersLength:e?.startingCharactersConfig?.charactersLength??6},enableSessionForAPIKeys:e?.enableSessionForAPIKeys??!1,fallbackToDatabase:e?.fallbackToDatabase??!1,customStorage:e?.customStorage,deferUpdates:e?.deferUpdates??!1}))],i=bz(D0({defaultRateLimitMax:(r.length===1?r[0]?.rateLimit.maxRequests:void 0)??10,defaultTimeWindow:(r.length===1?r[0]?.rateLimit.timeWindow:void 0)??864e5}),n.schema),a=async e=>{let t=AU(e.length,`a-z`,`A-Z`);return`${e.prefix||``}${t}`};function o(e,t){if(t.customAPIKeyGetter)return t.customAPIKeyGetter(e);if(Array.isArray(t.apiKeyHeaders)){for(let n of t.apiKeyHeaders){let t=e.headers?.get(n);if(t)return t}return null}return e.headers?.get(t.apiKeyHeaders)??null}function s(e){for(let t of r){if(!t.enableSessionForAPIKeys)continue;let n=o(e,t);if(n)return{key:n,config:t}}return null}let u=E0({defaultKeyGenerator:a,configurations:r,schema:i});return{id:`api-key`,version:`1.7.5`,$ERROR_CODES:X,hooks:{before:[{matcher:e=>!!s(e),handler:gL(async e=>{let{key:t,config:n}=s(e);if(typeof t!=`string`)throw c.from(`BAD_REQUEST`,X.INVALID_API_KEY_GETTER_RETURN_TYPE);if(t.length<n.defaultKeyLength||n.customAPIKeyValidator&&!await n.customAPIKeyValidator({ctx:e,key:t}))throw c.from(`FORBIDDEN`,X.INVALID_API_KEY);let{apiKey:a}=await p0({key:t,ctx:e,lookupOpts:n,configurations:r,schema:i,expectedConfigId:n.configId}),o=T0(e.context).catch(t=>{e.context.logger.error(`Failed to delete expired API keys:`,t)});if(n.deferUpdates&&e.context.runInBackground(o),(n.references??`user`)!==`user`){let e=X.INVALID_REFERENCE_ID_FROM_API_KEY;throw c.from(`UNAUTHORIZED`,e)}let l=await e.context.internalAdapter.findUserById(a.referenceId);if(!l){let e=X.INVALID_REFERENCE_ID_FROM_API_KEY;throw c.from(`UNAUTHORIZED`,e)}let u={user:l,session:{id:a.id,token:t,userId:a.referenceId,userAgent:e.request?.headers.get(`user-agent`)??null,ipAddress:e.request?wR(e.request,e.context.options):null,createdAt:/* @__PURE__ */ new Date,updatedAt:/* @__PURE__ */ new Date,expiresAt:a.expiresAt||Q1(e.context.options.session?.expiresIn||604800,`ms`)}};return e.context.session=u,e.path===`/get-session`?u:{context:e}})}]},endpoints:{createApiKey:u.createApiKey,verifyApiKey:u.verifyApiKey,getApiKey:u.getApiKey,updateApiKey:u.updateApiKey,deleteApiKey:u.deleteApiKey,listApiKeys:u.listApiKeys,deleteAllExpiredApiKeys:u.deleteAllExpiredApiKeys},schema:i}}const j0=(e,t)=>({getAllKeys:async n=>t?.adapter?.getJwks?await t.adapter.getJwks(n):await(await GR(e)).findMany({model:`jwks`}),getLatestKey:async n=>{let r=/* @__PURE__ */ new Date,i=e=>!e.expiresAt||e.expiresAt>r;return t?.adapter?.getJwks?(await t.adapter.getJwks(n))?.filter(i).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]:(await(await GR(e)).findMany({model:`jwks`}))?.filter(i).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]},getKeyById:async(n,r)=>t?.adapter?.getJwks?(await t.adapter.getJwks(n))?.find(e=>e.id===r):await(await GR(e)).findOne({model:`jwks`,where:[{field:`id`,value:r}]})??void 0,getLatestKeyByAlg:async(n,r)=>{let i=t?.adapter?.getJwks?await t.adapter.getJwks(n):await(await GR(e)).findMany({model:`jwks`});if(!i)return;let a=t?.jwks?.keyPairConfig?.alg??`EdDSA`,o=/* @__PURE__ */ new Date;return i.filter(e=>e.alg===r||e.alg==null&&a===r).filter(e=>!e.expiresAt||e.expiresAt>o).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]},createJwk:async(n,r)=>t?.adapter?.createJwk?await t.adapter.createJwk(r,n):await(await GR(e)).create({model:`jwks`,data:{...r,createdAt:/* @__PURE__ */ new Date}})});function M0(e,t){return typeof e==`number`?e:e instanceof Date?Math.floor(e.getTime()/1e3):t+YV(e)}async function N0(e){let{alg:t,...n}=e?.jwks?.keyPairConfig??{alg:`EdDSA`,crv:`Ed25519`},{publicKey:r,privateKey:i}=await It(t,{...n,extractable:!0});return{publicWebKey:await Et(r),privateWebKey:await Et(i),alg:t,cfg:n}}async function P0(e,t){let{publicWebKey:n,privateWebKey:r,alg:i,cfg:a}=await N0(t),o=a&&`crv`in a?a.crv:void 0,s=typeof n.crv==`string`?n.crv:void 0,c=o??s,l=JSON.stringify(r),u=!t?.jwks?.disablePrivateKeyEncryption,d={alg:i,...c?{crv:c}:{},publicKey:JSON.stringify(n),privateKey:u?JSON.stringify(await IW({key:e.context.secretConfig,data:l})):l,createdAt:/* @__PURE__ */ new Date,...t?.jwks?.rotationInterval?{expiresAt:new Date(Date.now()+t.jwks.rotationInterval*1e3)}:{}};return await j0(e.context.adapter,t).createJwk(e,d)}async function F0(e,t,n){if(t?.jwt?.sign)return null;let r=j0(e.context.adapter,t),i;if(n?.signingKeyId!==void 0){if(i=await r.getKeyById(e,n.signingKeyId),!i)throw new l(`signJWT: signingKeyId "${n.signingKeyId}" not found in JWKS. The key must be provisioned before it can be referenced.`);if(n.signingAlgorithm!==void 0){let e=t?.jwks?.keyPairConfig?.alg??`EdDSA`;if((i.alg??e)!==n.signingAlgorithm)throw new l(`signJWT: signingKeyId "${n.signingKeyId}" has alg "${i.alg??`unset (inherits keyPairConfig.alg "${e}")`}" but signingAlgorithm was set to "${n.signingAlgorithm}".`)}}else if(n?.signingAlgorithm!==void 0){if(i=await r.getLatestKeyByAlg(e,n.signingAlgorithm),!i){let r=t?.jwks?.keyPairConfig?.alg??`EdDSA`,a=t?.jwks?.keyPairConfigs?.find(e=>e.alg===n.signingAlgorithm),o=r===n.signingAlgorithm;if(a||o)i=await P0(e,{...t,jwks:{...t?.jwks,keyPairConfig:a??t?.jwks?.keyPairConfig}});else{let e=t?.jwks?.keyPairConfigs?.map(e=>e.alg).join(`, `)||`none`;throw new l(`signJWT: no key with alg "${n.signingAlgorithm}" found in JWKS. The plugin auto-mints only one key matching keyPairConfig.alg="${r}"; additional algs configured via keyPairConfigs: ${e}. Add "${n.signingAlgorithm}" to jwks.keyPairConfigs so the plugin provisions it on first use, or mint the key explicitly via createJwk().`)}}}else{let n=t?.jwks?.keyPairConfig?.alg??`EdDSA`;i=await r.getLatestKeyByAlg(e,n)??await r.getLatestKey(e)}if(!i||i.expiresAt&&i.expiresAt</* @__PURE__ */ new Date){if(n?.signingKeyId!==void 0||n?.signingAlgorithm!==void 0)throw new l(`signJWT: requested signing key is expired and an explicit kid/alg was provided; not auto-minting a replacement. Rotate the key explicitly.`);i=await P0(e,t)}let a=t?.jwks?.disablePrivateKeyEncryption?i.privateKey:await LW({key:e.context.secretConfig,data:JSON.parse(i.privateKey)}).catch(()=>{throw new l(`Failed to decrypt private key. Make sure the secret currently in use is the same as the one used to encrypt the private key. If you are using a different secret, either clean up your JWKS or disable private key encryption.`)}),o=i.alg??t?.jwks?.keyPairConfig?.alg??`EdDSA`,s=await dV(JSON.parse(a),o);return{alg:o,kid:i.id,privateKey:s}}async function I0(e,t){let{options:n}=t,r=t.payload,i=Math.floor(Date.now()/1e3),a=r.iat,o=r.exp,s=M0(n?.jwt?.expirationTime??`15m`,a??i);o??=s;let c=r.nbf,l=typeof e.context.options.baseURL==`string`?e.context.options.baseURL:``,u=r.iss,d=n?.jwt?.issuer??l,f=r.aud,p=n?.jwt?.audience??l;if(n?.jwt?.sign){let e={...r,iat:a,exp:o,nbf:c,iss:u??d,aud:f??p};return n.jwt.sign(e,t.header,{signingKeyId:t.signingKeyId,signingAlgorithm:t.signingAlgorithm})}let{alg:m,kid:h,privateKey:g}=t.resolvedKey??await F0(e,n,{signingKeyId:t.signingKeyId,signingAlgorithm:t.signingAlgorithm}),_=new xt(r).setProtectedHeader({...t.header,alg:m,kid:h}).setExpirationTime(o).setIssuer(u??d).setAudience(f??p);return a&&_.setIssuedAt(a),r.sub&&_.setSubject(r.sub),r.nbf&&_.setNotBefore(r.nbf),r.jti&&_.setJti(r.jti),await _.sign(g)}async function L0(e,t){let n=t?.jwt?.definePayload?await t.jwt.definePayload(e.context.session):e.context.session.user;return await I0(e,{options:t,payload:{iat:Math.floor(Date.now()/1e3),...n,sub:await t?.jwt?.getSubject?.(e.context.session)??e.context.session.user.id}})}function R0(e){let t=e.context.options.baseURL;return typeof t==`string`?t||`better-auth:session-cache`:e.context.baseURL||`better-auth:session-cache`}async function z0(e,t,n){let r=fV(t),i=r.kid;if(!i)return e.context.logger.debug(`Cookie-cache JWT missing kid in header`),null;let a=await j0(e.context.adapter,n).getAllKeys(e);if(!a?.length)return e.context.logger.debug(`No JWKS keys available for cookie-cache JWT`),null;let o=a.find(e=>e.id===i);if(!o)return e.context.logger.debug(`No JWKS key found for cookie-cache JWT kid: ${i}`),null;let s=o.alg??n?.jwks?.keyPairConfig?.alg??r.alg;return s?{alg:s,publicKey:await dV(JSON.parse(o.publicKey),s)}:(e.context.logger.debug(`No JWT algorithm available for cookie-cache JWT kid: ${i}`),null)}async function B0(e,t,n,r){let i=await F0(e,r);if(!i)throw new l("`jwt({ sessionCookieCache: true })` requires locally managed JWT plugin keys and does not support `jwt.sign`.");return await new xt({...t,sid:t.session.token}).setProtectedHeader({alg:i.alg,kid:i.kid,typ:`better-auth.session-cache+jwt`}).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+n).setIssuer(R0(e)).setAudience(`better-auth:session-cache`).setSubject(t.user.id).sign(i.privateKey)}async function V0(e,t,n){try{if(fV(t).typ!==`better-auth.session-cache+jwt`)return null;let r=await z0(e,t,n);if(!r)return null;let{payload:i}=await JB(t,r.publicKey,{...eH({issuer:R0(e)}),algorithms:[r.alg]}),a=tH(i);return a?{payload:a,expiresAt:a.exp?a.exp*1e3:Date.now()}:null}catch(t){return e.context.logger.debug(`Cookie-cache JWT verification failed`,t),null}}function H0(e){return{sign:(t,n,r)=>B0(t,n,r,e),verify:(t,n)=>V0(t,n,e)}}const gce={jwks:{fields:{publicKey:{type:`string`,required:!0},privateKey:{type:`string`,required:!0},createdAt:{type:`date`,required:!0},expiresAt:{type:`date`,required:!1},alg:{type:`string`,required:!1},crv:{type:`string`,required:!1}}}};async function _ce(e,t){let n=dL();try{let r=e.split(`.`);if(r.length!==3)return null;let i=new TextDecoder().decode(aH.decode(r[0])),a=JSON.parse(i).kid;if(!a)return n.context.logger.debug(`JWT missing kid in header`),null;let o=await j0(n.context.adapter,t).getAllKeys(n);if(!o||o.length===0)return n.context.logger.debug(`No JWKS keys available`),null;let s=o.find(e=>e.id===a);if(!s)return n.context.logger.debug(`No JWKS key found for kid: ${a}`),null;let c=await dV(JSON.parse(s.publicKey),s.alg??t?.jwks?.keyPairConfig?.alg??`EdDSA`),l=typeof n.context.options.baseURL==`string`?n.context.options.baseURL:void 0,{payload:u}=await JB(e,c,{issuer:t?.jwt?.issuer??l,audience:t?.jwt?.audience??l});return!u.sub||!u.aud?null:u}catch(e){return n.context.logger.debug(`JWT verification failed`,e),null}}const vce=D({payload:g(f(),ie()),overrideOptions:g(f(),ie()).optional()}),yce=D({token:f(),issuer:f().optional()}),bce=e=>{if(e?.jwt?.sign&&!e.jwks?.remoteUrl)throw new l(`options.jwks.remoteUrl must be set when using options.jwt.sign`);if(e?.jwks?.remoteUrl&&!e.jwks?.keyPairConfig?.alg)throw new l(`options.jwks.keyPairConfig.alg must be specified when options.jwks.remoteUrl is used for OpenID metadata`);let t=e?.jwks?.jwksPath??`/jwks`;if(typeof t!=`string`||t.length===0||!t.startsWith(`/`)||t.includes(`..`))throw new l(`options.jwks.jwksPath must be a non-empty string starting with '/' and not contain '..'`);return{id:`jwt`,version:`1.7.5`,options:e,init(t){if(!e?.sessionCookieCache)return;if(t.options.session?.cookieCache?.strategy!==`jwt`)throw new l('`jwt({ sessionCookieCache: true })` requires `session.cookieCache.strategy = "jwt"`.');if(e.jwt?.sign)throw new l("`jwt({ sessionCookieCache: true })` requires locally managed JWT plugin keys and does not support `jwt.sign`.");let n=e.jwks?.gracePeriod,r=t.options.session.cookieCache.maxAge||300;return n!==void 0&&r>n&&t.logger.warn(`[better-auth] \`session.cookieCache.maxAge\` (${r}s) exceeds the JWT plugin JWKS grace period (${n}s). Rotated keys may stop verifying cookie-cache JWTs before the cookie expires.`),{context:{sessionConfig:{...t.sessionConfig,cookieCacheSigner:H0(e)}}}},endpoints:{getJwks:Y(t,{method:`GET`,metadata:{openapi:{operationId:`getJSONWebKeySet`,description:`Get the JSON Web Key Set`,responses:{200:{description:`JSON Web Key Set retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{keys:{type:`array`,description:`Array of public JSON Web Keys`,items:{type:`object`,properties:{kid:{type:`string`,description:`Key ID uniquely identifying the key, corresponds to the 'id' from the stored Jwk`},kty:{type:`string`,description:`Key type (e.g., 'RSA', 'EC', 'OKP')`},alg:{type:`string`,description:`Algorithm intended for use with the key (e.g., 'EdDSA', 'RS256')`},use:{type:`string`,description:`Intended use of the public key (e.g., 'sig' for signature)`,enum:[`sig`],nullable:!0},n:{type:`string`,description:`Modulus for RSA keys (base64url-encoded)`,nullable:!0},e:{type:`string`,description:`Exponent for RSA keys (base64url-encoded)`,nullable:!0},crv:{type:`string`,description:`Curve name for elliptic curve keys (e.g., 'Ed25519', 'P-256')`,nullable:!0},x:{type:`string`,description:`X coordinate for elliptic curve keys (base64url-encoded)`,nullable:!0},y:{type:`string`,description:`Y coordinate for elliptic curve keys (base64url-encoded)`,nullable:!0}},required:[`kid`,`kty`,`alg`]}}},required:[`keys`]}}}}}}}},async t=>{if(e?.jwks?.remoteUrl)throw new c(`NOT_FOUND`);let n=j0(t.context.adapter,e),r=await n.getAllKeys(t);if((!r||r?.length===0)&&(await P0(t,e),r=await n.getAllKeys(t)),!r?.length)throw new l(`No key sets found. Make sure you have a key in your database.`);let i=Date.now(),a=(e?.jwks?.gracePeriod??2592e3)*1e3,o=r.filter(e=>!e.expiresAt||e.expiresAt.getTime()+a>i),s=e?.jwks?.keyPairConfig,u=s&&`crv`in s?s.crv:void 0;return t.json({keys:o.map(t=>({alg:t.alg??e?.jwks?.keyPairConfig?.alg??`EdDSA`,crv:t.crv??u,...JSON.parse(t.publicKey),kid:t.id}))})}),getToken:Y(`/token`,{method:`GET`,requireHeaders:!0,use:[TH],metadata:{openapi:{operationId:`getJSONWebToken`,description:`Get a JWT token`,responses:{200:{description:`Success`,content:{"application/json":{schema:{type:`object`,properties:{token:{type:`string`}}}}}}}}}},async t=>{let n=await L0(t,e);return t.json({token:n})}),signJWT:Y.serverOnly({method:`POST`,metadata:{$Infer:{body:{}}},body:vce},async t=>{let n=await I0(t,{options:{...e,...t.body.overrideOptions},payload:t.body.payload});return t.json({token:n})}),verifyJWT:Y.serverOnly({method:`POST`,metadata:{$Infer:{body:{},response:{}}},body:yce},async t=>{let n=t.body.issuer?{...e,jwt:{...e?.jwt,issuer:t.body.issuer}}:e,r=await _ce(t.body.token,n);return t.json({payload:r})})},hooks:{after:[{matcher(e){return e.path===`/get-session`},handler:gL(async t=>{if(e?.disableSettingJwtHeader)return;let n=t.context.session||t.context.newSession;if(n&&n.session){let n=await L0(t,e),r=t.context.responseHeaders?.get(`access-control-expose-headers`)||``,i=new Set(r.split(`,`).map(e=>e.trim()).filter(Boolean));i.add(`set-auth-jwt`),t.setHeader(`set-auth-jwt`,n),t.setHeader(`Access-Control-Expose-Headers`,Array.from(i).join(`, `))}})}]},schema:bz(gce,e?.schema)}};var U0=Object.defineProperty,W0=(e,t)=>{let n={};for(var r in e)U0(n,r,{get:e[r],enumerable:!0});return t||U0(n,Symbol.toStringTag,{value:`Module`}),n};const G0=`ba_iat`,K0=`ba_pl`,q0=`ba_param`;function J0(e){let t=new URLSearchParams,n=[...e.entries()].sort(([e,t],[n,r])=>e<n?-1:e>n?1:t<r?-1:+(t>r));for(let[e,r]of n)t.append(e,r);return t}function xce(e){e.delete(q0);let t=[.../* @__PURE__ */ new Set([...e.keys(),q0])].sort();for(let n of t)e.append(q0,n)}function Sce(e){let t=new URLSearchParams(e).get(G0);if(!t)return null;let n=Number(t);return!Number.isFinite(n)||n<=0?null:new Date(n)}const Cce=[`authorization_code`,`client_credentials`,`refresh_token`],Y0=[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],wce=[`none`,...Y0],Tce=new Set(wce);function X0(e,t){if(!(t.trim().length>0))throw new l(`OAuth Provider extension ${e} cannot be empty`)}function Z0(e,t){X0(e,t);let n;try{n=new URL(t)}catch{n=void 0}if(!n?.protocol)throw new l(`OAuth Provider extension ${e} must be an absolute URI: ${t}`)}function Ece(e){Z0(`grant type`,e)}function Dce(e){if(X0(`token_endpoint_auth_method`,e),Tce.has(e))throw new l(`OAuth Provider extension token_endpoint_auth_method is reserved: ${e}`)}function Oce(e){if(Z0(`client_assertion_type`,e),e===`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)throw new l(`OAuth Provider extension client_assertion_type is reserved: ${e}`)}function kce(e){let t=Object.keys(e.grants??{});for(let e of t)Ece(e);let n=[],r=[];for(let[t,i]of Object.entries(e.clientAuthentication??{})){Dce(t),n.push(t);let e=i.assertionTypes??[t];if(e.length===0)throw new l(`OAuth Provider extension client_assertion_type list cannot be empty for ${t}`);for(let t of e)Oce(t),r.push(t)}let i=(e.clientDiscovery?Array.isArray(e.clientDiscovery)?e.clientDiscovery:[e.clientDiscovery]:[]).map(e=>e.id);for(let e of i)X0(`client discovery id`,e);return{grantTypes:t,authMethods:n,assertionTypes:r,clientDiscoveryIds:i}}function Q0(e,t){let n=/* @__PURE__ */ new Set;for(let r of t){if(n.has(r))throw new l(`OAuth Provider extensions register ${e} "${r}" more than once. Extension contributions must be disjoint.`);n.add(r)}}function $0(e){let t=(e??[]).map(kce);Q0(`grant type`,t.flatMap(e=>e.grantTypes)),Q0(`token_endpoint_auth_method`,t.flatMap(e=>e.authMethods)),Q0(`client_assertion_type`,t.flatMap(e=>e.assertionTypes)),Q0(`client discovery id`,t.flatMap(e=>e.clientDiscoveryIds))}function e2(e){return e.extensions??[]}function t2(e){return e2(e).flatMap(e=>{let t=e.clientDiscovery;return t?Array.isArray(t)?t:[t]:[]})}function Ace(e,t){let n=e.getPlugin(`oauth-provider`);if(!n)throw new l(`extendOAuthProvider requires the oauth-provider plugin.`);let r=n.options.extensions??[];if(r.includes(t))return;let i=[...r,t];$0(i),n.options.extensions=i}function jce(e){return e2(e).flatMap(e=>Object.keys(e.grants??{}))}function n2(e){return Array.from(/* @__PURE__ */ new Set([...e.grantTypes??Cce,...jce(e)]))}function Mce(e,t){for(let n of e2(e)){let e=n.grants?.[t];if(e)return e}}function r2(e){return e2(e).flatMap(e=>Object.keys(e.clientAuthentication??{}))}function i2(e,t){return Array.from(/* @__PURE__ */ new Set([...t?.includeNone?[`none`]:[],...Y0,...r2(e)]))}function a2(e,t){return t?r2(e).includes(t):!1}function Nce(e,t){if(t!==`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)for(let n of e2(e)){let e=n.clientAuthentication??{};for(let[n,r]of Object.entries(e))if((r.assertionTypes??[n]).includes(t))return{method:n,strategy:r}}}function o2(e,t,n,r){let i={...r};for(let a of e2(t)){let o=a.metadata?.({ctx:e,opts:t,type:n,document:r});for(let[e,t]of Object.entries(o??{}))e in i||(i[e]=t)}return i}async function s2(e,t){let n={};for(let r of e2(e)){let e=await t(r)??{};for(let[t,r]of Object.entries(e)){if(t in n){O.warn(`oauth-provider: two extensions contributed the claim "${t}"; keeping the first-registered value.`);continue}n[t]=r}}return n}function Pce(e,t){return s2(e,e=>e.claims?.accessToken?.(t))}function Fce(e,t){return s2(e,e=>e.claims?.idToken?.(t))}function Ice(e,t){return s2(e,e=>e.claims?.userInfo?.(t))}function Lce(e){return e2(e).some(e=>e.claims?.userInfo)}function Rce(e){if(!e)return;let[t,n,...r]=e.trim().split(/\s+/);if(t?.toLowerCase()===`bearer`){if(!n||r.length>0)throw new d(`BAD_REQUEST`,{error:`invalid_request`,error_description:`Malformed Bearer Authorization header`});return n}}function zce(){let e=/* @__PURE__ */ new Map;return{get(t){let n=e.get(t);if(n){if(n.expiresAt&&n.expiresAt</* @__PURE__ */ new Date){e.delete(t);return}return n}},set(t,n){e.set(t,n)}}}const c2=e=>{let t=e.getPlugin(`jwt`);if(!t)throw new l(`jwt_config`);return t};function l2(e){if(e!=null){if(e instanceof Date)return Number.isFinite(e.getTime())?e:void 0;if(typeof e==`number`){if(!Number.isFinite(e))return;let t=new Date(e);return Number.isFinite(t.getTime())?t:void 0}if(typeof e==`string`){let t=e.trim();if(!t.length)return;let n=Number(t);if(Number.isFinite(n)){let e=new Date(n);return Number.isFinite(e.getTime())?e:void 0}let r=new Date(t);return Number.isFinite(r.getTime())?r:void 0}}}function Bce(e){if(e instanceof Date||!e||typeof e!=`object`)return l2(e);let t=l2(e.createdAt)??l2(e.created_at);if(t)return t;let n=e.session;if(n&&typeof n==`object`)return l2(n.createdAt)??l2(n.created_at)}function u2(e){if(typeof e==`string`)return[e];if(e?.length)return e}function d2(e){if(typeof e==`string`)return e;if(e?.length)return e.length===1?e.at(0):e}const f2=/* @__PURE__ */ new WeakMap;function Vce(e){let t=f2.get(e);if(t)return t;let n=zce();return f2.set(e,n),n}async function p2(e,t){let n=new URLSearchParams(e),r=n.get(`sig`),i=n.getAll(`sig`),a=Number(n.get(`exp`));n.delete(`sig`);let o=await zW(J0(n).toString(),t);return i.length===1&&!!r&&CU(r,o)&&/* @__PURE__ */ new Date(a*1e3)>=/* @__PURE__ */ new Date}async function m2(e,t,n){let r=Vce(t),i=r.get(n);if(i&&!i.clientDiscoveryId)return Object.assign({},i);let a=await e.context.adapter.findOne({model:t.schema?.oauthClient?.modelName??`oauthClient`,where:[{field:`clientId`,value:n}]}),o=t2(t);if(a?.clientDiscoveryId){let t=a.clientDiscoveryId,r=o.find(e=>e.id===t);if(!r?.matches(n)||(a=await r.resolve(e,n,a),!a))return null}else if(a)return t.cachedTrustedClients?.has(n)&&r.set(n,Object.assign({},a)),a;else for(let t of o){if(!t.matches(n))continue;let r=await t.resolve(e,n,null);if(r){a=r;break}}return a}function h2(e){return e.reduce((e,t)=>({...e,...t.discoveryMetadata??{}}),{})}const g2=async e=>{let t=await PH(`SHA-256`).digest(new TextEncoder().encode(e));return oH.encode(new Uint8Array(t),{padding:!1})};async function _2(e,t,n){if(t===`encrypted`)return await LW({key:e.context.secretConfig,data:n});if(typeof t==`object`&&`decrypt`in t)return await t.decrypt(n);throw new l(`Unsupported decryption storageMethod type '${t}'`)}async function Hce(e,t,n,r){let i=t.storeClientSecret??(t.disableJwtPlugin?`encrypted`:`hashed`);if(r&&t.prefix?.clientSecret){if(r.startsWith(t.prefix?.clientSecret))r=r.replace(t.prefix.clientSecret,``);else throw new d(`UNAUTHORIZED`,{error_description:`invalid client_secret`,error:`invalid_client`})}if(i===`hashed`){let e=r?await g2(r):void 0;return!!e&&CU(e,n)}if(typeof i==`object`&&`hash`in i){if(i.verify)return!!r&&await i.verify(r,n);{let e=r?await i.hash(r):void 0;return!!e&&CU(e,n)}}if(i===`encrypted`)try{let t=await _2(e,i,n);return!!r&&CU(t,r)}catch{return!1}if(typeof i==`object`&&`decrypt`in i){let t=await _2(e,i,n);return!!r&&CU(t,r)}throw new l(`Unsupported verify storageMethod type '${i}'`)}async function v2(e,t,n){let r=t.storeClientSecret??(t.disableJwtPlugin?`encrypted`:`hashed`);if(r===`encrypted`)return await IW({key:e.context.secretConfig,data:n});if(r===`hashed`)return await g2(n);if(typeof r==`object`&&`hash`in r)return await r.hash(n);if(typeof r==`object`&&`encrypt`in r)return await r.encrypt(n);throw new l(`Unsupported storeClientSecret type '${r}'`)}async function y2(e=`hashed`,t,n){if(e===`hashed`)return await g2(t);if(typeof e==`object`&&`hash`in e)return await e.hash(t,n);throw new l(`storeToken: unsupported storageMethod type '${e}'`)}async function b2(e=`hashed`,t,n){if(e===`hashed`)return await g2(t);if(typeof e==`object`&&`hash`in e)return await e.hash(t,n);throw new l(`getStoredToken: unsupported storageMethod type '${e}'`)}const x2=/^Basic +/i,Uce=/^([!#$%&'*+\-.^_`|~0-9A-Za-z]+)(?=\s|$)/;function Wce(e){return e.match(Uce)?.[1]}const S2=[`client_secret`,`client_assertion`,`client_assertion_type`];function C2(e){throw new d(`BAD_REQUEST`,{error:`invalid_request`,error_description:e})}async function Gce(e,t={}){let n;t.client_id!==void 0&&t.client_id!==``&&(typeof t.client_id!=`string`&&C2(`client_id must be a string`),n=t.client_id);let r={},i=(e,t)=>{t!==void 0&&t!==``&&(typeof t!=`string`&&C2(`${e} must be a string`),r[e]=t)};for(let e of S2)Object.hasOwn(t,e)&&i(e,t[e]);let a=!!e?.headers.get(`authorization`);if(e&&(e.headers.get(`content-type`)?.toLowerCase()??``).includes(`application/x-www-form-urlencoded`)){let t=new URLSearchParams(await e.clone().text()),r=t.getAll(`client_id`).filter(e=>e.length>0);r.length>1&&C2(`client_id must not be repeated`),n=r[0];for(let e of S2){let n=t.getAll(e).filter(e=>e.length>0);n.length>1&&C2(`${e} must not be repeated`),n.length===1&&i(e,n[0])}}let o=r.client_secret!==void 0,s=r.client_assertion!==void 0||r.client_assertion_type!==void 0;(a&&(o||s)||o&&s)&&C2(`A request must use only one client authentication method`),t.client_id=n;for(let e of S2)t[e]=r[e];return{detected:a||Object.keys(r).length>0}}function Kce(e){if(x2.test(e))try{let{clientId:t,clientSecret:n}=vG(e);return{client_id:t,client_secret:n}}catch{throw new d(`UNAUTHORIZED`,{error_description:`invalid authorization header format`,error:`invalid_client`},{"WWW-Authenticate":`Basic`})}}function w2(e,t){let n=e.grantTypes&&e.grantTypes.length>0?e.grantTypes:[`authorization_code`];return t===`refresh_token`&&n.includes(`authorization_code`)?!0:n.includes(t)}function qce(e,t){if(!t||!e.scopes)return;let n=new Set(e.scopes);for(let e of t)if(!n.has(e))throw new d(`BAD_REQUEST`,{error_description:`client does not allow scope ${e}`,error:`invalid_scope`})}function T2(e,t){let n=t?.method===`client_secret_basic`,r=t?.scheme??(n?`Basic`:void 0);throw new d(r?`UNAUTHORIZED`:`BAD_REQUEST`,{error_description:e,error:`invalid_client`},r?{"WWW-Authenticate":r}:void 0)}async function E2(e,t,n,r,i,a,o,s){let c=await m2(e,t,n);c||T2(`missing client`,{method:s}),c.disabled&&T2(`client is disabled`,{method:s});let l=c.tokenEndpointAuthMethod??`client_secret_basic`;if(s&&l!==s&&T2(`client registered for ${l} cannot use ${s}`,{method:s}),(c.tokenEndpointAuthMethod===`private_key_jwt`||a2(t,c.tokenEndpointAuthMethod))&&!a)throw new d(`BAD_REQUEST`,{error_description:`client registered for ${c.tokenEndpointAuthMethod} must use client_assertion`,error:`invalid_client`});if(a||(c.tokenEndpointAuthMethod!==`none`&&!r&&T2(`client secret must be provided`,{method:s}),r&&!c.clientSecret&&T2(`public client, client secret should not be received`,{method:s}),r&&!await Hce(e,t,c.clientSecret,r)&&T2(`invalid client_secret`,{method:s})),qce(c,i),o&&!w2(c,o))throw new d(`BAD_REQUEST`,{error_description:`client is not authorized to use grant type ${o}`,error:`unauthorized_client`});return c}function D2(e){if(e)return typeof e==`string`?JSON.parse(e):e}function O2(e){return{clientId:e?.clientId,clientSecret:e?.kind===`client_secret`?e.clientSecret:void 0,preVerified:e?.kind===`pre_verified`,authMethod:e?.method,confirmation:e?.kind===`pre_verified`?e.confirmation:void 0}}async function k2(e,t,n){let r={...e.body??{}};await Gce(e.request,r);let i=e.request?.headers.get(`authorization`)??void 0;if(r.client_assertion_type||r.client_assertion){if(!r.client_assertion||!r.client_assertion_type)throw new d(`BAD_REQUEST`,{error_description:`client_assertion and client_assertion_type must both be provided`,error:`invalid_client`});let i=r.client_assertion,a=r.client_assertion_type,o=Nce(t,a);if(o){let s=await o.strategy.authenticate({ctx:e,opts:t,assertion:i,assertionType:a,clientId:r.client_id,expectedAudience:n});return{kind:`pre_verified`,method:o.method,clientId:s.clientId,confirmation:s.confirmation}}let{verifyClientAssertion:s}=await Promise.resolve().then(()=>fue).then(e=>e.o);return{kind:`pre_verified`,method:`private_key_jwt`,clientId:(await s(e,t,i,a,r.client_id,n)).clientId}}if(i&&!x2.test(i)){let e=Wce(i);if(!e)throw new d(`BAD_REQUEST`,{error:`invalid_request`,error_description:`Invalid authorization header format`});T2(`unsupported authorization scheme`,{scheme:e})}if(i&&x2.test(i)){let e=Kce(i);if(e)return{kind:`client_secret`,method:`client_secret_basic`,clientId:e.client_id,clientSecret:e.client_secret}}return r.client_id&&r.client_secret?{kind:`client_secret`,method:`client_secret_post`,clientId:r.client_id,clientSecret:r.client_secret}:r.client_id?{kind:`public`,method:`none`,clientId:r.client_id}:null}function A2(e){let t=e.split(` `).map(e=>e.trim()),n=/* @__PURE__ */ new Set;for(let e of t)(e===`login`||e===`consent`||e===`create`||e===`select_account`||e===`none`)&&n.add(e);return new Set(n)}function Jce(e){let t=e.redirectUris?.[0];if(!t)throw new l(`Client has no redirect URIs for sector identifier`);return new URL(t).host}async function Yce(e,t,n){return zW(`${Jce(t)}.${e}`,n)}async function j2(e,t,n){return t.subjectType===`pairwise`&&n.pairwiseSecret?Yce(e,t,n.pairwiseSecret):e}function M2(e){let t=Object.create(null);for(let n of new Set(e.keys())){let r=e.getAll(n);t[n]=r.length===1?r[0]:r}return t}function N2(e,t){if(!t)return!1;let n=l2(e);return n?n.getTime()>=t.getTime():!1}function P2(e,t){let n=new URLSearchParams(e),r=n.get(`prompt`)?.split(` `),i=r?.findIndex(e=>e===t)??-1;return i>=0&&(r?.splice(i,1),r?.length?n.set(`prompt`,r.join(` `)):n.delete(`prompt`)),n}function F2(e){let t=new URLSearchParams(e);return t.delete(`max_age`),t}function I2(e,t){if(e.tokenEndpointAuthMethod===`none`)return`pkce is required for public clients`;let n=t?.scopes??[],r=n.includes(`openid`),i=typeof t?.nonce==`string`&&t.nonce.length>0,a=r&&i;return n.includes(`offline_access`)&&!a?`pkce or OIDC nonce is required when requesting offline_access scope`:e.requirePKCE??!0?`pkce is required for this client`:!1}const Xce=/^[a-z](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/i;function L2(e){let t=e.protocol.slice(0,-1),n=e.href.slice(e.protocol.length);return e.protocol!==`http:`&&e.protocol!==`https:`&&e.host.length===0&&n.startsWith(`/`)&&!n.startsWith(`//`)&&Xce.test(t)}const R2=p().superRefine((e,t)=>{let n;try{n=new URL(e)}catch{return t.addIssue({code:`custom`,message:`URL must be parseable`,fatal:!0}),C}if(QL.includes(n.protocol)){t.addIssue({code:`custom`,message:`URL cannot use javascript:, data:, or vbscript: scheme`});return}e.includes(`#`)&&t.addIssue({code:`custom`,message:`Redirect URI must not contain a fragment component`}),n.protocol===`http:`&&!sU(n.host)&&t.addIssue({code:`custom`,message:`Redirect URI must use HTTPS (HTTP allowed only for loopback hosts)`})}),Zce=/* @__PURE__ */ new Set([`iss`,`sub`,`aud`,`exp`,`nbf`,`iat`,`jti`,`auth_time`,`nonce`,`acr`,`amr`,`azp`,`sid`,`at_hash`,`c_hash`,`s_hash`]);function z2(e){if(!e)return{};let t=[],n=Object.create(null);for(let[r,i]of Object.entries(e)){if(Zce.has(r)){t.push(r);continue}n[r]=i}return t.length>0&&O.warn(`oauth-provider: stripped reserved id-token claim name(s): ${t.join(`, `)}. The AS owns these claim values.`),n}const B2=g(f(),se()).nullable(),Qce=x({essential:T().optional(),value:f().optional(),values:_(f()).optional()}).nullable(),$ce=D({acr:Qce.optional()}).catchall(B2),ele=x({userinfo:g(f(),B2).optional(),id_token:$ce.optional()});function tle(e){if(typeof e==`string`)try{return JSON.parse(e)}catch{return}return e}function V2(e){let t=tle(e),n=ele.safeParse(t);return n.success?n.data:void 0}const H2=n([f(),g(f(),se())]),nle=H2,U2=H2.refine(e=>V2(e)!==void 0,{error:`claims must be a valid Claims request object`});function rle(e){return e===void 0||V2(e)!==void 0}function W2(e,t){let n=V2(e)?.userinfo;if(!n)return[];let r=Object.keys(n);if(!t)return r;let i=new Set(t);return r.filter(e=>i.has(e))}function ile(e,t){let n=V2(e);if(!n)return e===void 0;let r=n.id_token?.acr;if(!r||r.essential!==!0)return!0;let i=r.value===void 0||r.value===t,a=r.values===void 0||r.values.includes(t);return i&&a}function ale(e,t){let n=V2(e);if(!n)return;let r=new Set(t),i=Object.fromEntries(Object.entries(n.userinfo??{}).filter(([e])=>r.has(e))),a=Object.keys(i).length?{...n,userinfo:i}:Object.fromEntries(Object.entries(n).filter(([e])=>e!==`userinfo`));return Object.keys(a).length?a:void 0}function G2(e){let t=e.split(` `).filter(e=>e!==``);return t.length<=1?{}:{given:t.slice(0,-1).join(` `),family:t.at(-1)}}const K2={name:{scope:`profile`,resolve:e=>e.name??void 0},picture:{scope:`profile`,resolve:e=>e.image??void 0},given_name:{scope:`profile`,resolve:e=>G2(e.name).given},family_name:{scope:`profile`,resolve:e=>G2(e.name).family},email:{scope:`email`,resolve:e=>e.email??void 0},email_verified:{scope:`email`,resolve:e=>e.emailVerified??!1}},q2=Object.keys(K2);function J2(e){return e.advertisedMetadata?.claims_supported??e.claims??[]}const ole=/* @__PURE__ */ new Set([`iss`,`sub`,`aud`,`exp`,`iat`,`jti`,`client_id`,`scope`,`auth_time`,`acr`,`amr`,`cnf`]);function sle(e){if(!e)return{};let t=[],n={};for(let[r,i]of Object.entries(e)){if(ole.has(r)){t.push(r);continue}n[r]=i}return t.length>0&&O.warn(`oauth-provider: stripped reserved access-token claim name(s): ${t.join(`, `)}. The AS owns these claim values.`),n}async function Y2(e){let{ctx:t,opts:n,user:r,client:i,scopes:a,resources:o,referenceId:s,metadata:c,grantType:l,sessionId:u,perRequestClaims:d,resourcePolicyClaims:f}=e,p=await Pce(n,{ctx:t,opts:n,user:r,client:i,scopes:a,grantType:l,referenceId:s,sessionId:u,resources:o,metadata:c}),m=n.customAccessTokenClaims?await n.customAccessTokenClaims({user:r,scopes:a,resources:o,referenceId:s,metadata:c}):{};return sle({...p,...d??{},...m,...f})}const X2=[`EdDSA`,`ES256`,`ES512`,`PS256`,`RS256`],cle=new Set(X2);async function Z2(e,t){let n=e.identifierValidator;if(n)return await n(t)?{ok:!0}:{ok:!1,reason:`resource identifier ${t} failed validation`};let r;try{r=new URL(t)}catch{return{ok:!1,reason:`resource identifier ${t} must be an absolute URI (RFC 8707 §2)`}}return r.hash?{ok:!1,reason:`resource identifier ${t} must not contain a URI fragment (RFC 8707 §2)`}:{ok:!0}}async function lle(e,t){let n=await Z2(e,t);if(!n.ok)throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:n.reason})}const ule=e=>`${e}/oauth2/userinfo`;async function dle(e){if(!(e.headers.get(`content-type`)?.toLowerCase()??``).includes(`application/x-www-form-urlencoded`))return;let t;try{t=await e.clone().text()}catch{return}if(!t)return;let n=new URLSearchParams(t).getAll(`resource`).filter(e=>e.length>0);return n.length>0?n:void 0}function fle(e){if(e!=null){if(typeof e==`string`)return[e];if(Array.isArray(e)){let t=e.filter(e=>typeof e==`string`&&e.length>0);return t.length>0?t:void 0}}}async function Q2(e,t,n,r=[]){if(n===void 0)return!0;let i=Array.isArray(n)?n:[n];if(i.length>64)return!1;let a=new Set(r),o=/* @__PURE__ */ new Set;for(let e of i)a.has(e)||o.add(e);return o.size===0||(await Promise.all(Array.from(o,n=>r4(e,t,n)))).every(Boolean)}async function $2(e,t,n){let r=fle(n.resource),i=n.requestedScopes.includes(`openid`),a=ule(e.context.baseURL??``);if(!r)return{audienceClaim:void 0,accessTokenTtl:null,refreshTokenTtl:null,signingAlgorithm:null,signingKeyId:null,rawCustomClaims:{},dpopBoundAccessTokensRequired:!1,effectiveScopes:[...n.requestedScopes]};let o=[...new Set(r)],s=[];for(let n of o){if(n===a)continue;let r=await r4(e,t,n);if(r){if(r.disabled)throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is disabled`});s.push(r);continue}throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is not configured`})}let{value:l}=e4(t);l&&s.length>0&&await ple(e,t,n.clientId,s);let u=[...n.requestedScopes];for(let e of s){if(e.allowedScopes===null||e.allowedScopes===void 0)continue;let t=new Set(e.allowedScopes),n=u.filter(e=>t.has(e));if(n.length===0)throw new c(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`none of the requested scopes are allowed for resource ${e.identifier}`});u=n}let d=null,f=null;for(let e of s)e.accessTokenTtl!=null&&(d=d===null?e.accessTokenTtl:Math.min(d,e.accessTokenTtl)),e.refreshTokenTtl!=null&&(f=f===null?e.refreshTokenTtl:Math.min(f,e.refreshTokenTtl));let p=/* @__PURE__ */ new Set,m=/* @__PURE__ */ new Set;for(let e of s)e.signingAlgorithm&&p.add(e.signingAlgorithm),e.signingKeyId&&m.add(e.signingKeyId);if(p.size>1)throw new c(`BAD_REQUEST`,{error:`invalid_request`,error_description:`multi-resource request has conflicting signingAlgorithm pins; a single JWS signature cannot satisfy multiple algorithms`});if(m.size>1)throw new c(`BAD_REQUEST`,{error:`invalid_request`,error_description:`multi-resource request has conflicting signingKeyId pins; a single JWS signature cannot satisfy multiple key ids`});let h=p.values().next().value??null,g=m.values().next().value??null,_={};for(let e of s)e.customClaims&&typeof e.customClaims==`object`&&Object.assign(_,e.customClaims);let v=s.some(e=>e.dpopBoundAccessTokensRequired===!0),y=i?[...o,a]:o,b=[...new Set(y)];return{audienceClaim:b.length===1?b[0]:b,accessTokenTtl:d,refreshTokenTtl:f,signingAlgorithm:h,signingKeyId:g,rawCustomClaims:_,dpopBoundAccessTokensRequired:v,effectiveScopes:u}}async function ple(e,t,n,r){if(r.length===0)return;let i=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,a=await e.context.adapter.findMany({model:i,where:[{field:`clientId`,value:n}]}),o=new Set(a?.map(e=>e.resourceId)??[]),s=r.filter(e=>!o.has(e.identifier));if(s.length>0)throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`client ${n} is not linked to resource(s) ${s.map(e=>e.identifier).join(`, `)}`})}async function mle(e,t,n,r){if(r.length===0)return!1;let i=t.schema?.oauthClientResource?.modelName??`oauthClientResource`;return((await e.context.adapter.findMany({model:i,where:[{field:`clientId`,value:n},{field:`resourceId`,operator:`in`,value:r}],limit:1}))?.length??0)>0}async function hle(e,t,n){if(n.length===0)return{};let r=await e.context.adapter.findMany({model:t.schema?.oauthResource?.modelName??`oauthResource`,where:[{field:`identifier`,operator:`in`,value:n}]}),i=new Map(r.map(e=>[e.identifier,e])),a={};for(let e of n){let t=i.get(e);t?.customClaims&&typeof t.customClaims==`object`&&Object.assign(a,t.customClaims)}return a}function e4(e){return e.enforcePerClientResources===void 0?{value:!0,source:`default`}:{value:e.enforcePerClientResources,source:`explicit`}}const t4=/* @__PURE__ */ new Map;function n4(e){if(e===void 0){t4.clear();return}t4.delete(e)}async function r4(e,t,n){if(await ble(e.context,t),t.cachedResources?.has(n)){let e=t4.get(n);if(e)return Object.assign({},e)}let r=await e.context.adapter.findOne({model:t.schema?.oauthResource?.modelName??`oauthResource`,where:[{field:`identifier`,value:n}]});return r&&t.cachedResources?.has(n)&&t4.set(n,Object.assign({},r)),r}function gle(e){return e.name??e.identifier}function _le(e){let t=[];if(e.resources?.length)for(let n of e.resources)t.push(typeof n==`string`?{identifier:n}:n);return t}function i4(e,t){return{identifier:e.identifier,name:gle(e),accessTokenTtl:e.accessTokenTtl??null,refreshTokenTtl:e.refreshTokenTtl??null,signingAlgorithm:e.signingAlgorithm??null,signingKeyId:e.signingKeyId??null,allowedScopes:e.allowedScopes??null,customClaims:e.customClaims??null,dpopBoundAccessTokensRequired:e.dpopBoundAccessTokensRequired??!1,disabled:e.disabled??!1,policyVersion:1,metadata:e.metadata??null,createdAt:t,updatedAt:t}}function vle(e,t,n){if(t===`overwrite`){let{identifier:t,createdAt:r,...i}=i4(e,n);return i}let r={updatedAt:n};return e.name!==void 0&&(r.name=e.name),e.accessTokenTtl!==void 0&&(r.accessTokenTtl=e.accessTokenTtl),e.refreshTokenTtl!==void 0&&(r.refreshTokenTtl=e.refreshTokenTtl),e.signingAlgorithm!==void 0&&(r.signingAlgorithm=e.signingAlgorithm),e.signingKeyId!==void 0&&(r.signingKeyId=e.signingKeyId),e.allowedScopes!==void 0&&(r.allowedScopes=e.allowedScopes),e.customClaims!==void 0&&(r.customClaims=e.customClaims),e.dpopBoundAccessTokensRequired!==void 0&&(r.dpopBoundAccessTokensRequired=e.dpopBoundAccessTokensRequired),e.disabled!==void 0&&(r.disabled=e.disabled),e.metadata!==void 0&&(r.metadata=e.metadata),r}const a4=/no such table|relation.*does not exist|table.*does(?: not|n[''']?t) exist/i;let o4=/* @__PURE__ */ new WeakMap;function yle(e){let t=e.adapter,n=o4.get(t);if(n)return n;let r={completed:!1,promise:null};return o4.set(t,r),r}async function s4(e,t){let n=_le(t);if(n.length===0)return;let r=t.resourceSeedMode??`insertOnly`,i=t.schema?.oauthResource?.modelName??`oauthResource`;for(let a of n){let n=await Z2(t,a.identifier);if(!n.ok){O.warn(`oauth-provider: skipping resource seed for ${a.identifier} — ${n.reason}`);continue}let o=a;if(o.signingAlgorithm!=null&&!cle.has(o.signingAlgorithm)){O.warn(`oauth-provider: dropping unsupported signingAlgorithm "${o.signingAlgorithm}" for resource ${o.identifier} — must be one of ${X2.join(`, `)}. Continuing without an algorithm override.`);let{signingAlgorithm:e,...t}=o;o=t}let s;try{s=await e.adapter.findOne({model:i,where:[{field:`identifier`,value:o.identifier}]})}catch(e){let t=e instanceof Error?e.message:String(e);if(a4.test(t)){O.debug(`oauth-provider: oauthResource table not yet created; deferring resource seed to first access.`);return}throw e}let c=/* @__PURE__ */ new Date;if(!s){try{await e.adapter.create({model:i,data:i4(o,c)})}catch(e){let t=e instanceof Error?e.message:String(e);if(/unique|duplicate|UNIQUE/i.test(t)){O.debug(`oauth-provider: resource ${o.identifier} already inserted by a concurrent process — skipping.`);continue}if(a4.test(t)){O.debug(`oauth-provider: oauthResource table not yet created; deferring resource seed to first access.`);return}throw e}continue}r!==`insertOnly`&&await e.adapter.update({model:i,where:[{field:`identifier`,value:o.identifier}],update:vle(o,r,c)})}}async function ble(e,t){let n=yle(e);if(n.completed!==!0)return n.promise===null&&(n.promise=s4(e,t).then(()=>{n.completed=!0}).catch(e=>{throw n.promise=null,e})),n.promise}function xle(e){let t=e4(e);O.info(`oauth-provider: enforcePerClientResources resolved to ${t.value} (${t.source})`)}function c4(e){return e.headers?.get(`dpop`)??void 0}function l4(e,t){return e.request?.url??`${e.context.baseURL}${t}`}const Sle=/* @__PURE__ */ new Set([`openid`,`profile`,`email`,`offline_access`]);function u4(e){return Sle.has(e)}function d4(e){return[...new Set(e.map(e=>e.trim()).filter(Boolean))]}function f4(e,t,n,r){if(e.length===0)return;if(!t.includes(`client_credentials`))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`client_credentials_scopes requires the client_credentials grant`});if(n===`none`)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`public clients cannot be assigned client_credentials scopes`});let i=new Set(r.scopes??[]),a=e.filter(e=>!i.has(e)||u4(e));if(a.length>0)throw new c(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`The following client_credentials scopes are invalid: ${a.join(`, `)}`})}const Cle=[`javascript:`,`data:`,`vbscript:`],p4=f().superRefine((e,t)=>{if(!URL.canParse(e))return t.addIssue({code:`custom`,message:`resource must be an absolute URI`,fatal:!0}),C;if(e.includes(`#`)){t.addIssue({code:`custom`,message:`resource must not contain a fragment`});return}Cle.includes(new URL(e).protocol)&&t.addIssue({code:`custom`,message:`resource cannot use javascript:, data:, or vbscript: scheme`})}),wle=E([`none`,`consent`,`login`,`create`,`select_account`]),Tle=f().superRefine((e,t)=>{let n=e.split(` `).map(e=>e.trim()).filter(Boolean),r=/* @__PURE__ */ new Set;if(!n.length){t.addIssue({code:`custom`,message:`prompt must include at least one value`});return}for(let e of n){let n=wle.safeParse(e);if(!n.success){t.addIssue({code:`custom`,message:`unsupported prompt value: ${e}`});continue}r.add(n.data)}r.has(`none`)&&r.size>1&&t.addIssue({code:`custom`,message:`prompt=none cannot be combined with other prompt values`})}),m4=D({keys:_(g(f(),se())).min(1)}),Ele=n([m(),f().trim().min(1)]).transform((e,t)=>{let n=typeof e==`number`?e:Number(e);return!Number.isInteger(n)||n<0?(t.addIssue({code:`custom`,message:`max_age must be a non-negative integer`}),C):n}),Dle=f().regex(/^[A-Za-z0-9_-]{43}$/,`dpop_jkt must be a base64url-encoded SHA-256 JWK thumbprint`),h4=D({response_type:f().pipe(E([`code`])).optional(),request:f().optional(),request_uri:f().optional(),redirect_uri:R2.optional(),scope:f().optional(),state:f().optional(),client_id:f().min(1,`client_id is required`),prompt:Tle.optional(),display:f().optional(),ui_locales:f().optional(),max_age:Ele.optional(),acr_values:f().optional(),login_hint:f().optional(),id_token_hint:f().optional(),code_challenge:f().optional(),code_challenge_method:f().pipe(E([`S256`])).optional(),nonce:f().optional(),claims:nle.optional(),dpop_jkt:Dle.optional(),resource:n([p4,_(p4).min(1)]).optional()}).passthrough(),Ole=h4.extend({redirect_uri:R2.optional(),claims:U2.optional()}),kle=D({type:ee(`authorization_code`),query:Ole,sessionId:f(),userId:f(),referenceId:f().optional(),authTime:m().optional(),resource:_(f()).optional()}).passthrough(),g4=D({redirect_uris:_(R2).min(1).optional(),scope:f().optional(),client_name:f().refine(e=>e.trim().length>0,`client_name cannot be empty`).optional(),client_uri:f().optional(),logo_uri:f().optional(),contacts:_(f().min(1)).min(1).optional(),tos_uri:f().optional(),policy_uri:f().optional(),software_id:f().optional(),software_version:f().optional(),software_statement:f().optional(),post_logout_redirect_uris:_(R2).min(1).optional(),backchannel_logout_uri:R2.optional(),backchannel_logout_session_required:T().optional(),token_endpoint_auth_method:f().trim().min(1).optional(),jwks:m4.optional(),jwks_uri:f().optional(),grant_types:_(f().trim().min(1)).min(1).optional(),response_types:_(E([`code`])).optional(),application_type:E([`web`,`native`]).optional(),subject_type:E([`public`,`pairwise`]).optional(),dpop_bound_access_tokens:T().optional(),resources:_(p4).optional(),skip_consent:b({error:`skip_consent cannot be set during dynamic client registration`}).optional()}),Ale=g4.omit({skip_consent:!0}).extend({client_id:f().refine(e=>e.trim().length>0,`client_id cannot be empty`),client_secret:f().optional(),client_secret_expires_at:m().int().nonnegative().optional(),client_id_issued_at:m().int().nonnegative().optional()}).loose();function jle(e,t,n=[]){let r=new Set(n),i={sub:e.id??void 0};for(let[n,a]of Object.entries(K2))(t.includes(a.scope)||r.has(n))&&(i[n]=a.resolve(e));return i}function _4(e,t){let n={};for(let[r,i]of Object.entries(e??{}))i!==void 0&&(t&&r in t||(n[r]=i));return n}function Mle(e){let t=e.headers?.get(`authorization`),n=xK(t),r=e.request?.method===`POST`?e.body?.access_token??void 0:void 0;if(n&&r)throw new c(`BAD_REQUEST`,{error_description:`Multiple access token transport methods are not allowed`,error:`invalid_request`});let i=n??(r?{scheme:`Bearer`,token:r}:void 0);return{authorization:i,token:i?.token}}async function Nle(e,t){let{authorization:n}=Mle(e);if(!n?.token)throw new c(`UNAUTHORIZED`,{error_description:`access token not found`,error:`invalid_request`});let{payload:r,requestedUserInfoClaims:i}=await z4(e,t,n.token);if(DK(r)&&!e.request)throw new c(`UNAUTHORIZED`,{error_description:`DPoP-bound access token requires an HTTP request context`,error:`invalid_token`});try{await LK({payload:r,authorization:n,proofJwt:c4(e),method:e.request?.method??`GET`,url:l4(e,`/oauth2/userinfo`),proofMaxAgeSeconds:t.dpop?.proofMaxAgeSeconds,signingAlgorithms:t.dpop?.signingAlgorithms,replayStore:vK(e.context.internalAdapter)})}catch(e){throw IK(e)?new c(`UNAUTHORIZED`,{error_description:e.message,error:e.code}):e}let a=r.scope?.split(` `);if(!a?.includes(`openid`))throw new c(`BAD_REQUEST`,{error_description:`Missing required scope`,error:`invalid_scope`});if(!r.sub)throw new c(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let o=await e.context.internalAdapter.findUserById(r.sub);if(!o)throw new c(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let s=jle(o,a??[],i),l=r.client_id??r.azp,u=l&&(t.pairwiseSecret||Lce(t))?await m2(e,t,l):void 0;t.pairwiseSecret&&u&&(s.sub=await j2(o.id,u,t));let d=a?.length?await Ice(t,{ctx:e,opts:t,user:o,scopes:a,jwt:r,client:u??void 0,requestedClaims:i}):{},f=t.customUserInfoClaims&&a?.length?await t.customUserInfoClaims({user:o,scopes:a,jwt:r,requestedClaims:i}):{};return{...s,..._4(d,s),..._4(f),sub:s.sub}}const Ple=Object.fromEntries(q2.map(e=>[e,void 0]));function v4(e){return EK(e)?`DPoP`:`Bearer`}async function Fle(e,t){let n=e.body.grant_type;if(!n2(t).includes(n))throw new c(`BAD_REQUEST`,{error_description:`unsupported grant_type ${n}`,error:`unsupported_grant_type`});switch(n){case`authorization_code`:return nue(e,t);case`client_credentials`:return rue(e,t);case`refresh_token`:return iue(e,t);default:{let r=Mce(t,n);if(r)return r({ctx:e,opts:t,grantType:n,provider:Ile(e,t,n)});throw new c(`BAD_REQUEST`,{error_description:`unsupported grant_type ${n}`,error:`unsupported_grant_type`})}}}function Ile(e,t,n){return{getClient:n=>m2(e,t,n),authenticateClient:async r=>{let{clientId:i,clientSecret:a,preVerified:o,authMethod:s,confirmation:l}=O2(await k2(e,t,`${e.context.baseURL}${e.path??`/oauth2/token`}`));if(!i)throw new c(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});if(r?.requireCredentials!==!1&&!a&&!o)throw new c(`BAD_REQUEST`,{error_description:`Missing required client credentials`,error:`invalid_client`});return{clientId:i,client:await E2(e,t,i,a,r?.scopes,o,n,s),method:s,confirmation:l}},issueTokens:r=>{if(!n)throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`issueTokens requires a grant type; pass it to getOAuthProviderApi(ctx, opts, grantType).`,error:`server_error`});return j4(e,t,{...r,grantType:n})},hashToken:(e,n)=>y2(t.storeTokens,e,n),validateAccessToken:async(n,r)=>{let{validateAccessToken:i}=await Promise.resolve().then(()=>M4);return i(e,t,n,r)},requireActiveAccessToken:async(n,r)=>{let{requireActiveAccessToken:i}=await Promise.resolve().then(()=>M4);return i(e,t,n,r)}}}async function Lle(e,t,n,r,i,a,o){let s=o?.iat??Math.floor(Date.now()/1e3),c=o?.exp??s+(t.accessTokenExpiresIn??3600),l=c2(e.context).options,u=n?.id??r.clientId;return I0(e,{options:l,header:{typ:`at+jwt`},signingKeyId:o?.signingKeyId??void 0,signingAlgorithm:o?.signingAlgorithm??void 0,payload:{...o?.accessTokenClaims??{},sub:u,aud:d2(i),client_id:r.clientId,azp:r.clientId,scope:a.join(` `),sid:o?.sid,iss:l?.jwt?.issuer??e.context.baseURL,iat:s,exp:c,jti:AU(32),...o?.confirmation?{cnf:o.confirmation}:{}}})}async function Rle(e,t){let n;n=t===`EdDSA`?`SHA-512`:t.endsWith(`384`)?`SHA-384`:t.endsWith(`512`)?`SHA-512`:`SHA-256`;let r=new Uint8Array(await crypto.subtle.digest(n,new TextEncoder().encode(e)));return ot(r.slice(0,r.length/2))}async function zle(e,t,n,r,i,a,o,s,l,u){let d=Math.floor(Date.now()/1e3),f=d+(t.idTokenExpiresIn??36e3),p=await j2(n.id,r,t),m=s==null?void 0:Math.floor(s.getTime()/1e3),h=z2(t.customIdTokenClaims?await t.customIdTokenClaims({user:n,scopes:i,metadata:D2(r.metadata)}):void 0),g=t.disableJwtPlugin?void 0:c2(e.context).options,_=!t.disableJwtPlugin&&!g?.jwt?.sign?await F0(e,g):void 0,v=t.disableJwtPlugin?`HS256`:_?.alg??g?.jwks?.keyPairConfig?.alg,y=l?await Rle(l,v):void 0,b=!!(r.enableEndSession||r.backchannelLogoutUri),x={...Ple,auth_time:m,acr:`0`,...h,at_hash:y,iss:g?.jwt?.issuer??e.context.baseURL,sub:p,aud:r.clientId,nonce:a,iat:d,exp:f,sid:b?o:void 0},S=z2(u);if(Object.assign(x,_4(S,x)),t.disableJwtPlugin&&!r.clientSecret)return;let C=t.disableJwtPlugin?await new xt(x).setProtectedHeader({alg:`HS256`}).sign(new TextEncoder().encode(await _2(e,t.storeClientSecret,r.clientSecret))):await I0(e,{options:g,payload:x,resolvedKey:_??void 0});if(C&&y&&g?.jwt?.sign){let e=fV(C);if(e.alg!==v)throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`ID token signed with "${e.alg}" but at_hash was computed for "${v}". Ensure jwt.sign uses the algorithm declared in keyPairConfig.alg.`,error:`server_error`})}return C}async function y4(e,t,n){return(e.prefix?.refreshToken??``)+(e.formatRefreshToken?.encrypt?e.formatRefreshToken.encrypt(t,n):t)}async function b4(e,t){if(e.prefix?.refreshToken){if(t.startsWith(e.prefix.refreshToken))t=t.replace(e.prefix.refreshToken,``);else throw new c(`BAD_REQUEST`,{error_description:`refresh token not found`,error:`invalid_token`})}return e.formatRefreshToken?.decrypt?e.formatRefreshToken?.decrypt(t):{token:t}}async function Ble(e,t,n,r,i,a,o,s,c,l,u,d){let f=a.iat??Math.floor(Date.now()/1e3),p=a?.exp??f+(t.accessTokenExpiresIn??3600),m=t.generateOpaqueAccessToken?await t.generateOpaqueAccessToken():AU(32,`A-Z`,`a-z`);return await e.context.adapter.create({model:`oauthAccessToken`,data:{token:await y2(t.storeTokens,m,`access_token`),clientId:r.clientId,sessionId:a?.sid,userId:n?.id,referenceId:s,authorizationCodeId:c,resources:o,refreshId:l,confirmation:u,requestedUserInfoClaims:d?.length?d:void 0,scopes:i,createdAt:/* @__PURE__ */ new Date(f*1e3),expiresAt:/* @__PURE__ */ new Date(p*1e3)}}),(t.prefix?.opaqueAccessToken??``)+m}async function x4(e,t,n){let r=await e.context.adapter.findMany({model:`oauthRefreshToken`,where:[{field:`clientId`,value:t},{field:`userId`,value:n}]});r.length&&await e.context.adapter.deleteMany({model:`oauthAccessToken`,where:[{field:`refreshId`,operator:`in`,value:r.map(e=>e.id)}]}),await e.context.adapter.deleteMany({model:`oauthRefreshToken`,where:[{field:`clientId`,value:t},{field:`userId`,value:n}]})}async function Vle(e,t){let n=async n=>{try{await e.context.adapter.deleteMany({model:n,where:[{field:`authorizationCodeId`,value:t}]})}catch(t){e.context.logger.error(`authorization code replay cleanup failed`,t)}};await n(`oauthAccessToken`),await n(`oauthRefreshToken`)}async function S4(e,t,n,r,i,a,o,s,l,u,d,f,p){let m=s.iat??Math.floor(Date.now()/1e3),h=s?.exp??m+(t.refreshTokenExpiresIn??2592e3),g=t.generateRefreshToken?await t.generateRefreshToken():AU(32,`A-Z`,`a-z`),_=s?.sid,v={token:await y2(t.storeTokens,g,`refresh_token`),clientId:a.clientId,sessionId:_,userId:n.id,referenceId:r,authorizationCodeId:i,authTime:u,confirmation:f,requestedUserInfoClaims:p?.length?p:void 0,scopes:o,resources:d,createdAt:/* @__PURE__ */ new Date(m*1e3),expiresAt:/* @__PURE__ */ new Date(h*1e3)};if(!l?.id)return{id:(await e.context.adapter.create({model:`oauthRefreshToken`,data:v})).id,token:await y4(t,g,_)};let y=/* @__PURE__ */ new Date(m*1e3),b={revoked:y,rotatedAt:y},x=t.refreshTokenReuseInterval??0;if(x>0&&(b.rotationReplayExpiresAt=/* @__PURE__ */ new Date((m+x)*1e3)),!await e.context.adapter.incrementOne({model:`oauthRefreshToken`,where:[{field:`id`,value:l.id},{field:`revoked`,operator:`eq`,value:null}],increment:{},set:b}))throw new c(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`});return{id:(await e.context.adapter.create({model:`oauthRefreshToken`,data:v})).id,token:await y4(t,g,_)}}async function C4(e,t,n){let r=await $2(e,t,{resource:n.resources,clientId:n.clientId,requestedScopes:n.requestedScopes}),i=r.accessTokenTtl===null?n.scopeExpiresAtSeconds:n.iat+r.accessTokenTtl,a=t.refreshTokenExpiresIn??2592e3,o=r.refreshTokenTtl===null?a:Math.min(r.refreshTokenTtl,a);return{audienceClaim:r.audienceClaim,effectiveScopes:r.effectiveScopes,accessTokenExpiresAtSeconds:Math.min(n.scopeExpiresAtSeconds,i),refreshTokenExpiresAtSeconds:n.iat+o,refreshResources:n.refreshToken?.resources??n.originalResources??n.resources,signingAlgorithm:r.signingAlgorithm,signingKeyId:r.signingKeyId,resourceCustomClaims:r.rawCustomClaims,dpopBoundAccessTokensRequired:r.dpopBoundAccessTokensRequired}}function w4(e){throw new c(`BAD_REQUEST`,{error:`invalid_dpop_proof`,error_description:e})}function Hle(e){let t=D2(e.metadata)??{};return e.dpopBoundAccessTokens===!0||t.dpop_bound_access_tokens===!0}async function T4(e,t,n){let r=n.verificationValue?.query.dpop_jkt,i=EK(n.refreshToken?.confirmation),a=i??r,o=c4(e),s=Hle(n.client)||n.grantIssuance.dpopBoundAccessTokensRequired||!!r||!!i;if(!o){s&&w4(`DPoP proof header is required`);return}try{return{jkt:(await PK({proofJwt:o,method:`POST`,url:l4(e,`/oauth2/token`),expectedJkt:a,proofMaxAgeSeconds:t.dpop?.proofMaxAgeSeconds,signingAlgorithms:t.dpop?.signingAlgorithms,replayStore:vK(e.context.internalAdapter)})).jkt}}catch(e){throw bK(e)&&w4(e.message),e}}function E4(e){return e?[...new Set(e)].sort():void 0}function D4(e,t){let n=E4(e),r=E4(t);return n===void 0||r===void 0?n===r:n.length===r.length&&n.every((e,t)=>e===r[t])}function O4(e){if(e)return`jkt`in e?`jkt:${e.jkt}`:`x5t#S256:${e[`x5t#S256`]}`}function Ule(e,t){return O4(e)===O4(t)}function Wle(e){if(!e||typeof e!=`object`)return!1;let t=e;return typeof t.jkt==`string`&&t[`x5t#S256`]===void 0||typeof t[`x5t#S256`]==`string`&&t.jkt===void 0}function Gle(e){return e===`Bearer`||e===`DPoP`}function Kle(e){if(!e||typeof e!=`object`)return!1;let t=e;return typeof t.access_token==`string`&&typeof t.expires_in==`number`&&typeof t.expires_at==`number`&&Gle(t.token_type)&&typeof t.scope==`string`&&(t.refresh_token===void 0||typeof t.refresh_token==`string`)&&(t.id_token===void 0||typeof t.id_token==`string`)}function qle(e){if(!e||typeof e!=`object`)return!1;let t=e,n=t.request;return!!n&&Array.isArray(n.effectiveScopes)&&n.effectiveScopes.every(e=>typeof e==`string`)&&(n.requestedResources===void 0||Array.isArray(n.requestedResources)&&n.requestedResources.every(e=>typeof e==`string`))&&(n.confirmation===void 0||Wle(n.confirmation))&&Kle(t.response)}function k4(e){let t=E4(e.requestedResources);return{effectiveScopes:E4(e.effectiveScopes)??[],...t?{requestedResources:t}:{},...e.confirmation?{confirmation:e.confirmation}:{}}}function Jle(e,t){return D4(e.effectiveScopes,t.effectiveScopes)&&D4(e.requestedResources,t.requestedResources)&&Ule(e.confirmation,t.confirmation)}async function Yle(e,t){return IW({key:e.context.secretConfig,data:JSON.stringify(t)})}async function Xle(e,t){let n=await LW({key:e.context.secretConfig,data:t}),r=JSON.parse(n);if(qle(r))return r}function A4(e){return!!e.rotatedAt&&!!e.rotationReplayExpiresAt&&e.rotationReplayExpiresAt>=/* @__PURE__ */ new Date}async function Zle(e,t,n,r,i){(t.refreshTokenReuseInterval??0)<=0||await e.context.adapter.update({model:`oauthRefreshToken`,where:[{field:`id`,value:n.id}],update:{rotationReplayResponse:await Yle(e,{request:r,response:i})}})}async function Qle(e,t,n){if(A4(t)&&t.rotationReplayResponse)try{let r=await Xle(e,t.rotationReplayResponse);return!r||!Jle(r.request,n)?void 0:r.response}catch(t){e.context.logger.error(`refresh token rotation replay failed`,t);return}}async function $le(e,t,n){let r=Math.floor(Date.now()/1e3),i=await C4(e,t,{clientId:n.client.clientId,requestedScopes:n.scopes,resources:n.resources,refreshToken:n.refreshToken,iat:r,scopeExpiresAtSeconds:r+(t.accessTokenExpiresIn??3600)}),a=await T4(e,t,{client:n.client,grantIssuance:i,refreshToken:n.refreshToken});return k4({effectiveScopes:i.effectiveScopes,requestedResources:n.resources,confirmation:a})}function eue(e,t){let n=Math.floor(Date.now()/1e3);return e.json({...t,expires_in:Math.max(0,t.expires_at-n)})}async function j4(e,t,n){let{client:r,scopes:i,user:a,grantType:o,referenceId:s,sessionId:c,nonce:l,refreshToken:u,authTime:d,verificationValue:f}=n,p=Math.floor(Date.now()/1e3),m=p+(a?t.accessTokenExpiresIn??3600:t.m2mAccessTokenExpiresIn??3600),h=t.scopeExpirations?i.map(e=>t.scopeExpirations?.[e]?M0(t.scopeExpirations[e],p):m).reduce((e,t)=>e<t?e:t,m):m,g=await C4(e,t,{clientId:r.clientId,requestedScopes:i,resources:n.resources,originalResources:n.originalResources,refreshToken:n.refreshToken,iat:p,scopeExpiresAtSeconds:h}),_=g.audienceClaim,v=g.effectiveScopes,y=g.accessTokenExpiresAtSeconds,b=g.refreshTokenExpiresAtSeconds,x=a&&w2(r,`refresh_token`)&&(u?.scopes?.includes(`offline_access`)||i.includes(`offline_access`)),S=_&&!t.disableJwtPlugin,C=a&&v.includes(`openid`),w=D2(r.metadata),T=C&&a?{...await Fce(t,{ctx:e,opts:t,user:a,client:r,scopes:v,grantType:o,referenceId:s,sessionId:c,resources:n.resources,metadata:w}),...n.idTokenClaims??{}}:void 0,ee=t.customTokenResponseFields?await t.customTokenResponseFields({grantType:o,user:a,scopes:v,metadata:w,verificationValue:f}):void 0,te=g.refreshResources,E=n.confirmation??await T4(e,t,{client:r,grantIssuance:g,verificationValue:f,refreshToken:u}),ne=n.requestedUserInfoClaims??u?.requestedUserInfoClaims??[],re=x&&a&&!S?await S4(e,t,a,s,n.authorizationCodeId,r,v,{iat:p,exp:b,sid:c},u,d,te,E,ne):void 0,ie=S?await Y2({ctx:e,opts:t,user:a,client:r,scopes:v,grantType:o,sessionId:c,resources:n.resources,referenceId:s,metadata:w,perRequestClaims:n.accessTokenClaims,resourcePolicyClaims:g.resourceCustomClaims}):void 0,[ae,oe]=await Promise.all([S?Lle(e,t,a,r,_,v,{iat:p,exp:y,sid:c,signingAlgorithm:g.signingAlgorithm,signingKeyId:g.signingKeyId,accessTokenClaims:ie,confirmation:E}):Ble(e,t,a,r,v,{iat:p,exp:y,sid:c},n?.resources,s,n.authorizationCodeId,re?.id,E,ne),re||(x&&a?S4(e,t,a,s,n.authorizationCodeId,r,v,{iat:p,exp:b,sid:c},u,d,te,E,ne):void 0)]),D=C?await zle(e,t,a,r,v,l,c,d,ae,T):void 0,se={...ee,...n.tokenResponse??{},access_token:ae,expires_in:y-p,expires_at:y,token_type:v4(E),refresh_token:oe?.token,scope:v.join(` `),id_token:D};if(u?.id&&oe?.id)try{await Zle(e,t,u,k4({effectiveScopes:v,requestedResources:n.resources,confirmation:E}),se)}catch(t){e.context.logger.error(`failed to store refresh token rotation replay`,t)}return e.json(se)}async function tue(e,t,n,r,i,a){let o=await y2(t.storeTokens,n,`authorization_code`),s=await e.context.internalAdapter.consumeVerificationValue(o);if(!s)throw await Vle(e,o),new c(`BAD_REQUEST`,{error_description:`invalid code`,error:`invalid_grant`});let l;try{l=JSON.parse(s.value)}catch{throw new c(`BAD_REQUEST`,{error_description:`malformed verification value`,error:`invalid_grant`})}let u=kle.safeParse(l);if(!u.success)throw new c(`BAD_REQUEST`,{error_description:`malformed verification value`,error:`invalid_grant`});let d=u.data;if(d.query.client_id!==r)throw new c(`BAD_REQUEST`,{error_description:`invalid client_id`,error:`invalid_grant`});let f=d.query.redirect_uri;if(f){if(!i)throw new c(`BAD_REQUEST`,{error_description:`redirect_uri is required`,error:`invalid_request`});if(f!==i)throw new c(`BAD_REQUEST`,{error_description:`redirect_uri mismatch`,error:`invalid_grant`})}else if(i)throw new c(`BAD_REQUEST`,{error_description:`redirect_uri mismatch`,error:`invalid_grant`});let p=u2(d.resource)??u2(d.query.resource),m=a??p;if(a&&p){let e=new Set(a),t=new Set(p);for(let n of e)if(!t.has(n))throw new c(`BAD_REQUEST`,{error_description:`requested resource not authorized`,error:`invalid_target`})}return{verificationValue:d,effectiveResources:m,authorizedResources:p,authorizationCodeId:o}}async function nue(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=O2(await k2(e,t,`${e.context.baseURL}/oauth2/token`)),{code:o,code_verifier:s,redirect_uri:l,resource:u}=e.body,d=u2(u);if(!n)throw new c(`BAD_REQUEST`,{error_description:`client_id is required`,error:`invalid_request`});if(!o)throw new c(`BAD_REQUEST`,{error_description:`code is required`,error:`invalid_request`});let f=n&&r,p=n&&o&&s;if(!f&&!p&&!i)throw new c(`BAD_REQUEST`,{error_description:`Either code_verifier or client_secret is required`,error:`invalid_request`});let{verificationValue:m,effectiveResources:h,authorizedResources:g,authorizationCodeId:_}=await tue(e,t,o,n,l,d),v=m.query.scope?.split(` `);if(!v)throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`verification scope unset`,error:`invalid_scope`});let y=await E2(e,t,n,r,v,i,`authorization_code`,a);if(I2(y,{scopes:(m.query?.scope)?.split(` `)||[],nonce:m.query?.nonce})){if(!p)throw new c(`BAD_REQUEST`,{error_description:`PKCE is required for this client`,error:`invalid_request`})}else if(!(p||f||i))throw new c(`BAD_REQUEST`,{error_description:`Either PKCE (code_verifier) or client authentication (client_secret or client_assertion) is required`,error:`invalid_request`});let b=!!m.query?.code_challenge,x=!!s;if(b||x){if(b&&!x)throw new c(`UNAUTHORIZED`,{error_description:`code_verifier required because PKCE was used in authorization`,error:`invalid_request`});if(!b&&x)throw new c(`UNAUTHORIZED`,{error_description:`code_verifier provided but PKCE was not used in authorization`,error:`invalid_request`});if((m.query?.code_challenge_method===`S256`?await lG(s):void 0)!==m.query?.code_challenge)throw new c(`UNAUTHORIZED`,{error_description:`code verification failed`,error:`invalid_request`})}if(!m.userId)throw new c(`BAD_REQUEST`,{error_description:`missing user, user may have been deleted`,error:`invalid_user`});let S=await e.context.internalAdapter.findUserById(m.userId);if(!S)throw new c(`BAD_REQUEST`,{error_description:`missing user, user may have been deleted`,error:`invalid_user`});let C=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:m.sessionId}]});if(!C||C.expiresAt</* @__PURE__ */ new Date)throw new c(`BAD_REQUEST`,{error_description:`session no longer exists`,error:`invalid_request`});let w=m.authTime==null?Bce(C):l2(m.authTime),T=W2(m.query.claims,J2(t));return j4(e,t,{client:y,scopes:m.query.scope?.split(` `)??[],user:S,grantType:`authorization_code`,referenceId:m.referenceId,sessionId:C.id,nonce:m.query?.nonce,authTime:w,verificationValue:m,authorizationCodeId:_,requestedUserInfoClaims:T,resources:h,originalResources:g})}async function rue(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=O2(await k2(e,t,`${e.context.baseURL}/oauth2/token`)),{scope:o,resource:s}=e.body,l=u2(s);if(!n)throw new c(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});let u=await E2(e,t,n,r,void 0,i,`client_credentials`,a);if(u.tokenEndpointAuthMethod===`none`)throw new c(`BAD_REQUEST`,{error_description:`public clients cannot use the client_credentials grant`,error:`unauthorized_client`});let d=u.clientCredentialsScopes;if(!d?.length)throw new c(`BAD_REQUEST`,{error_description:`client has no authorized client_credentials scopes`,error:`unauthorized_client`});let f=o?.split(` `);if(f){let e=new Set(d),t=f.filter(t=>!e.has(t)||u4(t));if(t.length)throw new c(`BAD_REQUEST`,{error_description:`The following scopes are invalid: ${t.join(`, `)}`,error:`invalid_scope`})}return f||=[...d],j4(e,t,{client:u,scopes:f,grantType:`client_credentials`,resources:l})}async function iue(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=O2(await k2(e,t,`${e.context.baseURL}/oauth2/token`)),{refresh_token:o,scope:s,resource:l}=e.body,u=u2(l);if(!n)throw new c(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});if(!o)throw new c(`BAD_REQUEST`,{error_description:`Missing a required refresh_token for refresh_token grant`,error:`invalid_request`});let d=await b4(t,o),f=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await b2(t.storeTokens,d.token,`refresh_token`)}]});if(!f)throw new c(`BAD_REQUEST`,{error_description:`session not found`,error:`invalid_grant`});if(f.clientId!==n||f.expiresAt</* @__PURE__ */ new Date)throw new c(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`});if(u&&f.resources&&!u.every(e=>f.resources?.includes(e)))throw new c(`BAD_REQUEST`,{error_description:`requested resource invalid`,error:`invalid_target`});let p=f?.scopes,m=s?.split(` `);if(m){let e=new Set(p);for(let t of m)if(!e.has(t))throw new c(`BAD_REQUEST`,{error_description:`unable to issue scope ${t}`,error:`invalid_scope`})}let h=await E2(e,t,n,r,m??p,i,`refresh_token`,a);if(f.revoked){if(A4(f)){let n=await Qle(e,f,await $le(e,t,{client:h,refreshToken:f,scopes:m??p,resources:u??f.resources}));if(n)return eue(e,n);throw new c(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`})}throw await x4(e,n,f.userId),new c(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`})}let g=await e.context.internalAdapter.findUserById(f.userId);if(!g)throw new c(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let _=f.authTime==null?void 0:l2(f.authTime);return j4(e,t,{client:h,scopes:m??p,user:g,grantType:`refresh_token`,referenceId:f.referenceId,authorizationCodeId:f.authorizationCodeId,sessionId:f.sessionId,refreshToken:f,resources:u??f.resources,authTime:_,requestedUserInfoClaims:f.requestedUserInfoClaims})}var M4=/* @__PURE__ */ W0({introspectEndpoint:()=>V4,requireActiveAccessToken:()=>due,requireActiveAccessTokenWithClaims:()=>z4,validateAccessToken:()=>R4});const N4=`Invalid access token`,aue=`Bearer error="invalid_token", error_description="${N4}"`;function P4(){return{payload:{active:!1},requestedUserInfoClaims:[]}}function oue(e,t){return e==null?[]:(Array.isArray(e)?e:[e]).filter(e=>typeof e==`string`&&e!==t)}async function F4(e,t,n){let{introspectingClientId:r,issuerClientId:i,audienceResources:a}=n;return!r||r===i||a.length!==0&&mle(e,t,r,a)}async function sue(e,t,n,r){let i=t.disableJwtPlugin?void 0:c2(e.context),a=i?.options,o=`${e.context.baseURL??``}/oauth2/userinfo`,s=a?.jwt?.issuer??e.context.baseURL,c;try{c=(await JB(n,nV(await XK(n,{jwksFetch:a?.jwks?.remoteUrl?a.jwks.remoteUrl:async()=>(await i?.endpoints.getJwks(e))?.response,jwksCacheKey:i})),{issuer:s})).payload}catch(e){if(e instanceof Error){if(e.name===`TypeError`||e.name===`JWSInvalid`)throw new d(`BAD_REQUEST`,{error_description:`invalid JWT signature`,error:`invalid_request`});if(e.name===`JWTExpired`||e.name===`JWTInvalid`)return{active:!1};throw e}throw Error(e)}let l=c.aud;if(!await Q2(e,t,l,[o])||!c.azp)return{active:!1};let u=await m2(e,t,c.azp);if(!u||u?.disabled||!await F4(e,t,{introspectingClientId:r,issuerClientId:c.azp,audienceResources:oue(l,o)}))return{active:!1};let f=c.sid;if(f){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:f}]});if(!t||t.expiresAt</* @__PURE__ */ new Date)return{active:!1}}return c.client_id=c.azp,c.active=!0,c.token_type=v4(c.cnf),c}async function cue(e,t,n,r){let i=n;if(t.prefix?.opaqueAccessToken){if(i.startsWith(t.prefix.opaqueAccessToken))i=i.replace(t.prefix.opaqueAccessToken,``);else throw new d(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`})}let a=await e.context.adapter.findOne({model:`oauthAccessToken`,where:[{field:`token`,value:await b2(t.storeTokens,i,`access_token`)}]});if(!a)throw new d(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_token`});if(!a.expiresAt||a.expiresAt</* @__PURE__ */ new Date||a.revoked)return P4();let o=Array.isArray(a.resources)?a.resources:void 0,s;if(a.clientId&&(s=await m2(e,t,a.clientId),!s||s?.disabled||!await F4(e,t,{introspectingClientId:r,issuerClientId:a.clientId,audienceResources:o??[]})))return P4();let c=a.sessionId??void 0;if(c){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:c}]});if(!t||t.expiresAt</* @__PURE__ */ new Date)return P4()}let l;a.userId&&(l=await e.context.internalAdapter.findUserById(a?.userId));let u=`${e.context.baseURL}/oauth2/userinfo`;if(o?.length&&!await Q2(e,t,o,[u]))return P4();let f=o?[...o]:void 0;f?.length&&a.scopes?.includes(`openid`)&&(f.includes(u)||f.push(u));let p=o?.length?await hle(e,t,o):{},m=s?await Y2({ctx:e,opts:t,user:l,client:s,scopes:a.scopes??[],grantType:void 0,sessionId:void 0,resources:o,referenceId:a.referenceId,metadata:D2(s.metadata),perRequestClaims:void 0,resourcePolicyClaims:p}):{},h=(t.disableJwtPlugin?void 0:c2(e.context))?.options;return{payload:{...m,active:!0,iss:h?.jwt?.issuer??e.context.baseURL,aud:d2(f),client_id:a.clientId,azp:a.clientId,sub:l?.id,sid:c,exp:Math.floor(new Date(a.expiresAt).getTime()/1e3),iat:Math.floor(new Date(a.createdAt).getTime()/1e3),scope:a.scopes?.join(` `),token_type:v4(a.confirmation),...a.confirmation?{cnf:a.confirmation}:{}},requestedUserInfoClaims:a.requestedUserInfoClaims??[]}}async function lue(e,t,n,r){let i=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await b2(t.storeTokens,n,`refresh_token`)}]});if(!i)throw new d(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_token`});if(!i.clientId||i.clientId!==r||!i.expiresAt||i.expiresAt</* @__PURE__ */ new Date||i.revoked)return{active:!1};let a=i.sessionId??void 0;if(a){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:a}]});(!t||t.expiresAt</* @__PURE__ */ new Date)&&(a=void 0)}let o;return i.userId&&(o=await e.context.internalAdapter.findUserById(i?.userId)??void 0),{active:!0,client_id:r,iss:((t.disableJwtPlugin?void 0:c2(e.context))?.options)?.jwt?.issuer??e.context.baseURL,sub:o?.id,sid:a,exp:Math.floor(new Date(i.expiresAt).getTime()/1e3),iat:Math.floor(new Date(i.createdAt).getTime()/1e3),scope:i.scopes?.join(` `),token_type:v4(i.confirmation),...i.confirmation?{cnf:i.confirmation}:{}}}function I4(){return new d(`UNAUTHORIZED`,{error_description:N4,error:`invalid_token`},{"WWW-Authenticate":aue})}function uue(e){return e.status===`BAD_REQUEST`||e.body?.error===`invalid_token`}async function L4(e,t,n,r){try{return{payload:await sue(e,t,n,r),requestedUserInfoClaims:[]}}catch(e){if(!(e instanceof d))throw e instanceof Error?e:Error(e)}try{return await cue(e,t,n,r)}catch(e){if(!(e instanceof d))throw e instanceof Error?e:Error(`Unknown error validating access token`)}throw I4()}async function R4(e,t,n,r){return(await L4(e,t,n,r)).payload}async function due(e,t,n,r){let i=await R4(e,t,n,r);if(i.active)return i;throw I4()}async function z4(e,t,n,r){let{payload:i,requestedUserInfoClaims:a}=await L4(e,t,n,r);if(i.active)return{payload:i,requestedUserInfoClaims:a};throw I4()}async function B4(e,t,n,r){if(!n.active||!n.sub)return n;let i=n.client_id??n.azp;if(!i)return n;let a=i===r.clientId?r:await m2(e,t,i);if(!a)return n;let o=await j2(n.sub,a,t);return{...n,sub:o}}async function V4(e,t){let{token:n,token_type_hint:r}=e.body;r!==`access_token`&&r!==`refresh_token`&&(r=void 0);let{clientId:i,clientSecret:a,preVerified:o,authMethod:s}=O2(await k2(e,t,`${e.context.baseURL}/oauth2/introspect`));if(!i||!a&&!o)throw new d(`UNAUTHORIZED`,{error_description:`missing required credentials`,error:`invalid_client`});if(n&&typeof n==`string`&&(n=SK(n)),!n?.length)throw new d(`BAD_REQUEST`,{error_description:`missing a required token for introspection`,error:`invalid_request`});let c=await E2(e,t,i,a,void 0,o,void 0,s);try{if(r===void 0||r===`access_token`)try{return B4(e,t,await R4(e,t,n,c.clientId),c)}catch(e){if(e instanceof d){if(r===`access_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}if(r===void 0||r===`refresh_token`)try{return B4(e,t,await lue(e,t,(await b4(t,n)).token,c.clientId),c)}catch(e){if(e instanceof d){if(r===`refresh_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}throw new d(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`})}catch(e){if(e instanceof d){if(uue(e))return{active:!1};throw e}throw e instanceof Error?(O.error(`Introspection error:`,e.message,e.stack),new d(`INTERNAL_SERVER_ERROR`)):(O.error(`Introspection error:`,e),new d(`INTERNAL_SERVER_ERROR`))}}function H4(e){return e?.get(`sec-fetch-mode`)===`cors`}var fue=/* @__PURE__ */ e({a:()=>W3,c:()=>b3,d:()=>d3,f:()=>l3,h:()=>u3,i:()=>d6,l:()=>y3,n:()=>a6,o:()=>Gue,r:()=>c6,s:()=>M3,t:()=>_6,u:()=>s3});async function pue(e,t,n){let r=await s6.get(),i=r?.query;if(!i)throw new c(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let a=new URLSearchParams(i),o=a.get(`scope`)?.split(` `)??[],s=J2(t),l=W2(a.get(`claims`),s),u=a.get(`client_id`);if(!u)throw new c(`BAD_REQUEST`,{error_description:`client_id is required`,error:`invalid_client`});let d=e.body.scope?.split(` `);if(d&&!d.every(e=>o?.includes(e)))throw new c(`BAD_REQUEST`,{error_description:`Scope not originally requested`,error:`invalid_request`});let f=e.body.claims,p=f===void 0?l:W2(f,s);if(f!==void 0&&!p.every(e=>l.includes(e)))throw new c(`BAD_REQUEST`,{error_description:`Claim not originally requested`,error:`invalid_request`});if(e.body.accept!==!0)return{redirect:!0,url:f6(a.get(`redirect_uri`)??``,`access_denied`,`User denied access`,a.get(`state`)??void 0,_6(e,t))};let m=await CH(e),h=A2(a.get(`prompt`)??``).has(`login`),g=h&&N2(m?.session.createdAt,r?.signedQueryIssuedAt);if(h&&!g)return e?.headers?.set(`accept`,`application/json`),e.query=M2(a),await n(e);let _=await t.postLogin?.consentReferenceId?.({user:m?.user,session:m?.session,scopes:d??o}),v=await e.context.adapter.findOne({model:`oauthConsent`,where:[{field:`clientId`,value:u},{field:`userId`,value:m?.user.id},..._?[{field:`referenceId`,value:_}]:[]]}),y=Math.floor(Date.now()/1e3),b=a.getAll(`resource`),x={clientId:u,userId:m?.user.id,scopes:d??o,requestedUserInfoClaims:p,createdAt:/* @__PURE__ */ new Date(y*1e3),updatedAt:/* @__PURE__ */ new Date(y*1e3),resources:b.length?b:void 0,referenceId:_};if(v?.id?await e.context.adapter.update({model:`oauthConsent`,where:[{field:`id`,value:v.id}],update:{resources:x.resources,scopes:x.scopes,requestedUserInfoClaims:x.requestedUserInfoClaims,updatedAt:/* @__PURE__ */ new Date(y*1e3)}}):await e.context.adapter.create({model:`oauthConsent`,data:{...x,scopes:x.scopes}}),d&&a.set(`scope`,x.scopes.join(` `)),f!==void 0){let e=ale(a.get(`claims`),p);e?a.set(`claims`,JSON.stringify(e)):a.delete(`claims`)}e?.headers?.set(`accept`,`application/json`);let S=P2(a,`consent`);return g&&(S=P2(S,`login`),S=F2(S)),e.query=M2(S),await n(e,{postLogin:r?.postLoginClearedForSession!==void 0&&r.postLoginClearedForSession===m?.session.id})}async function mue(e,t){if(e.body.selected===!0)return await hue(e,t);if(e.body.created===!0)return await gue(e,t);if(e.body.postLogin===!0)return await _ue(e,t);throw new c(`BAD_REQUEST`,{error_description:`Missing parameters`,error:`invalid_request`})}async function hue(e,t){let n=(await s6.get())?.query;if(!n)throw new c(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});return e.headers?.set(`accept`,`application/json`),e.query=M2(P2(new URLSearchParams(n),`select_account`)),await t(e)}async function gue(e,t){let n=(await s6.get())?.query;if(!n)throw new c(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let r=new URLSearchParams(n);return e.headers?.set(`accept`,`application/json`),e.query=M2(P2(r,`create`)),await t(e)}async function _ue(e,t){let n=await s6.get(),r=n?.query;if(!r)throw new c(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let i=new URLSearchParams(r);e.headers?.set(`accept`,`application/json`),e.query=M2(i);let a=await CH(e);return await t(e,{postLogin:n?.postLoginClearedForSession!==void 0&&n.postLoginClearedForSession===a?.session.id})}async function vue(e,t,n,r){return I0(e,{options:t,payload:{...r,events:{"http://schemas.openid.net/event/backchannel-logout":{}}},header:{typ:`logout+jwt`},resolvedKey:n??void 0})}async function yue(e,t,n){let{sessionId:r,userId:i}=n;if(!i)return null;let a=e.context.logger;try{let n=await GR(e.context.adapter),o=[{field:`sessionId`,value:r}],[s,c]=await Promise.all([n.findMany({model:`oauthAccessToken`,where:o}),n.findMany({model:`oauthRefreshToken`,where:o})]),l=/* @__PURE__ */ new Set;for(let e of s)l.add(e.clientId);for(let e of c)l.add(e.clientId);if(l.size===0)return null;let u=await n.findMany({model:`oauthClient`,where:[{field:`clientId`,operator:`in`,value:Array.from(l)}]}),d=s.filter(e=>!e.revoked).map(e=>e.id),f=c.filter(e=>!e.revoked&&!e.scopes?.includes(`offline_access`)).map(e=>e.id),p=t.disableJwtPlugin?[]:u.filter(e=>!!e.backchannelLogoutUri&&!e.disabled);return{accessTokenIds:d,refreshTokenIds:f,sessionId:r,targets:(await Promise.all(p.map(async e=>{try{return{client:e,sub:await j2(i,e,t)}}catch(t){return a.warn(`back-channel logout: unable to resolve subject for client ${e.clientId}`,t),null}}))).filter(e=>e!==null)}}catch(e){return a.error(`back-channel logout planning failed`,e),null}}async function bue(e,t){let n=/* @__PURE__ */ new Date,r=await GR(e.context.adapter),i=await Promise.allSettled([t.accessTokenIds.length>0?r.updateMany({model:`oauthAccessToken`,where:[{field:`id`,operator:`in`,value:t.accessTokenIds}],update:{revoked:n}}):Promise.resolve(),t.refreshTokenIds.length>0?r.updateMany({model:`oauthRefreshToken`,where:[{field:`id`,operator:`in`,value:t.refreshTokenIds}],update:{revoked:n}}):Promise.resolve()]);for(let t of i)t.status===`rejected`&&e.context.logger.error(`back-channel logout: token revocation update failed`,t.reason);t.targets.length>0&&await xue(e,t)}async function xue(e,t){let n=e.context.logger,r=c2(e.context)?.options,i=r?.jwt?.issuer??e.context.baseURL,a=Math.floor(Date.now()/1e3),o=a+120,s=r?.jwt?.sign?null:await F0(e,r);await Promise.allSettled(t.targets.map(async({client:c,sub:l})=>{try{let u=AU(32,`a-z`,`A-Z`,`0-9`),d=await vue(e,r,s,{iss:i,aud:c.clientId,sub:l,sid:t.sessionId,iat:a,exp:o,jti:u}),f=await fetch(c.backchannelLogoutUri,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`,Accept:`application/json`},body:new URLSearchParams({logout_token:d}),signal:AbortSignal.timeout(5e3),redirect:`error`});f.status!==200&&f.status!==204&&n.warn(`back-channel logout to client ${c.clientId} returned ${f.status}`)}catch(e){n.warn(`back-channel logout to client ${c.clientId} failed`,e)}}))}function U4(e){return e.replace(/[&<>"']/g,e=>{switch(e){case`&`:return`&amp;`;case`<`:return`&lt;`;case`>`:return`&gt;`;case`"`:return`&quot;`;case`'`:return`&#39;`;default:return e}})}function W4(e){let t=e.request?.headers??e.headers;if(!t||H4(t))return!1;let n=t.get(`accept`)??``;return t.get(`sec-fetch-mode`)===`navigate`||n.includes(`text/html`)||n.includes(`application/xhtml+xml`)}function G4(e,t,n=200){return new Response(`<!doctype html><html><head><meta charset="utf-8"><title>${U4(e)}</title></head><body>${t}</body></html>`,{status:n,headers:{"cache-control":`no-store`,"content-security-policy":`default-src 'none'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'`,"content-type":`text/html; charset=utf-8`,pragma:`no-cache`,"x-content-type-options":`nosniff`}})}function K4(e){return`${e.context.baseURL.replace(/\/$/,``)}/oauth2/end-session/confirm`}function Sue(e){try{return new URL(K4(e)).pathname}catch{return`/oauth2/end-session/confirm`}}function q4(e){return G4(`Confirm logout`,`<main><h1>Confirm logout</h1><p>Do you want to log out of this account?</p><form method="post" data-oidc-logout-confirmation action="${U4(K4(e))}"><button type="submit" name="action" value="confirm">Confirm logout</button></form></main>`)}function J4(e){return G4(`Logged out`,`<main><p data-oidc-logout-state="logged-out">${e?`Logged out. ${U4(e)}`:`Logged out.`}</p></main>`)}function Cue(e,t){return G4(`Logout error`,`<main><h1>Logout error</h1><p data-oidc-logout-state="error">${U4(e)}</p></main>`,t)}function Y4(e,t,n,r){if(W4(e))return Cue(r,t===`BAD_REQUEST`?400:t===`UNAUTHORIZED`?401:500);throw new d(t,{error:n,error_description:r})}function X4(e){return`${e.context.authCookies.sessionToken.name}.oauth_logout_confirmation`}function Z4(e,t){return{...e.context.authCookies.sessionToken.attributes,httpOnly:!0,maxAge:t,path:Sue(e),sameSite:`lax`}}async function Q4(e,t,n={}){let r={...t?{sessionId:t}:{},...n,expiresAt:Date.now()+3e5};await e.setSignedCookie(X4(e),JSON.stringify(r),e.context.secret,Z4(e,300))}async function wue(e){let t=await e.getSignedCookie(X4(e),e.context.secret);if(typeof t!=`string`)return null;try{let e=JSON.parse(t);if(typeof e!=`object`||!e)return null;let n=e;return n.sessionId!==void 0&&(typeof n.sessionId!=`string`||n.sessionId.length===0)||n.clientId!==void 0&&(typeof n.clientId!=`string`||n.clientId.length===0)||n.postLogoutRedirectUri!==void 0&&(typeof n.postLogoutRedirectUri!=`string`||n.postLogoutRedirectUri.length===0)||n.state!==void 0&&typeof n.state!=`string`||n.redirectInvalid!==void 0&&typeof n.redirectInvalid!=`boolean`||n.postLogoutRedirectUri!==void 0&&n.clientId===void 0||typeof n.expiresAt!=`number`||!Number.isFinite(n.expiresAt)?null:{...typeof n.sessionId==`string`?{sessionId:n.sessionId}:{},...typeof n.clientId==`string`?{clientId:n.clientId}:{},...typeof n.postLogoutRedirectUri==`string`?{postLogoutRedirectUri:n.postLogoutRedirectUri}:{},...typeof n.state==`string`?{state:n.state}:{},...typeof n.redirectInvalid==`boolean`?{redirectInvalid:n.redirectInvalid}:{},expiresAt:n.expiresAt}}catch{return null}}function $4(e){e.setCookie(X4(e),``,Z4(e,0))}async function e3(e){let t=await e.getSignedCookie(e.context.authCookies.sessionToken.name,e.context.secret);if(typeof t!=`string`||t.length===0)return null;try{let n=await e.context.internalAdapter.findSession(t);return n?{session:n.session}:null}catch(t){throw e.context.logger.error(`Failed to read the current logout session`,t),new d(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to read the current session`})}}async function Tue(e,t){try{return await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:t}]})}catch(t){throw e.context.logger.error(`Failed to read the hinted logout session`,t),new d(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to read the hinted session`})}}async function t3(e,t){if(typeof t.token!=`string`||t.token.length===0)throw new d(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to complete logout`});try{await e.context.internalAdapter.deleteSession(t.token)}catch(t){throw e.context.logger.error(`Failed to delete the logout session`,t),new d(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to complete logout`})}}async function n3(e,t,n){try{return await m2(e,t,n)}catch(t){throw e.context.logger.error(`Failed to resolve the logout client`,t),new d(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to resolve the logout client`})}}function r3(e){return(Array.isArray(e)?e:[e]).filter(e=>typeof e==`string`)}function Eue(e){if(typeof e.aud==`string`&&e.aud.length>0)return e.aud;if(typeof e.azp==`string`&&e.azp.length>0)return e.azp;let t=r3(e.aud);return t.length===1?t[0]:null}async function Due(e,t,n,r){if(r)return n3(e,t,r);let i;try{i=pV(n)}catch{return null}let a=Eue(i);return a?n3(e,t,a):null}async function Oue(e,t,n,r){try{let i;if(t.disableJwtPlugin){if(!r.clientSecret)return null;let a=await _2(e,t.storeClientSecret,r.clientSecret),{payload:o}=await qB(n,new TextEncoder().encode(a));i=JSON.parse(new TextDecoder().decode(o))}else{let t=c2(e.context).options,{payload:r}=await qB(n,nV(await XK(n,{jwksFetch:t?.jwks?.remoteUrl??`${e.context.baseURL}${t?.jwks?.jwksPath??`/jwks`}`})));i=JSON.parse(new TextDecoder().decode(r))}return i.iss!==_6(e,t)||!r3(i.aud).includes(r.clientId)||typeof i.sid!=`string`||i.sid.length===0||typeof i.sub!=`string`||i.sub.length===0?null:i}catch{return null}}function i3(e,t,n){if(!t)return{invalid:!1};if(!e.postLogoutRedirectUris?.includes(t))return{invalid:!0};if(!n)return{uri:t,invalid:!1};try{let e=new URL(t);return e.searchParams.set(`state`,n),{uri:e.toString(),invalid:!1}}catch{return{invalid:!0}}}function a3(e,t){return t.post_logout_redirect_uri?i3(e,t.post_logout_redirect_uri,t.state).invalid?{redirectInvalid:!0}:{clientId:e.clientId,postLogoutRedirectUri:t.post_logout_redirect_uri,...t.state===void 0?{}:{state:t.state}}:{}}async function kue(e,t,n){if(n.redirectInvalid)return{invalid:!0};if(!n.clientId||!n.postLogoutRedirectUri)return{invalid:!1};let r=await n3(e,t,n.clientId);return!r||r.disabled||!r.enableEndSession?{invalid:!0}:i3(r,n.postLogoutRedirectUri,n.state)}async function o3(e,t,n={}){return t?W4(e)?(await Q4(e,t.session.id,n),q4(e)):Y4(e,`BAD_REQUEST`,`invalid_request`,`User confirmation is required to complete logout`):W4(e)?(await Q4(e,void 0,n),q4(e)):Y4(e,`BAD_REQUEST`,`invalid_request`,`No active session is available for logout`)}async function Aue(e,t){let n=await wue(e),r=await e3(e);if(!n||n.expiresAt<=Date.now())return Y4(e,`BAD_REQUEST`,`invalid_request`,`The logout confirmation is invalid or expired`);let i=await kue(e,t,n);return r?n.sessionId&&n.sessionId!==r.session.id?Y4(e,`BAD_REQUEST`,`invalid_request`,`The logout confirmation is invalid or expired`):(await t3(e,r.session),bH(e),$4(e),i.uri?m6(e,i.uri):W4(e)?J4(i.invalid?`The requested post-logout redirect was not registered.`:void 0):null):($4(e),i.uri?m6(e,i.uri):W4(e)?J4(i.invalid?`The requested post-logout redirect was not registered.`:void 0):Y4(e,`BAD_REQUEST`,`invalid_request`,`No active session is available for logout`))}async function jue(e,t){let n=e.query??{},r=e.body??{},i={...n,...r},a=await e3(e);if(i.id_token_hint===void 0){let n={};if(i.client_id){let r=await n3(e,t,i.client_id);if(!r)return Y4(e,`BAD_REQUEST`,`invalid_client`,`The logout client does not exist`);if(r.disabled)return Y4(e,`BAD_REQUEST`,`invalid_client`,`The logout client is disabled`);if(!r.enableEndSession)return Y4(e,`UNAUTHORIZED`,`invalid_client`,`The client is not allowed to initiate logout`);n=a3(r,i)}return o3(e,a,n)}let o=await Due(e,t,i.id_token_hint,i.client_id);if(!o)return a&&W4(e)?o3(e,a):Y4(e,`BAD_REQUEST`,`invalid_client`,`The logout client does not exist`);if(o.disabled)return Y4(e,`BAD_REQUEST`,`invalid_client`,`The logout client is disabled`);if(!o.enableEndSession)return Y4(e,`UNAUTHORIZED`,`invalid_client`,`The client is not allowed to initiate logout`);let s=await Oue(e,t,i.id_token_hint,o);if(!s)return a&&W4(e)?o3(e,a,i.client_id?a3(o,i):{}):Y4(e,`UNAUTHORIZED`,`invalid_token`,`The id_token_hint is invalid`);let c=s.sid,l=await Tue(e,c),u=a?.session.id===c;if(a&&!u)return o3(e,a,a3(o,i));let d=i3(o,i.post_logout_redirect_uri,i.state),f=l??(u?a?.session:null);return f&&await t3(e,f),u&&bH(e),$4(e),d.uri?m6(e,d.uri):W4(e)?J4(d.invalid?`The requested post-logout redirect was not registered.`:void 0):null}async function Mue(e,t){return Aue(e,t)}function s3(e,t,n){let r=e.context.baseURL,i=!n?.jwt_disabled;return{scopes_supported:n?.scopes_supported,issuer:g6(t?.jwt?.issuer??r),authorization_endpoint:`${r}/oauth2/authorize`,token_endpoint:`${r}/oauth2/token`,jwks_uri:n?.jwt_disabled?void 0:t?.jwks?.remoteUrl??`${r}${t?.jwks?.jwksPath??`/jwks`}`,registration_endpoint:n?.dynamic_client_registration_supported?`${r}/oauth2/register`:void 0,introspection_endpoint:`${r}/oauth2/introspect`,revocation_endpoint:`${r}/oauth2/revoke`,response_types_supported:n?.grant_types_supported&&!n.grant_types_supported.includes(`authorization_code`)?[]:[`code`],response_modes_supported:[`query`],grant_types_supported:n?.grant_types_supported??[`authorization_code`,`client_credentials`,`refresh_token`],token_endpoint_auth_methods_supported:n?.token_endpoint_auth_methods_supported??[...n?.public_client_supported?[`none`]:[],`client_secret_basic`,`client_secret_post`,`private_key_jwt`],token_endpoint_auth_signing_alg_values_supported:[...yG],introspection_endpoint_auth_methods_supported:n?.endpoint_auth_methods_supported??[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],introspection_endpoint_auth_signing_alg_values_supported:[...yG],revocation_endpoint_auth_methods_supported:n?.endpoint_auth_methods_supported??[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],revocation_endpoint_auth_signing_alg_values_supported:[...yG],code_challenge_methods_supported:[`S256`],authorization_response_iss_parameter_supported:!0,dpop_signing_alg_values_supported:n?.dpop_signing_alg_values_supported??[...gK],backchannel_logout_supported:i,backchannel_logout_session_supported:i}}function c3(e,t){let n=t.disableJwtPlugin?void 0:c2(e.context).options,r=t2(t),i=t.allowUnauthenticatedClientRegistration||r.length>0;return{jwtPluginOptions:n,clientDiscoveries:r,authMetadata:s3(e,n,{scopes_supported:t.advertisedMetadata?.scopes_supported??t.scopes,dynamic_client_registration_supported:t.allowDynamicClientRegistration,public_client_supported:i,grant_types_supported:n2(t),token_endpoint_auth_methods_supported:i2(t,{includeNone:i}),endpoint_auth_methods_supported:i2(t),jwt_disabled:t.disableJwtPlugin,dpop_signing_alg_values_supported:t.dpop?.signingAlgorithms})}}function l3(e,t){let{clientDiscoveries:n,authMetadata:r}=c3(e,t);return o2(e,t,`oauth-authorization-server`,{...h2(n),...r})}function u3(e,t){let n=e.context.baseURL,{jwtPluginOptions:r,clientDiscoveries:i,authMetadata:a}=c3(e,t),o={...a,claims_supported:J2(t),claims_parameter_supported:!0,userinfo_endpoint:`${n}/oauth2/userinfo`,subject_types_supported:t.pairwiseSecret?[`public`,`pairwise`]:[`public`],acr_values_supported:[`0`],id_token_signing_alg_values_supported:(()=>{if(t.disableJwtPlugin)return[`HS256`];let e=r?.jwks?.keyPairConfig?.alg??`EdDSA`,n=r?.jwks?.keyPairConfigs?.map(e=>e.alg)??[];return Array.from(/* @__PURE__ */ new Set([e,...n]))})(),end_session_endpoint:`${n}/oauth2/end-session`,request_parameter_supported:!1,request_uri_parameter_supported:!1,prompt_values_supported:[`login`,`consent`,`create`,`select_account`,`none`]};return o2(e,t,`openid-configuration`,{...h2(i),...o})}function d3(e,t){let n=new Headers(t);return n.has(`Cache-Control`)||n.set(`Cache-Control`,`public, max-age=15, stale-while-revalidate=15, stale-if-error=86400`),n.set(`Content-Type`,`application/json`),new Response(JSON.stringify(e),{status:200,headers:n})}function f3(e,t,n){let{redirectOnError:r,onValidationError:i,errorCodesByField:a,defaultError:o=`invalid_request`,...s}=t;if(!r)return Y(e,{...s,onValidationError:async e=>{throw i&&await i(e),new d(`BAD_REQUEST`,{...p3(e.issues,a,o)})}},n);let c=r,{body:l,query:u,...f}=s;async function p(e,t,n){if(!n)return{ok:!0};let r=await n.safeParseAsync(e[t]??{});return r.success?(e[t]=r.data,{ok:!0}):(i&&await i({message:r.error.message,issues:r.error.issues}),{ok:!1,response:c({...p3(r.error.issues,a,o),ctx:e})})}return Y(e,f,async e=>{let t=await p(e,`body`,l);if(!t.ok)return t.response;let r=await p(e,`query`,u);return r.ok?n(e):r.response})}function p3(e,n,r=`invalid_request`){let i=e[0];if(!i)return{error:r,error_description:`Invalid request.`};let a=i.path?.[0],o=typeof a==`string`?a:void 0,s=o?n?.[o]:void 0,c=i.path?.length?t(i.path):``;return{error:Nue(i,s,r),error_description:Fue(i,c)}}function Nue(e,t,n){return typeof t==`string`?t:Pue(e)?t?.missing??n:e.code===`invalid_value`?t?.invalid??n:n}function Pue(e){return e.code===`invalid_type`&&e.message.endsWith(`received undefined`)}function Fue(e,t){if(!t)return e.message;if(e.code===`invalid_type`)return e.message.endsWith(`received undefined`)?`${t} is required`:e.message.endsWith(`received array`)?`${t} must not appear more than once`:`${t} must be a ${e.expected??`valid value`}`;if(e.code===`invalid_value`){let n=e.values;if(Array.isArray(n)&&n.length>0)return`${t} must be one of: ${n.join(`, `)}`}return`${t}: ${e.message}`}const Iue=e=>gL(async t=>{if(!e.allowPublicClientPrelogin)throw new c(`BAD_REQUEST`);let n=t.body.oauth_query;if(!await p2(n,t.context.secret))throw new c(`UNAUTHORIZED`,{error:`invalid_signature`})}),m3={"P-256":`ES256`,"P-384":`ES384`,"P-521":`ES512`},Lue=[`Ed25519`],Rue=[`d`,`p`,`q`,`dp`,`dq`,`qi`,`oth`];function h3(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function g3(e,t){return typeof e[t]==`string`&&e[t].length>0}function _3(e){return typeof e==`string`&&Object.prototype.hasOwnProperty.call(m3,e)}function v3(e){return Lue.some(t=>t===e)}function zue(e){switch(e.kty){case`RSA`:return g3(e,`n`)&&g3(e,`e`);case`EC`:return _3(e.crv)&&g3(e,`x`)&&g3(e,`y`);case`OKP`:return v3(e.crv)&&g3(e,`x`);default:return!1}}function Bue(e){if(e.alg===void 0)return!0;if(typeof e.alg!=`string`||!yG.some(t=>t===e.alg))return!1;switch(e.kty){case`RSA`:return e.alg.startsWith(`RS`)||e.alg.startsWith(`PS`);case`EC`:return _3(e.crv)&&m3[e.crv]===e.alg;case`OKP`:return v3(e.crv)&&e.alg===`EdDSA`;default:return!1}}function y3(e){let t=h3(e)&&Array.isArray(e.keys)?e.keys:void 0;if(!t?.length)return{valid:!1,error:`jwks must be an RFC 7517 JWK Set object with a non-empty keys array`};for(let e of t){if(!h3(e))return{valid:!1,error:`jwks keys must be supported public JWKs with required key parameters`};if(e.kty===`oct`||`k`in e||Rue.some(t=>t in e))return{valid:!1,error:`jwks must contain only public asymmetric keys`};if(!zue(e))return{valid:!1,error:`jwks keys must be supported public JWKs with required key parameters`};if(!Bue(e))return{valid:!1,error:`jwks key alg must be supported for private_key_jwt and compatible with its key type and signing curve`}}return{valid:!0,jwks:{keys:t}}}const Vue=Object.freeze(Object.keys({clientId:!0,clientSecret:!0,clientDiscoveryId:!0,disabled:!0,scopes:!0,clientCredentialsScopes:!0,userId:!0,createdAt:!0,updatedAt:!0,expiresAt:!0,name:!0,uri:!0,icon:!0,contacts:!0,tos:!0,policy:!0,softwareId:!0,softwareVersion:!0,softwareStatement:!0,redirectUris:!0,postLogoutRedirectUris:!0,backchannelLogoutUri:!0,backchannelLogoutSessionRequired:!0,tokenEndpointAuthMethod:!0,grantTypes:!0,responseTypes:!0,applicationType:!0,jwks:!0,jwksUri:!0,requirePKCE:!0,dpopBoundAccessTokens:!0,skipConsent:!0,enableEndSession:!0,subjectType:!0,referenceId:!0,metadata:!0})),Hue=/* @__PURE__ */ `client_id.client_secret.client_secret_expires_at.scope.user_id.client_id_issued_at.client_name.client_uri.logo_uri.contacts.tos_uri.policy_uri.jwks.jwks_uri.software_id.software_version.software_statement.redirect_uris.post_logout_redirect_uris.backchannel_logout_uri.backchannel_logout_session_required.token_endpoint_auth_method.grant_types.response_types.application_type.disabled.skip_consent.enable_end_session.require_pkce.dpop_bound_access_tokens.subject_type.reference_id`.split(`.`),Uue=/* @__PURE__ */ new Set([...Vue,...Hue,`public`,`type`,`resources`,`client_credentials_scopes`]),Wue=/* @__PURE__ */ new Set(/* @__PURE__ */ `disabled.client_secret.client_secret_expires_at.client_id_issued_at.skip_consent.enable_end_session.require_pkce.reference_id.user_id.resources.clientSecret.clientDiscoveryId.skipConsent.enableEndSession.requirePKCE.referenceId.userId.clientId.applicationType.tokenEndpointAuthMethod.redirectUris.postLogoutRedirectUris.grantTypes.responseTypes.scopes.expiresAt.createdAt.updatedAt.softwareId.softwareVersion.softwareStatement.backchannelLogoutUri.backchannelLogoutSessionRequired.jwksUri.dpopBoundAccessTokens.subjectType`.split(`.`));function b3(e){return Wue.has(e)}function x3(e){if(e)return Object.fromEntries(Object.entries(e).filter(([e])=>!Uue.has(e)))}async function S3(e,t,n,r){if(!t)throw new c(`UNAUTHORIZED`);if(!e.headers)throw new c(`BAD_REQUEST`);if(r===`configure-client-credentials-scopes`&&!n.clientPrivileges||n.clientPrivileges&&!await n.clientPrivileges({headers:e.headers,action:r,session:t.session,user:t.user}))throw new c(`UNAUTHORIZED`)}var Gue=/* @__PURE__ */ W0({consumeClientAssertion:()=>M3,isPrivateHostname:()=>k3,verifyClientAssertion:()=>Que});const C3=/* @__PURE__ */ new WeakMap,w3=65536,Kue=/^application\/(?:[-\w.]+\+)?json\s*(?:;|$)/i;function T3(e,t,n,r){if(e.set(t,{jwks:n,fetchedAt:r}),e.size>500){let t=e.keys().next().value;t!==void 0&&e.delete(t)}}function E3(e){let t=C3.get(e);if(t)return t;let n=/* @__PURE__ */ new Map;return C3.set(e,n),n}function D3(e){return`${e.clientDiscoveryId??`managed`}:${e.jwksUri??``}`}const O3=[...yG];function k3(e){return!cU(e)}function que(e,t,n){let r=new URL(t);if(r.protocol!==`https:`)throw new d(`BAD_REQUEST`,{error_description:`jwks_uri must use HTTPS`,error:`invalid_client`});if(r.username||r.password)throw new d(`BAD_REQUEST`,{error_description:`jwks_uri must not contain credentials`,error:`invalid_client`});if(t.includes(`#`))throw new d(`BAD_REQUEST`,{error_description:`jwks_uri must not include a fragment component`,error:`invalid_client`});if(k3(r.hostname))throw new d(`BAD_REQUEST`,{error_description:`jwks_uri must not point to a private or reserved address`,error:`invalid_client`});if(!(n&&r.origin===n)&&!e.context.isTrustedOrigin(r.href))throw new d(`BAD_REQUEST`,{error_description:`client jwks_uri is not trusted`,error:`invalid_client`})}function Jue(e){try{let t=new URL(e);return t.protocol!==`https:`&&t.protocol!==`http:`?void 0:t.origin}catch{return}}async function Yue(e){let t=e.headers.get(`content-length`);if(t!==null&&Number.isFinite(Number(t))&&Number(t)>w3)throw await e.body?.cancel(),Error(`JWKS response exceeds 64 KiB`);if(!e.body)return``;let n=e.body.getReader(),r=[],i=0;for(;;){let{done:e,value:t}=await n.read();if(e)break;if(i+=t.byteLength,i>w3)throw await n.cancel(),Error(`JWKS response exceeds 64 KiB`);r.push(t)}let a=new Uint8Array(i),o=0;for(let e of r)a.set(e,o),o+=e.byteLength;return new TextDecoder().decode(a)}async function A3(e,t=globalThis.fetch){let n=new AbortController,r=setTimeout(()=>n.abort(),5e3);try{let r=await t(e,{signal:n.signal,headers:{accept:`application/json`},redirect:`error`});if(r.redirected)throw Error(`JWKS fetch redirected`);if(r.status!==200)throw Error(`JWKS fetch returned ${r.status}`);let i=r.headers.get(`content-type`);if(!i||!Kue.test(i))throw Error(`JWKS response must use a JSON media type`);let a=await Yue(r),o;try{o=JSON.parse(a)}catch{return{valid:!1}}let s=y3(o);return s.valid?{valid:!0,jwks:s.jwks}:{valid:!1}}finally{clearTimeout(r)}}function j3(){return new d(`BAD_REQUEST`,{error_description:`failed to fetch client JWKS`,error:`invalid_client`})}async function Xue(e,t,n){if(n.jwks)return JSON.parse(n.jwks);if(!n.jwksUri)throw new d(`BAD_REQUEST`,{error_description:`client has no JWKS configured`,error:`invalid_client`});let r=n.clientDiscoveryId?t2(t).find(e=>e.id===n.clientDiscoveryId):void 0;if(n.clientDiscoveryId&&!r?.fetchClientMetadataResource)throw new d(`BAD_REQUEST`,{error_description:`client discovery does not provide a metadata resource transport`,error:`invalid_client`});que(e,n.jwksUri,n.clientDiscoveryId?Jue(n.clientId):void 0);let i=Date.now(),a=D3(n),o=E3(t),s=o.get(a);if(s&&i-s.fetchedAt<3e5)return s.jwks;let c;try{c=await A3(n.jwksUri,r?.fetchClientMetadataResource)}catch{if(s&&i-s.fetchedAt<6e5)return s.jwks;throw j3()}if(!c.valid)throw j3();return T3(o,a,c.jwks,i),c.jwks}async function Zue(e,t){if(!t.jwksUri)return null;let n=t.clientDiscoveryId?t2(e).find(e=>e.id===t.clientDiscoveryId):void 0;if(t.clientDiscoveryId&&!n?.fetchClientMetadataResource)return null;try{let r=await A3(t.jwksUri,n?.fetchClientMetadataResource);return r.valid?(T3(E3(e),D3(t),r.jwks,Date.now()),r.jwks):null}catch{return null}}async function M3(e,t,n){let{namespace:r,payload:i,expectedAudience:a}=n;if(!(Array.isArray(i.aud)?i.aud:i.aud==null?[]:[i.aud]).includes(a))throw new d(`BAD_REQUEST`,{error_description:`client assertion aud does not match the endpoint`,error:`invalid_client`});let o=t.assertionMaxLifetime??300,s=Math.floor(Date.now()/1e3);if(typeof i.exp!=`number`)throw new d(`BAD_REQUEST`,{error_description:`client assertion must include exp claim`,error:`invalid_client`});if(i.exp<=s)throw new d(`BAD_REQUEST`,{error_description:`client assertion has expired`,error:`invalid_client`});if(i.exp-s>o)throw new d(`BAD_REQUEST`,{error_description:`client assertion exp is too far in the future (max ${o}s)`,error:`invalid_client`});if(typeof i.iat==`number`&&s-i.iat>o)throw new d(`BAD_REQUEST`,{error_description:`client assertion iat is too far in the past (max ${o}s)`,error:`invalid_client`});if(typeof i.jti!=`string`||i.jti.length===0)throw new d(`BAD_REQUEST`,{error_description:`client assertion must include jti claim`,error:`invalid_client`});let c=await PH(`SHA-256`).digest(new TextEncoder().encode(`${r}:${i.jti}`)),l=oH.encode(new Uint8Array(c).slice(0,24),{padding:!1});try{await e.context.adapter.create({model:`oauthClientAssertion`,data:{id:l,expiresAt:/* @__PURE__ */ new Date(i.exp*1e3)},forceAllowId:!0})}catch(t){let n=!1;try{n=!!await e.context.adapter.findOne({model:`oauthClientAssertion`,where:[{field:`id`,value:l}]})}catch{}throw n?new d(`BAD_REQUEST`,{error_description:`client assertion jti has already been used`,error:`invalid_client`}):t}}async function Que(e,t,n,r,i,a){if(r!==`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)throw new d(`BAD_REQUEST`,{error_description:`unsupported client_assertion_type`,error:`invalid_client`});let o;try{o=fV(n)}catch{throw new d(`BAD_REQUEST`,{error_description:`malformed client assertion: invalid JWT header`,error:`invalid_client`})}if(!o.alg||!O3.includes(o.alg))throw new d(`BAD_REQUEST`,{error_description:`unsupported assertion signing algorithm: ${o.alg}`,error:`invalid_client`});let s;try{s=pV(n)}catch{throw new d(`BAD_REQUEST`,{error_description:`malformed client assertion: invalid JWT payload`,error:`invalid_client`})}let c=s.sub??s.iss;if(!c)throw new d(`BAD_REQUEST`,{error_description:`client assertion must contain sub or iss claim identifying the client`,error:`invalid_client`});if(i&&i!==c)throw new d(`BAD_REQUEST`,{error_description:`client_id in body does not match assertion sub/iss`,error:`invalid_client`});let l=await m2(e,t,c);if(!l)throw new d(`BAD_REQUEST`,{error_description:`unknown client`,error:`invalid_client`});if(l.disabled)throw new d(`BAD_REQUEST`,{error_description:`client is disabled`,error:`invalid_client`});if(l.tokenEndpointAuthMethod!==`private_key_jwt`)throw new d(`BAD_REQUEST`,{error_description:`client is not registered for private_key_jwt authentication`,error:`invalid_client`});let u=await Xue(e,t,l),f=a??`${e.context.baseURL}/oauth2/token`,p=_6(e,t),m=[.../* @__PURE__ */ new Set([f,p])],h={issuer:c,subject:c,audience:m,algorithms:O3},g;try{({payload:g}=await JB(n,nV(u),h))}catch(e){if(e instanceof Error&&/no matching key|no applicable key/i.test(e.message)){let e=await Zue(t,l);if(e)try{({payload:g}=await JB(n,nV(e),h))}catch{throw new d(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}else throw new d(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}else throw new d(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}let _=(Array.isArray(g.aud)?g.aud:[g.aud]).find(e=>typeof e==`string`&&m.includes(e));return await M3(e,t,{namespace:`private_key_jwt:${c}`,payload:g,expectedAudience:_}),{clientId:c}}function N3(e,t,n){return new d(e,{error:t,error_description:n},{"WWW-Authenticate":`Bearer error="${t}"`,...pL})}async function $ue(e,t,n){let r=e.headers,i;try{i=Rce(r?.get(`authorization`))}catch{throw N3(`BAD_REQUEST`,`invalid_request`,`Malformed initial access token Authorization header`)}if(!i||!r)return;if(!t.validateInitialAccessToken)throw N3(`UNAUTHORIZED`,`invalid_token`,`Invalid initial access token`);let a;try{a=await t.validateInitialAccessToken({initialAccessToken:i,headers:r,clientMetadata:n})}catch(e){throw e instanceof d?e:new d(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Initial access token validation failed`})}if(!a)throw N3(`UNAUTHORIZED`,`invalid_token`,`Invalid initial access token`);return a}const ede=[`authorization_code`];function P3(e){return[.../* @__PURE__ */ new Set([...e.clientRegistrationDefaultScopes??e.scopes??[],...e.clientRegistrationAllowedScopes??[]])]}function F3(e){let t=e.grant_types??[...ede];if(t.length>0)return t;throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`grant_types must contain at least one grant type`})}function tde(e,t){return e.response_types?e.response_types:t.includes(`authorization_code`)?[`code`]:void 0}function I3(e,t=`web`){let n=F3(e);return{...e,token_endpoint_auth_method:e.token_endpoint_auth_method??`client_secret_basic`,application_type:e.application_type??(t===null?void 0:t),grant_types:n,response_types:tde(e,n)}}const nde=/* @__PURE__ */ new Set([`file:`,`ftp:`,`mailto:`,`javascript:`,`data:`,`vbscript:`]);function L3(e){throw new c(`BAD_REQUEST`,{error:`invalid_redirect_uri`,error_description:e})}function rde(e){let t=/^http:\/\/([^/?#]*)/i.exec(e)?.[1];if(!t)return null;let n=t.slice(t.lastIndexOf(`@`)+1);if(n.startsWith(`[`)){let e=n.indexOf(`]`);return e<0?null:n.slice(0,e+1).toLowerCase()}return(n.split(`:`)[0]??``).toLowerCase()}async function ide(e,t,n){let r=t.clientRegistrationDefaultResources??[],i=/* @__PURE__ */ new Set([...r,...t.clientRegistrationAllowedResources??[]]);for(let e of n)if(!i.has(e))throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${e} is not allowed for client registration`});let a=[.../* @__PURE__ */ new Set([...r,...n])];for(let n of a){let r=await r4(e,t,n);if(!r)throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} does not exist`});if(r.disabled)throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is disabled`})}return a}function ade(e,t){let n;try{n=new URL(e)}catch{L3(`redirect URI must be an absolute URI: ${e}`)}(e.includes(`#`)||n.username.length>0||n.password.length>0)&&L3(`redirect URI must not include credentials or a fragment: ${e}`);let r=n.protocol===`http:`,i=n.protocol===`https:`;/^localhost\.+$/i.test(n.hostname)&&L3(`redirect URI localhost must not include trailing dots: ${e}`);let a=oU(n.hostname)||n.hostname===`localhost`,o=rde(e),s=o===`localhost`||o===`127.0.0.1`||o===`[::1]`;if(t===`web`){(!i||a)&&L3(`web clients require https redirect URIs on non-loopback hosts: ${e}`);return}if(i){a&&L3(`native clients must not use https loopback redirect URIs: ${e}`);return}if(r){s||L3(`native clients may use http only on the exact loopback hosts localhost, 127.0.0.1, or [::1]: ${e}`);return}(nde.has(n.protocol)||!L2(n))&&L3(`native private-use redirect URI schemes must be well-formed reverse-domain names, omit the naming authority, and must not use a reserved scheme: ${e}`)}function ode(e){let t=y3(e);if(!t.valid)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:t.error})}async function sde(e,t){let n=e.body;if(!t.allowDynamicClientRegistration)throw new c(`FORBIDDEN`,{error:`access_denied`,error_description:`Client registration is disabled`});let r=await CH(e),i=r?void 0:await $ue(e,t,n),a=!!i;if(!(r||a||t.allowUnauthenticatedClientRegistration))throw new c(`UNAUTHORIZED`,{error_description:`Authentication required for client registration`},{"WWW-Authenticate":`Bearer`,...pL});if(!r&&!a&&n.grant_types?.includes(`client_credentials`))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`client_credentials grant requires authenticated registration`});let o=Array.isArray(n.resources)?n.resources.filter(e=>typeof e==`string`&&e.length>0):[];r&&await S3(e,r,t,`create`);let s=i?.referenceId??(r&&t.clientReference?await t.clientReference({user:r.user,session:r.session}):void 0),l=await U3(e,t,{metadata:n,registrationSource:`dynamic`,userId:s?void 0:r?.session.userId,referenceId:s,requestedResources:o});return e.setStatus(201),e.json(l)}async function R3(e,t,n){let r=n?.registrationSource===`clientMetadataDocument`,i=I3(e,r?null:`web`),a=i.token_endpoint_auth_method??`client_secret_basic`;if(!new Set(i2(t,{includeNone:!0})).has(a))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`unsupported token_endpoint_auth_method ${a}`});if(i.dpop_bound_access_tokens!==void 0&&typeof i.dpop_bound_access_tokens!=`boolean`)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`dpop_bound_access_tokens must be a boolean`});let o=i.grant_types??[],s=i.response_types,l=i.application_type;if(l!==void 0&&l!==`web`&&l!==`native`)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`application_type must be web or native`});if(o.includes(`authorization_code`)&&(!i.redirect_uris||i.redirect_uris.length===0))throw new c(`BAD_REQUEST`,{error:`invalid_redirect_uri`,error_description:`Redirect URIs are required for authorization_code and implicit grant types`});for(let e of i.redirect_uris??[])ade(e,l??(r?`native`:`web`));let u=new Set(n2(t));if(r){if(!o.some(e=>u.has(e)))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`no mutually supported grant_type among ${o.join(`, `)}`})}else for(let e of o)if(!u.has(e))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`unsupported grant_type ${e}`});if(o.includes(`authorization_code`)&&!s?.includes(`code`))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`When 'authorization_code' grant type is used, 'code' response type must be included`});if(!o.includes(`authorization_code`)&&s?.includes(`code`))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`When 'code' response type is used, 'authorization_code' grant type must be included`});if(i.subject_type!==void 0){if(i.subject_type!==`public`&&i.subject_type!==`pairwise`)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`subject_type must be "public" or "pairwise"`});if(i.subject_type===`pairwise`&&!t.pairwiseSecret)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise subject_type requires server pairwiseSecret configuration`});if(i.subject_type===`pairwise`&&i.redirect_uris&&i.redirect_uris.length>1&&new Set(i.redirect_uris.map(e=>new URL(e).host)).size>1)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise clients with redirect_uris on different hosts require a sector_identifier_uri, which is not yet supported. All redirect_uris must share the same host.`})}let d=(i?.scope)?.split(` `).filter(e=>e.length),f=n?.registrationSource===`dynamic`||n?.registrationSource===`clientMetadataDocument`,p=f?P3(t):t.scopes;if(p){let e=new Set(p);for(let t of d??[])if(!e?.has(t))throw new c(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`cannot request scope ${t}`})}if(f&&i.require_pkce===!1)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pkce is required for registered clients.`});if(i.jwks||i.jwks_uri){if(i.jwks&&i.jwks_uri)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks and jwks_uri are mutually exclusive`});if(i.jwks_uri)try{let e=new URL(i.jwks_uri);if(e.protocol!==`https:`)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must use HTTPS`});if(e.username||e.password)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not contain credentials`});if(i.jwks_uri.includes(`#`))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not include a fragment component`});if(k3(e.hostname))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not point to a private or reserved address`});if(n?.ctx&&!n.ctx.context.isTrustedOrigin(e.href)){let t=typeof i.client_id==`string`?i.client_id:void 0;if(!(r&&t!==void 0&&URL.canParse(t)&&new URL(t).origin===e.origin))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must belong to a trusted origin or the Client ID Metadata Document origin`})}}catch(e){throw e instanceof c?e:new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must be a valid URL`})}i.jwks&&ode(i.jwks)}if(a===`private_key_jwt`&&!i.jwks&&!i.jwks_uri)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`private_key_jwt requires either jwks or jwks_uri`});if(i.backchannel_logout_uri!==void 0){if(t.disableJwtPlugin)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri requires the jwt plugin (disableJwtPlugin must be false)`});let e;try{e=new URL(i.backchannel_logout_uri)}catch{throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must be an absolute URL`})}if(i.backchannel_logout_uri.includes(`#`))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not include a fragment component`});if(e.protocol!==`https:`)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must use https`});if(e.username||e.password)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not contain credentials`});if(k3(e.hostname))throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not point to a private or reserved address`})}}const z3=Symbol(`client-registration-collision`);function B3(e){if(!e||typeof e!=`object`)return!1;let t=e;return t[z3]===!0&&(t.kind===`oauth-client-row-unique`||t.kind===`oauth-client-resource-link-unique`)&&`cause`in t}async function V3(e,t,n){let r=I3(n.registrationSource===`dynamic`&&!n.metadata.scope?{...n.metadata,scope:(t.clientRegistrationDefaultScopes??t.scopes)?.join(` `)}:n.metadata,n.registrationSource===`clientMetadataDocument`?null:`web`),i=r.token_endpoint_auth_method===`none`,a=r.token_endpoint_auth_method===`private_key_jwt`,o=a2(t,r.token_endpoint_auth_method);await R3(r,t,{registrationSource:n.registrationSource,ctx:e});let s=n.clientId??t.generateClientId?.()??AU(32,`a-z`,`A-Z`),l=i||a||o?void 0:t.generateClientSecret?.()||AU(32,`a-z`,`A-Z`),u=l?await v2(e,t,l):void 0,d=n.registrationSource===`dynamic`&&!i&&t.clientRegistrationRequirePKCE===!1,f=r.require_pkce??(!d&&void 0),p=Math.floor(Date.now()/1e3),{resources:m,...h}=n.registrationSource===`dynamic`||n.registrationSource===`clientMetadataDocument`?{...r,scope:P3(t).join(` `)}:r,g=n.registrationSource===`clientMetadataDocument`?void 0:{userId:n.userId,referenceId:n.referenceId},_=q3({...h,redirect_uris:r.redirect_uris??[],disabled:void 0,client_secret_expires_at:u?n.registrationSource===`dynamic`&&t.clientRegistrationClientSecretExpiration?M0(t.clientRegistrationClientSecretExpiration,p):0:void 0,client_id:s,client_secret:u,client_id_issued_at:p,require_pkce:f,user_id:g?.referenceId?void 0:g?.userId,reference_id:g?.referenceId});_.clientCredentialsScopes=n.registrationSource===`clientMetadataDocument`?n.existingClient?.clientCredentialsScopes??[]:n.registrationSource===`managed`?n.clientCredentialsScopes??[]:[],_.clientDiscoveryId=n.registrationSource===`clientMetadataDocument`?n.clientDiscoveryId:null,n.registrationSource===`clientMetadataDocument`&&r.application_type===void 0&&(_.applicationType=null);let v=await ide(e,t,n.registrationSource===`dynamic`?n.requestedResources??[]:[]),y=t.schema?.oauthClient?.modelName??`oauthClient`,b=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,x=n.registrationSource===`clientMetadataDocument`?n.existingClient:void 0,S=n.registrationSource===`clientMetadataDocument`?n.clientDiscoveryId:null,C=await qR(e.context.adapter,async()=>{let t=await GR(e.context.adapter),r,i=!1;if(x){let e=await t.update({model:y,where:[{field:`clientId`,value:s},{field:`clientDiscoveryId`,value:S}],update:{..._,disabled:x.disabled,skipConsent:x.skipConsent,enableEndSession:x.enableEndSession,createdAt:x.createdAt,updatedAt:/* @__PURE__ */ new Date(p*1e3)}});if(!e)throw new c(`BAD_REQUEST`,{error:`invalid_client`,error_description:`client no longer exists`});r=e}else{try{r=await t.create({model:y,data:{..._,createdAt:/* @__PURE__ */ new Date(p*1e3),updatedAt:/* @__PURE__ */ new Date(p*1e3)}})}catch(e){throw n.registrationSource===`clientMetadataDocument`&&G3(e)?{[z3]:!0,kind:`oauth-client-row-unique`,clientId:s,cause:e}:e}i=!0}let a=v.length===0?[]:await t.findMany({model:b,where:[{field:`clientId`,value:s}]}),o=new Set(a.map(e=>e.resourceId)),l=/* @__PURE__ */ new Date;for(let e of v)if(!o.has(e))try{await t.create({model:b,data:{clientId:s,resourceId:e,createdAt:l}})}catch(t){throw n.registrationSource===`clientMetadataDocument`&&G3(t)?{[z3]:!0,kind:`oauth-client-resource-link-unique`,clientId:s,resourceId:e,cause:t}:t}return{client:r,created:i}});return{client:C.client,clientSecret:l,resources:v,created:C.created}}function H3(e,t){let n=J3({...e.client,clientSecret:e.clientSecret?(t.prefix?.clientSecret??``)+e.clientSecret:void 0});return e.resources.length>0&&(n.resources=e.resources),n}function cde(e,t){return{...H3(e,t),client_credentials_scopes:[...e.client.clientCredentialsScopes??[]]}}async function U3(e,t,n){return H3(await V3(e,t,n),t)}async function lde(e,t,n){return cde(await V3(e,t,n),t)}function ude(e,t){if(e&&e.clientDiscoveryId!==t)throw new c(`BAD_REQUEST`,{error:`invalid_client`,error_description:`client_id is already owned by a different registration source`})}async function W3(e,t,n){if(ude(n.existingClient,n.clientDiscoveryId),n.metadata.backchannel_logout_uri!==void 0||n.metadata.backchannel_logout_session_required!==void 0)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`Client ID Metadata Documents cannot register a back-channel logout target`});if((n.metadata.token_endpoint_auth_method??`none`)!==`none`&&n.metadata.token_endpoint_auth_method!==`private_key_jwt`)throw new c(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`Client ID Metadata Document clients cannot use a shared secret`});let r={...n,metadata:{...n.metadata,token_endpoint_auth_method:n.metadata.token_endpoint_auth_method??`none`,client_secret:void 0,client_secret_expires_at:void 0},registrationSource:`clientMetadataDocument`};try{return await V3(e,t,r)}catch(i){if(!B3(i))throw i;let a=t.schema?.oauthClient?.modelName??`oauthClient`,o=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,s=await e.context.adapter.findOne({model:a,where:[{field:`clientId`,value:n.clientId}]});if(i.clientId!==n.clientId||!s||s.clientDiscoveryId!==n.clientDiscoveryId||i.kind===`oauth-client-resource-link-unique`&&!await e.context.adapter.findOne({model:o,where:[{field:`clientId`,value:i.clientId},{field:`resourceId`,value:i.resourceId}]}))throw i.cause;try{return await V3(e,t,{...r,existingClient:s})}catch(e){throw B3(e)?e.cause:e}}}function G3(e){if(!e||typeof e!=`object`)return!1;let t=e,n=String(t.code??t.errno??``);return[`1062`,`11000`,`23505`,`ER_DUP_ENTRY`,`P2002`,`SQLITE_CONSTRAINT_UNIQUE`].includes(n)||t.name===`MongoServerError`&&t.code===11e3?!0:typeof t.message==`string`&&/(?:duplicate|unique constraint|unique key)/i.test(t.message)}async function K3(e,t,n){let r=await CH(e);if(await S3(e,r,t,`create`),!r)throw new c(`UNAUTHORIZED`);let i=t.clientReference?await t.clientReference({user:r.user,session:r.session}):void 0,{client_credentials_scopes:a,...o}=e.body,s=n?.admin?d4(a??[]):[];f4(s,F3(o),o.token_endpoint_auth_method,t),s.length>0&&await S3(e,r,t,`configure-client-credentials-scopes`);let l={metadata:o,registrationSource:`managed`,userId:i?void 0:r.session.userId,referenceId:i,clientCredentialsScopes:s},u=n?.admin?await lde(e,t,l):await U3(e,t,l);return e.setStatus(201),e.json(u)}function q3(e){let{client_id:t,client_secret:n,client_secret_expires_at:r,scope:i,user_id:a,client_id_issued_at:o,client_name:s,client_uri:c,logo_uri:l,contacts:u,tos_uri:d,policy_uri:f,jwks:p,jwks_uri:m,software_id:h,software_version:g,software_statement:_,redirect_uris:v,post_logout_redirect_uris:y,backchannel_logout_uri:b,backchannel_logout_session_required:x,token_endpoint_auth_method:S,grant_types:C,response_types:w,application_type:T,disabled:ee,skip_consent:te,enable_end_session:E,require_pkce:ne,dpop_bound_access_tokens:re,subject_type:ie,reference_id:ae,metadata:oe}=e,D=r?/* @__PURE__ */ new Date(Number(r)*1e3):void 0,se=o?/* @__PURE__ */ new Date(o*1e3):void 0,ce=i?.split(` `),le=x3(oe??{}),ue=le&&Object.keys(le).length?JSON.stringify(le):void 0;return{clientId:t,clientSecret:n,disabled:ee,scopes:ce,userId:a,createdAt:se,expiresAt:D,name:s,uri:c,icon:l,contacts:u,tos:d,policy:f,softwareId:h,softwareVersion:g,softwareStatement:_,redirectUris:v,postLogoutRedirectUris:y,backchannelLogoutUri:b,backchannelLogoutSessionRequired:x,tokenEndpointAuthMethod:S,grantTypes:C,responseTypes:w,jwks:p?JSON.stringify(p):void 0,jwksUri:m,applicationType:T,skipConsent:te,enableEndSession:E,requirePKCE:ne,dpopBoundAccessTokens:re,subjectType:ie,referenceId:ae,metadata:ue}}function J3(e){let{clientId:t,clientSecret:n,disabled:r,scopes:i,userId:a,createdAt:o,updatedAt:s,expiresAt:c,name:l,uri:u,icon:d,contacts:f,tos:p,policy:m,softwareId:h,softwareVersion:g,softwareStatement:_,redirectUris:v,postLogoutRedirectUris:y,backchannelLogoutUri:b,backchannelLogoutSessionRequired:x,tokenEndpointAuthMethod:S,grantTypes:C,responseTypes:w,applicationType:T,jwks:ee,jwksUri:te,skipConsent:E,enableEndSession:ne,requirePKCE:re,dpopBoundAccessTokens:ie,subjectType:ae,referenceId:oe,metadata:D}=e,se=c?Math.round(new Date(c).getTime()/1e3):void 0,ce=o?Math.round(new Date(o).getTime()/1e3):void 0,le=i?.join(` `);return{...x3(D2(D)),client_id:t,client_secret:n??void 0,client_secret_expires_at:n?se??0:void 0,scope:le??void 0,user_id:a??void 0,client_id_issued_at:ce??void 0,client_name:l??void 0,client_uri:u??void 0,logo_uri:d??void 0,contacts:f??void 0,tos_uri:p??void 0,policy_uri:m??void 0,jwks:ee?JSON.parse(ee):void 0,jwks_uri:te??void 0,software_id:h??void 0,software_version:g??void 0,software_statement:_??void 0,redirect_uris:v??[],post_logout_redirect_uris:y??void 0,backchannel_logout_uri:b??void 0,backchannel_logout_session_required:x??void 0,token_endpoint_auth_method:S??void 0,grant_types:C??void 0,response_types:w??void 0,application_type:T??void 0,disabled:r??void 0,skip_consent:E??void 0,enable_end_session:ne??void 0,require_pkce:re??void 0,dpop_bound_access_tokens:ie??void 0,subject_type:ae??void 0,reference_id:oe??void 0}}async function dde(e,t){let n=await CH(e);if(await S3(e,n,t,`read`),!n)throw new c(`UNAUTHORIZED`);let r=await m2(e,t,e.query.client_id);if(!r)throw new c(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(r.userId){if(r.userId!==n.user.id)throw new c(`UNAUTHORIZED`)}else if(r.referenceId&&t.clientReference){if(r.referenceId!==await t.clientReference(n))throw new c(`UNAUTHORIZED`)}else throw new c(`UNAUTHORIZED`);let i=J3(r);return i.client_secret=void 0,i}async function Y3(e,t,n){let r=await m2(e,t,n);if(!r||r.disabled)throw new c(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});return J3({clientId:r.clientId,name:r.name,uri:r.uri,contacts:r.contacts,icon:r.icon,tos:r.tos,policy:r.policy})}async function fde(e,t){let n=await CH(e);if(await S3(e,n,t,`list`),!n)throw new c(`UNAUTHORIZED`);let r=await t.clientReference?.(n);if(r)return await e.context.adapter.findMany({model:`oauthClient`,where:[{field:`referenceId`,value:r}]}).then(e=>e?e.map(e=>{let t=J3(e);return t.client_secret=void 0,t}):null);if(n.user.id)return await e.context.adapter.findMany({model:`oauthClient`,where:[{field:`userId`,value:n.user.id}]}).then(e=>e?e.map(e=>{let t=J3(e);return t.client_secret=void 0,t}):null);throw new c(`BAD_REQUEST`,{message:`either user_id or reference_id must be provided`})}async function pde(e,t){let n=await CH(e);if(await S3(e,n,t,`delete`),!n)throw new c(`UNAUTHORIZED`);let r=e.body.client_id;if(t.cachedTrustedClients?.has(r))throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`trusted clients must be updated manually`,error:`invalid_client`});let i=await m2(e,t,r);if(!i)throw new c(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(i.userId){if(i.userId!==n.user.id)throw new c(`UNAUTHORIZED`)}else if(i.referenceId&&t.clientReference){if(i.referenceId!==await t.clientReference(n))throw new c(`UNAUTHORIZED`)}else throw new c(`UNAUTHORIZED`);await e.context.adapter.delete({model:`oauthClient`,where:[{field:`clientId`,value:r}]})}async function X3(e,t,n){let r=await CH(e);if(await S3(e,r,t,`update`),!r)throw new c(`UNAUTHORIZED`);let i=e.body.client_id;if(t.cachedTrustedClients?.has(i))throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`trusted clients must be updated manually`,error:`invalid_client`});let a=await m2(e,t,i);if(!a)throw new c(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});let{client_credentials_scopes:o,...s}=e.body.update,l=a.userId?a.userId===r.user.id:a.referenceId&&t.clientReference?a.referenceId===await t.clientReference(r):!1,u=!l&&n?.admin&&o!==void 0&&Object.keys(s).length===0;if(!l&&!u)throw new c(`UNAUTHORIZED`);if(u&&await S3(e,r,t,`configure-client-credentials-scopes`),Object.keys(s).length===0&&o===void 0){let e=J3(a);return e.client_secret=void 0,n?.admin?{...e,client_credentials_scopes:[...a.clientCredentialsScopes??[]]}:e}let d=s.grant_types??a.grantTypes??[],f=s.token_endpoint_auth_method??a.tokenEndpointAuthMethod,p=o===void 0?void 0:d4(o);p!==void 0&&(f4(p,d,f,t),p.length>0&&!u&&await S3(e,r,t,`configure-client-credentials-scopes`)),await R3({...J3(a),...s},t,{ctx:e});let m={...q3(s)};!d.includes(`client_credentials`)||f===`none`?m.clientCredentialsScopes=[]:p!==void 0&&(m.clientCredentialsScopes=p),s.token_endpoint_auth_method&&(s.token_endpoint_auth_method===`private_key_jwt`?m.clientSecret=null:(m.jwks=null,m.jwksUri=null,m.clientSecret||=await v2(e,t,t.generateClientSecret?.()||AU(32,`a-z`,`A-Z`))));let h=await e.context.adapter.update({model:`oauthClient`,where:[{field:`clientId`,value:i}],update:{...m,updatedAt:/* @__PURE__ */ new Date(Math.floor(Date.now()/1e3)*1e3)}});if(!h)throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`unable to update client`,error:`invalid_client`});let g=J3(h);return g.client_secret=void 0,n?.admin?{...g,client_credentials_scopes:[...h.clientCredentialsScopes??[]]}:g}async function mde(e,t){let n=await CH(e);if(await S3(e,n,t,`rotate`),!n)throw new c(`UNAUTHORIZED`);let r=e.body.client_id;if(t.cachedTrustedClients?.has(r))throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`trusted clients must be updated manually`,error:`invalid_client`});let i=await m2(e,t,r);if(!i)throw new c(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(i.userId){if(i.userId!==n.user.id)throw new c(`UNAUTHORIZED`)}else if(i.referenceId&&t.clientReference){if(i.referenceId!==await t.clientReference(n))throw new c(`UNAUTHORIZED`)}else throw new c(`UNAUTHORIZED`);if(i.tokenEndpointAuthMethod===`none`||!i.clientSecret)throw new c(`BAD_REQUEST`,{error_description:`secret rotation is only available for clients using client_secret authentication`,error:`invalid_client`});let a=t.generateClientSecret?.()||AU(32,`a-z`,`A-Z`),o=a?await v2(e,t,a):void 0,s=await e.context.adapter.update({model:`oauthClient`,where:[{field:`clientId`,value:r}],update:{clientSecret:o,updatedAt:/* @__PURE__ */ new Date(Math.floor(Date.now()/1e3)*1e3)}});if(!s)throw new c(`INTERNAL_SERVER_ERROR`,{error_description:`unable to update client`,error:`invalid_client`});return J3({...s,clientSecret:(t.prefix?.clientSecret??``)+a})}const Z3=f().trim().min(1),Q3=_(f().trim().min(1)).min(1),hde=e=>Y(`/admin/oauth2/create-client`,{method:`POST`,body:D({redirect_uris:_(R2).min(1).optional(),scope:f().optional(),client_name:f().optional(),client_uri:f().optional(),logo_uri:f().optional(),contacts:_(f().min(1)).min(1).optional(),tos_uri:f().optional(),policy_uri:f().optional(),software_id:f().optional(),software_version:f().optional(),software_statement:f().optional(),post_logout_redirect_uris:_(R2).min(1).optional(),backchannel_logout_uri:R2.optional(),backchannel_logout_session_required:T().optional(),token_endpoint_auth_method:Z3.optional(),application_type:E([`web`,`native`]).optional(),jwks:m4.optional(),jwks_uri:f().optional(),grant_types:Q3.optional(),client_credentials_scopes:_(f().trim().min(1)).optional(),response_types:_(E([`code`])).optional(),client_secret_expires_at:n([f(),m()]).optional().default(0),skip_consent:T().optional(),enable_end_session:T().optional(),require_pkce:T().optional(),dpop_bound_access_tokens:T().optional(),subject_type:E([`public`,`pairwise`]).optional(),metadata:g(f(),se()).optional()}),metadata:{noStore:!0,SERVER_ONLY:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},client_credentials_scopes:{type:`array`,items:{type:`string`},description:`Server-authorized scope ceiling for client_credentials tokens`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`URI of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URI for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final server-owned resources linked to the client`},disabled:{type:`boolean`,description:`Whether the client is disabled`},require_pkce:{type:`boolean`,description:`Whether the client requires PKCE`,default:!0},metadata:{type:`object`,additionalProperties:!0,nullable:!0,description:`Additional metadata for the application`}},required:[`client_id`]}}}}}}}},async t=>K3(t,e,{admin:!0})),gde=e=>Y(`/oauth2/create-client`,{method:`POST`,use:[TH],body:D({redirect_uris:_(R2).min(1).optional(),scope:f().optional(),client_name:f().optional(),client_uri:f().optional(),logo_uri:f().optional(),contacts:_(f().min(1)).min(1).optional(),tos_uri:f().optional(),policy_uri:f().optional(),software_id:f().optional(),software_version:f().optional(),software_statement:f().optional(),post_logout_redirect_uris:_(R2).min(1).optional(),backchannel_logout_uri:R2.optional(),backchannel_logout_session_required:T().optional(),token_endpoint_auth_method:Z3.optional(),application_type:E([`web`,`native`]).optional(),jwks:m4.optional(),jwks_uri:f().optional(),grant_types:Q3.optional(),response_types:_(E([`code`])).optional(),dpop_bound_access_tokens:T().optional()}),metadata:{noStore:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`URI of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URI for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final server-owned resources linked to the client`},disabled:{type:`boolean`,description:`Whether the client is disabled`},metadata:{type:`object`,additionalProperties:!0,nullable:!0,description:`Additional metadata for the application`}},required:[`client_id`]}}}}}}}},async t=>K3(t,e)),_de=e=>Y(`/oauth2/get-client`,{method:`GET`,use:[TH],query:D({client_id:f()}),metadata:{openapi:{description:`Get OAuth2 formatted client details`}}},async t=>dde(t,e)),vde=e=>Y(`/oauth2/public-client`,{method:`GET`,use:[TH],query:D({client_id:f()}),metadata:{openapi:{description:`Gets publicly available client fields`}}},async t=>{let n=t.query.client_id;return Y3(t,e,n)}),yde=e=>Y(`/oauth2/public-client-prelogin`,{method:`POST`,use:[Iue(e)],body:D({client_id:f(),oauth_query:f().optional()}),metadata:{openapi:{description:`Gets publicly available client fields (prior to login)`}}},async t=>{let n=t.body.client_id;return Y3(t,e,n)}),bde=e=>Y(`/oauth2/get-clients`,{method:`GET`,use:[TH],metadata:{openapi:{description:`Get OAuth2 formatted client details for a user or organization`}}},async t=>fde(t,e)),xde=e=>Y(`/admin/oauth2/update-client`,{method:`PATCH`,body:D({client_id:f(),update:D({redirect_uris:_(R2).min(1).optional(),scope:f().optional(),client_name:f().optional(),client_uri:f().optional(),logo_uri:f().optional(),contacts:_(f().min(1)).min(1).optional(),tos_uri:f().optional(),policy_uri:f().optional(),software_id:f().optional(),software_version:f().optional(),software_statement:f().optional(),post_logout_redirect_uris:_(R2).min(1).optional(),backchannel_logout_uri:R2.optional(),backchannel_logout_session_required:T().optional(),application_type:E([`web`,`native`]).optional(),grant_types:Q3.optional(),client_credentials_scopes:_(f().trim().min(1)).optional(),response_types:_(E([`code`])).optional(),client_secret_expires_at:n([f(),m()]).optional(),skip_consent:T().optional(),enable_end_session:T().optional(),dpop_bound_access_tokens:T().optional(),metadata:g(f(),se()).optional()})}),metadata:{SERVER_ONLY:!0,openapi:{description:`Updates OAuth2 formatted client details.`}}},async t=>X3(t,e,{admin:!0})),Sde=e=>Y(`/oauth2/update-client`,{method:`POST`,use:[TH],body:D({client_id:f(),update:D({redirect_uris:_(R2).min(1).optional(),scope:f().optional(),client_name:f().optional(),client_uri:f().optional(),logo_uri:f().optional(),contacts:_(f().min(1)).min(1).optional(),tos_uri:f().optional(),policy_uri:f().optional(),software_id:f().optional(),software_version:f().optional(),software_statement:f().optional(),post_logout_redirect_uris:_(R2).min(1).optional(),backchannel_logout_uri:R2.optional(),backchannel_logout_session_required:T().optional(),application_type:E([`web`,`native`]).optional(),grant_types:Q3.optional(),response_types:_(E([`code`])).optional()})}),metadata:{openapi:{description:`Updates OAuth2 formatted client details.`}}},async t=>X3(t,e)),Cde=e=>Y(`/oauth2/client/rotate-secret`,{method:`POST`,use:[TH],body:D({client_id:f()}),metadata:{noStore:!0,openapi:{description:`Rotates a confidential client's secret`}}},async t=>mde(t,e)),wde=e=>Y(`/oauth2/delete-client`,{method:`POST`,use:[TH],body:D({client_id:f()}),metadata:{openapi:{description:`Deletes an oauth client`}}},async t=>pde(t,e));async function $3(e,t,n){return await e.context.adapter.findOne({model:`oauthConsent`,where:[{field:`id`,value:n}]})}async function Tde(e,t){let n=await CH(e);if(!n)throw new c(`UNAUTHORIZED`);let{id:r}=e.query;if(!r)throw new c(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await $3(e,t,r);if(!i)throw new c(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new c(`UNAUTHORIZED`);return i}async function Ede(e,t){let n=await CH(e);if(!n)throw new c(`UNAUTHORIZED`);return await e.context.adapter.findMany({model:`oauthConsent`,where:[{field:`userId`,value:n.user.id}]})}async function Dde(e,t){let n=await CH(e);if(!n)throw new c(`UNAUTHORIZED`);let{id:r}=e.body;if(!r)throw new c(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await $3(e,t,r);if(!i)throw new c(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new c(`UNAUTHORIZED`);await e.context.adapter.delete({model:`oauthConsent`,where:[{field:`id`,value:r}]})}async function Ode(e,t){let n=await CH(e);if(!n)throw new c(`UNAUTHORIZED`);let{id:r}=e.body;if(!r)throw new c(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await $3(e,t,r);if(!i)throw new c(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new c(`UNAUTHORIZED`);let a=await m2(e,t,i.clientId);if(!a)throw new c(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});let o=a?.scopes??t.scopes??[],s=e.body.update,l=s.scopes;if(l&&!l.every(e=>o?.includes(e)))throw new c(`BAD_REQUEST`,{error_description:`unable to provide scopes to ${a?.referenceId??a?.userId}`,error:`invalid_request`});let u=Math.floor(Date.now()/1e3);return await e.context.adapter.update({model:`oauthConsent`,where:[{field:`id`,value:r}],update:{...s,updatedAt:/* @__PURE__ */ new Date(u*1e3)}})}const kde=e=>Y(`/oauth2/get-consent`,{method:`GET`,query:D({id:f()}),use:[TH],metadata:{openapi:{description:`Gets details of a specific OAuth2 consent for a user`}}},async t=>Tde(t,e)),Ade=e=>Y(`/oauth2/get-consents`,{method:`GET`,use:[TH],metadata:{openapi:{description:`Gets all available OAuth2 consents for a user`}}},async t=>Ede(t,e)),jde=e=>Y(`/oauth2/update-consent`,{method:`POST`,use:[TH],body:D({id:f(),update:D({scopes:_(f())})}),metadata:{openapi:{description:`Updates consent granted to a client.`}}},async t=>Ode(t,e)),Mde=e=>Y(`/oauth2/delete-consent`,{method:`POST`,use:[TH],body:D({id:f()}),metadata:{openapi:{description:`Deletes consent granted to a client`}}},async t=>Dde(t,e));async function e6(e,t,n,r,i){if(!t)throw new c(`UNAUTHORIZED`);if(!e.headers)throw new c(`BAD_REQUEST`);if(n.resourcePrivileges&&!await n.resourcePrivileges({headers:e.headers,action:r,session:t.session,user:t.user,resourceId:i}))throw new c(`UNAUTHORIZED`)}const t6=e=>e.schema?.oauthResource?.modelName??`oauthResource`,n6=e=>e.schema?.oauthClientResource?.modelName??`oauthClientResource`,Nde=e=>e.schema?.oauthClient?.modelName??`oauthClient`;function r6(e){try{return decodeURIComponent(e)}catch{return e}}function Pde(e,t){return{identifier:e.identifier,name:e.name??e.identifier,accessTokenTtl:e.accessTokenTtl??null,refreshTokenTtl:e.refreshTokenTtl??null,signingAlgorithm:e.signingAlgorithm??null,signingKeyId:e.signingKeyId??null,allowedScopes:e.allowedScopes??null,customClaims:e.customClaims??null,dpopBoundAccessTokensRequired:e.dpopBoundAccessTokensRequired??!1,disabled:e.disabled??!1,policyVersion:1,metadata:e.metadata??null,createdAt:t,updatedAt:t}}async function Fde(e,t){await e6(e,await CH(e),t,`create`);let n=e.body;if(!n?.identifier)throw new c(`BAD_REQUEST`,{error:`invalid_request`,error_description:`identifier is required`});await lle(t,n.identifier);let r=/* @__PURE__ */ new Date,i;try{i=await e.context.adapter.create({model:t6(t),data:Pde(n,r)})}catch(e){let t=e instanceof Error?e.message:String(e);throw/unique|duplicate|UNIQUE/i.test(t)?new c(`BAD_REQUEST`,{error:`invalid_request`,error_description:`resource ${n.identifier} already exists`}):e}if(!i)throw new c(`BAD_REQUEST`,{error:`invalid_request`,error_description:`resource ${n.identifier} could not be created`});return n4(i.identifier),e.json(i,{status:201})}async function Ide(e,t){await e6(e,await CH(e),t,`list`);let n=await e.context.adapter.findMany({model:t6(t)});return e.json(n??[])}async function Lde(e,t){let n=r6(e.params.identifier);await e6(e,await CH(e),t,`read`,n);let r=await e.context.adapter.findOne({model:t6(t),where:[{field:`identifier`,value:n}]});if(!r)throw new c(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return e.json(r)}async function Rde(e,t){let n=r6(e.params.identifier);if(await e6(e,await CH(e),t,`update`,n),!await e.context.adapter.findOne({model:t6(t),where:[{field:`identifier`,value:n}]}))throw new c(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});let r={updatedAt:/* @__PURE__ */ new Date};for(let t of[`name`,`accessTokenTtl`,`refreshTokenTtl`,`signingAlgorithm`,`signingKeyId`,`allowedScopes`,`customClaims`,`dpopBoundAccessTokensRequired`,`disabled`,`metadata`])Object.prototype.hasOwnProperty.call(e.body,t)&&(r[t]=e.body[t]);await e.context.adapter.update({model:t6(t),where:[{field:`identifier`,value:n}],update:r}),n4(n);let i=await e.context.adapter.findOne({model:t6(t),where:[{field:`identifier`,value:n}]});if(!i)throw new c(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return e.json(i)}async function zde(e,t){let n=r6(e.params.identifier);if(await e6(e,await CH(e),t,`delete`,n),!await e.context.adapter.findOne({model:t6(t),where:[{field:`identifier`,value:n}]}))throw new c(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return await e.context.adapter.delete({model:t6(t),where:[{field:`identifier`,value:n}]}),n4(n),e.json({deleted:!0})}async function Bde(e,t){let n=await CH(e),r=r6(e.params.identifier),i=r6(e.params.client_id);if(await e6(e,n,t,`link`,r),!await e.context.adapter.findOne({model:t6(t),where:[{field:`identifier`,value:r}]}))throw new c(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${r} not found`});if(!await e.context.adapter.findOne({model:Nde(t),where:[{field:`clientId`,value:i}]}))throw new c(`NOT_FOUND`,{error:`not_found`,error_description:`client ${i} not found`});try{await e.context.adapter.create({model:n6(t),data:{clientId:i,resourceId:r,createdAt:/* @__PURE__ */ new Date}})}catch(t){let n=t instanceof Error?t.message:String(t);if(/unique|duplicate|UNIQUE/i.test(n))return e.json({linked:!0,alreadyLinked:!0});throw t}return e.json({linked:!0})}async function Vde(e,t){let n=await CH(e),r=r6(e.params.identifier),i=r6(e.params.client_id);return await e6(e,n,t,`unlink`,r),await e.context.adapter.deleteMany({model:n6(t),where:[{field:`clientId`,value:i},{field:`resourceId`,value:r}]}),e.json({unlinked:!0})}const i6=D({identifier:f().min(1).optional(),name:f().optional(),accessTokenTtl:m().int().positive().nullable().optional(),refreshTokenTtl:m().int().positive().nullable().optional(),signingAlgorithm:E(X2).nullable().optional(),signingKeyId:f().nullable().optional(),allowedScopes:_(f()).nullable().optional(),customClaims:g(f(),se()).nullable().optional(),dpopBoundAccessTokensRequired:T().optional(),disabled:T().optional(),metadata:g(f(),se()).nullable().optional()}),Hde=e=>Y(`/admin/oauth2/resources`,{method:`POST`,body:i6.required({identifier:!0}),metadata:{SERVER_ONLY:!0}},async t=>Fde(t,e)),Ude=e=>Y(`/admin/oauth2/resources`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async t=>Ide(t,e)),Wde=e=>Y(`/admin/oauth2/resources/:identifier`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async t=>Lde(t,e)),Gde=e=>Y(`/admin/oauth2/resources/:identifier`,{method:`PATCH`,body:i6,metadata:{SERVER_ONLY:!0}},async t=>Rde(t,e)),Kde=e=>Y(`/admin/oauth2/resources/:identifier`,{method:`DELETE`,metadata:{SERVER_ONLY:!0}},async t=>zde(t,e)),qde=e=>Y(`/admin/oauth2/resources/:identifier/clients/:client_id`,{method:`POST`,metadata:{SERVER_ONLY:!0}},async t=>Bde(t,e)),Jde=e=>Y(`/admin/oauth2/resources/:identifier/clients/:client_id`,{method:`DELETE`,metadata:{SERVER_ONLY:!0}},async t=>Vde(t,e));async function Yde(e,t,n){let r=t.disableJwtPlugin?void 0:c2(e.context),i=r?.options;try{let a=await JB(n,nV(await XK(n,{jwksFetch:i?.jwks?.remoteUrl?i.jwks.remoteUrl:async()=>(await r?.endpoints.getJwks(e))?.response,jwksCacheKey:r})),{issuer:i?.jwt?.issuer??e.context.baseURL}),o=`${e.context.baseURL}/oauth2/userinfo`;if(!a.payload.azp||!await Q2(e,t,a.payload.aud,[o]))return null}catch(e){if(e instanceof Error){if(e.name===`TypeError`||e.name===`JWSInvalid`)throw new d(`BAD_REQUEST`,{error_description:`invalid JWT signature`,error:`invalid_request`});if(e.name===`JWTExpired`||e.name===`JWTInvalid`)return null;throw e}throw Error(e)}throw new d(`BAD_REQUEST`,{error_description:`JWT access tokens are self-contained and cannot be revoked server-side`,error:`unsupported_token_type`})}async function Xde(e,t,n,r){let i=n;if(t.prefix?.opaqueAccessToken){if(i.startsWith(t.prefix.opaqueAccessToken))i=i.replace(t.prefix.opaqueAccessToken,``);else throw new d(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`})}let a=await e.context.adapter.findOne({model:`oauthAccessToken`,where:[{field:`token`,value:await b2(t.storeTokens,i,`access_token`)}]});if(!a)throw new d(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`});if(!a.clientId||a.clientId!==r)return null;a.id?await e.context.adapter.delete({model:`oauthAccessToken`,where:[{field:`id`,value:a.id}]}):await e.context.adapter.delete({model:`oauthAccessToken`,where:[{field:`token`,value:a.token}]})}async function Zde(e,t,n,r){let i=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await b2(t.storeTokens,n,`refresh_token`)}]});if(!i)throw new d(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`});if(i.revoked)throw await x4(e,r,i.userId),new d(`BAD_REQUEST`,{error_description:`refresh token revoked`,error:`invalid_request`});if(!i.clientId||i.clientId!==r)return null;let a=Math.floor(Date.now()/1e3);if(!await e.context.adapter.incrementOne({model:`oauthRefreshToken`,where:[{field:`id`,value:i.id},{field:`revoked`,operator:`eq`,value:null}],increment:{},set:{revoked:/* @__PURE__ */ new Date(a*1e3)}}))throw await x4(e,r,i.userId),new d(`BAD_REQUEST`,{error_description:`refresh token revoked`,error:`invalid_request`});await e.context.adapter.deleteMany({model:`oauthAccessToken`,where:[{field:`refreshId`,value:i.id}]})}async function Qde(e,t,n,r){try{return await Yde(e,t,r)}catch(e){if(e instanceof d){if(e.body?.error===`unsupported_token_type`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}try{return await Xde(e,t,r,n)}catch(e){if(!(e instanceof d))throw e instanceof Error?e:Error(`Unknown error validating access token`)}throw new d(`BAD_REQUEST`,{error_description:`Invalid access token`,error:`invalid_request`})}async function $de(e,t){let{token:n,token_type_hint:r}=e.body;r!==`access_token`&&r!==`refresh_token`&&(r=void 0);let{clientId:i,clientSecret:a,preVerified:o,authMethod:s}=O2(await k2(e,t,`${e.context.baseURL}/oauth2/revoke`));if(!i)throw new d(`UNAUTHORIZED`,{error_description:`missing required credentials`,error:`invalid_client`});if(typeof n==`string`&&(n=SK(n)),!n?.length)throw new d(`BAD_REQUEST`,{error_description:`missing a required token for introspection`,error:`invalid_request`});let c=await E2(e,t,i,a,void 0,o,void 0,s);try{if(r===void 0||r===`access_token`)try{return await Qde(e,t,c.clientId,n)}catch(e){if(e instanceof d){if(r===`access_token`||e.body?.error===`unsupported_token_type`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}if(r===void 0||r===`refresh_token`)try{return await Zde(e,t,(await b4(t,n)).token,c.clientId)}catch(e){if(e instanceof d){if(r===`refresh_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}throw new d(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`})}catch(e){if(e instanceof d){if(e.body?.error===`unsupported_token_type`)throw e;if(e.name===`BAD_REQUEST`)return null;throw e}throw e instanceof Error?(O.error(`Introspection error:`,e.message,e.stack),new d(`INTERNAL_SERVER_ERROR`)):(O.error(`Introspection error:`,e),new d(`INTERNAL_SERVER_ERROR`))}}const efe={oauthClient:{modelName:`oauthClient`,fields:{clientId:{type:`string`,unique:!0,required:!0},clientSecret:{type:`string`,required:!1},clientDiscoveryId:{type:`string`,required:!1},disabled:{type:`boolean`,defaultValue:!1,required:!1},skipConsent:{type:`boolean`,required:!1},enableEndSession:{type:`boolean`,required:!1},subjectType:{type:`string`,required:!1},scopes:{type:`string[]`,required:!1},clientCredentialsScopes:{type:`string[]`,required:!1,defaultValue:[]},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},createdAt:{type:`date`,required:!1},updatedAt:{type:`date`,required:!1},name:{type:`string`,required:!1},uri:{type:`string`,required:!1},icon:{type:`string`,required:!1},contacts:{type:`string[]`,required:!1},tos:{type:`string`,required:!1},policy:{type:`string`,required:!1},softwareId:{type:`string`,required:!1},softwareVersion:{type:`string`,required:!1},softwareStatement:{type:`string`,required:!1},redirectUris:{type:`string[]`,required:!0},postLogoutRedirectUris:{type:`string[]`,required:!1},backchannelLogoutUri:{type:`string`,required:!1},backchannelLogoutSessionRequired:{type:`boolean`,required:!1},tokenEndpointAuthMethod:{type:`string`,required:!1},applicationType:{type:`string`,required:!1},jwks:{type:`string`,required:!1},jwksUri:{type:`string`,required:!1},grantTypes:{type:`string[]`,required:!1},responseTypes:{type:`string[]`,required:!1},requirePKCE:{type:`boolean`,required:!1},dpopBoundAccessTokens:{type:`boolean`,required:!1,defaultValue:!1},referenceId:{type:`string`,required:!1},metadata:{type:`json`,required:!1}}},oauthResource:{modelName:`oauthResource`,fields:{identifier:{type:`string`,required:!0,unique:!0},name:{type:`string`,required:!0},accessTokenTtl:{type:`number`,required:!1},refreshTokenTtl:{type:`number`,required:!1},signingAlgorithm:{type:`string`,required:!1},signingKeyId:{type:`string`,required:!1},allowedScopes:{type:`string[]`,required:!1},customClaims:{type:`json`,required:!1},dpopBoundAccessTokensRequired:{type:`boolean`,required:!1,defaultValue:!1},disabled:{type:`boolean`,required:!1,defaultValue:!1},createdAt:{type:`date`,required:!1},updatedAt:{type:`date`,required:!1},policyVersion:{type:`number`,required:!1,defaultValue:1},metadata:{type:`json`,required:!1}}},oauthClientResource:{modelName:`oauthClientResource`,fields:{clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`,onDelete:`cascade`},index:!0},resourceId:{type:`string`,required:!0,references:{model:`oauthResource`,field:`identifier`,onDelete:`cascade`},index:!0},metadata:{type:`json`,required:!1},createdAt:{type:`date`,required:!1}},indexes:[{fields:[`clientId`,`resourceId`],unique:!0}]},oauthRefreshToken:{fields:{token:{type:`string`,required:!0,unique:!0},clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},sessionId:{type:`string`,required:!1,references:{model:`session`,field:`id`,onDelete:`set null`},index:!0},userId:{type:`string`,required:!0,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},authorizationCodeId:{type:`string`,required:!1,index:!0},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},expiresAt:{type:`date`},createdAt:{type:`date`},revoked:{type:`date`,required:!1},rotatedAt:{type:`date`,required:!1},rotationReplayResponse:{type:`string`,required:!1},rotationReplayExpiresAt:{type:`date`,required:!1},authTime:{type:`date`,required:!1},confirmation:{type:`json`,required:!1},scopes:{type:`string[]`,required:!0}}},oauthAccessToken:{modelName:`oauthAccessToken`,fields:{token:{type:`string`,unique:!0},clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},sessionId:{type:`string`,required:!1,references:{model:`session`,field:`id`,onDelete:`set null`},index:!0},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},authorizationCodeId:{type:`string`,required:!1,index:!0},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},refreshId:{type:`string`,required:!1,references:{model:`oauthRefreshToken`,field:`id`},index:!0},expiresAt:{type:`date`},createdAt:{type:`date`},revoked:{type:`date`,required:!1},confirmation:{type:`json`,required:!1},scopes:{type:`string[]`,required:!0}}},oauthConsent:{modelName:`oauthConsent`,fields:{clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},scopes:{type:`string[]`,required:!0},createdAt:{type:`date`},updatedAt:{type:`date`}}},oauthClientAssertion:{modelName:`oauthClientAssertion`,fields:{expiresAt:{type:`date`,required:!0}}}},a6=[`openid`,`profile`,`email`,`offline_access`],o6=D({id_token_hint:f().optional(),client_id:f().optional(),post_logout_redirect_uri:R2.optional(),state:f().optional()}),s6=UR(()=>null),c6=s6.get,l6=/* @__PURE__ */ new WeakMap,u6=`signedQueryIssuedAtMs`;function tfe(e){let t=typeof e==`number`?e:typeof e==`string`?Number(e):void 0;if(!(!t||!Number.isFinite(t)||t<=0))return new Date(t)}const d6=e=>{let t=e.clientRegistrationAllowedScopes;if(e.clientRegistrationDefaultScopes){let n=t?/* @__PURE__ */ new Set([...t,...e.clientRegistrationDefaultScopes]):/* @__PURE__ */ new Set([...e.clientRegistrationDefaultScopes]);t=Array.from(n)}let r=new Set((e.scopes??a6).filter(e=>e.length));if(t){for(let e of t)if(!r.has(e))throw new l(`clientRegistrationAllowedScope ${e} not found in scopes`)}for(let t of e.advertisedMetadata?.scopes_supported??[])if(!r?.has(t))throw new l(`advertisedMetadata.scopes_supported ${t} not found in scopes`);let i=new Set((e.resources??[]).map(e=>typeof e==`string`?e:e.identifier));for(let[t,n]of[[`clientRegistrationDefaultResources`,e.clientRegistrationDefaultResources],[`clientRegistrationAllowedResources`,e.clientRegistrationAllowedResources]])for(let e of n??[])if(!i.has(e))throw new l(`${t} resource ${e} not found in resources`);let a=/* @__PURE__ */ new Set([`sub`,`iss`,`aud`,`exp`,`iat`,`sid`,`scope`,`azp`,...q2.filter(e=>r.has(K2[e].scope))]),o={codeExpiresIn:600,accessTokenExpiresIn:3600,m2mAccessTokenExpiresIn:3600,refreshTokenExpiresIn:2592e3,refreshTokenReuseInterval:0,allowUnauthenticatedClientRegistration:!1,allowDynamicClientRegistration:!1,disableJwtPlugin:!1,storeClientSecret:e.disableJwtPlugin?`encrypted`:`hashed`,storeTokens:`hashed`,grantTypes:[`authorization_code`,`client_credentials`,`refresh_token`],...e,scopes:Array.from(r),claims:Array.from(a),clientRegistrationAllowedScopes:t};if($0(o.extensions),o.pairwiseSecret&&o.pairwiseSecret.length<32)throw new l(`pairwiseSecret must be at least 32 characters long for adequate HMAC-SHA256 security`);if(o.grantTypes&&o.grantTypes.includes(`refresh_token`)&&!o.grantTypes.includes(`authorization_code`))throw new l(`refresh_token grant requires authorization_code grant`);if(o.disableJwtPlugin&&(o.storeClientSecret===`hashed`||typeof o.storeClientSecret==`object`&&`hash`in o.storeClientSecret))throw new l(`unable to store hashed secrets because id tokens will be signed with secret`);if(!o.disableJwtPlugin&&(o.storeClientSecret===`encrypted`||typeof o.storeClientSecret==`object`&&(`encrypt`in o.storeClientSecret||`decrypt`in o.storeClientSecret)))throw new l(`encryption method not recommended, please use 'hashed' or the 'hash' function`);let s=async(e,t)=>{let n=new URL(e.url).pathname,r=t.options.advanced?.skipTrailingSlashes?n.replace(/\/+$/,``)||`/`:n,i=o.disableJwtPlugin?t.baseURL:c2(t)?.options?.jwt?.issuer??t.baseURL,a=`/`;try{a=new URL(i).pathname.replace(/\/$/,``)||``}catch{a=new URL(t.baseURL).pathname.replace(/\/$/,``)||``}let s={context:t},c=/* @__PURE__ */ new Set([`/.well-known/oauth-authorization-server${a}`,`${a}/.well-known/oauth-authorization-server`]),l=`${a}/.well-known/openid-configuration`,u=c.has(r),d=o.scopes?.includes(`openid`)&&r===l,f=t=>{let n=d3(t);return e.method===`HEAD`?new Response(null,{status:n.status,headers:n.headers}):n};if((u||d)&&e.method!==`GET`&&e.method!==`HEAD`)return{response:new Response(null,{status:405,headers:{Allow:`GET, HEAD`}})};if(u)return o.scopes?.includes(`openid`)?{response:f(u3(s,o))}:{response:f(l3(s,o))};if(d)return{response:f(u3(s,o))}},u=f3(`/oauth2/authorize`,{method:[`GET`,`POST`],body:D({}).passthrough(),redirectOnError:x6(o),metadata:{allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Authorize an OAuth 2.1 request from query parameters or an application/x-www-form-urlencoded POST body`,parameters:[{name:`response_type`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 response type (e.g., 'code')`},{name:`client_id`,in:`query`,required:!0,schema:{type:`string`},description:`OAuth 2.1 client ID`},{name:`redirect_uri`,in:`query`,required:!1,schema:{type:`string`,format:`uri`},description:`OAuth 2.1 redirect URI`},{name:`scope`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 scopes (space-separated)`},{name:`state`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 state parameter`},{name:`request_uri`,in:`query`,required:!1,schema:{type:`string`},description:`Pushed Authorization Request URI referencing stored parameters`},{name:`code_challenge`,in:`query`,required:!1,schema:{type:`string`},description:`PKCE code challenge`},{name:`code_challenge_method`,in:`query`,required:!1,schema:{type:`string`},description:`PKCE code challenge method`},{name:`nonce`,in:`query`,required:!1,schema:{type:`string`},description:`OpenID Connect nonce`},{name:`max_age`,in:`query`,required:!1,schema:{type:`integer`,minimum:0},description:`Maximum authentication age in seconds; forces re-authentication when exceeded`},{name:`resource`,in:`query`,required:!1,schema:{type:`array`,items:{type:`string`}},description:`Requested protected resource(s) for the access token. May be supplied multiple times as repeated 'resource' query parameters (RFC 8707) or as an array of strings.`},{name:`prompt`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth2 prompt parameter`}],responses:{302:{description:`Redirect to client with code or error`,headers:{Location:{description:`Redirect URI with code or error`,schema:{type:`string`,format:`uri`}}}},400:{description:`Invalid request`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},state:{type:`string`}},required:[`error`]}}}}}}}},async e=>lfe(e,o,e.authorizeSettings??{isAuthorize:!0})),d=(e,t)=>VJ(u,{...e,asResponse:!1,returnHeaders:!1,returnStatus:!1,authorizeSettings:t??{}});return{id:`oauth-provider`,version:`1.7.5`,options:o,onRequest:s,init:async e=>{if(e.options.secondaryStorage&&e.options.session?.storeSessionInDatabase!==!0)throw new l("OAuth Provider requires `session.storeSessionInDatabase: true` when using secondaryStorage");if(await s4(e,o),xle(o),!o.disableJwtPlugin){let t=c2(e)?.options,n=t?.jwt?.issuer??e.baseURL,r=t?.jwt?.issuer==null&&typeof e.options.baseURL==`object`&&e.options.baseURL!==null&&`allowedHosts`in e.options.baseURL;try{new URL(n)}catch(e){if(!r||n!==``)throw e}}return{options:{databaseHooks:{session:{delete:{async before(e,t){if(!t)return;let n=await yue(t,o,{sessionId:e.id,userId:e.userId});if(!n)return;let r=l6.get(t)??/* @__PURE__ */ new Map;r.set(e.id,n),l6.set(t,r)},async after(e,t){if(!t)return;let n=l6.get(t);if(!n)return;let r=n.get(e.id);if(n.delete(e.id),n.size===0&&l6.delete(t),!r)return;let i=bue(t,r).catch(e=>{t.context.logger.error(`Back-channel logout failed after session deletion`,e)});await t.context.runInBackgroundOrAwait(i)}}}}}}},hooks:{before:[{matcher(e){return e.body?.oauth_query},handler:gL(async e=>{let t=e.body.oauth_query;if(!await p2(t,e.context.secret))throw new c(`BAD_REQUEST`,{error:`invalid_signature`});let n=Sce(t),r=new URLSearchParams(t),i=r.get(`ba_pl`)??void 0;r.delete(`sig`),r.delete(`exp`),r.delete(G0),r.delete(K0),await s6.set({query:r.toString(),signedQueryIssuedAt:n??void 0,postLoginClearedForSession:i}),e.path===`/sign-in/social`&&await ez({query:r.toString(),...n?{[u6]:n.getTime()}:{}})})}],after:[{matcher(e){return DV(e.context.responseHeaders?.get(`set-cookie`)||``).has(e.context.authCookies.sessionToken.name)},handler:gL(async e=>{let t=DV(e.context.responseHeaders?.get(`set-cookie`)||``).get(e.context.authCookies.sessionToken.name)?.value.split(`.`)[0];if(!t)return;let n=await s6.get(),r=(await ZR())?.serverContext,i=n?.query??r?.query;if(!i)return;let a=new URLSearchParams(i),o=await e.context.internalAdapter.findSession(t);if(!o)return;e.context.session=o;let s=e.request?.headers?.get(`sec-fetch-mode`)?.toLowerCase(),c=e.request?.headers?.get(`accept`)?.toLowerCase()??``;s===`navigate`||!s&&(c.includes(`text/html`)||c.includes(`application/xhtml+xml`))||e.headers?.set(`accept`,`application/json`);let l=n?.signedQueryIssuedAt??tfe(r?.[u6]),u=P2(a,`login`);return N2(o.session.createdAt,l)&&(u=F2(u)),e.query=M2(u),await d(e)})}]},endpoints:{getOAuthServerConfig:Y(`/.well-known/oauth-authorization-server`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async e=>o.scopes&&o.scopes.includes(`openid`)?u3(e,o):l3(e,o)),getOpenIdConfig:Y(`/.well-known/openid-configuration`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async e=>{if(o.scopes&&!o.scopes.includes(`openid`))throw new c(`NOT_FOUND`);return u3(e,o)}),oauth2Authorize:u,oauth2Consent:Y(`/oauth2/consent`,{method:`POST`,body:D({accept:T().meta({description:`Accept or deny user consent for a set of scopes`}),scope:f().optional().meta({description:`List of accept of accepted space-separated scopes. If none is provided, then all originally requested scopes are accepted.`}),claims:U2.optional().meta({description:`Accepted OIDC claims request object. If none is provided, then all originally requested claims are accepted.`}),oauth_query:f().optional().meta({description:`The redirected page's query parameters`})}),use:[TH],metadata:{openapi:{description:`Handle OAuth2 consent`,responses:{200:{description:`Consent processed successfully`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`The URI to redirect to, either with an authorization code or an error`}},required:[`redirect_uri`]}}}}}}}},async e=>pue(e,o,d)),oauth2Continue:Y(`/oauth2/continue`,{method:`POST`,body:D({selected:T().optional().meta({description:`Confirms an account has been selected and authorization can proceed.`}),created:T().optional().meta({description:`Confirms an account was registered`}),postLogin:T().optional().meta({description:`Confirms organization and/or team selection.`}),oauth_query:f().optional().meta({description:`The redirected page's query parameters`})}),use:[TH],metadata:{openapi:{description:`Continues OAuth2 authorization flow`,responses:{200:{description:`Consent processed successfully`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`The URI to redirect to, either with an authorization code or an error`}},required:[`redirect_uri`]}}}}}}}},async e=>mue(e,d)),oauth2Token:f3(`/oauth2/token`,{method:`POST`,cloneRequest:!0,body:D({grant_type:f().trim().min(1),client_id:f().optional(),client_secret:f().optional(),client_assertion:f().optional(),client_assertion_type:f().optional(),code:f().optional(),code_verifier:f().optional(),redirect_uri:R2.optional(),refresh_token:f().optional(),resource:n([p4,_(p4).min(1)]).optional(),scope:f().optional()}).passthrough(),errorCodesByField:{grant_type:{missing:`invalid_request`,invalid:`unsupported_grant_type`},resource:{invalid:`invalid_target`}},metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Obtain an OAuth2.1 access token`,parameters:[{name:`DPoP`,in:`header`,required:!1,schema:{type:`string`},description:`RFC 9449 DPoP proof JWT for issuing DPoP-bound tokens`}],requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{grant_type:{type:`string`,description:`OAuth2 grant type`},client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},code:{type:`string`,description:`Authorization code (for authorization_code grant)`},code_verifier:{type:`string`,description:`PKCE code verifier (for authorization_code grant)`},redirect_uri:{type:`string`,format:`uri`,description:`Redirect URI (for authorization_code grant)`},refresh_token:{type:`string`,description:`Refresh token (for refresh_token grant)`},resource:{oneOf:[{type:`string`,description:`Single resource (URL)`},{type:`array`,items:{type:`string`},description:`Multiple resources (URLs)`}],description:`Requested protected resource(s) for the access token`},scope:{type:`string`,description:`Requested scopes (for client_credentials grant)`}},required:[`grant_type`]}}}},responses:{200:{description:`Access token response`,content:{"application/json":{schema:{type:`object`,properties:{access_token:{type:`string`,description:`The access token issued by the authorization server`},token_type:{type:`string`,description:`The type of the token issued`,enum:[`Bearer`,`DPoP`]},expires_in:{type:`number`,description:`Lifetime in seconds of the access token`},refresh_token:{type:`string`,description:`Refresh token, if issued`},scope:{type:`string`,description:`Scopes granted by the access token`},id_token:{type:`string`,description:`ID Token (if OpenID Connect)`}},required:[`access_token`,`token_type`,`expires_in`]}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>{if(e.request){let t=await dle(e.request);t&&t.length>1&&(e.body.resource=t)}return Fle(e,o)}),oauth2Introspect:f3(`/oauth2/introspect`,{method:`POST`,cloneRequest:!0,body:D({client_id:f().optional(),client_secret:f().optional(),client_assertion:f().optional(),client_assertion_type:f().optional(),token:f(),token_type_hint:f().optional()}),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Introspect an OAuth2 access or refresh token`,requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},token:{type:`string`,description:`The token to introspect (access or refresh token)`},token_type_hint:{type:`string`,description:"Hint about the token type. Recognized values: `access_token`, `refresh_token`."}},required:[`token`]}}}},responses:{200:{description:`Token introspection response`,content:{"application/json":{schema:{type:`object`,properties:{active:{type:`boolean`,description:`Whether the token is active`},scope:{type:`string`,description:`Scopes associated with the token`},client_id:{type:`string`,description:`Client ID associated with the token`},username:{type:`string`,description:`Username associated with the token`},token_type:{type:`string`,description:`Type of the token`},exp:{type:`number`,description:`Expiration time of the token (seconds since epoch)`},iat:{type:`number`,description:`Issued at time (seconds since epoch)`},nbf:{type:`number`,description:`Not before time (seconds since epoch)`},sub:{type:`string`,description:`Subject of the token`},aud:{type:`string`,description:`Audience of the token`},iss:{type:`string`,description:`Issuer of the token`},jti:{type:`string`,description:`JWT ID`}},required:[`active`]}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>V4(e,o)),oauth2Revoke:f3(`/oauth2/revoke`,{method:`POST`,cloneRequest:!0,body:D({client_id:f().optional(),client_secret:f().optional(),client_assertion:f().optional(),client_assertion_type:f().optional(),token:f(),token_type_hint:f().optional()}),metadata:{allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Revoke an OAuth2 access or refresh token`,requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},token:{type:`string`,description:`The token to revoke (access or refresh token)`},token_type_hint:{type:`string`,description:"Hint about the token type. Recognized values: `access_token`, `refresh_token`."}},required:[`token`]}}}},responses:{200:{description:`Token revoked successfully. The response body is empty.`,content:{"application/json":{schema:{type:`object`,description:`Empty object on success`}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>$de(e,o)),oauth2UserInfo:Y(`/oauth2/userinfo`,{method:[`GET`,`POST`],body:D({access_token:f().optional()}).passthrough().optional(),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Get OpenID Connect user information (UserInfo endpoint)`,security:[{bearerAuth:[]},{OAuth2:[`openid`,`profile`,`email`]}],parameters:[{name:`Authorization`,in:`header`,required:!1,schema:{type:`string`},description:`Bearer or DPoP access token`},{name:`DPoP`,in:`header`,required:!1,schema:{type:`string`},description:`RFC 9449 DPoP proof JWT when using a DPoP-bound access token`}],responses:{200:{description:`User information retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{sub:{type:`string`,description:`Subject identifier (user ID)`},email:{type:`string`,format:`email`,nullable:!0,description:`User's email address, included if 'email' scope is granted`},name:{type:`string`,nullable:!0,description:`User's full name, included if 'profile' scope is granted`},picture:{type:`string`,format:`uri`,nullable:!0,description:`User's profile picture URL, included if 'profile' scope is granted`},given_name:{type:`string`,nullable:!0,description:`User's given name, included if 'profile' scope is granted`},family_name:{type:`string`,nullable:!0,description:`User's family name, included if 'profile' scope is granted`},email_verified:{type:`boolean`,nullable:!0,description:`Whether the email is verified, included if 'email' scope is granted`}},required:[`sub`]}}}},401:{description:`Unauthorized - invalid or missing access token`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`}},required:[`error`]}}}},403:{description:`Forbidden - insufficient scope`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`}},required:[`error`]}}}}}}}},async e=>Nle(e,o)),oauth2EndSession:f3(`/oauth2/end-session`,{method:[`GET`,`POST`],body:o6.optional(),query:o6.optional(),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`,`application/json`],$Infer:{body:{},query:{}},openapi:{description:`RP-Initiated Logout endpoint. Accepts standard logout parameters through GET or an application/x-www-form-urlencoded POST body, plus JSON for Better Auth generated-client calls. Requests without a usable id_token_hint may require explicit OP confirmation.`,responses:{200:{description:`Logout completed, or an HTML confirmation page was returned for browser navigation. A redirect is used only for an exact registered post_logout_redirect_uri.`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`URI to redirect to after logout (if post_logout_redirect_uri was provided)`},message:{type:`string`,description:`Success message`}}}},"text/html":{schema:{type:`string`}}}}}}}},async e=>jue(e,o)),oauth2EndSessionConfirmation:f3(`/oauth2/end-session/confirm`,{method:`POST`,body:D({action:ee(`confirm`)}),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],scope:`http`}},async e=>Mue(e,o)),registerOAuthClient:f3(`/oauth2/register`,{method:`POST`,body:g4,errorCodesByField:{redirect_uris:`invalid_redirect_uri`,post_logout_redirect_uris:`invalid_redirect_uri`,software_statement:`invalid_software_statement`,resources:`invalid_target`},defaultError:`invalid_client_metadata`,metadata:{noStore:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`Name of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URL for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},post_logout_redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed logout redirect uris`},backchannel_logout_uri:{type:`string`,format:`uri`,description:`RP URL to receive signed Logout Tokens when the end-user's OP session terminates`},backchannel_logout_session_required:{type:`boolean`,description:"Whether the RP requires a `sid` claim in every Logout Token"},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final resource identifiers linked to the registered client`},disabled:{type:`boolean`,description:`Whether the client is disabled`}},required:[`client_id`]}}}}}}}},async e=>sde(e,o)),adminCreateOAuthClient:hde(o),createOAuthClient:gde(o),getOAuthClient:_de(o),getOAuthClientPublic:vde(o),getOAuthClientPublicPrelogin:yde(o),getOAuthClients:bde(o),adminUpdateOAuthClient:xde(o),updateOAuthClient:Sde(o),rotateClientSecret:Cde(o),deleteOAuthClient:wde(o),getOAuthConsent:kde(o),getOAuthConsents:Ade(o),updateOAuthConsent:jde(o),deleteOAuthConsent:Mde(o),adminCreateOAuthResource:Hde(o),adminListOAuthResources:Ude(o),adminGetOAuthResource:Wde(o),adminUpdateOAuthResource:Gde(o),adminDeleteOAuthResource:Kde(o),adminLinkClientResource:qde(o),adminUnlinkClientResource:Jde(o)},schema:bz(structuredClone(efe),o?.schema),rateLimit:[...o.rateLimit?.token===!1?[]:[{pathMatcher:e=>e===`/oauth2/token`,window:o.rateLimit?.token?.window??60,max:o.rateLimit?.token?.max??20}],...o.rateLimit?.authorize===!1?[]:[{pathMatcher:e=>e===`/oauth2/authorize`,window:o.rateLimit?.authorize?.window??60,max:o.rateLimit?.authorize?.max??30}],...o.rateLimit?.introspect===!1?[]:[{pathMatcher:e=>e===`/oauth2/introspect`,window:o.rateLimit?.introspect?.window??60,max:o.rateLimit?.introspect?.max??100}],...o.rateLimit?.revoke===!1?[]:[{pathMatcher:e=>e===`/oauth2/revoke`,window:o.rateLimit?.revoke?.window??60,max:o.rateLimit?.revoke?.max??30}],...o.rateLimit?.register===!1?[]:[{pathMatcher:e=>e===`/oauth2/register`,window:o.rateLimit?.register?.window??60,max:o.rateLimit?.register?.max??5}],...o.rateLimit?.userinfo===!1?[]:[{pathMatcher:e=>e===`/oauth2/userinfo`,window:o.rateLimit?.userinfo?.window??60,max:o.rateLimit?.userinfo?.max??60}]]}};function nfe(e,t,n){return t!==0&&n.getTime()-e.getTime()<=t*1e3}function rfe(e){let{max_age:t,...n}=e;return n}function f6(e,t,n,r,i,a=`query`){let o=new URLSearchParams({error:t,error_description:n});return r&&o.append(`state`,r),i&&o.append(`iss`,i),a===`fragment`?`${e}#${o.toString()}`:ZL(e,o)}function ife(e){let t=typeof e.response_mode==`string`?e.response_mode:void 0;if(t===`fragment`)return`fragment`;if(t===`query`)return`query`;let n=typeof e.response_type==`string`?e.response_type:void 0;return n&&/\b(token|id_token)\b/.test(n)?`fragment`:`query`}const afe={response_type:{invalid:`unsupported_response_type`},resource:{invalid:`invalid_target`}};function ofe(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function p6(e){return typeof e==`string`?e:void 0}function sfe(e,t){let n=e.method===`POST`&&t?.isAuthorize===!0?e.body:e.query;return{...ofe(n)?n:{}}}const m6=(e,t)=>{let n=H4(e.request?.headers),r=e.headers?.get(`accept`)?.includes(`application/json`);if(n||r)return{redirect:!0,url:t.toString()};throw e.redirect(t)};function h6(e,t,n,r,i){return m6(e,f6(n.redirect_uri,r,i,n.state,_6(e,t)))}function g6(e){try{let t=new URL(e);return t.protocol!==`https:`&&!sU(t.host)&&(t.protocol=`https:`),t.search=``,t.hash=``,t.toString().replace(/\/$/,``)}catch{return e}}function _6(e,t){let n;if(t.disableJwtPlugin)n=e.context.baseURL;else try{n=c2(e.context).options?.jwt?.issuer??e.context.baseURL}catch{n=e.context.baseURL}return g6(n)}function v6(e,t,n){return f6(e.context.options.onAPIError?.errorURL||`${e.context.baseURL}/error`,t,n)}function y6(e){let t;try{t=new URL(e)}catch{return}let n=oU(t.hostname)||t.hostname===`localhost`;if(t.protocol!==`http:`||!n)return;let r=e.indexOf(`://`);if(r<0)return;let i=r+3,a=e.slice(i).search(/[/?#]/u),o=e.length;a>=0&&(o=i+a);let s=e.slice(i,o),c;if(s.startsWith(`[`)){let t=s.indexOf(`]`);if(t<0)return;if(s[t+1]!==`:`)return e;c=t+1}else if(c=s.lastIndexOf(`:`),c<0)return e;let l=s.slice(c+1);if(!/^\d*$/u.test(l))return;let u=i+c;return`${e.slice(0,u)}${e.slice(o)}`}function b6(e,t){if(!e||!t)return;let n;try{n=new URL(t)}catch{return}let r=t.includes(`#`),i=n.username.length>0||n.password.length>0;if(r||i)return;let a=y6(t);return e.find(e=>e===t?!0:a?y6(e)===a:!1)}async function cfe(e,t,n,r){if(!n||!r)return null;let i;try{i=await m2(e,t,n)}catch{return null}return!i||i.disabled?null:b6(i.redirectUris,r)?r:null}function x6(e){return async({error:t,error_description:n,ctx:r})=>{let i=r.query??{},a=await cfe(r,e,typeof i.client_id==`string`?i.client_id:void 0,typeof i.redirect_uri==`string`?i.redirect_uri:void 0);return a?m6(r,f6(a,t,n,typeof i.state==`string`?i.state:void 0,_6(r,e),ife(i))):m6(r,v6(r,t,n))}}async function lfe(e,t,n){if(t.grantTypes&&!t.grantTypes.includes(`authorization_code`))throw new d(`NOT_FOUND`);if(!e.request)throw new d(`UNAUTHORIZED`,{error_description:`request not found`,error:`invalid_request`});let r=e.request,i=sfe(e,n);e.query=i;let a=p6(i.request),o=p6(i.request_uri);if(a!==void 0&&o!==void 0)return x6(t)({error:`invalid_request`,error_description:`request and request_uri cannot be used together`,ctx:e});if(a!==void 0)return x6(t)({error:`request_not_supported`,error_description:`request object not supported`,ctx:e});if(o!==void 0){let n=p6(i.client_id);if(!n)return x6(t)({error:`invalid_request`,error_description:`client_id is required`,ctx:e});if(!t.requestUriResolver)return x6(t)({error:`request_uri_not_supported`,error_description:`request_uri not supported`,ctx:e});let r=await t.requestUriResolver({requestUri:o,clientId:n,ctx:e});if(!r)return x6(t)({error:`invalid_request_uri`,error_description:`request_uri is invalid or expired`,ctx:e});let a=i.client_id;i=r,a&&(i.client_id=a)}e.query=i;let s=h4.safeParse(i);if(!s.success){let n=p3(s.error.issues,afe);return x6(t)({...n,ctx:e})}if(i=s.data,e.query=i,await s6.set({query:S6(i).toString()}),!i.response_type)return x6(t)({error:`invalid_request`,error_description:`response_type is required`,ctx:e});let c=e.query?.prompt?A2(e.query?.prompt):void 0,l=c?.has(`none`)??!1;if(c?.has(`select_account`)&&!t.selectAccount?.page)return m6(e,v6(e,`unsupported_prompt_select_account`,`unsupported prompt type`));if(i.response_type!==`code`)return m6(e,v6(e,`unsupported_response_type`,`unsupported response type`));let u=await m2(e,t,i.client_id);if(!u)return m6(e,v6(e,`invalid_client`,`client_id is required`));if(u.disabled)return m6(e,v6(e,`client_disabled`,`client is disabled`));if(!w2(u,`authorization_code`))return m6(e,v6(e,`unauthorized_client`,`client is not authorized to use the authorization_code grant`));if(!b6(u.redirectUris,i.redirect_uri)||!i.redirect_uri)return m6(e,v6(e,`invalid_redirect`,`invalid redirect uri`));let f=i.scope?.split(` `).filter(e=>e);if(f){let n=new Set(u.scopes??t.scopes),r=f.filter(e=>!n?.has(e));if(r.length)return m6(e,f6(i.redirect_uri,`invalid_scope`,`The following scopes are invalid: ${r.join(`, `)}`,i.state,_6(e,t)))}f||(f=u.scopes??t.scopes??[],i.scope=f.join(` `));let p=f.includes(`openid`);if(i.claims!==void 0&&!p)return m6(e,f6(i.redirect_uri,`invalid_request`,`openid scope must be requested when using the claims parameter`,i.state,_6(e,t)));if(p&&!rle(i.claims))return m6(e,f6(i.redirect_uri,`invalid_request`,`claims must be a valid Claims request object`,i.state,_6(e,t)));if(p&&!ile(i.claims,`0`))return m6(e,f6(i.redirect_uri,`access_denied`,`essential acr requirement cannot be met`,i.state,_6(e,t)));let m=W2(i.claims,J2(t));if(i.resource!==void 0)try{await $2(e,t,{resource:i.resource,clientId:u.clientId,requestedScopes:f})}catch(n){if(n instanceof d){let r=n.body?.error??`invalid_target`,a=n.body?.error_description??`requested resource invalid`;return m6(e,f6(i.redirect_uri,r,a,i.state,_6(e,t)))}throw n}let h=I2(u,{scopes:f,nonce:i.nonce});if(h&&(!i.code_challenge||!i.code_challenge_method))return m6(e,f6(i.redirect_uri,`invalid_request`,h.valueOf(),i.state,_6(e,t)));if(i.code_challenge||i.code_challenge_method){if(!i.code_challenge||!i.code_challenge_method)return m6(e,f6(i.redirect_uri,`invalid_request`,`code_challenge and code_challenge_method must both be provided`,i.state,_6(e,t)));if(![`S256`].includes(i.code_challenge_method))return m6(e,f6(i.redirect_uri,`invalid_request`,`invalid code_challenge method, only S256 is supported`,i.state,_6(e,t)))}let g=u2(i.resource)??[],_=await CH(e),v=i.max_age,y=_!=null&&v!==void 0&&nfe(new Date(_.session.createdAt),v,/* @__PURE__ */ new Date);if(!_||_!=null&&v!==void 0&&!y||c?.has(`login`)||c?.has(`create`))return l?h6(e,t,i,`login_required`,`authentication required`):w6(e,t,c?.has(`create`)?`create`:`login`);if(y&&(i=rfe(i),e.query=i),n?.isAuthorize&&c?.has(`select_account`))return w6(e,t,`select_account`);if(n?.isAuthorize&&t.selectAccount&&await t.selectAccount.shouldRedirect({headers:r.headers,user:_.user,session:_.session,scopes:f}))return l?h6(e,t,i,`account_selection_required`,`End-User account selection is required`):w6(e,t,`select_account`);if(t.signup?.shouldRedirect){let n=await t.signup.shouldRedirect({headers:r.headers,user:_.user,session:_.session,scopes:f});if(n)return l?h6(e,t,i,`interaction_required`,`End-User interaction is required`):w6(e,t,`create`,{page:typeof n==`string`?n:void 0})}if(!n?.postLogin&&t.postLogin&&await t.postLogin.shouldRedirect({headers:r.headers,user:_.user,session:_.session,scopes:f}))return l?h6(e,t,i,`interaction_required`,`End-User interaction is required`):w6(e,t,`post_login`);if(c?.has(`consent`))return w6(e,t,`consent`,{sessionId:_.session.id});let b=await t.postLogin?.consentReferenceId?.({user:_.user,session:_.session,scopes:f});if(u.skipConsent)return C6(e,t,{query:i,clientId:u.clientId,userId:_.user.id,sessionId:_.session.id,authTime:new Date(_.session.createdAt).getTime(),referenceId:b,resource:g});let x=await e.context.adapter.findOne({model:`oauthConsent`,where:[{field:`clientId`,value:u.clientId},{field:`userId`,value:_.user.id},...b?[{field:`referenceId`,value:b}]:[]]});if(!x||!f.every(e=>x.scopes.includes(e))||!m.every(e=>(x.requestedUserInfoClaims??[]).includes(e)))return l?h6(e,t,i,`consent_required`,`End-User consent is required`):w6(e,t,`consent`,{sessionId:_.session.id});let S=x?.resources??[];return g.some(e=>!S.includes(e))?l?h6(e,t,i,`consent_required`,`End-User consent is required`):w6(e,t,`consent`,{sessionId:_.session.id}):C6(e,t,{query:i,clientId:u.clientId,userId:_.user.id,sessionId:_.session.id,authTime:new Date(_.session.createdAt).getTime(),referenceId:b,resource:g})}function S6(e){let t=new URLSearchParams;for(let[n,r]of Object.entries(e))if(r!=null){if(Array.isArray(r))for(let e of r)t.append(n,String(e));else n===`claims`&&typeof r==`object`?t.set(n,JSON.stringify(r)):t.set(n,String(r))}return t}async function C6(e,t,n){let r=AU(32,`a-z`,`A-Z`,`0-9`),i=Math.floor(Date.now()/1e3),a=i+(t.codeExpiresIn??600),o={identifier:await y2(t.storeTokens,r,`authorization_code`),updatedAt:/* @__PURE__ */ new Date(i*1e3),expiresAt:/* @__PURE__ */ new Date(a*1e3),value:JSON.stringify({type:`authorization_code`,query:n.query,userId:n.userId,sessionId:n?.sessionId,referenceId:n.referenceId,authTime:n.authTime,resource:n.resource})};await e.context.internalAdapter.createVerificationValue({...o,createdAt:/* @__PURE__ */ new Date(i*1e3)});let s=new URL(n.query.redirect_uri);return s.searchParams.set(`code`,r),n.query.state&&s.searchParams.set(`state`,n.query.state),s.searchParams.set(`iss`,_6(e,t)),m6(e,s.toString())}async function w6(e,t,n,r){let i=await ufe(e,t,{postLoginClearedForSession:n===`consent`&&t.postLogin?r?.sessionId:void 0}),a=t.loginPage;if(n===`select_account`)a=t.selectAccount?.page??t.loginPage;else if(n===`post_login`){if(!t.postLogin?.page)throw new d(`INTERNAL_SERVER_ERROR`,{error_description:`postLogin should have been defined`});a=t.postLogin?.page}else n===`consent`?a=t.consentPage:n===`create`&&(a=t.signup?.page??t.loginPage);return m6(e,`${r?.page??a}?${i}`)}async function ufe(e,t,n){let r=Date.now(),i=Math.floor(r/1e3)+(t.codeExpiresIn??600),a=S6(e.query);a.set(`exp`,String(i)),a.set(G0,String(r)),a.delete(`sig`),a.delete(K0),n?.postLoginClearedForSession&&a.set(K0,n.postLoginClearedForSession),xce(a);let o=await zW(J0(a).toString(),e.context.secret);return a.set(`sig`,o),a.toString()}const dfe=/\/(?:\.|%2e)(?:\.|%2e)?(?:\/|$|#|\?)/i,ffe=/* @__PURE__ */ new Set([`client_secret_post`,`client_secret_basic`,`client_secret_jwt`]);function T6(e){let t;try{t=new URL(e)}catch{return!1}return t.protocol===`https:`}function pfe(e){if(dfe.test(e))return`client_id URL MUST NOT contain dot segments`;if(e.includes(`#`))return`client_id URL MUST NOT contain a fragment`;let t;try{t=new URL(e)}catch{return`client_id is not a valid URL`}if(t.protocol!==`https:`)return`client_id URL must use HTTPS`;let n=/^https:\/\//i.exec(e);if(!n||e.includes(`\\`))return`client_id URL MUST use an explicit HTTPS authority form`;let r=e.slice(n[0].length),i=r.search(/[/?#]/);return i===0?`client_id URL MUST use an explicit HTTPS authority form`:i<0||r[i]!==`/`?`client_id URL MUST contain an explicit path component`:t.username||t.password?`client_id URL MUST NOT contain credentials`:cU(t.hostname)?null:`client_id URL must not target a private or reserved address`}function mfe(e){let t=[];try{let n=new URL(e);n.pathname===`/`&&t.push(`client_id URL path / is NOT RECOMMENDED (§3)`),n.search&&t.push(`client_id URL SHOULD NOT contain a query string (§3)`)}catch{}return t}function hfe(e){try{let t=new URL(e);return t.protocol===`http:`||t.protocol===`https:`||L2(t)}catch{return!1}}function gfe(e,t,n={}){if(!t||typeof t!=`object`)return{valid:!1,error:`metadata document is not a JSON object`};for(let e of Object.keys(t))if(b3(e))return{valid:!1,error:`metadata document MUST NOT contain "${e}"`};let r=Ale.strip().safeParse(t);if(!r.success){let e=r.error.issues[0];return{valid:!1,error:`${e?.path.join(`.`)||`metadata document`}: ${e?.message??`invalid client metadata`}`}}let i=r.data,a=[];if(i.client_id!==e)return{valid:!1,error:`client_id "${String(i.client_id)}" does not match the metadata document URL`};if(n.metadataProfile===`mcp-2026-07-28`&&!i.client_name?.trim())return{valid:!1,error:`client_name must be a non-empty string`};for(let e of[`backchannel_logout_uri`,`backchannel_logout_session_required`])if(i[e]!==void 0)return{valid:!1,error:`metadata document MUST NOT contain "${e}"`};let o=/* @__PURE__ */ new Set([`none`,`private_key_jwt`]);if(typeof i.token_endpoint_auth_method==`string`){if(ffe.has(i.token_endpoint_auth_method))return{valid:!1,error:`symmetric auth method "${i.token_endpoint_auth_method}" is prohibited for Client ID Metadata Document clients`};if(!o.has(i.token_endpoint_auth_method))return{valid:!1,error:`token_endpoint_auth_method must be "none" or "private_key_jwt" for Client ID Metadata Document clients`};if(i.token_endpoint_auth_method===`private_key_jwt`&&!i.jwks&&!i.jwks_uri)return{valid:!1,error:`private_key_jwt requires either jwks or jwks_uri in the metadata document`}}if(i.jwks&&!y3(i.jwks).valid)return{valid:!1,error:`jwks must contain only structurally valid public keys`};if(i.jwks_uri)try{let e=new URL(i.jwks_uri);if(e.username||e.password)return{valid:!1,error:`jwks_uri must not contain credentials`};if(i.jwks_uri.includes(`#`))return{valid:!1,error:`jwks_uri must not contain a fragment`}}catch{return{valid:!1,error:`jwks_uri must be a valid URL`}}if(n.metadataProfile===`mcp-2026-07-28`&&!i.redirect_uris||i.redirect_uris&&!i.redirect_uris.every(e=>hfe(e)))return{valid:!1,error:`redirect_uris must be a non-empty array of absolute HTTP(S) or private-use URIs`};for(let e of[`client_uri`,`logo_uri`,`tos_uri`,`policy_uri`]){if(i[e]!==void 0&&typeof i[e]!=`string`)return{valid:!1,error:`${e} must be a string`};if(typeof i[e]==`string`)try{let t=new URL(i[e]);if(t.protocol!==`https:`&&t.protocol!==`http:`)return{valid:!1,error:`${e} must use HTTP(S)`};if(t.username||t.password)return{valid:!1,error:`${e} must not contain credentials`};if(!cU(t.hostname))return{valid:!1,error:`${e} must not point to a private or reserved address`}}catch{return{valid:!1,error:`${e} is not a valid URL`}}}let s=n.originBoundFields??[`post_logout_redirect_uris`,`client_uri`],c;try{c=new URL(e).origin}catch{return{valid:!1,error:`client_id is not a valid URL`}}for(let e of s){let t=i[e];if(t===void 0)continue;let n;if(typeof t==`string`)n=[t];else if(Array.isArray(t)){if(!t.every(e=>typeof e==`string`))return{valid:!1,error:`${e} must be a string or an array of strings`};n=t}else return{valid:!1,error:`${e} must be a string or an array of strings`};for(let t of n){let n;try{n=new URL(t)}catch{return{valid:!1,error:`${e} contains an invalid URL: "${t}"`}}let r=e===`redirect_uris`||e===`post_logout_redirect_uris`,i=r&&L2(n);if(n.protocol!==`https:`&&n.protocol!==`http:`&&!i)return{valid:!1,error:`all values for ${e} must use HTTP(S) or an authority-free private-use scheme`};if(i)continue;let a=r&&sU(n.hostname);if(n.origin!==c&&!a)return{valid:!1,error:`${e} value "${t}" must have the same origin as client_id (${c})`}}}return a.push(...mfe(e)),{valid:!0,metadata:{...i,token_endpoint_auth_method:i.token_endpoint_auth_method??`none`},...a.length>0?{warnings:a}:{}}}const E6=5e3,D6=5120,_fe=/^application\/(?:[-\w.]+\+)?json\s*(?:;|$)/i,O6=`Failed to fetch metadata document (network error or redirect blocked)`,k6=`cimd`;function A6(e){return new d(`BAD_REQUEST`,{error:`invalid_client`,error_description:e})}function j6(){return A6(`Metadata document exceeds ${D6/1024}KB size limit`)}async function vfe(e,t,n){let r=e.body?.getReader();if(!r){let n=await e.text();if(new TextEncoder().encode(n).byteLength>t)throw j6();return n}let i=[],a=0,o,s=new Promise((e,t)=>{o=t}),c=()=>{o?.(/* @__PURE__ */ Error(`Metadata document body read aborted`)),r.cancel().catch(()=>{})};n.aborted?c():n.addEventListener(`abort`,c,{once:!0});try{for(;;){let{done:e,value:n}=await Promise.race([r.read(),s]);if(e)break;if(a+=n.byteLength,a>t)throw await r.cancel(),j6();i.push(n)}}finally{n.removeEventListener(`abort`,c),r.releaseLock()}let l=new Uint8Array(a),u=0;for(let e of i)l.set(e,u),u+=e.byteLength;return new TextDecoder().decode(l)}function yfe(e){return{cacheControl:e.get(`cache-control`)??void 0,vary:e.get(`vary`)??void 0,expires:e.get(`expires`)??void 0,date:e.get(`date`)??void 0,age:e.get(`age`)??void 0,etag:e.get(`etag`)??void 0,lastModified:e.get(`last-modified`)??void 0}}async function bfe(e,t,n,r){let i=pfe(t);if(i)throw A6(i);if(n.isMetadataDocumentUrlAllowed&&!await n.isMetadataDocumentUrlAllowed(t,e))throw A6(`client_id URL is not permitted by the server's fetch policy`);let a=new Headers({Accept:`application/json`});r?.etag&&a.set(`If-None-Match`,r.etag),r?.lastModified&&a.set(`If-Modified-Since`,r.lastModified);let o,s=new AbortController,c=!1,l=setTimeout(()=>{c=!0,s.abort()},E6);try{try{o=await n.fetchClientMetadataResource(t,{headers:a,redirect:`error`,signal:s.signal})}catch{throw A6(c?`Metadata document fetch timed out after ${E6}ms`:O6)}if(o.redirected)throw A6(`Metadata document fetch must not follow redirects`);let i=yfe(o.headers);if(o.status===304){if(!r?.etag&&!r?.lastModified)throw A6(`Metadata document returned 304 without a conditional validator`);return{status:`not-modified`,cacheHeaders:i}}if(o.status!==200)throw A6(`Metadata document fetch returned HTTP ${o.status}`);let l=o.headers.get(`content-type`)??``;if(!_fe.test(l))throw A6(`Metadata document must be JSON (got Content-Type "${l||`(none)`}")`);let u;try{let e=o.headers.get(`content-length`);if(e){let t=Number.parseInt(e,10);if(Number.isFinite(t)&&t>D6)throw await o.body?.cancel(),j6()}u=await vfe(o,D6,s.signal)}catch(e){throw c?A6(`Metadata document fetch timed out after ${E6}ms`):e instanceof d?e:A6(O6)}let f;try{f=JSON.parse(u)}catch{throw A6(`Metadata document is not valid JSON`)}let p=gfe(t,f,{originBoundFields:n.originBoundFields,metadataProfile:n.metadataProfile});if(!p.valid)throw A6(p.error);for(let t of p.warnings??[])e.context.logger.warn(`cimd metadata document warning: ${t}`);return{status:`modified`,metadata:p.metadata,cacheHeaders:i}}finally{clearTimeout(l)}}async function M6(e,t,n,r,i,a){let o=a?{...a}:void 0,s=await W3(e,i,{clientId:t,clientDiscoveryId:k6,metadata:{...n,client_id:n.client_id,redirect_uris:n.redirect_uris??[]},existingClient:a});if(s.created)try{await r.onClientCreated?.({client:s.client,clientMetadataDocument:n,context:e})}catch(t){e.context.logger.error(`cimd onClientCreated notification failed`,t)}else try{o&&await r.onClientRefreshed?.({client:s.client,previousClient:o,clientMetadataDocument:n,context:e})}catch(t){e.context.logger.error(`cimd onClientRefreshed notification failed`,t)}return s.client}const N6={minimumFetchInterval:1,maximumConcurrentFetches:16,maximumConcurrentFetchesPerOrigin:4,maximumFetchesPerMinute:120,maximumFetchesPerOriginPerMinute:30};function xfe(e){return new d(`BAD_REQUEST`,{error:`invalid_client`,error_description:e})}function P6(e){return new d(`TOO_MANY_REQUESTS`,{error:`temporarily_unavailable`,error_description:e})}function Sfe(e,t){if(typeof e==`number`){if(!Number.isFinite(e)||e<0)throw new l(`cimd metadataFetchPolicy.${t} must be a non-negative number of seconds or duration string`);return e*1e3}try{let t=Math.floor(Date.now()/1e3),n=(M0(e,t)-t)*1e3;if(!Number.isFinite(n)||n<0)throw Error(`negative duration`);return n}catch{throw new l(`cimd metadataFetchPolicy.${t} must be a non-negative number of seconds or duration string`)}}function F6(e,t){if(!Number.isInteger(e)||e<1)throw new l(`cimd metadataFetchPolicy.${t} must be a positive integer`);return e}function Cfe(e){let t=e.metadataFetchPolicy;return{minimumFetchIntervalMs:Sfe(t?.minimumFetchInterval??N6.minimumFetchInterval,`minimumFetchInterval`),maximumConcurrentFetches:F6(t?.maximumConcurrentFetches??N6.maximumConcurrentFetches,`maximumConcurrentFetches`),maximumConcurrentFetchesPerOrigin:F6(t?.maximumConcurrentFetchesPerOrigin??N6.maximumConcurrentFetchesPerOrigin,`maximumConcurrentFetchesPerOrigin`),maximumFetchesPerMinute:F6(t?.maximumFetchesPerMinute??N6.maximumFetchesPerMinute,`maximumFetchesPerMinute`),maximumFetchesPerOriginPerMinute:F6(t?.maximumFetchesPerOriginPerMinute??N6.maximumFetchesPerOriginPerMinute,`maximumFetchesPerOriginPerMinute`)}}function I6(e,t){let n=t-6e4,r=0;for(;r<e.length&&e[r]<=n;)r+=1;r>0&&e.splice(0,r)}function wfe(e,t){if(typeof e==`number`)return Math.max(0,e*1e3);let n=Math.floor(t/1e3);return Math.max(0,(M0(e,n)-n)*1e3)}function Tfe(e){let t=/* @__PURE__ */ new Map,n=/* @__PURE__ */ new Set;for(let r of e?.split(`,`)??[]){let[e,...i]=r.trim().split(`=`),a=e?.toLowerCase();if(!a)continue;t.has(a)&&n.add(a);let o=i.join(`=`).trim();t.set(a,!o||o.replace(/^"|"$/g,``))}return{directives:t,duplicates:n}}function L6(e){if(typeof e!=`string`||!/^\d+$/.test(e))return null;let t=Number(e);return Number.isSafeInteger(t)?t:null}function Efe(e,t,n){let{directives:r,duplicates:i}=Tfe(e.cacheControl),a=e.vary?.split(`,`).some(e=>e.trim()===`*`);if(r.has(`no-store`)||r.has(`private`)||a)return{cacheable:!1,expiresAt:n};let o=wfe(t,n);if(r.has(`no-cache`))return{cacheable:!0,expiresAt:n};let s=L6(e.age)??0,c=e.date?Date.parse(e.date):n,l=Number.isFinite(c)?Math.max(0,n-c):0,u=Math.max(l,s*1e3),d=null,f=r.has(`s-maxage`),p=L6(r.get(`s-maxage`)),m=r.has(`max-age`),h=L6(r.get(`max-age`)),g=f?p===null||i.has(`s-maxage`):m&&(h===null||i.has(`max-age`)),_=f?p:h;if(g)d=0;else if(_!==null)d=Math.max(0,_*1e3-u);else if(e.expires){let t=Date.parse(e.expires);Number.isFinite(t)&&(d=Math.max(0,t-(Number.isFinite(c)?c:n)-u))}return{cacheable:!0,expiresAt:n+Math.min(o,d??o)}}function Dfe(e,t){return{cacheControl:t.cacheControl??e.cacheControl,vary:t.vary??e.vary,expires:t.expires??e.expires,date:t.date??e.date,age:t.age??e.age,etag:t.etag??e.etag,lastModified:t.lastModified??e.lastModified}}function Ofe(e,t,n,r){let i=Efe(t,n,r);return i.cacheable?{metadata:e,expiresAt:i.expiresAt,etag:t.etag,lastModified:t.lastModified,responseCacheHeaders:t}:null}function kfe(e){let t=e.metadataRevalidationInterval??`60m`,n=e.maxCacheEntries??1e3;if(!Number.isInteger(n)||n<1)throw new l(`cimd maxCacheEntries must be a positive integer`);let r=Cfe(e),i=/* @__PURE__ */ new Map,a=/* @__PURE__ */ new Map,o=/* @__PURE__ */ new Map,s=/* @__PURE__ */ new Map,c=[],u=0,d=e=>{let t=i.get(e);if(t)return i.delete(e),i.set(e,t),t},f=(e,t)=>{for(i.delete(e);i.size>=n;){let e=i.keys().next().value;if(typeof e!=`string`)break;i.delete(e)}i.set(e,t)},p=(e,t)=>{if(!o.has(e))for(;o.size>=n;){let e=!1;for(let[n,i]of o)if(!a.has(n)&&!(r.minimumFetchIntervalMs>0&&t-i<r.minimumFetchIntervalMs)){o.delete(n),e=!0;break}if(!e)throw P6(`metadata fetch client state is at capacity`)}},m=(e,t)=>{let r=s.get(e);if(r)return I6(r.fetchStartTimesMs,t),s.delete(e),s.set(e,r),r;for(;s.size>=n;){let e=!1;for(let[n,r]of s)if(I6(r.fetchStartTimesMs,t),!(r.activeFetchCount>0||r.fetchStartTimesMs.length>0)){s.delete(n),e=!0;break}if(!e)throw P6(`metadata fetch origin state is at capacity`)}let i={activeFetchCount:0,fetchStartTimesMs:[]};return s.set(e,i),i},h=e=>{let t=Date.now(),n=o.get(e);if(r.minimumFetchIntervalMs>0&&n!==void 0&&t-n<r.minimumFetchIntervalMs)throw P6(`metadata document fetch is within the per-client minimum interval`);p(e,t);let i=new URL(e).origin,a=m(i,t);if(I6(c,t),u>=r.maximumConcurrentFetches)throw P6(`global metadata fetch concurrency limit exceeded`);if(a.activeFetchCount>=r.maximumConcurrentFetchesPerOrigin)throw P6(`metadata fetch concurrency limit exceeded for client origin`);if(c.length>=r.maximumFetchesPerMinute)throw P6(`global metadata fetch rate limit exceeded`);if(a.fetchStartTimesMs.length>=r.maximumFetchesPerOriginPerMinute)throw P6(`metadata fetch rate limit exceeded for client origin`);o.delete(e),o.set(e,t),c.push(t),a.fetchStartTimesMs.push(t),u+=1,a.activeFetchCount+=1;let s=!1;return()=>{s||(s=!0,--u,--a.activeFetchCount)}};return async(n,r,s)=>{if(!T6(r))return null;let c=n.context.getPlugin(`oauth-provider`);if(!c)throw new l(`cimd discovery invoked without the oauth-provider plugin installed`);let u=c.options,p=d(r),m=Date.now();if(p&&p.expiresAt>m)return s||M6(n,r,p.metadata,e,u);let g=a.get(r);if(g)return g;let _=h(r),v=(async()=>{let a=await bfe(n,r,e,p?{etag:p.etag,lastModified:p.lastModified}:void 0);if(a.status===`not-modified`&&!p)throw xfe(`Metadata document returned 304 without a validated cached document`);let c=a.status===`modified`?a.metadata:p.metadata,l=await M6(n,r,c,e,u,s??void 0),d=Ofe(c,a.status===`modified`?a.cacheHeaders:Dfe(p.responseCacheHeaders,a.cacheHeaders),t,Date.now());return d?f(r,d):i.delete(r),o.delete(r),l})();a.set(r,v);try{return await v}catch(e){throw o.delete(r),o.set(r,Date.now()),e}finally{a.get(r)===v&&a.delete(r),_()}}}function Afe(e){return{id:k6,matches:T6,resolve:kfe(e),fetchClientMetadataResource:e.fetchClientMetadataResource,discoveryMetadata:{client_id_metadata_document_supported:!0}}}const jfe=e=>{let t=Afe(e);return{id:`cimd`,version:`1.7.5`,init(e){Ace(e,{clientDiscovery:t})}}},R6=(e,t)=>e===t||e.endsWith(`.${t}`),Mfe=e=>{try{return new URL(`https://${e}`).hostname===e&&e.includes(`.`)&&!dn(e)}catch{return!1}},z6=(e,t)=>e.protocol===`https:`||e.protocol===`http:`&&([`localhost`,`127.0.0.1`,`[::1]`].includes(e.hostname)||t),B6=`HTTPS origins (HTTP allowed on loopback, or anywhere with CLANKERAUTH_ALLOW_INSECURE_HTTP=true)`,V6=(e,t)=>URL.canParse(e)&&new URL(e).origin===e&&z6(new URL(e),t),H6=V(function*(e){let{allowInsecureHttp:t,baseURL:n,cookieDomain:r}=e;return V6(n,t)?pT(e.secret).length<32?yield*R(/* @__PURE__ */ Error(`CLANKERAUTH_BETTER_AUTH_SECRET must have at least 32 characters`)):e.mcpAllowedOrigins.every(e=>V6(e,t))?r!==void 0&&(!Mfe(r)||!R6(new URL(n).hostname,r))?yield*R(/* @__PURE__ */ Error(`CLANKERAUTH_COOKIE_DOMAIN must be a bare parent domain of the CLANKERAUTH_BASE_URL host, such as home.example`)):e:yield*R(/* @__PURE__ */ Error(`CLANKERAUTH_MCP_ALLOWED_ORIGINS must contain exact ${B6}`)):yield*R(/* @__PURE__ */ Error(`CLANKERAUTH_BASE_URL must be one of: ${B6}`))});mh(function*(){let e={baseURL:yield*VA(`CLANKERAUTH_BASE_URL`),secret:yield*GA(`CLANKERAUTH_BETTER_AUTH_SECRET`),database:yield*VA(`CLANKERAUTH_DATABASE`).pipe(kA(`data/clankerauth.sqlite`)),host:yield*VA(`CLANKERAUTH_HOST`).pipe(kA(`127.0.0.1`)),port:yield*WA(`CLANKERAUTH_PORT`).pipe(kA(3e3)),mcpAllowedOrigins:yield*HA(YD,`CLANKERAUTH_MCP_ALLOWED_ORIGINS`).pipe(kA([])),trustProxy:yield*UA(`CLANKERAUTH_TRUST_PROXY`).pipe(kA(!1)),allowInsecureHttp:yield*UA(`CLANKERAUTH_ALLOW_INSECURE_HTTP`).pipe(kA(!1)),cookieDomain:yield*VA(`CLANKERAUTH_COOKIE_DOMAIN`).pipe(kA(void 0))};return yield*H6(e)});const U6=`clankerauth_forward`,Nfe=TE(W({subject:U,audience:U,scope:U})),Pfe=(e,t)=>({id:`forward-tokens`,endpoints:{signForwardToken:Y.serverOnly({method:`POST`,body:Nfe},async n=>{let r=Math.floor(Date.now()/1e3),i=await I0(n,{options:e,header:{typ:`at+jwt`},payload:{sub:n.body.subject,aud:n.body.audience,client_id:`forward-auth`,scope:n.body.scope,iat:r,exp:r+t}});return n.json({token:i})})}}),W6=(e,t)=>dN({error:t},{status:e}),Ffe=e=>vm(B(G6,t=>{let{settings:n}=t,r=t=>{if(!URL.canParse(t))return;let r=new URL(t);return!r.username&&!r.password&&z6(r,n.allowInsecureHttp)&&R6(r.hostname,e)?r:void 0},i=pT(n.secret),a=e$(n.baseURL),o=new URL(`/login`,n.baseURL),s={domain:e,path:`/`,httpOnly:!0,secure:n.baseURL.startsWith(`https:`),sameSite:`lax`},c=t.context.authCookies.sessionToken.name,l=(e,t)=>{let r=new URL(e,n.baseURL);return r.searchParams.set(`rd`,t.href),r},u=e=>LQ(()=>t.auth.api.getSession({headers:new Headers({cookie:e})})),d=mh(function*(){let e=yield*cP,{headers:o}=e,s=o[`x-forwarded-proto`],d=o[`x-forwarded-host`],f=s&&d?r(`${s}://${d}${o[`x-forwarded-uri`]??`/`}`):void 0;if(!f)return W6(400,`invalid_forwarded_request`);let p=new URL(e.url,n.baseURL).searchParams.get(`resource`),m=p&&p!==a&&(yield*t.resources.get(p));if(!m)return W6(403,`unknown_resource`);let h=e.cookies[U6],g=h?yield*Dh(ch(()=>LW({key:i,data:h}))):Ta(),_=Oa(g)?yield*u(`${c}=${g.value}`):null;if(!_)return o[`sec-fetch-mode`]===`navigate`?sN(l(`/forward-auth/continue`,f)):W6(401,`unauthenticated`);let{token:v}=yield*LQ(()=>t.auth.api.signForwardToken({body:{subject:_.user.id,audience:m.identifier,scope:m.scopes.join(` `)}}));return oN({status:204,headers:{authorization:`Bearer ${v}`}})}),f=mh(function*(){let e=yield*cP,t=new URL(e.url,n.baseURL).searchParams.get(`rd`),a=t?r(t):void 0;if(!a)return W6(400,`invalid_return_url`);let o=e.cookies[c];if(!(o&&(yield*u(e.headers.cookie??``)))||!o)return sN(l(`/login`,l(`/forward-auth/continue`,a)));let d=yield*ch(()=>IW({key:i,data:o}));return yield*sN(a).pipe(_N(U6,d,s))}),p=mh(function*(){let e=yield*cP,i=new URL(e.url,n.baseURL).searchParams.get(`rd`),a=i&&r(i)||o,{headers:c}=yield*LQ(()=>t.auth.api.signOut({headers:new Headers({cookie:e.headers.cookie??``}),returnHeaders:!0}));return yield*vN(sN(a),wT(c.getSetCookie())).pipe(_N(U6,``,{...s,maxAge:0}))});return bm(bP(`GET`,`/forward-auth`,jh(d,BQ)),bP(`GET`,`/forward-auth/continue`,jh(f,BQ)),bP(`GET`,`/forward-auth/logout`,jh(p,BQ)))})),Ife=/* @__PURE__ */ new Set([204,205,304]);function Lfe(e){let t=new Headers;for(let[n,r]of Object.entries(e))if(Array.isArray(r))for(let e of r)t.append(n,e);else r!==void 0&&t.append(n,r);return t}const Rfe=async(e,t)=>{let n=new Request(e,t),r=new URL(n.url);if(r.protocol!==`https:`)throw TypeError(`CIMD Node transport requires an HTTPS URL`);if(n.method!==`GET`&&n.method!==`HEAD`)throw TypeError(`CIMD Node transport supports only GET and HEAD`);let i=await wn(r.hostname,{all:!0,verbatim:!0});if(i.length===0)throw TypeError(`metadata hostname returned no DNS addresses`);for(let e of i)if(!cU(e.address))throw TypeError(`metadata hostname must resolve only to public-routable addresses`);let a=i[0],o=Object.fromEntries(n.headers.entries());o.host=r.host;let s=t?.signal??(e instanceof Request?e.signal:n.signal);return new Promise((e,t)=>{let i=_n(r,{agent:!1,headers:o,method:n.method,servername:dn(r.hostname.replace(/^\[|\]$/g,``))===0?r.hostname:void 0,signal:s,lookup:(e,t,n)=>{t.all?n(null,[a]):n(null,a.address,a.family)}},t=>{let r=t.statusCode??500,i=n.method===`HEAD`||Ife.has(r)?null:cn.toWeb(t);e(new Response(i,{headers:Lfe(t.headers),status:r,statusText:t.statusMessage}))});i.once(`error`,t),i.end()})};function zfe(e,t=8){let n=0;return(r,i)=>{let a=i?.signal??(r instanceof Request?r.signal:void 0);return a?.aborted?Promise.reject(a.reason):n>=t?Promise.reject(/* @__PURE__ */ Error(`CIMD transport capacity reached`)):(n++,new Promise((t,o)=>{let s=!1,c=()=>{s=!0,o(a?.reason)};a?.addEventListener(`abort`,c,{once:!0});let l=()=>{n--,a?.removeEventListener(`abort`,c)};Promise.resolve().then(()=>(a?.throwIfAborted(),e(r,i))).then(e=>{l(),s?e.body?.cancel().catch(()=>{}):t(e)},e=>{l(),o(e)})}))}}const Bfe=zfe(Rfe);function Vfe(e){let t=H(`Clients.revoke`)(function*(e,t){return(yield*t`SELECT 1 FROM oauthClient WHERE clientId = ${e}`).length?(yield*t`DELETE FROM oauthConsent WHERE clientId = ${e}`,yield*t`DELETE FROM verification WHERE json_valid(value) AND json_extract(value, '$.type') = 'authorization_code' AND json_extract(value, '$.query.client_id') = ${e}`,yield*t`DELETE FROM oauthAccessToken WHERE clientId = ${e}`,yield*t`DELETE FROM oauthRefreshToken WHERE clientId = ${e}`,{revoked:!0}):yield*R(new $Z({error:`Client not found`}))});return{revoke:n=>ZQ(e,e=>t(n,e)),block:(n,r)=>ZQ(e,e=>mh(function*(){if(r)yield*t(n,e);else if(!(yield*e`SELECT 1 FROM oauthClient WHERE clientId = ${n}`).length)return yield*R(new $Z({error:`Client not found`}));return yield*e`UPDATE oauthClient SET disabled = ${+!!r}, updatedAt = ${yield*Om} WHERE clientId = ${n}`,{blocked:r}}))}}const Hfe=e=>typeof e==`string`,Ufe=YQ(W({id:U})),Wfe=H(`Auth.open`)(function*(e,t){let n={disableSettingJwtHeader:!0,jwt:{issuer:`${e.baseURL}/api/auth`},jwks:{keyPairConfig:{alg:`EdDSA`,crv:`Ed25519`}}},r=Pg(yield*Qh());yield*vh(()=>mn($t(e.database),{recursive:!0,mode:448}));let i=yield*cg(ch(()=>QQ(e.database)),e=>sh(()=>e.close())),{sql:a}=i,o=Vfe(i.kysely),s=H(`Auth.owner`)(function*(){let e=yield*a`SELECT id FROM user LIMIT 1`;if(e.length)return(yield*Ufe(e[0])).id}),l=d6({loginPage:`/login`,consentPage:`/consent`,scopes:[...t$],resources:[{identifier:e$(e.baseURL),name:`clankerauth administration`,allowedScopes:[...t$,$Q]}],rateLimit:{register:{window:60,max:10}},postLogin:{page:`/consent`,shouldRedirect:()=>!1,consentReferenceId:async({scopes:e})=>{let t=await c6(),n=new URLSearchParams(t?.query),i=n.getAll(`resource`);if(i.length!==1||!await r(u.get(i[0])))throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`Choose exactly one Resource`});let a=n.get(`client_id`);if(!a||!await r(u.hasAccess(a,i[0])))throw new c(`BAD_REQUEST`,{error:`invalid_target`,error_description:`Client access is required`});let o=await r(u.scopesFor(i));if(e.some(e=>!o.includes(e)))throw new c(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`Resource scopes changed; start authorization again`});return n$(i[0])}},grantTypes:[`authorization_code`,`refresh_token`],allowDynamicClientRegistration:!0,allowUnauthenticatedClientRegistration:!0,clientRegistrationRequirePKCE:!0,clientRegistrationDefaultResources:[],enforcePerClientResources:!0,accessTokenExpiresIn:900,refreshTokenExpiresIn:2592e3,refreshTokenReuseInterval:30,codeExpiresIn:120,clientPrivileges:async({user:e,action:t})=>!!e&&t!==`configure-client-credentials-scopes`,resourcePrivileges:async({user:e})=>!!e}),u=yield*l$(a,()=>f,(e,t)=>{l.options.scopes=e,l.options.clientRegistrationDefaultResources=t},e$(e.baseURL)),d={appName:`clankerauth`,baseURL:e.baseURL,secret:pT(e.secret),database:{db:i.kysely,type:`sqlite`,transaction:!0},trustedOrigins:[e.baseURL],logger:{disabled:!0},disabledPaths:[`/token`],emailAndPassword:{enabled:!0,minPasswordLength:8,maxPasswordLength:128},databaseHooks:{user:{create:{before:async()=>{if(await(await GR((await f.$context).adapter)).count({model:`user`}))throw new c(`CONFLICT`,{message:`Setup already completed`})}}}},hooks:{before:gL(async e=>{if(e.path===`/oauth2/register`){let t=e.body.redirect_uris;!e.body.application_type&&Array.isArray(t)&&t.some(e=>{if(!Hfe(e))return!1;try{return new URL(e).protocol!==`https:`}catch{return!1}})&&(e.body.application_type=`native`)}})},session:{expiresIn:2592e3,updateAge:86400},advanced:{ipAddress:{ipAddressHeaders:[`x-clankerauth-peer`]}},rateLimit:{enabled:!0,storage:`database`,window:60,max:100,customRules:{"/sign-in/email":{window:60,max:5}}},plugins:[A0({defaultPrefix:`clankerauth_`,maximumNameLength:100,enableSessionForAPIKeys:!1,keyExpiration:{defaultExpiresIn:null,minExpiresIn:0},rateLimit:{enabled:!0,timeWindow:6e4,maxRequests:1e3}}),bce(n),Pfe(n,900),l,jfe({fetchClientMetadataResource:(e,n)=>(t.cimdTransport??Bfe)(e,n),metadataProfile:`mcp-2026-07-28`,metadataRevalidationInterval:300,maxCacheEntries:1e3,metadataFetchPolicy:{maximumConcurrentFetches:8,maximumConcurrentFetchesPerOrigin:2,maximumFetchesPerMinute:60,maximumFetchesPerOriginPerMinute:15}})]},{auth:f,context:p}=yield*H(`Auth.initialize`)(function*(){let e=yield*ch(()=>j$(d));if(e.schemaProblems.length)return yield*R(/* @__PURE__ */ Error(`Database schema requires manual repair`));yield*ch(()=>e.runMigrations());let t=h1(d);return{auth:t,context:yield*ch(()=>t.$context)}},yg)();return yield*u.synchronize(),{auth:f,context:p,sql:a,database:i.kysely,owner:s,settings:e,resources:u,clients:o,setup:yield*iS(1)}});var G6=class e extends N()(`clankerauth/Auth`){static layer=(t,n={})=>pm(e,Wfe(t,n))};const K6=H(`Auth.createOwner`)(function*(e,t){if(yield*e.owner())return yield*R(new eQ({error:`Setup already completed`}));let{headers:n}=yield*LQ(()=>e.auth.api.signUpEmail({body:{name:`Owner`,email:t.email.trim(),password:t.password},returnHeaders:!0}));return n.getSetCookie()},(e,t)=>t.setup.withPermit(e));var q6=class extends N()(`clankerauth/CurrentOwner`){};const Gfe=e=>z(zQ(e),R),Kfe=B(G6,e=>u$(q6,mh(function*(){let t=yield*cP,n=new Headers(t.headers),r=yield*LQ(()=>e.auth.api.getSession({headers:n}));return r?{providerHeaders:F(n),userId:r.user.id,email:r.user.email}:yield*R(new ZZ({error:`Owner session required`}))}).pipe(jh(Gfe)))),qfe=YQ(W({id:U,email:U})),Jfe=V(function*(e){let t=yield*G6,n=()=>({error:new ZZ({error:`Owner authorization required`}),headers:{"www-authenticate":e.challenge(!0)}}),r=e=>({error:e,headers:{}});return u$(q6,mh(function*(){let i=yield*cP,a=i.headers.authorization!==void 0,o=yield*e.verifier.verify(i.headers.authorization).pipe(Ih(t=>e.refuse(t,a)));if(o.actor.kind!==`client`)return yield*R(n());let s=yield*t.sql`SELECT u.id, u.email FROM user u
511
511
  JOIN oauthClient c ON c.clientId = ${o.actor.clientId}
512
- WHERE u.id = ${o.subject} AND c.disabled IS NOT 1`.pipe(Ih(r));if(!s[0])return yield*R(n());let c=yield*qfe(s[0]).pipe(Ih(r));return{userId:c.id,email:c.email,providerHeaders:p$(t,c.id)}}).pipe(jh(({error:e,headers:t})=>z(zQ(e,t),R))))});var J6=class extends N()(`ClankerAuth/ResponseCookies`){};const Yfe=EP()(e=>mh(function*(){let t=[],n=yield*ig(e,J6,{add:e=>I(()=>t.push(...e))});return t.length?vN(n,wT(t)):n})),Xfe=YQ(G(W({clientId:U,name:uD(U),redirectUris:KD(G(U)),tokenEndpointAuthMethod:uD(U),applicationType:uD(U),scopes:uD(KD(G(U))),grantTypes:uD(KD(G(U))),disabled:uD(ZE),clientDiscoveryId:uD(U),userId:uD(U)}))),Y6=B(G6,e=>{let{auth:t,settings:n}=e;return{setup:H(`Administration.setup`)(function*(t){let n=yield*K6(e,t);return yield*(yield*J6).add(n),{created:!0}}),list:H(`Administration.list`)(function*(){let{email:t}=yield*q6,r=yield*e.sql`
512
+ WHERE u.id = ${o.subject} AND c.disabled IS NOT 1`.pipe(Ih(r));if(!s[0])return yield*R(n());let c=yield*qfe(s[0]).pipe(Ih(r));return{userId:c.id,email:c.email,providerHeaders:p$(t,c.id)}}).pipe(jh(({error:e,headers:t})=>z(zQ(e,t),R))))});var J6=class extends N()(`clankerauth/ResponseCookies`){};const Yfe=EP()(e=>mh(function*(){let t=[],n=yield*ig(e,J6,{add:e=>I(()=>t.push(...e))});return t.length?vN(n,wT(t)):n})),Xfe=YQ(G(W({clientId:U,name:uD(U),redirectUris:KD(G(U)),tokenEndpointAuthMethod:uD(U),applicationType:uD(U),scopes:uD(KD(G(U))),grantTypes:uD(KD(G(U))),disabled:uD(ZE),clientDiscoveryId:uD(U),userId:uD(U)}))),Y6=B(G6,e=>{let{auth:t,settings:n}=e;return{setup:H(`Administration.setup`)(function*(t){let n=yield*K6(e,t);return yield*(yield*J6).add(n),{created:!0}}),list:H(`Administration.list`)(function*(){let{email:t}=yield*q6,r=yield*e.sql`
513
513
  SELECT clientId, name, redirectUris, tokenEndpointAuthMethod, applicationType, scopes,
514
514
  grantTypes, disabled, clientDiscoveryId, userId
515
515
  FROM oauthClient ORDER BY createdAt, clientId
516
516
  `,i=(yield*Xfe(r)).map(e=>({client_id:e.clientId,onboarding:e.clientDiscoveryId===null?e.userId===null?`dcr`:`managed`:`cimd`,blocked:e.disabled===1,client_name:e.name??void 0,redirect_uris:e.redirectUris,token_endpoint_auth_method:e.tokenEndpointAuthMethod??void 0,application_type:e.applicationType,scope:e.scopes?.join(` `),grant_types:e.grantTypes??void 0})),a=yield*ih({resources:e.resources.list(),clientAccess:e.resources.access()});return{clients:i,resources:a.resources.map(e=>({...e,builtIn:e.identifier===e$(n.baseURL)})),clientAccess:a.clientAccess,email:t,issuer:`${n.baseURL}/api/auth`}}),create:H(`Administration.create`)(function*(n){let{providerHeaders:r}=yield*q6,i=yield*e.resources.scopesFor(n.resources),a=yield*r,o=yield*LQ(()=>t.api.adminCreateOAuthClient({headers:a,body:{client_name:n.client_name,redirect_uris:[...n.redirect_uris],token_endpoint_auth_method:n.token_endpoint_auth_method,application_type:n.application_type,grant_types:[`authorization_code`,`refresh_token`],scope:i.join(` `),skip_consent:!0}}));return yield*e.resources.setAccess(o.client_id,n.resources,a).pipe(Rh(()=>LQ(()=>t.api.deleteOAuthClient({headers:a,body:{client_id:o.client_id}})))),o}),update:H(`Administration.update`)(function*(e){let{providerHeaders:n}=yield*q6,r=yield*n;return yield*LQ(()=>t.api.updateOAuthClient({headers:r,body:{client_id:e.client_id,update:{client_name:e.client_name,redirect_uris:[...e.redirect_uris],application_type:e.application_type}}}))}),access:H(`Administration.access`)(function*(t){let{providerHeaders:n}=yield*q6,r=yield*n;return{clientAccess:yield*e.resources.setAccess(t.client_id,t.resources,r)}}),createResource:H(`Administration.createResource`)(function*(t){let{providerHeaders:n}=yield*q6,r=yield*n;return yield*e.resources.create(t,r)}),updateResource:H(`Administration.updateResource`)(function*(t){let{providerHeaders:n}=yield*q6,r=yield*n;return yield*e.resources.update(t,r)}),deleteResource:H(`Administration.deleteResource`)(function*(t){let{providerHeaders:n}=yield*q6,r=yield*n;return yield*e.resources.delete(t.identifier,r)}),delete:H(`Administration.delete`)(function*(e){let{providerHeaders:n}=yield*q6,r=yield*n;return yield*LQ(()=>t.api.deleteOAuthClient({headers:r,body:e})),{deleted:!0}}),revoke:H(`Administration.revoke`)(function*(t){return yield*q6,yield*e.clients.revoke(t.client_id)}),block:H(`Administration.block`)(function*(t){return yield*q6,yield*e.clients.block(t.client_id,t.blocked)}),rotate:H(`Administration.rotate`)(function*(e){let{providerHeaders:n}=yield*q6,r=yield*n;return yield*LQ(()=>t.api.rotateClientSecret({headers:r,body:e}))})}}),X6=/*#__PURE__*/ W({method:lD([`GET`,`POST`,`PATCH`,`PUT`,`DELETE`,`HEAD`,`OPTIONS`,`TRACE`,`QUERY`]),url:U,urlParams:G(oD([U,U])),hash:BE(U),headers:rD(U,K([U,cO(U)]))}).annotate({identifier:`HttpRequestDetails`}),Zfe=/*#__PURE__*/ W({status:ID,headers:rD(U,K([U,cO(U)]))}).annotate({identifier:`HttpResponseDetails`}),Z6=`~effect/ai/AiError/Reason`,Q6=()=>epe.pipe(vD(F({})),bD(F({}))),Qfe=e=>{let t=Gr(e),n={};for(let e in t){let r=t[e];Hr(n,e,uT(r)?r.toString():r)}return n};var $fe=class e extends (/*#__PURE__*/ _O(`effect/ai/AiError/NetworkError`)({_tag:/*#__PURE__*/ xD(`NetworkError`),reason:/*#__PURE__*/ lD([`TransportError`,`EncodeError`,`InvalidUrlError`]),request:X6,description:/*#__PURE__*/ BE(U)})){[Z6]=Z6;get isRetryable(){return this.reason===`TransportError`}static fromRequestError(t){return new e({description:t.description,reason:t._tag,request:{hash:Na(t.request.hash),headers:Qfe(t.request.headers),method:t.request.method,url:t.request.url,urlParams:Array.from(t.request.urlParams)}})}get message(){let e=`${this.request.method} ${this.request.url}`,t=this.description?`${this.reason}: ${this.description}`:`${this.reason}: A network error occurred.`;t+=` (${e})`;let n=``;switch(this.reason){case`EncodeError`:n+=`Check that the request body data is properly formatted and matches the expected content type.`;break;case`InvalidUrlError`:n+=`Verify that the URL format is correct and that all required parameters have been provided.`,n+=` Check for any special characters that may need encoding.`;break;case`TransportError`:n+=`Check your network connection and verify that the requested URL is accessible.`}return t+=`\n\n${n}`,t}};const epe=/*#__PURE__*/ rD(U,/*#__PURE__*/ uD(wO)),$6=/*#__PURE__*/ W({promptTokens:BE(ID),completionTokens:BE(ID),totalTokens:BE(ID)}).annotate({identifier:`UsageInfo`}),e8=/*#__PURE__*/ W({request:X6,response:BE(Zfe),body:BE(U)}).annotate({identifier:`HttpContext`});var tpe=class extends (/*#__PURE__*/ _O(`effect/ai/AiError/RateLimitError`)({_tag:/*#__PURE__*/ xD(`RateLimitError`),retryAfter:/*#__PURE__*/ BE(oO),metadata:/*#__PURE__*/ Q6(),http:/*#__PURE__*/ BE(e8)})){[Z6]=Z6;get isRetryable(){return!0}get message(){let e=`Rate limit exceeded`;return this.retryAfter&&(e+=`. Retry after ${$s(this.retryAfter)}`),e}},npe=class extends (/*#__PURE__*/ _O(`effect/ai/AiError/QuotaExhaustedError`)({_tag:/*#__PURE__*/ xD(`QuotaExhaustedError`),resetAt:/*#__PURE__*/ BE(iO),metadata:/*#__PURE__*/ Q6(),http:/*#__PURE__*/ BE(e8)})){[Z6]=Z6;get isRetryable(){return!1}get message(){let e=`Quota exhausted`;return this.resetAt&&(e+=`. Resets at ${this.resetAt}`),`${e}. Check your account billing and usage limits.`}},rpe=class extends (/*#__PURE__*/ _O(`effect/ai/AiError/AuthenticationError`)({_tag:/*#__PURE__*/ xD(`AuthenticationError`),kind:/*#__PURE__*/ lD([`InvalidKey`,`ExpiredKey`,`MissingKey`,`InsufficientPermissions`,`Unknown`]),description:/*#__PURE__*/ BE(U),metadata:/*#__PURE__*/ Q6(),http:/*#__PURE__*/ BE(e8)})){[Z6]=Z6;get isRetryable(){return!1}get message(){let e=`${this.kind}: ${{InvalidKey:`Verify your API key is correct`,ExpiredKey:`Your API key has expired. Generate a new one`,MissingKey:`No API key provided. Set the appropriate environment variable`,InsufficientPermissions:`Your API key lacks required permissions`,Unknown:`Authentication failed. Check your credentials`}[this.kind]}`;return this.description&&(e+=`. ${this.description}`),e}},ipe=class extends (/*#__PURE__*/ _O(`effect/ai/AiError/ContentPolicyError`)({_tag:/*#__PURE__*/ xD(`ContentPolicyError`),description:U,metadata:/*#__PURE__*/ Q6(),http:/*#__PURE__*/ BE(e8)})){[Z6]=Z6;get isRetryable(){return!1}get message(){return`Content policy violation: ${this.description}`}},ape=class extends (/*#__PURE__*/ _O(`effect/ai/AiError/InvalidRequestError`)({_tag:/*#__PURE__*/ xD(`InvalidRequestError`),parameter:/*#__PURE__*/ BE(U),constraint:/*#__PURE__*/ BE(U),description:/*#__PURE__*/ BE(U),metadata:/*#__PURE__*/ Q6(),http:/*#__PURE__*/ BE(e8)})){[Z6]=Z6;get isRetryable(){return!1}get message(){let e=`Invalid request`;return this.parameter&&(e+=`: parameter '${this.parameter}'`),this.constraint&&(e+=` ${this.constraint}`),this.description&&(e+=`. ${this.description}`),e}},ope=class extends (/*#__PURE__*/ _O(`effect/ai/AiError/InternalProviderError`)({_tag:/*#__PURE__*/ xD(`InternalProviderError`),description:U,metadata:/*#__PURE__*/ Q6(),http:/*#__PURE__*/ BE(e8)})){[Z6]=Z6;get isRetryable(){return!0}get message(){return`Internal provider error: ${this.description}`}},spe=class e extends (/*#__PURE__*/ _O(`effect/ai/AiError/InvalidOutputError`)({_tag:/*#__PURE__*/ xD(`InvalidOutputError`),description:U,metadata:/*#__PURE__*/ Q6(),usage:/*#__PURE__*/ BE($6)})){[Z6]=Z6;get isRetryable(){return!0}static fromSchemaError(t){return new e({description:t.message})}get message(){return`Invalid output: ${this.description}`}},cpe=class e extends (/*#__PURE__*/ _O(`effect/ai/AiError/StructuredOutputError`)({_tag:/*#__PURE__*/ xD(`StructuredOutputError`),description:U,responseText:U,metadata:/*#__PURE__*/ Q6(),usage:/*#__PURE__*/ BE($6)})){[Z6]=Z6;get isRetryable(){return!0}static fromSchemaError(t,n){return new e({description:t.message,responseText:n})}get message(){return`Structured output validation failed: ${this.description}`}},lpe=class extends (/*#__PURE__*/ _O(`effect/ai/AiError/UnsupportedSchemaError`)({_tag:/*#__PURE__*/ xD(`UnsupportedSchemaError`),description:U,metadata:/*#__PURE__*/ Q6()})){[Z6]=Z6;get isRetryable(){return!1}get message(){return`Unsupported schema: ${this.description}`}},upe=class extends (/*#__PURE__*/ _O(`effect/ai/AiError/UnknownError`)({_tag:/*#__PURE__*/ xD(`UnknownError`),description:/*#__PURE__*/ BE(U),metadata:/*#__PURE__*/ Q6(),http:/*#__PURE__*/ BE(e8)})){[Z6]=Z6;get isRetryable(){return!1}get message(){return this.description??`Unknown error`}},t8=class extends (/*#__PURE__*/ _O(`effect/ai/AiError/ToolNotFoundError`)({_tag:/*#__PURE__*/ xD(`ToolNotFoundError`),toolName:U,availableTools:/*#__PURE__*/ G(U)})){[Z6]=Z6;get isRetryable(){return!0}get message(){let e=this.availableTools.length>0?this.availableTools.join(`, `):`none`;return`Tool '${this.toolName}' not found. Available tools: ${e}`}},n8=class extends (/*#__PURE__*/ _O(`effect/ai/AiError/ToolParameterValidationError`)({_tag:/*#__PURE__*/ xD(`ToolParameterValidationError`),toolName:U,description:U})){[Z6]=Z6;get isRetryable(){return!0}get message(){return`Invalid parameters for tool '${this.toolName}': ${this.description}`}},r8=class extends (/*#__PURE__*/ _O(`effect/ai/AiError/InvalidToolResultError`)({_tag:/*#__PURE__*/ xD(`InvalidToolResultError`),toolName:U,description:U})){[Z6]=Z6;get isRetryable(){return!1}get message(){return`Tool '${this.toolName}' returned invalid result: ${this.description}`}},i8=class extends (/*#__PURE__*/ _O(`effect/ai/AiError/ToolResultEncodingError`)({_tag:/*#__PURE__*/ xD(`ToolResultEncodingError`),toolName:U,toolResult:JE,description:U})){[Z6]=Z6;get isRetryable(){return!1}get message(){return`Failed to encode result for tool '${this.toolName}': ${this.description}`}};const dpe=/*#__PURE__*/ K([tpe,npe,rpe,ipe,ape,ope,$fe,spe,cpe,lpe,upe,t8,n8,r8,i8,class extends (/*#__PURE__*/ _O(`effect/ai/AiError/ToolConfigurationError`)({_tag:/*#__PURE__*/ xD(`ToolConfigurationError`),toolName:U,description:U})){[Z6]=Z6;get isRetryable(){return!1}get message(){return`Invalid configuration for tool '${this.toolName}': ${this.description}`}},class extends (/*#__PURE__*/ _O(`effect/ai/AiError/ToolkitRequiredError`)({_tag:/*#__PURE__*/ xD(`ToolkitRequiredError`),pendingApprovals:/*#__PURE__*/ G(U),description:/*#__PURE__*/ BE(U)})){[Z6]=Z6;get isRetryable(){return!1}get message(){return`Toolkit required to resolve pending tool approvals: ${this.pendingApprovals.join(`, `)}`}},class extends (/*#__PURE__*/ _O(`effect/ai/AiError/InvalidUserInputError`)({_tag:/*#__PURE__*/ xD(`InvalidUserInputError`),description:U})){[Z6]=Z6;get isRetryable(){return!1}get message(){return`Invalid user input: ${this.description}`}}]),a8=`~effect/ai/AiError`;var o8=class extends (/*#__PURE__*/ _O(`effect/ai/AiError/AiError`)({_tag:/*#__PURE__*/ xD(`AiError`),module:U,method:U,reason:dpe})){[a8]=a8;cause=this.reason;get isRetryable(){return this.reason.isRetryable}get retryAfter(){return`retryAfter`in this.reason?this.reason.retryAfter:void 0}get message(){return`${this.module}.${this.method}: ${this.reason.message}`}};const fpe=e=>M(e,a8),ppe=e=>M(e,Z6),s8=e=>new o8(e),mpe=e=>M(e,`~effect/ai/Tool/Dynamic`),c8=(e,t)=>Object.assign(Object.create(Object.getPrototypeOf(e)),e,t),l8={"~effect/ai/Tool":{_Requirements:j},pipe(){return Tn(this,arguments)},addDependency(){return c8(this)},setParameters(e){return c8(this,{parametersSchema:e,jsonSchema:void 0})},setSuccess(e){return c8(this,{successSchema:e})},setFailure(e){return c8(this,{failureSchema:e})},setNeedsApproval(e){return c8(this,{needsApproval:e})},annotate(e,t){return c8(this,{annotations:ds(this.annotations,e,t)})},annotateMerge(e){return c8(this,{annotations:Ss(this.annotations,e)})}};({...l8}),{...l8};const hpe=e=>{let t=Object.assign(Object.create(l8),e);return t.id=`effect/ai/Tool/${e.name}`,t},u8=(e,t)=>{let n=t?.success??eD,r=t?.failure??KE;return hpe({name:e,description:t?.description,parametersSchema:t?.parameters??Spe,successSchema:n,failureSchema:r,failureMode:t?.failureMode??`error`,annotations:cs(),needsApproval:t?.needsApproval})},gpe=e=>{if(e.description!==void 0)return e.description;if(RE(e.parametersSchema))return Nb(e.parametersSchema.ast)};var _pe=class extends (/*#__PURE__*/ N()(`effect/ai/Tool/Title`)){},vpe=class extends (/*#__PURE__*/ N()(`effect/ai/Tool/Meta`)){};const d8=/*#__PURE__*/ Ts(`effect/ai/Tool/Readonly`,{defaultValue:An}),f8=/*#__PURE__*/ Ts(`effect/ai/Tool/Destructive`,{defaultValue:kn}),p8=/*#__PURE__*/ Ts(`effect/ai/Tool/Idempotent`,{defaultValue:An}),m8=/*#__PURE__*/ Ts(`effect/ai/Tool/OpenWorld`,{defaultValue:kn}),h8=/*#__PURE__*/ Ts(`effect/ai/Tool/Strict`,{defaultValue:()=>void 0}),ype=e=>_s(e.annotations,h8),bpe=/*#__PURE__*/ W({type:lD([`execution-denied`,`execution-interrupted`]),reason:U}).annotate({identifier:`ToolExecutionFailure`}),xpe=e=>K([o8,e.failureSchema,bpe]),Spe=/*#__PURE__*/ rD(U,KE);function Cpe(e,t){let n=$C(e);if(n===void 0)throw Error(`Unsupported reference ${JSON.stringify(e)}`);if(!Object.hasOwn(t,n))throw Error(`Invalid reference ${JSON.stringify(e)}`);return t[n]}function wpe(e){return typeof e.schema.$ref==`string`?{...e,schema:Cpe(e.schema.$ref,e.definitions)}:e}const g8=`~effect/ai/Toolkit`,_8=/*#__PURE__*/ Ts(`effect/ai/Toolkit/FailureOrigin`,{defaultValue:()=>`result`}),v8=(e,t)=>mp(tp(e),us(_8,t)),Tpe={.../*#__PURE__*/ Go({label:`Toolkit`,evaluate:/*#__PURE__*/ V(function*(e){let t=this.tools,n=e.context,r=/* @__PURE__ */ new WeakMap,i=e=>{let t=r.get(e);if(Wn(t)){let i=n.mapUnsafe.get(e.id),a=RE(e.parametersSchema)?DE(e.parametersSchema):e=>F(e),o=NE(e.successSchema),s=NE(xpe(e));t={context:i.context,handler:i.handler,decodeParameters:a,encodeResult:(e,t)=>t?s(e):o(e)},r.set(e,t)}return t};return{tools:t,handle:V(function*(e,n,r,a){let o=Object.hasOwn(t,e)?t[e]:void 0;if(yield*Cg({tool:e,parameters:n}),Wn(o))return yield*s8({module:`Toolkit`,method:`${e}.handle`,reason:new t8({toolName:e,availableTools:Object.keys(t)})});let s=i(o),c=(t,n)=>s.encodeResult(t,n).pipe(Ih(n=>s8({module:`Toolkit`,method:`${e}.handle`,reason:new i8({toolName:e,toolResult:t,description:n.message})}))),l=yield*Eh(s.decodeParameters(n,a));if(Ha(l)){let t=s8({module:`Toolkit`,method:`${e}.handle`,reason:new n8({toolName:e,description:l.failure.message})});return o.failureMode===`error`?yield*hh(v8(t,`parameters`)):lk(B(c(t,!0),e=>({result:t,isFailure:!0,failureOrigin:`parameters`,preliminary:!1,encodedResult:e})))}let u=l.success,d=yield*Sx(),f={toolCallId:r,preliminary:e=>Ah(Tx(d,{result:e,isFailure:!1,preliminary:!0}))},p=yield*s.handler(u,f).pipe(z(e=>Tx(d,{result:e,isFailure:!1,preliminary:!1})),rg(e=>Ss(s.context,e)),Xh({onFailure:e=>kx(d,e),onSuccess:()=>jx(d)}),Og),m=t=>bE(t)?s8({module:`Toolkit`,method:`${e}.handle`,reason:new r8({toolName:e,description:`Tool handler returned invalid result: ${t.message}`})}):ppe(t)?s8({module:`Toolkit`,method:`${e}.handle`,reason:t}):t;return bk(d).pipe(Mk(e=>{let t=m(e),n=bE(e)?`result`:`handler`;return o.failureMode===`error`?vk(v8(t,n)):hk({result:t,isFailure:!0,failureOrigin:n,preliminary:!1})}),wk(V(function*(e){let t=yield*c(e.result,e.isFailure);return{...e,encodedResult:t}})),zk(Kb(p)))})}})}),[g8]:g8,of:j,toHandlers(e){return mh({self:this},function*(){let t=yield*Qh(),n=rh(e)?yield*e:e,r=/* @__PURE__ */ new Map;for(let[e,i]of Object.entries(n)){let n=Object.hasOwn(this.tools,e)?this.tools[e]:void 0;n!==void 0&&r.set(n.id,{name:e,handler:i,context:t})}return rs(r)})},toLayer(e){return hm(this.toHandlers(e))},toJSON(){return{_id:`effect/ai/Toolkit`,tools:Array.from(Object.values(this.tools)).map(e=>e.name)}}},Epe=e=>Object.assign(function(){},Tpe,{tools:e}),Dpe=(...e)=>{let t={};for(let n of e)Hr(t,n.name,n);return t},Ope=(...e)=>Epe(Dpe(...e)),y8=`~effect/rpc/RpcMiddleware`,kpe=()=>(e,t)=>{let n=ai(),r;n!==0&&(oi(2),r=new globalThis.Error,oi(n));function i(){}let a=i;return Object.setPrototypeOf(i,Object.getPrototypeOf(N(e))),i.key=e,Object.defineProperty(i,"stack",{get(){return r?.stack}}),a[y8]=y8,a.error=t?.error??KE,a.requiredForClient=t?.requiredForClient??!1,i},b8=(e,t)=>{let n=I(t);return zE(e).pipe(_D({decode:mv(n),encode:cv()}),vD(n))},Z=e=>zE(e).pipe(fD(BE(e),{decode:cv(),encode:dv(Ia(Ma))})),Ape=/*#__PURE__*/ K([U,kD]),x8=/*#__PURE__*/ K([U,kD]);var S8=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({_meta:/*#__PURE__*/ Z(/*#__PURE__*/ iD(/*#__PURE__*/ W({progressToken:/*#__PURE__*/ Z(x8)}),[q]))}))){},C8=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({_meta:/*#__PURE__*/ Z(q)}))){},w8=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({_meta:/*#__PURE__*/ Z(q)}))){};const jpe=U;({...S8.fields});var T8=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({...C8.fields,nextCursor:/*#__PURE__*/ Z(jpe)}))){};const Mpe=/*#__PURE__*/ lD([`user`,`assistant`]);var E8=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({audience:/*#__PURE__*/ Z(/*#__PURE__*/ G(Mpe)),priority:/*#__PURE__*/ Z(/*#__PURE__*/ kD.check(/*#__PURE__*/ PD({minimum:0,maximum:1}))),lastModified:/*#__PURE__*/ Z(U)}))){},D8=class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/Icon`)({src:U,mimeType:/*#__PURE__*/ Z(U),sizes:/*#__PURE__*/ Z(/*#__PURE__*/ G(U)),theme:/*#__PURE__*/ Z(/*#__PURE__*/ lD([`light`,`dark`]))})){},O8=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({name:U,title:/*#__PURE__*/ Z(U),version:U,icons:/*#__PURE__*/ Z(/*#__PURE__*/ G(D8)),description:/*#__PURE__*/ Z(U),websiteUrl:/*#__PURE__*/ Z(U)}))){},Npe=class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/ClientCapabilities`)({experimental:/*#__PURE__*/ Z(/*#__PURE__*/ rD(U,/*#__PURE__*/ W({}))),extensions:/*#__PURE__*/ Z(/*#__PURE__*/ rD(/*#__PURE__*/ GE([U,`/`,U]),CO)),roots:/*#__PURE__*/ Z(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ Z(QE)})),sampling:/*#__PURE__*/ Z(/*#__PURE__*/ W({context:/*#__PURE__*/ Z(/*#__PURE__*/ W({})),tools:/*#__PURE__*/ Z(/*#__PURE__*/ W({}))})),elicitation:/*#__PURE__*/ Z(/*#__PURE__*/ W({form:/*#__PURE__*/ Z(/*#__PURE__*/ W({})),url:/*#__PURE__*/ Z(/*#__PURE__*/ W({}))}))})){},Ppe=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({experimental:/*#__PURE__*/ Z(/*#__PURE__*/ rD(U,/*#__PURE__*/ W({}))),extensions:/*#__PURE__*/ Z(/*#__PURE__*/ rD(/*#__PURE__*/ GE([U,`/`,U]),CO)),logging:/*#__PURE__*/ Z(/*#__PURE__*/ W({})),completions:/*#__PURE__*/ Z(/*#__PURE__*/ W({})),prompts:/*#__PURE__*/ Z(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ Z(QE)})),resources:/*#__PURE__*/ Z(/*#__PURE__*/ W({subscribe:/*#__PURE__*/ Z(QE),listChanged:/*#__PURE__*/ Z(QE)})),tools:/*#__PURE__*/ Z(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ Z(QE)}))}))){},k8=class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/McpErrorBase`)({code:ID,message:U,data:/*#__PURE__*/ Z(qE)})){};const A8=-32601,j8=-32602,M8=-32603,N8=-32020;var P8=class extends (/*#__PURE__*/ _O(`effect/ai/McpSchema/ParseError`)({...k8.fields,_tag:/*#__PURE__*/ xD(`ParseError`),code:/*#__PURE__*/ xD(-32700)})){},F8=class extends (/*#__PURE__*/ _O(`effect/ai/McpSchema/InvalidRequest`)({...k8.fields,_tag:/*#__PURE__*/ xD(`InvalidRequest`),code:/*#__PURE__*/ xD(-32600)})){},I8=class extends (/*#__PURE__*/ _O(`effect/ai/McpSchema/MethodNotFound`)({...k8.fields,_tag:/*#__PURE__*/ xD(`MethodNotFound`),code:/*#__PURE__*/ xD(A8)})){},L8=class extends (/*#__PURE__*/ _O(`effect/ai/McpSchema/InvalidParams`)({...k8.fields,_tag:/*#__PURE__*/ xD(`InvalidParams`),code:/*#__PURE__*/ xD(j8)})){},R8=class e extends (/*#__PURE__*/ _O(`effect/ai/McpSchema/InternalError`)({...k8.fields,_tag:/*#__PURE__*/ xD(`InternalError`),code:/*#__PURE__*/ xD(M8)})){static notImplemented=/*#__PURE__*/ new e({message:`Not implemented`})};const z8=/*#__PURE__*/ K([P8,F8,I8,L8,R8,k8]);var Fpe=class extends (/*#__PURE__*/ zP(`ping`,{success:/*#__PURE__*/ W({}),error:z8,payload:/*#__PURE__*/ dD(S8)})){},Ipe=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({...C8.fields,protocolVersion:U,capabilities:Ppe,serverInfo:O8,instructions:/*#__PURE__*/ Z(U)}))){},Lpe=class extends (/*#__PURE__*/ zP(`initialize`,{success:Ipe,error:z8,payload:{...S8.fields,protocolVersion:U,capabilities:Npe,clientInfo:O8}})){},B8=class extends (/*#__PURE__*/ zP(`notifications/cancelled`,{payload:{...w8.fields,requestId:Ape,reason:/*#__PURE__*/ Z(U)}})){},V8=class extends (/*#__PURE__*/ zP(`notifications/progress`,{payload:{...w8.fields,progressToken:x8,progress:kD,total:/*#__PURE__*/ Z(kD),message:/*#__PURE__*/ Z(U)}})){},Rpe=class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/Resource`)({uri:U,name:U,title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),mimeType:/*#__PURE__*/ Z(U),annotations:/*#__PURE__*/ Z(E8),icons:/*#__PURE__*/ Z(/*#__PURE__*/ G(D8)),size:/*#__PURE__*/ Z(ID),_meta:/*#__PURE__*/ Z(q)})){},H8=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({uri:U,mimeType:/*#__PURE__*/ Z(U),_meta:/*#__PURE__*/ Z(q)}))){},zpe=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({...H8.fields,text:U}))){},Bpe=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({...H8.fields,blob:QD}))){};({...T8.fields}),{...T8.fields},{...C8.fields},{...S8.fields};var U8=class extends (/*#__PURE__*/ zP(`notifications/resources/list_changed`,{payload:/*#__PURE__*/ dD(w8)})){};({...S8.fields}),{...S8.fields};var W8=class extends (/*#__PURE__*/ zP(`notifications/resources/updated`,{payload:{...w8.fields,uri:U}})){},Vpe=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({name:U,title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),required:/*#__PURE__*/ Z(QE)}))){},Hpe=class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/Prompt`)({name:U,title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),arguments:/*#__PURE__*/ Z(/*#__PURE__*/ G(Vpe)),icons:/*#__PURE__*/ Z(/*#__PURE__*/ G(D8)),_meta:/*#__PURE__*/ Z(q)})){},G8=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({type:/*#__PURE__*/ xD(`text`),text:U,annotations:/*#__PURE__*/ Z(E8),_meta:/*#__PURE__*/ Z(q)}))){};const Upe=/*#__PURE__*/ K([G8,class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({type:/*#__PURE__*/ xD(`image`),data:QD,mimeType:U,annotations:/*#__PURE__*/ Z(E8),_meta:/*#__PURE__*/ Z(q)}))){},class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({type:/*#__PURE__*/ xD(`audio`),data:QD,mimeType:U,annotations:/*#__PURE__*/ Z(E8),_meta:/*#__PURE__*/ Z(q)}))){},class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({type:/*#__PURE__*/ xD(`resource`),resource:/*#__PURE__*/ K([zpe,Bpe]),annotations:/*#__PURE__*/ Z(E8),_meta:/*#__PURE__*/ Z(q)}))){},class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({...Rpe.fields,type:/*#__PURE__*/ xD(`resource_link`)}))){}]);({...T8.fields}),{...C8.fields},{...S8.fields};var K8=class extends (/*#__PURE__*/ zP(`notifications/prompts/list_changed`,{payload:/*#__PURE__*/ dD(w8)})){},Wpe=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({title:/*#__PURE__*/ Z(U),readOnlyHint:/*#__PURE__*/ b8(QE,An),destructiveHint:/*#__PURE__*/ b8(QE,kn),idempotentHint:/*#__PURE__*/ b8(QE,An),openWorldHint:/*#__PURE__*/ b8(QE,kn)}))){};const q8=/*#__PURE__*/ iD(/*#__PURE__*/ W({type:/*#__PURE__*/ UE(`object`),properties:/*#__PURE__*/ Z(/*#__PURE__*/ rD(U,q)),required:/*#__PURE__*/ Z(/*#__PURE__*/ G(U))}),[q]),J8=q;var Y8=class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/Tool`)({name:U,title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),inputSchema:q8,outputSchema:/*#__PURE__*/ Z(J8),annotations:/*#__PURE__*/ Z(Wpe),icons:/*#__PURE__*/ Z(/*#__PURE__*/ G(D8)),_meta:/*#__PURE__*/ Z(q)})){};({...T8.fields});var X8=class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/CallToolResult`)({...C8.fields,content:/*#__PURE__*/ G(Upe),structuredContent:/*#__PURE__*/ Z(CO),isError:/*#__PURE__*/ Z(QE)})){};({...S8.fields});var Z8=class extends (/*#__PURE__*/ zP(`notifications/tools/list_changed`,{payload:/*#__PURE__*/ dD(w8)})){};const Q8=/*#__PURE__*/ lD([`debug`,`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`]);({...S8.fields});var $8=class extends (/*#__PURE__*/ zP(`notifications/message`,{payload:/*#__PURE__*/ W({...w8.fields,level:Q8,logger:/*#__PURE__*/ Z(U),data:qE})})){},Gpe=class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/ToolChoice`)({mode:/*#__PURE__*/ Z(/*#__PURE__*/ lD([`auto`,`required`,`none`]))})){},Kpe=class extends (/*#__PURE__*/ CD()(/*#__PURE__*/ W({name:/*#__PURE__*/ Z(U)}))){};(class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/ModelPreferences`)({hints:/*#__PURE__*/ Z(/*#__PURE__*/ G(Kpe)),costPriority:/*#__PURE__*/ Z(/*#__PURE__*/ kD.check(/*#__PURE__*/ PD({minimum:0,maximum:1}))),speedPriority:/*#__PURE__*/ Z(/*#__PURE__*/ kD.check(/*#__PURE__*/ PD({minimum:0,maximum:1}))),intelligencePriority:/*#__PURE__*/ Z(/*#__PURE__*/ kD.check(/*#__PURE__*/ PD({minimum:0,maximum:1})))})){}).fields,Y8.fields,Gpe.fields,{...C8.fields};const qpe=/*#__PURE__*/ W({$schema:/*#__PURE__*/ Z(U),type:/*#__PURE__*/ xD(`object`),properties:/*#__PURE__*/ rD(U,/* @__PURE__ */ K([/* @__PURE__ */ K([class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/LegacyTitledEnum`)({type:/*#__PURE__*/ xD(`string`),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),enum:/*#__PURE__*/ G(U),enumNames:/*#__PURE__*/ Z(/*#__PURE__*/ G(U)),default:/*#__PURE__*/ Z(U)})){},/* @__PURE__ */ K([class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/UntitledSingleSelectEnum`)({type:/*#__PURE__*/ xD(`string`),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),enum:/*#__PURE__*/ G(U),default:/*#__PURE__*/ Z(U)})){},class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/TitledSingleSelectEnum`)({type:/*#__PURE__*/ xD(`string`),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),oneOf:/*#__PURE__*/ G(/*#__PURE__*/ W({const:U,title:U})),default:/*#__PURE__*/ Z(U)})){}]),/* @__PURE__ */ K([class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/UntitledMultiSelectEnum`)({type:/*#__PURE__*/ xD(`array`),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),minItems:/*#__PURE__*/ Z(ID),maxItems:/*#__PURE__*/ Z(ID),items:/*#__PURE__*/ W({type:/*#__PURE__*/ xD(`string`),enum:/*#__PURE__*/ G(U)}),default:/*#__PURE__*/ Z(/*#__PURE__*/ G(U))})){},class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/TitledMultiSelectEnum`)({type:/*#__PURE__*/ xD(`array`),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),minItems:/*#__PURE__*/ Z(ID),maxItems:/*#__PURE__*/ Z(ID),items:/*#__PURE__*/ W({anyOf:/*#__PURE__*/ G(/*#__PURE__*/ W({const:U,title:U}))}),default:/*#__PURE__*/ Z(/*#__PURE__*/ G(U))})){}])]),class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/ElicitationString`)({type:/*#__PURE__*/ xD(`string`),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),minLength:/*#__PURE__*/ Z(ID),maxLength:/*#__PURE__*/ Z(ID),format:/*#__PURE__*/ Z(/*#__PURE__*/ lD([`email`,`uri`,`date`,`date-time`])),default:/*#__PURE__*/ Z(U)})){},class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/ElicitationNumber`)({type:/*#__PURE__*/ lD([`number`,`integer`]),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),minimum:/*#__PURE__*/ Z(kD),maximum:/*#__PURE__*/ Z(kD),default:/*#__PURE__*/ Z(kD)})){},class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/ElicitationBoolean`)({type:/*#__PURE__*/ xD(`boolean`),title:/*#__PURE__*/ Z(U),description:/*#__PURE__*/ Z(U),default:/*#__PURE__*/ Z(QE)})){}])),required:/*#__PURE__*/ Z(/*#__PURE__*/ G(U))}),Jpe=/*#__PURE__*/ K([class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/ElicitRequestFormParams`)({...S8.fields,mode:/*#__PURE__*/ Z(/*#__PURE__*/ UE(`form`)),message:U,requestedSchema:qpe})){},class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/ElicitRequestURLParams`)({...S8.fields,mode:/*#__PURE__*/ UE(`url`),message:U,elicitationId:U,url:U})){}]),Ype=/*#__PURE__*/ K([class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/ElicitAcceptResult`)({...C8.fields,action:/*#__PURE__*/ UE(`accept`),content:/*#__PURE__*/ Z(/*#__PURE__*/ rD(U,/*#__PURE__*/ K([U,kD,QE,/*#__PURE__*/ G(U)])))})){},class extends (/*#__PURE__*/ gO(`@effect/ai/McpSchema/ElicitDeclineResult`)({...C8.fields,action:/*#__PURE__*/ lD([`cancel`,`decline`])})){}]);var Xpe=class extends (/*#__PURE__*/ zP(`elicitation/create`,{success:Ype,error:z8,payload:Jpe})){},Zpe=class extends (/*#__PURE__*/ zP(`notifications/elicitation/complete`,{payload:{elicitationId:U}})){};Xpe.payloadSchema;var Qpe=class extends (/*#__PURE__*/ oc(`McpReverseOperationUnsupported`)){},e5=class extends (/*#__PURE__*/ N()(`effect/ai/McpSchema/McpRequestContext`)){},t5=class extends (/*#__PURE__*/ N()(`effect/ai/McpSchema/McpServerClient`)){},n5=class extends (/*#__PURE__*/ kpe()(`effect/ai/McpSchema/McpServerClientMiddleware`)){},$pe=class extends (/*#__PURE__*/ nF(B8,V8,$8,W8,U8,Z8,K8,Zpe)){},r5=class extends (/*#__PURE__*/ N()(`effect/unstable/ai/McpSchema/EnabledWhen`)){};const i5={Complete:e=>({_tag:`Complete`,value:e}),InputRequired:e=>({_tag:`InputRequired`,...e})};var eme=class extends (/*#__PURE__*/ oc(`ResourceNotFound`)){},tme=class extends (/*#__PURE__*/ oc(`ToolNotFound`)){},nme=class extends (/*#__PURE__*/ oc(`InvalidToolInput`)){},rme=class extends (/*#__PURE__*/ oc(`InvalidToolContinuation`)){},ime=class extends (/*#__PURE__*/ oc(`ToolExecutionError`)){},ame=class extends (/*#__PURE__*/ oc(`PromptNotFound`)){};const a5=/*#__PURE__*/ dte(),ome=/*#__PURE__*/ I(()=>{let e=/* @__PURE__ */ new Map,t=[],n=[],r=/* @__PURE__ */ new Map,i=/* @__PURE__ */ new Map;return{tools:{register:t=>I(()=>{e.set(t.descriptor.name,t)}),list:t=>I(()=>{let n=[];for(let r of e.values())r.isVisible(t)&&n.push(r.descriptor);return n}),call:(t,n)=>dh(()=>{let r=e.get(t.name);return r===void 0||!r.isVisible(n.protocol)?new tme({name:t.name}):r.handle(t,n)})},resources:{register:e=>I(()=>{let n=t.findIndex(t=>t.descriptor.uri===e.descriptor.uri);n===-1?t.push(e):t[n]=e}),registerTemplate:e=>I(()=>{let t=n.findIndex(t=>t.descriptor.uriTemplate===e.descriptor.uriTemplate);t===-1?n.push(e):n[t]=e}),list:e=>I(()=>t.filter(t=>t.isVisible(e)).map(e=>e.descriptor)),listTemplates:e=>I(()=>n.filter(t=>t.isVisible(e)).map(e=>e.descriptor)),read:V(function*(e,r){let i=t.find(t=>t.descriptor.uri===e);if(i!==void 0&&i.isVisible(r.protocol))return yield*i.read(r);for(let t of n){let n=t.match(e);if(n!==void 0&&t.isVisible(r.protocol))return yield*t.read(e,n,r)}return yield*new eme({uri:e})})},prompts:{register:e=>I(()=>{r.set(e.descriptor.name,e)}),list:e=>I(()=>Array.from(r.values()).filter(t=>t.isVisible(e)).map(e=>e.descriptor)),get:V(function*(e,t,n){let i=r.get(e);return i===void 0||!i.isVisible(n.protocol)?yield*new ame({name:e}):yield*i.get(t,n)})},completions:{register:(e,t)=>I(()=>{i.set(e,t)}),complete:V(function*(e,t){let n=e.reference.type===`prompt`?`prompt/${e.reference.name}/${e.argument.name}`:`resource/${e.reference.uriTemplate}/${e.argument.name}`,r=i.get(n);if(r===void 0)return yield*new L8({message:`Unknown completion reference or argument`});let a=yield*r(e,t),o=ho(a.values,100);return{...a,values:o,hasMore:a.hasMore===!0||o.length<a.values.length}})},registrationPresence:I(()=>({tools:e.size>0,resources:t.length>0||n.length>0,prompts:r.size>0}))}}),sme=/*#__PURE__*/ new TextDecoder(`utf-8`,{fatal:!0,ignoreBOM:!0}),o5={debug:{effect:`Debug`,order:0},info:{effect:`Info`,order:1},notice:{effect:`Info`,order:2},warning:{effect:`Warn`,order:3},error:{effect:`Error`,order:4},critical:{effect:`Fatal`,order:5},alert:{effect:`Fatal`,order:6},emergency:{effect:`Fatal`,order:7}},s5=e=>{let t=e.startsWith(`=?base64?`),n=e.endsWith(`?=`);if(!t||!n)return/^[\t\x20-\x7e]*$/.test(e)?e:void 0;let r=uc(e.slice(9,-2));if(!Ha(r))try{return sme.decode(r.success)}catch{return}},cme=e=>({protocolVersion:e.protocolVersion,clientCapabilities:e.clientCapabilities,clientInfo:e.clientInfo,requestMetadata:e.initializePayload._meta}),c5=e=>({clientId:e.clientId,protocol:cme(e),requestContext:e5.of({clientId:e.clientId,protocolVersion:e.protocolVersion,clientCapabilities:e.clientCapabilities,clientInfo:e.clientInfo,requestMetadata:e.requestMetadata}),serverClient:e}),l5=e=>({clientId:e.clientId,protocol:{protocolVersion:e.protocolVersion,clientCapabilities:e.clientCapabilities,clientInfo:e.clientInfo,requestMetadata:e.requestMetadata},requestContext:e}),u5=e=>Qn(e)&&(e.type===`tool_use`||e.type===`tool_result`),lme=e=>Qn(e)?e.tools!==void 0||e.toolChoice!==void 0?!0:Array.isArray(e.messages)?e.messages.some(e=>{if(!Qn(e))return!1;let t=e.content;return Array.isArray(t)?t.some(u5):u5(t)}):!1:!1;var d5=class e extends (/*#__PURE__*/ oc(`ProtocolError`)){static fromTool(t){let n=vj(t).pipe(bj(`ToolNotFound`,e=>`Tool '${e.name}' not found`),bj(`UnsupportedByProtocol`,e=>`${e.feature} is not supported by MCP ${e.protocolVersion}`),xj({InvalidToolInput:e=>e.message,InvalidToolContinuation:e=>e.message,ToolExecutionError:e=>e.message}),wj);return new e({code:j8,message:n})}static fromFeature(t){if(M(t,`_tag`)){if(t._tag===`PromptNotFound`&&M(t,`name`)&&zn(t.name))return new e({code:j8,message:`Prompt '${t.name}' not found`});if(t._tag===`ResourceNotFound`&&M(t,`uri`)&&zn(t.uri))return new e({code:-32002,message:`Resource '${t.uri}' not found`})}let n=ume(t);return Ua(n)?new e(n.success):new e({code:M8,message:`MCP feature handler failed`})}};const ume=/*#__PURE__*/ AE(/* @__PURE__ */ W({code:kD,message:U,data:/*#__PURE__*/ zE(JE)})),f5=(e,t,n)=>PE(e)(n).pipe(z(DE(t))),dme=/*#__PURE__*/ H(function*(e,t){return a5.$match(t,{Cancelled:e=>({tag:B8._tag,payload:B8.payloadSchema.make({_meta:e.metadata,requestId:e.requestId,reason:e.reason})}),Progress:t=>({tag:V8._tag,payload:V8.payloadSchema.make({_meta:t.metadata,progressToken:t.progressToken,progress:t.progress,total:t.total,message:e.supportsProgressMessage?t.message:void 0})}),LoggingMessage:e=>({tag:$8._tag,payload:$8.payloadSchema.make({_meta:e.metadata,level:e.level,logger:e.logger,data:e.data})}),ResourceUpdated:e=>({tag:W8._tag,payload:W8.payloadSchema.make({_meta:e.metadata,uri:e.uri})}),ResourcesChanged:e=>({tag:U8._tag,payload:U8.payloadSchema.make({_meta:e.metadata})}),ToolsChanged:e=>({tag:Z8._tag,payload:Z8.payloadSchema.make({_meta:e.metadata})}),PromptsChanged:e=>({tag:K8._tag,payload:K8.payloadSchema.make({_meta:e.metadata})}),ElicitationComplete:()=>void 0})}),p5=e=>{switch(e._tag){case`ToolsChanged`:case`PromptsChanged`:case`ResourcesChanged`:case`ResourceUpdated`:return!0;default:return!1}},fme=e=>{let t=/* @__PURE__ */ new WeakMap,n=e=>{let n=t.get(e);if(n===void 0){let r=bO(e.payloadSchema);n={decode:DE(r),encode:NE(r)},t.set(e,n)}return n},r=(t,n,r)=>e.handlerRpcs===void 0||e.makeHandlers===void 0?L:n===void 0&&e.runtime._tag===`Stateful`?_h(`MCP sessionful handler installation requires a lifecycle runtime`):r.install(e,e.handlerRpcs,e.makeHandlers(t,e.runtime._tag===`Stateful`?n:void 0,r.context)),i=t=>Ose(e.serverRequestRpcs,{spanPrefix:`McpServer/Client`}).pipe(B(n=>e.toReverseClient(t,n)));return{...e,payloadCodecs:n,installHandlers:r,makeReverseClient:i}},m5=e=>`@effect/mcp/${encodeURIComponent(e.protocolVersion)}/`,pme=/*#__PURE__*/ V(function*(e){if(e.length===0)return yield*new pp(`MCP protocol declaration must contain at least one MCP protocol`);let t=Object.freeze(Array.from(e)),n=/* @__PURE__ */ new Map;for(let e of t){if(n.has(e.protocolVersion))return yield*new pp(`Duplicate MCP protocol version: ${e.protocolVersion}`);n.set(e.protocolVersion,e)}let r=t[0].clientRpcs.prefix(m5(t[0]));for(let e=1;e<t.length;e++)r=r.merge(t[e].clientRpcs.prefix(m5(t[e])));return{protocols:t,clientRpcs:r,select:e=>n.get(e)??t[0],protocolForInternalTag:e=>t.find(t=>e.startsWith(m5(t)))??t[0],routeClientRequest:(e,t)=>({...t,tag:`${m5(e)}${t.tag}`}),handlerTarget:(e,t)=>({context:t,install:V(function*(t,n,i){let a=yield*n.toHandlers(i);for(let i of n.requests.values()){let n=r.requests.get(`${m5(t)}${i._tag}`),o=a.mapUnsafe.get(i.key);if(n===void 0||o===void 0)return yield*_h(`MCP handler registration invariant failed for ${t.protocolVersion}/${i._tag}`);e.set(n.key,o)}})})}}),h5=e=>({initializePayload:e.initializePayload,negotiatedProfile:e.negotiatedProfile,protocol:e.protocol,resourceSubscriptions:e.supportsResourceSubscriptions?/* @__PURE__ */ new Set:void 0,logLevel:{_tag:`Effect`,level:e.logLevel}}),mme=()=>{let e=/* @__PURE__ */ new Map,t=/* @__PURE__ */ new Map,n=/* @__PURE__ */ new Set,r=(n,r)=>{let i=r[`mcp-session-id`];return i===void 0?t.get(n):e.get(i)};return{registerHttp:(t,n)=>{let r=h5(n);return e.set(t,r),r},registerConnection:(e,n)=>{let r=h5(n);return t.set(e,r),r},resolve:r,resolveSessionId:t=>e.get(t),setLogLevel:(e,t,n)=>I(()=>{let i=r(t,n);i!==void 0&&(i.logLevel={_tag:`Mcp`,level:e})}),subscribe:(e,t,n)=>{let i=r(t,n)?.resourceSubscriptions;return i===void 0?R(new d5({code:A8,message:`Resource subscriptions are not supported`})):I(()=>i.add(e)).pipe(Ah)},unsubscribe:(e,t,n)=>{let i=r(t,n)?.resourceSubscriptions;return i===void 0?R(new d5({code:A8,message:`Resource subscriptions are not supported`})):I(()=>i.delete(e)).pipe(Ah)},effectLogLevel:(e,t,n)=>{let i=r(e,t);return i?.logLevel._tag===`Mcp`?o5[i.logLevel.level].effect:i?.logLevel.level??n},canDeliver:(e,t,n,i)=>{let a=r(e,t);if(n._tag===`LoggingMessage`){let e=a?.logLevel;return e?._tag===`Mcp`?o5[n.level].order>=o5[e.level].order:vA(o5[n.level].effect,e?.level??i)}return n._tag!==`ResourceUpdated`||a?.resourceSubscriptions?.has(n.uri)===!0},markInitialized:e=>{n.add(e)},initializedClientIds:()=>n.values(),disconnect:e=>{t.delete(e),n.delete(e)}}},g5=`mcp-session-id`,_5=`mcp-protocol-version`,v5=`io.modelcontextprotocol/protocolVersion`,y5=`io.modelcontextprotocol/clientCapabilities`,b5=-32022,x5=e=>typeof e==`object`&&e?e:void 0,S5=e=>{let t=x5(e);return t!==void 0&&v5 in t?{present:!0,value:t[v5]}:{present:!1,value:void 0}},hme=e=>S5(x5(x5(e)?.params)?._meta).present,gme=e=>{switch(e){case`tools/call`:case`prompts/get`:return`name`;case`resources/read`:return`uri`;default:return}},C5=e=>({_tag:`Rejected`,status:400,error:{code:N8,message:e}}),w5=/*#__PURE__*/ nF(Fpe).middleware(n5);var T5=class extends (/*#__PURE__*/ N()(`effect/ai/McpRuntime/ServerRuntime`)){};const _me=(e,t)=>e.find(e=>e.runtime._tag===`Stateful`&&e.protocolVersion===t)??e.find(e=>e.runtime._tag===`Stateful`),vme=/*#__PURE__*/ V(function*(e){let t=e.find(e=>e.runtime._tag===`Stateful`)===void 0?void 0:mme(),n=e.map(e=>e.protocolVersion),r,i;for(let t of e)if(t.runtime._tag===`Stateless`){if(r!==void 0)return yield*new pp(`MCP runtime supports at most one stateless protocol`);r=t.runtime,i=t}let a=yield*pme(e),o=(e,r)=>{let o=e[_5],s=e[g5],c=x5(r),l=x5(x5(c?.params)?._meta),u=S5(l),d=c?.id,f=c?.jsonrpc===`2.0`&&c.method===`initialize`&&(typeof d==`string`||typeof d==`number`),p=c?.jsonrpc===`2.0`&&c.method===`notifications/cancelled`&&d===void 0;if(u.present||(!f||t===void 0)&&i!==void 0&&(o===i.protocolVersion||t===void 0&&c?.jsonrpc===`2.0`&&typeof c.method==`string`&&(typeof d==`string`||typeof d==`number`))){if(o===void 0)return C5(`MCP-Protocol-Version header is required`);if(!p&&(l===void 0||typeof u.value!=`string`))return{_tag:`Rejected`,status:400,error:{code:j8,message:`Required request metadata is missing`}};if((!p||u.present)&&u.value!==o)return C5(`MCP-Protocol-Version header does not match request metadata`);if(!p&&x5(l?.[y5])===void 0)return{_tag:`Rejected`,status:400,error:{code:j8,message:`${y5} request metadata is required`}};if(i===void 0||o!==i.protocolVersion)return{_tag:`Rejected`,status:400,error:{code:b5,message:`Unsupported protocol version '${o}'`,data:{supported:n,requested:o}}};let t=c?.method;if(typeof t!=`string`||e[`mcp-method`]!==t)return C5(`Mcp-Method header does not match request method`);let r=gme(t);if(r!==void 0){let t=x5(c?.params)?.[r],n=e[`mcp-name`];if(typeof t!=`string`||n===void 0||s5(n)!==t)return C5(`Mcp-Name header does not match request parameters`)}return{_tag:`Accepted`,binding:void 0,protocol:i}}let m=s===void 0?void 0:t?.resolveSessionId(s);return s!==void 0&&m===void 0?{_tag:`Rejected`,status:404}:!f&&o!==void 0&&!a.protocols.some(e=>e.protocolVersion===o)||!f&&m?.protocol.runtime.transport.http.requiresVersionHeader===!0&&o!==m.protocol.protocolVersion?{_tag:`Rejected`,status:400}:{_tag:`Accepted`,binding:m,protocol:m?.protocol}};return T5.of({protocols:a.protocols,clientRpcs:a.clientRpcs,selectProtocol:a.select,protocolForInternalTag:a.protocolForInternalTag,routeClientRequest:a.routeClientRequest,prepareRequest:V(function*(e,o,s){let c=x5(s.payload)?._meta,l=S5(c),u=typeof l.value==`string`?l.value:void 0,d=l.present?void 0:t?.resolve(e,o),f;if(l.present)f=a.protocols.find(e=>e.protocolVersion===u)??i??a.protocols[0];else if(d!==void 0)f=d.protocol;else if(s.tag===`initialize`){let e=s.payload?.protocolVersion,t=_me(a.protocols,e);if(t===void 0)return yield*new d5({code:b5,message:`initialize is not supported by the configured MCP protocols (requested '${e}')`});f=t}else f=a.protocols[0];if(f.runtime._tag===`Stateful`)return{protocol:f,binding:d};if(s.isNotification&&s.tag===`notifications/cancelled`)return{protocol:f};if(r===void 0)return yield*_h(`MCP stateless runtime invariant failed`);if(u!==void 0&&u!==f.protocolVersion)return yield*new d5({code:b5,message:`Unsupported protocol version '${u}'`,data:{supported:n,requested:u}});let p=yield*r.profileFromRequestMetadata(c),m={protocolVersion:p.protocolVersion,clientCapabilities:p.clientCapabilities,clientInfo:p.clientInfo,requestMetadata:p.requestMetadata},h=e5.of({clientId:e,protocolVersion:m.protocolVersion,clientCapabilities:m.clientCapabilities,clientInfo:m.clientInfo,requestMetadata:m.requestMetadata});return{protocol:f,profile:m,requestContext:h}}),resolveRequest:(e,n)=>t?.resolve(e,n),admitHttp:(e,t)=>{let n=(e,t,n=null)=>({_tag:`Rejected`,response:t===void 0?oN({status:e}):dN({jsonrpc:`2.0`,id:n,error:t},{status:e})});if(Ha(t)){let t=e[_5];if(t!==void 0&&!a.protocols.some(e=>e.protocolVersion===t))return n(400);let r=o(e,void 0);return r._tag===`Rejected`&&r.error===void 0?n(r.status):n(200,new P8({message:`Parse error`}))}let r=t.success;if(Array.isArray(r)){if(r.length===0)return n(400,new F8({message:`Invalid Request`}));let t=o(e,r);return t._tag===`Rejected`||r.some(hme)||r.some(e=>M(e,`method`)&&e.method===`initialize`)||t.binding?.protocol.runtime.transport.jsonRpc.acceptsBatches!==!0?n(400):{_tag:`Accepted`,acknowledge:!r.some(e=>M(e,`method`)&&M(e,`id`)),isSubscription:!1}}let i=M(r,`id`),s=i&&(typeof r.id==`string`||typeof r.id==`number`)?r.id:null,c=M(r,`jsonrpc`)&&r.jsonrpc===`2.0`,l=!i||typeof r.id==`string`||typeof r.id==`number`,u=c&&l&&M(r,`method`)&&typeof r.method==`string`,d=i&&(typeof r.id==`string`||typeof r.id==`number`||r.id===null),f=M(r,`result`),p=M(r,`error`),m=c&&d&&f!==p,h=o(e,r);if(h._tag===`Rejected`)return n(h.status,h.error,s);if(!u&&!m)return n(200,new F8({message:`Invalid Request`}),s);let g=M(r,`method`)&&r.method===`initialize`,_=e[g5]!==void 0;return(g?_:!_&&h.protocol?.runtime._tag!==`Stateless`)?n(400):u&&h.protocol?.runtime._tag===`Stateless`&&!(h.protocol.handlerRpcs?.requests.has(r.method)??h.protocol.clientRpcs.requests.has(r.method))?n(404,new I8({message:`Method not found: ${r.method}`}),s):{_tag:`Accepted`,acknowledge:!u||!i,isSubscription:M(r,`method`)&&r.method===`subscriptions/listen`}},effectLogLevel:(e,n,r)=>t?.effectLogLevel(e,n,r)??r,disconnect:e=>t?.disconnect(e),deliveryClientIds:()=>t?.initializedClientIds()??[],canDeliver:(e,n,r,i)=>t?.canDeliver(e,n,r,i)??!0,installHandlers:V(function*(e){let r=/* @__PURE__ */ new Map,i={subscribeServerNotifications:e.subscribeServerNotifications,...e.sendNotification===void 0?{}:{sendNotification:e.sendNotification},...e.markSubscriptionCancelled===void 0?{}:{markSubscriptionCancelled:e.markSubscriptionCancelled},...e.terminateSubscription===void 0?{}:{terminateSubscription:e.terminateSubscription},supportedVersions:n,serverInfo:e.serverInfo,registrationPresence:e.core.registrationPresence},o=a.handlerTarget(r,i);for(let n of a.protocols){if(n.runtime._tag===`Stateless`){yield*n.installHandlers(e.core,void 0,o);continue}if(t===void 0)return yield*_h(`MCP sessionful runtime invariant failed`);yield*o.install(n,w5,w5.of({ping:()=>F({})}));let r={initialize:V(function*(r,i,a){let o=yield*e.core.registrationPresence;return yield*bh(s=>{let c=ms(s.context,cP),l={completions:!0,logging:!0,...o.tools?{tools:{listChanged:!0}}:{},...o.resources?{resources:{listChanged:!0,subscribe:c===void 0}}:{},...o.prompts?{prompts:{listChanged:!0}}:{},...e.serverInfo.extensions?{extensions:e.serverInfo.extensions}:{}},u={initializePayload:Lpe.payloadSchema.make({protocolVersion:r,capabilities:i.clientCapabilities,clientInfo:i.clientInfo,_meta:i.requestMetadata}),negotiatedProfile:i,protocol:n,supportsResourceSubscriptions:c===void 0&&l.resources?.subscribe===!0,logLevel:e.defaultLogLevel};if(c!==void 0){let e=crypto.randomUUID();t.registerHttp(e,u),hP(c,(t,r)=>F(gN(r,{[g5]:e,[_5]:n.protocolVersion})))}else t.registerConnection(a,u);return F({capabilities:l,instructions:e.serverInfo.instructions,serverInfo:O8.make({name:e.serverInfo.name,version:e.serverInfo.version,description:e.serverInfo.description,websiteUrl:e.serverInfo.websiteUrl,icons:e.serverInfo.icons})})})}),setLogLevel:t.setLogLevel,subscribe:t.subscribe,unsubscribe:t.unsubscribe,clientNotification:V(function*(e,n){e._tag===`Initialized`&&t.markInitialized(n)})};yield*n.installHandlers(e.core,r,o)}return rs(r)})})}),yme=e=>pm(T5)(vme(e)),E5=e=>zE(e).pipe(fD(BE(e),{decode:cv(),encode:dv(Ia(Ma))})),D5=q,bme=/*#__PURE__*/ K([U,kD]),O5=/*#__PURE__*/ lD([`user`,`assistant`]),xme=/*#__PURE__*/ lD([`debug`,`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`]),k5=/*#__PURE__*/ W({_meta:/*#__PURE__*/ E5(/*#__PURE__*/ iD(/*#__PURE__*/ W({progressToken:/*#__PURE__*/ E5(bme)}),[q]))}),A5=/*#__PURE__*/ W({_meta:/*#__PURE__*/ E5(D5)}),j5=/*#__PURE__*/ W({_meta:/*#__PURE__*/ E5(D5)});({...k5.fields});const M5=/*#__PURE__*/ W({...j5.fields,nextCursor:/*#__PURE__*/ E5(U)}),Sme=/*#__PURE__*/ W({experimental:/*#__PURE__*/ E5(/*#__PURE__*/ rD(U,D5)),roots:/*#__PURE__*/ E5(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ E5(QE)})),sampling:/*#__PURE__*/ E5(D5)}),Cme=/*#__PURE__*/ W({experimental:/*#__PURE__*/ E5(/*#__PURE__*/ rD(U,D5)),logging:/*#__PURE__*/ E5(D5),prompts:/*#__PURE__*/ E5(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ E5(QE)})),resources:/*#__PURE__*/ E5(/*#__PURE__*/ W({subscribe:/*#__PURE__*/ E5(QE),listChanged:/*#__PURE__*/ E5(QE)})),tools:/*#__PURE__*/ E5(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ E5(QE)}))}),N5=/*#__PURE__*/ W({code:ID,message:U,data:/*#__PURE__*/ E5(qE)}),P5=/*#__PURE__*/ W({audience:/*#__PURE__*/ E5(/*#__PURE__*/ G(O5)),priority:/*#__PURE__*/ E5(/*#__PURE__*/ kD.check(/*#__PURE__*/ PD({minimum:0,maximum:1})))}),wme=/*#__PURE__*/ W({uri:U,mimeType:/*#__PURE__*/ E5(U),text:U}),Tme=/*#__PURE__*/ W({uri:U,mimeType:/*#__PURE__*/ E5(U),blob:U}),Eme=/*#__PURE__*/ W({type:/*#__PURE__*/ UE(`text`),text:U,annotations:/*#__PURE__*/ E5(P5)}),Dme=/*#__PURE__*/ W({type:/*#__PURE__*/ UE(`image`),data:U,mimeType:U,annotations:/*#__PURE__*/ E5(P5)}),Ome=/*#__PURE__*/ W({uri:U,name:U,description:/*#__PURE__*/ E5(U),mimeType:/*#__PURE__*/ E5(U),size:/*#__PURE__*/ E5(kD),annotations:/*#__PURE__*/ E5(P5)}),kme=/*#__PURE__*/ W({uriTemplate:U,name:U,description:/*#__PURE__*/ E5(U),mimeType:/*#__PURE__*/ E5(U),annotations:/*#__PURE__*/ E5(P5)}),F5=/*#__PURE__*/ W({name:U,description:/*#__PURE__*/ E5(U),required:/*#__PURE__*/ E5(QE)}),Ame=/*#__PURE__*/ W({name:U,description:/*#__PURE__*/ E5(U),arguments:/*#__PURE__*/ E5(/*#__PURE__*/ G(F5))}),jme=/*#__PURE__*/ W({name:U,description:/*#__PURE__*/ E5(U),inputSchema:/* @__PURE__ */ W({type:/*#__PURE__*/ UE(`object`),properties:/*#__PURE__*/ E5(/*#__PURE__*/ rD(U,D5)),required:/*#__PURE__*/ E5(/*#__PURE__*/ G(U))})}),I5=/*#__PURE__*/ W({hints:/*#__PURE__*/ E5(/*#__PURE__*/ G(/* @__PURE__ */ W({name:/*#__PURE__*/ E5(U)}))),costPriority:/*#__PURE__*/ E5(/*#__PURE__*/ kD.check(/*#__PURE__*/ PD({minimum:0,maximum:1}))),speedPriority:/*#__PURE__*/ E5(/*#__PURE__*/ kD.check(/*#__PURE__*/ PD({minimum:0,maximum:1}))),intelligencePriority:/*#__PURE__*/ E5(/*#__PURE__*/ kD.check(/*#__PURE__*/ PD({minimum:0,maximum:1})))}),Mme=/*#__PURE__*/ W({type:/*#__PURE__*/ UE(`ref/prompt`),name:U}),Nme=/*#__PURE__*/ W({uri:U,name:/*#__PURE__*/ E5(U)});({...j5.fields}),{...M5.fields},{...M5.fields},{...j5.fields},{...M5.fields},{...j5.fields},{...M5.fields},{...j5.fields},{...j5.fields},{...j5.fields},{...j5.fields},{...k5.fields},{...k5.fields},{...k5.fields},{...k5.fields},{...k5.fields},{...k5.fields},{...k5.fields},{...k5.fields},{...k5.fields},{...A5.fields},{...A5.fields},{...A5.fields},{...A5.fields};const L5=E5,Pme=/*#__PURE__*/ W({...Cme.fields,completions:/*#__PURE__*/ L5(/*#__PURE__*/ W({}))}),Fme=/*#__PURE__*/ W({type:/*#__PURE__*/ UE(`audio`),data:U,mimeType:U,annotations:/*#__PURE__*/ L5(P5)}),R5=/*#__PURE__*/ W({title:/*#__PURE__*/ L5(U),readOnlyHint:/*#__PURE__*/ L5(QE),destructiveHint:/*#__PURE__*/ L5(QE),idempotentHint:/*#__PURE__*/ L5(QE),openWorldHint:/*#__PURE__*/ L5(QE)});({...jme.fields}),{...j5.fields},{...j5.fields},{...M5.fields},{...j5.fields},{...j5.fields},{...k5.fields},{...k5.fields},{...k5.fields},{...k5.fields},{...A5.fields};const z5=E5,B5=q,V5=/*#__PURE__*/ z5(B5),H5=/*#__PURE__*/ W({name:U,title:/*#__PURE__*/ z5(U),version:U}),U5=/*#__PURE__*/ W({...Sme.fields,elicitation:/*#__PURE__*/ z5(/*#__PURE__*/ W({}))}),W5=/*#__PURE__*/ W({audience:/*#__PURE__*/ z5(/*#__PURE__*/ G(O5)),priority:/*#__PURE__*/ z5(/*#__PURE__*/ kD.check(/*#__PURE__*/ PD({minimum:0,maximum:1})))}),G5=/*#__PURE__*/ W({...Ome.fields,title:/*#__PURE__*/ z5(U),annotations:/*#__PURE__*/ z5(W5),_meta:V5}),Ime=/*#__PURE__*/ W({...kme.fields,title:/*#__PURE__*/ z5(U),annotations:/*#__PURE__*/ z5(W5),_meta:V5}),K5=/*#__PURE__*/ K([/* @__PURE__ */ W({...wme.fields,_meta:V5}),/* @__PURE__ */ W({...Tme.fields,_meta:V5})]),Lme=/*#__PURE__*/ W({...F5.fields,title:/*#__PURE__*/ z5(U)}),Rme=/*#__PURE__*/ W({...Ame.fields,title:/*#__PURE__*/ z5(U),arguments:/*#__PURE__*/ z5(/*#__PURE__*/ G(Lme)),_meta:V5}),q5=/*#__PURE__*/ W({type:/*#__PURE__*/ UE(`resource`),resource:K5,annotations:/*#__PURE__*/ z5(W5),_meta:V5}),zme=/*#__PURE__*/ W({...G5.fields,type:/*#__PURE__*/ UE(`resource_link`)}),J5=/*#__PURE__*/ W({...Eme.fields,annotations:/*#__PURE__*/ z5(W5),_meta:V5}),Y5=/*#__PURE__*/ W({...Dme.fields,annotations:/*#__PURE__*/ z5(W5),_meta:V5}),X5=/*#__PURE__*/ W({...Fme.fields,annotations:/*#__PURE__*/ z5(W5),_meta:V5}),Z5=/*#__PURE__*/ K([J5,Y5,X5,q5,zme]),Q5=/*#__PURE__*/ K([J5,Y5,X5]),Bme=/*#__PURE__*/ W({role:O5,content:Z5}),$5=/*#__PURE__*/ W({role:O5,content:Q5}),Vme=/*#__PURE__*/ W({...Pme.fields}),e7=/*#__PURE__*/ W({...j5.fields,protocolVersion:U,capabilities:Vme,serverInfo:H5,instructions:/*#__PURE__*/ z5(U)});var Hme=class extends (/*#__PURE__*/ zP(`initialize`,{success:e7,error:N5,payload:{...k5.fields,protocolVersion:U,capabilities:U5,clientInfo:H5}})){};const t7=/*#__PURE__*/ iD(/*#__PURE__*/ W({type:/*#__PURE__*/ UE(`object`),properties:/*#__PURE__*/ z5(/*#__PURE__*/ rD(U,B5)),required:/*#__PURE__*/ z5(/*#__PURE__*/ G(U))}),[q]),Ume=/*#__PURE__*/ W({name:U,title:/*#__PURE__*/ z5(U),description:/*#__PURE__*/ z5(U),inputSchema:t7,outputSchema:/*#__PURE__*/ z5(t7),annotations:/*#__PURE__*/ z5(R5),_meta:V5}),n7=/*#__PURE__*/ W({...j5.fields,content:/*#__PURE__*/ G(Z5),structuredContent:/*#__PURE__*/ z5(B5),isError:/*#__PURE__*/ z5(QE)}),Wme=/*#__PURE__*/ W({...j5.fields,role:O5,content:Q5,model:U,stopReason:/*#__PURE__*/ z5(U)});var Gme=class extends (/*#__PURE__*/ zP(`sampling/createMessage`,{success:Wme,error:N5,payload:{...k5.fields,messages:/*#__PURE__*/ G($5),modelPreferences:/*#__PURE__*/ z5(I5),systemPrompt:/*#__PURE__*/ z5(U),includeContext:/*#__PURE__*/ z5(/*#__PURE__*/ lD([`none`,`thisServer`,`allServers`])),temperature:/*#__PURE__*/ z5(kD),maxTokens:kD,stopSequences:/*#__PURE__*/ z5(/*#__PURE__*/ G(U)),metadata:/*#__PURE__*/ z5(B5)}})){};const Kme=/*#__PURE__*/ W({...Mme.fields,title:/*#__PURE__*/ z5(U)}),qme=/*#__PURE__*/ W({type:/*#__PURE__*/ UE(`ref/resource`),uri:U});({...k5.fields}),{...M5.fields},{...M5.fields},{...j5.fields},{...M5.fields};const Jme=/*#__PURE__*/ W({...j5.fields,description:/*#__PURE__*/ z5(U),messages:/*#__PURE__*/ G(Bme)});({...M5.fields}),{...k5.fields},{...k5.fields};var Yme=class extends (/*#__PURE__*/ zP(`tools/call`,{success:n7,error:N5,payload:{...k5.fields,name:U,arguments:/*#__PURE__*/ z5(B5)}})){};({...j5.fields}),{...k5.fields};const Q=E5,r7=q,i7=/*#__PURE__*/ Q(r7),a7=/*#__PURE__*/ W({src:U,mimeType:/*#__PURE__*/ Q(U),sizes:/*#__PURE__*/ Q(/*#__PURE__*/ G(U)),theme:/*#__PURE__*/ Q(/*#__PURE__*/ lD([`light`,`dark`]))}),Xme=/*#__PURE__*/ W({...H5.fields,description:/*#__PURE__*/ Q(U),websiteUrl:/*#__PURE__*/ Q(U),icons:/*#__PURE__*/ Q(/*#__PURE__*/ G(a7))});({...U5.fields});const o7=/*#__PURE__*/ W({...W5.fields,lastModified:/*#__PURE__*/ Q(U)}),s7=/*#__PURE__*/ W({...G5.fields,annotations:/*#__PURE__*/ Q(o7),icons:/*#__PURE__*/ Q(/*#__PURE__*/ G(a7))}),Zme=/*#__PURE__*/ W({...Ime.fields,annotations:/*#__PURE__*/ Q(o7),icons:/*#__PURE__*/ Q(/*#__PURE__*/ G(a7))}),Qme=/*#__PURE__*/ W({...Rme.fields,icons:/*#__PURE__*/ Q(/*#__PURE__*/ G(a7))}),c7=/*#__PURE__*/ W({...J5.fields,annotations:/*#__PURE__*/ Q(o7)}),l7=/*#__PURE__*/ W({...Y5.fields,annotations:/*#__PURE__*/ Q(o7)}),u7=/*#__PURE__*/ W({...X5.fields,annotations:/*#__PURE__*/ Q(o7)}),d7=/*#__PURE__*/ W({...q5.fields,annotations:/*#__PURE__*/ Q(o7)}),$me=/*#__PURE__*/ K([c7,l7,u7,/* @__PURE__ */ W({...s7.fields,type:/*#__PURE__*/ UE(`resource_link`)}),d7]),ehe=/*#__PURE__*/ W({...Ume.fields,icons:/*#__PURE__*/ Q(/*#__PURE__*/ G(a7))});({...n7.fields}),Yme.payloadSchema;const f7=/*#__PURE__*/ W({type:/*#__PURE__*/ UE(`tool_use`),id:U,name:U,input:r7,_meta:i7}),p7=/*#__PURE__*/ K([c7,l7,u7,f7,/* @__PURE__ */ W({type:/*#__PURE__*/ UE(`tool_result`),toolUseId:U,content:/*#__PURE__*/ G($me),structuredContent:/*#__PURE__*/ Q(r7),isError:/*#__PURE__*/ Q(QE),_meta:i7})]),the=/*#__PURE__*/ W({role:O5,content:/*#__PURE__*/ K([p7,/*#__PURE__*/ G(p7)]),_meta:i7}),nhe=/*#__PURE__*/ W({mode:/*#__PURE__*/ Q(/*#__PURE__*/ lD([`auto`,`required`,`none`]))});({...j5.fields,...the.fields}),{...Gme.payloadSchema.fields};const rhe=/*#__PURE__*/ W({...Nme.fields,_meta:i7});({...j5.fields});const ihe=/*#__PURE__*/ W({type:/*#__PURE__*/ UE(`string`),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),minLength:/*#__PURE__*/ Q(ID),maxLength:/*#__PURE__*/ Q(ID),format:/*#__PURE__*/ Q(/*#__PURE__*/ lD([`email`,`uri`,`date`,`date-time`])),default:/*#__PURE__*/ Q(U)}),ahe=/*#__PURE__*/ W({type:/*#__PURE__*/ lD([`number`,`integer`]),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),minimum:/*#__PURE__*/ Q(kD),maximum:/*#__PURE__*/ Q(kD),default:/*#__PURE__*/ Q(kD)}),ohe=/*#__PURE__*/ W({type:/*#__PURE__*/ UE(`boolean`),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),default:/*#__PURE__*/ Q(QE)}),m7=/*#__PURE__*/ W({const:U,title:U}),she=/*#__PURE__*/ K([/* @__PURE__ */ W({type:/*#__PURE__*/ UE(`string`),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),enum:/*#__PURE__*/ G(U),default:/*#__PURE__*/ Q(U)}),/* @__PURE__ */ W({type:/*#__PURE__*/ UE(`string`),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),oneOf:/*#__PURE__*/ G(m7),default:/*#__PURE__*/ Q(U)})]),che=/*#__PURE__*/ K([/* @__PURE__ */ W({type:/*#__PURE__*/ UE(`array`),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),minItems:/*#__PURE__*/ Q(ID),maxItems:/*#__PURE__*/ Q(ID),items:/*#__PURE__*/ W({type:/*#__PURE__*/ UE(`string`),enum:/*#__PURE__*/ G(U)}),default:/*#__PURE__*/ Q(/*#__PURE__*/ G(U))}),/* @__PURE__ */ W({type:/*#__PURE__*/ UE(`array`),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),minItems:/*#__PURE__*/ Q(ID),maxItems:/*#__PURE__*/ Q(ID),items:/*#__PURE__*/ W({anyOf:/*#__PURE__*/ G(m7)}),default:/*#__PURE__*/ Q(/*#__PURE__*/ G(U))})]),lhe=/*#__PURE__*/ W({type:/*#__PURE__*/ UE(`string`),title:/*#__PURE__*/ Q(U),description:/*#__PURE__*/ Q(U),enum:/*#__PURE__*/ G(U),enumNames:/*#__PURE__*/ Q(/*#__PURE__*/ G(U)),default:/*#__PURE__*/ Q(U)});({...k5.fields}),{...k5.fields},{...j5.fields},{...e7.fields},{...Hme.payloadSchema.fields},{...M5.fields},{...M5.fields},{...M5.fields},{...Jme.fields},{...M5.fields},{...k5.fields};const h7=`2026-07-28`,$=E5,g7=/*#__PURE__*/ $(q),_7=/*#__PURE__*/ K([U,ID]),v7=_7,y7=O5,b7=xme,x7=Xme,uhe=/*#__PURE__*/ iD(/*#__PURE__*/ W({experimental:/*#__PURE__*/ $(/*#__PURE__*/ rD(U,q)),roots:/*#__PURE__*/ $(/*#__PURE__*/ W({})),sampling:/*#__PURE__*/ $(/*#__PURE__*/ W({context:/*#__PURE__*/ $(q),tools:/*#__PURE__*/ $(q)})),elicitation:/*#__PURE__*/ $(/*#__PURE__*/ W({form:/*#__PURE__*/ $(q),url:/*#__PURE__*/ $(q)})),extensions:/*#__PURE__*/ $(/*#__PURE__*/ rD(U,q))}),[q]),dhe=/*#__PURE__*/ iD(/*#__PURE__*/ W({experimental:/*#__PURE__*/ $(/*#__PURE__*/ rD(U,q)),logging:/*#__PURE__*/ $(q),completions:/*#__PURE__*/ $(q),prompts:/*#__PURE__*/ $(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ $(QE)})),resources:/*#__PURE__*/ $(/*#__PURE__*/ W({subscribe:/*#__PURE__*/ $(QE),listChanged:/*#__PURE__*/ $(QE)})),tools:/*#__PURE__*/ $(/*#__PURE__*/ W({listChanged:/*#__PURE__*/ $(QE)})),extensions:/*#__PURE__*/ $(/*#__PURE__*/ rD(U,q))}),[q]),S7=/*#__PURE__*/ iD(/*#__PURE__*/ W({progressToken:/*#__PURE__*/ $(v7),"io.modelcontextprotocol/protocolVersion":U,"io.modelcontextprotocol/clientInfo":/*#__PURE__*/ $(x7),"io.modelcontextprotocol/clientCapabilities":uhe,"io.modelcontextprotocol/logLevel":/*#__PURE__*/ $(b7)}),[q]),C7=/*#__PURE__*/ W({_meta:S7}),w7=/*#__PURE__*/ W({_meta:/*#__PURE__*/ $(/* @__PURE__ */ iD(/*#__PURE__*/ W({"io.modelcontextprotocol/subscriptionId":/*#__PURE__*/ $(_7)}),[q]))}),T7=/*#__PURE__*/ iD(/*#__PURE__*/ W({"io.modelcontextprotocol/serverInfo":x7}),[q]),E7={_meta:T7,resultType:/*#__PURE__*/ UE(`complete`)},D7=/*#__PURE__*/ W({code:ID,message:U,data:/*#__PURE__*/ $(CO)}),fhe=o7,O7=/*#__PURE__*/ W({...s7.fields,size:/*#__PURE__*/ $(ID),annotations:/*#__PURE__*/ $(fhe)}),k7=Zme,phe=K5,A7=c7,j7=l7,M7=u7,N7=/*#__PURE__*/ K([A7,j7,M7,/* @__PURE__ */ W({...O7.fields,type:/*#__PURE__*/ UE(`resource_link`)}),d7]),P7=Qme,mhe=/*#__PURE__*/ W({role:y7,content:N7}),hhe=/*#__PURE__*/ iD(/*#__PURE__*/ W({$schema:/*#__PURE__*/ $(U),type:/*#__PURE__*/ UE(`object`)}),[q]),ghe=/*#__PURE__*/ iD(/*#__PURE__*/ W({$schema:/*#__PURE__*/ $(U)}),[q]),_he=R5,F7=/*#__PURE__*/ W({...ehe.fields,inputSchema:hhe,outputSchema:/*#__PURE__*/ $(ghe),annotations:/*#__PURE__*/ $(_he)}),I7=/*#__PURE__*/ K([A7,j7,M7,f7,/* @__PURE__ */ W({type:/*#__PURE__*/ UE(`tool_result`),toolUseId:U,content:/*#__PURE__*/ G(N7),structuredContent:/*#__PURE__*/ $(CO),isError:/*#__PURE__*/ $(QE),_meta:g7})]),L7=/*#__PURE__*/ W({role:y7,content:/*#__PURE__*/ K([I7,/*#__PURE__*/ G(I7)]),_meta:g7}),vhe=/*#__PURE__*/ iD(/*#__PURE__*/ W({name:/*#__PURE__*/ $(U)}),[q]),R7=/*#__PURE__*/ kD.check(/*#__PURE__*/ PD({minimum:0,maximum:1})),yhe=/*#__PURE__*/ W({...I5.fields,hints:/*#__PURE__*/ $(/*#__PURE__*/ G(vhe)),costPriority:/*#__PURE__*/ $(R7),speedPriority:/*#__PURE__*/ $(R7),intelligencePriority:/*#__PURE__*/ $(R7)}),bhe=/*#__PURE__*/ W({method:/*#__PURE__*/ UE(`sampling/createMessage`),params:/*#__PURE__*/ W({messages:/*#__PURE__*/ G(L7),modelPreferences:/*#__PURE__*/ $(yhe),systemPrompt:/*#__PURE__*/ $(U),includeContext:/*#__PURE__*/ $(/*#__PURE__*/ lD([`none`,`thisServer`,`allServers`])),temperature:/*#__PURE__*/ $(kD),maxTokens:ID,stopSequences:/*#__PURE__*/ $(/*#__PURE__*/ G(U)),metadata:/*#__PURE__*/ $(q),tools:/*#__PURE__*/ $(/*#__PURE__*/ G(F7)),toolChoice:/*#__PURE__*/ $(nhe)})}),xhe=/*#__PURE__*/ W({...L7.fields,model:U,stopReason:/*#__PURE__*/ $(U)}),She=rhe,Che=/*#__PURE__*/ W({method:/*#__PURE__*/ UE(`roots/list`),params:/*#__PURE__*/ $(/*#__PURE__*/ W({_meta:g7}))}),whe=/*#__PURE__*/ W({roots:/*#__PURE__*/ G(She)}),The=/*#__PURE__*/ W({method:/*#__PURE__*/ UE(`elicitation/create`),params:/* @__PURE__ */ K([/* @__PURE__ */ W({mode:/*#__PURE__*/ $(/*#__PURE__*/ UE(`form`)),message:U,requestedSchema:/* @__PURE__ */ W({$schema:/*#__PURE__*/ $(U),type:/*#__PURE__*/ UE(`object`),properties:/*#__PURE__*/ rD(U,/* @__PURE__ */ K([/* @__PURE__ */ K([lhe,she,che]),ihe,ahe,ohe])),required:/*#__PURE__*/ $(/*#__PURE__*/ G(U))})}),/* @__PURE__ */ W({mode:/*#__PURE__*/ UE(`url`),message:U,url:U})])}),Ehe=/*#__PURE__*/ W({action:/*#__PURE__*/ lD([`accept`,`decline`,`cancel`]),content:/*#__PURE__*/ $(/*#__PURE__*/ rD(U,/*#__PURE__*/ K([U,kD,QE,/*#__PURE__*/ G(U)])))}),Dhe=/*#__PURE__*/ K([bhe,Che,The]),Ohe=/*#__PURE__*/ K([xhe,whe,Ehe]),z7=/*#__PURE__*/ rD(U,Dhe),khe=/*#__PURE__*/ rD(U,Ohe),B7={_meta:T7,resultType:/*#__PURE__*/ UE(`input_required`)},V7=/*#__PURE__*/ K([/*#__PURE__*/ iD(/*#__PURE__*/ W({...B7,inputRequests:z7,requestState:/*#__PURE__*/ $(U)}),[q]),/*#__PURE__*/ iD(/*#__PURE__*/ W({...B7,inputRequests:/*#__PURE__*/ $(z7),requestState:U}),[q])]),H7={...C7.fields,inputResponses:/*#__PURE__*/ $(khe),requestState:/*#__PURE__*/ $(U)},U7={...E7,ttlMs:/*#__PURE__*/ ID.check(/*#__PURE__*/ ND(0)),cacheScope:/*#__PURE__*/ lD([`public`,`private`])},W7={...C7.fields,cursor:/*#__PURE__*/ $(U)},G7={...E7,nextCursor:/*#__PURE__*/ $(U)},K7=/*#__PURE__*/ iD(/*#__PURE__*/ W({...U7,supportedVersions:/*#__PURE__*/ G(U),capabilities:dhe,instructions:/*#__PURE__*/ $(U)}),[q]);var Ahe=class extends (/*#__PURE__*/ zP(`server/discover`,{success:K7,error:D7,payload:C7})){};const q7=/*#__PURE__*/ iD(/*#__PURE__*/ W({...G7,...U7,resources:/*#__PURE__*/ G(O7)}),[q]);var jhe=class extends (/*#__PURE__*/ zP(`resources/list`,{success:q7,error:D7,payload:W7})){};const J7=/*#__PURE__*/ iD(/*#__PURE__*/ W({...G7,...U7,resourceTemplates:/*#__PURE__*/ G(k7)}),[q]);var Mhe=class extends (/*#__PURE__*/ zP(`resources/templates/list`,{success:J7,error:D7,payload:W7})){};const Y7=/*#__PURE__*/ iD(/*#__PURE__*/ W({...U7,contents:/*#__PURE__*/ G(phe)}),[q]);var Nhe=class extends (/*#__PURE__*/ zP(`resources/read`,{success:/*#__PURE__*/ K([Y7,V7]),error:D7,payload:{...H7,uri:U}})){};const X7=/*#__PURE__*/ iD(/*#__PURE__*/ W({...G7,...U7,prompts:/*#__PURE__*/ G(P7)}),[q]);var Phe=class extends (/*#__PURE__*/ zP(`prompts/list`,{success:X7,error:D7,payload:W7})){};const Z7=/*#__PURE__*/ iD(/*#__PURE__*/ W({...E7,description:/*#__PURE__*/ $(U),messages:/*#__PURE__*/ G(mhe)}),[q]);var Fhe=class extends (/*#__PURE__*/ zP(`prompts/get`,{success:/*#__PURE__*/ K([Z7,V7]),error:D7,payload:{...H7,name:U,arguments:/*#__PURE__*/ $(/*#__PURE__*/ rD(U,U))}})){};const Q7=/*#__PURE__*/ iD(/*#__PURE__*/ W({...G7,...U7,tools:/*#__PURE__*/ G(F7)}),[q]);var Ihe=class extends (/*#__PURE__*/ zP(`tools/list`,{success:Q7,error:D7,payload:W7})){};const $7=/*#__PURE__*/ iD(/*#__PURE__*/ W({...E7,content:/*#__PURE__*/ G(N7),structuredContent:/*#__PURE__*/ $(CO),isError:/*#__PURE__*/ $(QE)}),[q]);var Lhe=class extends (/*#__PURE__*/ zP(`tools/call`,{success:/*#__PURE__*/ K([$7,V7]),error:D7,payload:{...H7,name:U,arguments:/*#__PURE__*/ $(q)}})){};const Rhe=Kme,zhe=qme,e9=/*#__PURE__*/ iD(/*#__PURE__*/ W({...E7,completion:/*#__PURE__*/ W({values:/*#__PURE__*/ G(U).check(/*#__PURE__*/ zD(100)),total:/*#__PURE__*/ $(ID),hasMore:/*#__PURE__*/ $(QE)})}),[q]);var Bhe=class extends (/*#__PURE__*/ zP(`completion/complete`,{success:e9,error:D7,payload:{...C7.fields,ref:/*#__PURE__*/ K([Rhe,zhe]),argument:/*#__PURE__*/ W({name:U,value:U}),context:/*#__PURE__*/ $(/*#__PURE__*/ W({arguments:/*#__PURE__*/ $(/*#__PURE__*/ rD(U,U))}))}})){};const t9=/*#__PURE__*/ W({toolsListChanged:/*#__PURE__*/ $(QE),promptsListChanged:/*#__PURE__*/ $(QE),resourcesListChanged:/*#__PURE__*/ $(QE),resourceSubscriptions:/*#__PURE__*/ $(/*#__PURE__*/ G(U))}),n9=/*#__PURE__*/ iD(/*#__PURE__*/ W({_meta:/* @__PURE__ */ iD(/*#__PURE__*/ W({"io.modelcontextprotocol/serverInfo":x7,"io.modelcontextprotocol/subscriptionId":_7}),[q]),resultType:/*#__PURE__*/ UE(`complete`)}),[q]);var Vhe=class extends (/*#__PURE__*/ zP(`subscriptions/listen`,{success:n9,error:D7,payload:{...C7.fields,notifications:t9}})){},r9=class extends (/*#__PURE__*/ zP(`notifications/cancelled`,{payload:{...w7.fields,requestId:_7,reason:/*#__PURE__*/ $(U)}})){},Hhe=class extends (/*#__PURE__*/ zP(`notifications/progress`,{payload:{...w7.fields,progressToken:v7,progress:kD,total:/*#__PURE__*/ $(kD),message:/*#__PURE__*/ $(U)}})){},Uhe=class extends (/*#__PURE__*/ zP(`notifications/message`,{payload:{...w7.fields,level:b7,logger:/*#__PURE__*/ $(U),data:CO}})){},i9=class extends (/*#__PURE__*/ zP(`notifications/resources/updated`,{payload:{...w7.fields,uri:U}})){},a9=class extends (/*#__PURE__*/ zP(`notifications/resources/list_changed`,{payload:/*#__PURE__*/ dD(w7)})){},o9=class extends (/*#__PURE__*/ zP(`notifications/tools/list_changed`,{payload:/*#__PURE__*/ dD(w7)})){},s9=class extends (/*#__PURE__*/ zP(`notifications/prompts/list_changed`,{payload:/*#__PURE__*/ dD(w7)})){},c9=class extends (/*#__PURE__*/ zP(`notifications/subscriptions/acknowledged`,{payload:{...w7.fields,notifications:t9}})){},l9=class extends (/*#__PURE__*/ nF(Ahe,Bhe,Fhe,Phe,jhe,Mhe,Nhe,Vhe,Lhe,Ihe)){},u9=class extends (/*#__PURE__*/ nF(r9)){},Whe=class extends (/*#__PURE__*/ l9.merge(u9)){},Ghe=class extends (/*#__PURE__*/ nF()){},Khe=class extends (/*#__PURE__*/ nF(r9,Hhe,Uhe,i9,a9,o9,s9,c9)){};const qhe=/*#__PURE__*/ rD(U,q),Jhe=/*#__PURE__*/ DE(S7),Yhe=/*#__PURE__*/ DE(r9.payloadSchema),Xhe=/*#__PURE__*/ EE(CO),d9=/*#__PURE__*/ PE(x7),f9=e=>{let t={};for(let n in e)e[n]!==void 0&&(t[n]=e[n]);return t},Zhe=(e,t)=>{if(qn(t))return e===void 0;if(e===void 0)return!1;let n=s5(e);return n!==void 0&&vj(t).pipe(yj(bie,e=>n===e),yj(Sie,e=>n===String(e)),yj(xie,e=>Number.isSafeInteger(e)&&n.trim().length>0&&Number(n)===e),Cj(()=>!1))},Qhe=/*#__PURE__*/ V(function*(e){let t=yield*Jhe(e);return{protocolVersion:h7,clientCapabilities:t[`io.modelcontextprotocol/clientCapabilities`],clientInfo:t[`io.modelcontextprotocol/clientInfo`],requestMetadata:t}}),p9=(e,t)=>{let n=e._meta;return{...Qn(n)?n:{},"io.modelcontextprotocol/serverInfo":t}},m9=(e,t)=>f9({_meta:{"io.modelcontextprotocol/serverInfo":t},resultType:`input_required`,inputRequests:e.inputRequests,requestState:e.requestState}),h9=/*#__PURE__*/ DE(/*#__PURE__*/ K([$7,V7])),g9=/*#__PURE__*/ V(function*(e,t){let n=yield*d9(t);return e._tag===`Complete`?yield*h9({...f9(e.value),_meta:p9(e.value,n),resultType:`complete`}):yield*h9(m9(e,n))}),$he=(e,t)=>{let n={};for(let r of Object.values(e??{}))vj(r).pipe(yj({method:`roots/list`},()=>{t.roots===void 0&&(n.roots={})}),yj({method:`sampling/createMessage`},e=>{let r=n.sampling??{};lme(e.params)&&t.sampling?.tools===void 0&&(r.tools={}),(e.params.includeContext===`thisServer`||e.params.includeContext===`allServers`)&&t.sampling?.context===void 0&&(r.context={}),(t.sampling===void 0||Object.keys(r).length>0)&&(n.sampling=r)}),yj({method:`elicitation/create`},e=>{let r=e.params.mode===`url`?`url`:`form`,i=t.elicitation;i!==void 0&&(r===`url`?i.url!==void 0:i.form!==void 0||Object.keys(i).length===0)||((n.elicitation??={})[r]={})}),wj);return n},_9=e=>f9({uri:e.uri,mimeType:e.mimeType,_meta:e._meta,...`text`in e?{text:e.text}:{blob:lc(e.blob)}}),v9=/*#__PURE__*/ _j().pipe(/*#__PURE__*/ yj({type:/*#__PURE__*/ Sj(`text`,`resource_link`)},e=>e),/*#__PURE__*/ yj({type:/*#__PURE__*/ Sj(`image`,`audio`)},e=>f9({type:e.type,mimeType:e.mimeType,data:lc(e.data),annotations:e.annotations,_meta:e._meta})),/*#__PURE__*/ yj({type:`resource`},e=>f9({type:`resource`,resource:_9(e.resource),annotations:e.annotations,_meta:e._meta})),wj),ege=e=>O7.make(e),tge=e=>k7.make(e),nge=e=>f5(Hpe,P7,e),rge=e=>f5(Y8,F7,e),y9={ttlMs:0,cacheScope:`private`},b9=/*#__PURE__*/ V(function*(e,t){let n=yield*d9(t);return{...f9(e),_meta:p9(e,n),resultType:`complete`}}),ige=/*#__PURE__*/ _j().pipe(/*#__PURE__*/ bj(`ResourceNotFound`,e=>new d5({code:-32602,message:`Resource '${e.uri}' not found`,data:{uri:e.uri}})),/*#__PURE__*/ bj(`ToolNotFound`,`InvalidToolInput`,`InvalidToolContinuation`,`ToolExecutionError`,`UnsupportedByProtocol`,d5.fromTool),/*#__PURE__*/ Cj(d5.fromFeature)),x9=e=>{let t=ige(e);return D7.make({code:t.code,message:t.message,...Xhe(t.data)?{data:t.data}:{}})},S9=/*#__PURE__*/ V(function*(e,t){let n=yield*ng(cP);return Oa(n)&&hP(n.value,(t,n)=>F(toe(n,e))),yield*t}),age=e=>Yhe(e).pipe(B(e=>({requestId:e.requestId,reason:e.reason,metadata:e._meta}))),C9=e=>new Qpe({operation:e,protocolVersion:h7,reason:`MCP 2026-07-28 carries server input requests in multi round-trip results`}),oge=/* @__PURE__ */ fme({protocolVersion:h7,runtime:{_tag:`Stateless`,transport:{jsonRpc:{acceptsBatches:!1},http:{}},profileFromRequestMetadata:Qhe},clientRpcs:Whe,clientNotificationRpcs:u9,serverRequestRpcs:Ghe,serverNotificationRpcs:Khe,handlerRpcs:/* @__PURE__ */ l9.merge(u9),makeHandlers:(e,t,n)=>{let r=DE(qhe),i=DE(K7),a=DE(q7),o=DE(J7),s=DE(Y7),c=DE(X7),l=DE(Z7),u=DE(K([Z7,V7])),d=DE(e9),f=DE(Q7),p=n.sendNotification,m=p!==void 0,h=n.serverInfo.extensions===void 0?void 0:eo(n.serverInfo.extensions,e=>Qn(e)),g=B(n.registrationPresence,e=>{let t={completions:{},logging:{}};return h!==void 0&&(t.extensions=h),e.tools&&(t.tools={listChanged:m}),e.resources&&(t.resources={listChanged:m,subscribe:m}),e.prompts&&(t.prompts={listChanged:m}),{supportedVersions:n.supportedVersions,capabilities:t,serverInfo:n.serverInfo}}),_=e5.useSync(l5),v=V(function*(e){let t=yield*e5,n=e.inputResponses===void 0?void 0:yield*r(e.inputResponses).pipe(Lh);return l5(e5.of({...t,inputResponses:n,requestState:e.requestState}))}),y=V(function*(e,t){let n=$he(e.inputRequests,t);if(Object.keys(n).length!==0)return yield*S9(400,new d5({code:-32021,message:`The request requires client capabilities that were not declared`,data:{requiredCapabilities:n}}))});return{"subscriptions/listen":V(function*(e,{client:t,requestId:r}){if(p===void 0)return yield*new d5({code:-32601,message:`Method not found: subscriptions/listen`});let i=yield*n.registrationPresence,a=yield*Gp(yield*ag),o=yield*Hp(n.subscribeServerNotifications,a),s={...i.tools&&e.notifications.toolsListChanged===!0?{toolsListChanged:!0}:{},...i.prompts&&e.notifications.promptsListChanged===!0?{promptsListChanged:!0}:{},...i.resources&&e.notifications.resourcesListChanged===!0?{resourcesListChanged:!0}:{},...i.resources&&e.notifications.resourceSubscriptions!==void 0?{resourceSubscriptions:e.notifications.resourceSubscriptions}:{}},c={"io.modelcontextprotocol/subscriptionId":r},l=new Set(s.resourceSubscriptions),u=yield*wx(64),d=yield*Op();yield*mh(function*(){for(;;){let e=yield*sie(o);if(e.targetClientId!==void 0&&e.targetClientId!==t.id)continue;let n=e.notification,r=vj(n).pipe(xj({ToolsChanged:()=>s.toolsListChanged===!0?o9:void 0,PromptsChanged:()=>s.promptsListChanged===!0?s9:void 0,ResourcesChanged:()=>s.resourcesListChanged===!0?a9:void 0,ResourceUpdated:e=>l.has(e.uri)?i9:void 0}),wj);if(r===void 0)continue;let i={tag:r._tag,payload:r.payloadSchema.make({_meta:{...n.metadata,...c},...n._tag===`ResourceUpdated`?{uri:n.uri}:{}})};if(!(yield*Tx(u,i)))break}}).pipe(Yp(a),wh(dh(()=>n.markSubscriptionCancelled?.(t.id,r)??L)),wh(Fp(d,void 0)),Ag),yield*p(h7,t.id,{tag:c9._tag,payload:c9.payloadSchema.make({_meta:c,notifications:s})});let f=Sg(Rx(u).pipe(z(e=>p(h7,t.id,e))));yield*Gh(f,kp(d)),yield*n.terminateSubscription?.(`2026-07-28`,t.id,r,`Pending notification limit exceeded`)??L;let m=yield*d9(n.serverInfo);return n9.make({_meta:{...c,"io.modelcontextprotocol/serverInfo":m},resultType:`complete`})},Ih(x9)),"server/discover":V(function*(e){let t=yield*g,r=yield*b9({...y9,supportedVersions:Array.from(t.supportedVersions),capabilities:t.capabilities,instructions:n.serverInfo.instructions},n.serverInfo);return yield*i(r)},Ih(x9)),"resources/list":V(function*(t){let r=yield*_,i=yield*e.resources.list(r.protocol),o=yield*b9({...y9,resources:i.map(ege)},n.serverInfo);return yield*a(o)},Ih(x9)),"resources/templates/list":V(function*(t){let r=yield*_,i=yield*e.resources.listTemplates(r.protocol),a=yield*b9({...y9,resourceTemplates:i.map(tge)},n.serverInfo);return yield*o(a)},Ih(x9)),"resources/read":V(function*(t){let r=yield*v(t),i=yield*e.resources.read(t.uri,r),a=i.contents.map(_9),o=yield*b9({...y9,contents:a,_meta:i._meta},n.serverInfo);return yield*s(o)},Ih(x9)),"prompts/list":V(function*(t){if(!(yield*n.registrationPresence).prompts)return yield*S9(404,new d5({code:A8,message:`Method not found`}));let r=yield*_,i=yield*e.prompts.list(r.protocol),a=yield*ah(i,nge),o=yield*b9({...y9,prompts:a},n.serverInfo);return yield*c(o)},Ih(x9)),"prompts/get":V(function*(t){let r=yield*v(t),i=yield*e.prompts.get(t.name,t.arguments??{},r);if(i._tag===`InputRequired`){yield*y(i,r.protocol.clientCapabilities);let e=yield*d9(n.serverInfo);return yield*u(m9(i,e))}let a=i.value,o=a.messages.map(e=>({role:e.role,content:v9(e.content)})),s=yield*b9({description:a.description,messages:o,_meta:a._meta},n.serverInfo);return yield*l(s)},Ih(x9)),"completion/complete":V(function*(t){let r=yield*_,i=yield*e.completions.complete({reference:t.ref.type===`ref/prompt`?{type:`prompt`,name:t.ref.name,title:t.ref.title}:{type:`resourceTemplate`,uriTemplate:t.ref.uri},argument:t.argument,context:t.context?.arguments===void 0?void 0:{arguments:t.context.arguments},metadata:t._meta},r),a=yield*b9({completion:f9({values:Array.from(i.values),total:i.total,hasMore:i.hasMore}),_meta:i.metadata},n.serverInfo);return yield*d(a)},Ih(x9)),"tools/list":V(function*(t){let r=yield*_,i=yield*e.tools.list(r.protocol),a=yield*ah(i,rge),o=yield*b9({...y9,tools:a},n.serverInfo);return yield*f(o)},Ih(x9)),"tools/call":V(function*(t){let r=yield*v(t),i=(yield*e.tools.list(r.protocol)).find(e=>e.name===t.name),a=yield*ng(cP);if(i!==void 0&&Oa(a)){let e=[{schema:i.inputSchema,argument:t.arguments,path:``}];for(;e.length>0;){let{schema:t,argument:n,path:r}=e.pop();if(!Qn(t))continue;let i=t[`x-mcp-header`];if(typeof i==`string`){let e=`mcp-param-${i.toLowerCase()}`;if(!Zhe(a.value.headers[e],n))return yield*S9(400,new d5({code:N8,message:`${e} does not match argument '${r}'`}))}if(Qn(t.properties))for(let[i,a]of Object.entries(t.properties))e.push({schema:a,argument:Qn(n)&&Object.hasOwn(n,i)?n[i]:void 0,path:r===``?i:`${r}.${i}`})}}let o=yield*e.tools.call({name:t.name,arguments:t.arguments??{}},r).pipe(Mh([`ToolExecutionError`,`InvalidToolInput`],e=>F(i5.Complete(X8.make({content:[G8.make({type:`text`,text:e.message})],isError:!0})))));if(o._tag===`InputRequired`)return yield*y(o,r.protocol.clientCapabilities),yield*g9(o,n.serverInfo);let s=o.value,c=s.content.map(v9);return yield*g9(i5.Complete({content:c,structuredContent:s.structuredContent,isError:s.isError,_meta:s._meta}),n.serverInfo)},Ih(x9)),"notifications/cancelled":V(function*(e){return yield*L})}},toReverseClient:()=>({listRoots:()=>R(C9(`roots/list`)),createMessage:()=>R(C9(`sampling/createMessage`)),elicit:()=>R(C9(`elicitation/create`))}),projectNotification:e=>p5(e)?F(void 0):dme({supportsProgressMessage:!0},e),normalizeCancellation:age}),w9=/*#__PURE__*/ new WeakMap,sge=/*#__PURE__*/ $pe.omit(`notifications/elicitation/complete`),T9=/*#__PURE__*/ EE(Q8),cge=e=>{switch(e.tag){case`notifications/cancelled`:return a5.Cancelled({requestId:e.payload.requestId,reason:e.payload.reason,metadata:e.payload._meta});case`notifications/progress`:return a5.Progress({progressToken:e.payload.progressToken,progress:e.payload.progress,total:e.payload.total,message:e.payload.message,metadata:e.payload._meta});case`notifications/message`:return a5.LoggingMessage({level:e.payload.level,logger:e.payload.logger,data:e.payload.data,metadata:e.payload._meta});case`notifications/resources/updated`:return a5.ResourceUpdated({uri:e.payload.uri,metadata:e.payload._meta});case`notifications/resources/list_changed`:return a5.ResourcesChanged({metadata:e.payload?._meta});case`notifications/tools/list_changed`:return a5.ToolsChanged({metadata:e.payload?._meta});case`notifications/prompts/list_changed`:return a5.PromptsChanged({metadata:e.payload?._meta});default:return}},E9=/*#__PURE__*/ ws(e5,t5,cP,Rp),D9=(e,t)=>{let n=ig(e,e5,t.requestContext),r=t.requestContext.requestMetadata,i=M(r,`io.modelcontextprotocol/logLevel`)?r[`io.modelcontextprotocol/logLevel`]:void 0;return T9(i)&&(n=ig(n,Rp,o5[i].effect)),t.serverClient===void 0?n:ig(n,t5,t.serverClient)};var O9=class e extends (/*#__PURE__*/ N()(`effect/ai/McpServer`)){static make=/*#__PURE__*/ mh(function*(){let t=yield*ome,n=_o(),r=[],i=[],a=[],o=yield*Sx(),s={consumers:0},c=/* @__PURE__ */ new Set,l=(yield*ec).makeDispatcher(),u=yield*XP(sge,{spanPrefix:`McpServer/Notifications`,onFromClient:e=>Op().pipe(z(t=>bh(n=>{let r=e.message;if(r._tag!==`Request`)return L;let i=cge(r);if(i===void 0)return L;let a={notification:i,delivered:t,requestContext:ms(n.context,e5),requestHeaders:ms(n.context,cP)?.headers},d=!1;if(r.tag.includes(`list_changed`)){if(!c.has(r.tag)){d=!0;let e=r.tag;l.scheduleTask(()=>{Ex(o,a),c.delete(r.tag)},0),c.add(e)}}else d=!0,Ex(o,a);let f=dh(()=>u.write({clientId:0,requestId:r.id,_tag:`Exit`,exit:Sp}));return d&&a.requestContext!==void 0&&s.consumers>0?wh(kp(t),f):f})))}),d=e.of({notifications:u.client,notifyElicitationComplete:({clientId:e,elicitationId:t})=>Op().pipe(z(n=>Tx(o,{notification:a5.ElicitationComplete({elicitationId:t}),targetClientId:e,delivered:n}).pipe(wh(dh(()=>s.consumers>0?kp(n):L))))),get tools(){return n},addTool:e=>mh(function*(){let r=n.findIndex(({tool:t})=>t.name===e.tool.name);r===-1?n.push(e):n[r]=e;let i=ms(e.annotations,r5);yield*t.tools.register({descriptor:new Y8({...e.tool,title:e.tool.title??e.tool.annotations?.title}),isVisible:e=>i===void 0||i({protocolVersion:e.protocolVersion,capabilities:e.clientCapabilities,clientInfo:e.clientInfo}),handle:(t,n)=>D9(e.handle(t.arguments),n).pipe(Nh({InternalError:t=>R(new ime({name:e.tool.name,message:t.message})),InvalidParams:t=>R(new(n.requestContext.requestState===void 0&&n.requestContext.inputResponses===void 0?nme:rme)({name:e.tool.name,message:t.message}))}),B(e=>er(e,`InputRequired`)?i5.InputRequired(e):i5.Complete(e)))}),yield*u.client[`notifications/tools/list_changed`]({})}),callTool:e=>mh(function*(){let n=yield*t5,r=yield*t.tools.call(e,c5(n)).pipe(Ih(e=>new L8({message:e._tag===`ToolNotFound`?`Tool '${e.name}' not found`:e.message})));return r._tag===`InputRequired`?yield*new L8({message:`Client input is not supported by this MCP protocol`}):r.value}),get resources(){return r},get resourceTemplates(){return i},addResource:e=>mh(function*(){let n=r.findIndex(({resource:t})=>t.uri===e.resource.uri);n===-1?r.push(e):r[n]=e,yield*t.resources.register({descriptor:e.resource,isVisible:t=>{let n=ms(e.annotations,r5);return n===void 0||n({protocolVersion:t.protocolVersion,capabilities:t.clientCapabilities,clientInfo:t.clientInfo})},read:t=>D9(e.handle,t)}),yield*u.client[`notifications/resources/list_changed`]({})}),addResourceTemplate:({annotations:e,completions:n,handle:r,routerPath:a,template:o})=>mh(function*(){let s=i.findIndex(({template:e})=>e.uriTemplate===o.uriTemplate);s===-1?i.push({template:o,annotations:e}):i[s]={template:o,annotations:e};let c=yge();c.add(a,!0),yield*t.resources.registerTemplate({descriptor:o,isVisible:t=>{let n=ms(e,r5);return n===void 0||n({protocolVersion:t.protocolVersion,capabilities:t.clientCapabilities,clientInfo:t.clientInfo})},match:e=>{let t=c.find(e);if(t===void 0)return;let n=[];for(let e of Object.keys(t.params))n[Number(e)]=t.params[e];return n},read:(e,t,n)=>D9(r(e,Array.from(t)),n)});for(let[e,r]of Object.entries(n))yield*t.completions.register(`resource/${o.uriTemplate}/${e}`,(e,t)=>D9(r(e.argument.value,e.context),t).pipe(B(e=>({values:e.completion.values,total:e.completion.total,hasMore:e.completion.hasMore,metadata:e._meta}))));yield*u.client[`notifications/resources/list_changed`]({})}),findResource:e=>mh(function*(){let n=yield*t5;return yield*t.resources.read(e,c5(n)).pipe(Mh(`ResourceNotFound`,e=>R(new L8({message:`Resource '${e.uri}' not found`}))))}),get prompts(){return a},addPrompt:e=>mh(function*(){let n=a.findIndex(({prompt:t})=>t.name===e.prompt.name);n===-1?a.push(e):a[n]=e,yield*t.prompts.register({descriptor:e.prompt,isVisible:t=>{let n=ms(e.annotations,r5);return n===void 0||n({protocolVersion:t.protocolVersion,capabilities:t.clientCapabilities,clientInfo:t.clientInfo})},get:(t,n)=>D9(e.handle(t),n).pipe(B(e=>er(e,`InputRequired`)?i5.InputRequired(e):i5.Complete(e)))});for(let[n,r]of Object.entries(e.completions))yield*t.completions.register(`prompt/${e.prompt.name}/${n}`,(e,t)=>D9(r(e.argument.value,e.context),t).pipe(B(e=>({values:e.completion.values,total:e.completion.total,hasMore:e.completion.hasMore,metadata:e._meta}))));yield*u.client[`notifications/prompts/list_changed`]({})}),getPromptResult:V(function*({arguments:e,name:n}){let r=yield*t5,i=yield*t.prompts.get(n,e??{},c5(r)).pipe(Mh(`PromptNotFound`,()=>new L8({message:`Prompt '${n}' not found`})));return i._tag===`Complete`?i.value:yield*new L8({message:`Client input is not supported by this MCP protocol`})}),completion:V(function*(e){let n=yield*t5,r=e.ref,i=yield*t.completions.complete({reference:r.type===`ref/resource`?{type:`resourceTemplate`,uriTemplate:r.uri}:{type:`prompt`,name:r.name},argument:e.argument,context:e.context},c5(n));return{_meta:i.metadata,completion:{values:i.values,total:i.total,hasMore:i.hasMore}}})});return w9.set(d,{core:t,notifications:o,notificationDelivery:s}),d});static layer=/*#__PURE__*/ pm(e)(e.make)};const k9=`mcp-session-id`,A9=/*#__PURE__*/ new WeakMap,j9=e=>`${typeof e}:${e}`;var M9=class extends ic{};const lge=/*#__PURE__*/ V(function*(e,t,n){let r=yield*eF,i=yield*O9,a=yield*Rp,o=n===`http`,s=/* @__PURE__ */ new Map,c=/* @__PURE__ */ new Map,l=/* @__PURE__ */ new Map,u=e=>{c.delete(e),s.delete(e),t.disconnect(e)},d=(e,t,n)=>r.send(e,{_tag:`Exit`,requestId:t,exit:{_tag:`Failure`,cause:[{_tag:`Fail`,error:n}]}}),f=(e,t)=>{let n=l.get(e);if(n===void 0)return;let r=n.filter(e=>e!==t);r.length===0?l.delete(e):l.set(e,r)},p=yield*nie(),m=(e,n,i)=>dh(()=>{let a=t.selectProtocol(e),o=a.serverNotificationRpcs.requests.get(i.tag);return o===void 0?_h(`MCP protocol ${e} does not define server notification ${i.tag}`):a.payloadCodecs(o).encode(i.payload).pipe(Lh,z(e=>r.send(n,{_tag:`Request`,id:``,tag:i.tag,payload:e,headers:[],isNotification:!0})))}),h=(e,t)=>{let n=c.get(e),r=j9(t),i=n?.get(r);return i!==void 0&&(n.set(r,{...i,cancelled:!0}),!0)},g=yield*t.installHandlers({core:w9.get(i).core,subscribeServerNotifications:aie(p),...r.supportsNotifications?{sendNotification:m,markSubscriptionCancelled:(e,t)=>I(()=>{h(e,t)}),terminateSubscription:(e,t,n,i)=>dh(()=>h(t,n)?o?r.end(t):m(e,t,{tag:`notifications/cancelled`,payload:{requestId:n,reason:i}}):L)}:{},defaultLogLevel:a,serverInfo:e}),_=yield*JO({lookup:V(function*(e){let n=t.selectProtocol(e.profile.protocolVersion),i,a=yield*QP.make(V(function*(t){let n=0;return i=e=>t(n,e),{send(t,i,a){if(n=t,i._tag===`Request`){let t=j9(i.id),n=l.get(t)??[];return n.push(e),l.set(t,n),r.send(e.clientId,{_tag:`Request`,id:i.id,tag:i.tag,payload:i.payload,headers:[]}).pipe(dg(()=>I(()=>f(t,e))))}return i._tag===`Interrupt`&&f(j9(i.requestId),e),r.send(e.clientId,i)},supportsAck:!0,supportsTransferables:!1,supportsStructuredClone:!1,codecFor:r.codecFor}}));return{client:yield*n.makeReverseClient(e.profile).pipe(ig(QP,a)),write:i}}),idleTimeToLive:1e4}),v=n5.of((e,{client:n,headers:r,payload:i,rpc:o})=>{let c=t.resolveRequest(n.id,r);if(!o._tag.endsWith(`/initialize`)&&!c){let e=qb(),t=ms(e.context,cP);return t&&hP(t,()=>F(oN({status:r[k9]===void 0?400:404}))),_h(/* @__PURE__ */ Error(`Mcp-Session-Id does not exist`))}let l=c?.initializePayload??i,u=s.get(n.id),d=c?.protocol??u?.protocol??t.protocolForInternalTag(o._tag);if(!bge(d.protocolVersion)||d.protocolVersion===`2026-07-28`)return _h(`Unsupported selected MCP protocol version: ${d.protocolVersion}`);let f=c?.negotiatedProfile??{protocolVersion:d.protocolVersion,clientCapabilities:l.capabilities,clientInfo:l.clientInfo};u!==void 0&&(u.profile=f);let p=e5.of({clientId:n.id,protocolVersion:f.protocolVersion,clientCapabilities:f.clientCapabilities,clientInfo:f.clientInfo,requestMetadata:l._meta});return ig(ig(ig(e,t5,t5.of({clientId:n.id,protocolVersion:f.protocolVersion,clientCapabilities:f.clientCapabilities,clientInfo:f.clientInfo,initializePayload:l,requestMetadata:Qn(i)&&Qn(i._meta)?i._meta:void 0,getClient:YO(_,new M9({clientId:n.id,profile:f})).pipe(B(({client:e})=>e))})),e5,p),Rp,t.effectLogLevel(n.id,r,a))}),y=eF.of({...r,send:(e,t)=>{if(t._tag===`Exit`){let i=c.get(e),a=j9(t.requestId),o=i?.get(a)?.cancelled;if(i!==void 0&&i.delete(a)&&i.size===0&&c.delete(e),o===!0)return n===`custom`?L:(A9.set(t,t.requestId),r.send(e,t));if(t.exit._tag===`Failure`&&!t.exit.cause.some(e=>e._tag===`Fail`))return r.send(e,{_tag:`Exit`,requestId:t.requestId,exit:{_tag:`Failure`,cause:[{_tag:`Fail`,error:new R8({message:`Internal error`})}]}})}return r.send(e,t)},run:e=>r.run((n,r)=>{let i=qb(),a=r,p=o?ms(i.context,cP):void 0;switch(p!==void 0&&a._tag!==`Eof`&&hP(p,(e,t)=>F(t.status===200&&t.body._tag===`Uint8Array`&&t.body.contentLength===0?oN({headers:$T(t.headers,`content-type`),status:202}):t)),a._tag){case`Request`:{let r=o?gs(qb().context,cP).headers:JT(a.headers),l=a.tag===`notifications/cancelled`&&typeof a.payload==`object`&&a.payload!==null&&`requestId`in a.payload&&(typeof a.payload.requestId==`string`||typeof a.payload.requestId==`number`)?c.get(n)?.get(j9(a.payload.requestId)):void 0,f=l===void 0?t.prepareRequest(n,r,a):F(l.prepared);return mh(function*(){let l=yield*f,m=s.get(n);o&&m===void 0&&(yield*Wp(gs(i.context,zp),I(()=>u(n))));let _=l.binding,v=l.protocol;if(s.set(n,{protocol:v,profile:l.profile??m?.profile,sessionHeaders:o&&r[k9]!==void 0?JT({[k9]:r[k9]}):m?.sessionHeaders}),a.tag===`invalid/json-rpc-batch`)return yield*d(n,a.id,new F8({message:`JSON-RPC batches are not supported`}));p!==void 0&&_!==void 0&&hP(p,(e,t)=>F(mN(t,`mcp-protocol-version`,_.protocol.protocolVersion)));let y=t.routeClientRequest(v,a),b=t.clientRpcs.requests.get(y.tag),x=v.clientNotificationRpcs.requests.has(a.tag);if(b&&x&&a.isNotification){if(!_&&v.runtime._tag===`Stateful`){p&&hP(p,()=>F(oN({status:r[k9]===void 0?400:404})));return}let t=v.payloadCodecs(b).decode(a.payload);return yield*mh(function*(){let i=yield*t;if(a.tag===`notifications/cancelled`){let t=yield*v.normalizeCancellation(i),r=j9(t.requestId),a=n;if(o){if(_===void 0)return;let e=Array.from(c).find(([,e])=>e.get(r)?.prepared.binding===_);if(e===void 0)return;a=e[0]}return h(a,t.requestId)?yield*e(a,{_tag:`Interrupt`,requestId:t.requestId}):void 0}let s=g.mapUnsafe.get(b.key),u=s?s.handler(i,{rpc:b,requestId:UP(a.id),client:new LP(n),headers:r}):L;return yield*l.requestContext===void 0?u:ig(u,e5,l.requestContext)}).pipe(Vh)}if(!b||x)return a.isNotification?void 0:yield*d(n,a.id,new I8({message:`Method not found: ${a.tag}`}));let S=yield*Eh(v.payloadCodecs(b).decode(a.payload));if(Ha(S))return yield*a.isNotification?L:d(n,a.id,new L8({message:`Invalid method parameters`}));if(a.isNotification!==!0){let e=c.get(n)??/* @__PURE__ */ new Map;e.set(j9(a.id),{prepared:l,cancelled:!1}),c.set(n,e)}let C=e(n,y);return yield*l.requestContext===void 0?C:ig(C,e5,l.requestContext)}).pipe(jh(e=>a.isNotification?L:d(n,a.id,er(e,`ProtocolError`)?d5.fromFeature(e):new L8({message:`Invalid request metadata`}))))}case`Ping`:case`Ack`:case`Interrupt`:return e(n,a);case`Eof`:return o||u(n),e(n,a);case`Pong`:case`Exit`:case`Chunk`:case`ClientProtocolError`:case`Defect`:{let e=a._tag===`Exit`?j9(a.requestId):void 0,r=o?t.resolveRequest(n,gs(qb().context,cP).headers):void 0,i=(e===void 0?void 0:l.get(e))?.find(e=>o?e.profile===r?.negotiatedProfile:e.clientId===n);if(a._tag===`Exit`&&i===void 0)return L;i!==void 0&&e!==void 0&&f(e,i);let c=i?.clientId??n,u=s.get(c),d=u?.protocol??t.protocols[0],p=i?.profile??u?.profile??{protocolVersion:d.protocolVersion,clientCapabilities:{},clientInfo:{name:`unknown`,version:`unknown`}};return YO(_,new M9({clientId:c,profile:p})).pipe(z(({write:e})=>e(a)),og)}}})}),{notificationDelivery:b,notifications:x}=w9.get(i);yield*cg(I(()=>{b.consumers++}),()=>I(()=>{b.consumers--}));let S=/* @__PURE__ */ new Map;return yield*Rx(x).pipe(z(V(function*(e){let{delivered:n,notification:r,targetClientId:i,requestContext:c,requestHeaders:l}=e;p5(r)&&(yield*iie(p,{notification:r,targetClientId:i}));let u=yield*y.clientIds;for(let e of s.keys())u.has(e)||(s.delete(e),t.disconnect(e));let d=r._tag===`LoggingMessage`||r._tag===`Progress`,f=d&&c!==void 0?[c.clientId]:i===void 0?o?s.keys():t.deliveryClientIds():[i],m=[],h=!1;for(let e of f){if(i!==void 0&&e!==i)continue;if(!u.has(e)){t.disconnect(e);continue}if(!y.supportsNotifications)continue;let o=d&&c!==void 0?t.selectProtocol(c.protocolVersion):s.get(e)?.protocol;if(!o)continue;let f=S.get(e),p=e===(i??c?.clientId);h||=p;let g=p?n:Dp();S.set(e,g);let _=mh(function*(){f!==void 0&&(yield*kp(f));let n=yield*o.projectNotification(r);if(n===void 0||r._tag===`Progress`&&o.runtime._tag===`Stateless`&&c?.requestMetadata?.progressToken!==r.progressToken)return;if(r._tag===`LoggingMessage`&&o.runtime._tag===`Stateless`){let t=c?.requestMetadata,n=M(t,`io.modelcontextprotocol/logLevel`)?t[`io.modelcontextprotocol/logLevel`]:void 0;if(c?.clientId!==e||!T9(n)||Q8.literals.indexOf(r.level)<Q8.literals.indexOf(n))return}else if(!t.canDeliver(e,(c?.clientId===e?l:void 0)??s.get(e)?.sessionHeaders??qT,r,a))return;let i=o.serverNotificationRpcs.requests.get(n.tag);if(!i)return;let u=yield*o.payloadCodecs(i).encode(n.payload);yield*y.send(e,{_tag:`Request`,id:``,tag:n.tag,payload:u,headers:[],isNotification:!0})}).pipe(Vh,ug(I(()=>{Ip(g,Sp),S.get(e)===g&&S.delete(e)})));m.push(_)}h||(yield*Fp(n,void 0)),yield*ih(m,{concurrency:`unbounded`,discard:!0}).pipe(Ag({startImmediately:!0}))})),Vh,Sg,Ag),yield*Nse(t.clientRpcs,{spanPrefix:`McpServer`,disableFatalDefects:!0}).pipe(ig(eF,y),ig(n5,v),eg(g))},og),uge=(e,t)=>gm(mh(function*(){let n=yield*T5;yield*Ag(lge(e,n,t))})).pipe(wm(O9.layer)),dge=e=>{let t=yme(e.protocols),n=oN({status:405,headers:{allow:`POST`}}),r=t=>P9(t,e.allowedOrigins)?F(n):F(oN({status:403})),i=bm(bP(`GET`,e.path,r),bP(`PUT`,e.path,r),bP(`PATCH`,e.path,r),bP(`DELETE`,e.path,r),bP(`OPTIONS`,e.path,r));return xm(uge(e,`http`),i).pipe(Cm(fge(e)),Cm(t),Cm(Cse()))},fge=e=>pm(eF)(mh(function*(){let t=yield*T5,{httpEffect:n,protocol:r}=yield*Pse().pipe(ig(GP,pge));return yield*(yield*_P).add(`POST`,e.path,r=>{if(!P9(r,e.allowedOrigins))return F(oN({status:403}));if(F9(r.headers[`content-type`])[0]!==`application/json`)return F(oN({status:415}));let i=F9(r.headers.accept);return!i.includes(`application/json`)||!i.includes(`text/event-stream`)?F(oN({status:406})):mh(function*(){let e=yield*Eh(z(r.text,OE(qD))),i=t.admitHttp(r.headers,e);if(i._tag===`Rejected`)return i.response;let a=B(n,e=>{let t=e.body._tag===`Uint8Array`&&e.body.body.subarray(0,-1).includes(10);return i.isSubscription||e.body._tag===`Stream`||t?gge(e):e});return yield*i.acknowledge?Ph(a,()=>F(oN({status:202}))):a})}),r})),pge=/*#__PURE__*/ (()=>{let e=/*#__PURE__*/ hge();return GP.of({contentType:e.contentType,includesFraming:!0,codecFor:e.codecFor,makeUnsafe:()=>{let t=e.makeUnsafe();return{decode:t.decode,encode:e=>{let n=t.encode(e);return typeof n==`string`?`${n}\n`:n}}}})})(),mge=/*#__PURE__*/ EE(/*#__PURE__*/ SD(`Cause`,{data:/*#__PURE__*/ oD([/*#__PURE__*/ SD(`Fail`,{error:/*#__PURE__*/ HE(z8)})])})),N9=e=>Array.isArray(e)?e.map(N9):!Qn(e)||!M(e,`error`)?e:mge(e.error)?{...e,error:e.error.data[0].error}:e;function hge(e){let t=KP(e);return GP.of({...t,makeUnsafe:()=>{let e=t.makeUnsafe(),n=/* @__PURE__ */ new Set;return{decode:e.decode,encode:t=>{if(Qn(t)){let e=A9.get(t);e!==void 0&&(A9.delete(t),n.add(e))}let r=e.encode(t);if(typeof r!=`string`||n.size===0&&!r.includes(`"_tag":"Cause"`))return r;let i=JSON.parse(r);if(n.size>0){let e=e=>!(Qn(e)&&!M(e,`method`)&&(typeof e.id==`string`||typeof e.id==`number`)&&n.delete(e.id));if(Array.isArray(i)){let t=i.filter(e);if(t.length===0)return;i=t}else if(!e(i))return}return JSON.stringify(N9(i))}}}})}const gge=e=>{let t=new TextEncoder,n=new TextDecoder,r=e=>t.encode(n.decode(e).trimEnd().split(`
517
- `).map(e=>`data: ${e}\n\n`).join(``)),i={status:e.status,statusText:e.statusText,headers:$T(e.headers,`content-type`),cookies:e.cookies,contentType:`text/event-stream`};return e.body._tag===`Stream`?pN(e.body.stream.pipe(Ck(r)),i):e.body._tag===`Uint8Array`?cN(r(e.body.body),i):mN(e,`content-type`,`text/event-stream`)},P9=(e,t)=>{let n=e.headers.origin;return n===void 0||(t??[]).includes(n)},F9=e=>e===void 0?[]:e.split(`,`).flatMap(e=>{let[t,...n]=e.split(`;`),r=n.map(e=>e.trim().toLowerCase()).find(e=>e.startsWith(`q=`));if(r!==void 0){let e=Number(r.slice(2));if(!Number.isFinite(e)||e<=0||e>1)return[]}return[t.trim().toLowerCase()]}),I9=e=>new X8({isError:!0,content:[{type:`text`,text:e}]}),L9=e=>e===void 0?[]:[{type:`text`,text:JSON.stringify(e)}],_ge=/*#__PURE__*/ V(function*(e){let t=yield*O9,n=yield*e.pipe(rg(t=>{let n=new Map(t.mapUnsafe);for(let t of Object.values(e.tools)){let e=n.get(t.id);e!==void 0&&n.set(t.id,{...e,context:E9(e.context)})}return rs(n)})),r=E9(yield*Qh()),i=e=>tg(sj(e),r),a=e=>{let t=sp(e);return Ha(t)&&!cp(e)?hh(t.failure):zg(e).pipe(wh(i(e)),kh(I9(`Tool execution failed due to an internal server error.`)))},o=[];for(let e of Object.values(n.tools)){let t=ype(e)===!0,i=mpe(e)?e.jsonSchema:void 0;if(t&&i!==void 0)return yield*_h(`McpServer cannot strictly validate the raw JSON Schema for tool '${e.name}'; use an Effect Schema instead`);let s=t?{onExcessProperty:`error`}:void 0,c=e.annotations,l=ms(c,vpe),u=EE(e.failureSchema),d=NE(e.failureSchema),f=e=>e instanceof Error?F(I9(e.message)):B(d(e),e=>new X8({isError:!0,content:L9(e)})),p=e=>{let t=sp(e);if(Ua(t)){let e=t.success.error,n=_s(Ene(t.success),_8);if(n===`parameters`&&vge(e))return R(new L8({message:e.reason.message}));if(n===`handler`&&u(e))return Ph(f(e),a)}return a(e)},m=yield*DE(J8)(R9(e.successSchema,!1)).pipe(Lh),h=yield*DE(q8)(i??R9(e.parametersSchema,t)).pipe(Lh),g=new Y8({name:e.name,description:gpe(e),inputSchema:h,outputSchema:m,annotations:{...xs(e.annotations,_pe).pipe(Fa(e=>({title:e})),Na),readOnlyHint:_s(e.annotations,d8),destructiveHint:_s(e.annotations,f8),idempotentHint:_s(e.annotations,p8),openWorldHint:_s(e.annotations,m8)},_meta:l});o.push({tool:g,annotations:c,handle(t){return n.handle(e.name,t??{},void 0,s).pipe(Sk,Wk,z(Sh),z(e=>e.isFailure&&e.failureOrigin!==`handler`?hh(mp(tp(e.result),us(_8,e.failureOrigin??`result`))):F(new X8({isError:e.isFailure,structuredContent:e.isFailure?void 0:e.encodedResult,content:L9(e.encodedResult)}))),Ph(p),tg(r))}})}for(let e of o)yield*t.addTool(e)}),vge=e=>fpe(e)&&e.reason._tag===`ToolParameterValidationError`,R9=(e,t)=>{let n=wpe(yO(e,{onExcessProperty:t?`error`:`ignore`}));return Object.keys(n.definitions).length===0?n.schema:{...n.schema,$defs:n.definitions}},yge=()=>{let e=$M({ignoreTrailingSlash:!0,ignoreDuplicateSlashes:!0,caseSensitive:!0});return{add:(t,n)=>{e.on(`GET`,`/${t}`,n)},find:t=>e.find(`GET`,`/${t}`)}},bge=e=>e===`2024-11-05`||e===`2025-03-26`||e===`2025-06-18`||e===`2025-11-25`||e===`2026-07-28`,xge=e=>e.mcp!==!1,Sge=e=>e.flatMap(e=>{let t=e.group.actions.filter(xge);return t.length===0?[]:[{app:e,actions:t}]}),Cge=e=>e.flatMap(({app:e,actions:t})=>t.map(t=>({app:e,action:t}))),z9=(e,t)=>e.annotate(d8,t.readOnly).annotate(f8,t.destructive).annotate(p8,t.idempotent).annotate(m8,t.openWorld),wge=(e,t)=>z9(u8(e.mcp.name,{description:e.description,parameters:e.input,success:e.success,failure:K(t),failureMode:`return`}),e.mcp),Tge=(e,t)=>z9(u8(e.mcp.name,{description:e.description,parameters:bO(e.input),success:bO(W({value:e.success})),failure:bO(K(t)),failureMode:`return`}),e.mcp),Ege=(e,t,n)=>{let r=XJ(t.action,n.errors),i=e===`native`?wge(t.action,r):Tge(t.action,r);return e===`native`?i:i.annotate(h8,!0)},Dge=(e,t,n,r,i)=>{let a=rY(t.group,n,r,i);return e===`native`?a:e=>B(a(e),e=>({value:e}))},Oge=(e,t,n)=>{let r=Sge(e),i=Cge(r);$J(`MCP tool`,i.map(({action:e})=>e.mcp.name));let a=Ope(...i.map(e=>Ege(t,e,n)));return{toolkit:a,layer:a.toLayer(B(ah(r,({app:e,actions:r})=>B(e.build,i=>{let a=i;return r.map(r=>[r.mcp.name,Dge(t,e,r,a,n.before)])})),e=>Object.fromEntries(e.flat())))}},kge=[oge],Age=(e,t)=>{let n=Oge(e,`mcp`,t);return gm(_ge(n.toolkit)).pipe(Cm(n.layer))},jge=(e,t,n)=>Age(e,t).pipe(Cm(n),Em);function Mge(e,t){return jge(e,t,dge({...t,protocols:kge}))}var Nge=`0.8.0`,Pge=class extends vO()(`Unauthorized`,{message:U},{httpApiStatus:401}){constructor(e){super({message:e.message}),Object.defineProperty(this,"cause",{value:e.cause})}},Fge=class extends vO()(`RateLimited`,{message:U},{httpApiStatus:429}){},B9=class extends vO()(`ProviderUnavailable`,{operation:U},{httpApiStatus:503}){constructor(e){super({operation:e.operation}),Object.defineProperty(this,"cause",{value:e.cause})}},Ige=class extends vO()(`InsufficientScope`,{scope:U},{httpApiStatus:403}){},Lge=class extends vO()(`ConfigurationError`,{message:U}){};const V9=(e,t)=>$h(n=>Tae(e).execute(t).pipe(ig(hF,{...ms(n,hF),redirect:`error`}),Ih(e=>new B9({operation:`http.request`,cause:e})))),Rge=W({keys:G(W({kty:U,crv:zE(U),x:zE(U),kid:zE(U),alg:zE(U),use:zE(U),key_ops:zE(G(U))}))}),zge=W({sub:BD,client_id:BD,scope:U,exp:kD}),Bge=W({keyId:BD,ownerId:BD,resource:U,scopes:G(BD),expiresAt:uD(aO)}),H9=()=>new Pge({message:`Authentication required`}),Vge=H(`Verifier.make`)(function*(e){let t=yield*LM,n=yield*vh({try:()=>({jwks:new URL(`${e.issuer}/jwks`).href,apiKey:new URL(`/api/issuer/verifyApiKey`,e.issuer).href}),catch:()=>new Lge({message:`Invalid issuer URL`})}),r=H(`Verifier.jwks`)(function*(){let e=yield*V9(t,iae(n.jwks));return e.status===200?nV({keys:(yield*MM(Rge)(e).pipe(Ih(e=>new B9({operation:`jwks.decode`,cause:e})))).keys.map(({key_ops:e,...t})=>e?{...t,key_ops:[...e]}:t)}):yield*new B9({operation:`jwks.fetch`,cause:{status:e.status}})},og),i=yield*hg(r(),e=>Cp(e)?`1 minute`:`5 seconds`),a=Ph(i,e=>lp(e)?R(new B9({operation:`jwks.refresh`})):hh(e)),o=H(`Verifier.signingKey`)(function*(e){let t=yield*a;return yield*ch({try:()=>t({alg:`EdDSA`,kid:e}),catch:H9})}),s=H(`Verifier.jwt`)(function*(t){let n=yield*vh({try:()=>fV(t),catch:H9});if(n.alg!==`EdDSA`||n.kid===void 0)return yield*H9();let r=yield*o(n.kid),i=yield*Om,{payload:a}=yield*ch({try:()=>JB(t,r,{issuer:e.issuer,audience:e.resource,algorithms:[`EdDSA`],typ:`at+jwt`,requiredClaims:[`sub`,`client_id`,`scope`,`iat`,`exp`],currentDate:new Date(i)}),catch:H9});if(a.cnf!==void 0)return yield*H9();let s=yield*DE(zge)(a).pipe(Ih(H9));return{subject:s.sub,scopes:s.scope.split(` `).filter(Boolean),actor:{kind:`client`,clientId:s.client_id},expiresAt:s.exp*1e3}}),c=H(`Verifier.apiKey`)(function*(r){let i=TM(n.apiKey).pipe(EM(`authorization`,`Bearer ${r}`),AM({resource:e.resource})),a=yield*V9(t,i);if(a.status===401||a.status===403)return yield*H9();if(a.status===429)return yield*new Fge({message:`Authentication rate exceeded`});if(a.status!==200)return yield*new B9({operation:`api-key.verify`,cause:{status:a.status}});let o=yield*MM(Bge)(a).pipe(Ih(e=>new B9({operation:`api-key.response`,cause:e})));return o.resource===e.resource?o.expiresAt!==null&&Q_(o.expiresAt)<=(yield*Om)?yield*H9():{subject:o.ownerId,scopes:o.scopes,actor:{kind:`key`,keyId:o.keyId},expiresAt:void 0}:yield*new B9({operation:`api-key.response`})},og),l=H(`Verifier.verifyToken`)(function*(t){let n=yield*t.startsWith(`ca_`)?e.apiKeys===!1?R(H9()):c(t):s(t),r=e.requiredScopes?.find(e=>!n.scopes.includes(e));return r===void 0?n:yield*new Ige({scope:r})});return{verifyToken:l,verify:H(`Verifier.verify`)(function*(e){let t=/^Bearer ([^\s,]+)$/iu.exec(e??``)?.[1];return t?yield*l(t):yield*H9()})}}),Hge=H(`AdministrationResource.make`)(function*(){let e=yield*G6,t=`${e.settings.baseURL}/api/auth`,n=e$(e.settings.baseURL),r=f$({resource:n,authorizationServers:[t],scopesSupported:[$Q,`offline_access`]}),i=yield*Vge({issuer:t,resource:n,requiredScopes:[$Q],apiKeys:!1}).pipe(eg(gF.pipe(Cm(um(mF,(t,n)=>{let r=new Request(t,n);return r.headers.set(`x-clankerauth-peer`,`127.0.0.1`),e.auth.handler(r)}))))),a=(e,t)=>vj(e).pipe(bj(`InsufficientScope`,({scope:e})=>({error:new QZ({error:`Insufficient scope`}),headers:{"www-authenticate":r.challenge({error:`insufficient_scope`,scope:e})}})),bj(`RateLimited`,()=>({error:new tQ({error:`Authentication rate exceeded`}),headers:{"retry-after":`60`}})),bj(`ProviderUnavailable`,()=>({error:new rQ({error:`Request could not be completed`}),headers:{}})),bj(`Unauthorized`,()=>({error:new ZZ({error:`Authentication required`}),headers:{"www-authenticate":o(t)}})),wj),o=e=>r.challenge(e?{error:`invalid_token`,scope:$Q}:{scope:$Q});return{discovery:r,verifier:i,refuse:a,challenge:o}}),U9=YQ(bQ),W9=V(function*(e){return{keyId:e.id,name:e.name??``,enabled:e.enabled,permissions:yield*U9(e.permissions??{}),expiresAt:e.expiresAt?J_(e.expiresAt):null,createdAt:J_(e.createdAt)}}),G9=B(G6,e=>{let t=H(`MachineKeys.validate`)(function*(t,n){if(t!==void 0&&(!t.trim()||t.length>100))return yield*R(new XZ({error:`Key names require 1–100 characters`}));if(n!==void 0){if(!Object.keys(n).length)return yield*R(new XZ({error:`Select at least one Resource and scope`}));for(let[t,r]of Object.entries(n)){if(t===e$(e.settings.baseURL))return yield*R(new XZ({error:`Administration requires OAuth access tokens, not API keys`}));let n=yield*e.resources.get(t);if(!n||!r.length||new Set(r).size!==r.length||r.some(e=>!n.scopes.includes(e)))return yield*R(new XZ({error:`Select explicitly granted, currently available Resource scopes`}))}}});return{list:H(`MachineKeys.list`)(function*(){let{providerHeaders:t}=yield*q6,n=yield*t,r=yield*LQ(()=>e.auth.api.listApiKeys({headers:n,query:{sortBy:`createdAt`,sortDirection:`asc`}}));return{keys:yield*ah(r.apiKeys,W9)}}),create:H(`MachineKeys.create`)(function*(n){let r=yield*q6;yield*t(n.name,n.permissions);let i=n.expiresAt===null?null:(Q_(n.expiresAt)-(yield*Om))/1e3;if(i!==null&&i<1)return yield*R(new XZ({error:`Expiry must be in the future`}));let a=yield*LQ(()=>e.auth.api.createApiKey({body:{userId:r.userId,name:n.name.trim(),permissions:Object.fromEntries(Object.entries(n.permissions).map(([e,t])=>[e,[...t]])),expiresIn:i}}));return{...yield*W9(a),key:a.key}}),update:H(`MachineKeys.update`)(function*(n){let r=yield*q6;return yield*t(n.name,n.permissions),yield*W9(yield*LQ(()=>e.auth.api.updateApiKey({body:{userId:r.userId,keyId:n.keyId,name:n.name?.trim(),enabled:n.enabled,permissions:n.permissions?Object.fromEntries(Object.entries(n.permissions).map(([e,t])=>[e,[...t]])):void 0}})))}),delete:H(`MachineKeys.delete`)(function*({keyId:t}){let{providerHeaders:n}=yield*q6,r=yield*n;return yield*LQ(()=>e.auth.api.deleteApiKey({headers:r,body:{keyId:t}})),{deleted:!0}}),verify:H(`MachineKeys.verify`)(function*(t,n){let r=/^Bearer (ca_[^\s]+)$/i.exec(t.get(`authorization`)??``)?.[1];if(!r)return yield*R(new ZZ({error:`API key required`}));let i=yield*LQ(()=>e.auth.api.verifyApiKey({body:{key:r}}));if(!i.valid||!i.key)return i.error?.code===`RATE_LIMITED`?yield*R(new tQ({error:`API key verification rate exceeded`})):yield*R(new ZZ({error:`Invalid API key`}));let a=yield*e.resources.get(n),o=((yield*U9(i.key.permissions??{}))[n]??[]).filter(e=>a?.scopes.includes(e));return!a||!o.length?yield*R(new QZ({error:`No access to this Resource`})):{keyId:i.key.id,ownerId:i.key.referenceId,resource:n,scopes:o,expiresAt:i.key.expiresAt?J_(i.key.expiresAt):null}})}});function Uge(e){return vm(mh(function*(){let t=yield*G6,n=yield*Y6,r=yield*G9,i=kQ.implement({listClients:n.list,createClient:n.create,updateClient:n.update,deleteClient:n.delete,revokeClient:n.revoke,blockClient:n.block,rotateClientSecret:n.rotate,setClientAccess:n.access,createResource:n.createResource,updateResource:n.updateResource,deleteResource:n.deleteResource,listApiKeys:r.list,createApiKey:r.create,updateApiKey:r.update,deleteApiKey:r.delete}),a=DQ.implement({setupStatus:()=>t.owner().pipe(B(e=>({required:!e})),Ih(()=>new nQ({error:`Request could not be completed`}))),setupOwner:n.setup,verifyApiKey:({resource:e})=>mh(function*(){let t=yield*cP;return yield*r.verify(new Headers(t.headers),e)})}),o=yield*Hge(),s=bm(AQ.layer([i]).pipe(Cm((yield*Kfe).layer)),AQ.openApi(`/openapi.json`),AQ.layer([a]).pipe(Cm(Yfe.layer))),c=Mge([i],{name:`clankerauth-admin`,version:Nge,path:`/mcp`,allowedOrigins:e,instructions:`Owner administration. Mutations change authorization policy; create/rotate actions return secrets once.`}).pipe(Cm((yield*Jfe(o)).layer));return bm(s,c,o.discovery.layer)}))}const Wge=e=>un({requestTimeout:15e3,headersTimeout:1e4},e),Gge=Fv(65536),Kge=/^\/forward-auth(?:\?|$)/,qge=(e,t,n)=>{let r=(e[`x-forwarded-for`]?.split(`,`).map(e=>e.trim()).filter(Boolean))?.at(-1);return n&&r?r:Aa(t,()=>`unknown`)},Jge=({baseURL:e,trustProxy:t})=>n=>mh(function*(){let r=yield*cP,i=r.source,a=i instanceof ln?i.url:r.url;if(!a?.startsWith(`/`)||a.startsWith(`//`))return oN({status:400});let o=Nn(r.headers,Kge.test(a)?$T(`forwarded`):eE([`forwarded`,`x-forwarded-host`,`x-forwarded-proto`]),XT(`host`,new URL(e).host),XT(`x-clankerauth-peer`,qge(r.headers,r.remoteAddress,t)),$T(`x-forwarded-for`)),s=yield*n.pipe(ig(cP,r.modify({headers:o})),ig(NM,Gge));return i instanceof ln?vj(s.body).pipe(bj(`Stream`,e=>yN(s,pM(e.stream.pipe(jk(()=>I(()=>i.socket.destroy()))),e.contentType,e.contentLength))),Cj(()=>s)):s}).pipe(_g),Yge=/* @__PURE__ */ new Set([`/sign-in/email`,`/sign-out`,`/get-session`,`/change-password`,`/jwks`,`/oauth2/register`,`/oauth2/authorize`,`/oauth2/token`,`/oauth2/consent`,`/oauth2/continue`,`/oauth2/public-client`,`/oauth2/introspect`,`/oauth2/revoke`,`/.well-known/oauth-authorization-server`]),Xge=/* @__PURE__ */ new Set([`/.well-known/oauth-protected-resource/mcp`,`/jwks`,`/oauth2/register`,`/oauth2/token`,`/oauth2/revoke`,`/oauth2/introspect`,`/.well-known/oauth-authorization-server`,`/.well-known/oauth-authorization-server/api/auth`]),Zge=/* @__PURE__ */ new Set([`/jwks`,`/.well-known/oauth-protected-resource/mcp`,`/.well-known/oauth-authorization-server`,`/.well-known/oauth-authorization-server/api/auth`]),Qge=/* @__PURE__ */ new Set([`/`,`/login`,`/consent`,`/setup`]),$ge=/^\/assets\/[a-zA-Z0-9_.-]+\.(js|css)$/,K9=(e,t=200)=>dN(e,{status:t}),q9=K9({error:`Not found`},404),J9=[`Authorization`,`Content-Type`,`Accept`,`Mcp-Protocol-Version`,`Mcp-Method`,`Mcp-Name`],e_e=new Set(J9.map(e=>e.toLowerCase())),t_e=(e=rn(new URL(`dist/`,import.meta.resolve(`@clankerauth/web/package.json`))))=>vm(B(G6,t=>{let{auth:n,settings:r}=t,i=[.../* @__PURE__ */ new Set([r.baseURL,...r.mcpAllowedOrigins])],a=mh(function*(){let e=yield*cP,i=new URL(e.url,r.baseURL),a=i.pathname.replace(/^\/api\/auth/,``);if(!Yge.has(a)&&a!==`/.well-known/oauth-authorization-server/api/auth`)return q9;if(a===`/oauth2/authorize`){let n=e.method===`GET`?i.searchParams.getAll(`resource`):new URLSearchParams(yield*e.text).getAll(`resource`);if(n.length!==1||!(yield*t.resources.get(n[0]??``)))return K9({error:`invalid_target`,error_description:`Exactly one configured resource is required`},400)}let o=e.method===`GET`||e.method===`HEAD`?void 0:yield*e.arrayBuffer,s=yield*LQ(()=>n.handler(new Request(i,{method:e.method,headers:e.headers,body:o})));return roe(s)}).pipe(jh(BQ)),o=yP(t=>mh(function*(){let n=yield*wN;yield*t.add(`*`,`/*`,mh(function*(){let t=yield*cP;if(t.method!==`GET`&&t.method!==`HEAD`)return q9;let i=new URL(t.url,r.baseURL).pathname,a=Qge.has(i)?`index.html`:$ge.test(i)?i.slice(1):void 0;return a?yield*n.fileResponse(tn(e,a),{contentType:a.endsWith(`.js`)?`text/javascript`:a.endsWith(`.css`)?`text/css`:`text/html; charset=utf-8`}).pipe(jh(()=>F(q9))):q9}))})),s=EP(e=>Jge({baseURL:r.baseURL,trustProxy:r.trustProxy})(mh(function*(){let t=yield*cP,n=new URL(t.url,r.baseURL).pathname,a=n.replace(/^\/api\/auth/,``),o=n===`/mcp`,s=t.headers.origin,c=s!==void 0&&i.includes(s),l=Xge.has(a),u;if(o&&s!==void 0&&!c)u=K9({error:`Invalid origin`},403);else if(o&&t.method===`OPTIONS`){let e=t.headers[`access-control-request-method`],n=(t.headers[`access-control-request-headers`]??``).split(`,`).map(e=>e.trim().toLowerCase()).filter(Boolean);u=c&&e===`POST`&&n.every(e=>e_e.has(e))?oN({status:204}):K9({error:`MCP preflight rejected`},403)}else u=l&&t.method===`OPTIONS`?oN({status:204}):yield*e;l&&(u=u.pipe(gN({"access-control-allow-origin":`*`,"access-control-allow-methods":`GET, POST, OPTIONS`,"access-control-allow-headers":`Authorization, Content-Type, DPoP`,"access-control-expose-headers":`WWW-Authenticate, DPoP-Nonce`}),hN(`access-control-allow-credentials`))),o&&(u=u.pipe(mN(`vary`,u.headers.vary?`${u.headers.vary}, Origin`:`Origin`),hN(`access-control-allow-credentials`)),c&&s!==void 0&&(u=u.pipe(gN({"access-control-allow-origin":s,"access-control-expose-headers":`WWW-Authenticate, Mcp-Protocol-Version`})),t.method===`OPTIONS`&&u.status>=200&&u.status<300&&(u=u.pipe(gN({"access-control-allow-methods":`POST`,"access-control-allow-headers":J9.join(`, `)})))));let d=t.method!==`GET`||u.status!==200?`no-store`:n.startsWith(`/assets/`)?`public, max-age=31536000, immutable`:Zge.has(a)?`public, max-age=300`:`no-store`;return u=u.pipe(gN({"cache-control":d,"referrer-policy":`no-referrer`,"x-content-type-options":`nosniff`,"x-frame-options":`DENY`,"content-security-policy":`default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'`})),r.baseURL.startsWith(`https:`)&&(u=u.pipe(mN(`strict-transport-security`,`max-age=31536000`))),u})),{global:!0}),c=EP(e=>yg(e));return bm(Uge(i),r.cookieDomain===void 0?fm:Ffe(r.cookieDomain),bP(`GET`,`/healthz`,t.sql`SELECT 1`.pipe(kh(K9({status:`ok`})),jh(BQ))),bP(`*`,`/api/auth/*`,a),bP(`*`,`/.well-known/*`,a),o).pipe(Cm(c.layer),Cm(s),Cm(VF))})),n_e=H(`Http.nodeHandler`)(function*(e){let t=yield*sse(t_e(e));return yield*zF(t,{scope:yield*ag})}),Y9=`credentials.json`,X9=W({email:U,password:U,secret:U,clientId:BE(U),clientSecret:BE(U)}),r_e=DE(KD(X9)),i_e=IE(X9),Z9=(e,t)=>z(Zk,n=>n.writeFileString(en(e,Y9),`${JSON.stringify(i_e(t),null,2)}\n`,{mode:384})),a_e=H(`Dev.identity`)(function*(e,t){let n={email:`owner@example.internal`,password:Yt(24).toString(`base64url`),secret:Yt(32).toString(`hex`)};if(!t)return n;let r=yield*Zk,i=en(e,Y9);return(yield*r.exists(i))?yield*r_e(yield*r.readFileString(i)):(yield*Z9(e,n),n)}),Q9=e=>Error(`Disposable issuer provisioning failed`,{cause:e}),$9=H(`Dev.ownerSession`)(function*(e,t,n,r){if(t===void 0)return yield*R(/* @__PURE__ */ Error(`A forward-auth session needs a cookieDomain; the issuer serves none`));let i=yield*LM,a=yield*i.execute(TM(`${e}/api/auth/sign-in/email`,{headers:{origin:e}}).pipe(AM(n)));if(yield*a.text,a.status!==200)return yield*R(/* @__PURE__ */ Error(`Owner sign-in failed with HTTP ${a.status}`));let o=new URL(`/`,r).href,s=yield*i.get(`${e}/forward-auth/continue?rd=${encodeURIComponent(o)}`,{headers:{cookie:RT(a.cookies)}});yield*s.text;let c=FT(a.cookies,s.cookies);return{cookie:RT(c),cookies:Object.entries(zT(c)).map(([e,t])=>({name:e,value:t}))}}),o_e=bm(pF,gF,um(hF,{redirect:`manual`})),s_e=V(function*(e){let t=yield*Zk,n=rn(new URL(`./web/`,import.meta.url));if(!(yield*t.exists(en(n,`index.html`))))return yield*R(/* @__PURE__ */ Error(`The @gjermundgaraba/clankerauth-dev installation is missing its bundled dashboard assets`));let r=e.dataDir,i=r===void 0?yield*t.makeTempDirectoryScoped({prefix:`clankerauth-disposable-`}):yield*kh(t.makeDirectory(tn(r),{recursive:!0,mode:448}),tn(r)),a=(e,t)=>{t.writeHead(503).end()},o=Wge((t,n)=>{try{e.onRequest?.({method:t.method??`GET`,url:new URL(t.url??`/`,`http://127.0.0.1:${t.socket.localPort}`)}),a(t,n)}catch{n.headersSent?n.destroy():n.writeHead(500).end(`Request failed`)}}),s=fh(e=>{o.close(()=>e(L)),o.closeAllConnections()});yield*cg(fh(t=>{let n=e=>t(R(e));o.once(`error`,n),o.listen(e.port??0,`127.0.0.1`,()=>{o.off(`error`,n),t(L)})}),()=>s);let c=o.address();if(!(c instanceof Object))return yield*R(/* @__PURE__ */ Error(`Disposable issuer failed to bind a TCP port`));let{port:l}=c,u=e.cookieDomain===void 0?`http://127.0.0.1:${l}`:`http://auth.${e.cookieDomain}:${l}`,d=yield*a_e(i,r!==void 0),f=yield*H6({baseURL:u,secret:dT(d.secret),database:en(i,`issuer.sqlite`),host:`127.0.0.1`,port:l,mcpAllowedOrigins:[],trustProxy:!1,allowInsecureHttp:e.cookieDomain!==void 0,cookieDomain:e.cookieDomain}),p=yield*cm(G6.layer(f,{cimdTransport:e.cimdTransport})),m=_s(p,G6),h=yield*Gp(yield*ag);a=yield*n_e(n).pipe(eg(p),ig(zp,h)),yield*lg(()=>s);let g={email:d.email,password:d.password},_=yield*eg(Y6,p),v=yield*eg(G9,p),y=e=>yg(og(mh(function*(){let t=yield*m.owner();if(t===void 0)return yield*_h(/* @__PURE__ */ Error(`Owner setup failed`));let n=yield*p$(m,t);return yield*e(t).pipe(ig(q6,{userId:t,email:g.email,providerHeaders:F(n)}))}))).pipe(Ih(Q9));(yield*m.owner())||(yield*K6(m,g).pipe(Ih(Q9))),yield*y(()=>ah(e.resources,e=>z(m.resources.get(e.identifier),t=>t?L:Ah(_.createResource(e)))));let b=yield*y(()=>mh(function*(){if(d.clientId!==void 0&&d.clientSecret!==void 0){let{clients:e}=yield*_.list();if(e.some(e=>e.client_id===d.clientId))return{client_id:d.clientId,client_secret:d.clientSecret}}return yield*_.create({client_name:e.client.name,redirect_uris:[e.client.redirect],resources:e.client.resources,token_endpoint_auth_method:`client_secret_basic`,application_type:`native`})})),x=b.client_secret;if(x===void 0)return yield*R(/* @__PURE__ */ Error(`Disposable issuer did not return client credentials`));r!==void 0&&(yield*Z9(i,{...d,clientId:b.client_id,clientSecret:x}));let S=e.cookieDomain===void 0?void 0:u;return{details:{issuer:`${u}/api/auth`,clientId:b.client_id,clientSecret:x,owner:g,url:u,port:l,directory:i},apiKey:e=>y(()=>B(v.create({name:e.name??`development`,permissions:e.permissions,expiresAt:null}),e=>e.key)),ownerSession:e=>$9(u,S,g,e),ownerToken:H(`Dev.ownerToken`)(function*(e){let{cookie:t}=yield*$9(u,S,g,e.appOrigin),n=yield*LM,r=new URL(e.appOrigin),i=new URL(`/forward-auth`,u);i.searchParams.set(`resource`,e.resource);let a=yield*n.get(i,{headers:{cookie:t,"x-forwarded-proto":r.protocol.slice(0,-1),"x-forwarded-host":r.host,"x-forwarded-uri":`/`}});yield*a.text;let o=a.headers.authorization;return a.status!==204||o===void 0?yield*R(/* @__PURE__ */ Error(`Forward auth issued no token (HTTP ${a.status})`)):o.replace(/^Bearer /iu,``)})}});async function c_e(e){let t=Vp(),n=e=>Ng(e.pipe(ig(zp,t),eg(o_e)),{onFiberStart:Jb(t)}),r=Fg(mg(qp(t,Sp)));try{let t=await n(s_e(e));return{...t.details,apiKey:e=>n(t.apiKey(e)),ownerSession:e=>n(t.ownerSession(e)),ownerToken:e=>n(t.ownerToken(e)),close:()=>Ng(r)}}catch(e){throw await Ng(r),e}}export{c_e as startDisposableIssuer,VQ as t};
517
+ `).map(e=>`data: ${e}\n\n`).join(``)),i={status:e.status,statusText:e.statusText,headers:$T(e.headers,`content-type`),cookies:e.cookies,contentType:`text/event-stream`};return e.body._tag===`Stream`?pN(e.body.stream.pipe(Ck(r)),i):e.body._tag===`Uint8Array`?cN(r(e.body.body),i):mN(e,`content-type`,`text/event-stream`)},P9=(e,t)=>{let n=e.headers.origin;return n===void 0||(t??[]).includes(n)},F9=e=>e===void 0?[]:e.split(`,`).flatMap(e=>{let[t,...n]=e.split(`;`),r=n.map(e=>e.trim().toLowerCase()).find(e=>e.startsWith(`q=`));if(r!==void 0){let e=Number(r.slice(2));if(!Number.isFinite(e)||e<=0||e>1)return[]}return[t.trim().toLowerCase()]}),I9=e=>new X8({isError:!0,content:[{type:`text`,text:e}]}),L9=e=>e===void 0?[]:[{type:`text`,text:JSON.stringify(e)}],_ge=/*#__PURE__*/ V(function*(e){let t=yield*O9,n=yield*e.pipe(rg(t=>{let n=new Map(t.mapUnsafe);for(let t of Object.values(e.tools)){let e=n.get(t.id);e!==void 0&&n.set(t.id,{...e,context:E9(e.context)})}return rs(n)})),r=E9(yield*Qh()),i=e=>tg(sj(e),r),a=e=>{let t=sp(e);return Ha(t)&&!cp(e)?hh(t.failure):zg(e).pipe(wh(i(e)),kh(I9(`Tool execution failed due to an internal server error.`)))},o=[];for(let e of Object.values(n.tools)){let t=ype(e)===!0,i=mpe(e)?e.jsonSchema:void 0;if(t&&i!==void 0)return yield*_h(`McpServer cannot strictly validate the raw JSON Schema for tool '${e.name}'; use an Effect Schema instead`);let s=t?{onExcessProperty:`error`}:void 0,c=e.annotations,l=ms(c,vpe),u=EE(e.failureSchema),d=NE(e.failureSchema),f=e=>e instanceof Error?F(I9(e.message)):B(d(e),e=>new X8({isError:!0,content:L9(e)})),p=e=>{let t=sp(e);if(Ua(t)){let e=t.success.error,n=_s(Ene(t.success),_8);if(n===`parameters`&&vge(e))return R(new L8({message:e.reason.message}));if(n===`handler`&&u(e))return Ph(f(e),a)}return a(e)},m=yield*DE(J8)(R9(e.successSchema,!1)).pipe(Lh),h=yield*DE(q8)(i??R9(e.parametersSchema,t)).pipe(Lh),g=new Y8({name:e.name,description:gpe(e),inputSchema:h,outputSchema:m,annotations:{...xs(e.annotations,_pe).pipe(Fa(e=>({title:e})),Na),readOnlyHint:_s(e.annotations,d8),destructiveHint:_s(e.annotations,f8),idempotentHint:_s(e.annotations,p8),openWorldHint:_s(e.annotations,m8)},_meta:l});o.push({tool:g,annotations:c,handle(t){return n.handle(e.name,t??{},void 0,s).pipe(Sk,Wk,z(Sh),z(e=>e.isFailure&&e.failureOrigin!==`handler`?hh(mp(tp(e.result),us(_8,e.failureOrigin??`result`))):F(new X8({isError:e.isFailure,structuredContent:e.isFailure?void 0:e.encodedResult,content:L9(e.encodedResult)}))),Ph(p),tg(r))}})}for(let e of o)yield*t.addTool(e)}),vge=e=>fpe(e)&&e.reason._tag===`ToolParameterValidationError`,R9=(e,t)=>{let n=wpe(yO(e,{onExcessProperty:t?`error`:`ignore`}));return Object.keys(n.definitions).length===0?n.schema:{...n.schema,$defs:n.definitions}},yge=()=>{let e=$M({ignoreTrailingSlash:!0,ignoreDuplicateSlashes:!0,caseSensitive:!0});return{add:(t,n)=>{e.on(`GET`,`/${t}`,n)},find:t=>e.find(`GET`,`/${t}`)}},bge=e=>e===`2024-11-05`||e===`2025-03-26`||e===`2025-06-18`||e===`2025-11-25`||e===`2026-07-28`,xge=e=>e.mcp!==!1,Sge=e=>e.flatMap(e=>{let t=e.group.actions.filter(xge);return t.length===0?[]:[{app:e,actions:t}]}),Cge=e=>e.flatMap(({app:e,actions:t})=>t.map(t=>({app:e,action:t}))),z9=(e,t)=>e.annotate(d8,t.readOnly).annotate(f8,t.destructive).annotate(p8,t.idempotent).annotate(m8,t.openWorld),wge=(e,t)=>z9(u8(e.mcp.name,{description:e.description,parameters:e.input,success:e.success,failure:K(t),failureMode:`return`}),e.mcp),Tge=(e,t)=>z9(u8(e.mcp.name,{description:e.description,parameters:bO(e.input),success:bO(W({value:e.success})),failure:bO(K(t)),failureMode:`return`}),e.mcp),Ege=(e,t,n)=>{let r=XJ(t.action,n.errors),i=e===`native`?wge(t.action,r):Tge(t.action,r);return e===`native`?i:i.annotate(h8,!0)},Dge=(e,t,n,r,i)=>{let a=rY(t.group,n,r,i);return e===`native`?a:e=>B(a(e),e=>({value:e}))},Oge=(e,t,n)=>{let r=Sge(e),i=Cge(r);$J(`MCP tool`,i.map(({action:e})=>e.mcp.name));let a=Ope(...i.map(e=>Ege(t,e,n)));return{toolkit:a,layer:a.toLayer(B(ah(r,({app:e,actions:r})=>B(e.build,i=>{let a=i;return r.map(r=>[r.mcp.name,Dge(t,e,r,a,n.before)])})),e=>Object.fromEntries(e.flat())))}},kge=[oge],Age=(e,t)=>{let n=Oge(e,`mcp`,t);return gm(_ge(n.toolkit)).pipe(Cm(n.layer))},jge=(e,t,n)=>Age(e,t).pipe(Cm(n),Em);function Mge(e,t){return jge(e,t,dge({...t,protocols:kge}))}var Nge=`0.9.0`,Pge=class extends vO()(`Unauthorized`,{message:U},{httpApiStatus:401}){constructor(e){super({message:e.message}),Object.defineProperty(this,"cause",{value:e.cause})}},Fge=class extends vO()(`RateLimited`,{message:U},{httpApiStatus:429}){},B9=class extends vO()(`ProviderUnavailable`,{operation:U},{httpApiStatus:503}){constructor(e){super({operation:e.operation}),Object.defineProperty(this,"cause",{value:e.cause})}},Ige=class extends vO()(`InsufficientScope`,{scope:U},{httpApiStatus:403}){},Lge=class extends vO()(`ConfigurationError`,{message:U}){};const V9=(e,t)=>$h(n=>Tae(e).execute(t).pipe(ig(hF,{...ms(n,hF),redirect:`error`}),Ih(e=>new B9({operation:`http.request`,cause:e})))),Rge=W({keys:G(W({kty:U,crv:zE(U),x:zE(U),kid:zE(U),alg:zE(U),use:zE(U),key_ops:zE(G(U))}))}),zge=W({sub:BD,client_id:BD,scope:U,exp:kD}),Bge=W({keyId:BD,ownerId:BD,resource:U,scopes:G(BD),expiresAt:uD(aO)}),H9=()=>new Pge({message:`Authentication required`}),Vge=H(`Verifier.make`)(function*(e){let t=yield*LM,n=yield*vh({try:()=>({jwks:new URL(`${e.issuer}/jwks`).href,apiKey:new URL(`/api/issuer/verifyApiKey`,e.issuer).href}),catch:()=>new Lge({message:`Invalid issuer URL`})}),r=H(`Verifier.jwks`)(function*(){let e=yield*V9(t,iae(n.jwks));return e.status===200?nV({keys:(yield*MM(Rge)(e).pipe(Ih(e=>new B9({operation:`jwks.decode`,cause:e})))).keys.map(({key_ops:e,...t})=>e?{...t,key_ops:[...e]}:t)}):yield*new B9({operation:`jwks.fetch`,cause:{status:e.status}})},og),i=yield*hg(r(),e=>Cp(e)?`1 minute`:`5 seconds`),a=Ph(i,e=>lp(e)?R(new B9({operation:`jwks.refresh`})):hh(e)),o=H(`Verifier.signingKey`)(function*(e){let t=yield*a;return yield*ch({try:()=>t({alg:`EdDSA`,kid:e}),catch:H9})}),s=H(`Verifier.jwt`)(function*(t){let n=yield*vh({try:()=>fV(t),catch:H9});if(n.alg!==`EdDSA`||n.kid===void 0)return yield*H9();let r=yield*o(n.kid),i=yield*Om,{payload:a}=yield*ch({try:()=>JB(t,r,{issuer:e.issuer,audience:e.resource,algorithms:[`EdDSA`],typ:`at+jwt`,requiredClaims:[`sub`,`client_id`,`scope`,`iat`,`exp`],currentDate:new Date(i)}),catch:H9});if(a.cnf!==void 0)return yield*H9();let s=yield*DE(zge)(a).pipe(Ih(H9));return{subject:s.sub,scopes:s.scope.split(` `).filter(Boolean),actor:{kind:`client`,clientId:s.client_id},expiresAt:s.exp*1e3}}),c=H(`Verifier.apiKey`)(function*(r){let i=TM(n.apiKey).pipe(EM(`authorization`,`Bearer ${r}`),AM({resource:e.resource})),a=yield*V9(t,i);if(a.status===401||a.status===403)return yield*H9();if(a.status===429)return yield*new Fge({message:`Authentication rate exceeded`});if(a.status!==200)return yield*new B9({operation:`api-key.verify`,cause:{status:a.status}});let o=yield*MM(Bge)(a).pipe(Ih(e=>new B9({operation:`api-key.response`,cause:e})));return o.resource===e.resource?o.expiresAt!==null&&Q_(o.expiresAt)<=(yield*Om)?yield*H9():{subject:o.ownerId,scopes:o.scopes,actor:{kind:`key`,keyId:o.keyId},expiresAt:void 0}:yield*new B9({operation:`api-key.response`})},og),l=H(`Verifier.verifyToken`)(function*(t){let n=yield*t.startsWith(`clankerauth_`)?e.apiKeys===!1?R(H9()):c(t):s(t),r=e.requiredScopes?.find(e=>!n.scopes.includes(e));return r===void 0?n:yield*new Ige({scope:r})});return{verifyToken:l,verify:H(`Verifier.verify`)(function*(e){let t=/^Bearer ([^\s,]+)$/iu.exec(e??``)?.[1];return t?yield*l(t):yield*H9()})}}),Hge=H(`AdministrationResource.make`)(function*(){let e=yield*G6,t=`${e.settings.baseURL}/api/auth`,n=e$(e.settings.baseURL),r=f$({resource:n,authorizationServers:[t],scopesSupported:[$Q,`offline_access`]}),i=yield*Vge({issuer:t,resource:n,requiredScopes:[$Q],apiKeys:!1}).pipe(eg(gF.pipe(Cm(um(mF,(t,n)=>{let r=new Request(t,n);return r.headers.set(`x-clankerauth-peer`,`127.0.0.1`),e.auth.handler(r)}))))),a=(e,t)=>vj(e).pipe(bj(`InsufficientScope`,({scope:e})=>({error:new QZ({error:`Insufficient scope`}),headers:{"www-authenticate":r.challenge({error:`insufficient_scope`,scope:e})}})),bj(`RateLimited`,()=>({error:new tQ({error:`Authentication rate exceeded`}),headers:{"retry-after":`60`}})),bj(`ProviderUnavailable`,()=>({error:new rQ({error:`Request could not be completed`}),headers:{}})),bj(`Unauthorized`,()=>({error:new ZZ({error:`Authentication required`}),headers:{"www-authenticate":o(t)}})),wj),o=e=>r.challenge(e?{error:`invalid_token`,scope:$Q}:{scope:$Q});return{discovery:r,verifier:i,refuse:a,challenge:o}}),U9=YQ(bQ),W9=V(function*(e){return{keyId:e.id,name:e.name??``,enabled:e.enabled,permissions:yield*U9(e.permissions??{}),expiresAt:e.expiresAt?J_(e.expiresAt):null,createdAt:J_(e.createdAt)}}),G9=B(G6,e=>{let t=H(`MachineKeys.validate`)(function*(t,n){if(t!==void 0&&(!t.trim()||t.length>100))return yield*R(new XZ({error:`Key names require 1–100 characters`}));if(n!==void 0){if(!Object.keys(n).length)return yield*R(new XZ({error:`Select at least one Resource and scope`}));for(let[t,r]of Object.entries(n)){if(t===e$(e.settings.baseURL))return yield*R(new XZ({error:`Administration requires OAuth access tokens, not API keys`}));let n=yield*e.resources.get(t);if(!n||!r.length||new Set(r).size!==r.length||r.some(e=>!n.scopes.includes(e)))return yield*R(new XZ({error:`Select explicitly granted, currently available Resource scopes`}))}}});return{list:H(`MachineKeys.list`)(function*(){let{providerHeaders:t}=yield*q6,n=yield*t,r=yield*LQ(()=>e.auth.api.listApiKeys({headers:n,query:{sortBy:`createdAt`,sortDirection:`asc`}}));return{keys:yield*ah(r.apiKeys,W9)}}),create:H(`MachineKeys.create`)(function*(n){let r=yield*q6;yield*t(n.name,n.permissions);let i=n.expiresAt===null?null:(Q_(n.expiresAt)-(yield*Om))/1e3;if(i!==null&&i<1)return yield*R(new XZ({error:`Expiry must be in the future`}));let a=yield*LQ(()=>e.auth.api.createApiKey({body:{userId:r.userId,name:n.name.trim(),permissions:Object.fromEntries(Object.entries(n.permissions).map(([e,t])=>[e,[...t]])),expiresIn:i}}));return{...yield*W9(a),key:a.key}}),update:H(`MachineKeys.update`)(function*(n){let r=yield*q6;return yield*t(n.name,n.permissions),yield*W9(yield*LQ(()=>e.auth.api.updateApiKey({body:{userId:r.userId,keyId:n.keyId,name:n.name?.trim(),enabled:n.enabled,permissions:n.permissions?Object.fromEntries(Object.entries(n.permissions).map(([e,t])=>[e,[...t]])):void 0}})))}),delete:H(`MachineKeys.delete`)(function*({keyId:t}){let{providerHeaders:n}=yield*q6,r=yield*n;return yield*LQ(()=>e.auth.api.deleteApiKey({headers:r,body:{keyId:t}})),{deleted:!0}}),verify:H(`MachineKeys.verify`)(function*(t,n){let r=/^Bearer (clankerauth_[^\s]+)$/i.exec(t.get(`authorization`)??``)?.[1];if(!r)return yield*R(new ZZ({error:`API key required`}));let i=yield*LQ(()=>e.auth.api.verifyApiKey({body:{key:r}}));if(!i.valid||!i.key)return i.error?.code===`RATE_LIMITED`?yield*R(new tQ({error:`API key verification rate exceeded`})):yield*R(new ZZ({error:`Invalid API key`}));let a=yield*e.resources.get(n),o=((yield*U9(i.key.permissions??{}))[n]??[]).filter(e=>a?.scopes.includes(e));return!a||!o.length?yield*R(new QZ({error:`No access to this Resource`})):{keyId:i.key.id,ownerId:i.key.referenceId,resource:n,scopes:o,expiresAt:i.key.expiresAt?J_(i.key.expiresAt):null}})}});function Uge(e){return vm(mh(function*(){let t=yield*G6,n=yield*Y6,r=yield*G9,i=kQ.implement({listClients:n.list,createClient:n.create,updateClient:n.update,deleteClient:n.delete,revokeClient:n.revoke,blockClient:n.block,rotateClientSecret:n.rotate,setClientAccess:n.access,createResource:n.createResource,updateResource:n.updateResource,deleteResource:n.deleteResource,listApiKeys:r.list,createApiKey:r.create,updateApiKey:r.update,deleteApiKey:r.delete}),a=DQ.implement({setupStatus:()=>t.owner().pipe(B(e=>({required:!e})),Ih(()=>new nQ({error:`Request could not be completed`}))),setupOwner:n.setup,verifyApiKey:({resource:e})=>mh(function*(){let t=yield*cP;return yield*r.verify(new Headers(t.headers),e)})}),o=yield*Hge(),s=bm(AQ.layer([i]).pipe(Cm((yield*Kfe).layer)),AQ.openApi(`/openapi.json`),AQ.layer([a]).pipe(Cm(Yfe.layer))),c=Mge([i],{name:`clankerauth-admin`,version:Nge,path:`/mcp`,allowedOrigins:e,instructions:`Owner administration. Mutations change authorization policy; create/rotate actions return secrets once.`}).pipe(Cm((yield*Jfe(o)).layer));return bm(s,c,o.discovery.layer)}))}const Wge=e=>un({requestTimeout:15e3,headersTimeout:1e4},e),Gge=Fv(65536),Kge=/^\/forward-auth(?:\?|$)/,qge=(e,t,n)=>{let r=(e[`x-forwarded-for`]?.split(`,`).map(e=>e.trim()).filter(Boolean))?.at(-1);return n&&r?r:Aa(t,()=>`unknown`)},Jge=({baseURL:e,trustProxy:t})=>n=>mh(function*(){let r=yield*cP,i=r.source,a=i instanceof ln?i.url:r.url;if(!a?.startsWith(`/`)||a.startsWith(`//`))return oN({status:400});let o=Nn(r.headers,Kge.test(a)?$T(`forwarded`):eE([`forwarded`,`x-forwarded-host`,`x-forwarded-proto`]),XT(`host`,new URL(e).host),XT(`x-clankerauth-peer`,qge(r.headers,r.remoteAddress,t)),$T(`x-forwarded-for`)),s=yield*n.pipe(ig(cP,r.modify({headers:o})),ig(NM,Gge));return i instanceof ln?vj(s.body).pipe(bj(`Stream`,e=>yN(s,pM(e.stream.pipe(jk(()=>I(()=>i.socket.destroy()))),e.contentType,e.contentLength))),Cj(()=>s)):s}).pipe(_g),Yge=/* @__PURE__ */ new Set([`/sign-in/email`,`/sign-out`,`/get-session`,`/change-password`,`/jwks`,`/oauth2/register`,`/oauth2/authorize`,`/oauth2/token`,`/oauth2/consent`,`/oauth2/continue`,`/oauth2/public-client`,`/oauth2/introspect`,`/oauth2/revoke`,`/.well-known/oauth-authorization-server`]),Xge=/* @__PURE__ */ new Set([`/.well-known/oauth-protected-resource/mcp`,`/jwks`,`/oauth2/register`,`/oauth2/token`,`/oauth2/revoke`,`/oauth2/introspect`,`/.well-known/oauth-authorization-server`,`/.well-known/oauth-authorization-server/api/auth`]),Zge=/* @__PURE__ */ new Set([`/jwks`,`/.well-known/oauth-protected-resource/mcp`,`/.well-known/oauth-authorization-server`,`/.well-known/oauth-authorization-server/api/auth`]),Qge=/* @__PURE__ */ new Set([`/`,`/login`,`/consent`,`/setup`]),$ge=/^\/assets\/[a-zA-Z0-9_.-]+\.(js|css)$/,K9=(e,t=200)=>dN(e,{status:t}),q9=K9({error:`Not found`},404),J9=[`Authorization`,`Content-Type`,`Accept`,`Mcp-Protocol-Version`,`Mcp-Method`,`Mcp-Name`],e_e=new Set(J9.map(e=>e.toLowerCase())),t_e=(e=rn(new URL(`dist/`,import.meta.resolve(`@clankerauth/web/package.json`))))=>vm(B(G6,t=>{let{auth:n,settings:r}=t,i=[.../* @__PURE__ */ new Set([r.baseURL,...r.mcpAllowedOrigins])],a=mh(function*(){let e=yield*cP,i=new URL(e.url,r.baseURL),a=i.pathname.replace(/^\/api\/auth/,``);if(!Yge.has(a)&&a!==`/.well-known/oauth-authorization-server/api/auth`)return q9;if(a===`/oauth2/authorize`){let n=e.method===`GET`?i.searchParams.getAll(`resource`):new URLSearchParams(yield*e.text).getAll(`resource`);if(n.length!==1||!(yield*t.resources.get(n[0]??``)))return K9({error:`invalid_target`,error_description:`Exactly one configured resource is required`},400)}let o=e.method===`GET`||e.method===`HEAD`?void 0:yield*e.arrayBuffer,s=yield*LQ(()=>n.handler(new Request(i,{method:e.method,headers:e.headers,body:o})));return roe(s)}).pipe(jh(BQ)),o=yP(t=>mh(function*(){let n=yield*wN;yield*t.add(`*`,`/*`,mh(function*(){let t=yield*cP;if(t.method!==`GET`&&t.method!==`HEAD`)return q9;let i=new URL(t.url,r.baseURL).pathname,a=Qge.has(i)?`index.html`:$ge.test(i)?i.slice(1):void 0;return a?yield*n.fileResponse(tn(e,a),{contentType:a.endsWith(`.js`)?`text/javascript`:a.endsWith(`.css`)?`text/css`:`text/html; charset=utf-8`}).pipe(jh(()=>F(q9))):q9}))})),s=EP(e=>Jge({baseURL:r.baseURL,trustProxy:r.trustProxy})(mh(function*(){let t=yield*cP,n=new URL(t.url,r.baseURL).pathname,a=n.replace(/^\/api\/auth/,``),o=n===`/mcp`,s=t.headers.origin,c=s!==void 0&&i.includes(s),l=Xge.has(a),u;if(o&&s!==void 0&&!c)u=K9({error:`Invalid origin`},403);else if(o&&t.method===`OPTIONS`){let e=t.headers[`access-control-request-method`],n=(t.headers[`access-control-request-headers`]??``).split(`,`).map(e=>e.trim().toLowerCase()).filter(Boolean);u=c&&e===`POST`&&n.every(e=>e_e.has(e))?oN({status:204}):K9({error:`MCP preflight rejected`},403)}else u=l&&t.method===`OPTIONS`?oN({status:204}):yield*e;l&&(u=u.pipe(gN({"access-control-allow-origin":`*`,"access-control-allow-methods":`GET, POST, OPTIONS`,"access-control-allow-headers":`Authorization, Content-Type, DPoP`,"access-control-expose-headers":`WWW-Authenticate, DPoP-Nonce`}),hN(`access-control-allow-credentials`))),o&&(u=u.pipe(mN(`vary`,u.headers.vary?`${u.headers.vary}, Origin`:`Origin`),hN(`access-control-allow-credentials`)),c&&s!==void 0&&(u=u.pipe(gN({"access-control-allow-origin":s,"access-control-expose-headers":`WWW-Authenticate, Mcp-Protocol-Version`})),t.method===`OPTIONS`&&u.status>=200&&u.status<300&&(u=u.pipe(gN({"access-control-allow-methods":`POST`,"access-control-allow-headers":J9.join(`, `)})))));let d=t.method!==`GET`||u.status!==200?`no-store`:n.startsWith(`/assets/`)?`public, max-age=31536000, immutable`:Zge.has(a)?`public, max-age=300`:`no-store`;return u=u.pipe(gN({"cache-control":d,"referrer-policy":`no-referrer`,"x-content-type-options":`nosniff`,"x-frame-options":`DENY`,"content-security-policy":`default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'`})),r.baseURL.startsWith(`https:`)&&(u=u.pipe(mN(`strict-transport-security`,`max-age=31536000`))),u})),{global:!0}),c=EP(e=>yg(e));return bm(Uge(i),r.cookieDomain===void 0?fm:Ffe(r.cookieDomain),bP(`GET`,`/healthz`,t.sql`SELECT 1`.pipe(kh(K9({status:`ok`})),jh(BQ))),bP(`*`,`/api/auth/*`,a),bP(`*`,`/.well-known/*`,a),o).pipe(Cm(c.layer),Cm(s),Cm(VF))})),n_e=H(`Http.nodeHandler`)(function*(e){let t=yield*sse(t_e(e));return yield*zF(t,{scope:yield*ag})}),Y9=`credentials.json`,X9=W({email:U,password:U,secret:U,clientId:BE(U),clientSecret:BE(U)}),r_e=DE(KD(X9)),i_e=IE(X9),Z9=(e,t)=>z(Zk,n=>n.writeFileString(en(e,Y9),`${JSON.stringify(i_e(t),null,2)}\n`,{mode:384})),a_e=H(`Dev.identity`)(function*(e,t){let n={email:`owner@example.internal`,password:Yt(24).toString(`base64url`),secret:Yt(32).toString(`hex`)};if(!t)return n;let r=yield*Zk,i=en(e,Y9);return(yield*r.exists(i))?yield*r_e(yield*r.readFileString(i)):(yield*Z9(e,n),n)}),Q9=e=>Error(`Disposable issuer provisioning failed`,{cause:e}),$9=H(`Dev.ownerSession`)(function*(e,t,n,r){if(t===void 0)return yield*R(/* @__PURE__ */ Error(`A forward-auth session needs a cookieDomain; the issuer serves none`));let i=yield*LM,a=yield*i.execute(TM(`${e}/api/auth/sign-in/email`,{headers:{origin:e}}).pipe(AM(n)));if(yield*a.text,a.status!==200)return yield*R(/* @__PURE__ */ Error(`Owner sign-in failed with HTTP ${a.status}`));let o=new URL(`/`,r).href,s=yield*i.get(`${e}/forward-auth/continue?rd=${encodeURIComponent(o)}`,{headers:{cookie:RT(a.cookies)}});yield*s.text;let c=FT(a.cookies,s.cookies);return{cookie:RT(c),cookies:Object.entries(zT(c)).map(([e,t])=>({name:e,value:t}))}}),o_e=bm(pF,gF,um(hF,{redirect:`manual`})),s_e=V(function*(e){let t=yield*Zk,n=rn(new URL(`./web/`,import.meta.url));if(!(yield*t.exists(en(n,`index.html`))))return yield*R(/* @__PURE__ */ Error(`The @gjermundgaraba/clankerauth-dev installation is missing its bundled dashboard assets`));let r=e.dataDir,i=r===void 0?yield*t.makeTempDirectoryScoped({prefix:`clankerauth-disposable-`}):yield*kh(t.makeDirectory(tn(r),{recursive:!0,mode:448}),tn(r)),a=(e,t)=>{t.writeHead(503).end()},o=Wge((t,n)=>{try{e.onRequest?.({method:t.method??`GET`,url:new URL(t.url??`/`,`http://127.0.0.1:${t.socket.localPort}`)}),a(t,n)}catch{n.headersSent?n.destroy():n.writeHead(500).end(`Request failed`)}}),s=fh(e=>{o.close(()=>e(L)),o.closeAllConnections()});yield*cg(fh(t=>{let n=e=>t(R(e));o.once(`error`,n),o.listen(e.port??0,`127.0.0.1`,()=>{o.off(`error`,n),t(L)})}),()=>s);let c=o.address();if(!(c instanceof Object))return yield*R(/* @__PURE__ */ Error(`Disposable issuer failed to bind a TCP port`));let{port:l}=c,u=e.cookieDomain===void 0?`http://127.0.0.1:${l}`:`http://clankerauth.${e.cookieDomain}:${l}`,d=yield*a_e(i,r!==void 0),f=yield*H6({baseURL:u,secret:dT(d.secret),database:en(i,`issuer.sqlite`),host:`127.0.0.1`,port:l,mcpAllowedOrigins:[],trustProxy:!1,allowInsecureHttp:e.cookieDomain!==void 0,cookieDomain:e.cookieDomain}),p=yield*cm(G6.layer(f,{cimdTransport:e.cimdTransport})),m=_s(p,G6),h=yield*Gp(yield*ag);a=yield*n_e(n).pipe(eg(p),ig(zp,h)),yield*lg(()=>s);let g={email:d.email,password:d.password},_=yield*eg(Y6,p),v=yield*eg(G9,p),y=e=>yg(og(mh(function*(){let t=yield*m.owner();if(t===void 0)return yield*_h(/* @__PURE__ */ Error(`Owner setup failed`));let n=yield*p$(m,t);return yield*e(t).pipe(ig(q6,{userId:t,email:g.email,providerHeaders:F(n)}))}))).pipe(Ih(Q9));(yield*m.owner())||(yield*K6(m,g).pipe(Ih(Q9))),yield*y(()=>ah(e.resources,e=>z(m.resources.get(e.identifier),t=>t?L:Ah(_.createResource(e)))));let b=yield*y(()=>mh(function*(){if(d.clientId!==void 0&&d.clientSecret!==void 0){let{clients:e}=yield*_.list();if(e.some(e=>e.client_id===d.clientId))return{client_id:d.clientId,client_secret:d.clientSecret}}return yield*_.create({client_name:e.client.name,redirect_uris:[e.client.redirect],resources:e.client.resources,token_endpoint_auth_method:`client_secret_basic`,application_type:`native`})})),x=b.client_secret;if(x===void 0)return yield*R(/* @__PURE__ */ Error(`Disposable issuer did not return client credentials`));r!==void 0&&(yield*Z9(i,{...d,clientId:b.client_id,clientSecret:x}));let S=e.cookieDomain===void 0?void 0:u;return{details:{issuer:`${u}/api/auth`,clientId:b.client_id,clientSecret:x,owner:g,url:u,port:l,directory:i},apiKey:e=>y(()=>B(v.create({name:e.name??`development`,permissions:e.permissions,expiresAt:null}),e=>e.key)),ownerSession:e=>$9(u,S,g,e),ownerToken:H(`Dev.ownerToken`)(function*(e){let{cookie:t}=yield*$9(u,S,g,e.appOrigin),n=yield*LM,r=new URL(e.appOrigin),i=new URL(`/forward-auth`,u);i.searchParams.set(`resource`,e.resource);let a=yield*n.get(i,{headers:{cookie:t,"x-forwarded-proto":r.protocol.slice(0,-1),"x-forwarded-host":r.host,"x-forwarded-uri":`/`}});yield*a.text;let o=a.headers.authorization;return a.status!==204||o===void 0?yield*R(/* @__PURE__ */ Error(`Forward auth issued no token (HTTP ${a.status})`)):o.replace(/^Bearer /iu,``)})}});async function c_e(e){let t=Vp(),n=e=>Ng(e.pipe(ig(zp,t),eg(o_e)),{onFiberStart:Jb(t)}),r=Fg(mg(qp(t,Sp)));try{let t=await n(s_e(e));return{...t.details,apiKey:e=>n(t.apiKey(e)),ownerSession:e=>n(t.ownerSession(e)),ownerToken:e=>n(t.ownerToken(e)),close:()=>Ng(r)}}catch(e){throw await Ng(r),e}}export{c_e as startDisposableIssuer,VQ as t};