@jeffusion/bungee-core 5.26.0 → 6.0.1

package/dist/plugins/user-auth/control.js

@@ -0,0 +1,3911 @@
+// @bun
+// node_modules/oauth4webapi/build/index.js
+var USER_AGENT;
+if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
+  const NAME = "oauth4webapi";
+  const VERSION = "v3.8.8";
+  USER_AGENT = `${NAME}/${VERSION}`;
+}
+function looseInstanceOf(input, expected) {
+  if (input == null) {
+    return false;
+  }
+  try {
+    return input instanceof expected || Object.getPrototypeOf(input)[Symbol.toStringTag] === expected.prototype[Symbol.toStringTag];
+  } catch {
+    return false;
+  }
+}
+var ERR_INVALID_ARG_VALUE = "ERR_INVALID_ARG_VALUE";
+var ERR_INVALID_ARG_TYPE = "ERR_INVALID_ARG_TYPE";
+function CodedTypeError(message, code, cause) {
+  const err = new TypeError(message, { cause });
+  Object.assign(err, { code });
+  return err;
+}
+var allowInsecureRequests = Symbol();
+var clockSkew = Symbol();
+var clockTolerance = Symbol();
+var customFetch = Symbol();
+var modifyAssertion = Symbol();
+var jweDecrypt = Symbol();
+var jwksCache = Symbol();
+var encoder = new TextEncoder;
+var decoder = new TextDecoder;
+function buf(input) {
+  if (typeof input === "string") {
+    return encoder.encode(input);
+  }
+  return decoder.decode(input);
+}
+var encodeBase64Url;
+if (Uint8Array.prototype.toBase64) {
+  encodeBase64Url = (input) => {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    return input.toBase64({ alphabet: "base64url", omitPadding: true });
+  };
+} else {
+  const CHUNK_SIZE = 32768;
+  encodeBase64Url = (input) => {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    const arr = [];
+    for (let i = 0;i < input.byteLength; i += CHUNK_SIZE) {
+      arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+    }
+    return btoa(arr.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  };
+}
+var decodeBase64Url;
+if (Uint8Array.fromBase64) {
+  decodeBase64Url = (input) => {
+    try {
+      return Uint8Array.fromBase64(input, { alphabet: "base64url" });
+    } catch (cause) {
+      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+} else {
+  decodeBase64Url = (input) => {
+    try {
+      const binary = atob(input.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, ""));
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0;i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+      }
+      return bytes;
+    } catch (cause) {
+      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+}
+function b64u(input) {
+  if (typeof input === "string") {
+    return decodeBase64Url(input);
+  }
+  return encodeBase64Url(input);
+}
+
+class UnsupportedOperationError extends Error {
+  code;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    this.code = UNSUPPORTED_OPERATION;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+
+class OperationProcessingError extends Error {
+  code;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    if (options?.code) {
+      this.code = options?.code;
+    }
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+function OPE(message, code, cause) {
+  return new OperationProcessingError(message, { code, cause });
+}
+function isJsonObject(input) {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    return false;
+  }
+  return true;
+}
+function prepareHeaders(input) {
+  if (looseInstanceOf(input, Headers)) {
+    input = Object.fromEntries(input.entries());
+  }
+  const headers = new Headers(input ?? {});
+  if (USER_AGENT && !headers.has("user-agent")) {
+    headers.set("user-agent", USER_AGENT);
+  }
+  if (headers.has("authorization")) {
+    throw CodedTypeError('"options.headers" must not include the "authorization" header name', ERR_INVALID_ARG_VALUE);
+  }
+  return headers;
+}
+function signal(url, value) {
+  if (value !== undefined) {
+    if (typeof value === "function") {
+      value = value(url.href);
+    }
+    if (!(value instanceof AbortSignal)) {
+      throw CodedTypeError('"options.signal" must return or be an instance of AbortSignal', ERR_INVALID_ARG_TYPE);
+    }
+    return value;
+  }
+  return;
+}
+function replaceDoubleSlash(pathname) {
+  if (pathname.includes("//")) {
+    return pathname.replace("//", "/");
+  }
+  return pathname;
+}
+function prependWellKnown(url, wellKnown, allowTerminatingSlash = false) {
+  if (url.pathname === "/") {
+    url.pathname = wellKnown;
+  } else {
+    url.pathname = replaceDoubleSlash(`${wellKnown}/${allowTerminatingSlash ? url.pathname : url.pathname.replace(/(\/)$/, "")}`);
+  }
+  return url;
+}
+function appendWellKnown(url, wellKnown) {
+  url.pathname = replaceDoubleSlash(`${url.pathname}/${wellKnown}`);
+  return url;
+}
+async function performDiscovery(input, urlName, transform, options) {
+  if (!(input instanceof URL)) {
+    throw CodedTypeError(`"${urlName}" must be an instance of URL`, ERR_INVALID_ARG_TYPE);
+  }
+  checkProtocol(input, options?.[allowInsecureRequests] !== true);
+  const url = transform(new URL(input.href));
+  const headers = prepareHeaders(options?.headers);
+  headers.set("accept", "application/json");
+  return (options?.[customFetch] || fetch)(url.href, {
+    body: undefined,
+    headers: Object.fromEntries(headers.entries()),
+    method: "GET",
+    redirect: "manual",
+    signal: signal(url, options?.signal)
+  });
+}
+async function discoveryRequest(issuerIdentifier, options) {
+  return performDiscovery(issuerIdentifier, "issuerIdentifier", (url) => {
+    switch (options?.algorithm) {
+      case undefined:
+      case "oidc":
+        appendWellKnown(url, ".well-known/openid-configuration");
+        break;
+      case "oauth2":
+        prependWellKnown(url, ".well-known/oauth-authorization-server");
+        break;
+      default:
+        throw CodedTypeError('"options.algorithm" must be "oidc" (default), or "oauth2"', ERR_INVALID_ARG_VALUE);
+    }
+    return url;
+  }, options);
+}
+function assertNumber(input, allow0, it, code, cause) {
+  try {
+    if (typeof input !== "number" || !Number.isFinite(input)) {
+      throw CodedTypeError(`${it} must be a number`, ERR_INVALID_ARG_TYPE, cause);
+    }
+    if (input > 0)
+      return;
+    if (allow0) {
+      if (input !== 0) {
+        throw CodedTypeError(`${it} must be a non-negative number`, ERR_INVALID_ARG_VALUE, cause);
+      }
+      return;
+    }
+    throw CodedTypeError(`${it} must be a positive number`, ERR_INVALID_ARG_VALUE, cause);
+  } catch (err) {
+    if (code) {
+      throw OPE(err.message, code, cause);
+    }
+    throw err;
+  }
+}
+function assertString(input, it, code, cause) {
+  try {
+    if (typeof input !== "string") {
+      throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE, cause);
+    }
+    if (input.length === 0) {
+      throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE, cause);
+    }
+  } catch (err) {
+    if (code) {
+      throw OPE(err.message, code, cause);
+    }
+    throw err;
+  }
+}
+async function processDiscoveryResponse(expectedIssuerIdentifier, response) {
+  const expected = expectedIssuerIdentifier;
+  if (!(expected instanceof URL) && expected !== _nodiscoverycheck) {
+    throw CodedTypeError('"expectedIssuerIdentifier" must be an instance of URL', ERR_INVALID_ARG_TYPE);
+  }
+  if (!looseInstanceOf(response, Response)) {
+    throw CodedTypeError('"response" must be an instance of Response', ERR_INVALID_ARG_TYPE);
+  }
+  if (response.status !== 200) {
+    throw OPE('"response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);
+  }
+  assertReadableResponse(response);
+  const json = await getResponseJsonBody(response);
+  assertString(json.issuer, '"response" body "issuer" property', INVALID_RESPONSE, { body: json });
+  if (expected !== _nodiscoverycheck && new URL(json.issuer).href !== expected.href) {
+    throw OPE('"response" body "issuer" property does not match the expected value', JSON_ATTRIBUTE_COMPARISON, { expected: expected.href, body: json, attribute: "issuer" });
+  }
+  return json;
+}
+function assertApplicationJson(response) {
+  assertContentType(response, "application/json");
+}
+function notJson(response, ...types) {
+  let msg = '"response" content-type must be ';
+  if (types.length > 2) {
+    const last = types.pop();
+    msg += `${types.join(", ")}, or ${last}`;
+  } else if (types.length === 2) {
+    msg += `${types[0]} or ${types[1]}`;
+  } else {
+    msg += types[0];
+  }
+  return OPE(msg, RESPONSE_IS_NOT_JSON, response);
+}
+function assertContentTypes(response, ...types) {
+  if (!types.includes(getContentType(response))) {
+    throw notJson(response, ...types);
+  }
+}
+function assertContentType(response, contentType) {
+  if (getContentType(response) !== contentType) {
+    throw notJson(response, contentType);
+  }
+}
+function randomBytes() {
+  return b64u(crypto.getRandomValues(new Uint8Array(32)));
+}
+function generateRandomCodeVerifier() {
+  return randomBytes();
+}
+function generateRandomState() {
+  return randomBytes();
+}
+function generateRandomNonce() {
+  return randomBytes();
+}
+async function calculatePKCECodeChallenge(codeVerifier) {
+  assertString(codeVerifier, "codeVerifier");
+  return b64u(await crypto.subtle.digest("SHA-256", buf(codeVerifier)));
+}
+function getClockSkew(client) {
+  const skew = client?.[clockSkew];
+  return typeof skew === "number" && Number.isFinite(skew) ? skew : 0;
+}
+function getClockTolerance(client) {
+  const tolerance = client?.[clockTolerance];
+  return typeof tolerance === "number" && Number.isFinite(tolerance) && Math.sign(tolerance) !== -1 ? tolerance : 30;
+}
+function epochTime() {
+  return Math.floor(Date.now() / 1000);
+}
+function assertAs(as) {
+  if (typeof as !== "object" || as === null) {
+    throw CodedTypeError('"as" must be an object', ERR_INVALID_ARG_TYPE);
+  }
+  assertString(as.issuer, '"as.issuer"');
+}
+function assertClient(client) {
+  if (typeof client !== "object" || client === null) {
+    throw CodedTypeError('"client" must be an object', ERR_INVALID_ARG_TYPE);
+  }
+  assertString(client.client_id, '"client.client_id"');
+}
+function formUrlEncode(token) {
+  return encodeURIComponent(token).replace(/(?:[-_.!~*'()]|%20)/g, (substring) => {
+    switch (substring) {
+      case "-":
+      case "_":
+      case ".":
+      case "!":
+      case "~":
+      case "*":
+      case "'":
+      case "(":
+      case ")":
+        return `%${substring.charCodeAt(0).toString(16).toUpperCase()}`;
+      case "%20":
+        return "+";
+      default:
+        throw new Error;
+    }
+  });
+}
+function ClientSecretPost(clientSecret) {
+  assertString(clientSecret, '"clientSecret"');
+  return (_as, client, body, _headers) => {
+    body.set("client_id", client.client_id);
+    body.set("client_secret", clientSecret);
+  };
+}
+function ClientSecretBasic(clientSecret) {
+  assertString(clientSecret, '"clientSecret"');
+  return (_as, client, _body, headers) => {
+    const username = formUrlEncode(client.client_id);
+    const password = formUrlEncode(clientSecret);
+    const credentials = btoa(`${username}:${password}`);
+    headers.set("authorization", `Basic ${credentials}`);
+  };
+}
+function None() {
+  return (_as, client, body, _headers) => {
+    body.set("client_id", client.client_id);
+  };
+}
+var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) => {
+  try {
+    return new URL(url, base);
+  } catch {
+    return null;
+  }
+};
+function checkProtocol(url, enforceHttps) {
+  if (enforceHttps && url.protocol !== "https:") {
+    throw OPE("only requests to HTTPS are allowed", HTTP_REQUEST_FORBIDDEN, url);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw OPE("only HTTP and HTTPS requests are allowed", REQUEST_PROTOCOL_FORBIDDEN, url);
+  }
+}
+function validateEndpoint(value, endpoint, useMtlsAlias, enforceHttps) {
+  let url;
+  if (typeof value !== "string" || !(url = URLParse(value))) {
+    throw OPE(`authorization server metadata does not contain a valid ${useMtlsAlias ? `"as.mtls_endpoint_aliases.${endpoint}"` : `"as.${endpoint}"`}`, value === undefined ? MISSING_SERVER_METADATA : INVALID_SERVER_METADATA, { attribute: useMtlsAlias ? `mtls_endpoint_aliases.${endpoint}` : endpoint });
+  }
+  checkProtocol(url, enforceHttps);
+  return url;
+}
+function resolveEndpoint(as, endpoint, useMtlsAlias, enforceHttps) {
+  if (useMtlsAlias && as.mtls_endpoint_aliases && endpoint in as.mtls_endpoint_aliases) {
+    return validateEndpoint(as.mtls_endpoint_aliases[endpoint], endpoint, useMtlsAlias, enforceHttps);
+  }
+  return validateEndpoint(as[endpoint], endpoint, useMtlsAlias, enforceHttps);
+}
+function isDPoPNonceError(err) {
+  if (err instanceof WWWAuthenticateChallengeError) {
+    return err.cause.some((challenge) => challenge.scheme === "dpop" && challenge.parameters.error === "use_dpop_nonce");
+  }
+  if (err instanceof ResponseBodyError) {
+    return err.error === "use_dpop_nonce";
+  }
+  return false;
+}
+class ResponseBodyError extends Error {
+  cause;
+  code;
+  error;
+  status;
+  error_description;
+  response;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    this.code = RESPONSE_BODY_ERROR;
+    this.cause = options.cause;
+    this.error = options.cause.error;
+    this.status = options.response.status;
+    this.error_description = options.cause.error_description;
+    Object.defineProperty(this, "response", { enumerable: false, value: options.response });
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+
+class AuthorizationResponseError extends Error {
+  cause;
+  code;
+  error;
+  error_description;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    this.code = AUTHORIZATION_RESPONSE_ERROR;
+    this.cause = options.cause;
+    this.error = options.cause.get("error");
+    this.error_description = options.cause.get("error_description") ?? undefined;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+
+class WWWAuthenticateChallengeError extends Error {
+  cause;
+  code;
+  response;
+  status;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    this.code = WWW_AUTHENTICATE_CHALLENGE;
+    this.cause = options.cause;
+    this.status = options.response.status;
+    this.response = options.response;
+    Object.defineProperty(this, "response", { enumerable: false });
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+var tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
+var token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
+var quotedMatch = '"((?:[^"\\\\]|\\\\[\\s\\S])*)"';
+var quotedParamMatcher = "(" + tokenMatch + ")\\s*=\\s*" + quotedMatch;
+var paramMatcher = "(" + tokenMatch + ")\\s*=\\s*(" + tokenMatch + ")";
+var schemeRE = new RegExp("^[,\\s]*(" + tokenMatch + ")");
+var quotedParamRE = new RegExp("^[,\\s]*" + quotedParamMatcher + "[,\\s]*(.*)");
+var unquotedParamRE = new RegExp("^[,\\s]*" + paramMatcher + "[,\\s]*(.*)");
+var token68ParamRE = new RegExp("^(" + token68Match + ")(?:$|[,\\s])(.*)");
+function parseWwwAuthenticateChallenges(response) {
+  if (!looseInstanceOf(response, Response)) {
+    throw CodedTypeError('"response" must be an instance of Response', ERR_INVALID_ARG_TYPE);
+  }
+  const header = response.headers.get("www-authenticate");
+  if (header === null) {
+    return;
+  }
+  const challenges = [];
+  let rest = header;
+  while (rest) {
+    let match = rest.match(schemeRE);
+    const scheme = match?.["1"].toLowerCase();
+    if (!scheme) {
+      return;
+    }
+    const afterScheme = rest.substring(match[0].length);
+    if (afterScheme && !afterScheme.match(/^[\s,]/)) {
+      return;
+    }
+    const spaceMatch = afterScheme.match(/^\s+(.*)$/);
+    const hasParameters = !!spaceMatch;
+    rest = spaceMatch ? spaceMatch[1] : undefined;
+    const parameters = {};
+    let token68;
+    if (hasParameters) {
+      while (rest) {
+        let key;
+        let value;
+        if (match = rest.match(quotedParamRE)) {
+          [, key, value, rest] = match;
+          if (value.includes("\\")) {
+            value = value.replace(/\\([\s\S])/g, "$1");
+          }
+          parameters[key.toLowerCase()] = value;
+          continue;
+        }
+        if (match = rest.match(unquotedParamRE)) {
+          [, key, value, rest] = match;
+          parameters[key.toLowerCase()] = value;
+          continue;
+        }
+        if (match = rest.match(token68ParamRE)) {
+          if (Object.keys(parameters).length) {
+            break;
+          }
+          [, token68, rest] = match;
+          break;
+        }
+        return;
+      }
+    } else {
+      rest = afterScheme || undefined;
+    }
+    const challenge = { scheme, parameters };
+    if (token68) {
+      challenge.token68 = token68;
+    }
+    challenges.push(challenge);
+  }
+  if (!challenges.length) {
+    return;
+  }
+  return challenges;
+}
+async function parseOAuthResponseErrorBody(response) {
+  if (response.status > 399 && response.status < 500) {
+    assertReadableResponse(response);
+    assertApplicationJson(response);
+    try {
+      const json = await response.clone().json();
+      if (isJsonObject(json) && typeof json.error === "string" && json.error.length) {
+        return json;
+      }
+    } catch {}
+  }
+  return;
+}
+async function checkOAuthBodyError(response, expected, label) {
+  if (response.status !== expected) {
+    checkAuthenticationChallenges(response);
+    let err;
+    if (err = await parseOAuthResponseErrorBody(response)) {
+      await response.body?.cancel();
+      throw new ResponseBodyError("server responded with an error in the response body", {
+        cause: err,
+        response
+      });
+    }
+    throw OPE(`"response" is not a conform ${label} response (unexpected HTTP status code)`, RESPONSE_IS_NOT_CONFORM, response);
+  }
+}
+function assertDPoP(option) {
+  if (!branded.has(option)) {
+    throw CodedTypeError('"options.DPoP" is not a valid DPoPHandle', ERR_INVALID_ARG_VALUE);
+  }
+}
+async function resourceRequest(accessToken, method, url, headers, body, options) {
+  assertString(accessToken, '"accessToken"');
+  if (!(url instanceof URL)) {
+    throw CodedTypeError('"url" must be an instance of URL', ERR_INVALID_ARG_TYPE);
+  }
+  checkProtocol(url, options?.[allowInsecureRequests] !== true);
+  headers = prepareHeaders(headers);
+  if (options?.DPoP) {
+    assertDPoP(options.DPoP);
+    await options.DPoP.addProof(url, headers, method.toUpperCase(), accessToken);
+  }
+  headers.set("authorization", `${headers.has("dpop") ? "DPoP" : "Bearer"} ${accessToken}`);
+  const response = await (options?.[customFetch] || fetch)(url.href, {
+    duplex: looseInstanceOf(body, ReadableStream) ? "half" : undefined,
+    body,
+    headers: Object.fromEntries(headers.entries()),
+    method,
+    redirect: "manual",
+    signal: signal(url, options?.signal)
+  });
+  options?.DPoP?.cacheNonce(response, url);
+  return response;
+}
+async function protectedResourceRequest(accessToken, method, url, headers, body, options) {
+  const response = await resourceRequest(accessToken, method, url, headers, body, options);
+  checkAuthenticationChallenges(response);
+  return response;
+}
+var jwksMap;
+var jwksRequests;
+var jwksKeys;
+function setJwksCache(as, jwks, uat, cache) {
+  jwksMap ||= new WeakMap;
+  jwksMap.set(as, {
+    jwks,
+    uat,
+    get age() {
+      return epochTime() - this.uat;
+    }
+  });
+  if (cache) {
+    Object.assign(cache, { jwks: structuredClone(jwks), uat });
+  }
+}
+function isFreshJwksCache(input) {
+  if (typeof input !== "object" || input === null) {
+    return false;
+  }
+  if (!("uat" in input) || typeof input.uat !== "number" || epochTime() - input.uat >= 300) {
+    return false;
+  }
+  if (!("jwks" in input) || !isJsonObject(input.jwks) || !Array.isArray(input.jwks.keys) || !Array.prototype.every.call(input.jwks.keys, isJsonObject)) {
+    return false;
+  }
+  return true;
+}
+function clearJwksCache(as, cache) {
+  jwksMap?.delete(as);
+  delete cache?.jwks;
+  delete cache?.uat;
+}
+async function getPublicSigKeyFromIssuerJwksUri(as, options, header) {
+  const { alg, kid } = header;
+  checkSupportedJwsAlg(header);
+  if (!jwksMap?.has(as) && isFreshJwksCache(options?.[jwksCache])) {
+    setJwksCache(as, options?.[jwksCache].jwks, options?.[jwksCache].uat);
+  }
+  let jwks;
+  let age;
+  if (jwksMap?.has(as)) {
+    ({ jwks, age } = jwksMap.get(as));
+    if (age >= 300) {
+      clearJwksCache(as, options?.[jwksCache]);
+      return getPublicSigKeyFromIssuerJwksUri(as, options, header);
+    }
+  } else {
+    const downloaded = await jwksRequest(as, options);
+    jwks = downloaded.jwks;
+    age = epochTime() - downloaded.uat;
+    setJwksCache(as, jwks, downloaded.uat, options?.[jwksCache]);
+  }
+  let kty;
+  switch (alg.slice(0, 2)) {
+    case "RS":
+    case "PS":
+      kty = "RSA";
+      break;
+    case "ES":
+      kty = "EC";
+      break;
+    case "Ed":
+      kty = "OKP";
+      break;
+    case "ML":
+      kty = "AKP";
+      break;
+    default:
+      throw new UnsupportedOperationError("unsupported JWS algorithm", { cause: { alg } });
+  }
+  const candidates = jwks.keys.filter((jwk) => {
+    if (jwk.kty !== kty) {
+      return false;
+    }
+    if (kid !== undefined && kid !== jwk.kid) {
+      return false;
+    }
+    if (jwk.alg !== undefined && alg !== jwk.alg) {
+      return false;
+    }
+    if (jwk.use !== undefined && jwk.use !== "sig") {
+      return false;
+    }
+    if (jwk.key_ops?.includes("verify") === false) {
+      return false;
+    }
+    switch (true) {
+      case (alg === "ES256" && jwk.crv !== "P-256"):
+      case (alg === "ES384" && jwk.crv !== "P-384"):
+      case (alg === "ES512" && jwk.crv !== "P-521"):
+      case (alg === "Ed25519" && jwk.crv !== "Ed25519"):
+      case (alg === "EdDSA" && jwk.crv !== "Ed25519"):
+        return false;
+    }
+    return true;
+  });
+  const { 0: jwk, length } = candidates;
+  if (!length) {
+    if (age >= 60) {
+      clearJwksCache(as, options?.[jwksCache]);
+      return getPublicSigKeyFromIssuerJwksUri(as, options, header);
+    }
+    throw OPE("error when selecting a JWT verification key, no applicable keys found", KEY_SELECTION, { header, candidates, jwks_uri: new URL(as.jwks_uri) });
+  }
+  if (length !== 1) {
+    throw OPE('error when selecting a JWT verification key, multiple applicable keys found, a "kid" JWT Header Parameter is required', KEY_SELECTION, { header, candidates, jwks_uri: new URL(as.jwks_uri) });
+  }
+  jwksKeys ||= new WeakMap;
+  let keys = jwksKeys.get(jwk);
+  if (!keys) {
+    keys = new Map;
+    jwksKeys.set(jwk, keys);
+  }
+  let key = keys.get(alg);
+  if (!key) {
+    key = importJwk(alg, jwk).catch((cause) => {
+      keys.delete(alg);
+      throw cause;
+    });
+    keys.set(alg, key);
+  }
+  return key;
+}
+var skipSubjectCheck = Symbol();
+function getContentType(input) {
+  return input.headers.get("content-type")?.split(";")[0];
+}
+async function authenticatedRequest(as, client, clientAuthentication, url, body, headers, options) {
+  await clientAuthentication(as, client, body, headers);
+  headers.set("content-type", "application/x-www-form-urlencoded;charset=UTF-8");
+  return (options?.[customFetch] || fetch)(url.href, {
+    body,
+    headers: Object.fromEntries(headers.entries()),
+    method: "POST",
+    redirect: "manual",
+    signal: signal(url, options?.signal)
+  });
+}
+async function tokenEndpointRequest(as, client, clientAuthentication, grantType, parameters, options) {
+  const url = resolveEndpoint(as, "token_endpoint", client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);
+  parameters.set("grant_type", grantType);
+  const headers = prepareHeaders(options?.headers);
+  headers.set("accept", "application/json");
+  if (options?.DPoP !== undefined) {
+    assertDPoP(options.DPoP);
+    await options.DPoP.addProof(url, headers, "POST");
+  }
+  const response = await authenticatedRequest(as, client, clientAuthentication, url, parameters, headers, options);
+  options?.DPoP?.cacheNonce(response, url);
+  return response;
+}
+var idTokenClaims = new WeakMap;
+var jwtRefs = new WeakMap;
+function getValidatedIdTokenClaims(ref) {
+  if (!ref.id_token) {
+    return;
+  }
+  const claims = idTokenClaims.get(ref);
+  if (!claims) {
+    throw CodedTypeError('"ref" was already garbage collected or did not resolve from the proper sources', ERR_INVALID_ARG_VALUE);
+  }
+  return claims;
+}
+async function validateApplicationLevelSignature(as, ref, options) {
+  assertAs(as);
+  if (!jwtRefs.has(ref)) {
+    throw CodedTypeError('"ref" does not contain a processed JWT Response to verify the signature of', ERR_INVALID_ARG_VALUE);
+  }
+  const { 0: protectedHeader, 1: payload, 2: encodedSignature } = jwtRefs.get(ref).split(".");
+  const header = JSON.parse(buf(b64u(protectedHeader)));
+  if (header.alg.startsWith("HS")) {
+    throw new UnsupportedOperationError("unsupported JWS algorithm", { cause: { alg: header.alg } });
+  }
+  let key;
+  key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);
+  await validateJwsSignature(protectedHeader, payload, key, b64u(encodedSignature));
+}
+async function processGenericAccessTokenResponse(as, client, response, additionalRequiredIdTokenClaims, decryptFn, recognizedTokenTypes) {
+  assertAs(as);
+  assertClient(client);
+  if (!looseInstanceOf(response, Response)) {
+    throw CodedTypeError('"response" must be an instance of Response', ERR_INVALID_ARG_TYPE);
+  }
+  await checkOAuthBodyError(response, 200, "Token Endpoint");
+  assertReadableResponse(response);
+  const json = await getResponseJsonBody(response);
+  assertString(json.access_token, '"response" body "access_token" property', INVALID_RESPONSE, {
+    body: json
+  });
+  assertString(json.token_type, '"response" body "token_type" property', INVALID_RESPONSE, {
+    body: json
+  });
+  json.token_type = json.token_type.toLowerCase();
+  if (json.expires_in !== undefined) {
+    let expiresIn = typeof json.expires_in !== "number" ? parseFloat(json.expires_in) : json.expires_in;
+    assertNumber(expiresIn, true, '"response" body "expires_in" property', INVALID_RESPONSE, {
+      body: json
+    });
+    json.expires_in = expiresIn;
+  }
+  if (json.refresh_token !== undefined) {
+    assertString(json.refresh_token, '"response" body "refresh_token" property', INVALID_RESPONSE, {
+      body: json
+    });
+  }
+  if (json.scope !== undefined && typeof json.scope !== "string") {
+    throw OPE('"response" body "scope" property must be a string', INVALID_RESPONSE, { body: json });
+  }
+  if (json.id_token !== undefined) {
+    assertString(json.id_token, '"response" body "id_token" property', INVALID_RESPONSE, {
+      body: json
+    });
+    const requiredClaims = [];
+    if (client.require_auth_time === true) {
+      requiredClaims.push("auth_time");
+    }
+    if (client.default_max_age !== undefined) {
+      assertNumber(client.default_max_age, true, '"client.default_max_age"');
+      requiredClaims.push("auth_time");
+    }
+    if (additionalRequiredIdTokenClaims?.length) {
+      requiredClaims.push(...additionalRequiredIdTokenClaims);
+    }
+    const { claims, jwt } = await validateIdTokenClaims(as, client, json.id_token, requiredClaims, decryptFn);
+    validateIdTokenAuthorizedParty(client, claims);
+    validateIdTokenAuthTimeClaim(claims);
+    jwtRefs.set(response, jwt);
+    idTokenClaims.set(json, claims);
+  }
+  if (recognizedTokenTypes?.[json.token_type] !== undefined) {
+    recognizedTokenTypes[json.token_type](response, json);
+  } else if (json.token_type !== "dpop" && json.token_type !== "bearer") {
+    throw new UnsupportedOperationError("unsupported `token_type` value", { cause: { body: json } });
+  }
+  return json;
+}
+function checkAuthenticationChallenges(response) {
+  let challenges;
+  if (challenges = parseWwwAuthenticateChallenges(response)) {
+    throw new WWWAuthenticateChallengeError("server responded with a challenge in the WWW-Authenticate HTTP Header", { cause: challenges, response });
+  }
+}
+function validateAudience(expected, result) {
+  if (Array.isArray(result.claims.aud)) {
+    if (!result.claims.aud.includes(expected)) {
+      throw OPE('unexpected JWT "aud" (audience) claim value', JWT_CLAIM_COMPARISON, {
+        expected,
+        claims: result.claims,
+        claim: "aud"
+      });
+    }
+  } else if (result.claims.aud !== expected) {
+    throw OPE('unexpected JWT "aud" (audience) claim value', JWT_CLAIM_COMPARISON, {
+      expected,
+      claims: result.claims,
+      claim: "aud"
+    });
+  }
+  return result;
+}
+function validateIssuer(as, result) {
+  const expected = as[_expectedIssuer]?.(result) ?? as.issuer;
+  if (result.claims.iss !== expected) {
+    throw OPE('unexpected JWT "iss" (issuer) claim value', JWT_CLAIM_COMPARISON, {
+      expected,
+      claims: result.claims,
+      claim: "iss"
+    });
+  }
+  return result;
+}
+var branded = new WeakSet;
+function brand(searchParams) {
+  branded.add(searchParams);
+  return searchParams;
+}
+var nopkce = Symbol();
+async function authorizationCodeGrantRequest(as, client, clientAuthentication, callbackParameters, redirectUri, codeVerifier, options) {
+  assertAs(as);
+  assertClient(client);
+  if (!branded.has(callbackParameters)) {
+    throw CodedTypeError('"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()', ERR_INVALID_ARG_VALUE);
+  }
+  assertString(redirectUri, '"redirectUri"');
+  const code = getURLSearchParameter(callbackParameters, "code");
+  if (!code) {
+    throw OPE('no authorization code in "callbackParameters"', INVALID_RESPONSE);
+  }
+  const parameters = new URLSearchParams(options?.additionalParameters);
+  parameters.set("redirect_uri", redirectUri);
+  parameters.set("code", code);
+  if (codeVerifier !== nopkce) {
+    assertString(codeVerifier, '"codeVerifier"');
+    parameters.set("code_verifier", codeVerifier);
+  }
+  return tokenEndpointRequest(as, client, clientAuthentication, "authorization_code", parameters, options);
+}
+var jwtClaimNames = {
+  aud: "audience",
+  c_hash: "code hash",
+  client_id: "client id",
+  exp: "expiration time",
+  iat: "issued at",
+  iss: "issuer",
+  jti: "jwt id",
+  nonce: "nonce",
+  s_hash: "state hash",
+  sub: "subject",
+  ath: "access token hash",
+  htm: "http method",
+  htu: "http uri",
+  cnf: "confirmation",
+  auth_time: "authentication time"
+};
+function validatePresence(required, result) {
+  for (const claim of required) {
+    if (result.claims[claim] === undefined) {
+      throw OPE(`JWT "${claim}" (${jwtClaimNames[claim]}) claim missing`, INVALID_RESPONSE, {
+        claims: result.claims
+      });
+    }
+  }
+  return result;
+}
+function validateStringClaim(claim, result) {
+  if (typeof result.claims[claim] !== "string") {
+    throw OPE(`unexpected JWT "${claim}" (${jwtClaimNames[claim]}) claim type`, INVALID_RESPONSE, {
+      claims: result.claims
+    });
+  }
+  return result;
+}
+function validateIdTokenClaims(as, client, idToken, requiredClaims, decryptFn) {
+  return validateJwt(idToken, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported, "RS256"), getClockSkew(client), getClockTolerance(client), decryptFn).then(validatePresence.bind(undefined, ["aud", "exp", "iat", "iss", "sub", ...requiredClaims])).then(validateIssuer.bind(undefined, as)).then(validateAudience.bind(undefined, client.client_id)).then(validateStringClaim.bind(undefined, "sub"));
+}
+function resolveIdTokenMaxAge(client, maxAge) {
+  if (maxAge === skipAuthTimeCheck) {
+    return maxAge;
+  }
+  const fromClient = maxAge === undefined;
+  if (fromClient) {
+    maxAge = client.default_max_age;
+  }
+  if (maxAge === undefined) {
+    return skipAuthTimeCheck;
+  }
+  assertNumber(maxAge, true, fromClient ? '"client.default_max_age"' : '"maxAge" argument');
+  return maxAge;
+}
+function validateIdTokenAuthTimeClaim(claims) {
+  if (claims.auth_time !== undefined) {
+    assertNumber(claims.auth_time, true, 'ID Token "auth_time" (authentication time)', INVALID_RESPONSE, { claims });
+  }
+}
+function validateIdTokenAuthTime(client, claims, maxAge) {
+  if (maxAge === skipAuthTimeCheck) {
+    return;
+  }
+  const now = epochTime() + getClockSkew(client);
+  const tolerance = getClockTolerance(client);
+  if (claims.auth_time + maxAge < now - tolerance) {
+    throw OPE("too much time has elapsed since the last End-User authentication", JWT_TIMESTAMP_CHECK, { claims, now, tolerance, claim: "auth_time" });
+  }
+}
+function validateIdTokenNonce(claims, expectedNonce) {
+  const expected = expectedNonce === expectNoNonce ? undefined : expectedNonce;
+  if (claims.nonce !== expected) {
+    throw OPE('unexpected ID Token "nonce" claim value', JWT_CLAIM_COMPARISON, {
+      expected,
+      claims,
+      claim: "nonce"
+    });
+  }
+}
+function validateIdTokenAuthorizedParty(client, claims) {
+  if (Array.isArray(claims.aud) && claims.aud.length !== 1) {
+    if (claims.azp === undefined) {
+      throw OPE('ID Token "aud" (audience) claim includes additional untrusted audiences', JWT_CLAIM_COMPARISON, { claims, claim: "aud" });
+    }
+    if (claims.azp !== client.client_id) {
+      throw OPE('unexpected ID Token "azp" (authorized party) claim value', JWT_CLAIM_COMPARISON, {
+        expected: client.client_id,
+        claims,
+        claim: "azp"
+      });
+    }
+  }
+}
+var expectNoNonce = Symbol();
+var skipAuthTimeCheck = Symbol();
+async function processAuthorizationCodeResponse(as, client, response, options) {
+  if (typeof options?.expectedNonce === "string" || typeof options?.maxAge === "number" || options?.requireIdToken) {
+    return processAuthorizationCodeOpenIDResponse(as, client, response, options.expectedNonce, options.maxAge, options[jweDecrypt], options.recognizedTokenTypes);
+  }
+  return processAuthorizationCodeOAuth2Response(as, client, response, options?.maxAge, options?.[jweDecrypt], options?.recognizedTokenTypes);
+}
+async function processAuthorizationCodeOpenIDResponse(as, client, response, expectedNonce, maxAge, decryptFn, recognizedTokenTypes) {
+  const additionalRequiredClaims = [];
+  switch (expectedNonce) {
+    case undefined:
+      expectedNonce = expectNoNonce;
+      break;
+    case expectNoNonce:
+      break;
+    default:
+      assertString(expectedNonce, '"expectedNonce" argument');
+      additionalRequiredClaims.push("nonce");
+  }
+  maxAge = resolveIdTokenMaxAge(client, maxAge);
+  if (maxAge !== skipAuthTimeCheck) {
+    additionalRequiredClaims.push("auth_time");
+  }
+  const result = await processGenericAccessTokenResponse(as, client, response, additionalRequiredClaims, decryptFn, recognizedTokenTypes);
+  assertString(result.id_token, '"response" body "id_token" property', INVALID_RESPONSE, {
+    body: result
+  });
+  const claims = getValidatedIdTokenClaims(result);
+  validateIdTokenAuthTime(client, claims, maxAge);
+  validateIdTokenNonce(claims, expectedNonce);
+  return result;
+}
+async function processAuthorizationCodeOAuth2Response(as, client, response, maxAge, decryptFn, recognizedTokenTypes) {
+  const result = await processGenericAccessTokenResponse(as, client, response, undefined, decryptFn, recognizedTokenTypes);
+  const claims = getValidatedIdTokenClaims(result);
+  if (claims) {
+    validateIdTokenAuthTime(client, claims, resolveIdTokenMaxAge(client, maxAge));
+    validateIdTokenNonce(claims, expectNoNonce);
+  }
+  return result;
+}
+var WWW_AUTHENTICATE_CHALLENGE = "OAUTH_WWW_AUTHENTICATE_CHALLENGE";
+var RESPONSE_BODY_ERROR = "OAUTH_RESPONSE_BODY_ERROR";
+var UNSUPPORTED_OPERATION = "OAUTH_UNSUPPORTED_OPERATION";
+var AUTHORIZATION_RESPONSE_ERROR = "OAUTH_AUTHORIZATION_RESPONSE_ERROR";
+var PARSE_ERROR = "OAUTH_PARSE_ERROR";
+var INVALID_RESPONSE = "OAUTH_INVALID_RESPONSE";
+var RESPONSE_IS_NOT_JSON = "OAUTH_RESPONSE_IS_NOT_JSON";
+var RESPONSE_IS_NOT_CONFORM = "OAUTH_RESPONSE_IS_NOT_CONFORM";
+var HTTP_REQUEST_FORBIDDEN = "OAUTH_HTTP_REQUEST_FORBIDDEN";
+var REQUEST_PROTOCOL_FORBIDDEN = "OAUTH_REQUEST_PROTOCOL_FORBIDDEN";
+var JWT_TIMESTAMP_CHECK = "OAUTH_JWT_TIMESTAMP_CHECK_FAILED";
+var JWT_CLAIM_COMPARISON = "OAUTH_JWT_CLAIM_COMPARISON_FAILED";
+var JSON_ATTRIBUTE_COMPARISON = "OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED";
+var KEY_SELECTION = "OAUTH_KEY_SELECTION_FAILED";
+var MISSING_SERVER_METADATA = "OAUTH_MISSING_SERVER_METADATA";
+var INVALID_SERVER_METADATA = "OAUTH_INVALID_SERVER_METADATA";
+function assertReadableResponse(response) {
+  if (response.bodyUsed) {
+    throw CodedTypeError('"response" body has been used already', ERR_INVALID_ARG_VALUE);
+  }
+}
+async function jwksRequest(as, options) {
+  assertAs(as);
+  const url = resolveEndpoint(as, "jwks_uri", false, options?.[allowInsecureRequests] !== true);
+  const headers = prepareHeaders(options?.headers);
+  headers.set("accept", "application/json");
+  headers.append("accept", "application/jwk-set+json");
+  const requestHeaders = Object.fromEntries(headers.entries());
+  const headersKey = JSON.stringify(requestHeaders);
+  const fetcher = options?.[customFetch] || fetch;
+  const requestSignal = signal(url, options?.signal);
+  jwksRequests ||= new WeakMap;
+  const requests = jwksRequests.get(as) ?? new Set;
+  for (const pending of requests) {
+    if (pending.url === url.href && pending.headers === headersKey && pending.fetch === fetcher && pending.signal === requestSignal) {
+      return pending.promise;
+    }
+  }
+  const pending = {
+    url: url.href,
+    headers: headersKey,
+    fetch: fetcher,
+    signal: requestSignal,
+    promise: Promise.resolve().then(() => fetcher(url.href, {
+      body: undefined,
+      headers: requestHeaders,
+      method: "GET",
+      redirect: "manual",
+      signal: requestSignal
+    })).then(processJwksResponse).then((jwks) => {
+      const uat = epochTime();
+      setJwksCache(as, jwks, uat);
+      return { jwks, uat };
+    }).finally(() => {
+      requests.delete(pending);
+      if (!requests.size) {
+        jwksRequests.delete(as);
+      }
+    })
+  };
+  requests.add(pending);
+  jwksRequests.set(as, requests);
+  return pending.promise;
+}
+async function processJwksResponse(response) {
+  if (!looseInstanceOf(response, Response)) {
+    throw CodedTypeError('"response" must be an instance of Response', ERR_INVALID_ARG_TYPE);
+  }
+  if (response.status !== 200) {
+    throw OPE('"response" is not a conform JSON Web Key Set response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);
+  }
+  assertReadableResponse(response);
+  const json = await getResponseJsonBody(response, (response) => assertContentTypes(response, "application/json", "application/jwk-set+json"));
+  if (!Array.isArray(json.keys)) {
+    throw OPE('"response" body "keys" property must be an array', INVALID_RESPONSE, { body: json });
+  }
+  if (!Array.prototype.every.call(json.keys, isJsonObject)) {
+    throw OPE('"response" body "keys" property members must be JWK formatted objects', INVALID_RESPONSE, { body: json });
+  }
+  return json;
+}
+function supported(alg) {
+  switch (alg) {
+    case "PS256":
+    case "ES256":
+    case "RS256":
+    case "PS384":
+    case "ES384":
+    case "RS384":
+    case "PS512":
+    case "ES512":
+    case "RS512":
+    case "Ed25519":
+    case "EdDSA":
+    case "ML-DSA-44":
+    case "ML-DSA-65":
+    case "ML-DSA-87":
+      return true;
+    default:
+      return false;
+  }
+}
+function checkSupportedJwsAlg(header) {
+  if (!supported(header.alg)) {
+    throw new UnsupportedOperationError('unsupported JWS "alg" identifier', {
+      cause: { alg: header.alg }
+    });
+  }
+}
+function checkRsaKeyAlgorithm(key) {
+  const { algorithm } = key;
+  if (typeof algorithm.modulusLength !== "number" || algorithm.modulusLength < 2048) {
+    throw new UnsupportedOperationError(`unsupported ${algorithm.name} modulusLength`, {
+      cause: key
+    });
+  }
+}
+function ecdsaHashName(key) {
+  const { algorithm } = key;
+  switch (algorithm.namedCurve) {
+    case "P-256":
+      return "SHA-256";
+    case "P-384":
+      return "SHA-384";
+    case "P-521":
+      return "SHA-512";
+    default:
+      throw new UnsupportedOperationError("unsupported ECDSA namedCurve", { cause: key });
+  }
+}
+function keyToSubtle(key) {
+  switch (key.algorithm.name) {
+    case "ECDSA":
+      return {
+        name: key.algorithm.name,
+        hash: ecdsaHashName(key)
+      };
+    case "RSA-PSS": {
+      checkRsaKeyAlgorithm(key);
+      switch (key.algorithm.hash.name) {
+        case "SHA-256":
+        case "SHA-384":
+        case "SHA-512":
+          return {
+            name: key.algorithm.name,
+            saltLength: parseInt(key.algorithm.hash.name.slice(-3), 10) >> 3
+          };
+        default:
+          throw new UnsupportedOperationError("unsupported RSA-PSS hash name", { cause: key });
+      }
+    }
+    case "RSASSA-PKCS1-v1_5":
+      checkRsaKeyAlgorithm(key);
+      return key.algorithm.name;
+    case "ML-DSA-44":
+    case "ML-DSA-65":
+    case "ML-DSA-87":
+    case "Ed25519":
+      return key.algorithm.name;
+  }
+  throw new UnsupportedOperationError("unsupported CryptoKey algorithm name", { cause: key });
+}
+async function validateJwsSignature(protectedHeader, payload, key, signature) {
+  const data = buf(`${protectedHeader}.${payload}`);
+  const algorithm = keyToSubtle(key);
+  const verified = await crypto.subtle.verify(algorithm, key, signature, data);
+  if (!verified) {
+    throw OPE("JWT signature verification failed", INVALID_RESPONSE, {
+      key,
+      data,
+      signature,
+      algorithm
+    });
+  }
+}
+async function validateJwt(jws, checkAlg, clockSkew, clockTolerance, decryptJwt) {
+  let { 0: protectedHeader, 1: payload, length } = jws.split(".");
+  if (length === 5) {
+    if (decryptJwt !== undefined) {
+      jws = await decryptJwt(jws);
+      ({ 0: protectedHeader, 1: payload, length } = jws.split("."));
+    } else {
+      throw new UnsupportedOperationError("JWE decryption is not configured", { cause: jws });
+    }
+  }
+  if (length !== 3) {
+    throw OPE("Invalid JWT", INVALID_RESPONSE, jws);
+  }
+  let header;
+  try {
+    header = JSON.parse(buf(b64u(protectedHeader)));
+  } catch (cause) {
+    throw OPE("failed to parse JWT Header body as base64url encoded JSON", PARSE_ERROR, cause);
+  }
+  if (!isJsonObject(header)) {
+    throw OPE("JWT Header must be a top level object", INVALID_RESPONSE, jws);
+  }
+  checkAlg(header);
+  if (header.crit !== undefined) {
+    throw new UnsupportedOperationError('no JWT "crit" header parameter extensions are supported', {
+      cause: { header }
+    });
+  }
+  let claims;
+  try {
+    claims = JSON.parse(buf(b64u(payload)));
+  } catch (cause) {
+    throw OPE("failed to parse JWT Payload body as base64url encoded JSON", PARSE_ERROR, cause);
+  }
+  if (!isJsonObject(claims)) {
+    throw OPE("JWT Payload must be a top level object", INVALID_RESPONSE, jws);
+  }
+  const now = epochTime() + clockSkew;
+  if (claims.exp !== undefined) {
+    if (typeof claims.exp !== "number") {
+      throw OPE('unexpected JWT "exp" (expiration time) claim type', INVALID_RESPONSE, { claims });
+    }
+    if (claims.exp <= now - clockTolerance) {
+      throw OPE('unexpected JWT "exp" (expiration time) claim value, expiration is past current timestamp', JWT_TIMESTAMP_CHECK, { claims, now, tolerance: clockTolerance, claim: "exp" });
+    }
+  }
+  if (claims.iat !== undefined) {
+    if (typeof claims.iat !== "number") {
+      throw OPE('unexpected JWT "iat" (issued at) claim type', INVALID_RESPONSE, { claims });
+    }
+  }
+  if (claims.iss !== undefined) {
+    if (typeof claims.iss !== "string") {
+      throw OPE('unexpected JWT "iss" (issuer) claim type', INVALID_RESPONSE, { claims });
+    }
+  }
+  if (claims.nbf !== undefined) {
+    if (typeof claims.nbf !== "number") {
+      throw OPE('unexpected JWT "nbf" (not before) claim type', INVALID_RESPONSE, { claims });
+    }
+    if (claims.nbf > now + clockTolerance) {
+      throw OPE('unexpected JWT "nbf" (not before) claim value', JWT_TIMESTAMP_CHECK, {
+        claims,
+        now,
+        tolerance: clockTolerance,
+        claim: "nbf"
+      });
+    }
+  }
+  if (claims.aud !== undefined) {
+    if (typeof claims.aud !== "string" && !Array.isArray(claims.aud)) {
+      throw OPE('unexpected JWT "aud" (audience) claim type', INVALID_RESPONSE, { claims });
+    }
+  }
+  return { header, claims, jwt: jws };
+}
+async function consumeStream(request) {
+  if (request.bodyUsed) {
+    throw CodedTypeError("form_post Request instances must contain a readable body", ERR_INVALID_ARG_VALUE, { cause: request });
+  }
+  return request.text();
+}
+async function formPostResponse(request) {
+  if (request.method !== "POST") {
+    throw CodedTypeError("form_post responses are expected to use the POST method", ERR_INVALID_ARG_VALUE, { cause: request });
+  }
+  if (getContentType(request) !== "application/x-www-form-urlencoded") {
+    throw CodedTypeError("form_post responses are expected to use the application/x-www-form-urlencoded content-type", ERR_INVALID_ARG_VALUE, { cause: request });
+  }
+  return consumeStream(request);
+}
+function checkSigningAlgorithm(client, issuer, fallback, header) {
+  if (client !== undefined) {
+    if (typeof client === "string" ? header.alg !== client : !client.includes(header.alg)) {
+      throw OPE('unexpected JWT "alg" header parameter', INVALID_RESPONSE, {
+        header,
+        expected: client,
+        reason: "client configuration"
+      });
+    }
+    return;
+  }
+  if (Array.isArray(issuer)) {
+    if (!issuer.includes(header.alg)) {
+      throw OPE('unexpected JWT "alg" header parameter', INVALID_RESPONSE, {
+        header,
+        expected: issuer,
+        reason: "authorization server metadata"
+      });
+    }
+    return;
+  }
+  if (fallback !== undefined) {
+    if (typeof fallback === "string" ? header.alg !== fallback : typeof fallback === "function" ? !fallback(header.alg) : !fallback.includes(header.alg)) {
+      throw OPE('unexpected JWT "alg" header parameter', INVALID_RESPONSE, {
+        header,
+        expected: fallback,
+        reason: "default value"
+      });
+    }
+    return;
+  }
+  throw OPE('missing client or server configuration to verify used JWT "alg" header parameter', undefined, { client, issuer, fallback });
+}
+function getURLSearchParameter(parameters, name) {
+  const { 0: value, length } = parameters.getAll(name);
+  if (length > 1) {
+    throw OPE(`"${name}" parameter must be provided only once`, INVALID_RESPONSE);
+  }
+  return value;
+}
+var skipStateCheck = Symbol();
+var expectNoState = Symbol();
+function validateAuthResponse(as, client, parameters, expectedState) {
+  assertAs(as);
+  assertClient(client);
+  if (parameters instanceof URL) {
+    parameters = parameters.searchParams;
+  }
+  if (!(parameters instanceof URLSearchParams)) {
+    throw CodedTypeError('"parameters" must be an instance of URLSearchParams, or URL', ERR_INVALID_ARG_TYPE);
+  }
+  if (getURLSearchParameter(parameters, "response")) {
+    throw OPE('"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()', INVALID_RESPONSE, { parameters });
+  }
+  const iss = getURLSearchParameter(parameters, "iss");
+  const state = getURLSearchParameter(parameters, "state");
+  if (!iss && as.authorization_response_iss_parameter_supported) {
+    throw OPE('response parameter "iss" (issuer) missing', INVALID_RESPONSE, { parameters });
+  }
+  if (iss && iss !== as.issuer) {
+    throw OPE('unexpected "iss" (issuer) response parameter value', INVALID_RESPONSE, {
+      expected: as.issuer,
+      parameters
+    });
+  }
+  switch (expectedState) {
+    case undefined:
+    case expectNoState:
+      if (state !== undefined) {
+        throw OPE('unexpected "state" response parameter encountered', INVALID_RESPONSE, {
+          expected: undefined,
+          parameters
+        });
+      }
+      break;
+    case skipStateCheck:
+      break;
+    default:
+      assertString(expectedState, '"expectedState" argument');
+      if (state !== expectedState) {
+        throw OPE(state === undefined ? 'response parameter "state" missing' : 'unexpected "state" response parameter value', INVALID_RESPONSE, { expected: expectedState, parameters });
+      }
+  }
+  const error = getURLSearchParameter(parameters, "error");
+  if (error) {
+    throw new AuthorizationResponseError("authorization response from the server is an error", {
+      cause: parameters
+    });
+  }
+  const id_token = getURLSearchParameter(parameters, "id_token");
+  const token = getURLSearchParameter(parameters, "token");
+  if (id_token !== undefined || token !== undefined) {
+    throw new UnsupportedOperationError("implicit and hybrid flows are not supported");
+  }
+  return brand(new URLSearchParams(parameters));
+}
+function algToSubtle(alg) {
+  switch (alg) {
+    case "PS256":
+    case "PS384":
+    case "PS512":
+      return { name: "RSA-PSS", hash: `SHA-${alg.slice(-3)}` };
+    case "RS256":
+    case "RS384":
+    case "RS512":
+      return { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${alg.slice(-3)}` };
+    case "ES256":
+    case "ES384":
+      return { name: "ECDSA", namedCurve: `P-${alg.slice(-3)}` };
+    case "ES512":
+      return { name: "ECDSA", namedCurve: "P-521" };
+    case "EdDSA":
+      return "Ed25519";
+    case "Ed25519":
+    case "ML-DSA-44":
+    case "ML-DSA-65":
+    case "ML-DSA-87":
+      return alg;
+    default:
+      throw new UnsupportedOperationError("unsupported JWS algorithm", { cause: { alg } });
+  }
+}
+async function importJwk(alg, jwk) {
+  const { ext, key_ops, use, ...key } = jwk;
+  return crypto.subtle.importKey("jwk", key, algToSubtle(alg), true, ["verify"]);
+}
+async function getResponseJsonBody(response, check = assertApplicationJson) {
+  let json;
+  try {
+    json = await response.json();
+  } catch (cause) {
+    check(response);
+    throw OPE('failed to parse "response" body as JSON', PARSE_ERROR, cause);
+  }
+  if (!isJsonObject(json)) {
+    throw OPE('"response" body must be a top level object', INVALID_RESPONSE, { body: json });
+  }
+  return json;
+}
+var _nodiscoverycheck = Symbol();
+var _expectedIssuer = Symbol();
+
+// node_modules/openid-client/build/index.js
+var headers;
+var USER_AGENT2;
+if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
+  const NAME = "openid-client";
+  const VERSION = "v6.8.4";
+  USER_AGENT2 = `${NAME}/${VERSION}`;
+  headers = { "user-agent": USER_AGENT2 };
+}
+var int = (config) => {
+  return props.get(config);
+};
+var props;
+var tbi;
+function ClientSecretPost2(clientSecret) {
+  if (clientSecret !== undefined) {
+    return ClientSecretPost(clientSecret);
+  }
+  tbi ||= new WeakMap;
+  return (as, client, body, headers) => {
+    let auth;
+    if (!(auth = tbi.get(client))) {
+      assertString2(client.client_secret, '"metadata.client_secret"');
+      auth = ClientSecretPost(client.client_secret);
+      tbi.set(client, auth);
+    }
+    return auth(as, client, body, headers);
+  };
+}
+function assertString2(input, it) {
+  if (typeof input !== "string") {
+    throw CodedTypeError2(`${it} must be a string`, ERR_INVALID_ARG_TYPE2);
+  }
+  if (input.length === 0) {
+    throw CodedTypeError2(`${it} must not be empty`, ERR_INVALID_ARG_VALUE2);
+  }
+}
+function ClientSecretBasic2(clientSecret) {
+  if (clientSecret !== undefined) {
+    return ClientSecretBasic(clientSecret);
+  }
+  tbi ||= new WeakMap;
+  return (as, client, body, headers) => {
+    let auth;
+    if (!(auth = tbi.get(client))) {
+      assertString2(client.client_secret, '"metadata.client_secret"');
+      auth = ClientSecretBasic(client.client_secret);
+      tbi.set(client, auth);
+    }
+    return auth(as, client, body, headers);
+  };
+}
+function None2() {
+  return None();
+}
+var customFetch2 = customFetch;
+var ERR_INVALID_ARG_VALUE2 = "ERR_INVALID_ARG_VALUE";
+var ERR_INVALID_ARG_TYPE2 = "ERR_INVALID_ARG_TYPE";
+function CodedTypeError2(message, code, cause) {
+  const err = new TypeError(message, { cause });
+  Object.assign(err, { code });
+  return err;
+}
+function calculatePKCECodeChallenge2(codeVerifier) {
+  return calculatePKCECodeChallenge(codeVerifier);
+}
+function randomPKCECodeVerifier() {
+  return generateRandomCodeVerifier();
+}
+function randomNonce() {
+  return generateRandomNonce();
+}
+function randomState() {
+  return generateRandomState();
+}
+
+class ClientError extends Error {
+  code;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    this.code = options?.code;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+var decoder2 = new TextDecoder;
+function e(msg, cause, code) {
+  return new ClientError(msg, { cause, code });
+}
+function errorHandler(err) {
+  if (err instanceof TypeError || err instanceof ClientError || err instanceof ResponseBodyError || err instanceof AuthorizationResponseError || err instanceof WWWAuthenticateChallengeError) {
+    throw err;
+  }
+  if (err instanceof OperationProcessingError) {
+    switch (err.code) {
+      case HTTP_REQUEST_FORBIDDEN:
+        throw e("only requests to HTTPS are allowed", err, err.code);
+      case REQUEST_PROTOCOL_FORBIDDEN:
+        throw e("only requests to HTTP or HTTPS are allowed", err, err.code);
+      case RESPONSE_IS_NOT_CONFORM:
+        throw e("unexpected HTTP response status code", err.cause, err.code);
+      case RESPONSE_IS_NOT_JSON:
+        throw e("unexpected response content-type", err.cause, err.code);
+      case PARSE_ERROR:
+        throw e("parsing error occured", err, err.code);
+      case INVALID_RESPONSE:
+        throw e("invalid response encountered", err, err.code);
+      case JWT_CLAIM_COMPARISON:
+        throw e("unexpected JWT claim value encountered", err, err.code);
+      case JSON_ATTRIBUTE_COMPARISON:
+        throw e("unexpected JSON attribute value encountered", err, err.code);
+      case JWT_TIMESTAMP_CHECK:
+        throw e("JWT timestamp claim value failed validation", err, err.code);
+      default:
+        throw e(err.message, err, err.code);
+    }
+  }
+  if (err instanceof UnsupportedOperationError) {
+    throw e("unsupported operation", err, err.code);
+  }
+  if (err instanceof DOMException) {
+    switch (err.name) {
+      case "OperationError":
+        throw e("runtime operation error", err, UNSUPPORTED_OPERATION);
+      case "NotSupportedError":
+        throw e("runtime unsupported operation", err, UNSUPPORTED_OPERATION);
+      case "TimeoutError":
+        throw e("operation timed out", err, "OAUTH_TIMEOUT");
+      case "AbortError":
+        throw e("operation aborted", err, "OAUTH_ABORT");
+    }
+  }
+  throw new ClientError("something went wrong", { cause: err });
+}
+function handleEntraId(server, as, options) {
+  if (server.origin === "https://login.microsoftonline.com" && (!options?.algorithm || options.algorithm === "oidc")) {
+    as[kEntraId] = true;
+    return true;
+  }
+  return false;
+}
+function handleB2Clogin(server, options) {
+  if (server.hostname.endsWith(".b2clogin.com") && (!options?.algorithm || options.algorithm === "oidc")) {
+    return true;
+  }
+  return false;
+}
+async function discovery(server, clientId, metadata, clientAuthentication, options) {
+  const as = await performDiscovery2(server, options);
+  const instance = new Configuration(as, clientId, metadata, clientAuthentication);
+  let internals = int(instance);
+  if (options?.[customFetch2]) {
+    internals.fetch = options[customFetch2];
+  }
+  if (options?.timeout) {
+    internals.timeout = options.timeout;
+  }
+  if (options?.execute) {
+    for (const extension of options.execute) {
+      extension(instance);
+    }
+  }
+  return instance;
+}
+async function performDiscovery2(server, options) {
+  if (!(server instanceof URL)) {
+    throw CodedTypeError2('"server" must be an instance of URL', ERR_INVALID_ARG_TYPE2);
+  }
+  const resolve = !server.href.includes("/.well-known/");
+  const timeout = options?.timeout ?? 30;
+  const signal = AbortSignal.timeout(timeout * 1000);
+  const as = await (resolve ? discoveryRequest(server, {
+    algorithm: options?.algorithm,
+    [customFetch]: options?.[customFetch2],
+    [allowInsecureRequests]: options?.execute?.includes(allowInsecureRequests2),
+    signal,
+    headers: new Headers(headers)
+  }) : (options?.[customFetch2] || fetch)((() => {
+    checkProtocol(server, options?.execute?.includes(allowInsecureRequests2) ? false : true);
+    return server.href;
+  })(), {
+    headers: Object.fromEntries(new Headers({ accept: "application/json", ...headers }).entries()),
+    body: undefined,
+    method: "GET",
+    redirect: "manual",
+    signal
+  })).then((response) => processDiscoveryResponse(_nodiscoverycheck, response)).catch(errorHandler);
+  if (resolve && new URL(as.issuer).href !== server.href) {
+    handleEntraId(server, as, options) || handleB2Clogin(server, options) || (() => {
+      throw new ClientError("discovered metadata issuer does not match the expected issuer", {
+        code: JSON_ATTRIBUTE_COMPARISON,
+        cause: {
+          expected: server.href,
+          body: as,
+          attribute: "issuer"
+        }
+      });
+    })();
+  }
+  return as;
+}
+function getServerHelpers(metadata) {
+  return {
+    supportsPKCE: {
+      __proto__: null,
+      value(method = "S256") {
+        return metadata.code_challenge_methods_supported?.includes(method) === true;
+      }
+    }
+  };
+}
+function addServerHelpers(metadata) {
+  Object.defineProperties(metadata, getServerHelpers(metadata));
+}
+var kEntraId = Symbol();
+
+class Configuration {
+  constructor(server, clientId, metadata, clientAuthentication) {
+    if (typeof clientId !== "string" || !clientId.length) {
+      throw CodedTypeError2('"clientId" must be a non-empty string', ERR_INVALID_ARG_TYPE2);
+    }
+    if (typeof metadata === "string") {
+      metadata = { client_secret: metadata };
+    }
+    if (metadata?.client_id !== undefined && clientId !== metadata.client_id) {
+      throw CodedTypeError2('"clientId" and "metadata.client_id" must be the same', ERR_INVALID_ARG_VALUE2);
+    }
+    const client = {
+      ...structuredClone(metadata),
+      client_id: clientId
+    };
+    client[clockSkew] = metadata?.[clockSkew] ?? 0;
+    client[clockTolerance] = metadata?.[clockTolerance] ?? 30;
+    let auth;
+    if (clientAuthentication) {
+      auth = clientAuthentication;
+    } else {
+      if (typeof client.client_secret === "string" && client.client_secret.length) {
+        auth = ClientSecretPost2(client.client_secret);
+      } else {
+        auth = None2();
+      }
+    }
+    let c = Object.freeze(client);
+    const clone = structuredClone(server);
+    if (kEntraId in server) {
+      clone[_expectedIssuer] = ({ claims: { tid } }) => server.issuer.replace("{tenantid}", tid);
+    }
+    let as = Object.freeze(clone);
+    props ||= new WeakMap;
+    props.set(this, {
+      __proto__: null,
+      as,
+      c,
+      auth,
+      tlsOnly: true,
+      jwksCache: {}
+    });
+  }
+  serverMetadata() {
+    const metadata = structuredClone(int(this).as);
+    addServerHelpers(metadata);
+    return metadata;
+  }
+  clientMetadata() {
+    const metadata = structuredClone(int(this).c);
+    return metadata;
+  }
+  get timeout() {
+    return int(this).timeout;
+  }
+  set timeout(value) {
+    int(this).timeout = value;
+  }
+  get [customFetch2]() {
+    return int(this).fetch;
+  }
+  set [customFetch2](value) {
+    int(this).fetch = value;
+  }
+}
+Object.freeze(Configuration.prototype);
+function getHelpers(response) {
+  let exp = undefined;
+  if (response.expires_in !== undefined) {
+    const now = new Date;
+    now.setSeconds(now.getSeconds() + response.expires_in);
+    exp = now.getTime();
+  }
+  return {
+    expiresIn: {
+      __proto__: null,
+      value() {
+        if (exp) {
+          const now = Date.now();
+          if (exp > now) {
+            return Math.floor((exp - now) / 1000);
+          }
+          return 0;
+        }
+        return;
+      }
+    },
+    claims: {
+      __proto__: null,
+      value() {
+        try {
+          return getValidatedIdTokenClaims(this);
+        } catch {
+          return;
+        }
+      }
+    }
+  };
+}
+function addHelpers(response) {
+  Object.defineProperties(response, getHelpers(response));
+}
+function allowInsecureRequests2(config) {
+  int(config).tlsOnly = false;
+}
+function enableNonRepudiationChecks(config) {
+  checkConfig(config);
+  int(config).nonRepudiation = (response) => {
+    const { as, fetch: fetch2, tlsOnly, timeout, jwksCache: jwksCache2 } = int(config);
+    return validateApplicationLevelSignature(as, response, {
+      [customFetch]: fetch2,
+      [allowInsecureRequests]: !tlsOnly,
+      headers: new Headers(headers),
+      signal: signal2(timeout),
+      [jwksCache]: jwksCache2
+    }).catch(errorHandler);
+  };
+}
+function stripParams(url) {
+  url = new URL(url);
+  url.search = "";
+  url.hash = "";
+  return url.href;
+}
+function webInstanceOf(input, toStringTag) {
+  try {
+    return Object.getPrototypeOf(input)[Symbol.toStringTag] === toStringTag;
+  } catch {
+    return false;
+  }
+}
+async function authorizationCodeGrant(config, currentUrl, checks, tokenEndpointParameters, options) {
+  checkConfig(config);
+  if (options?.flag !== retry && !(currentUrl instanceof URL) && !webInstanceOf(currentUrl, "Request")) {
+    throw CodedTypeError2('"currentUrl" must be an instance of URL, or Request', ERR_INVALID_ARG_TYPE2);
+  }
+  let authResponse;
+  let redirectUri;
+  const { as, c, auth, fetch: fetch2, tlsOnly, jarm, hybrid, nonRepudiation, timeout, decrypt, implicit } = int(config);
+  if (options?.flag === retry) {
+    authResponse = options.authResponse;
+    redirectUri = options.redirectUri;
+  } else {
+    if (!(currentUrl instanceof URL)) {
+      const request = currentUrl;
+      currentUrl = new URL(currentUrl.url);
+      switch (request.method) {
+        case "GET":
+          break;
+        case "POST":
+          const params = new URLSearchParams(await formPostResponse(request));
+          if (hybrid) {
+            currentUrl.hash = params.toString();
+          } else {
+            for (const [k, v] of params.entries()) {
+              currentUrl.searchParams.append(k, v);
+            }
+          }
+          break;
+        default:
+          throw CodedTypeError2("unexpected Request HTTP method", ERR_INVALID_ARG_VALUE2);
+      }
+    }
+    redirectUri = stripParams(currentUrl);
+    switch (true) {
+      case !!jarm:
+        authResponse = await jarm(currentUrl, checks?.expectedState);
+        break;
+      case !!hybrid:
+        authResponse = await hybrid(currentUrl, checks?.expectedNonce, checks?.expectedState, checks?.maxAge);
+        break;
+      case !!implicit:
+        throw new TypeError("authorizationCodeGrant() cannot be used by response_type=id_token clients");
+      default:
+        try {
+          authResponse = validateAuthResponse(as, c, currentUrl.searchParams, checks?.expectedState);
+        } catch (err) {
+          errorHandler(err);
+        }
+    }
+  }
+  const response = await authorizationCodeGrantRequest(as, c, auth, authResponse, redirectUri, checks?.pkceCodeVerifier || nopkce, {
+    additionalParameters: tokenEndpointParameters,
+    [customFetch]: fetch2,
+    [allowInsecureRequests]: !tlsOnly,
+    DPoP: options?.DPoP,
+    headers: new Headers(headers),
+    signal: signal2(timeout)
+  }).catch(errorHandler);
+  if (typeof checks?.expectedNonce === "string" || typeof checks?.maxAge === "number") {
+    checks.idTokenExpected = true;
+  }
+  const p = processAuthorizationCodeResponse(as, c, response, {
+    expectedNonce: checks?.expectedNonce,
+    maxAge: checks?.maxAge,
+    requireIdToken: checks?.idTokenExpected,
+    [jweDecrypt]: decrypt
+  });
+  let result;
+  try {
+    result = await p;
+  } catch (err) {
+    if (retryable(err, options)) {
+      return authorizationCodeGrant(config, undefined, checks, tokenEndpointParameters, {
+        ...options,
+        flag: retry,
+        authResponse,
+        redirectUri
+      });
+    }
+    errorHandler(err);
+  }
+  result.id_token && await nonRepudiation?.(response);
+  addHelpers(result);
+  return result;
+}
+function buildAuthorizationUrl(config, parameters) {
+  checkConfig(config);
+  const { as, c, tlsOnly, hybrid, jarm, implicit } = int(config);
+  const authorizationEndpoint = resolveEndpoint(as, "authorization_endpoint", false, tlsOnly);
+  parameters = new URLSearchParams(parameters);
+  if (!parameters.has("client_id")) {
+    parameters.set("client_id", c.client_id);
+  }
+  if (!parameters.has("request_uri") && !parameters.has("request")) {
+    if (!parameters.has("response_type")) {
+      parameters.set("response_type", hybrid ? "code id_token" : implicit ? "id_token" : "code");
+    }
+    if (implicit && !parameters.has("nonce")) {
+      throw CodedTypeError2("response_type=id_token clients must provide a nonce parameter in their authorization request parameters", ERR_INVALID_ARG_VALUE2);
+    }
+    if (jarm) {
+      parameters.set("response_mode", "jwt");
+    }
+  }
+  for (const [k, v] of parameters.entries()) {
+    authorizationEndpoint.searchParams.append(k, v);
+  }
+  return authorizationEndpoint;
+}
+function checkConfig(input) {
+  if (!(input instanceof Configuration)) {
+    throw CodedTypeError2('"config" must be an instance of Configuration', ERR_INVALID_ARG_TYPE2);
+  }
+  if (Object.getPrototypeOf(input) !== Configuration.prototype) {
+    throw CodedTypeError2("subclassing Configuration is not allowed", ERR_INVALID_ARG_VALUE2);
+  }
+}
+function signal2(timeout) {
+  return timeout ? AbortSignal.timeout(timeout * 1000) : undefined;
+}
+function retryable(err, options) {
+  if (options?.DPoP && options.flag !== retry) {
+    return isDPoPNonceError(err);
+  }
+  return false;
+}
+var retry = Symbol();
+async function fetchProtectedResource(config, accessToken, url, method, body, headers, options) {
+  checkConfig(config);
+  headers ||= new Headers;
+  if (!headers.has("user-agent")) {
+    headers.set("user-agent", USER_AGENT2);
+  }
+  const { fetch: fetch2, tlsOnly, timeout } = int(config);
+  const exec = protectedResourceRequest(accessToken, method, url, headers, body, {
+    [customFetch]: fetch2,
+    [allowInsecureRequests]: !tlsOnly,
+    DPoP: options?.DPoP,
+    signal: signal2(timeout)
+  });
+  let result;
+  try {
+    result = await exec;
+  } catch (err) {
+    if (retryable(err, options)) {
+      return fetchProtectedResource(config, accessToken, url, method, body, headers, {
+        ...options,
+        flag: retry
+      });
+    }
+    errorHandler(err);
+  }
+  return result;
+}
+
+// plugins/user-auth/server/control.ts
+import { isDeepStrictEqual } from "util";
+
+// plugins/user-auth/server/errors.ts
+class AccountError extends Error {
+  code;
+  status;
+  constructor(code, status = 400) {
+    super(code);
+    this.code = code;
+    this.status = status;
+  }
+}
+function fail(code, status = 400) {
+  throw new AccountError(code, status);
+}
+
+// plugins/user-auth/server/control.ts
+import { createHash, createHmac, randomBytes as randomBytes2, randomUUID, timingSafeEqual } from "crypto";
+
+// packages/core/src/plugin-logger.ts
+var sinkKey = Symbol.for("@jeffusion/bungee/plugin-log-sink");
+function createLogger(bindings = {}) {
+  const method = (level) => (value, message) => {
+    const sink = globalThis[sinkKey];
+    if (sink) {
+      if (typeof value === "string")
+        sink[level](bindings, value);
+      else
+        sink[level]({ ...bindings, ...value }, message);
+    } else if (level !== "debug" || process.env.LOG_LEVEL === "debug") {
+      const write = level === "fatal" ? console.error : console[level];
+      write(message ?? (typeof value === "string" ? value : ""), typeof value === "string" ? bindings : { ...bindings, ...value });
+    }
+  };
+  return {
+    info: method("info"),
+    warn: method("warn"),
+    error: method("error"),
+    debug: method("debug"),
+    fatal: method("fatal"),
+    child: (extra) => createLogger({ ...bindings, ...extra })
+  };
+}
+var logger = createLogger();
+
+// packages/core/src/hooks/impl.ts
+var WATERFALL_VIEW_TRANSFORM = Symbol("waterfall-view-transform");
+// packages/core/src/plugin-extensions.ts
+var ANONYMOUS_PRINCIPAL = Object.freeze({ domain: "anonymous", keyId: "", credentialVersion: 0 });
+// packages/core/src/plugin-durable-state.ts
+function isDurableStateConflictError(error) {
+  return error instanceof Error && "code" in error && error.code === "durable_state_conflict";
+}
+var MAX_BYTES = 1024 * 1024;
+// packages/core/src/plugin-services/host-rpc.ts
+import { AsyncLocalStorage } from "async_hooks";
+
+// packages/core/src/plugin-services/wire-contract.ts
+var RPC_JSON_MAX_BYTES = 64 * 1024;
+var RPC_CONTRACT_MAX_BYTES = 256 * 1024;
+var RPC_CALL_PURPOSES = new Set(["bootstrap", "background", "management", "request", "attempt"]);
+var RPC_COMMAND_DEDUPLICATION = new Set(["local-transaction", "external-contract", "none"]);
+var RPC_COMMAND_POLICY_KEYS = new Set(["deduplication", "resultRetentionMs", "quotaBytes", "maxResultBytes"]);
+
+// packages/core/src/plugin-services/rpc-runtime.ts
+var PROCESSES = new Set(["control", "worker", "ingress"]);
+var SCOPES = new Set(["global", "binding"]);
+var PURPOSES = new Set(["bootstrap", "background", "management", "request", "attempt"]);
+var ENDPOINTS = new WeakMap;
+var REVOKED = new WeakMap;
+
+// packages/core/src/plugin-services/host-rpc.ts
+var SERVICE_ERROR_MESSAGES = {
+  unauthorized: "RPC call is not authorized",
+  not_ready: "RPC endpoint is not ready",
+  retired: "RPC endpoint is retiring",
+  revoked: "RPC endpoint generation was revoked",
+  unsupported_method: "RPC method is not published",
+  wrong_purpose: "RPC method is not published for this purpose",
+  invalid_input: "RPC input is not valid",
+  invalid_output: "RPC output is not valid",
+  invalid_operation_id: "RPC command operation id is invalid",
+  overloaded: "RPC runtime is at capacity",
+  cancelled: "RPC call was cancelled",
+  timeout: "RPC call deadline exceeded",
+  unknown: "RPC command outcome is unknown",
+  capability_unavailable: "RPC command execution is unavailable",
+  closed: "RPC runtime is closed",
+  failed: "RPC call failed",
+  conflict: "RPC command identity conflicts with an existing record",
+  expired: "RPC command result has expired",
+  pending: "RPC command is still pending",
+  rejected: "RPC command was rejected",
+  missing: "RPC command has no stored result",
+  storage_failure: "RPC command storage failed",
+  deadlock: "RPC call chain would deadlock",
+  call_depth_exceeded: "RPC call depth exceeded",
+  undeclared: "RPC service is not declared by the manifest",
+  unavailable: "RPC service is unavailable",
+  ambiguous_placement: "RPC service placement is ambiguous",
+  invalid_registration: "RPC registration is invalid"
+};
+var SERVICE_ERROR_CODES = new Set(Object.keys(SERVICE_ERROR_MESSAGES));
+var EMPTY_OPTIONS = Object.freeze({});
+var FRAME_STORE = new AsyncLocalStorage;
+var CALLEE_INFO = new WeakMap;
+// packages/core/src/plugin-services/peer-channel-protocol.ts
+var CHANNEL_REQUEST_MAX_BYTES = 4 * 1024;
+var CHANNEL_RESULT_MAX_BYTES = 60 * 1024;
+var CHANNEL_MAX_CHUNK_BYTES = 60 * 1024;
+var PLUGIN_CHANNEL_LANES = Object.freeze(["event", "snapshot", "stream"]);
+var ERROR_CODES = new Set([
+  "unavailable",
+  "ambiguous",
+  "unauthorized",
+  "invalid",
+  "overloaded",
+  "expired",
+  "conflict",
+  "gap",
+  "truncated",
+  "rejected",
+  "cancelled",
+  "closed",
+  "unknown",
+  "failed"
+]);
+var RPC_CALL_PURPOSES2 = new Set(["bootstrap", "background", "management", "request", "attempt"]);
+
+// packages/core/src/plugin-services/peer-channel-hub.ts
+var CHANNEL_MAX_TRANSFER_BUFFER_BYTES = 4 * CHANNEL_MAX_CHUNK_BYTES;
+var CHANNEL_MAX_TOTAL_BUFFER_BYTES = 16 * CHANNEL_MAX_CHUNK_BYTES;
+var CHANNEL_STREAM_MAX_TOTAL_BYTES = 64 * 1024 * 1024;
+var CHANNEL_STREAM_MAX_CREDIT_BYTES = 8 * CHANNEL_MAX_CHUNK_BYTES;
+var CHANNEL_STREAM_DEFAULT_CREDIT_BYTES = 4 * CHANNEL_MAX_CHUNK_BYTES;
+var CHANNEL_SNAPSHOT_MAX_BYTES = 64 * 1024 * 1024;
+var CHANNEL_EVENT_MAX_PAYLOAD_BYTES = 60 * 1024;
+var EMPTY = new Uint8Array(0);
+var HANDLE_REGISTRATIONS = new WeakMap;
+
+// packages/core/src/plugin-services/snapshot-store.ts
+var DEFAULT_CHUNK_BYTES = 60 * 1024;
+var SNAPSHOT_FAMILY_REFS = new Map;
+
+// packages/core/src/plugin-services.ts
+var CHANNEL_KINDS = new Set(["events", "snapshot", "stream"]);
+// packages/core/src/gateway/retry-action.ts
+var retryActionBrand = Symbol.for("@jeffusion/bungee/request-retry-action");
+// packages/core/src/token-stats-window.ts
+var HOUR = 3600000;
+var TOKEN_STATS_RETENTION_MS = 31 * 24 * HOUR;
+// plugins/user-auth/server/control.ts
+var GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var MICROSOFT = "https://login.microsoftonline.com/";
+var CONSUMERS = "9188040d-6c67-4c5b-b112-36a304b66dad";
+var ISSUER_TEMPLATE = MICROSOFT + "{tenantid}/v2.0";
+var LIMIT = 1024 * 1024;
+function providerFields(value, fields) {
+  if (Object.keys(value).some((key) => !fields.includes(key)))
+    fail("invalid_input");
+}
+function providerRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    fail("invalid_input");
+  return value;
+}
+function providerUrl(value) {
+  let url;
+  try {
+    if (typeof value !== "string" || !value || value.length > 2048)
+      fail("invalid_oidc_url");
+    url = new URL(value);
+  } catch {
+    return fail("invalid_oidc_url");
+  }
+  if (url.username || url.password || url.hash || typeof value === "string" && (value.includes("#") || /^https?:\/\/[^/?#]*@/i.test(value)) || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+    fail("invalid_oidc_url");
+  return url;
+}
+function parseProvider(provider, input, scopesInput) {
+  if (!["google", "microsoft", "github", "oidc"].includes(provider))
+    fail("invalid_provider");
+  const p = provider, c = providerRecord(input);
+  let issuer, configuration;
+  if (p === "google" || p === "github") {
+    providerFields(c, []);
+    issuer = p === "google" ? "https://accounts.google.com" : "https://github.com";
+    configuration = {};
+  } else if (p === "microsoft") {
+    providerFields(c, ["accountType", "tenantId"]);
+    if (!["tenant", "organizations", "consumers", "common"].includes(c.accountType))
+      fail("invalid_microsoft_configuration");
+    if (c.accountType === "tenant" ? typeof c.tenantId !== "string" || !GUID.test(c.tenantId) : Object.hasOwn(c, "tenantId"))
+      fail("invalid_microsoft_configuration");
+    configuration = { accountType: c.accountType, ...c.accountType === "tenant" ? { tenantId: c.tenantId.toLowerCase() } : {} };
+    issuer = MICROSOFT + (configuration.tenantId ?? configuration.accountType) + "/v2.0";
+  } else {
+    if (!["issuer", "discovery", "manual"].includes(c.mode))
+      fail("invalid_oidc_configuration");
+    const fields = c.mode === "issuer" ? ["mode", "issuer"] : c.mode === "discovery" ? ["mode", "issuer", "discoveryUrl"] : ["mode", "issuer", "authorizationEndpoint", "tokenEndpoint", "jwksUri", "tokenEndpointAuthMethod", "idTokenSigningAlg"];
+    providerFields(c, fields);
+    providerUrl(c.issuer);
+    issuer = c.issuer;
+    if (new URL(issuer).search)
+      fail("invalid_oidc_url");
+    if (c.mode === "discovery")
+      providerUrl(c.discoveryUrl);
+    if (c.mode === "manual") {
+      for (const field of ["authorizationEndpoint", "tokenEndpoint", "jwksUri"])
+        providerUrl(c[field]);
+      if (c.tokenEndpointAuthMethod !== undefined && !["client_secret_basic", "client_secret_post"].includes(c.tokenEndpointAuthMethod))
+        fail("oidc_auth_method_unsupported");
+      if (c.idTokenSigningAlg !== undefined && !["RS256", "PS256", "ES256"].includes(c.idTokenSigningAlg))
+        fail("oidc_signing_alg_unsupported");
+    }
+    configuration = { ...c };
+  }
+  if (p !== "oidc" && scopesInput !== undefined)
+    fail("preset_scopes_fixed");
+  const scopes = p === "github" ? ["read:user"] : scopesInput ?? ["openid", "profile", "email"];
+  if (!Array.isArray(scopes) || !scopes.length || scopes.length > 16 || scopes.some((s) => typeof s !== "string" || !s || s.length > 128 || /\s/.test(s)) || p !== "github" && !scopes.includes("openid"))
+    fail("invalid_input");
+  return { provider: p, issuer, configuration, scopes };
+}
+async function boundedResponse(response) {
+  if (!response.body)
+    return response;
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    for (;; ) {
+      const chunk = await reader.read();
+      if (chunk.done)
+        break;
+      size += chunk.value.length;
+      if (size > LIMIT) {
+        await reader.cancel();
+        fail("oidc_metadata_limit");
+      }
+      chunks.push(chunk.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const headers = new Headers(response.headers);
+  headers.delete("content-encoding");
+  headers.delete("content-length");
+  return new Response(Buffer.concat(chunks), { status: response.status, statusText: response.statusText, headers });
+}
+async function limitedJson(response) {
+  if (!response.ok)
+    fail("oidc_metadata_failed", 502);
+  const reader = response.body?.getReader();
+  if (!reader)
+    fail("oidc_metadata_invalid");
+  let size = 0;
+  const chunks = [];
+  try {
+    for (;; ) {
+      const r = await reader.read();
+      if (r.done)
+        break;
+      size += r.value.length;
+      if (size > LIMIT) {
+        await reader.cancel();
+        fail("oidc_metadata_limit");
+      }
+      chunks.push(r.value);
+    }
+  } catch (error) {
+    if (error instanceof AccountError)
+      throw error;
+    fail("oidc_network_failed", 502);
+  } finally {
+    reader.releaseLock();
+  }
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    return fail("oidc_metadata_invalid");
+  }
+}
+function discoveryUrl(issuer) {
+  const url = providerUrl(issuer);
+  url.pathname = url.pathname.replace(/\/$/, "") + "/.well-known/openid-configuration";
+  return url.href;
+}
+function metadataCheck(value, expected) {
+  const m = providerRecord(value);
+  if (typeof m.issuer !== "string")
+    fail("oidc_metadata_invalid");
+  if (providerUrl(m.issuer).search)
+    fail("invalid_oidc_url");
+  if (expected !== undefined && m.issuer !== expected)
+    fail("oidc_issuer_mismatch");
+  for (const key of ["authorization_endpoint", "token_endpoint", "jwks_uri"])
+    providerUrl(m[key]);
+  for (const key of ["token_endpoint_auth_methods_supported", "id_token_signing_alg_values_supported"])
+    if (m[key] !== undefined && (!Array.isArray(m[key]) || m[key].some((v) => typeof v !== "string")))
+      fail("oidc_metadata_invalid");
+  const methods = m.token_endpoint_auth_methods_supported;
+  if (methods && !methods.some((m) => ["client_secret_basic", "client_secret_post"].includes(m)))
+    fail("oidc_auth_method_unsupported");
+  const algs = m.id_token_signing_alg_values_supported;
+  if (!algs?.some((a) => ["RS256", "PS256", "ES256"].includes(a)))
+    fail("oidc_signing_alg_unsupported");
+  if (m.code_challenge_methods_supported !== undefined && (!Array.isArray(m.code_challenge_methods_supported) || !m.code_challenge_methods_supported.includes("S256")))
+    fail("oidc_pkce_unsupported");
+  return m;
+}
+
+class LoginProviders {
+  fetcher;
+  signal;
+  constructor(fetcher, signal) {
+    this.fetcher = fetcher;
+    this.signal = signal;
+  }
+  async network(input, init = {}) {
+    providerUrl(input instanceof Request ? input.url : String(input));
+    try {
+      return await boundedResponse(await this.fetcher(input, { ...init, redirect: "error", signal: AbortSignal.any([this.signal, AbortSignal.timeout(5000), ...init.signal ? [init.signal] : []]) }));
+    } catch (error) {
+      if (error instanceof AccountError)
+        throw error;
+      fail("oidc_network_failed", 502);
+    }
+  }
+  async discover(mode, value) {
+    if (mode !== "issuer" && mode !== "discovery")
+      fail("invalid_input");
+    const url = providerUrl(value);
+    if (mode === "issuer" && url.search)
+      fail("invalid_oidc_url");
+    const endpoint = mode === "issuer" ? discoveryUrl(value) : url.href;
+    const m = metadataCheck(await limitedJson(await this.network(endpoint)), mode === "issuer" ? value : undefined);
+    return { issuer: m.issuer, discoveryUrl: endpoint, authorizationEndpoint: m.authorization_endpoint, tokenEndpoint: m.token_endpoint, jwksUri: m.jwks_uri, tokenEndpointAuthMethods: m.token_endpoint_auth_methods_supported ?? ["client_secret_basic"], idTokenSigningAlgs: m.id_token_signing_alg_values_supported };
+  }
+  async metadata(c) {
+    if (c.provider === "github")
+      return { issuer: "https://github.com/login/oauth", authorization_response_iss_parameter_supported: true, authorization_endpoint: "https://github.com/login/oauth/authorize", token_endpoint: "https://github.com/login/oauth/access_token", token_endpoint_auth_methods_supported: ["client_secret_post"] };
+    const configuration = c.configuration;
+    if (c.provider === "oidc" && configuration.mode === "manual")
+      return metadataCheck({ issuer: c.issuer, authorization_endpoint: configuration.authorizationEndpoint, token_endpoint: configuration.tokenEndpoint, jwks_uri: configuration.jwksUri, token_endpoint_auth_methods_supported: [configuration.tokenEndpointAuthMethod ?? "client_secret_basic"], id_token_signing_alg_values_supported: [configuration.idTokenSigningAlg ?? "RS256"] }, c.issuer);
+    const endpoint = c.provider === "oidc" && configuration.mode === "discovery" ? configuration.discoveryUrl : discoveryUrl(c.issuer);
+    const raw = await limitedJson(await this.network(endpoint));
+    const ms = c.configuration;
+    const expected = c.provider === "microsoft" && ms.accountType !== "tenant" ? ms.accountType === "consumers" ? MICROSOFT + CONSUMERS + "/v2.0" : ISSUER_TEMPLATE : c.issuer;
+    return metadataCheck(raw, expected);
+  }
+  async validate(c) {
+    await this.metadata(c);
+  }
+  microsoftIssuer(connection, claims) {
+    const c = connection.configuration, tid = claims.tid;
+    if (typeof tid !== "string" || !GUID.test(tid))
+      fail("invalid_microsoft_tenant", 401);
+    const normalized = tid.toLowerCase();
+    if (claims.iss !== MICROSOFT + tid + "/v2.0" || c.accountType === "tenant" && normalized !== c.tenantId || c.accountType === "organizations" && normalized === CONSUMERS || c.accountType === "consumers" && normalized !== CONSUMERS)
+      fail("microsoft_account_scope", 401);
+    return claims.iss;
+  }
+  async configuration(c, secret) {
+    const metadata = await this.metadata(c);
+    const custom = c.configuration;
+    const methods = metadata.token_endpoint_auth_methods_supported ?? ["client_secret_basic"];
+    const method = c.provider === "oidc" && custom.mode === "manual" ? custom.tokenEndpointAuthMethod ?? "client_secret_basic" : methods.includes("client_secret_post") ? "client_secret_post" : "client_secret_basic";
+    const auth = method === "client_secret_post" ? ClientSecretPost2(secret) : ClientSecretBasic2(secret);
+    let actualIssuer;
+    const customFetch = async (input, init) => {
+      const { body, ...options } = init;
+      const response = await this.network(input, { ...options, body: body instanceof Uint8Array ? new Uint8Array(body).buffer : body });
+      if (c.provider === "github" && String(input) === metadata.token_endpoint) {
+        let value;
+        try {
+          value = await response.clone().json();
+        } catch {
+          fail("oauth_token_failed", 502);
+        }
+        if (value && typeof value === "object" && "error" in value) {
+          switch (value.error) {
+            case "incorrect_client_credentials":
+              fail("oauth_client_rejected", 502);
+            case "redirect_uri_mismatch":
+              fail("oauth_callback_mismatch", 502);
+            case "bad_verification_code":
+              fail("oauth_code_rejected", 401);
+            case "unverified_user_email":
+              fail("oauth_email_unverified", 401);
+            default:
+              fail("oauth_token_failed", 502);
+          }
+        }
+      }
+      if (c.provider !== "microsoft")
+        return response;
+      if (String(input) === metadata.token_endpoint && response.ok) {
+        const value = await limitedJson(response.clone());
+        try {
+          if (typeof value.id_token !== "string")
+            fail("invalid_oidc_identity", 401);
+          const claims = providerRecord(JSON.parse(Buffer.from(value.id_token.split(".")[1], "base64url").toString()));
+          actualIssuer = this.microsoftIssuer(c, claims);
+        } catch (error) {
+          if (error instanceof AccountError)
+            throw error;
+          fail("invalid_oidc_identity", 401);
+        }
+      }
+      if (String(input) === metadata.jwks_uri) {
+        if (!actualIssuer)
+          fail("invalid_oidc_identity", 401);
+        const value = providerRecord(await limitedJson(response));
+        if (!Array.isArray(value.keys))
+          fail("oidc_metadata_invalid");
+        const keys = value.keys.filter((key) => key && typeof key === "object" && typeof key.issuer === "string" && key.issuer.replace("{tenantid}", actualIssuer.slice(MICROSOFT.length, -"/v2.0".length)) === actualIssuer);
+        if (!keys.length)
+          fail("microsoft_signing_key_issuer", 401);
+        return Response.json({ keys });
+      }
+      return response;
+    };
+    const signingAlg = metadata.id_token_signing_alg_values_supported?.includes("RS256") ? "RS256" : metadata.id_token_signing_alg_values_supported?.find((alg) => ["PS256", "ES256"].includes(alg));
+    let config;
+    if (c.provider === "microsoft") {
+      config = await discovery(new URL(c.issuer), c.clientId, { client_secret: secret, id_token_signed_response_alg: "RS256" }, auth, { timeout: 5, [customFetch2]: async () => Response.json(metadata) });
+    } else
+      config = new Configuration(metadata, c.clientId, { client_secret: secret, ...c.provider !== "github" ? { id_token_signed_response_alg: signingAlg } : {} }, auth);
+    config[customFetch2] = customFetch;
+    config.timeout = 5;
+    if ([c.issuer, metadata.token_endpoint, metadata.jwks_uri].some((url) => url?.startsWith("http:")))
+      allowInsecureRequests2(config);
+    if (c.provider !== "github")
+      enableNonRepudiationChecks(config);
+    return config;
+  }
+  async exchange(c, config, callback, checks) {
+    const tokens = await authorizationCodeGrant(config, callback, c.provider === "github" ? { pkceCodeVerifier: checks.pkceCodeVerifier, expectedState: checks.expectedState } : { ...checks, idTokenExpected: true }).catch((error) => {
+      if (error instanceof AccountError)
+        throw error;
+      if (error instanceof ClientError && error.cause instanceof AccountError)
+        throw error.cause;
+      if (c.provider !== "github")
+        throw error;
+      fail("oauth_token_failed", 502);
+    });
+    if (c.provider === "github") {
+      const response = await fetchProtectedResource(config, tokens.access_token, new URL("https://api.github.com/user"), "GET", undefined, new Headers({ accept: "application/vnd.github+json", "x-github-api-version": "2022-11-28", "user-agent": "Bungee" }));
+      const user = providerRecord(await limitedJson(response));
+      if (!Number.isSafeInteger(user.id) || user.id <= 0)
+        fail("invalid_oauth_identity", 401);
+      return { protocol: "oauth2", issuer: "https://github.com", subject: String(user.id), displayName: typeof user.name === "string" ? [...user.name].slice(0, 128).join("") : "GitHub user" };
+    }
+    const claims = tokens.claims();
+    if (!claims || typeof claims.sub !== "string" || !claims.sub || claims.sub.length > 255 || typeof claims.iss !== "string")
+      fail("invalid_oidc_identity", 401);
+    if (c.provider === "microsoft")
+      this.microsoftIssuer(c, claims);
+    return { protocol: "oidc", issuer: claims.iss, subject: claims.sub, displayName: typeof claims.name === "string" ? [...claims.name].slice(0, 128).join("") : "SSO user" };
+  }
+}
+var MAX_USERS = 128;
+var MAX_CONNECTIONS = 32;
+var MAX_IDENTITIES = 512;
+var MAX_FLOWS = 128;
+var MAX_AUDIT = 128;
+var MAX_SECRETS = 512;
+var FLOW_COOKIE = "bungee_user_flow";
+var EMPTY_SETTINGS = { autoCreateUsers: false, sessionEpoch: 1, failureEpoch: 1 };
+var EMPTY_TURNSTILE = { enabled: false, siteKey: "", secretRef: "", hostnames: [] };
+var PROVIDER = "user-auth";
+var COOKIE = "bungee_user_session";
+var DEFAULT_SESSION_POLICY = Object.freeze({ idleTimeoutMinutes: 30, absoluteTimeoutMinutes: 480 });
+var COOKIE_LEASE_SECONDS = 400 * 24 * 60 * 60;
+var MAX_TIMEOUT_MINUTES = 43200;
+var ALL = ["config.read", "config.write", "logs.read", "logs.body", "keys.read", "keys.write", "plugins.read", "plugins.toggle", "plugins.code", "auth.mode", "self.password", "self.logout"];
+function object(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v))
+    fail("invalid_input");
+  return v;
+}
+function exact(v, fields) {
+  if (Object.keys(v).some((k) => !fields.includes(k)))
+    fail("invalid_input");
+}
+function username(v) {
+  if (typeof v !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.@-]{0,63}$/.test(v))
+    fail("invalid_input");
+  return v.toLowerCase();
+}
+function password(v) {
+  if (typeof v !== "string" || [...v].length < 5 || [...v].length > 32)
+    fail("invalid_password");
+  return v;
+}
+function digest(v) {
+  return createHash("sha256").update(v).digest("hex");
+}
+function csrf(token) {
+  return createHmac("sha256", token).update("user-auth/csrf/v1").digest("base64url");
+}
+function constant(a, b) {
+  const aa = Buffer.from(a), bb = Buffer.from(b);
+  return aa.length === bb.length && timingSafeEqual(aa, bb);
+}
+function dto(m) {
+  return { id: m.id, username: m.username, displayName: m.displayName, disabled: m.disabled, hasLocalPassword: !!m.passwordHash, requiresPasswordChange: m.temporary };
+}
+function json(v, status = 200, headers = {}) {
+  return Response.json(v, { status, headers: { "cache-control": "no-store", ...headers } });
+}
+function safe(error) {
+  return error instanceof AccountError ? json({ error: error.code }, error.status) : json({ error: "provider_unavailable" }, 503);
+}
+async function body(request) {
+  const reader = request.body?.getReader();
+  if (!reader)
+    fail("invalid_input");
+  let size = 0;
+  const chunks = [];
+  try {
+    for (;; ) {
+      const r = await reader.read();
+      if (r.done)
+        break;
+      size += r.value.length;
+      if (size > 8192) {
+        await reader.cancel();
+        fail("body_limit", 413);
+      }
+      chunks.push(r.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  try {
+    return object(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+  } catch (e) {
+    if (e instanceof AccountError)
+      throw e;
+    return fail("invalid_input");
+  }
+}
+function credentials(request) {
+  const auth = request.headers.get("authorization");
+  if (auth !== null) {
+    const m = /^Bearer ([A-Za-z0-9_-]{43})$/.exec(auth);
+    return m ? { token: m[1], transport: "bearer" } : null;
+  }
+  const tokens = (request.headers.get("cookie") ?? "").split(";").map((x) => x.trim()).filter((x) => x.startsWith(COOKIE + "="));
+  if (tokens.length !== 1)
+    return null;
+  const token = tokens[0].slice(COOKIE.length + 1);
+  return /^[A-Za-z0-9_-]{43}$/.test(token) ? { token, transport: "cookie" } : null;
+}
+function origin(request, expected) {
+  if (request.headers.get("origin") !== (expected ?? new URL(request.url).origin))
+    fail("invalid_origin", 403);
+}
+function cookie(request, token, maxAge, managementOrigin) {
+  return `${COOKIE}=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${new URL(managementOrigin ?? request.url).protocol === "https:" ? "; Secure" : ""}`;
+}
+function validateSessionPolicy(value, code = "invalid_session_policy", status = 400) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    fail(code, status);
+  const p = value;
+  if (Object.keys(p).some((key) => !["idleTimeoutMinutes", "absoluteTimeoutMinutes"].includes(key)) || ![p.idleTimeoutMinutes, p.absoluteTimeoutMinutes].every((n) => Number.isSafeInteger(n) && n >= 0 && n <= MAX_TIMEOUT_MINUTES) || p.absoluteTimeoutMinutes === 0)
+    fail(code, status);
+  return { idleTimeoutMinutes: p.idleTimeoutMinutes, absoluteTimeoutMinutes: p.absoluteTimeoutMinutes };
+}
+var ACCOUNT_RECORD_SCHEMA = 3;
+var MAX_SESSIONS = 512;
+var MAX_FAILURES = 1024;
+var asJson = (value) => value;
+function validateUser(value) {
+  const u = value;
+  if (!u || Object.keys(u).some((k) => !["id", "username", "displayName", "disabled", "generation"].includes(k)) || typeof u.id !== "string" || !/^[a-f0-9-]{36}$/.test(u.id) || typeof u.username !== "string" || !/^[a-z0-9][a-z0-9_.@-]{0,63}$/.test(u.username) || typeof u.displayName !== "string" || [...u.displayName].length > 128 || typeof u.disabled !== "boolean" || !Number.isSafeInteger(u.generation) || u.generation < 1)
+    fail("corrupt_state", 503);
+  return u;
+}
+function localValue(record) {
+  if (!record)
+    return null;
+  const c = envelope(record.value, "credential");
+  if (!c || Object.keys(c).some((k) => !["passwordHash", "temporary"].includes(k)) || typeof c.passwordHash !== "string" || !c.passwordHash.startsWith("$argon2id$") || typeof c.temporary !== "boolean")
+    fail("corrupt_state", 503);
+  return c;
+}
+function entry(records, key, field, fallback) {
+  const r = records.find((r) => r.key === key);
+  return { key, version: r?.version ?? 0, value: r ? envelope(r.value, field) : fallback };
+}
+function users(records) {
+  const result = records.filter((r) => r.key.startsWith("user:")).map((r) => {
+    const u = validateUser(envelope(r.value, "user"));
+    if (r.key !== "user:" + u.id)
+      fail("corrupt_state", 503);
+    const c = localValue(records.find((r) => r.key === "credential:" + u.id));
+    return { ...u, passwordHash: c?.passwordHash ?? "", temporary: c?.temporary ?? false };
+  });
+  if (result.length > MAX_USERS || new Set(result.map((u) => u.username)).size !== result.length)
+    fail("corrupt_state", 503);
+  return result;
+}
+function settings(records) {
+  const s = entry(records, "login-settings", "settings", EMPTY_SETTINGS), v = s.value;
+  requireReadyRecord(records, s.version);
+  if (!v || Object.keys(v).some((k) => !["autoCreateUsers", "sessionEpoch", "failureEpoch"].includes(k)) || typeof v.autoCreateUsers !== "boolean" || ![v.sessionEpoch, v.failureEpoch].every((n) => Number.isSafeInteger(n) && n > 0))
+    fail("corrupt_state", 503);
+  return s;
+}
+function turnstile(records) {
+  const s = entry(records, "turnstile", "turnstile", EMPTY_TURNSTILE), v = s.value;
+  requireReadyRecord(records, s.version);
+  if (!v || Object.keys(v).some((k) => !["enabled", "siteKey", "secretRef", "hostnames"].includes(k)) || typeof v.enabled !== "boolean" || typeof v.siteKey !== "string" || typeof v.secretRef !== "string" || !Array.isArray(v.hostnames) || v.hostnames.some((h) => typeof h !== "string") || v.enabled && (!v.siteKey || !v.secretRef || !v.hostnames.length))
+    fail("corrupt_state", 503);
+  return s;
+}
+function requireReadyRecord(records, version) {
+  const setup = records.find((r) => r.key === "setup");
+  if (!version && setup && envelope(setup.value, "setup").phase === "ready")
+    fail("corrupt_state", 503);
+}
+function connectionSlots(records) {
+  const ids = new Set;
+  const result = records.filter((r) => r.key.startsWith("connection:")).map((r) => {
+    const c = envelope(r.value, "connection");
+    if (c === null)
+      return { key: r.key, version: r.version, value: null };
+    if (!c || c.deleting !== undefined && (!c.deleting || c.enabled || Object.keys(c.deleting).some((k) => k !== "secretRefs") || !Array.isArray(c.deleting.secretRefs) || c.deleting.secretRefs.length > MAX_FLOWS + 1 || c.deleting.secretRefs.some((ref) => typeof ref !== "string" || !/^auth-secret:(\d+):([1-9]\d*)$/.test(ref))) || Object.keys(c).some((k) => !["id", "label", "enabled", "issuer", "provider", "configuration", "clientId", "secretRef", "scopes", "generation", "deleting"].includes(k)) || typeof c.id !== "string" || !/^[a-f0-9-]{36}$/.test(c.id) || ids.has(c.id) || typeof c.label !== "string" || typeof c.enabled !== "boolean" || typeof c.issuer !== "string" || typeof c.clientId !== "string" || typeof c.secretRef !== "string" || !Array.isArray(c.scopes) || c.provider !== "github" && !c.scopes.includes("openid") || c.scopes.some((s) => typeof s !== "string") || !Number.isSafeInteger(c.generation) || c.generation < 1)
+      fail("corrupt_state", 503);
+    try {
+      const parsed = parseProvider(c.provider, c.configuration, c.provider === "oidc" ? c.scopes : undefined);
+      if (JSON.stringify(parsed) !== JSON.stringify({ provider: c.provider, issuer: c.issuer, configuration: c.configuration, scopes: c.scopes }))
+        fail("corrupt_state", 503);
+    } catch {
+      fail("corrupt_state", 503);
+    }
+    ids.add(c.id);
+    return { key: r.key, version: r.version, value: c };
+  });
+  if (result.length > MAX_CONNECTIONS)
+    fail("corrupt_state", 503);
+  return result;
+}
+function connections(records) {
+  return connectionSlots(records).flatMap((slot) => slot.value && !slot.value.deleting ? [slot.value] : []);
+}
+function identities(records) {
+  const result = records.filter((r) => r.key.startsWith("identity:")).flatMap((r) => {
+    const i = envelope(r.value, "identity");
+    if (i === null)
+      return [];
+    if (!i || Object.keys(i).some((k) => !["id", "userId", "connectionId", "issuer", "subject", "protocol"].includes(k)) || typeof i.userId !== "string" || typeof i.connectionId !== "string" || typeof i.issuer !== "string" || !["oidc", "oauth2"].includes(i.protocol) || typeof i.subject !== "string" || !i.subject || r.key !== "identity:" + i.id || i.id !== digest(i.issuer + "\x00" + i.subject))
+      fail("corrupt_state", 503);
+    return [i];
+  });
+  if (result.length > MAX_IDENTITIES)
+    fail("corrupt_state", 503);
+  return result;
+}
+function envelope(value, field) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    fail("corrupt_state", 503);
+  const v = value;
+  if (v.schema !== ACCOUNT_RECORD_SCHEMA || !Object.hasOwn(v, field) || Object.keys(v).some((k) => k !== "schema" && k !== field))
+    fail("corrupt_state", 503);
+  return v[field];
+}
+function validateSession(value) {
+  if (value === null)
+    return null;
+  const s = value;
+  if (!s || Object.keys(s).some((k) => !["digest", "administratorId", "generation", "created", "touched", "pendingTouch", "transport", "policy", "epoch", "connectionId", "connectionGeneration"].includes(k)) || !/^[a-f0-9]{64}$/.test(s.digest) || typeof s.administratorId !== "string" || !s.administratorId || !Number.isSafeInteger(s.generation) || s.generation < 1 || !Number.isSafeInteger(s.created) || s.created < 0 || !Number.isSafeInteger(s.touched) || s.touched < s.created || s.pendingTouch !== undefined && (!Number.isSafeInteger(s.pendingTouch) || s.pendingTouch < s.touched) || !Number.isSafeInteger(s.epoch) || s.epoch < 1 || s.connectionId !== undefined && (typeof s.connectionId !== "string" || !Number.isSafeInteger(s.connectionGeneration)) || !["cookie", "bearer"].includes(s.transport))
+    fail("corrupt_state", 503);
+  validateSessionPolicy(s.policy, "corrupt_state", 503);
+  return s;
+}
+function validateFailure(value) {
+  if (value === null)
+    return null;
+  const f = value;
+  if (!f || Object.keys(f).some((k) => !["key", "count", "until", "epoch"].includes(k)) || typeof f.key !== "string" || !/^(account|source|challenge):[a-f0-9]{64}$/.test(f.key) || !Number.isSafeInteger(f.count) || f.count < 0 || !Number.isSafeInteger(f.until) || f.until < 0 || !Number.isSafeInteger(f.epoch) || f.epoch < 1)
+    fail("corrupt_state", 503);
+  return f;
+}
+function slots(records, kind, limit, validate) {
+  const result = Array.from({ length: limit }, (_, i) => ({ key: `${kind}:${i}`, version: 0, value: null }));
+  const seen = new Set;
+  for (const r of records.filter((r) => r.key.startsWith(kind + ":"))) {
+    const index = Number(r.key.slice(kind.length + 1));
+    if (!Number.isInteger(index) || index < 0 || index >= limit || r.key !== `${kind}:${index}`)
+      fail("corrupt_state", 503);
+    const value = validate(envelope(r.value, kind));
+    const identity = value && (kind === "session" ? value.digest : kind === "failure" ? value.key : value.id);
+    if (identity && seen.has(identity))
+      fail("corrupt_state", 503);
+    if (identity)
+      seen.add(identity);
+    result[index] = { key: r.key, version: r.version, value };
+  }
+  return result;
+}
+var mutation = (slot, field, value) => ({ key: slot.key, expectedVersion: slot.version, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, [field]: value }) });
+function next(value) {
+  if (!Number.isSafeInteger(value + 1))
+    fail("generation_overflow");
+  return value + 1;
+}
+function validateKeys(records) {
+  for (const r of records)
+    if (!["setup", "clock", "session-policy", "recovery-summary", "recovery-anchor", "login-settings", "turnstile"].includes(r.key) && !["session:", "failure:", "user:", "credential:", "identity:", "connection:", "flow:", "audit:"].some((p) => r.key.startsWith(p)))
+      fail("corrupt_state", 503);
+}
+function validateAudit(records) {
+  for (const record of records.filter((r) => r.key.startsWith("audit:"))) {
+    const index = Number(record.key.slice(6));
+    const value = envelope(record.value, "audit");
+    if (!Number.isInteger(index) || index < 0 || index >= MAX_AUDIT || record.key !== "audit:" + index || !value || Object.keys(value).some((k) => !["actor", "action", "result", "at"].includes(k)) || [value.actor, value.action, value.result].some((v) => typeof v !== "string" || !v || v.length > 128) || !Number.isSafeInteger(value.at) || value.at < 0)
+      fail("corrupt_state", 503);
+  }
+}
+function clockValue(record) {
+  if (!record)
+    fail("corrupt_state", 503);
+  const value = envelope(record.value, "observedThrough");
+  if (!Number.isSafeInteger(value) || value < 0)
+    fail("corrupt_state", 503);
+  return value;
+}
+function wallTime(now) {
+  const value = now();
+  if (!Number.isSafeInteger(value) || value < 0)
+    fail("invalid_clock", 503);
+  return value;
+}
+function clockMutation(clock) {
+  return { key: "clock", expectedVersion: clock.version, value: { schema: ACCOUNT_RECORD_SCHEMA, observedThrough: clock.value } };
+}
+async function observeClock(state, now) {
+  for (let i = 0;i < 64; i++) {
+    const record = await state.get("clock"), prior = clockValue(record), value = Math.max(prior, wallTime(now));
+    if (value === prior)
+      return { version: record.version, value, readVersion: record.version };
+    try {
+      const [saved] = await state.transact([clockMutation({ version: record.version, value })]);
+      return { version: saved.version, value, readVersion: record.version };
+    } catch (e) {
+      if (!isDurableStateConflictError(e))
+        throw e;
+    }
+  }
+  return fail("version_conflict", 409);
+}
+function setupRecord(records) {
+  validateKeys(records);
+  const record = records.find((r) => r.key === "setup");
+  if (!record)
+    fail("corrupt_state", 503);
+  const value = envelope(record.value, "setup");
+  if (!value || !["uninitialized", "ready"].includes(value.phase) || Object.keys(value).some((k) => !["phase", "code"].includes(k)))
+    fail("corrupt_state", 503);
+  if (value.code !== undefined && (!value.code || !/^[a-f0-9]{64}$/.test(value.code.digest) || !Number.isSafeInteger(value.code.expiresAt) || value.code.expiresAt < 0 || Object.keys(value.code).some((k) => !["digest", "expiresAt"].includes(k))))
+    fail("corrupt_state", 503);
+  if (value.phase === "ready" && value.code !== undefined)
+    fail("corrupt_state", 503);
+  const all = users(records), anchor = records.find((r) => r.key === "recovery-anchor");
+  if (value.phase === "ready" !== !!all.length || value.phase === "ready" && (!anchor || typeof envelope(anchor.value, "userId") !== "string"))
+    fail("corrupt_state", 503);
+  validateAudit(records);
+  settings(records);
+  turnstile(records);
+  connections(records);
+  identities(records);
+  clockValue(records.find((r) => r.key === "clock"));
+  return { key: "setup", version: record.version, value };
+}
+
+class UserAuthControl {
+  host;
+  dependencies;
+  management = this;
+  rpc = [];
+  api;
+  state;
+  now;
+  subjects = new WeakMap;
+  sessionSlots = new Map;
+  dummy = "";
+  disposed = false;
+  stateTail = Promise.resolve();
+  pendingStateOperations = 0;
+  constructor(host, dependencies = {}) {
+    this.host = host;
+    this.dependencies = dependencies;
+    if (!host.durableState)
+      fail("durable_state_required", 503);
+    this.state = host.durableState;
+    this.now = dependencies.now ?? Date.now;
+    const invoke = (fn) => async (c) => {
+      try {
+        this.alive();
+        if (c.requestSignal.aborted)
+          fail("cancelled");
+        return await fn(c);
+      } catch (e) {
+        return safe(e);
+      }
+    };
+    this.api = [
+      { path: "/password", methods: ["POST"], handler: "changePassword", invoke: invoke(async (c) => {
+        await this.requireCapability(c, "self.password", true);
+        const b = await body(c.request);
+        exact(b, ["currentPassword", "password", "passwordConfirmation"]);
+        await this.changePassword(c, b);
+        return json({ ok: true }, 200, { "set-cookie": cookie(c.request, "", 0, this.host.managementOrigin) });
+      }) },
+      { path: "/logout", methods: ["POST"], handler: "logout", invoke: invoke(async (c) => {
+        await this.requireCapability(c, "self.logout", true);
+        return this.logout(c.request);
+      }) },
+      { path: "/self", methods: ["GET"], handler: "self", invoke: invoke(async (c) => {
+        await this.requireCapability(c, "self.password");
+        return this.retry(async (time) => {
+          const { user } = await this.guard(c, time), creds = credentials(c.request);
+          return { mutations: [], result: json({ administrator: dto(user), ...creds?.transport === "cookie" ? { csrfToken: csrf(creds.token) } : {} }) };
+        });
+      }) },
+      { path: "/session-policy", methods: ["GET", "PUT"], handler: "sessionPolicy", invoke: invoke(async (c) => {
+        await this.requireCapability(c, "config.write", c.request.method === "PUT");
+        if (c.request.method === "GET")
+          return this.retry(async (time) => {
+            const policy = await this.readSessionPolicy();
+            await this.guard(c, time);
+            return { mutations: [], result: json(policy) };
+          });
+        const b = await body(c.request);
+        exact(b, ["version", "policy"]);
+        if (!Number.isSafeInteger(b.version) || b.version < 0)
+          fail("invalid_session_policy");
+        const policy = validateSessionPolicy(b.policy);
+        await this.requireCapability(c, "config.write", true);
+        try {
+          await this.retry(async (time) => {
+            await this.guard(c, time);
+            return { mutations: [{ key: "session-policy", expectedVersion: b.version, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, policy }) }], result: undefined };
+          });
+        } catch (e) {
+          if (isDurableStateConflictError(e))
+            fail("version_conflict", 409);
+          throw e;
+        }
+        return json(await this.readSessionPolicy());
+      }) },
+      ...this.featureApi(invoke)
+    ];
+  }
+  alive() {
+    if (this.disposed || this.host.signal.aborted)
+      fail("provider_unavailable", 503);
+  }
+  async readAdministrator(id) {
+    this.alive();
+    if (!id) {
+      const all = users(await this.records());
+      id = all[0]?.id;
+    }
+    if (!id)
+      return { key: "user:missing", version: 0, value: null };
+    const record = await this.state.get("user:" + id);
+    if (!record)
+      return { key: "user:" + id, version: 0, value: null };
+    const user = validateUser(envelope(record.value, "user")), credential = localValue(await this.state.get("credential:" + id));
+    if (user.id !== id)
+      fail("corrupt_state", 503);
+    return { key: record.key, version: record.version, value: { ...user, passwordHash: credential?.passwordHash ?? "", temporary: credential?.temporary ?? false } };
+  }
+  userMutation(slot, value) {
+    const { passwordHash, temporary, ...user } = value;
+    return mutation(slot, "user", user);
+  }
+  credentialMutation(records, id, hash) {
+    const r = records.find((r) => r.key === "credential:" + id);
+    return { key: "credential:" + id, expectedVersion: r?.version ?? 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, credential: { passwordHash: hash, temporary: false } }) };
+  }
+  async records() {
+    this.alive();
+    const records = await this.state.list();
+    setupRecord(records);
+    return records;
+  }
+  async retry(plan) {
+    if (this.pendingStateOperations >= 256)
+      fail("provider_busy", 503);
+    this.pendingStateOperations++;
+    const task = this.stateTail.then(async () => {
+      await this.cleanupDeletedConnections();
+      const result = await this.retryState(plan);
+      await this.cleanupDeletedConnections();
+      return result;
+    });
+    this.stateTail = task.then(() => {}, () => {});
+    try {
+      return await task;
+    } finally {
+      this.pendingStateOperations--;
+    }
+  }
+  async retryState(plan) {
+    for (let i = 0;i < 64; i++) {
+      const before = await this.state.get("clock");
+      clockValue(before);
+      let clock;
+      const time = async () => {
+        const prior = clock, observed = await observeClock(this.state, this.now);
+        clock = prior && observed.readVersion === prior.version ? { ...observed, readVersion: prior.readVersion } : observed;
+        return clock.value;
+      };
+      let planned;
+      try {
+        planned = await plan(time);
+      } catch (error) {
+        await time();
+        throw error;
+      }
+      if (!clock)
+        await time();
+      if (clock.readVersion !== before.version)
+        continue;
+      if (!planned.mutations.length)
+        return planned.result;
+      this.alive();
+      try {
+        await this.state.transact([...planned.mutations, clockMutation(clock)]);
+        return planned.result;
+      } catch (e) {
+        if (!isDurableStateConflictError(e))
+          throw e;
+      }
+    }
+    return fail("version_conflict", 409);
+  }
+  async cleanupDeletedConnections() {
+    if (!connectionSlots(await this.state.list()).some((slot) => slot.value?.deleting))
+      return;
+    for (;; ) {
+      const pending = await this.retryState(async () => {
+        const records = await this.records();
+        const slot = connectionSlots(records).find((s) => s.value?.deleting);
+        if (!slot)
+          return { mutations: [], result: { done: true, connection: null } };
+        const id = slot.value.id;
+        const bindings = identities(records).filter((i) => i.connectionId === id);
+        const flows = this.flows(records).filter((f) => f.value?.connectionId === id);
+        const changes = [
+          ...bindings.map((i) => mutation(entry(records, "identity:" + i.id, "identity", null), "identity", null)),
+          ...flows.map((f) => mutation(f, "flow", null))
+        ];
+        return { mutations: changes.slice(0, 255), result: { done: false, connection: changes.length ? null : slot.value } };
+      });
+      if (pending.done)
+        return;
+      if (!pending.connection)
+        continue;
+      for (const ref of pending.connection.deleting.secretRefs) {
+        const match = /^auth-secret:(\d+):([1-9]\d*)$/.exec(ref);
+        const key = "auth-secret:" + match[1], version = Number(match[2]);
+        const saved = await this.host.secretStore.get(key);
+        if (saved?.version === version)
+          await this.host.secretStore.delete(key, version);
+      }
+      await this.retryState(async () => {
+        const records = await this.records();
+        const slot = connectionSlots(records).find((s) => s.value?.id === pending.connection.id && s.value.deleting);
+        return { mutations: slot ? [mutation(slot, "connection", null)] : [], result: undefined };
+      });
+    }
+  }
+  async readSessionPolicy() {
+    this.alive();
+    const record = await this.state.get("session-policy");
+    return { version: record?.version ?? 0, policy: record ? validateSessionPolicy(envelope(record.value, "policy"), "corrupt_state", 503) : { ...DEFAULT_SESSION_POLICY } };
+  }
+  async start() {
+    await readManagementSetup(this.state);
+    await observeClock(this.state, this.now);
+    await this.readSessionPolicy();
+    const records = await this.records();
+    slots(records, "session", MAX_SESSIONS, validateSession);
+    slots(records, "failure", MAX_FAILURES, validateFailure);
+    this.flows(records);
+    for (const r of records.filter((r) => r.key.startsWith("credential:"))) {
+      localValue(r);
+      if (!users(records).some((u) => r.key === "credential:" + u.id))
+        fail("corrupt_state", 503);
+    }
+    await this.cleanupDeletedConnections();
+    this.dummy = await this.hash(randomBytes2(32).toString("base64url"));
+  }
+  dispose() {
+    this.disposed = true;
+  }
+  hash(p) {
+    return Bun.password.hash(p, { algorithm: "argon2id", memoryCost: 65536, timeCost: 3 });
+  }
+  async setupStatus() {
+    return (await readManagementSetup(this.state)).initialized ? "ready" : "uninitialized";
+  }
+  async hasIdentity() {
+    return await this.setupStatus() === "ready" && users(await this.records()).some((u) => !u.disabled);
+  }
+  async revokeSessions() {
+    await this.retry(async () => {
+      const s = settings(await this.records());
+      return { mutations: [mutation(s, "settings", { ...s.value, sessionEpoch: next(s.value.sessionEpoch) })], result: undefined };
+    });
+  }
+  async bootstrap(input) {
+    const b = object(input);
+    exact(b, ["username", "password"]);
+    const name = username(b.username), p = password(b.password);
+    if (await this.setupStatus() !== "ready")
+      fail("initialization_required", 409);
+    const prior = users(await this.records()).find((u) => u.username === name);
+    if (!prior?.passwordHash)
+      fail("invalid_credentials", 401);
+    if (prior.username !== name || prior.disabled || !await Bun.password.verify(p, prior.passwordHash))
+      fail("invalid_credentials", 401);
+    const latest = (await this.readAdministrator(prior.id)).value;
+    if (!latest || latest.id !== prior.id || latest.generation !== prior.generation || latest.username !== prior.username || latest.disabled)
+      fail("invalid_credentials", 401);
+  }
+  source(request) {
+    return (this.dependencies.trustedSource ?? this.host.trustedSource)?.(request) ?? "unknown";
+  }
+  async reserve(keys) {
+    return this.retry(async (time) => {
+      const epoch = settings(await this.records()).value.failureEpoch;
+      const failures = slots(await this.records(), "failure", MAX_FAILURES, validateFailure), selected = [], now = await time();
+      for (const key of keys) {
+        let slot = failures.find((x) => !selected.includes(x) && x.value?.key === key);
+        const active = slot?.value && slot.value.epoch === epoch && slot.value.until > now;
+        if (active && slot.value.count >= 10)
+          fail("login_limited", 429);
+        slot ??= failures.find((x) => !selected.includes(x) && (!x.value || x.value.epoch !== epoch || x.value.until <= now));
+        if (!slot)
+          fail("login_limited", 429);
+        selected.push(slot);
+      }
+      return { mutations: selected.map((slot, i) => {
+        const prior = slot.value;
+        return mutation(slot, "failure", { key: keys[i], count: prior && prior.key === keys[i] && prior.epoch === epoch && prior.until > now ? prior.count + 1 : 1, until: prior && prior.key === keys[i] && prior.epoch === epoch && prior.until > now ? prior.until : now + 15 * 60000, epoch });
+      }), result: epoch };
+    });
+  }
+  async initialize(request) {
+    try {
+      this.alive();
+      if (request.method !== "POST")
+        fail("method_not_allowed", 405);
+      origin(request, this.host.managementOrigin);
+      const b = await body(request);
+      exact(b, ["setupCode", "username", "password", "passwordConfirmation"]);
+      await this.reserve(["source:" + digest(this.source(request))]);
+      const check = async (time) => {
+        const records = await this.records(), setup = setupRecord(records), now = await time();
+        if (setup.value.phase !== "uninitialized")
+          fail("already_initialized", 409);
+        if (!setup.value.code || now >= setup.value.code.expiresAt || typeof b.setupCode !== "string" || !constant(digest(b.setupCode), setup.value.code.digest))
+          fail("invalid_setup_code", 401);
+        return { setup, records };
+      };
+      const initial = await this.retry(async (time) => ({ mutations: [], result: await check(time) }));
+      const name = username(b.username), p = password(b.password);
+      if (b.passwordConfirmation !== p)
+        fail("password_confirmation");
+      const passwordHash = await this.hash(p);
+      await this.retry(async (time) => {
+        const { setup, records } = await check(time);
+        if (setup.version !== initial.setup.version)
+          fail("invalid_setup_code", 401);
+        const account = { id: randomUUID(), username: name, displayName: name, disabled: false, generation: 1 };
+        return { mutations: [mutation(setup, "setup", { phase: "ready" }), mutation(settings(records), "settings", EMPTY_SETTINGS), mutation(turnstile(records), "turnstile", EMPTY_TURNSTILE), { key: "user:" + account.id, expectedVersion: 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, user: account }) }, this.credentialMutation(records, account.id, passwordHash), { key: "recovery-anchor", expectedVersion: 0, value: { schema: ACCOUNT_RECORD_SCHEMA, userId: account.id } }], result: undefined };
+      });
+      return json({ initialized: true });
+    } catch (e) {
+      return safe(e);
+    }
+  }
+  live(m, session, now, records) {
+    if (session.epoch !== settings(records).value.sessionEpoch)
+      return;
+    if (session.connectionId) {
+      const c = connections(records).find((c) => c.id === session.connectionId);
+      if (!c?.enabled || c.generation !== session.connectionGeneration)
+        return;
+    }
+    const policy = session.policy;
+    if (now < session.touched || now < session.created || policy.idleTimeoutMinutes > 0 && now - session.touched >= policy.idleTimeoutMinutes * 60000 || now - session.created >= policy.absoluteTimeoutMinutes * 60000)
+      return;
+    return m && m.id === session.administratorId && !m.disabled && m.generation === session.generation ? m : undefined;
+  }
+  async findSession(d) {
+    this.alive();
+    const key = this.sessionSlots.get(d);
+    if (key) {
+      const record = await this.state.get(key), value = record && validateSession(envelope(record.value, "session"));
+      if (record && value?.digest === d)
+        return { key, version: record.version, value };
+      this.sessionSlots.delete(d);
+    }
+    const found = slots(await this.records(), "session", MAX_SESSIONS, validateSession).find((x) => x.value?.digest === d);
+    if (found) {
+      if (this.sessionSlots.size >= MAX_SESSIONS)
+        this.sessionSlots.clear();
+      this.sessionSlots.set(d, found.key);
+    }
+    return found;
+  }
+  cookieAge(policy, elapsedMs = 0) {
+    return Math.max(0, Math.min(COOKIE_LEASE_SECONDS, Math.floor((policy.absoluteTimeoutMinutes * 60000 - elapsedMs) / 1000)));
+  }
+  async sessionCookie(request) {
+    this.alive();
+    const creds = credentials(request);
+    if (creds?.transport !== "cookie")
+      return;
+    return this.retry(async (time) => {
+      const slot = await this.findSession(digest(creds.token)), session = slot?.value, m = (await this.readAdministrator(session?.administratorId)).value, records = await this.records(), now = await time();
+      return { mutations: [], result: session && session.transport === "cookie" && this.live(m, session, now, records) ? cookie(request, creds.token, this.cookieAge(session.policy, now - session.created), this.host.managementOrigin) : undefined };
+    });
+  }
+  async authenticate(request) {
+    this.alive();
+    const c = credentials(request);
+    if (!c)
+      return null;
+    const d = digest(c.token);
+    const prepared = await this.retry(async (time) => {
+      const slot = await this.findSession(d), session = slot?.value, m = (await this.readAdministrator(session?.administratorId)).value, records = await this.records(), now = await time();
+      const administrator = session && session.transport === c.transport && this.live(m, session, now, records);
+      if (!slot || !session || !administrator)
+        return { mutations: [], result: false };
+      return { mutations: session.pendingTouch === undefined ? [mutation(slot, "session", { ...session, pendingTouch: now })] : [], result: true };
+    }).catch(async (error) => {
+      try {
+        await observeClock(this.state, this.now);
+      } catch {}
+      throw error;
+    });
+    if (!prepared)
+      return null;
+    const authenticated = await this.retry(async (time) => {
+      const slot = await this.findSession(d), session = slot?.value, m = (await this.readAdministrator(session?.administratorId)).value, records = await this.records(), now = await time();
+      const administrator = session && session.transport === c.transport && this.live(m, session, now, records);
+      if (!slot || !session || !administrator)
+        return { mutations: [], result: null };
+      const { pendingTouch, ...confirmed } = session;
+      return { mutations: pendingTouch === undefined ? [] : [mutation(slot, "session", { ...confirmed, touched: now })], result: administrator };
+    });
+    if (!authenticated)
+      return null;
+    const subject = Object.freeze({ id: authenticated.id, provider: PROVIDER, capabilities: Object.freeze([...ALL]), requiresPasswordChange: authenticated.temporary });
+    this.subjects.set(subject, { generation: authenticated.generation, digest: d });
+    return await this.authorize(subject, "config.read") ? subject : null;
+  }
+  async authorize(subject, _capability) {
+    this.alive();
+    const issued = this.subjects.get(subject);
+    if (!issued || subject.provider !== PROVIDER)
+      return false;
+    return this.retry(async (time) => {
+      const slot = await this.findSession(issued.digest), session = slot?.value, account = (await this.readAdministrator(session?.administratorId)).value, records = await this.records(), now = await time(), m = session && this.live(account, session, now, records);
+      return { mutations: [], result: !!m && m.id === subject.id && m.generation === issued.generation };
+    });
+  }
+  async requireCapability(c, capability, write = false) {
+    if (!c.subject || !credentials(c.request) || this.subjects.get(c.subject)?.digest !== digest(credentials(c.request).token) || !await this.authorize(c.subject, capability))
+      fail("forbidden", 403);
+    if (write)
+      this.checkWrite(c.request);
+  }
+  validateWrite(request) {
+    this.checkWrite(request);
+  }
+  csrfToken(request) {
+    const c = credentials(request);
+    return c?.transport === "cookie" ? csrf(c.token) : undefined;
+  }
+  checkWrite(request) {
+    const c = credentials(request);
+    if (!c)
+      fail("unauthorized", 401);
+    if (c.transport === "cookie") {
+      origin(request, this.host.managementOrigin);
+      if (!constant(request.headers.get("x-csrf-token") ?? "", csrf(c.token)))
+        fail("invalid_csrf", 403);
+    }
+  }
+  async login(request) {
+    try {
+      this.alive();
+      if (request.method !== "POST")
+        fail("method_not_allowed", 405);
+      const b = await body(request);
+      exact(b, ["username", "password", "transport", "turnstileToken"]);
+      const name = username(b.username), p = typeof b.password === "string" ? b.password : "";
+      const transport = b.transport ?? "cookie";
+      if (transport !== "cookie" && transport !== "bearer")
+        fail("invalid_input");
+      if (transport === "cookie" || request.headers.has("origin"))
+        origin(request, this.host.managementOrigin);
+      const keys = ["account:" + digest(name), "source:" + digest(this.source(request))];
+      const reservation = await this.reserve(keys);
+      if (await this.setupStatus() !== "ready")
+        fail("invalid_credentials", 401);
+      const turn = turnstile(await this.records());
+      await this.verifyTurnstile(b.turnstileToken, turn.value, request);
+      const administrator = users(await this.records()).find((u) => u.username === name);
+      const valid = await Bun.password.verify(p, administrator?.passwordHash || this.dummy || await this.hash("dummy-invalid-password"));
+      if (!valid || !administrator || !administrator.passwordHash || administrator.disabled)
+        fail("invalid_credentials", 401);
+      const token = randomBytes2(32).toString("base64url");
+      let policy = { ...DEFAULT_SESSION_POLICY };
+      const created = await this.retry(async (time) => {
+        const m = (await this.readAdministrator(administrator.id)).value;
+        if (!m || m.id !== administrator.id || m.username !== administrator.username || m.disabled || m.generation !== administrator.generation)
+          fail("invalid_credentials", 401);
+        const records = await this.records();
+        policy = (await this.readSessionPolicy()).policy;
+        if (settings(records).value.failureEpoch !== reservation || turnstile(records).version !== turn.version)
+          fail("version_conflict", 409);
+        const now = await time(), sessions = slots(records, "session", MAX_SESSIONS, validateSession), slot = sessions.find((x) => !x.value || !this.live(users(records).find((u) => u.id === x.value.administratorId) ?? null, x.value, now, records));
+        if (!slot)
+          fail("session_limit", 429);
+        const changes = [mutation(slot, "session", { digest: digest(token), administratorId: m.id, generation: m.generation, created: now, touched: now, transport, policy, epoch: settings(records).value.sessionEpoch }), this.audit(records, m.id, "local.login", now)];
+        const failures = slots(records, "failure", MAX_FAILURES, validateFailure);
+        const account = failures.find((x) => x.value?.key === keys[0] && x.value.epoch === reservation);
+        if (account)
+          changes.push(mutation(account, "failure", null));
+        const source = failures.find((x) => x.value?.key === keys[1] && x.value.epoch === reservation);
+        if (source)
+          changes.push(mutation(source, "failure", { ...source.value, count: Math.max(0, source.value.count - 1) }));
+        return { mutations: changes, result: now };
+      });
+      const latest = (await this.readAdministrator(administrator.id)).value;
+      if (!latest || latest.disabled || latest.generation !== administrator.generation || latest.id !== administrator.id)
+        fail("invalid_credentials", 401);
+      return transport === "cookie" ? json({ administrator: dto(administrator), csrfToken: csrf(token) }, 200, { "set-cookie": cookie(request, token, this.cookieAge(policy, (await observeClock(this.state, this.now)).value - created), this.host.managementOrigin) }) : json({ administrator: dto(administrator), token, expiresIn: policy.absoluteTimeoutMinutes * 60 });
+    } catch (e) {
+      await this.recordFailure("local.login", e);
+      return safe(e);
+    }
+  }
+  async logout(request) {
+    try {
+      this.alive();
+      if (request.method !== "POST")
+        fail("method_not_allowed", 405);
+      this.checkWrite(request);
+      const c = credentials(request);
+      await this.retry(async () => {
+        const slot = await this.findSession(digest(c.token));
+        return { mutations: slot?.value ? [mutation(slot, "session", null)] : [], result: undefined };
+      });
+      return json({ ok: true }, 200, { "set-cookie": cookie(request, "", 0, this.host.managementOrigin) });
+    } catch (e) {
+      return safe(e);
+    }
+  }
+  async changePassword(c, b) {
+    const p = password(b.password);
+    if (b.passwordConfirmation !== p)
+      fail("password_confirmation");
+    const id = c.subject.id, m = (await this.readAdministrator(id)).value;
+    if (!m || !m.passwordHash || m.id !== id || typeof b.currentPassword !== "string" || !await Bun.password.verify(b.currentPassword, m.passwordHash))
+      fail("invalid_credentials", 401);
+    if (constant(p, b.currentPassword))
+      fail("password_unchanged");
+    const hashed = await this.hash(p);
+    await this.retry(async (time) => {
+      this.checkWrite(c.request);
+      const a = await this.readAdministrator(id), current = a.value, records = await this.records();
+      if (!current || current.id !== id || current.disabled || current.generation !== m.generation)
+        fail("version_conflict", 409);
+      const issued = this.subjects.get(c.subject), slot = await this.findSession(issued.digest), now = await time();
+      if (!slot?.value || !this.live(current, slot.value, now, records))
+        fail("forbidden", 403);
+      return { mutations: [this.userMutation(a, { ...current, generation: next(current.generation) }), this.credentialMutation(records, id, hashed), mutation(slot, "session", null), this.audit(records, id, "user.password.change", now)], result: undefined };
+    });
+  }
+  async guard(c, time) {
+    this.checkWriteIfNeeded(c.request);
+    const issued = c.subject && this.subjects.get(c.subject), creds = credentials(c.request);
+    if (!issued || !creds || issued.digest !== digest(creds.token))
+      fail("forbidden", 403);
+    const slot = await this.findSession(issued.digest), records = await this.records(), user = users(records).find((u) => u.id === c.subject.id), now = await time();
+    if (!slot?.value || slot.value.transport !== creds.transport || !user || user.generation !== issued.generation || !this.live(user, slot.value, now, records))
+      fail("forbidden", 403);
+    return { user, records };
+  }
+  checkWriteIfNeeded(request) {
+    if (!["GET", "HEAD"].includes(request.method))
+      this.checkWrite(request);
+  }
+  audit(records, actor, action, at, result = "success") {
+    const recordsBySlot = Array.from({ length: MAX_AUDIT }, (_, i) => records.find((r) => r.key === "audit:" + i));
+    const index = recordsBySlot.findIndex((r) => !r);
+    const slot = index >= 0 ? index : recordsBySlot.reduce((best, r, i) => envelope(r.value, "audit").at < envelope(recordsBySlot[best].value, "audit").at ? i : best, 0);
+    return { key: "audit:" + slot, expectedVersion: recordsBySlot[slot]?.version ?? 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, audit: { actor, action, result, at } }) };
+  }
+  async recordFailure(action, error) {
+    try {
+      await this.retry(async (time) => {
+        const records = await this.records(), at = await time();
+        return { mutations: [this.audit(records, "anonymous", action, at, error instanceof AccountError ? error.code : "provider_unavailable")], result: undefined };
+      });
+    } catch {}
+  }
+  featureApi(invoke) {
+    const route = (path, methods, handler, fn) => ({ path, methods, handler, invoke: invoke(fn) });
+    return [
+      route("/users", ["GET", "POST"], "users", async (c) => {
+        await this.requireCapability(c, "config.write", c.request.method === "POST");
+        if (c.request.method === "GET")
+          return this.retry(async (time) => {
+            const { records } = await this.guard(c, time);
+            return { mutations: [], result: json({ users: users(records).map(dto) }) };
+          });
+        const b = await body(c.request);
+        exact(b, ["username", "displayName", "password", "passwordConfirmation"]);
+        const name = username(b.username), displayName = this.displayName(b.displayName ?? name);
+        const hash = b.password === undefined ? "" : await this.hash(this.confirmPassword(b)), id = randomUUID();
+        return this.retry(async (time) => {
+          const { records, user } = await this.guard(c, time), all = users(records);
+          if (all.length >= MAX_USERS)
+            fail("user_limit", 409);
+          if (all.some((u) => u.username === name))
+            fail("username_exists", 409);
+          const u = { id, username: name, displayName, disabled: false, generation: 1, passwordHash: hash, temporary: false };
+          return { mutations: [this.userMutation({ key: "user:" + id, version: 0, value: null }, u), ...hash ? [this.credentialMutation(records, id, hash)] : [], this.audit(records, user.id, "user.create", await time())], result: json({ user: dto(u) }, 201) };
+        });
+      }),
+      route("/users/update", ["PUT"], "updateUser", async (c) => {
+        await this.requireCapability(c, "config.write", true);
+        const b = await body(c.request);
+        exact(b, ["id", "username", "displayName", "disabled"]);
+        const id = this.text(b.id, 64), name = username(b.username), displayName = this.displayName(b.displayName);
+        if (typeof b.disabled !== "boolean")
+          fail("invalid_input");
+        return this.retry(async (time) => {
+          const { records, user } = await this.guard(c, time), all = users(records), u = all.find((u) => u.id === id);
+          if (!u)
+            fail("not_found", 404);
+          if (all.some((u) => u.id !== id && u.username === name))
+            fail("username_exists", 409);
+          if (b.disabled && !u.disabled && u.passwordHash && !all.some((x) => x.id !== id && !x.disabled && x.passwordHash))
+            fail("last_local_user", 409);
+          const updated = { ...u, username: name, displayName, disabled: b.disabled, generation: b.disabled !== u.disabled ? next(u.generation) : u.generation };
+          const r = records.find((r) => r.key === "user:" + id);
+          return { mutations: [this.userMutation({ key: r.key, version: r.version, value: u }, updated), this.audit(records, user.id, "user.update", await time())], result: json({ user: dto(updated) }) };
+        });
+      }),
+      route("/users/password", ["POST"], "resetUserPassword", async (c) => {
+        await this.requireCapability(c, "config.write", true);
+        const b = await body(c.request);
+        exact(b, ["id", "password", "passwordConfirmation"]);
+        const id = this.text(b.id, 64), hash = await this.hash(this.confirmPassword(b));
+        return this.retry(async (time) => {
+          const { records, user } = await this.guard(c, time), u = users(records).find((u) => u.id === id);
+          if (!u)
+            fail("not_found", 404);
+          const r = records.find((r) => r.key === "user:" + id);
+          return { mutations: [this.userMutation({ key: r.key, version: r.version, value: u }, { ...u, generation: next(u.generation) }), this.credentialMutation(records, id, hash), this.audit(records, user.id, "user.password.reset", await time())], result: json({ ok: true }) };
+        });
+      }),
+      route("/identities", ["GET", "POST", "DELETE"], "identities", async (c) => {
+        await this.requireCapability(c, "config.write", c.request.method !== "GET");
+        const b = c.request.method === "GET" ? {} : await body(c.request);
+        exact(b, c.request.method === "POST" ? ["userId", "connectionId", "subject"] : ["id"]);
+        return this.retry(async (time) => {
+          const { records, user } = await this.guard(c, time), all = identities(records);
+          if (c.request.method === "GET") {
+            const id = new URL(c.request.url).searchParams.get("userId");
+            return { mutations: [], result: json({ identities: all.filter((i) => !id || i.userId === id) }) };
+          }
+          let identity;
+          if (c.request.method === "POST") {
+            const connection = connections(records).find((x) => x.id === b.connectionId);
+            if (!connection)
+              fail("not_found", 404);
+            const ms = connection.configuration;
+            if (connection.provider === "microsoft" && ["common", "organizations"].includes(ms.accountType))
+              fail("verified_identity_required");
+            const identityIssuer = connection.provider === "microsoft" && ms.accountType === "consumers" ? "https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0" : connection.issuer;
+            const sub = this.text(b.subject, 255), id = digest(identityIssuer + "\x00" + sub);
+            if (connection.provider === "github" && (!/^[1-9][0-9]*$/.test(sub) || !Number.isSafeInteger(Number(sub))))
+              fail("invalid_oauth_identity");
+            if (all.some((x) => x.id === id))
+              fail("identity_exists", 409);
+            if (all.length >= MAX_IDENTITIES)
+              fail("identity_limit", 409);
+            identity = { id, userId: this.text(b.userId, 64), connectionId: connection.id, issuer: identityIssuer, subject: sub, protocol: connection.provider === "github" ? "oauth2" : "oidc" };
+          } else {
+            const found = all.find((i) => i.id === b.id);
+            if (!found)
+              fail("not_found", 404);
+            identity = found;
+          }
+          const target = users(records).find((u) => u.id === identity.userId);
+          if (!target)
+            fail("not_found", 404);
+          const r = records.find((r) => r.key === "user:" + target.id), prior = entry(records, "identity:" + identity.id, "identity", null);
+          return { mutations: [mutation(prior, "identity", c.request.method === "POST" ? identity : null), this.userMutation({ key: r.key, version: r.version, value: target }, { ...target, generation: next(target.generation) }), this.audit(records, user.id, c.request.method === "POST" ? "identity.bind" : "identity.unbind", await time())], result: json({ ok: true }) };
+        });
+      }),
+      route("/login-connections", ["GET", "POST", "PUT", "DELETE"], "loginConnections", async (c) => {
+        await this.requireCapability(c, "config.write", c.request.method !== "GET");
+        if (c.request.method === "GET")
+          return this.retry(async (time) => {
+            const { records } = await this.guard(c, time);
+            return { mutations: [], result: json({ publicOrigin: this.host.managementOrigin ? this.publicOrigin() : null, connections: connectionSlots(records).flatMap((slot) => slot.value && !slot.value.deleting ? [{ ...this.connectionDto(slot.value), version: slot.version }] : []) }) };
+          });
+        const b = await body(c.request);
+        if (c.request.method === "DELETE") {
+          exact(b, ["id", "version"]);
+          const id = this.text(b.id, 64);
+          if (!Number.isSafeInteger(b.version) || b.version < 1)
+            fail("invalid_input");
+          return this.retry(async (time) => {
+            const { records, user } = await this.guard(c, time);
+            const slot = connectionSlots(records).find((s) => s.value?.id === id && !s.value.deleting);
+            if (!slot || slot.version !== b.version)
+              fail("version_conflict", 409);
+            const affectedIds = new Set(identities(records).filter((i) => i.connectionId === id).map((i) => i.userId));
+            const affected = users(records).filter((u) => affectedIds.has(u.id));
+            const issued = this.subjects.get(c.subject), session = await this.findSession(issued.digest);
+            return {
+              mutations: [
+                mutation(slot, "connection", { ...slot.value, enabled: false, deleting: { secretRefs: [...new Set([slot.value.secretRef, ...this.flows(records).filter((f) => f.value?.connectionId === id).map((f) => f.value.verifierRef)])].filter(Boolean) } }),
+                ...affected.map((u) => {
+                  const r = records.find((r) => r.key === "user:" + u.id);
+                  return this.userMutation({ key: r.key, version: r.version, value: u }, { ...u, generation: next(u.generation) });
+                }),
+                this.audit(records, user.id, "login.delete", await time())
+              ],
+              result: json({ ok: true, sessionRevoked: affectedIds.has(user.id) || session?.value?.connectionId === id })
+            };
+          });
+        }
+        exact(b, ["id", "version", "label", "enabled", "provider", "configuration", "clientId", "clientSecret", "scopes"]);
+        const id = this.text(b.id, 36), label = this.text(b.label, 128), clientId = this.text(b.clientId, 512);
+        if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(id) || b.enabled !== undefined && typeof b.enabled !== "boolean" || c.request.method === "POST" && b.version !== undefined || c.request.method === "PUT" && (!Number.isSafeInteger(b.version) || b.version < 1))
+          fail("invalid_input");
+        const parsed = parseProvider(b.provider, b.configuration, b.scopes);
+        const previous = c.request.method === "PUT" ? await this.retry(async (time) => {
+          const { records } = await this.guard(c, time);
+          const slot = connectionSlots(records).find((slot) => slot.value?.id === id && !slot.value.deleting);
+          if (!slot?.value || slot.version !== b.version)
+            fail("version_conflict", 409);
+          if (slot.value.provider !== parsed.provider)
+            fail("invalid_input");
+          return { mutations: [], result: slot.value };
+        }) : undefined;
+        const disableOnly = previous && b.enabled === false && b.clientSecret === undefined && previous.clientId === clientId && previous.issuer === parsed.issuer && isDeepStrictEqual(previous.configuration, parsed.configuration) && isDeepStrictEqual(previous.scopes, parsed.scopes);
+        if (!disableOnly)
+          await this.loginProviders().validate({ ...parsed, clientId });
+        const secretRef = b.clientSecret === undefined ? undefined : await this.storeSecret(this.text(b.clientSecret, 8192));
+        let replacedRef;
+        try {
+          return await this.retry(async (time) => {
+            const { records, user } = await this.guard(c, time), slots = connectionSlots(records), record = c.request.method === "POST" ? slots.find((s) => s.value?.id === id) ?? slots.find((s) => s.key === "connection:" + id) ?? slots.find((s) => s.value === null) : slots.find((s) => s.value?.id === id && !s.value.deleting), old = record?.value;
+            if (c.request.method === "PUT" && (!old || record?.version !== b.version))
+              fail("version_conflict", 409);
+            if (old && old.provider !== parsed.provider)
+              fail("invalid_input");
+            if (c.request.method === "POST" && old)
+              fail("version_conflict", 409);
+            if (c.request.method === "POST" && slots.filter((s) => s.value !== null).length >= MAX_CONNECTIONS)
+              fail("connection_limit", 409);
+            replacedRef = old?.secretRef;
+            const connection = { id, label, enabled: b.enabled ?? false, ...parsed, clientId, secretRef: secretRef ?? old?.secretRef ?? "", generation: next(old?.generation ?? 0) };
+            if (connection.enabled && !connection.secretRef)
+              fail("oidc_secret_required");
+            return { mutations: [{ key: record?.key ?? "connection:" + id, expectedVersion: record?.version ?? 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, connection }) }, this.audit(records, user.id, "login.configure", await time())], result: json({ connection: { ...this.connectionDto(connection), version: (record?.version ?? 0) + 1 } }, c.request.method === "POST" ? 201 : 200) };
+          });
+        } finally {
+          if (secretRef)
+            await this.discardUnpublishedSecret(secretRef);
+          if (replacedRef)
+            await this.discardUnpublishedSecret(replacedRef);
+        }
+      }),
+      route("/login-connections/discover", ["POST"], "discoverLoginConnection", async (c) => {
+        await this.requireCapability(c, "config.write", true);
+        const b = await body(c.request);
+        exact(b, ["mode", "url"]);
+        const metadata = await this.loginProviders().discover(b.mode, b.url);
+        return this.retry(async (time) => {
+          await this.guard(c, time);
+          return { mutations: [], result: json(metadata) };
+        });
+      }),
+      route("/login-settings", ["GET", "PUT"], "loginSettings", async (c) => {
+        await this.requireCapability(c, "config.write", c.request.method === "PUT");
+        const b = c.request.method === "PUT" ? await body(c.request) : {};
+        exact(b, ["version", "autoCreateUsers"]);
+        return this.retry(async (time) => {
+          const { records, user } = await this.guard(c, time), s = settings(records);
+          if (c.request.method === "GET")
+            return { mutations: [], result: json({ version: s.version, autoCreateUsers: s.value.autoCreateUsers }) };
+          if (typeof b.autoCreateUsers !== "boolean")
+            fail("invalid_input");
+          if (b.version !== s.version)
+            fail("version_conflict", 409);
+          return { mutations: [mutation(s, "settings", { ...s.value, autoCreateUsers: b.autoCreateUsers }), this.audit(records, user.id, "login.configure", await time())], result: json({ version: s.version + 1, autoCreateUsers: b.autoCreateUsers }) };
+        });
+      }),
+      route("/turnstile", ["GET", "PUT"], "turnstile", async (c) => {
+        await this.requireCapability(c, "config.write", c.request.method === "PUT");
+        if (c.request.method === "GET")
+          return this.retry(async (time) => {
+            const { records } = await this.guard(c, time), s = turnstile(records);
+            return { mutations: [], result: json(this.turnstileDto(s)) };
+          });
+        const b = await body(c.request);
+        exact(b, ["version", "enabled", "siteKey", "secret", "hostnames"]);
+        if (typeof b.enabled !== "boolean" || typeof b.siteKey !== "string" || b.siteKey.length > 256 || !Array.isArray(b.hostnames) || b.hostnames.length > 32 || b.hostnames.some((h) => typeof h !== "string" || !h || h.length > 253 || !/^([a-z0-9-]+\.)*[a-z0-9-]+$/i.test(h)))
+          fail("invalid_input");
+        const ref = b.secret === undefined ? undefined : await this.storeSecret(this.text(b.secret, 8192));
+        let replacedRef;
+        try {
+          return await this.retry(async (time) => {
+            const { records, user } = await this.guard(c, time), s = turnstile(records);
+            replacedRef = s.value.secretRef;
+            if (s.version !== b.version)
+              fail("version_conflict", 409);
+            const v = { enabled: b.enabled, siteKey: b.siteKey, secretRef: ref ?? s.value.secretRef, hostnames: b.hostnames };
+            if (v.enabled && (!v.siteKey || !v.secretRef || !v.hostnames.length))
+              fail("turnstile_incomplete");
+            return { mutations: [mutation(s, "turnstile", v), this.audit(records, user.id, "turnstile.configure", await time())], result: json(this.turnstileDto({ key: s.key, version: s.version + 1, value: v })) };
+          });
+        } finally {
+          if (ref)
+            await this.discardUnpublishedSecret(ref);
+          if (replacedRef)
+            await this.discardUnpublishedSecret(replacedRef);
+        }
+      }),
+      route("/identities/link/start", ["POST"], "beginIdentityLink", async (c) => {
+        await this.requireCapability(c, "config.write", true);
+        const b = await body(c.request);
+        exact(b, ["connectionId"]);
+        return this.startFlow(c.request, this.text(b.connectionId, 64), "/#/extensions/user-auth/profile", c);
+      }),
+      route("/identities/link/finish", ["POST"], "finishIdentityLink", async (c) => {
+        await this.requireCapability(c, "config.write", true);
+        const b = await body(c.request);
+        exact(b, ["flowId"]);
+        return this.finishLink(c, this.text(b.flowId, 64));
+      })
+    ];
+  }
+  displayName(v) {
+    if (typeof v !== "string" || [...v].length > 128)
+      fail("invalid_input");
+    return v;
+  }
+  text(v, max) {
+    if (typeof v !== "string" || !v || v.length > max)
+      fail("invalid_input");
+    return v;
+  }
+  confirmPassword(b) {
+    const p = password(b.password);
+    if (p !== b.passwordConfirmation)
+      fail("password_confirmation");
+    return p;
+  }
+  connectionDto(v) {
+    return { id: v.id, label: v.label, enabled: v.enabled, provider: v.provider, configuration: v.configuration, issuer: v.issuer, clientId: v.clientId, scopes: v.scopes, hasSecret: !!v.secretRef };
+  }
+  turnstileDto(s) {
+    return { version: s.version, enabled: s.value.enabled, siteKey: s.value.siteKey, hostnames: s.value.hostnames, hasSecret: !!s.value.secretRef };
+  }
+  async storeSecret(secret) {
+    const encoded = JSON.stringify({ owner: randomUUID(), value: secret });
+    for (let index = 0;index < MAX_SECRETS; index++) {
+      const key = "auth-secret:" + index;
+      if (await this.host.secretStore.get(key))
+        continue;
+      try {
+        const version = await this.host.secretStore.compareAndSet(key, null, encoded);
+        return key + ":" + version;
+      } catch (error) {
+        const saved = await this.host.secretStore.get(key);
+        if (saved && constant(saved.value, encoded))
+          return key + ":" + saved.version;
+        if (error && typeof error === "object" && "code" in error && error.code === "version_conflict")
+          continue;
+        throw error;
+      }
+    }
+    return fail("secret_limit", 503);
+  }
+  async readSecret(ref) {
+    const match = /^auth-secret:(\d+):([1-9]\d*)$/.exec(ref);
+    if (!match || Number(match[1]) >= MAX_SECRETS)
+      return null;
+    const key = "auth-secret:" + match[1], saved = await this.host.secretStore.get(key);
+    if (saved?.version !== Number(match[2]))
+      return null;
+    try {
+      const value = JSON.parse(saved.value);
+      return typeof value?.owner === "string" && typeof value.value === "string" ? { version: saved.version, value: value.value, key } : null;
+    } catch {
+      return null;
+    }
+  }
+  async deleteSecret(ref) {
+    const saved = await this.readSecret(ref);
+    if (saved)
+      await this.host.secretStore.delete(saved.key, saved.version);
+  }
+  async discardUnpublishedSecret(ref) {
+    try {
+      const records = await this.records();
+      if (records.some((r) => JSON.stringify(r.value).includes(ref)))
+        return;
+      await this.deleteSecret(ref);
+    } catch {}
+  }
+  async verifyTurnstile(token, config, request) {
+    if (!config.enabled)
+      return;
+    if (typeof token !== "string" || !token || token.length > 2048)
+      fail("turnstile_required", 401);
+    await this.retry(async (time) => {
+      const records = await this.records(), s = settings(records).value, all = slots(records, "failure", MAX_FAILURES, validateFailure), key = "challenge:" + digest(token), now = await time();
+      if (all.some((f) => f.value?.key === key && f.value.until > now))
+        fail("turnstile_failed", 401);
+      const slot = all.find((f) => !f.value || f.value.until <= now);
+      if (!slot)
+        fail("login_limited", 429);
+      return { mutations: [mutation(slot, "failure", { key, count: 1, until: now + 5 * 60000, epoch: s.failureEpoch })], result: undefined };
+    });
+    const secret = await this.readSecret(config.secretRef);
+    if (!secret)
+      fail("turnstile_failed", 401);
+    try {
+      const response = await (this.dependencies.fetch ?? fetch)("https://challenges.cloudflare.com/turnstile/v0/siteverify", { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ secret: secret.value, response: token }), signal: AbortSignal.any([request.signal, this.host.signal, AbortSignal.timeout(5000)]), redirect: "error" });
+      const result = await response.json();
+      if (!response.ok || result.success !== true || typeof result.hostname !== "string" || !config.hostnames.includes(result.hostname) || result.action !== "local-login")
+        fail("turnstile_failed", 401);
+    } catch (e) {
+      if (e instanceof AccountError)
+        throw e;
+      fail("turnstile_failed", 401);
+    }
+  }
+  publicOrigin() {
+    const configured = this.host.managementOrigin;
+    if (!configured)
+      fail("management_origin_required", 503);
+    let url;
+    try {
+      url = new URL(configured);
+    } catch {
+      fail("management_origin_required", 503);
+    }
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== configured)
+      fail("management_origin_required", 503);
+    return url.origin;
+  }
+  returnPath(value) {
+    if (value === undefined)
+      return "/#/";
+    if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//") || value.includes("\\") || /[\x00-\x20]/.test(value) || value.length > 2048)
+      fail("invalid_return_to");
+    const u = new URL(value, this.publicOrigin());
+    if (u.origin !== this.publicOrigin())
+      fail("invalid_return_to");
+    return u.pathname + u.search + u.hash;
+  }
+  flowCookie(token, maxAge = 600) {
+    return `${FLOW_COOKIE}=${token}; Path=/api/auth/login/callback/; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${this.publicOrigin().startsWith("https:") ? "; Secure" : ""}`;
+  }
+  flows(records) {
+    return slots(records, "flow", MAX_FLOWS, (v) => {
+      if (v === null)
+        return null;
+      const f = v;
+      if (!f || Object.keys(f).some((k) => !["id", "state", "nonce", "verifierRef", "connectionId", "generation", "created", "expiresAt", "epoch", "returnTo", "status", "initiator", "subject", "issuer", "protocol"].includes(k)) || typeof f.id !== "string" || typeof f.state !== "string" || typeof f.nonce !== "string" || typeof f.verifierRef !== "string" || typeof f.connectionId !== "string" || !Number.isSafeInteger(f.generation) || !Number.isSafeInteger(f.created) || !Number.isSafeInteger(f.expiresAt) || !Number.isSafeInteger(f.epoch) || !["pending", "exchanging", "verified", "consumed"].includes(f.status) || typeof f.returnTo !== "string" || f.subject !== undefined && typeof f.subject !== "string" || f.issuer !== undefined && typeof f.issuer !== "string" || f.protocol !== undefined && !["oidc", "oauth2"].includes(f.protocol) || f.status === "verified" && (!f.subject || !f.issuer || !f.protocol) || f.initiator !== undefined && (!f.initiator || typeof f.initiator.userId !== "string" || typeof f.initiator.sessionDigest !== "string" || !Number.isSafeInteger(f.initiator.generation)))
+        fail("corrupt_state", 503);
+      return f;
+    });
+  }
+  loginProviders() {
+    return new LoginProviders(this.dependencies.fetch ?? fetch, this.host.signal);
+  }
+  async oidcConfig(connection) {
+    const secret = await this.readSecret(connection.secretRef);
+    if (!secret)
+      fail("oidc_unavailable", 503);
+    return this.loginProviders().configuration(connection, secret.value);
+  }
+  async loginOptions(_request) {
+    try {
+      this.alive();
+      const records = await this.records(), t = turnstile(records).value;
+      return json({ local: { enabled: true, turnstile: { enabled: t.enabled, ...t.enabled ? { siteKey: t.siteKey } : {} } }, methods: connections(records).filter((c) => c.enabled).map((c) => ({ id: c.id, label: c.label, provider: c.provider })) });
+    } catch (e) {
+      return safe(e);
+    }
+  }
+  async beginLogin(request) {
+    try {
+      this.alive();
+      origin(request, this.host.managementOrigin);
+      const b = await body(request);
+      exact(b, ["methodId", "returnTo"]);
+      return await this.startFlow(request, this.text(b.methodId, 64), this.returnPath(b.returnTo));
+    } catch (e) {
+      return safe(e);
+    }
+  }
+  async startFlow(request, methodId, returnTo, c) {
+    const publicOrigin = this.publicOrigin();
+    await this.reserve(["source:" + digest(this.source(request))]);
+    const connection = connections(await this.records()).find((c) => c.id === methodId && c.enabled);
+    if (!connection)
+      fail("oidc_unavailable", 401);
+    const config = await this.oidcConfig(connection), state = randomState(), nonce = randomNonce(), verifier = randomPKCECodeVerifier(), challenge = await calculatePKCECodeChallenge2(verifier), verifierRef = await this.storeSecret(verifier), id = randomUUID();
+    let replacedRef;
+    try {
+      await this.retry(async (time) => {
+        const guarded = c ? await this.guard(c, time) : undefined, records = guarded?.records ?? await this.records(), current = connections(records).find((x) => x.id === methodId), now = await time();
+        if (!current?.enabled || current.generation !== connection.generation)
+          fail("version_conflict", 409);
+        const slot = this.flows(records).find((s) => !s.value || s.value.expiresAt <= now || s.value.status === "consumed");
+        if (!slot)
+          fail("flow_limit", 429);
+        replacedRef = slot.value?.verifierRef;
+        const flow = { id, state, nonce, verifierRef, connectionId: methodId, generation: current.generation, created: now, expiresAt: now + 10 * 60000, epoch: settings(records).value.sessionEpoch, returnTo, status: "pending", ...guarded ? { initiator: { userId: guarded.user.id, generation: guarded.user.generation, sessionDigest: this.subjects.get(c.subject).digest } } : {} };
+        return { mutations: [mutation(slot, "flow", flow)], result: undefined };
+      });
+      const authorizationUrl = buildAuthorizationUrl(config, { redirect_uri: publicOrigin + "/api/auth/login/callback/" + methodId, scope: connection.scopes.join(" "), response_type: "code", code_challenge: challenge, code_challenge_method: "S256", state, ...connection.provider === "github" ? {} : { nonce } }).href;
+      return json({ authorizationUrl, flowId: id }, 200, { "set-cookie": this.flowCookie(state) });
+    } finally {
+      await this.discardUnpublishedSecret(verifierRef);
+      if (replacedRef)
+        await this.discardUnpublishedSecret(replacedRef);
+    }
+  }
+  async completeLogin(request) {
+    let verifierRef;
+    try {
+      this.alive();
+      const publicOrigin = this.publicOrigin(), incoming = new URL(request.url), methodId = incoming.pathname.split("/").at(-1), state = incoming.searchParams.get("state");
+      const cookies = (request.headers.get("cookie") ?? "").split(";").map((c) => c.trim()).filter((c) => c.startsWith(FLOW_COOKIE + "="));
+      if (!state || cookies.length !== 1 || !constant(cookies[0].slice(FLOW_COOKIE.length + 1), state))
+        fail("invalid_oidc_state", 401);
+      const flow = await this.retry(async (time) => {
+        const records = await this.records(), slot = this.flows(records).find((s) => s.value?.state === state), connection = connections(records).find((c) => c.id === methodId), now = await time(), f = slot?.value;
+        if (!slot || !f || f.connectionId !== methodId || f.status !== "pending" || f.epoch !== settings(records).value.sessionEpoch || f.expiresAt <= now || !connection?.enabled || connection.generation !== f.generation)
+          fail("invalid_oidc_flow", 401);
+        return { mutations: [mutation(slot, "flow", { ...f, status: "exchanging" })], result: { flow: f, connection } };
+      });
+      verifierRef = flow.flow.verifierRef;
+      const verifier = await this.readSecret(verifierRef);
+      if (!verifier)
+        fail("invalid_oidc_flow", 401);
+      const config = await this.oidcConfig(flow.connection);
+      const canonical = new URL(publicOrigin + "/api/auth/login/callback/" + methodId);
+      canonical.search = incoming.search;
+      const identityResult = await this.loginProviders().exchange(flow.connection, config, canonical, { pkceCodeVerifier: verifier.value, expectedState: state, expectedNonce: flow.flow.nonce });
+      const token = randomBytes2(32).toString("base64url");
+      const result = await this.retry(async (time) => {
+        const records = await this.records(), slot = this.flows(records).find((s) => s.value?.id === flow.flow.id), f = slot?.value, current = connections(records).find((c) => c.id === methodId), policy = (await this.readSessionPolicy()).policy, initiatingSession = f?.initiator ? await this.findSession(f.initiator.sessionDigest) : undefined, now = await time();
+        if (!slot || !f || f.status !== "exchanging" || f.epoch !== settings(records).value.sessionEpoch || f.expiresAt <= now || !current?.enabled || current.generation !== f.generation)
+          fail("invalid_oidc_flow", 401);
+        if (f.initiator) {
+          const u = users(records).find((u) => u.id === f.initiator.userId), session = initiatingSession;
+          if (!u || u.generation !== f.initiator.generation || !session?.value || !this.live(u, session.value, now, records))
+            fail("forbidden", 403);
+          return { mutations: [mutation(slot, "flow", { ...f, status: "verified", subject: identityResult.subject, issuer: identityResult.issuer, protocol: identityResult.protocol })], result: { link: true, returnTo: "/#/extensions/user-auth/profile?oidcLink=" + f.id } };
+        }
+        const id = digest(identityResult.issuer + "\x00" + identityResult.subject), binding = identities(records).find((i) => i.id === id), all = users(records);
+        let u = binding && all.find((u) => u.id === binding.userId);
+        const changes = [];
+        if (binding && !u)
+          fail("corrupt_state", 503);
+        if (binding && (binding.connectionId !== current.id || binding.protocol !== identityResult.protocol))
+          fail("identity_connection_mismatch", 401);
+        if (!u) {
+          if (!settings(records).value.autoCreateUsers)
+            fail("unknown_identity", 401);
+          if (all.length >= MAX_USERS || identities(records).length >= MAX_IDENTITIES)
+            fail("user_limit", 409);
+          const userId = randomUUID();
+          u = { id: userId, username: "sso-" + userId, displayName: identityResult.displayName, disabled: false, generation: 1, passwordHash: "", temporary: false };
+          changes.push(this.userMutation({ key: "user:" + userId, version: 0, value: null }, u));
+          const identity = { id, userId, connectionId: current.id, issuer: identityResult.issuer, subject: identityResult.subject, protocol: identityResult.protocol };
+          changes.push(mutation(entry(records, "identity:" + id, "identity", null), "identity", identity));
+        }
+        if (u.disabled)
+          fail("disabled_user", 401);
+        const sessions = slots(records, "session", MAX_SESSIONS, validateSession), session = sessions.find((s) => !s.value || !this.live(all.find((u) => u.id === s.value.administratorId) ?? null, s.value, now, records));
+        if (!session)
+          fail("session_limit", 429);
+        changes.push(mutation(session, "session", { digest: digest(token), administratorId: u.id, generation: u.generation, created: now, touched: now, transport: "cookie", policy, epoch: settings(records).value.sessionEpoch, connectionId: current.id, connectionGeneration: current.generation }), mutation(slot, "flow", { ...f, status: "consumed" }), this.audit(records, u.id, "oidc.login", now));
+        return { mutations: changes, result: { link: false, returnTo: f.returnTo, policy } };
+      });
+      const headers = new Headers({ location: new URL(result.returnTo, publicOrigin).href, "cache-control": "no-store" });
+      headers.append("set-cookie", this.flowCookie("", 0));
+      if (!result.link && result.policy)
+        headers.append("set-cookie", cookie(request, token, this.cookieAge(result.policy), publicOrigin));
+      return new Response(null, { status: 302, headers });
+    } catch (error) {
+      const code = error instanceof AccountError ? error.code : "oidc_failed";
+      await this.recordFailure("oidc.login", error);
+      try {
+        return new Response(null, { status: 302, headers: { location: this.publicOrigin() + "/#/login?oidcError=" + encodeURIComponent(code), "cache-control": "no-store", "set-cookie": this.flowCookie("", 0) } });
+      } catch {
+        return safe(error);
+      }
+    } finally {
+      if (verifierRef) {
+        try {
+          await this.deleteSecret(verifierRef);
+        } catch {}
+      }
+    }
+  }
+  async finishLink(c, id) {
+    return this.retry(async (time) => {
+      const { records, user } = await this.guard(c, time), slot = this.flows(records).find((s) => s.value?.id === id), f = slot?.value, now = await time(), connection = f && connections(records).find((x) => x.id === f.connectionId), issued = this.subjects.get(c.subject);
+      if (!slot || !f || f.status !== "verified" || f.epoch !== settings(records).value.sessionEpoch || f.expiresAt <= now || !f.subject || !f.issuer || !f.protocol || !f.initiator || f.initiator.userId !== user.id || f.initiator.generation !== user.generation || f.initiator.sessionDigest !== issued.digest || !connection?.enabled || connection.generation !== f.generation)
+        fail("invalid_oidc_flow", 401);
+      const identity = { id: digest(f.issuer + "\x00" + f.subject), userId: user.id, connectionId: connection.id, issuer: f.issuer, subject: f.subject, protocol: f.protocol };
+      if (identities(records).some((i) => i.id === identity.id))
+        fail("identity_exists", 409);
+      if (identities(records).length >= MAX_IDENTITIES)
+        fail("identity_limit", 409);
+      const u = records.find((r) => r.key === "user:" + user.id);
+      return { mutations: [mutation(entry(records, "identity:" + identity.id, "identity", null), "identity", identity), this.userMutation({ key: u.key, version: u.version, value: user }, { ...user, generation: next(user.generation) }), mutation(slot, "flow", { ...f, status: "consumed" }), this.audit(records, user.id, "identity.link", now)], result: json({ ok: true }) };
+    });
+  }
+}
+function createControl(host, dependencies = {}) {
+  return new UserAuthControl(host, dependencies);
+}
+var api = [
+  { path: "/password", methods: ["POST"], handler: "changePassword" },
+  { path: "/logout", methods: ["POST"], handler: "logout" },
+  { path: "/self", methods: ["GET"], handler: "self" },
+  { path: "/session-policy", methods: ["GET", "PUT"], handler: "sessionPolicy" },
+  ...[["/users", ["GET", "POST"], "users"], ["/users/update", ["PUT"], "updateUser"], ["/users/password", ["POST"], "resetUserPassword"], ["/identities", ["GET", "POST", "DELETE"], "identities"], ["/login-connections", ["GET", "POST", "PUT", "DELETE"], "loginConnections"], ["/login-connections/discover", ["POST"], "discoverLoginConnection"], ["/login-settings", ["GET", "PUT"], "loginSettings"], ["/turnstile", ["GET", "PUT"], "turnstile"], ["/identities/link/start", ["POST"], "beginIdentityLink"], ["/identities/link/finish", ["POST"], "finishIdentityLink"]].map(([path, methods, handler]) => ({ path, methods, handler }))
+];
+var rpc = [];
+var controlApi = api;
+var controlRpc = rpc;
+async function readManagementSetup(state) {
+  const records = await state.list(), setup = setupRecord(records);
+  slots(records, "session", MAX_SESSIONS, validateSession);
+  slots(records, "failure", MAX_FAILURES, validateFailure);
+  const policy = records.find((r) => r.key === "session-policy");
+  if (policy)
+    validateSessionPolicy(envelope(policy.value, "policy"), "corrupt_state", 503);
+  return { initialized: setup.value.phase === "ready" };
+}
+async function prepareInitialization(context) {
+  const state = context.durableState, now = context.now ?? Date.now;
+  for (let i = 0;i < 64; i++) {
+    const records = await state.list(), fresh = !records.length;
+    if (!fresh)
+      await readManagementSetup(state);
+    const setup = fresh ? undefined : setupRecord(records);
+    if (setup?.value.phase === "ready")
+      fail("already_initialized", 409);
+    const clock = fresh ? { version: 0, value: wallTime(now) } : await observeClock(state, now), code = randomBytes2(32).toString("base64url"), expiresAt = clock.value + 30 * 60000;
+    try {
+      await state.transact([{ key: "setup", expectedVersion: setup?.version ?? 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, setup: { phase: "uninitialized", code: { digest: digest(code), expiresAt } } }) }, clockMutation(clock)]);
+      return { code, expiresAt };
+    } catch (e) {
+      if (!isDurableStateConflictError(e))
+        throw e;
+    }
+  }
+  return fail("version_conflict", 409);
+}
+async function recoverIdentity(input, context) {
+  const b = object(input);
+  exact(b, ["operation", "username", "password", "passwordConfirmation", "reason", "disableTurnstile"]);
+  if (b.operation !== "reset" || b.disableTurnstile !== undefined && !["", "yes", "no"].includes(b.disableTurnstile))
+    fail("invalid_input");
+  const name = username(b.username), p = password(b.password);
+  if (b.passwordConfirmation !== p)
+    fail("password_confirmation");
+  if (typeof b.reason !== "string" || !b.reason.trim() || b.reason.length > 512)
+    fail("invalid_reason");
+  const state = context.durableState, now = context.now ?? Date.now, hash = await Bun.password.hash(p, { algorithm: "argon2id", memoryCost: 65536, timeCost: 3 });
+  for (let i = 0;i < 64; i++) {
+    const records = await state.list();
+    validateKeys(records);
+    const anchor = records.find((r) => r.key === "recovery-anchor");
+    let anchorId;
+    if (anchor) {
+      const id = envelope(anchor.value, "userId");
+      if (typeof id !== "string" || !/^[a-f0-9-]{36}$/.test(id))
+        fail("corrupt_state", 503);
+      anchorId = id;
+    }
+    for (const r of records)
+      if (r.value?.schema !== ACCOUNT_RECORD_SCHEMA)
+        fail("corrupt_state", 503);
+    const id = anchorId ?? randomUUID(), record = records.find((r) => r.key === "user:" + id);
+    let prior;
+    if (record) {
+      try {
+        prior = validateUser(envelope(record.value, "user"));
+      } catch (error) {
+        if (!(error instanceof AccountError))
+          throw error;
+      }
+    }
+    const other = records.filter((r) => r.key.startsWith("user:") && r.key !== "user:" + id).map((r) => validateUser(envelope(r.value, "user")));
+    if (other.some((u) => u.username === name))
+      fail("username_exists", 409);
+    const s = settings(records), turn = turnstile(records), clockRecord = records.find((r) => r.key === "clock");
+    let observed = 0;
+    try {
+      observed = clockValue(clockRecord);
+    } catch (error) {
+      if (!(error instanceof AccountError))
+        throw error;
+    }
+    const at = Math.max(observed, wallTime(now)), user = { id, username: name, displayName: prior?.displayName ?? name, disabled: false, generation: next(prior?.generation ?? 0) }, credential = records.find((r) => r.key === "credential:" + id);
+    const failures = slots(records, "failure", MAX_FAILURES, validateFailure);
+    slots(records, "session", MAX_SESSIONS, validateSession);
+    connections(records);
+    identities(records);
+    const changes = [
+      { key: "user:" + id, expectedVersion: record?.version ?? 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, user }) },
+      { key: "credential:" + id, expectedVersion: credential?.version ?? 0, value: { schema: ACCOUNT_RECORD_SCHEMA, credential: { passwordHash: hash, temporary: false } } },
+      { key: "recovery-anchor", expectedVersion: anchor?.version ?? 0, value: { schema: ACCOUNT_RECORD_SCHEMA, userId: id } },
+      { key: "setup", expectedVersion: records.find((r) => r.key === "setup")?.version ?? 0, value: { schema: ACCOUNT_RECORD_SCHEMA, setup: { phase: "ready" } } },
+      { key: "clock", expectedVersion: clockRecord?.version ?? 0, value: { schema: ACCOUNT_RECORD_SCHEMA, observedThrough: at } },
+      mutation(s, "settings", { ...s.value, sessionEpoch: next(s.value.sessionEpoch), failureEpoch: next(Math.max(s.value.failureEpoch, ...failures.map((f) => f.value?.epoch ?? 0))) }),
+      { key: "recovery-summary", expectedVersion: records.find((r) => r.key === "recovery-summary")?.version ?? 0, value: { schema: ACCOUNT_RECORD_SCHEMA, userId: id, reason: b.reason, at } },
+      mutation(turn, "turnstile", { ...turn.value, ...b.disableTurnstile === "yes" ? { enabled: false } : {} })
+    ];
+    try {
+      await state.transact(changes);
+      return dto({ ...user, passwordHash: hash, temporary: false });
+    } catch (e) {
+      if (!isDurableStateConflictError(e))
+        throw e;
+    }
+  }
+  return fail("version_conflict", 409);
+}
+var control_default = { createControl, readManagementSetup, offlineRecovery: {
+  kind: "identity",
+  prepareInitialization,
+  prompts: [{ name: "username", label: "Recovery username", secret: false }, { name: "password", label: "New password", secret: true }, { name: "passwordConfirmation", label: "Confirm password", secret: true }, { name: "reason", label: "Recovery reason", secret: false }, { name: "disableTurnstile", label: "Disable Turnstile? Type yes to disable; default no", secret: false }],
+  recover: recoverIdentity
+} };
+export {
+  ACCOUNT_RECORD_SCHEMA,
+  LoginProviders,
+  MAX_FAILURES,
+  MAX_SESSIONS,
+  UserAuthControl,
+  api,
+  controlApi,
+  controlRpc,
+  createControl,
+  control_default as default,
+  parseProvider,
+  prepareInitialization,
+  providerUrl,
+  readManagementSetup,
+  recoverIdentity,
+  rpc
+};
+
+//# debugId=5FEFB6DCD014AEAE64756E2164756E21