@tempoxyz/id 0.0.0-pr-232.sha-e4f25eb → 0.0.0-pr-236.sha-9cac32e

package/dist/app/server/assets/{authorize-C95F-9E1-b9zG-W8w.js → authorize-C95F-9E1-D4G4zT66.js}

@@ -27,5 +27,5 @@ import{r as e}from"./rolldown-runtime-B0Z9INg1.js";import{Zt as t}from"./core-B1
     <\/script>
 	  <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"><\/script>
   </body>
-</html>`,jo=(()=>{let e=function(){};return e.prototype=Object.create(null),Object.freeze(e.prototype),e})();function Mo(){return{root:{key:``},static:new jo}}function No(e){let t=0,n=0;for(;t<e.length;t++){let r=e.charCodeAt(t);if(r===92)t++;else if(r===40)n++;else if(r===41&&n>0)n--;else if(r===123&&n===0)break}if(t>=e.length)return;let r=t+1;for(n=0;r<e.length;r++){let t=e.charCodeAt(r);if(t===92)r++;else if(t===40)n++;else if(t===41&&n>0)n--;else if(t===125&&n===0)break}if(r>=e.length)return;let i=e[r+1],a=i===`?`||i===`+`||i===`*`;return[e.slice(0,t),e.slice(t+1,r),e.slice(r+(a?2:1)),a?i:void 0]}function Po(e){if(!e.includes(`{`))return;let t=No(e);if(!t)return;let[n,r,i,a]=t;if(!a)return[n+r+i];if(a===`?`)return[n+r+i,n+i];if(r.includes(`/`))throw Error(`unsupported group repetition across segments`);return[`${n}(?:${r})${a}${i}`]}var Fo=`__rou3_unnamed_`,Io=`__rou3_esc_`;function Lo(e){return`${Fo}${e}`}function Ro(e){return/^(?!__rou3_|_\d)[A-Za-z_]\w*$/.test(e)?e:Io+e.replace(/[_-]/g,e=>e===`_`?`__`:`_h`)}function zo(e){return e.charCodeAt(0)===95?e.startsWith(`__rou3_esc_`)?e.slice(11).replace(/__|_h/g,e=>e===`__`?`_`:`-`):e.startsWith(`__rou3_unnamed_`)?e.slice(15):e:e}function Bo(e){let t=0;for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);if(r===92)n++;else if(r===40)t++;else if(r===41&&t>0)t--;else if(r===42&&t===0)return!0}return!1}function Vo(e,t,n=Lo){let r=0,i=t,a=``;for(let t=0;t<e.length;t++){let o=e.charCodeAt(t);o===92?(a+=e[t],t+1<e.length&&(a+=e[++t])):o===40?(r++,a+=e[t]):o===41&&r>0?(r--,a+=e[t]):a+=o===42&&r===0?`(?<${n(i++)}>[^/]*)`:e[t]}return[a,i]}function Ho(e){return e.includes(`\\`)?e.replace(/\\([:(){}])/g,(e,t)=>`�`+`ABCDE`[`:(){}`.indexOf(t)]):e}function Uo(e){return e.startsWith(`**`)?2:e===`*`||e.includes(`:`)||e.includes(`(`)||Bo(e)?1:e===`\\*`?`*`:e===`\\*\\*`?`**`:e.includes(`�`)?e.replace(/\uFFFD([A-E])/g,(e,t)=>t===`A`?`:`:t===`B`?`(`:t===`C`?`)`:t===`D`?`{`:`}`):e}function Wo(e){for(let t=0;t<e.length;t++){let n=e[t].charCodeAt(e[t].length-1);if(n!==63&&n!==43&&n!==42)continue;let r=e[t].match(/^(.*:[\w-]+(?:\([^)]*\))?)([?+*])$/);if(!r)continue;let i=e.slice(0,t),a=e.slice(t+1);if(r[2]===`?`)return[`/`+i.concat(r[1]).concat(a).join(`/`),`/`+i.concat(a).join(`/`)];let o=r[1].match(/:([\w-]+)/)?.[1]||`_`,s=`/`+[...i,`**:${o}`,...a].join(`/`),c=`/`+[...i,...a].join(`/`);return r[2]===`+`?[s]:[s,c]}}function Go(e){if(!e.includes(`/.`))return e;let t=[];for(let n of e.split(`/`))if(n===`.`)continue;else n===`..`&&t.length>1?t.pop():t.push(n);return t.join(`/`)||`/`}function Ko(e){let t=e.split(`/`);return t.shift(),t[t.length-1]===``&&t.pop(),t}function qo(e){let t=Ko(e);for(;t[t.length-1]===``;)t.pop();return t}function Jo(e,t){let n=new jo;for(let[r,i]of t){let t=r<0?e.slice(-(r+1)).join(`/`):e[r];if(typeof i==`string`)n[i]=t;else{let e=t.match(i);if(e)for(let t in e.groups)n[zo(t)]=e.groups[t]}}return n}function Yo(e,t=``,n,r){t=t.toUpperCase(),n.charCodeAt(0)!==47&&(n=`/${n}`);let i=Po(n);if(i){for(let n of i)Yo(e,t,n,r);return}n=Ho(n);let a=qo(n),o=Wo(a);if(o){for(let n of o)Yo(e,t,n,r);return}let s=e.root,c=0,l=[],u=[];for(let e=0;e<a.length;e++){let t=a[e],n=Uo(t);if(n===2){s.wildcard||(s.wildcard={key:`**`}),s=s.wildcard,l.push([-(e+1),t.split(`:`)[1]||`_`,t.length===2]);break}if(n===1){if(s.param||(s.param={key:`*`}),s=s.param,t===`*`)l.push([e,String(c++),!0]);else if(t.includes(`(`)||t.includes(`:`,1)||!/^:[\w-]+$/.test(t)){let[n,r]=Xo(t,c);c=r,u[e]=n,s.hasRegexParam=!0,l.push([e,n,!1])}else l.push([e,t.slice(1),!1]);continue}t=a[e]=n;let r=s.static?.[t];if(r)s=r;else{let e={key:t};s.static||(s.static=new jo),s.static[t]=e,s=e}}let d=l.length>0,f=s.methods??=new jo;(f[t]??=[]).push({data:r||null,paramsRegexp:u,paramsMap:d?l:void 0}),d||(e.static[`/`+a.join(`/`)]=s)}function Xo(e,t=0){let n=t,r=``,i=0;for(let t=0;t<e.length;t++){let n=e.charCodeAt(t);if(n===40)i++;else if(n===41&&i>0)i--;else if(n===92&&i===0&&t+1<e.length){let n=e[t+1];if(n!==`:`&&n!==`(`&&n!==`*`&&n!==`\\`){r+=`￾`+n,t++;continue}}else if(n===46&&i===0){r+=`\\.`;continue}r+=e[t]}[r,n]=Vo(r,n);let a=r.replace(/:([\w-]+)(?:\(([^)]*)\))?/g,(e,t,n)=>`(?<${Ro(t)}>${n||`[^/]+`})`).replace(/\((?![?<])/g,()=>`(?<${Lo(n++)}>`).replace(/\uFFFE(.)/g,(e,t)=>/[.*+?^${}()|[\]\\]/.test(t)?`\\${t}`:t);return[RegExp(`^${a}$`),n]}function Zo(e,t=``,n,r){r?.normalize&&(n=Go(n)),n.charCodeAt(n.length-1)===47&&(n=n.slice(0,-1));let i=e.static[n];if(i&&i.methods){let e=i.methods[t]||i.methods[``];if(e!==void 0)return e[0]}let a=Ko(n),o=Qo(e.root,t,a,0);if(o!==void 0)return r?.params===!1?o:{data:o.data,params:o.paramsMap?Jo(a,o.paramsMap):void 0}}function Qo(e,t,n,r){if(r===n.length){if(e.methods){let r=$o(e.methods,t,n,e.key===`*`,!1);if(r)return r}return e.param?.methods&&$o(e.param.methods,t,n,!0,!0)||e.wildcard?.methods&&$o(e.wildcard.methods,t,n,!0,!0)||void 0}let i=n[r];if(e.static){let a=e.static[i];if(a){let e=Qo(a,t,n,r+1);if(e)return e}}if(e.param){let i=Qo(e.param,t,n,r+1);if(i)return i}if(e.wildcard&&e.wildcard.methods)return $o(e.wildcard.methods,t,n,!0,!1)}function $o(e,t,n,r,i){let a=e[t]||e[``];if(!a)return;let o=a[0];if(a.length===1&&o.paramsRegexp.length===0){if(!i)return o;let e=o.paramsMap;return e?.[e.length-1]?.[2]?o:void 0}let s,c=-1;for(let e of a){let t=e.paramsMap,a=t?.[t.length-1]?.[2];if(i&&!a)continue;let o=r&&t&&!a?1:0,l=e.paramsRegexp;for(let e=0;e<l.length;e++)if(l[e]){if(!l[e].test(n[e])){o=-1;break}o++}o>c&&(s=e,c=o)}return s}function es(e,t=``,n,r){r?.normalize&&(n=Go(n)),n.charCodeAt(n.length-1)===47&&(n=n.slice(0,-1));let i=Ko(n),a=ts(e.root,t,i,0);return r?.params===!1?a:a.map(e=>({data:e.data,params:e.paramsMap?Jo(i,e.paramsMap):void 0}))}function ts(e,t,n,r,i=[]){let a=n[r];if(e.wildcard&&e.wildcard.methods){let a=e.wildcard.methods[t]||e.wildcard.methods[``];if(a){if(r<n.length)ns(i,a,!0);else{let e=[];for(let t of a){let n=t.paramsMap;n?.[n.length-1]?.[2]&&e.push(t)}ns(i,e,!0)}}}if(e.param){if(r<n.length){let o=i.length;if(ts(e.param,t,n,r+1,i),e.param.hasRegexParam)for(let e=i.length-1;e>=o;e--)i[e].paramsRegexp[r]?.test(a)===!1&&i.splice(e,1)}else if(e.param.methods){let n=e.param.methods[t]||e.param.methods[``];if(n){let e=[];for(let t of n){let n=t.paramsMap;n?.[n.length-1]?.[2]&&e.push(t)}ns(i,e,!0)}}}if(r<n.length){let o=e.static?.[a];o&&ts(o,t,n,r+1,i)}if(r===n.length&&e.methods){let n=e.methods[t]||e.methods[``];n&&ns(i,n,e.key===`*`)}return i}function ns(e,t,n){t.length>1&&(t=t.map(e=>{let t=0,{paramsRegexp:r,paramsMap:i}=e;for(let e=0;e<r.length;e++)r[e]&&t++;return n&&i&&!i[i.length-1][2]&&t++,[e,t]}).sort((e,t)=>e[1]-t[1]).map(e=>e[0]));for(let n of t)e.push(n)}var rs=(e,t)=>{if(!t?.openapi?.disabled){let n={path:`/api/reference`,...t?.openapi};e.openapi=xo(n.path,{method:`GET`},async t=>{let r=await ko(e);return new Response(Ao(r,n.scalar),{headers:{"Content-Type":`text/html`}})})}let n=Mo(),r=Mo();for(let t of Object.values(e)){if(!t.options||!t.path||t.options?.metadata?.SERVER_ONLY)continue;let e=Array.isArray(t.options?.method)?t.options.method:[t.options?.method];for(let r of e)Yo(n,r,t.path,t)}if(t?.routerMiddleware?.length)for(let{path:e,middleware:n}of t.routerMiddleware)Yo(r,`*`,e,n);let i=t?.basePath&&t.basePath!==`/`?t.basePath.replace(/\/+$/,``):``,a=async e=>{let a=new URL(e.url),o=a.pathname,s;if(i){if(!o.startsWith(`${i}/`))return new Response(null,{status:404,statusText:`Not Found`});s=o.slice(i.length)}else s=o;if(s.length===0||/\/{2,}/.test(s))return new Response(null,{status:404,statusText:`Not Found`});let c=Zo(n,e.method,s);if(s.endsWith(`/`)!==c?.data?.path?.endsWith(`/`)&&!t?.skipTrailingSlashes||!c?.data)return new Response(null,{status:404,statusText:`Not Found`});let l={};a.searchParams.forEach((e,t)=>{t in l?Array.isArray(l[t])?l[t].push(e):l[t]=[l[t],e]:l[t]=e});let u=c.data;try{let n=u.options.metadata?.allowedMediaTypes||t?.allowedMediaTypes,i={path:s,method:e.method,headers:e.headers,params:c.params?{...c.params}:{},request:e,body:u.options.disableBody?void 0:await Qa(u.options.cloneRequest?e.clone():e,n),query:l,_flag:`router`,asResponse:!0,context:t?.routerContext},a=es(r,`*`,s);if(a?.length)for(let{data:e,params:t}of a){let n=await e({...i,params:t?{...t}:{},asResponse:!1});if(n instanceof Response)return n}return await u(i)}catch(n){if(t?.onError)try{let r=await t.onError(n,e);if(r instanceof Response)return bo(r)}catch(e){if($a(e))return bo(e);throw e}if(t?.throwError)throw n;return $a(n)?bo(n):(console.error(`# SERVER_ERROR: `,n),new Response(null,{status:500,statusText:`Internal Server Error`}))}};return{handler:async e=>{let n=await t?.onRequest?.(e);if(n instanceof Response)return n;let r=no(n)?n:e,i=await a(r),o=await t?.onResponse?.(i,r);return o instanceof Response?o:i},endpoints:e}};function is(e){return Object.fromEntries(Object.entries(e).map(([e,t])=>[e,{code:e,message:t,toString:()=>e}]))}var as=is({USER_NOT_FOUND:`User not found`,FAILED_TO_CREATE_USER:`Failed to create user`,FAILED_TO_CREATE_SESSION:`Failed to create session`,FAILED_TO_UPDATE_USER:`Failed to update user`,FAILED_TO_GET_SESSION:`Failed to get session`,INVALID_PASSWORD:`Invalid password`,INVALID_EMAIL:`Invalid email`,INVALID_EMAIL_OR_PASSWORD:`Invalid email or password`,INVALID_USER:`Invalid user`,SOCIAL_ACCOUNT_ALREADY_LINKED:`Social account already linked`,PROVIDER_NOT_FOUND:`Provider not found`,INVALID_TOKEN:`Invalid token`,TOKEN_EXPIRED:`Token expired`,ID_TOKEN_NOT_SUPPORTED:`id_token not supported`,FAILED_TO_GET_USER_INFO:`Failed to get user info`,USER_EMAIL_NOT_FOUND:`User email not found`,EMAIL_NOT_VERIFIED:`Email not verified`,PASSWORD_TOO_SHORT:`Password too short`,PASSWORD_TOO_LONG:`Password too long`,USER_ALREADY_EXISTS:`User already exists.`,USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL:`User already exists. Use another email.`,EMAIL_CAN_NOT_BE_UPDATED:`Email can not be updated`,CHANGE_EMAIL_DISABLED:`Change email is disabled`,CREDENTIAL_ACCOUNT_NOT_FOUND:`Credential account not found`,SESSION_EXPIRED:`Session expired. Re-authenticate to perform this action.`,FAILED_TO_UNLINK_LAST_ACCOUNT:`You can't unlink your last account`,ACCOUNT_NOT_FOUND:`Account not found`,USER_ALREADY_HAS_PASSWORD:`User already has a password. Provide that to delete the account.`,CROSS_SITE_NAVIGATION_LOGIN_BLOCKED:`Cross-site navigation login blocked. This request appears to be a CSRF attack.`,VERIFICATION_EMAIL_NOT_ENABLED:`Verification email isn't enabled`,EMAIL_ALREADY_VERIFIED:`Email is already verified`,EMAIL_MISMATCH:`Email mismatch`,SESSION_NOT_FRESH:`Session is not fresh`,LINKED_ACCOUNT_ALREADY_EXISTS:`Linked account already exists`,INVALID_ORIGIN:`Invalid origin`,INVALID_CALLBACK_URL:`Invalid callbackURL`,INVALID_REDIRECT_URL:`Invalid redirectURL`,INVALID_ERROR_CALLBACK_URL:`Invalid errorCallbackURL`,INVALID_NEW_USER_CALLBACK_URL:`Invalid newUserCallbackURL`,MISSING_OR_NULL_ORIGIN:`Missing or null Origin`,CALLBACK_URL_REQUIRED:`callbackURL is required`,FAILED_TO_CREATE_VERIFICATION:`Unable to create verification`,FIELD_NOT_ALLOWED:`Field not allowed to be set`,ASYNC_VALIDATION_NOT_SUPPORTED:`Async validation is not supported`,VALIDATION_ERROR:`Validation Error`,MISSING_FIELD:`Field is required`,METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED:`POST method requires deferSessionRefresh to be enabled in session config`,BODY_MUST_BE_AN_OBJECT:`Body must be an object`,PASSWORD_ALREADY_SET:`User already has a password set`});function os(e){return Array.isArray(e)?e.map(e=>typeof e==`string`?e.trim():``).filter(Boolean):typeof e==`string`?e.trim().split(/\s+/).filter(Boolean):[]}function ss(e){let t=e=>new Date(new Date().getTime()+e*1e3);return{tokenType:e.token_type,accessToken:e.access_token,refreshToken:e.refresh_token,accessTokenExpiresAt:e.expires_in?t(e.expires_in):void 0,refreshTokenExpiresAt:e.refresh_token_expires_in?t(e.refresh_token_expires_in):void 0,scopes:os(e.scope),idToken:e.id_token,raw:e}}function cs(e,t){let n=e?e.split(`,`).map(e=>e.trim()).filter(Boolean):[],r=(t??[]).map(e=>e.trim()).filter(Boolean);return[...new Set([...n,...r])].join(`,`)}function ls(e){let t=Array.isArray(e)?e[0]:e;return typeof t==`string`&&t.length>0?t:void 0}async function us(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest(`SHA-256`,t);return ve.encode(new Uint8Array(n),{padding:!1})}var ds=/^Basic +(.*)$/i;function fs(e){return new URLSearchParams({v:e}).toString().slice(2)}function ps(e){let t=new URLSearchParams(`v=${e}`).get(`v`);if(t===null)throw Error(`form-url-encoded value could not be decoded`);return t}function ms(e,t){let n=`${fs(e)}:${fs(t)}`;return`Basic ${te.encode(n)}`}function hs(e){let t=e.match(ds);if(!t)throw Error(`Authorization header is not a Basic credential`);let n=t[1]??``,r=new TextDecoder().decode(te.decode(n)),i=r.indexOf(`:`);if(i===-1)throw Error(`Basic credential is missing the client id/secret separator`);let a=r.slice(0,i),o=r.slice(i+1);if(!a||!o)throw Error(`Basic credential client id and secret must both be non-empty`);return{clientId:ps(a),clientSecret:ps(o)}}var gs=[`RS256`,`RS384`,`RS512`,`PS256`,`PS384`,`PS512`,`ES256`,`ES384`,`ES512`,`EdDSA`],_s=`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`;async function vs({getClientAssertion:e,context:t}){return{client_assertion:await e(t),client_assertion_type:_s}}var ys=class extends Error{constructor(e,t,n){super(t||e.toString(),{cause:n}),this.status=e,this.statusText=t,this.error=n,Error.captureStackTrace(this,this.constructor)}},bs=async(e,t)=>{let n=t||{},r={onRequest:[t?.onRequest],onResponse:[t?.onResponse],onSuccess:[t?.onSuccess],onError:[t?.onError],onRetry:[t?.onRetry]};if(!t||!t?.plugins)return{url:e,options:n,hooks:r};for(let i of t?.plugins||[]){if(i.init){let t=await i.init?.call(i,e.toString(),n);n=t.options||n,e=t.url}r.onRequest.push(i.hooks?.onRequest),r.onResponse.push(i.hooks?.onResponse),r.onSuccess.push(i.hooks?.onSuccess),r.onError.push(i.hooks?.onError),r.onRetry.push(i.hooks?.onRetry)}return{url:e,options:n,hooks:r}},xs=class{constructor(e){this.options=e}shouldAttemptRetry(e,t){return this.options.shouldRetry?Promise.resolve(e<this.options.attempts&&this.options.shouldRetry(t)):Promise.resolve(e<this.options.attempts)}getDelay(){return this.options.delay}},Ss=class{constructor(e){this.options=e}shouldAttemptRetry(e,t){return this.options.shouldRetry?Promise.resolve(e<this.options.attempts&&this.options.shouldRetry(t)):Promise.resolve(e<this.options.attempts)}getDelay(e){return Math.min(this.options.maxDelay,this.options.baseDelay*2**e)}};function Cs(e){if(typeof e==`number`)return new xs({type:`linear`,attempts:e,delay:1e3});switch(e.type){case`linear`:return new xs(e);case`exponential`:return new Ss(e);default:throw Error(`Invalid retry strategy`)}}var ws=[`get`,`post`,`put`,`patch`,`delete`];function Ts(e){if(!e.startsWith(`@`))return{method:void 0,path:e};let t=e.indexOf(`/`),n=e.slice(1,t===-1?void 0:t);return ws.includes(n)?{method:n,path:t===-1?e:e.slice(t+1)}:{method:void 0,path:e}}var Es=e=>e===`.`||e===`..`,Ds=e=>e.split(`:`).map(e=>encodeURIComponent(e)).join(`:`);function Os(e,t){let n=t.get(e);if(n===void 0)return Ds(e);if(Es(n))throw TypeError(`Path parameters cannot be reserved path segments`);return encodeURIComponent(n)}function ks(e,t){let{baseURL:n,params:r,query:i}=t||{query:{},params:{},baseURL:``},a=e.startsWith(`http`)?e.split(`/`).slice(0,3).join(`/`):n||``,{path:o}=Ts(e);o!==e&&(e=`/${o}`),a.endsWith(`/`)||(a+=`/`);let[s,c]=e.replace(a,``).split(`?`),l=new URLSearchParams(c);for(let[e,t]of Object.entries(i||{})){if(t==null)continue;let n;if(typeof t==`string`)n=t;else if(Array.isArray(t)){for(let n of t)l.append(e,n);continue}else n=JSON.stringify(t);l.set(e,n)}let u=new Map;if(r){if(Array.isArray(r)){let e=s.split(`/`).filter(e=>e.startsWith(`:`));for(let[t,n]of e.entries()){let e=r[t];u.set(n,String(e))}}else for(let[e,t]of Object.entries(r))u.set(`:${e}`,String(t))}s=s.split(`/`).map(e=>Os(e,u)).join(`/`),s=s.replace(/^\/+/,``);let d=l.toString();return d=d.length>0?`?${d}`.replace(/\+/g,`%20`):``,a.startsWith(`http`)?new URL(`${s}${d}`,a):`${a}${s}${d}`}var As=async e=>{let t={},n=async e=>typeof e==`function`?await e():e;if(e?.auth){if(e.auth.type===`Bearer`){let r=await n(e.auth.token);if(!r)return t;t.authorization=`Bearer ${r}`}else if(e.auth.type===`Basic`){let[r,i]=await Promise.all([n(e.auth.username),n(e.auth.password)]);if(!r||!i)return t;t.authorization=`Basic ${btoa(`${r}:${i}`)}`}else if(e.auth.type===`Custom`){let[r,i]=await Promise.all([n(e.auth.prefix),n(e.auth.value)]);if(!i)return t;t.authorization=`${r??``} ${i}`}}return t},js=/^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;function Ms(e){let t=e.headers.get(`content-type`),n=new Set([`image/svg`,`application/xml`,`application/xhtml`,`application/html`]);if(!t)return`json`;let r=t.split(`;`).shift()||``;return js.test(r)?`json`:n.has(r)||r.startsWith(`text/`)?`text`:`blob`}function Ns(e){try{return JSON.parse(e),!0}catch{return!1}}function Ps(e){if(e===void 0)return!1;let t=typeof e;return t===`string`||t===`number`||t===`boolean`||t===null?!0:t===`object`?Array.isArray(e)?!0:e.buffer?!1:e.constructor&&e.constructor.name===`Object`||typeof e.toJSON==`function`:!1}function Fs(e){try{return JSON.parse(e)}catch{return e}}function Is(e){return typeof e==`function`}function Ls(e){if(e?.customFetchImpl)return e.customFetchImpl;if(typeof globalThis<`u`&&Is(globalThis.fetch))return globalThis.fetch;if(typeof window<`u`&&Is(window.fetch))return window.fetch;throw Error(`No fetch implementation found`)}function Rs(...e){let t={};for(let n of e)if(n){if(n instanceof Headers)n.forEach((e,n)=>{t[n]=e});else{let e=Array.isArray(n)?n:Object.entries(n);for(let[n,r]of e)r!=null&&(t[n]=r)}}return t}async function zs(e){let t=new Headers(Rs(e?.headers,await As(e)));if(!t.has(`content-type`)){let n=Bs(e?.body);n&&t.set(`content-type`,n)}return t}function Bs(e){return Ps(e)?`application/json`:null}function Vs(e){let t=e.get(`content-type`);return t?t.split(`;`)[0].trim().toLowerCase():null}function Hs(e,t){let{body:n}=e;return n?!Ps(n)||typeof n==`string`?n:Vs(t)===`application/x-www-form-urlencoded`?new URLSearchParams(n).toString():JSON.stringify(n):null}function Us(e,t){if(t?.method)return t.method.toUpperCase();let{method:n}=Ts(e);return n?n.toUpperCase():t?.body?`POST`:`GET`}function Ws(e,t){let n;return!e?.signal&&e?.timeout&&(n=setTimeout(()=>t?.abort(),e?.timeout)),{abortTimeout:n,clearTimeout:()=>{n&&clearTimeout(n)}}}var Gs=class e extends Error{constructor(t,n){super(n||JSON.stringify(t,null,2)),this.issues=t,Object.setPrototypeOf(this,e.prototype)}};async function Ks(e,t){let n=await e[`~standard`].validate(t);if(n.issues)throw new Gs(n.issues);return n.value}function qs(e){"@babel/helpers - typeof";return qs=typeof Symbol==`function`&&typeof Symbol.iterator==`symbol`?function(e){return typeof e}:function(e){return e&&typeof Symbol==`function`&&e.constructor===Symbol&&e!==Symbol.prototype?`symbol`:typeof e},qs(e)}function Js(e,t){if(qs(e)!=`object`||!e)return e;var n=e[Symbol.toPrimitive];if(n!==void 0){var r=n.call(e,t||`default`);if(qs(r)!=`object`)return r;throw TypeError(`@@toPrimitive must return a primitive value.`)}return(t===`string`?String:Number)(e)}function Ys(e){var t=Js(e,`string`);return qs(t)==`symbol`?t:t+``}function Xs(e,t,n){return(t=Ys(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Zs(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,r)}return n}function Qs(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]==null?{}:arguments[t];t%2?Zs(Object(n),!0).forEach(function(t){Xs(e,t,n[t])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Zs(Object(n)).forEach(function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))})}return e}var $s=async(e,t)=>{var n;let{hooks:r,url:i,options:a}=await bs(e,t),o=Ls(a),s=new AbortController,c=a.signal??s.signal,l=ks(i,a),u=await zs(a),d=Hs(a,u),f=Us(i,a),p=Qs(Qs({},a),{},{url:l,headers:u,body:d,method:f,signal:c});for(let e of r.onRequest)if(e){let t=await e(p);typeof t==`object`&&t&&Object.assign(p,t)}(`pipeTo`in p&&typeof p.pipeTo==`function`||typeof(t==null||(n=t.body)==null?void 0:n.pipe)==`function`)&&(`duplex`in p||(p.duplex=`half`));let{clearTimeout:m}=Ws(a,s),h=await o(p.url,p);m();let g={response:h,request:p};for(let e of r.onResponse)if(e){var _;let n=await e(Qs(Qs({},g),{},{response:t!=null&&(_=t.hookOptions)!=null&&_.cloneResponse?h.clone():h}));n instanceof Response?h=n:typeof n==`object`&&n&&(h=n.response)}if(h.ok){if(p.method===`HEAD`)return{data:``,error:null};let e=Ms(h),n={data:null,response:h,request:p};if(e===`json`||e===`text`){let e=await h.text();n.data=await(p.jsonParser??Fs)(e)}else n.data=await h[e]();p?.output&&p.output&&!p.disableValidation&&(n.data=await Ks(p.output,n.data));for(let e of r.onSuccess)if(e){var v;await e(Qs(Qs({},n),{},{response:t!=null&&(v=t.hookOptions)!=null&&v.cloneResponse?h.clone():h}))}return t?.throw?n.data:{data:n.data,error:null}}let y=t?.jsonParser??Fs,b=await h.text(),x=Ns(b),S=x?await y(b):null,C={response:h,responseText:b,request:p,error:Qs(Qs({},S),{},{status:h.status,statusText:h.statusText})};for(let e of r.onError)if(e){var w;await e(Qs(Qs({},C),{},{response:t!=null&&(w=t.hookOptions)!=null&&w.cloneResponse?h.clone():h}))}if(t?.retry){let n=Cs(t.retry),i=t.retryAttempt??0;if(await n.shouldAttemptRetry(i,h)){for(let e of r.onRetry)e&&await e(g);let a=n.getDelay(i);return await new Promise(e=>setTimeout(e,a)),await $s(e,Qs(Qs({},t),{},{retryAttempt:i+1}))}}if(t?.throw)throw new ys(h.status,h.statusText,x?S:b);return{data:null,error:Qs(Qs({},S),{},{status:h.status,statusText:h.statusText})}},ec=new Set([301,302,303,307,308]);function tc(e){return e.type===`opaqueredirect`||ec.has(e.status)}function nc(e){return new V(`The OAuth endpoint "${e}" returned an HTTP redirect. Server-side OAuth fetches refuse redirects to prevent SSRF; configure the final endpoint URL.`)}var rc={redirect:`manual`};async function ic(e,t){let n=!1,r=t?.onError,i=await $s(e,{...t,...rc,async onError(e){tc(e.response)&&(n=!0),await r?.(e)}}).catch(t=>{throw n?nc(e):t});if(n)throw nc(e);return i}var ac=`dpop+jwt`,oc=[`EdDSA`,`ES256`,`ES512`,`PS256`,`RS256`],sc=300,cc=512,lc=new Set([`d`,`p`,`q`,`dp`,`dq`,`qi`,`oth`,`k`]);function uc(e){return{reserve:({key:t,expiresAt:n})=>e.reserveVerificationValue({identifier:`dpop-proof:${t}`,value:t,expiresAt:n})}}function Y(e,t){return Object.assign(Error(t),{code:e})}function dc(e){return e instanceof Error&&`code`in e&&e.code===`invalid_dpop_proof`}function fc(e){if(!e)return;let t=e.trim();if(!t)return;let n=/^([A-Za-z][A-Za-z0-9!#$%&'*+.^_`|~-]*)\s+(.+)$/.exec(t);if(!n)return{scheme:`Unknown`,token:t};let r=n[1]??``,i=n[2]?.trim()??``;return r.toLowerCase()===`bearer`?{scheme:`Bearer`,token:i}:r.toLowerCase()===`dpop`?{scheme:`DPoP`,token:i}:{scheme:`Unknown`,token:t}}function pc(e){return fc(e)?.token??e}function mc(e){let t=new URL(e);if(t.hash)throw Error(`DPoP proof htu must not contain a fragment`);return`${t.origin}${t.pathname}`}async function hc(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return G(new Uint8Array(t))}async function gc(e){return fi(e,`sha256`)}function _c(e){if(!e||typeof e!=`object`||Array.isArray(e))return;let t=e.jkt;return typeof t==`string`&&t.length>0?t:void 0}function vc(e){return _c(e.cnf)}function yc(e,t){let n=e[t];return typeof n==`string`&&n.length>0?n:void 0}function bc(e,t){let n=e[t];return typeof n==`number`&&Number.isFinite(n)?n:void 0}function xc(e,t){if(!e||e===`none`||e.startsWith(`HS`))throw Y(`invalid_dpop_proof`,`DPoP proof must use an asymmetric JWS algorithm`);if(!t.includes(e))throw Y(`invalid_dpop_proof`,`DPoP proof uses an unsupported JWS algorithm`)}function Sc(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Y(`invalid_dpop_proof`,`DPoP proof header must include a public jwk`);if(e.kty===`oct`)throw Y(`invalid_dpop_proof`,`DPoP proof jwk must be asymmetric`);for(let t of lc)if(t in e)throw Y(`invalid_dpop_proof`,`DPoP proof jwk must not contain private key material`)}async function Cc(e){let t=`${e.jkt}\n${e.htm}\n${e.htu}\n${e.jti}`,n=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(t));return G(new Uint8Array(n))}async function wc(e,t){if(e&&!await e.reserve(t))throw Y(`invalid_dpop_proof`,`DPoP proof jti has already been used`)}async function Tc({proofJwt:e,method:t,url:n,accessToken:r,expectedJkt:i,requireAth:a=!1,nowSeconds:o=Math.floor(Date.now()/1e3),proofMaxAgeSeconds:s=sc,signingAlgorithms:c=oc,replayStore:l}){if(!e||e.split(`.`).length!==3)throw Y(`invalid_dpop_proof`,`DPoP proof must be a compact JWT`);let u;try{u=vi(e)}catch(e){throw Y(`invalid_dpop_proof`,e instanceof Error?e.message:`DPoP proof header is invalid`)}if(u.typ!==`dpop+jwt`)throw Y(`invalid_dpop_proof`,`DPoP proof typ must be "dpop+jwt"`);xc(u.alg,c),Sc(u.jwk);let d;try{d=(await Vr(e,await _i(u.jwk,u.alg),{typ:ac})).payload}catch(e){throw Y(`invalid_dpop_proof`,e instanceof Error?e.message:`DPoP proof signature is invalid`)}let f=yc(d,`htm`),p=yc(d,`htu`),m=yc(d,`jti`),h=bc(d,`iat`);if(!f||!p||!m||h===void 0)throw Y(`invalid_dpop_proof`,`DPoP proof must include htm, htu, jti, and iat claims`);if(m.length>cc)throw Y(`invalid_dpop_proof`,`DPoP proof jti is too large`);if(f.toUpperCase()!==t.toUpperCase())throw Y(`invalid_dpop_proof`,`DPoP proof htm does not match the request method`);let g,_;try{g=mc(n),_=mc(p)}catch(e){throw Y(`invalid_dpop_proof`,e instanceof Error?e.message:`DPoP proof htu is invalid`)}if(_!==g)throw Y(`invalid_dpop_proof`,`DPoP proof htu does not match the request URL`);if(h>o+5||o-h>s)throw Y(`invalid_dpop_proof`,`DPoP proof iat is outside the accepted window`);let v=yc(d,`ath`);if(a&&!v)throw Y(`invalid_dpop_proof`,`DPoP proof must include an ath claim`);if(r!==void 0&&v!==await hc(r))throw Y(`invalid_dpop_proof`,`DPoP proof ath does not match the access token`);let y=await gc(u.jwk);if(i!==void 0&&y!==i)throw Y(`invalid_dpop_proof`,`DPoP proof key does not match the bound token`);let b=await Cc({jkt:y,htm:f.toUpperCase(),htu:g,jti:m}),x=new Date((h+s)*1e3);return await wc(l,{key:b,expiresAt:x,now:new Date(o*1e3)}),{jwk:u.jwk,jkt:y,jti:m,htm:f,htu:g,iat:h,ath:v,replayKey:b,expiresAt:x}}function Ec(e,t){return Object.assign(Error(t),{code:e})}function Dc(e){return e instanceof Error&&`code`in e&&(e.code===`invalid_token`||e.code===`invalid_dpop_proof`)}async function Oc({payload:e,authorization:t,proofJwt:n,method:r,url:i,replayStore:a,proofMaxAgeSeconds:o,signingAlgorithms:s}){let c=vc(e);if(c){if(t.scheme!==`DPoP`)throw Ec(`invalid_token`,`DPoP-bound access token requires the DPoP authorization scheme`);if(!n)throw Ec(`invalid_dpop_proof`,`DPoP proof header is required`);try{await Tc({proofJwt:n,method:r,url:i,accessToken:t.token,expectedJkt:c,requireAth:!0,proofMaxAgeSeconds:o,signingAlgorithms:s,replayStore:a})}catch(e){throw dc(e)?Ec(`invalid_dpop_proof`,e.message):e}}else if(t.scheme===`DPoP`)throw Ec(`invalid_token`,`DPoP authorization requires a DPoP-bound access token`)}_t.code,mt.code,gt.code;var kc=new Map,Ac=new WeakMap,jc=3e5;function Mc(e,t){if(e&&!(Date.now()-e.fetchedAt>=jc)&&(!t||e.jwks.keys.some(e=>e.kid===t)))return e.jwks}async function Nc(e){let t=typeof e==`string`?await ic(e,{headers:{Accept:`application/json`}}).then(async e=>{if(e.error)throw Error(`Jwks failed: ${e.error.message??e.error.statusText}`);return e.data}):await e();if(!t)throw Error(`No jwks found`);return t}async function Pc(e,t){return(await Fc(e,t)).jwks}async function Fc(e,t){let n;try{n=vi(e)}catch(e){throw e instanceof Error?e:Error(e)}let r=n.kid;if(typeof t.jwksFetch!=`string`){let e=t.jwksCacheKey;if(!e){let e=await t.jwksFetch();if(!e)throw Error(`No jwks found`);return{jwks:e,fromCache:!1,kid:r}}let n=Ac.get(e),i=t.forceRefresh?void 0:Mc(n,r);if(i)return{jwks:i,fromCache:!0,kid:r,noKidRefetchedAt:n?.noKidRefetchedAt};let a=await t.jwksFetch();if(!a)throw Error(`No jwks found`);let o=Date.now();return Ac.set(e,{jwks:a,fetchedAt:o,...t.forceRefresh&&!r?{noKidRefetchedAt:o}:{}}),{jwks:a,fromCache:!1,kid:r}}let i=t.jwksFetch,a=kc.get(i),o=t.forceRefresh?void 0:Mc(a,r);if(!o){let e=await Nc(t.jwksFetch),n=Date.now();return kc.set(i,{jwks:e,fetchedAt:n,...t.forceRefresh&&!r?{noKidRefetchedAt:n}:{}}),{jwks:e,fromCache:!1,kid:r}}return{jwks:o,fromCache:!0,kid:r,noKidRefetchedAt:a?.noKidRefetchedAt}}var Ic=[`authorization_code`,`client_credentials`,`refresh_token`],Lc=[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],Rc=[`none`,...Lc],zc=new Set(Rc);function Bc(e,t){if(!(t.trim().length>0))throw new V(`OAuth Provider extension ${e} cannot be empty`)}function Vc(e,t){Bc(e,t);let n;try{n=new URL(t)}catch{n=void 0}if(!n?.protocol)throw new V(`OAuth Provider extension ${e} must be an absolute URI: ${t}`)}function Hc(e){Vc(`grant type`,e)}function Uc(e){if(Bc(`token_endpoint_auth_method`,e),zc.has(e))throw new V(`OAuth Provider extension token_endpoint_auth_method is reserved: ${e}`)}function Wc(e){if(Vc(`client_assertion_type`,e),e===`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)throw new V(`OAuth Provider extension client_assertion_type is reserved: ${e}`)}function Gc(e){let t=Object.keys(e.grants??{});for(let e of t)Hc(e);let n=[],r=[];for(let[t,i]of Object.entries(e.clientAuthentication??{})){Uc(t),n.push(t);let e=i.assertionTypes??[t];if(e.length===0)throw new V(`OAuth Provider extension client_assertion_type list cannot be empty for ${t}`);for(let t of e)Wc(t),r.push(t)}let i=(e.clientDiscovery?Array.isArray(e.clientDiscovery)?e.clientDiscovery:[e.clientDiscovery]:[]).map(e=>e.id);for(let e of i)Bc(`client discovery id`,e);return{grantTypes:t,authMethods:n,assertionTypes:r,clientDiscoveryIds:i}}function Kc(e,t){let n=new Set;for(let r of t){if(n.has(r))throw new V(`OAuth Provider extensions register ${e} "${r}" more than once. Extension contributions must be disjoint.`);n.add(r)}}function qc(e){let t=(e??[]).map(Gc);Kc(`grant type`,t.flatMap(e=>e.grantTypes)),Kc(`token_endpoint_auth_method`,t.flatMap(e=>e.authMethods)),Kc(`client_assertion_type`,t.flatMap(e=>e.assertionTypes)),Kc(`client discovery id`,t.flatMap(e=>e.clientDiscoveryIds))}function Jc(e){return e.extensions??[]}function Yc(e){return Jc(e).flatMap(e=>{let t=e.clientDiscovery;return t?Array.isArray(t)?t:[t]:[]})}function Xc(e,t){let n=e.getPlugin(`oauth-provider`);if(!n)throw new V(`extendOAuthProvider requires the oauth-provider plugin.`);let r=n.options.extensions??[];if(r.includes(t))return;let i=[...r,t];qc(i),n.options.extensions=i}function Zc(e){return Jc(e).flatMap(e=>Object.keys(e.grants??{}))}function Qc(e){return Array.from(new Set([...e.grantTypes??Ic,...Zc(e)]))}function $c(e,t){for(let n of Jc(e)){let e=n.grants?.[t];if(e)return e}}function el(e){return Jc(e).flatMap(e=>Object.keys(e.clientAuthentication??{}))}function tl(e,t){return Array.from(new Set([...t?.includeNone?[`none`]:[],...Lc,...el(e)]))}function nl(e,t){return t?el(e).includes(t):!1}function rl(e,t){if(t!==`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)for(let n of Jc(e)){let e=n.clientAuthentication??{};for(let[n,r]of Object.entries(e))if((r.assertionTypes??[n]).includes(t))return{method:n,strategy:r}}}function il(e,t,n,r){let i={...r};for(let a of Jc(t)){let o=a.metadata?.({ctx:e,opts:t,type:n,document:r});for(let[e,t]of Object.entries(o??{}))e in i||(i[e]=t)}return i}async function al(e,t){let n={};for(let r of Jc(e)){let e=await t(r)??{};for(let[t,r]of Object.entries(e))t in n?_e.warn(`oauth-provider: two extensions contributed the claim "${t}"; keeping the first-registered value.`):n[t]=r}return n}function ol(e,t){return al(e,e=>e.claims?.accessToken?.(t))}function sl(e,t){return al(e,e=>e.claims?.idToken?.(t))}function cl(e,t){return al(e,e=>e.claims?.userInfo?.(t))}function ll(e){return Jc(e).some(e=>e.claims?.userInfo)}function ul(e){if(!e)return;let[t,n,...r]=e.trim().split(/\s+/);if(t?.toLowerCase()===`bearer`){if(!n||r.length>0)throw new z(`BAD_REQUEST`,{error:`invalid_request`,error_description:`Malformed Bearer Authorization header`});return n}}function dl(){let e=new Map;return{get(t){let n=e.get(t);if(n){if(n.expiresAt&&n.expiresAt<new Date)e.delete(t);else return n}},set(t,n){e.set(t,n)}}}var fl=e=>e.getPlugin(`oauth-provider`),pl=e=>{let t=e.getPlugin(`jwt`);if(!t)throw new V(`jwt_config`);return t};function ml(e){if(e!=null){if(e instanceof Date)return Number.isFinite(e.getTime())?e:void 0;if(typeof e==`number`){if(!Number.isFinite(e))return;let t=new Date(e);return Number.isFinite(t.getTime())?t:void 0}if(typeof e==`string`){let t=e.trim();if(!t.length)return;let n=Number(t);if(Number.isFinite(n)){let e=new Date(n);return Number.isFinite(e.getTime())?e:void 0}let r=new Date(t);return Number.isFinite(r.getTime())?r:void 0}}}function hl(e){if(e instanceof Date||!e||typeof e!=`object`)return ml(e);let t=ml(e.createdAt)??ml(e.created_at);if(t)return t;let n=e.session;if(n&&typeof n==`object`)return ml(n.createdAt)??ml(n.created_at)}function gl(e){if(typeof e==`string`)return[e];if(e?.length)return e}function _l(e){if(typeof e==`string`)return e;if(e?.length)return e.length===1?e.at(0):e}var vl=new WeakMap;function yl(e){let t=vl.get(e);if(t)return t;let n=dl();return vl.set(e,n),n}async function bl(e,t){let n=new URLSearchParams(e),r=n.get(`sig`),i=n.getAll(`sig`),a=Number(n.get(`exp`));n.delete(`sig`);let o=await Ga(De(n).toString(),t);return i.length===1&&!!r&&Pi(r,o)&&new Date(a*1e3)>=new Date}async function xl(e,t,n){let r=yl(t),i=r.get(n);if(i&&!i.clientDiscoveryId)return Object.assign({},i);let a=await e.context.adapter.findOne({model:t.schema?.oauthClient?.modelName??`oauthClient`,where:[{field:`clientId`,value:n}]}),o=Yc(t);if(a?.clientDiscoveryId){let t=a.clientDiscoveryId,r=o.find(e=>e.id===t);if(!r?.matches(n)||(a=await r.resolve(e,n,a),!a))return null}else if(a)return t.cachedTrustedClients?.has(n)&&r.set(n,Object.assign({},a)),a;else for(let t of o){if(!t.matches(n))continue;let r=await t.resolve(e,n,null);if(r){a=r;break}}return a}function Sl(e){return e.reduce((e,t)=>({...e,...t.discoveryMetadata??{}}),{})}var Cl=async e=>{let t=await Li(`SHA-256`).digest(new TextEncoder().encode(e));return ve.encode(new Uint8Array(t),{padding:!1})};async function wl(e,t,n){if(t===`encrypted`)return await Ua({key:e.context.secretConfig,data:n});if(typeof t==`object`&&`decrypt`in t)return await t.decrypt(n);throw new V(`Unsupported decryption storageMethod type '${t}'`)}async function Tl(e,t,n,r){let i=t.storeClientSecret??(t.disableJwtPlugin?`encrypted`:`hashed`);if(r&&t.prefix?.clientSecret){if(r.startsWith(t.prefix?.clientSecret))r=r.replace(t.prefix.clientSecret,``);else throw new z(`UNAUTHORIZED`,{error_description:`invalid client_secret`,error:`invalid_client`})}if(i===`hashed`){let e=r?await Cl(r):void 0;return!!e&&Pi(e,n)}if(typeof i==`object`&&`hash`in i){if(i.verify)return!!r&&await i.verify(r,n);{let e=r?await i.hash(r):void 0;return!!e&&Pi(e,n)}}if(i===`encrypted`)try{let t=await wl(e,i,n);return!!r&&Pi(t,r)}catch{return!1}if(typeof i==`object`&&`decrypt`in i){let t=await wl(e,i,n);return!!r&&Pi(t,r)}throw new V(`Unsupported verify storageMethod type '${i}'`)}async function El(e,t,n){let r=t.storeClientSecret??(t.disableJwtPlugin?`encrypted`:`hashed`);if(r===`encrypted`)return await Ha({key:e.context.secretConfig,data:n});if(r===`hashed`)return await Cl(n);if(typeof r==`object`&&`hash`in r)return await r.hash(n);if(typeof r==`object`&&`encrypt`in r)return await r.encrypt(n);throw new V(`Unsupported storeClientSecret type '${r}'`)}async function Dl(e=`hashed`,t,n){if(e===`hashed`)return await Cl(t);if(typeof e==`object`&&`hash`in e)return await e.hash(t,n);throw new V(`storeToken: unsupported storageMethod type '${e}'`)}async function Ol(e=`hashed`,t,n){if(e===`hashed`)return await Cl(t);if(typeof e==`object`&&`hash`in e)return await e.hash(t,n);throw new V(`getStoredToken: unsupported storageMethod type '${e}'`)}var kl=/^Basic +/i,Al=/^([!#$%&'*+\-.^_`|~0-9A-Za-z]+)(?=\s|$)/;function jl(e){return e.match(Al)?.[1]}var Ml=[`client_secret`,`client_assertion`,`client_assertion_type`];function Nl(e){throw new z(`BAD_REQUEST`,{error:`invalid_request`,error_description:e})}async function Pl(e,t={}){let n;t.client_id!==void 0&&t.client_id!==``&&(typeof t.client_id!=`string`&&Nl(`client_id must be a string`),n=t.client_id);let r={},i=(e,t)=>{t!==void 0&&t!==``&&(typeof t!=`string`&&Nl(`${e} must be a string`),r[e]=t)};for(let e of Ml)Object.hasOwn(t,e)&&i(e,t[e]);let a=!!e?.headers.get(`authorization`);if(e&&(e.headers.get(`content-type`)?.toLowerCase()??``).includes(`application/x-www-form-urlencoded`)){let t=new URLSearchParams(await e.clone().text()),r=t.getAll(`client_id`).filter(e=>e.length>0);r.length>1&&Nl(`client_id must not be repeated`),n=r[0];for(let e of Ml){let n=t.getAll(e).filter(e=>e.length>0);n.length>1&&Nl(`${e} must not be repeated`),n.length===1&&i(e,n[0])}}let o=r.client_secret!==void 0,s=r.client_assertion!==void 0||r.client_assertion_type!==void 0;(a&&(o||s)||o&&s)&&Nl(`A request must use only one client authentication method`),t.client_id=n;for(let e of Ml)t[e]=r[e];return{detected:a||Object.keys(r).length>0}}function Fl(e){if(kl.test(e))try{let{clientId:t,clientSecret:n}=hs(e);return{client_id:t,client_secret:n}}catch{throw new z(`UNAUTHORIZED`,{error_description:`invalid authorization header format`,error:`invalid_client`},{"WWW-Authenticate":`Basic`})}}function Il(e,t){let n=e.grantTypes&&e.grantTypes.length>0?e.grantTypes:[`authorization_code`];return t===`refresh_token`&&n.includes(`authorization_code`)?!0:n.includes(t)}function Ll(e,t){if(!t||!e.scopes)return;let n=new Set(e.scopes);for(let e of t)if(!n.has(e))throw new z(`BAD_REQUEST`,{error_description:`client does not allow scope ${e}`,error:`invalid_scope`})}function Rl(e,t){let n=t?.method===`client_secret_basic`,r=t?.scheme??(n?`Basic`:void 0);throw new z(r?`UNAUTHORIZED`:`BAD_REQUEST`,{error_description:e,error:`invalid_client`},r?{"WWW-Authenticate":r}:void 0)}async function zl(e,t,n,r,i,a,o,s){let c=await xl(e,t,n);c||Rl(`missing client`,{method:s}),c.disabled&&Rl(`client is disabled`,{method:s});let l=c.tokenEndpointAuthMethod??`client_secret_basic`;if(s&&l!==s&&Rl(`client registered for ${l} cannot use ${s}`,{method:s}),(c.tokenEndpointAuthMethod===`private_key_jwt`||nl(t,c.tokenEndpointAuthMethod))&&!a)throw new z(`BAD_REQUEST`,{error_description:`client registered for ${c.tokenEndpointAuthMethod} must use client_assertion`,error:`invalid_client`});if(a||(c.tokenEndpointAuthMethod!==`none`&&!r&&Rl(`client secret must be provided`,{method:s}),r&&!c.clientSecret&&Rl(`public client, client secret should not be received`,{method:s}),r&&!await Tl(e,t,c.clientSecret,r)&&Rl(`invalid client_secret`,{method:s})),Ll(c,i),o&&!Il(c,o))throw new z(`BAD_REQUEST`,{error_description:`client is not authorized to use grant type ${o}`,error:`unauthorized_client`});return c}function Bl(e){if(e)return typeof e==`string`?JSON.parse(e):e}function Vl(e){return{clientId:e?.clientId,clientSecret:e?.kind===`client_secret`?e.clientSecret:void 0,preVerified:e?.kind===`pre_verified`,authMethod:e?.method,confirmation:e?.kind===`pre_verified`?e.confirmation:void 0}}async function Hl(e,t,n){let r={...e.body??{}};await Pl(e.request,r);let i=e.request?.headers.get(`authorization`)??void 0;if(r.client_assertion_type||r.client_assertion){if(!r.client_assertion||!r.client_assertion_type)throw new z(`BAD_REQUEST`,{error_description:`client_assertion and client_assertion_type must both be provided`,error:`invalid_client`});let i=r.client_assertion,a=r.client_assertion_type,o=rl(t,a);if(o){let s=await o.strategy.authenticate({ctx:e,opts:t,assertion:i,assertionType:a,clientId:r.client_id,expectedAudience:n});return{kind:`pre_verified`,method:o.method,clientId:s.clientId,confirmation:s.confirmation}}let{verifyClientAssertion:s}=await Promise.resolve().then(()=>fg).then(e=>e.o);return{kind:`pre_verified`,method:`private_key_jwt`,clientId:(await s(e,t,i,a,r.client_id,n)).clientId}}if(i&&!kl.test(i)){let e=jl(i);if(!e)throw new z(`BAD_REQUEST`,{error:`invalid_request`,error_description:`Invalid authorization header format`});Rl(`unsupported authorization scheme`,{scheme:e})}if(i&&kl.test(i)){let e=Fl(i);if(e)return{kind:`client_secret`,method:`client_secret_basic`,clientId:e.client_id,clientSecret:e.client_secret}}return r.client_id&&r.client_secret?{kind:`client_secret`,method:`client_secret_post`,clientId:r.client_id,clientSecret:r.client_secret}:r.client_id?{kind:`public`,method:`none`,clientId:r.client_id}:null}function Ul(e){let t=e.split(` `).map(e=>e.trim()),n=new Set;for(let e of t)(e===`login`||e===`consent`||e===`create`||e===`select_account`||e===`none`)&&n.add(e);return new Set(n)}function Wl(e){let t=e.redirectUris?.[0];if(!t)throw new V(`Client has no redirect URIs for sector identifier`);return new URL(t).host}async function Gl(e,t,n){return Ga(`${Wl(t)}.${e}`,n)}async function Kl(e,t,n){return t.subjectType===`pairwise`&&n.pairwiseSecret?Gl(e,t,n.pairwiseSecret):e}function ql(e){let t=Object.create(null);for(let n of new Set(e.keys())){let r=e.getAll(n);t[n]=r.length===1?r[0]:r}return t}function Jl(e,t){if(!t)return!1;let n=ml(e);return n?n.getTime()>=t.getTime():!1}function Yl(e,t){let n=new URLSearchParams(e),r=n.get(`prompt`)?.split(` `),i=r?.findIndex(e=>e===t)??-1;return i>=0&&(r?.splice(i,1),r?.length?n.set(`prompt`,r.join(` `)):n.delete(`prompt`)),n}function Xl(e){let t=new URLSearchParams(e);return t.delete(`max_age`),t}function Zl(e,t){if(e.tokenEndpointAuthMethod===`none`)return`pkce is required for public clients`;let n=t?.scopes??[],r=n.includes(`openid`),i=typeof t?.nonce==`string`&&t.nonce.length>0,a=r&&i;return n.includes(`offline_access`)&&!a?`pkce or OIDC nonce is required when requesting offline_access scope`:e.requirePKCE??!0?`pkce is required for this client`:!1}function Ql(e){return e instanceof z||e instanceof B||e?.name===`APIError`}var $l,eu=!1;function tu(){try{return globalThis.process?.getBuiltinModule?.(`node:async_hooks`)?.AsyncLocalStorage}catch{return}}async function nu(){if($l)return $l;let e=tu();if(e)return $l??=e,$l;try{let{AsyncLocalStorage:e}=await import(`node:async_hooks`);return $l??=e,$l}catch(e){let t=globalThis.AsyncLocalStorage;if(typeof t==`function`)return $l??=t,$l;throw typeof window<`u`?Error(`getAsyncLocalStorage is only available in server code`):(eu||(eu=!0,console.warn(`[better-auth] Warning: AsyncLocalStorage is not available in this environment. Some features may not work as expected.`),console.warn(`[better-auth] Please read more about this warning at https://better-auth.com/docs/installation#mount-handler`),console.warn(`[better-auth] If you are using Cloudflare Workers, please see: https://developers.cloudflare.com/workers/configuration/compatibility-flags/#nodejs-compatibility-flag`)),e)}}var ru=()=>O().context.endpointContextAsyncStorage,iu=async()=>{let e=ru();if(e)return e;let t=await nu(),n=O().context;return n.endpointContextAsyncStorage??=new t};function au(){return ge()}function ou(){let e=au();if(!e)throw Error("No auth context found. Please make sure you are calling this function within a `runWithEndpointContext` callback.");return e}async function su(e,t){return(await iu()).run(e,t)}var cu={"Cache-Control":`no-store`,Pragma:`no-cache`};function lu(e,t){Ql(t)&&e&&Object.defineProperty(t,F,{enumerable:!1,configurable:!0,value:e,writable:!1})}var uu=Co(async()=>({})),du=Co.create({use:[uu,Co(async()=>({}))]}),fu=xo.create({use:[uu]});function pu(e,t){let n=t.metadata?.noStore===!0;return async t=>{if(n)for(let[e,n]of Object.entries(cu))t.setHeader(e,n);try{return await su(t,()=>e(t))}catch(e){throw lu(t.responseHeaders,e),e}}}function X(...e){if(e.length===3){let[t,n,r]=e;return fu(t,n,pu(r,n))}let[t,n]=e;return fu(t,pu(n,t))}function mu(e){return{...e,metadata:{...e.metadata,SERVER_ONLY:!0}}}X.serverOnly=(e,t)=>X(mu(e),t);function hu(e){return e===`-`||e===`^`||e===`$`||e===`+`||e===`.`||e===`(`||e===`)`||e===`|`||e===`[`||e===`]`||e===`{`||e===`}`||e===`*`||e===`?`||e===`\\`?`\\${e}`:e}function gu(e){let t=``;for(let n=0;n<e.length;n++)t+=hu(e[n]);return t}function _u(e,t=!0){if(Array.isArray(e))return`(?:${e.map(e=>`^${_u(e,t)}$`).join(`|`)})`;let n=``,r=``,i=`.`;t===!0?(n=`/`,r=`[/\\\\]`,i=`[^/\\\\]`):t&&(n=t,r=gu(n),r.length>1?(r=`(?:${r})`,i=`((?!${r}).)`):i=`[^${r}]`);let a=t?`${r}+?`:``,o=t?`${r}*?`:``,s=t?e.split(n):[e],c=``;for(let e=0;e<s.length;e++){let n=s[e],r=s[e+1],l=``;if(!(!n&&e>0)){if(t&&(l=e===s.length-1?o:r===`**`?``:a),t&&n===`**`)l&&(c+=e===0?``:l,c+=`(?:${i}*?${l})*?`);else{for(let e=0;e<n.length;e++){let t=n[e];t===`\\`?e<n.length-1&&(c+=hu(n[e+1]),e++):c+=t===`?`?i:t===`*`?`${i}*?`:hu(t)}c+=l}}}return c}function vu(e,t){if(typeof t!=`string`)throw TypeError(`Sample must be a string, but ${typeof t} given`);return e.test(t)}function yu(e,t){if(typeof e!=`string`&&!Array.isArray(e))throw TypeError(`The first argument must be a single pattern string or an array of patterns, but ${typeof e} given`);if((typeof t==`string`||typeof t==`boolean`)&&(t={separator:t}),arguments.length===2&&!(t===void 0||typeof t==`object`&&t&&!Array.isArray(t)))throw TypeError(`The second argument must be an options object or a string/boolean separator, but ${typeof t} given`);if(t||={},t.separator===`\\`)throw Error("\\ is not a valid separator because it is used for escaping. Try setting the separator to `true` instead");let n=_u(e,t.separator),r=RegExp(`^${n}$`,t.flags),i=vu.bind(null,r);return i.options=t,i.pattern=e,i.regexp=r,i}var bu=47;function xu(e){let t=e.replace(/:\d+$/,``).replace(/^\[|\]$/g,``).toLowerCase();return t===`localhost`||t.endsWith(`.localhost`)||t===`::1`||t.startsWith(`127.`)}function Su(e){let t=e.length;for(;t>0&&e.charCodeAt(t-1)===bu;)t--;return t===e.length?e:e.slice(0,t)}function Cu(e){try{return(Su(new URL(e).pathname)||`/`)!==`/`}catch{throw new V(`Invalid base URL: ${e}. Please provide a valid base URL.`)}}function wu(e){try{let t=new URL(e);if(t.protocol!==`http:`&&t.protocol!==`https:`)throw new V(`Invalid base URL: ${e}. URL must include 'http://' or 'https://'`)}catch(t){throw t instanceof V?t:new V(`Invalid base URL: ${e}. Please provide a valid base URL.`,{cause:t})}}function Tu(e,t=`/api/auth`){if(wu(e),Cu(e))return e;let n=Su(e);return!t||t===`/`?n:(t=t.startsWith(`/`)?t:`/${t}`,`${n}${t}`)}function Eu(e,t){return!e||e.trim()===``?!1:t===`proto`?e===`http`||e===`https`:t===`host`?[/\.\./,/\0/,/[\s]/,/^[.]/,/[<>'"]/,/javascript:/i,/file:/i,/data:/i].some(t=>t.test(e))?!1:/^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(:[0-9]{1,5})?$/.test(e)||/^(\d{1,3}\.){3}\d{1,3}(:[0-9]{1,5})?$/.test(e)||/^\[[0-9a-fA-F:]+\](:[0-9]{1,5})?$/.test(e)||/^localhost(:[0-9]{1,5})?$/i.test(e):!1}function Du(e,t,n,r,i){if(e)return Tu(e,t);if(r!==!1){let e=R.BETTER_AUTH_URL||R.NEXT_PUBLIC_BETTER_AUTH_URL||R.PUBLIC_BETTER_AUTH_URL||R.NUXT_PUBLIC_BETTER_AUTH_URL||R.NUXT_PUBLIC_AUTH_URL||(R.BASE_URL===`/`?void 0:R.BASE_URL);if(e)return Tu(e,t)}let a=n?.headers.get(`x-forwarded-host`),o=n?.headers.get(`x-forwarded-proto`);if(a&&o&&i&&Eu(o,`proto`)&&Eu(a,`host`))try{return Tu(`${o}://${a}`,t)}catch{}if(n){let e=Ou(n.url);if(!e)throw new V(`Could not get origin from request. Please provide a valid base URL.`);return Tu(e,t)}if(typeof window<`u`&&window.location)return Tu(window.location.origin,t)}function Ou(e){try{let t=new URL(e);return t.origin===`null`?null:t.origin}catch{return null}}function ku(e){try{return new URL(e).protocol}catch{return null}}function Au(e){try{return new URL(e).host}catch{return null}}function ju(e){return typeof e==`object`&&!!e&&`allowedHosts`in e&&Array.isArray(e.allowedHosts)}function Mu(e){if(e instanceof Request)return!0;if(typeof e!=`object`||!e||Object.prototype.toString.call(e)!==`[object Request]`)return!1;let t=e;return typeof t.url==`string`&&typeof t.headers==`object`&&t.headers!==null&&typeof t.headers.get==`function`}function Nu(e,t){let n=Mu(e)?e.headers:e;if(t){let e=n.get(`x-forwarded-host`);if(e&&Eu(e,`host`))return e}let r=n.get(`host`);if(r&&Eu(r,`host`))return r;if(Mu(e))try{return new URL(e.url).host}catch{return null}return null}function Pu(e,t,n){if(t===`http`||t===`https`)return t;let r=Mu(e)?e.headers:e;if(n){let e=r.get(`x-forwarded-proto`);if(e&&Eu(e,`proto`))return e}if(Mu(e))try{let t=new URL(e.url);if(t.protocol===`http:`||t.protocol===`https:`)return t.protocol.slice(0,-1)}catch{}let i=Nu(e,n);return i&&xu(i)?`http`:`https`}var Fu=(e,t)=>{if(!e||!t)return!1;let n=e.replace(/^https?:\/\//,``).split(`/`)[0].toLowerCase(),r=t.replace(/^https?:\/\//,``).split(`/`)[0].toLowerCase();return r.includes(`*`)||r.includes(`?`)?yu(r)(n):n.toLowerCase()===r.toLowerCase()};function Iu(e,t,n,r){let i=Nu(t,r);if(!i){if(e.fallback)return Tu(e.fallback,n);throw new V(`Could not determine host from request headers. Please provide a fallback URL in your baseURL config.`)}if(e.allowedHosts.some(e=>Fu(i,e)))return Tu(`${Pu(t,e.protocol,r)}://${i}`,n);if(e.fallback)return Tu(e.fallback,n);throw new V(`Host "${i}" is not in the allowed hosts list. Allowed hosts: ${e.allowedHosts.join(`, `)}. Add this host to your allowedHosts config or provide a fallback URL.`)}function Lu(e,t,n,r,i){if(ju(e))return n?Iu(e,n,t,i):e.fallback?Tu(e.fallback,t):Du(void 0,t,void 0,r,i);let a=Mu(n)?n:void 0;return Du(typeof e==`string`?e:void 0,t,a,r,i)}function Ru(e,t){let n;try{n=new URL(e).pathname.replace(/\/+$/,``)||`/`}catch{return`/`}let r=t.replace(/\/+$/,``);return r===``?n:n===r?`/`:n.startsWith(r+`/`)?n.slice(r.length).replace(/\/+$/,``)||`/`:n}var zu=`https://better-auth.invalid`;function Bu(e,t){let n=e.startsWith(`/`);if(e.startsWith(`//`)||e.startsWith(`/\\`))throw TypeError(`Expected an absolute or root-relative URL`);let r=n?new URL(e,zu):new URL(e);if(n&&r.origin!==zu)throw TypeError(`Expected an absolute or root-relative URL`);let i=t.toString();if(!i)return e;let a=r.search.endsWith(`&`)?``:`&`;return r.search=r.search?`${r.search}${a}${i}`:i,n?r.href.slice(r.origin.length):r.href}var Vu=[`javascript:`,`data:`,`vbscript:`],Hu=m(),Uu=p();function Wu(e){return Gu(e)||Ku(e)}function Gu(e){return n(Hu,e)}function Ku(e){return n(Uu,e)}function qu(e){let t=e.toLowerCase();if(t.startsWith(`::ffff:`)){let e=t.substring(7);if(Gu(e))return e}let n=e.split(`:`);if(n.length===7&&n[5]?.toLowerCase()===`ffff`){let e=n[6];if(e&&Gu(e))return e}if(t.includes(`::ffff:`)||t.includes(`:ffff:`)){let t=Ju(e);if(t.length===8&&t[0]===`0000`&&t[1]===`0000`&&t[2]===`0000`&&t[3]===`0000`&&t[4]===`0000`&&t[5]===`ffff`&&t[6]&&t[7])return`${Number.parseInt(t[6].substring(0,2),16)}.${Number.parseInt(t[6].substring(2,4),16)}.${Number.parseInt(t[7].substring(0,2),16)}.${Number.parseInt(t[7].substring(2,4),16)}`}return null}function Ju(e){if(e.includes(`::`)){let t=e.split(`::`),n=t[0]?t[0].split(`:`):[],r=t[1]?t[1].split(`:`):[],i=8-n.length-r.length,a=Array(i).fill(`0000`),o=n.map(e=>e.padStart(4,`0`)),s=r.map(e=>e.padStart(4,`0`));return[...o,...a,...s]}return e.split(`:`).map(e=>e.padStart(4,`0`))}function Yu(e,t){let n=Ju(e);if(t!==void 0&&t<128){let e=Math.max(0,Math.floor(t));return n.map(t=>{if(e<=0)return`0000`;if(e>=16)return e-=16,t;let n=Number.parseInt(t,16)&65535<<16-e&65535;return e=0,n.toString(16).padStart(4,`0`)}).join(`:`).toLowerCase()}return n.join(`:`).toLowerCase()}function Xu(e,t={}){if(Gu(e)||!Ku(e))return e.toLowerCase();let n=qu(e);return n?n.toLowerCase():Yu(e,t.ipv6Subnet??64)}function Zu(e){if(Gu(e))return Uint8Array.from(e.split(`.`).map(e=>Number(e)));if(!Ku(e))return null;let t=qu(e);if(t)return Uint8Array.from(t.split(`.`).map(e=>Number(e)));let n=Ju(e),r=new Uint8Array(16);for(let e=0;e<8;e++){let t=Number.parseInt(n[e]??`0`,16);r[e*2]=t>>8&255,r[e*2+1]=t&255}return r}var Qu=/^\d+$/;function $u(e){let t=e.lastIndexOf(`/`),n=Zu(t===-1?e:e.slice(0,t));if(!n)return null;let r=n.length*8;if(t===-1)return{bytes:n,prefix:r};let i=e.slice(t+1);if(!Qu.test(i))return null;let a=Number(i);return a<=r?{bytes:n,prefix:a}:null}function ed(e,t){if(e.length!==t.bytes.length)return!1;let n=t.prefix;for(let r=0;r<e.length&&n>0;r++){let i=n>=8?8:n,a=i===8?255:255<<8-i&255;if(((e[r]??0)&a)!==((t.bytes[r]??0)&a))return!1;n-=8}return!0}function td(e){return e.filter(e=>$u(e)===null)}function nd(e,t={}){let n=e.split(`,`).map(e=>e.trim()).filter(Boolean);if(n.length===0)return null;let r=(t.trustedProxies??[]).map($u).filter(e=>e!==null);if(r.length>0){for(let e=n.length-1;e>=0;e--){let i=n[e],a=i?Zu(i):null;if(!i||!a)return null;if(!r.some(e=>ed(a,e)))return Xu(i,{ipv6Subnet:t.ipv6Subnet})}return null}if(n.length!==1)return null;let i=n[0];return!i||!Wu(i)?null:Xu(i,{ipv6Subnet:t.ipv6Subnet})}var rd=`127.0.0.1`,id=[`x-forwarded-for`];function ad(e,t){if(t.advanced?.ipAddress?.disableIpTracking)return null;let n=`headers`in e?e.headers:e,r=t.advanced?.ipAddress?.ipAddressHeaders||id;for(let e of r){let r=`get`in n?n.get(e):n[e];if(typeof r==`string`){let e=nd(r,{ipv6Subnet:t.advanced?.ipAddress?.ipv6Subnet,trustedProxies:t.advanced?.ipAddress?.trustedProxies});if(e)return e}}return L()||fe()?rd:null}function od(e,t){return`${e}|${t}`}var sd=async()=>{let e=O(),t=e.context.requestStateAsyncStorage;if(t)return t;let n=await nu();return e.context.requestStateAsyncStorage??=new n,e.context.requestStateAsyncStorage};async function cd(){return(await sd()).getStore()!==void 0}async function ld(){let e=(await sd()).getStore();if(!e)throw Error("No request state found. Please make sure you are calling this function within a `runWithRequestState` callback.");return e}async function ud(e,t){return(await sd()).run(e,t)}function dd(e){let t=Object.freeze({});return{get ref(){return t},async get(){let n=await ld();if(!n.has(t)){let r=await e();return n.set(t,r),r}return n.get(t)},async set(e){(await ld()).set(t,e)}}}var fd=async()=>{let e=O(),t=e.context.adapterAsyncStorage;if(t)return t;let n=await nu();return e.context.adapterAsyncStorage??=new n,e.context.adapterAsyncStorage},pd=async e=>fd().then(t=>t.getStore()?.adapter||e).catch(()=>e),md=async(e,t)=>{let n=!1;return fd().then(async r=>{n=!0;let i=[],a,o,s=!1;try{a=await r.run({adapter:e,pendingHooks:i,isTransactionActive:!1},t)}catch(e){o=e,s=!0}for(let e of i)await e();if(s)throw o;return a}).catch(e=>{if(!n)return t();throw e})},hd=async(e,t,n)=>{let r=!1;return fd().then(async i=>{if(r=!0,i.getStore()?.isTransactionActive)return t();let a=ye(e)?.();a&&await a;let o=[],s,c,l=!1;try{s=await e.transaction(async e=>(o=[],i.run({adapter:e,pendingHooks:o,isTransactionActive:!0},t)))}catch(e){l=!0,c=e}let u=async e=>{for(let t of o)try{await t()}catch(t){if(!n?.onAfterCommitHookError){if(e===`throw`)throw t;try{_e.error(`Failed to run an after-commit hook for work that could not roll back`,t)}catch{}continue}try{await n.onAfterCommitHookError(t)}catch{}}};if(l)throw e.options?.adapterConfig.transaction===!1&&await u(`log`),c;return await u(`throw`),s}).catch(e=>{if(!r)return t();throw e})},gd=async(e,t)=>{let n=async()=>{try{await e()}catch(e){if(!t?.onError)throw e;await t.onError(e)}},r;try{r=await fd()}catch{return n()}let i=r.getStore();if(!i?.isTransactionActive)return n();i.pendingHooks.push(n)},{get:_d,set:vd}=dd(()=>null),yd=async()=>await _d(),{get:bd,set:xd}=dd(()=>null),Sd=async e=>{await xd({...await bd()??{},...e})},{get:Cd,set:wd}=dd(()=>!1);function Td(e){return!!e.database||!!e.secondaryStorage}function Ed(e){return!!e.database}function Dd(e){return Ed(e)}var Od=w({id:c(),createdAt:f().default(()=>new Date),updatedAt:f().default(()=>new Date)}),kd=Od.extend({userId:be(),expiresAt:f(),token:c(),ipAddress:c().nullish(),userAgent:c().nullish()}),Ad=Od.extend({email:c().transform(e=>e.toLowerCase()),emailVerified:v().default(!1),name:c(),image:c().nullish()});function jd(e,t){if(!e||!t)return e;let n=Object.entries(t).filter(([,{returned:e}])=>e===!1).map(([e])=>e);return Object.entries(structuredClone(e)).filter(([e])=>!n.includes(e)).reduce((e,[t,n])=>({...e,[t]:n}),{})}var Md=new WeakMap;function Nd(e,t,n){let r=`${t}:${n}`;Md.has(e)||Md.set(e,new Map);let i=Md.get(e);if(i.has(r))return i.get(r);let a=n===`output`?de(e)[t]?.fields??{}:{},o=t===`user`||t===`session`||t===`account`?e[t]?.additionalFields:void 0,s={...a,...o??{}};for(let n of e.plugins||[])n.schema&&n.schema[t]&&(s={...s,...n.schema[t].fields});return i.set(r,s),s}function Pd(e,t){return jd(t,Nd(e,`user`,`output`))}function Fd(e,t){let n=Nd(e,`user`,`output`),r={};for(let e in n){let i=n[e];i.returned!==!1&&(e in t&&t[e]!==void 0?r[e]=t[e]:i.defaultValue===void 0?i.required||(r[e]=null):r[e]=typeof i.defaultValue==`function`?i.defaultValue():i.defaultValue)}return`id`in t&&(r.id=t.id),r}function Id(e,t){return jd(t,Nd(e,`session`,`output`))}function Ld(e,t){let{accessToken:n,refreshToken:r,idToken:i,accessTokenExpiresAt:a,refreshTokenExpiresAt:o,password:s,...c}=jd(t,Nd(e,`account`,`output`));return c}function Rd(e,t){let n=t.action||`create`,r=t.fields,i=Object.create(null);for(let t in r)if(t in e){if(r[t].input===!1){if(r[t].defaultValue!==void 0&&n!==`update`){i[t]=r[t].defaultValue;continue}if(e[t])throw B.from(`BAD_REQUEST`,{...as.FIELD_NOT_ALLOWED,message:`${t} is not allowed to be set`});continue}if(r[t].validator?.input&&e[t]!==void 0){let n=r[t].validator.input[`~standard`].validate(e[t]);if(n instanceof Promise)throw B.from(`INTERNAL_SERVER_ERROR`,as.ASYNC_VALIDATION_NOT_SUPPORTED);if(`issues`in n&&n.issues)throw B.from(`BAD_REQUEST`,{...as.VALIDATION_ERROR,message:n.issues[0]?.message||`Validation Error`});i[t]=n.value;continue}if(r[t].transform?.input&&e[t]!==void 0){i[t]=r[t].transform?.input(e[t]);continue}i[t]=e[t]}else if(r[t].defaultValue!==void 0&&n===`create`){if(typeof r[t].defaultValue==`function`){i[t]=r[t].defaultValue();continue}i[t]=r[t].defaultValue}else if(r[t].required&&n===`create`)throw B.from(`BAD_REQUEST`,{...as.MISSING_FIELD,message:`${t} is required`});return i}function zd(e,t={},n){return Rd(t,{fields:Nd(e,`user`,`input`),action:n})}function Bd(e,t={},n){let r=Nd(e,`user`,`input`),i=Object.create(null);for(let e of Object.keys(t))r[e]?.input!==!1&&(i[e]=t[e]);return Rd(i,{fields:r,action:n})}function Vd(e,t,n){return Rd(t,{fields:Nd(e,`session`,`input`),action:n})}function Hd(e){let t=Nd(e,`session`,`input`),n={};for(let e in t)t[e].defaultValue!==void 0&&(n[e]=typeof t[e].defaultValue==`function`?t[e].defaultValue():t[e].defaultValue);return n}function Ud(e,t){if(!t)return e;for(let n in t){let r=t[n]?.modelName;r&&(e[n].modelName=r);for(let r in e[n].fields){let i=t[n]?.fields?.[r];i&&(e[n].fields[r].fieldName=i)}}return e}var Wd=(e,t=`ms`)=>new Date(Date.now()+(t===`sec`?e*1e3:e));function Gd(e){if(e.indexOf(`%`)===-1)return e;try{return decodeURIComponent(e)}catch{return e}}var Kd=`__Secure-`;function qd(e){if(!e)return[];let t=[],n=0,r=0;for(;r<e.length;){if(e[r]===`,`){let i=r+1;for(;i<e.length&&e[i]===` `;)i++;for(;i<e.length&&e[i]!==`=`&&e[i]!==`;`&&e[i]!==`,`;)i++;if(i<e.length&&e[i]===`=`){let i=e.slice(n,r).trim();for(i&&t.push(i),n=r+1;n<e.length&&e[n]===` `;)n++;r=n;continue}}r++}let i=e.slice(n).trim();return i&&t.push(i),t}function Jd(e){let t=new Map;return qd(e).forEach(e=>{let[n,...r]=e.split(`;`).map(e=>e.trim()),[i,...a]=(n||``).split(`=`),o=Zd(a.join(`=`));if(!i)return;let s={value:Gd(o)};r.forEach(e=>{let[t,...n]=e.split(`=`),r=n.join(`=`),i=t.trim().toLowerCase();switch(i){case`max-age`:s[`max-age`]=r?parseInt(r.trim(),10):void 0;break;case`expires`:s.expires=r?new Date(r.trim()):void 0;break;case`domain`:s.domain=r?r.trim():void 0;break;case`path`:s.path=r?r.trim():void 0;break;case`secure`:s.secure=!0;break;case`httponly`:s.httponly=!0;break;case`samesite`:s.samesite=r?r.trim().toLowerCase():void 0;break;case`partitioned`:s.partitioned=!0;break;default:s[i]=!r||r.trim()}}),t.set(i,s)}),t}var Yd=/^[\x21\x23-\x27\x2A\x2B\x2D\x2E\x30-\x39\x41-\x5A\x5E\x5F\x60\x61-\x7A\x7C\x7E]+$/,Xd=/^[\x20\x21\x23-\x3A\x3C-\x5B\x5D-\x7E]*$/;function Zd(e){return e.length<2||!e.startsWith(`"`)||!e.endsWith(`"`)?e:e.slice(1,-1)}function Qd(e){let t=0,n=e.length;for(;t<n;){let n=e.charCodeAt(t);if(n!==32&&n!==9)break;t++}for(;n>t;){let t=e.charCodeAt(n-1);if(t!==32&&t!==9)break;n--}return t===0&&n===e.length?e:e.slice(t,n)}function $d(e){let t=new Map;if(e.length<2)return t;for(let n of e.split(`;`)){let e=n.indexOf(`=`);if(e===-1)continue;let r=Qd(n.slice(0,e)),i=Zd(Qd(n.slice(e+1)));Yd.test(r)&&Xd.test(i)&&t.set(r,Gd(i))}return t}var ef=4050,tf=100;function nf(e,t){return ef-co(e,``,{...t}).length}function rf(e,t){let n=`${e}.`;if(!t.startsWith(n))return null;let r=t.slice(n.length),i=Number(r);return!Number.isSafeInteger(i)||i<0||String(i)!==r?null:i}function af(e,t){let n={},r=$d(t.headers?.get(`cookie`)||``);for(let[t,i]of r)(t===e||rf(e,t)!==null)&&(n[t]=i);return n}function of(e,t,n,r){let i=nf(`${t.name}.99`,t.attributes),a=i>0?Math.ceil(t.value.length/i):1/0;if(a<=1)return n[t.name]=t.value,[t];if(a>tf)return r.warn(`${e} cookie is too large to store even after chunking, so the cookie cache was skipped. Reduce the cached data size or avoid storing this data in cookies.`),[];let o=[];for(let e=0;e<a;e++){let r=`${t.name}.${e}`,a=e*i,s=t.value.substring(a,a+i);o.push({...t,name:r,value:s}),n[r]=s}return r.debug(`CHUNKING_${e.toUpperCase()}_COOKIE`,{message:`${e} cookie exceeds the ${ef} byte limit and was split into ${a} chunks.`,valueSize:t.value.length,chunkCount:a,chunkSizes:o.map(e=>e.value.length)}),o}function sf(e,t){let n={};for(let r in e)n[r]={name:r,value:``,attributes:{...t,maxAge:0}};return n}var cf=e=>(t,n,r)=>{let i=af(t,r),a=r.context.logger,o=()=>{let e=sf(i,n);for(let e in i)delete i[e];return e};return{chunk(r,s){let c=o(),l=of(e,{name:t,value:r,attributes:{...n,...s}},i,a);for(let e of l)c[e.name]=e;return Object.values(c)},clean(){return Object.values(o())},setCookies(e){for(let t of e)r.setCookie(t.name,t.value,t.attributes)}}},lf=cf(`Session`),uf=cf(`Account`);function df(e,t){let n=e.getCookie(t);if(n)return n;let r=[],i=e.headers?.get(`cookie`);if(!i)return null;for(let[e,n]of $d(i)){let i=rf(t,e);i!==null&&r.push({index:i,value:n})}return r.length>0?(r.sort((e,t)=>e.index-t.index),r.map(e=>e.value).join(``)):null}async function ff(e,t){let n=e.context.authCookies.accountData,r={maxAge:300,...n.attributes},i=await ji(t,e.context.secretConfig,`better-auth-account`,r.maxAge),a=uf(n.name,r,e);a.setCookies(a.chunk(i,r))}async function pf(e){let t=df(e,e.context.authCookies.accountData.name);if(t){let n=ue(await Ni(t,e.context.secretConfig,`better-auth-account`));if(n)return n}return null}var mf=s(w({disableCookieCache:xe().meta({description:`Disable cookie cache and fetch session from database`}).optional(),disableRefresh:xe().meta({description:`Disable session refresh. Useful for checking session status, without updating the session`}).optional()}));function hf(e){return!!e&&(typeof e==`object`||typeof e==`function`)&&typeof e.then==`function`}var gf=1e3,_f=gf*60,vf=_f*60,yf=vf*24,bf=yf*7,xf=yf*30,Sf=yf*365.25,Cf=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|months?|mo|years?|yrs?|y)(?: (ago|from now))?$/i;function wf(e){let t=Cf.exec(e);if(!t||t[4]&&t[1])throw TypeError(`Invalid time string format: "${e}". Use formats like "7d", "30m", "1 hour", etc.`);let n=parseFloat(t[2]),r=t[3].toLowerCase(),i;switch(r){case`years`:case`year`:case`yrs`:case`yr`:case`y`:i=n*Sf;break;case`months`:case`month`:case`mo`:i=n*xf;break;case`weeks`:case`week`:case`w`:i=n*bf;break;case`days`:case`day`:case`d`:i=n*yf;break;case`hours`:case`hour`:case`hrs`:case`hr`:case`h`:i=n*vf;break;case`minutes`:case`minute`:case`mins`:case`min`:case`m`:i=n*_f;break;case`seconds`:case`second`:case`secs`:case`sec`:case`s`:i=n*gf;break;default:throw TypeError(`Unknown time unit: "${r}"`)}return t[1]===`-`||t[4]===`ago`?-i:i}function Tf(e){return wf(e)}function Ef(e){return Math.round(wf(e)/1e3)}var Df=C({session:kd.loose(),user:Ad.loose(),updatedAt:d(),version:c().optional()}),Of=w({session:i(c(),o()),expiresAt:d(),signature:c()});function kf(e){let t=ue(e);if(t===null)return null;let n=Df.safeParse(t);return n.success?n.data:(_e.warn(`Cookie cache payload failed schema validation`,{issues:n.error.issues.map(({code:e,path:t})=>({code:e,path:t}))}),null)}function Af(e){let t=Of.safeParse(e);return t.success?t.data:null}var jf=new Map,Mf=new TextEncoder,Nf={decode:(e,t=`utf-8`)=>(jf.has(t)||jf.set(t,new TextDecoder(t)),jf.get(t).decode(e)),encode:e=>Mf.encode(e)},Pf=(e=`SHA-256`,t=`none`)=>{let n={importKey:async(t,n)=>Ii().importKey(`raw`,D(t),{name:`HMAC`,hash:{name:e}},!1,[n]),sign:async(e,r)=>{typeof e==`string`&&(e=await n.importKey(e,`sign`));let i=await Ii().sign(`HMAC`,e,D(r));return t===`hex`?he.encode(i):t===`base64`?te.encode(i):t===`base64url`||t===`base64urlnopad`?ve.encode(i,{padding:t!==`base64urlnopad`}):i},verify:async(e,r,i)=>(typeof e==`string`&&(e=await n.importKey(e,`verify`)),t===`hex`&&(i=typeof i==`string`?he.toBytes(i):i),(t===`base64`||t===`base64url`||t===`base64urlnopad`)&&(i=await te.decode(i)),Ii().verify(`HMAC`,e,D(i),D(r)))};return n};function Ff(e){let t=typeof e.baseURL==`string`?e.baseURL:void 0,n=typeof e.baseURL==`object`&&e.baseURL!==null?e.baseURL.protocol:void 0,r=(e.advanced?.useSecureCookies===void 0?n===`https`||n!==`http`&&(t?t.startsWith(`https://`):I):e.advanced?.useSecureCookies)?Kd:``,i=!!e.advanced?.crossSubDomainCookies?.enabled,a=i?e.advanced?.crossSubDomainCookies?.domain||(t?new URL(t).hostname:void 0):void 0;if(i&&!a&&!ju(e.baseURL))throw new V(`baseURL is required when crossSubdomainCookies are enabled.`);function o(t,n={}){let o=e.advanced?.cookiePrefix||`better-auth`,s=e.advanced?.cookies?.[t]?.name||`${o}.${t}`,c=e.advanced?.cookies?.[t]?.attributes??{};return{name:`${r}${s}`,attributes:{secure:!!r,sameSite:`lax`,path:`/`,httpOnly:!0,...i?{domain:a}:{},...e.advanced?.defaultCookieAttributes,...n,...c}}}return o}function If(e){let t=Ff(e),n=t(`session_token`,{maxAge:e.session?.expiresIn||Ef(`7d`)}),r=t(`session_data`,{maxAge:e.session?.cookieCache?.maxAge||300}),i=t(`account_data`,{maxAge:e.session?.cookieCache?.maxAge||300}),a=t(`dont_remember`);return{sessionToken:{name:n.name,attributes:n.attributes},sessionData:{name:r.name,attributes:r.attributes},dontRememberToken:{name:a.name,attributes:a.attributes},accountData:{name:i.name,attributes:i.attributes}}}async function Lf(e,t,n){if(!e.context.options.session?.cookieCache?.enabled)return;let r=jd(t.session,e.context.options.session?.additionalFields),i=Pd(e.context.options,t.user),a=e.context.options.session?.cookieCache?.version,o=`1`;if(a){if(typeof a==`string`)o=a;else if(typeof a==`function`){let e=a(t.session,t.user);o=hf(e)?await e:e}}let s={session:r,user:i,updatedAt:Date.now(),version:o},c={...e.context.authCookies.sessionData.attributes,maxAge:n?void 0:e.context.authCookies.sessionData.attributes.maxAge},l=Wd(c.maxAge||60,`sec`).getTime(),u=e.context.options.session?.cookieCache?.strategy||`compact`,d;if(u===`jwe`)d=await ji(s,e.context.secretConfig,`better-auth-session`,c.maxAge||300);else if(u===`jwt`){let t=e.context.sessionConfig.cookieCacheSigner;d=t?await t.sign(e,s,c.maxAge||300):await Si(s,e.context.secret,c.maxAge||300)}else d=ve.encode(JSON.stringify({session:s,expiresAt:l,signature:await Pf(`SHA-256`,`base64urlnopad`).sign(e.context.secret,JSON.stringify({...s,expiresAt:l}))}),{padding:!1});let f=lf(e.context.authCookies.sessionData.name,c,e);if(f.setCookies(f.chunk(d,c)),e.context.options.account?.storeAccountCookie&&!Vf(e,e.context.authCookies.accountData.name)){let n=await pf(e);if(n){if(!Dd(e.context.options)||n.userId===t.user.id)await ff(e,n);else{Hf(e,e.context.authCookies.accountData);let t=uf(e.context.authCookies.accountData.name,e.context.authCookies.accountData.attributes,e);t.setCookies(t.clean())}}}}async function Rf(e,t){let n=e.context.options.session?.cookieCache?.strategy||`compact`;if(n===`jwe`){let n=await Ni(t,e.context.secretConfig,`better-auth-session`),r=kf(n);return r?{session:r,expiresAt:n?.exp?n.exp*1e3:Date.now()}:null}if(n===`jwt`){let n=e.context.sessionConfig.cookieCacheSigner;if(n){let r=await n.verify(e,t);return r?{session:r.payload,expiresAt:r.expiresAt}:null}let r=await Ci(t,e.context.secret),i=kf(r);return i?{session:i,expiresAt:r?.exp?r.exp*1e3:Date.now()}:null}let r=Af(ue(Nf.decode(ve.decode(t))));if(!r||!await Pf(`SHA-256`,`base64urlnopad`).verify(e.context.secret,JSON.stringify({...r.session,expiresAt:r.expiresAt}),r.signature))return null;let i=kf(r.session);return i?{session:i,expiresAt:r.expiresAt}:null}async function zf(e,t,n,r){let i=await e.getSignedCookie(e.context.authCookies.dontRememberToken.name,e.context.secret);n=n===void 0?!!i:n;let a=e.context.authCookies.sessionToken.attributes,o=n?void 0:e.context.sessionConfig.expiresIn;await e.setSignedCookie(e.context.authCookies.sessionToken.name,t.session.token,e.context.secret,{...a,maxAge:o,...r}),n&&await e.setSignedCookie(e.context.authCookies.dontRememberToken.name,`true`,e.context.secret,e.context.authCookies.dontRememberToken.attributes),await Lf(e,t,n),e.context.setNewSession(t)}function Bf(e,t){let n=e,r=new Set;n.responseHeaders&&r.add(n.responseHeaders),n.context?.responseHeaders&&r.add(n.context.responseHeaders);let i=`${t}=`,a=`${t}.`;for(let e of r){let t=typeof e.getSetCookie==`function`?e.getSetCookie():qd(e.get(`set-cookie`)||``);if(!t.length)continue;let n=t.filter(e=>!e.startsWith(i)&&!e.startsWith(a));if(n.length!==t.length){e.delete(`set-cookie`);for(let t of n)e.append(`set-cookie`,t)}}}function Vf(e,t){let n=e,r=new Set;n.responseHeaders&&r.add(n.responseHeaders),n.context?.responseHeaders&&r.add(n.context.responseHeaders);let i=`${t}=`,a=`${t}.`;for(let e of r)if((typeof e.getSetCookie==`function`?e.getSetCookie():qd(e.get(`set-cookie`)||``)).some(e=>e.startsWith(i)||e.startsWith(a)))return!0;return!1}function Hf(e,t){Bf(e,t.name),e.setCookie(t.name,``,{...t.attributes,maxAge:0})}function Uf(e,t){if(Hf(e,e.context.authCookies.sessionToken),Hf(e,e.context.authCookies.sessionData),e.context.options.account?.storeAccountCookie){Hf(e,e.context.authCookies.accountData);let t=uf(e.context.authCookies.accountData.name,e.context.authCookies.accountData.attributes,e),n=t.clean();t.setCookies(n)}e.context.oauthConfig.storeStateStrategy===`cookie`&&Hf(e,e.context.createAuthCookie(`oauth_state`));let n=lf(e.context.authCookies.sessionData.name,e.context.authCookies.sessionData.attributes,e),r=n.clean();n.setCookies(r),t||Hf(e,e.context.authCookies.dontRememberToken)}var Wf=()=>X(`/get-session`,{method:[`GET`,`POST`],operationId:`getSession`,query:mf,requireHeaders:!0,metadata:{openapi:{operationId:`getSession`,description:`Get the current session`,responses:{200:{description:`Success`,content:{"application/json":{schema:{type:[`object`,`null`],properties:{session:{$ref:`#/components/schemas/Session`},user:{$ref:`#/components/schemas/User`}},required:[`session`,`user`]}}}}}}}},async e=>{e.setHeader(`cache-control`,`no-store`),e.setHeader(`pragma`,`no-cache`);let t=e.context.options.session?.deferSessionRefresh,n=e.method===`POST`;if(n&&!t)throw B.from(`METHOD_NOT_ALLOWED`,as.METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED);try{let r=e.context.options.session?.cookieCache?.enabled===!0,i=await e.getSignedCookie(e.context.authCookies.sessionToken.name,e.context.secret);if(!i&&r)return null;let a=df(e,e.context.authCookies.sessionData.name);if(a&&!r){let t=lf(e.context.authCookies.sessionData.name,e.context.authCookies.sessionData.attributes,e);t.setCookies(t.clean())}if(!i)return null;let o=r&&!e.query?.disableCookieCache,s=o&&a?await Rf(e,a):null;o&&a&&!s&&Hf(e,e.context.authCookies.sessionData);let c=await e.getSignedCookie(e.context.authCookies.dontRememberToken.name,e.context.secret);if(s?.session){let t=s.session,n=t.session.token!==i;if(!n){let r=e.context.options.session?.cookieCache?.version,i=`1`;if(r){if(typeof r==`string`)i=r;else if(typeof r==`function`){let e=r(t.session,t.user);i=e instanceof Promise?await e:e}}n=(t.version||`1`)!==i}if(!n){let e=Date.now(),r=new Date(t.session.expiresAt).getTime();n=s.expiresAt<e||!Number.isFinite(r)||r<e}if(n)Hf(e,e.context.authCookies.sessionData);else{let n=e.context.sessionConfig.cookieRefreshCache;if(n===!1){e.context.session=t;let n=Id(e.context.options,{...t.session,expiresAt:new Date(t.session.expiresAt),createdAt:new Date(t.session.createdAt),updatedAt:new Date(t.session.updatedAt)}),r=Pd(e.context.options,{...t.user,createdAt:new Date(t.user.createdAt),updatedAt:new Date(t.user.updatedAt)});return e.json({session:n,user:r})}let r=s.expiresAt-Date.now(),i=n.updateAge*1e3,a=await Cd();if(r<i&&!a){let n={session:{...t.session},user:t.user,updatedAt:Date.now()};await Lf(e,n,!1);let r=e.context.authCookies.sessionToken.attributes,i=c?void 0:e.context.sessionConfig.expiresIn;await e.setSignedCookie(e.context.authCookies.sessionToken.name,t.session.token,e.context.secret,{...r,maxAge:i});let a=Id(e.context.options,{...n.session,expiresAt:new Date(n.session.expiresAt),createdAt:new Date(n.session.createdAt),updatedAt:new Date(n.session.updatedAt)}),o=Pd(e.context.options,{...n.user,createdAt:new Date(n.user.createdAt),updatedAt:new Date(n.user.updatedAt)});return e.context.session={session:a,user:o},e.json({session:a,user:o})}let o=Id(e.context.options,{...t.session,expiresAt:new Date(t.session.expiresAt),createdAt:new Date(t.session.createdAt),updatedAt:new Date(t.session.updatedAt)}),l=Pd(e.context.options,{...t.user,createdAt:new Date(t.user.createdAt),updatedAt:new Date(t.user.updatedAt)});return e.context.session={session:o,user:l},e.json({session:o,user:l})}}let l=await e.context.internalAdapter.findSession(i);if(e.context.session=l,!l||l.session.expiresAt<new Date)return Uf(e),l&&(!t||n)&&await e.context.internalAdapter.deleteSession(l.session.token),e.json(null);if(c||e.query?.disableRefresh){let t=Id(e.context.options,l.session),n=Pd(e.context.options,l.user);return e.json({session:t,user:n})}let u=e.context.sessionConfig.expiresIn,d=e.context.sessionConfig.updateAge,f=l.session.expiresAt.valueOf()-u*1e3+d*1e3<=Date.now(),p=e.query?.disableRefresh||e.context.options.session?.disableSessionRefresh,m=await Cd(),h=f&&!p&&!m;if(t&&!n){await Lf(e,l,!!c);let t=Id(e.context.options,l.session),n=Pd(e.context.options,l.user);return e.json({session:t,user:n,needsRefresh:h})}if(h){let t=await e.context.internalAdapter.updateSession(l.session.token,{expiresAt:Wd(e.context.sessionConfig.expiresIn,`sec`),updatedAt:new Date});if(!t)throw Uf(e),B.from(`UNAUTHORIZED`,as.FAILED_TO_GET_SESSION);let n=e.context.sessionConfig.expiresIn;await zf(e,{session:t,user:l.user},!1,{maxAge:n});let r=Id(e.context.options,t),i=Pd(e.context.options,l.user);return e.json({session:r,user:i})}await Lf(e,l,!!c);let g=Id(e.context.options,l.session),_=Pd(e.context.options,l.user);return e.json({session:g,user:_})}catch(t){throw Ql(t)?t:(e.context.logger.error(`INTERNAL_SERVER_ERROR`,t),B.from(`INTERNAL_SERVER_ERROR`,as.FAILED_TO_GET_SESSION))}}),Gf=e=>Td(e.context.options),Z=async(e,t)=>{if(e.context.session)return e.context.session;let n=await Wf()({...e,method:`GET`,asResponse:!1,headers:e.headers,returnHeaders:!0,returnStatus:!1,query:{...t,...e.query,disableCookieCache:t?.disableCookieCache||e.query?.disableCookieCache,disableRefresh:t?.disableRefresh||e.query?.disableRefresh}}).catch(()=>null);return n?(n.headers&&n.headers.forEach((t,n)=>{let r=n.toLowerCase();r!==`cache-control`&&r!==`pragma`&&(r===`set-cookie`?e.responseHeaders.append(n,t):e.responseHeaders.set(n,t))}),e.context.session=n.response,n.response):(e.context.session=null,null)},Kf=async e=>Gf(e)?(e.context.session=null,Z(e,{disableCookieCache:!0})):Z(e),qf=du(async e=>{let t=await Z(e);if(!t?.session)throw B.from(`UNAUTHORIZED`,{message:`Unauthorized`,code:`UNAUTHORIZED`});return{session:t}}),Jf=du(async e=>{let t=await Kf(e);if(!t?.session)throw B.from(`UNAUTHORIZED`,{message:`Unauthorized`,code:`UNAUTHORIZED`});return{session:t}});du(async e=>{let t=await Z(e);if(!t?.session&&(e.request||e.headers))throw B.from(`UNAUTHORIZED`,{message:`Unauthorized`,code:`UNAUTHORIZED`});return{session:t}});var Yf=du(async e=>{let t=await Z(e);if(!t?.session)throw B.from(`UNAUTHORIZED`,{message:`Unauthorized`,code:`UNAUTHORIZED`});if(e.context.sessionConfig.freshAge!==0){let n=new Date(t.session.createdAt).getTime(),r=e.context.sessionConfig.freshAge*1e3;if(Date.now()-n>=r)throw B.from(`FORBIDDEN`,as.SESSION_NOT_FRESH)}return{session:t}}),Xf=()=>X(`/list-sessions`,{method:`GET`,operationId:`listUserSessions`,use:[Yf],requireHeaders:!0,metadata:{openapi:{operationId:`listUserSessions`,description:`List all active sessions for the user`,responses:{200:{description:`Success`,content:{"application/json":{schema:{type:`array`,items:{$ref:`#/components/schemas/Session`}}}}}}}}},async e=>{try{let t=(await e.context.internalAdapter.listSessions(e.context.session.user.id,{onlyActiveSessions:!0})).filter(e=>e.expiresAt>new Date);return e.json(t.map(t=>Id(e.context.options,t)))}catch(t){throw e.context.logger.error(t),e.error(`INTERNAL_SERVER_ERROR`)}}),Zf=X(`/revoke-session`,{method:`POST`,body:w({token:c().meta({description:`The token to revoke`})}),use:[Jf],requireHeaders:!0,metadata:{openapi:{description:`Revoke a single session`,requestBody:{content:{"application/json":{schema:{type:`object`,properties:{token:{type:`string`,description:`The token to revoke`}},required:[`token`]}}}},responses:{200:{description:`Success`,content:{"application/json":{schema:{type:`object`,properties:{status:{type:`boolean`,description:`Indicates if the session was revoked successfully`}},required:[`status`]}}}}}}}},async e=>{let t=e.body.token;if((await e.context.internalAdapter.findSession(t))?.session.userId===e.context.session.user.id)try{await e.context.internalAdapter.deleteSession(t)}catch(t){throw e.context.logger.error(t&&typeof t==`object`&&`name`in t?t.name:``,t),B.from(`INTERNAL_SERVER_ERROR`,{message:`Internal Server Error`,code:`INTERNAL_SERVER_ERROR`})}return e.json({status:!0})}),Qf=X(`/revoke-sessions`,{method:`POST`,use:[Jf],requireHeaders:!0,metadata:{openapi:{description:`Revoke all sessions for the user`,responses:{200:{description:`Success`,content:{"application/json":{schema:{type:`object`,properties:{status:{type:`boolean`,description:`Indicates if all sessions were revoked successfully`}},required:[`status`]}}}}}}}},async e=>{try{await e.context.internalAdapter.deleteUserSessions(e.context.session.user.id)}catch(t){throw e.context.logger.error(t&&typeof t==`object`&&`name`in t?t.name:``,t),B.from(`INTERNAL_SERVER_ERROR`,{message:`Internal Server Error`,code:`INTERNAL_SERVER_ERROR`})}return e.json({status:!0})}),$f=X(`/revoke-other-sessions`,{method:`POST`,requireHeaders:!0,use:[Jf],metadata:{openapi:{description:`Revoke all other sessions for the user except the current one`,responses:{200:{description:`Success`,content:{"application/json":{schema:{type:`object`,properties:{status:{type:`boolean`,description:`Indicates if all other sessions were revoked successfully`}},required:[`status`]}}}}}}}},async e=>{let t=e.context.session;if(!t.user)throw B.from(`UNAUTHORIZED`,{message:`Unauthorized`,code:`UNAUTHORIZED`});let n=(await e.context.internalAdapter.listSessions(t.user.id)).filter(e=>e.expiresAt>new Date).filter(t=>t.token!==e.context.session.session.token);return await Promise.all(n.map(t=>e.context.internalAdapter.deleteSession(t.token))),e.json({status:!0})}),ep=`better_auth.operation_id`,tp=`better_auth.hook.type`,np=`better_auth.context`;function rp(e){if(typeof e!=`object`||!e)return!1;let t=Object.getPrototypeOf(e);return t!==null&&t!==Object.prototype&&Object.getPrototypeOf(t)!==null||Symbol.iterator in e?!1:Symbol.toStringTag in e?Object.prototype.toString.call(e)===`[object Module]`:!0}function ip(e,t,n=`.`,r){if(!rp(t))return ip(e,{},n,r);let i={...t};for(let t of Object.keys(e)){if(t===`__proto__`||t===`constructor`)continue;let a=e[t];a!=null&&(r&&r(i,t,a,n)||(i[t]=Array.isArray(a)&&Array.isArray(i[t])?[...a,...i[t]]:rp(a)&&rp(i[t])?ip(a,i[t],(n?`${n}.`:``)+t.toString(),r):a))}return i}function ap(e){return(...t)=>t.reduce((t,n)=>ip(t,n,``,e),{})}var op=ap(),sp=new Set([`metadata.google.internal`,`metadata.goog`,`metadata`,`instance-data`,`instance-data.ec2.internal`]);function cp(e){return e.length>=2&&e.startsWith(`[`)&&e.endsWith(`]`)?e.slice(1,-1):e}function lp(e){if(e.startsWith(`[`)){let t=e.indexOf(`]`);return t===-1?e:e.slice(0,t+1)}let t=e.indexOf(`:`);return t===-1||e.indexOf(`:`,t+1)!==-1?e:e.slice(0,t)}function up(e){let t=e.indexOf(`%`);return t===-1?e:e.slice(0,t)}function dp(e){return e.replace(/\.+$/,``)}function fp(e){return/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(e)}function pp(e){let t=e.split(`.`);return(Number(t[0])<<24|Number(t[1])<<16|Number(t[2])<<8|Number(t[3]))>>>0}function mp(e,t,n){if(n===0)return!0;let r=n===32?4294967295:-1<<32-n>>>0;return(e&r)===(t&r)}function hp(e){if(e===`0.0.0.0`)return`unspecified`;if(e===`255.255.255.255`)return`broadcast`;let t=pp(e);return mp(t,pp(`127.0.0.0`),8)?`loopback`:mp(t,pp(`10.0.0.0`),8)||mp(t,pp(`172.16.0.0`),12)||mp(t,pp(`192.168.0.0`),16)?`private`:mp(t,pp(`169.254.0.0`),16)?`linkLocal`:mp(t,pp(`100.64.0.0`),10)?`sharedAddressSpace`:mp(t,pp(`192.0.2.0`),24)||mp(t,pp(`198.51.100.0`),24)||mp(t,pp(`203.0.113.0`),24)?`documentation`:mp(t,pp(`198.18.0.0`),15)?`benchmarking`:mp(t,pp(`224.0.0.0`),4)?`multicast`:mp(t,pp(`0.0.0.0`),8)||mp(t,pp(`192.0.0.0`),24)||mp(t,pp(`192.88.99.0`),24)||mp(t,pp(`240.0.0.0`),4)?`reserved`:`public`}function gp(e,t,n={}){let r=t*5,i=Number.parseInt(e.slice(r,r+4),16),a=Number.parseInt(e.slice(r+5,r+9),16);if(!Number.isFinite(i)||!Number.isFinite(a))return null;let o=(i<<16|a)>>>0;return n.xor&&(o=(o^4294967295)>>>0),`${o>>>24&255}.${o>>>16&255}.${o>>>8&255}.${o&255}`}function _p(e){if(e===`0000:0000:0000:0000:0000:0000:0000:0000`)return`unspecified`;if(e===`0000:0000:0000:0000:0000:0000:0000:0001`)return`loopback`;let t=Number.parseInt(e.slice(0,2),16),n=Number.parseInt(e.slice(2,4),16);if(t===255)return`multicast`;if(t===254&&(n&192)==128)return`linkLocal`;if(t===254&&(n&192)==192)return`reserved`;if((t&254)==252)return`private`;if(e.startsWith(`2001:0db8:`))return`documentation`;if(e.startsWith(`2001:0002:0000:`))return`benchmarking`;if(e.startsWith(`2002:`)){let t=gp(e,1);return t&&hp(t)!==`public`?`reserved`:`public`}if(e.startsWith(`0064:ff9b:0000:0000:0000:0000:`)){let t=gp(e,6);return t&&hp(t),`reserved`}if(e.startsWith(`0064:ff9b:0001:`))return`reserved`;if(e.startsWith(`2001:0000:`)){let t=gp(e,6,{xor:!0});return t&&hp(t),`reserved`}return e.startsWith(`0100:0000:0000:0000:`)?`reserved`:e.startsWith(`3fff:0`)?`documentation`:e.startsWith(`5f00:`)||e.startsWith(`0000:0000:0000:0000:0000:0000:`)?`reserved`:`public`}function vp(e){let t=dp(up(cp(lp(e.trim())))).toLowerCase();if(t===``)return{kind:`reserved`,literal:`fqdn`,canonical:``};if(!Wu(t))return t===`localhost`||t.endsWith(`.localhost`)?{kind:`localhost`,literal:`fqdn`,canonical:t}:sp.has(t)?{kind:`cloudMetadata`,literal:`fqdn`,canonical:t}:{kind:`public`,literal:`fqdn`,canonical:t};if(fp(t))return{kind:hp(t),literal:`ipv4`,canonical:t};let n=Xu(t,{ipv6Subnet:128});return fp(n)?{kind:hp(n),literal:`ipv4`,canonical:n}:{kind:_p(n),literal:`ipv6`,canonical:n}}function yp(e){return vp(e).kind===`loopback`}function bp(e){let t=vp(e).kind;return t===`loopback`||t===`localhost`}function xp(e){return vp(e).kind===`public`}var Sp=ap((e,t,n)=>{if(Array.isArray(e[t])&&Array.isArray(n))return e[t]=n,!0}),Cp=new WeakMap;function wp(e,t){let n=e.options;return n?.operationId??n?.metadata?.openapi?.operationId??t??e.path??`/:virtual`}function Tp(e,t){t&&t.forEach((t,n)=>{e.responseHeaders?n.toLowerCase()===`set-cookie`?e.responseHeaders.append(n,t):e.responseHeaders.set(n,t):e.responseHeaders=new Headers({[n]:t})})}function Ep(e){let t=e[F],n=e.headers&&e.headers!==t?new Headers(e.headers):null;if(!t&&!n)return null;let r=new Headers;return t?.forEach((e,t)=>{r.append(t,e)}),n?.forEach((e,t)=>{t.toLowerCase()===`set-cookie`?r.append(t,e):r.set(t,e)}),r}async function Dp(e,t,n,r){let i=le(e.context.options),a={};for(let o of t){let t=!1;try{t=o.matcher(e)}catch(t){let n=Cp.get(o.handler)??`unknown`;throw e.context.logger.error(`An error occurred during ${n} hook matcher execution:`,t),new B(`INTERNAL_SERVER_ERROR`,{message:`An error occurred during hook matcher execution. Check the logs for more details.`})}if(!t)continue;let s=Cp.get(o.handler)??`unknown`,c=n.path??`/:virtual`,l=await i(`hook before ${c} ${s}`,{[tp]:`before`,[pe]:c,[np]:s,[ep]:r},()=>o.handler({...e,returnHeaders:!0})).catch(t=>{throw Ql(t)&&ne(e.context.logger.level,`debug`)&&(t.stack=t.errorStack),t});Tp(e.context,l?.headers);let u=l?.response;if(u&&typeof u==`object`){if(`context`in u&&typeof u.context==`object`){let{headers:e,...t}=u.context;e instanceof Headers&&(a.headers?e.forEach((e,t)=>{a.headers?.set(t,e)}):a.headers=e),a=Sp(t,a);continue}return u}}return{context:a}}async function Op(e,t,n,r){let i=le(e.context.options);for(let a of t){if(!a.matcher(e))continue;let t=Cp.get(a.handler)??`unknown`,o=n.path??`/:virtual`,s=await i(`hook after ${o} ${t}`,{[tp]:`after`,[pe]:o,[np]:t,[ep]:r},()=>a.handler(e)).catch(t=>{if(Ql(t))return ne(e.context.logger.level,`debug`)&&(t.stack=t.errorStack),{response:t,headers:Ep(t)};throw t});Tp(e.context,s.headers),s.response!==void 0&&(e.context.returned=s.response)}return{response:e.context.returned,headers:e.context.responseHeaders}}function kp(e){let t=e.options.plugins||[],n=[],r=[],i=e.options.hooks?.before;i&&(Cp.set(i,`user`),n.push({matcher:()=>!0,handler:i}));let a=e.options.hooks?.after;a&&(Cp.set(a,`user`),r.push({matcher:()=>!0,handler:a}));let o=t.flatMap(e=>(e.hooks?.before??[]).map(t=>(Cp.set(t.handler,`plugin:${e.id}`),t))),s=t.flatMap(e=>(e.hooks?.after??[]).map(t=>(Cp.set(t.handler,`plugin:${e.id}`),t)));return o.length&&n.push(...o),s.length&&r.push(...s),{beforeHooks:n,afterHooks:r}}async function Ap(e,t){let n=le(t.context.options),r=t.operationId??wp(e),i=e.path??`/:virtual`,a=e.options?.method,o=Array.isArray(a)?a[0]:a,s=t.method??t.request?.method??o??`?`,c=t.asResponse??Mu(t.request),l={...t,context:{...t.context,returned:void 0,responseHeaders:void 0,session:t.context.session??null},path:e.path,headers:t.headers?new Headers(t.headers):void 0};return n(`${s} ${i}`,{[pe]:i,[ep]:r},async()=>su(l,async()=>{let{beforeHooks:a,afterHooks:o}=kp(l.context),s=await Dp(l,a,e,r);if(`context`in s&&s.context&&typeof s.context==`object`){let{headers:e,...t}=s.context;if(e){l.headers||(l.headers=new Headers);let t=l.headers;e.forEach((e,n)=>{t.set(n,e)})}l=Sp(t,l)}else if(s){let e=l.context.responseHeaders;return c?bo(s,{headers:e}):t.returnHeaders?{headers:e,response:s}:s}l.asResponse=!1,l.returnHeaders=!0,l.returnStatus=!0;let u=await su(l,()=>n(`handler ${i}`,{[pe]:i,[ep]:r},()=>e(l))).catch(e=>{if(Ql(e))return{response:e,status:e.statusCode,headers:Ep(e)};throw e});if(u instanceof Response)return u;l.context.returned=u.response,l.context.responseHeaders=u.headers??void 0;let d=await Op(l,o,e,r);if(d.response!==void 0&&(u.response=d.response),u.headers=d.headers??u.headers,Ql(u.response)&&ne(l.context.logger.level,`debug`)&&(u.response.stack=u.response.errorStack),Ql(u.response)&&!c)throw u.headers&&Object.defineProperty(u.response,F,{enumerable:!1,configurable:!0,writable:!1,value:u.headers}),u.response;return c?bo(u.response,{headers:u.headers??void 0,status:u.status}):t.returnHeaders?t.returnStatus?{headers:u.headers,response:u.response,status:u.status}:{headers:u.headers,response:u.response}:t.returnStatus?{response:u.response,status:u.status}:u.response}))}var jp=/^[a-z](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/i,Mp=new Set([`http:`,`https:`,`ws:`,`wss:`,`file:`,`ftp:`,`mailto:`,`javascript:`,`data:`,`vbscript:`,`blob:`,`about:`,`view-source:`]);function Np(e){let t=e.protocol.slice(0,-1),n=e.href.slice(e.protocol.length);return e.protocol!==`http:`&&e.protocol!==`https:`&&e.host.length===0&&n.startsWith(`/`)&&!n.startsWith(`//`)&&jp.test(t)}function Pp(e){return Mp.has(e.protocol)||e.host.length===0?!1:e.pathname.startsWith(`/`)}function Fp(e){return Np(e)||Pp(e)}var Q=_().superRefine((e,n)=>{let r;try{r=new URL(e)}catch{return n.addIssue({code:`custom`,message:`URL must be parseable`,fatal:!0}),t}Vu.includes(r.protocol)?n.addIssue({code:`custom`,message:`URL cannot use javascript:, data:, or vbscript: scheme`}):(e.includes(`#`)&&n.addIssue({code:`custom`,message:`Redirect URI must not contain a fragment component`}),r.protocol===`http:`&&!bp(r.host)&&n.addIssue({code:`custom`,message:`Redirect URI must use HTTPS (HTTP allowed only for loopback hosts)`}))}),Ip=(e,t)=>({getAllKeys:async n=>t?.adapter?.getJwks?await t.adapter.getJwks(n):await(await pd(e)).findMany({model:`jwks`}),getLatestKey:async n=>{let r=new Date,i=e=>!e.expiresAt||e.expiresAt>r;return t?.adapter?.getJwks?(await t.adapter.getJwks(n))?.filter(i).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]:(await(await pd(e)).findMany({model:`jwks`}))?.filter(i).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]},getKeyById:async(n,r)=>t?.adapter?.getJwks?(await t.adapter.getJwks(n))?.find(e=>e.id===r):await(await pd(e)).findOne({model:`jwks`,where:[{field:`id`,value:r}]})??void 0,getLatestKeyByAlg:async(n,r)=>{let i=t?.adapter?.getJwks?await t.adapter.getJwks(n):await(await pd(e)).findMany({model:`jwks`});if(!i)return;let a=t?.jwks?.keyPairConfig?.alg??`EdDSA`,o=new Date;return i.filter(e=>e.alg===r||e.alg==null&&a===r).filter(e=>!e.expiresAt||e.expiresAt>o).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]},createJwk:async(n,r)=>t?.adapter?.createJwk?await t.adapter.createJwk(r,n):await(await pd(e)).create({model:`jwks`,data:{...r,createdAt:new Date}})});function Lp(e,t){return typeof e==`number`?e:e instanceof Date?Math.floor(e.getTime()/1e3):t+Ef(e)}async function Rp(e){let{alg:t,...n}=e?.jwks?.keyPairConfig??{alg:`EdDSA`,crv:`Ed25519`},{publicKey:r,privateKey:i}=await xi(t,{...n,extractable:!0});return{publicWebKey:await ui(r),privateWebKey:await ui(i),alg:t,cfg:n}}async function zp(e,t){let{publicWebKey:n,privateWebKey:r,alg:i,cfg:a}=await Rp(t),o=a&&`crv`in a?a.crv:void 0,s=typeof n.crv==`string`?n.crv:void 0,c=o??s,l=JSON.stringify(r),u=!t?.jwks?.disablePrivateKeyEncryption,d={alg:i,...c?{crv:c}:{},publicKey:JSON.stringify(n),privateKey:u?JSON.stringify(await Ha({key:e.context.secretConfig,data:l})):l,createdAt:new Date,...t?.jwks?.rotationInterval?{expiresAt:new Date(Date.now()+t.jwks.rotationInterval*1e3)}:{}};return await Ip(e.context.adapter,t).createJwk(e,d)}async function Bp(e,t,n){if(t?.jwt?.sign)return null;let r=Ip(e.context.adapter,t),i;if(n?.signingKeyId!==void 0){if(i=await r.getKeyById(e,n.signingKeyId),!i)throw new V(`signJWT: signingKeyId "${n.signingKeyId}" not found in JWKS. The key must be provisioned before it can be referenced.`);if(n.signingAlgorithm!==void 0){let e=t?.jwks?.keyPairConfig?.alg??`EdDSA`;if((i.alg??e)!==n.signingAlgorithm)throw new V(`signJWT: signingKeyId "${n.signingKeyId}" has alg "${i.alg??`unset (inherits keyPairConfig.alg "${e}")`}" but signingAlgorithm was set to "${n.signingAlgorithm}".`)}}else if(n?.signingAlgorithm!==void 0){if(i=await r.getLatestKeyByAlg(e,n.signingAlgorithm),!i){let r=t?.jwks?.keyPairConfig?.alg??`EdDSA`,a=t?.jwks?.keyPairConfigs?.find(e=>e.alg===n.signingAlgorithm),o=r===n.signingAlgorithm;if(a||o)i=await zp(e,{...t,jwks:{...t?.jwks,keyPairConfig:a??t?.jwks?.keyPairConfig}});else{let e=t?.jwks?.keyPairConfigs?.map(e=>e.alg).join(`, `)||`none`;throw new V(`signJWT: no key with alg "${n.signingAlgorithm}" found in JWKS. The plugin auto-mints only one key matching keyPairConfig.alg="${r}"; additional algs configured via keyPairConfigs: ${e}. Add "${n.signingAlgorithm}" to jwks.keyPairConfigs so the plugin provisions it on first use, or mint the key explicitly via createJwk().`)}}}else{let n=t?.jwks?.keyPairConfig?.alg??`EdDSA`;i=await r.getLatestKeyByAlg(e,n)??await r.getLatestKey(e)}if(!i||i.expiresAt&&i.expiresAt<new Date){if(n?.signingKeyId!==void 0||n?.signingAlgorithm!==void 0)throw new V(`signJWT: requested signing key is expired and an explicit kid/alg was provided; not auto-minting a replacement. Rotate the key explicitly.`);i=await zp(e,t)}let a=t?.jwks?.disablePrivateKeyEncryption?i.privateKey:await Ua({key:e.context.secretConfig,data:JSON.parse(i.privateKey)}).catch(()=>{throw new V(`Failed to decrypt private key. Make sure the secret currently in use is the same as the one used to encrypt the private key. If you are using a different secret, either clean up your JWKS or disable private key encryption.`)}),o=i.alg??t?.jwks?.keyPairConfig?.alg??`EdDSA`,s=await _i(JSON.parse(a),o);return{alg:o,kid:i.id,privateKey:s}}async function Vp(e,t){let{options:n}=t,r=t.payload,i=Math.floor(Date.now()/1e3),a=r.iat,o=r.exp,s=Lp(n?.jwt?.expirationTime??`15m`,a??i);o??=s;let c=r.nbf,l=typeof e.context.options.baseURL==`string`?e.context.options.baseURL:``,u=r.iss,d=n?.jwt?.issuer??l,f=r.aud,p=n?.jwt?.audience??l;if(n?.jwt?.sign){let e={...r,iat:a,exp:o,nbf:c,iss:u??d,aud:f??p};return n.jwt.sign(e,t.header,{signingKeyId:t.signingKeyId,signingAlgorithm:t.signingAlgorithm})}let{alg:m,kid:h,privateKey:g}=t.resolvedKey??await Bp(e,n,{signingKeyId:t.signingKeyId,signingAlgorithm:t.signingAlgorithm}),_=new Kr(r).setProtectedHeader({...t.header,alg:m,kid:h}).setExpirationTime(o).setIssuer(u??d).setAudience(f??p);return a&&_.setIssuedAt(a),r.sub&&_.setSubject(r.sub),r.nbf&&_.setNotBefore(r.nbf),r.jti&&_.setJti(r.jti),await _.sign(g)}async function Hp(e,t){let n=t?.jwt?.definePayload?await t.jwt.definePayload(e.context.session):e.context.session.user;return await Vp(e,{options:t,payload:{iat:Math.floor(Date.now()/1e3),...n,sub:await t?.jwt?.getSubject?.(e.context.session)??e.context.session.user.id}})}var Up=new Set([`iss`,`sub`,`aud`,`exp`,`nbf`,`iat`,`jti`,`auth_time`,`nonce`,`acr`,`amr`,`azp`,`sid`,`at_hash`,`c_hash`,`s_hash`]);function Wp(e){if(!e)return{};let t=[],n=Object.create(null);for(let[r,i]of Object.entries(e))Up.has(r)?t.push(r):n[r]=i;return t.length>0&&_e.warn(`oauth-provider: stripped reserved id-token claim name(s): ${t.join(`, `)}. The AS owns these claim values.`),n}var Gp=i(c(),o()).nullable(),Kp=C({essential:v().optional(),value:c().optional(),values:x(c()).optional()}).nullable(),qp=w({acr:Kp.optional()}).catchall(Gp),Jp=C({userinfo:i(c(),Gp).optional(),id_token:qp.optional()});function Yp(e){if(typeof e==`string`)try{return JSON.parse(e)}catch{return}return e}function Xp(e){let t=Yp(e),n=Jp.safeParse(t);return n.success?n.data:void 0}var Zp=a([c(),i(c(),o())]),Qp=Zp,$p=Zp.refine(e=>Xp(e)!==void 0,{error:`claims must be a valid Claims request object`});function em(e){return e===void 0||Xp(e)!==void 0}function tm(e,t){let n=Xp(e)?.userinfo;if(!n)return[];let r=Object.keys(n);if(!t)return r;let i=new Set(t);return r.filter(e=>i.has(e))}function nm(e,t){let n=Xp(e);if(!n)return e===void 0;let r=n.id_token?.acr;if(!r||r.essential!==!0)return!0;let i=r.value===void 0||r.value===t,a=r.values===void 0||r.values.includes(t);return i&&a}function rm(e,t){let n=Xp(e);if(!n)return;let r=new Set(t),i=Object.fromEntries(Object.entries(n.userinfo??{}).filter(([e])=>r.has(e))),a=Object.keys(i).length?{...n,userinfo:i}:Object.fromEntries(Object.entries(n).filter(([e])=>e!==`userinfo`));return Object.keys(a).length?a:void 0}function im(e){let t=e.split(` `).filter(e=>e!==``);return t.length<=1?{}:{given:t.slice(0,-1).join(` `),family:t.at(-1)}}var am={name:{scope:`profile`,resolve:e=>e.name??void 0},picture:{scope:`profile`,resolve:e=>e.image??void 0},given_name:{scope:`profile`,resolve:e=>im(e.name).given},family_name:{scope:`profile`,resolve:e=>im(e.name).family},email:{scope:`email`,resolve:e=>e.email??void 0},email_verified:{scope:`email`,resolve:e=>e.emailVerified??!1}},om=Object.keys(am);function sm(e){return e.advertisedMetadata?.claims_supported??e.claims??[]}var cm=new Set([`iss`,`sub`,`aud`,`exp`,`iat`,`jti`,`client_id`,`scope`,`auth_time`,`acr`,`amr`,`cnf`]);function lm(e){if(!e)return{};let t=[],n={};for(let[r,i]of Object.entries(e))cm.has(r)?t.push(r):n[r]=i;return t.length>0&&_e.warn(`oauth-provider: stripped reserved access-token claim name(s): ${t.join(`, `)}. The AS owns these claim values.`),n}async function um(e){let{ctx:t,opts:n,user:r,client:i,scopes:a,resources:o,referenceId:s,metadata:c,grantType:l,sessionId:u,perRequestClaims:d,resourcePolicyClaims:f}=e,p=await ol(n,{ctx:t,opts:n,user:r,client:i,scopes:a,grantType:l,referenceId:s,sessionId:u,resources:o,metadata:c}),m=n.customAccessTokenClaims?await n.customAccessTokenClaims({user:r,scopes:a,resources:o,referenceId:s,metadata:c}):{};return lm({...p,...d??{},...m,...f})}var dm=[`javascript:`,`data:`,`vbscript:`],fm=c().superRefine((e,n)=>{if(!URL.canParse(e))return n.addIssue({code:`custom`,message:`resource must be an absolute URI`,fatal:!0}),t;e.includes(`#`)?n.addIssue({code:`custom`,message:`resource must not contain a fragment`}):dm.includes(new URL(e).protocol)&&n.addIssue({code:`custom`,message:`resource cannot use javascript:, data:, or vbscript: scheme`})}),pm=u([`none`,`consent`,`login`,`create`,`select_account`]),mm=c().superRefine((e,t)=>{let n=e.split(` `).map(e=>e.trim()).filter(Boolean),r=new Set;if(!n.length)t.addIssue({code:`custom`,message:`prompt must include at least one value`});else{for(let e of n){let n=pm.safeParse(e);n.success?r.add(n.data):t.addIssue({code:`custom`,message:`unsupported prompt value: ${e}`})}r.has(`none`)&&r.size>1&&t.addIssue({code:`custom`,message:`prompt=none cannot be combined with other prompt values`})}}),hm=w({keys:x(i(c(),o())).min(1)}),gm=a([d(),c().trim().min(1)]).transform((e,n)=>{let r=typeof e==`number`?e:Number(e);return!Number.isInteger(r)||r<0?(n.addIssue({code:`custom`,message:`max_age must be a non-negative integer`}),t):r}),_m=c().regex(/^[A-Za-z0-9_-]{43}$/,`dpop_jkt must be a base64url-encoded SHA-256 JWK thumbprint`),vm=w({response_type:c().pipe(u([`code`])).optional(),request:c().optional(),request_uri:c().optional(),redirect_uri:Q.optional(),scope:c().optional(),state:c().optional(),client_id:c().min(1,`client_id is required`),prompt:mm.optional(),display:c().optional(),ui_locales:c().optional(),max_age:gm.optional(),acr_values:c().optional(),login_hint:c().optional(),id_token_hint:c().optional(),code_challenge:c().optional(),code_challenge_method:c().pipe(u([`S256`])).optional(),nonce:c().optional(),claims:Qp.optional(),dpop_jkt:_m.optional(),resource:a([fm,x(fm).min(1)]).optional()}).passthrough(),ym=vm.extend({redirect_uri:Q.optional(),claims:$p.optional()}),bm=w({type:l(`authorization_code`),query:ym,sessionId:c(),userId:c(),referenceId:c().optional(),authTime:d().optional(),resource:x(c()).optional()}).passthrough(),xm=w({redirect_uris:x(Q).min(1).optional(),scope:c().optional(),client_name:c().refine(e=>e.trim().length>0,`client_name cannot be empty`).optional(),client_uri:c().optional(),logo_uri:c().optional(),contacts:x(c().min(1)).min(1).optional(),tos_uri:c().optional(),policy_uri:c().optional(),software_id:c().optional(),software_version:c().optional(),software_statement:c().optional(),post_logout_redirect_uris:x(Q).min(1).optional(),backchannel_logout_uri:Q.optional(),backchannel_logout_session_required:v().optional(),token_endpoint_auth_method:c().trim().min(1).optional(),jwks:hm.optional(),jwks_uri:c().optional(),grant_types:x(c().trim().min(1)).min(1).optional(),response_types:x(u([`code`])).optional(),application_type:u([`web`,`native`]).optional(),subject_type:u([`public`,`pairwise`]).optional(),dpop_bound_access_tokens:v().optional(),resources:x(fm).optional(),skip_consent:T({error:`skip_consent cannot be set during dynamic client registration`}).optional()}),Sm=xm.omit({skip_consent:!0}).extend({client_id:c().refine(e=>e.trim().length>0,`client_id cannot be empty`),client_secret:c().optional(),client_secret_expires_at:d().int().nonnegative().optional(),client_id_issued_at:d().int().nonnegative().optional()}).loose(),Cm=[`EdDSA`,`ES256`,`ES512`,`PS256`,`RS256`],wm=new Set(Cm),Tm=64;async function Em(e,t){let n=e.identifierValidator;if(n)return await n(t)?{ok:!0}:{ok:!1,reason:`resource identifier ${t} failed validation`};let r=fm.safeParse(t);return r.success?{ok:!0}:{ok:!1,reason:`resource identifier ${t} is invalid: ${r.error.issues[0]?.message??`not an absolute URI`}`}}async function Dm(e,t){let n=await Em(e,t);if(!n.ok)throw new B(`BAD_REQUEST`,{error:`invalid_target`,error_description:n.reason})}var Om=e=>`${e}/oauth2/userinfo`;async function km(e){if(!(e.headers.get(`content-type`)?.toLowerCase()??``).includes(`application/x-www-form-urlencoded`))return;let t;try{t=await e.clone().text()}catch{return}if(!t)return;let n=new URLSearchParams(t).getAll(`resource`).filter(e=>e.length>0);return n.length>0?n:void 0}function Am(e){if(e!=null){if(typeof e==`string`)return[e];if(Array.isArray(e)){let t=e.filter(e=>typeof e==`string`&&e.length>0);return t.length>0?t:void 0}}}async function jm(e,t,n,r=[]){if(n===void 0)return!0;let i=Array.isArray(n)?n:[n];if(i.length>Tm)return!1;let a=new Set(r),o=new Set;for(let e of i)a.has(e)||o.add(e);return o.size===0||(await Promise.all(Array.from(o,n=>zm(e,t,n)))).every(Boolean)}async function Mm(e,t,n){let r=Am(n.resource),i=n.requestedScopes.includes(`openid`),a=Om(e.context.baseURL??``);if(!r)return{audienceClaim:void 0,accessTokenTtl:null,refreshTokenTtl:null,signingAlgorithm:null,signingKeyId:null,rawCustomClaims:{},dpopBoundAccessTokensRequired:!1,effectiveScopes:[...n.requestedScopes]};let o=[...new Set(r)],s=[];for(let n of o){if(n===a)continue;let r=await zm(e,t,n);if(r){if(r.disabled)throw new B(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is disabled`});s.push(r)}else throw new B(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is not configured`})}let{value:c}=Im(t);c&&s.length>0&&await Nm(e,t,n.clientId,s);let l=[...n.requestedScopes];for(let e of s){if(e.allowedScopes===null||e.allowedScopes===void 0)continue;let t=new Set(e.allowedScopes),n=l.filter(e=>t.has(e));if(n.length===0)throw new B(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`none of the requested scopes are allowed for resource ${e.identifier}`});l=n}let u=null,d=null;for(let e of s)e.accessTokenTtl!=null&&(u=u===null?e.accessTokenTtl:Math.min(u,e.accessTokenTtl)),e.refreshTokenTtl!=null&&(d=d===null?e.refreshTokenTtl:Math.min(d,e.refreshTokenTtl));let f=new Set,p=new Set;for(let e of s)e.signingAlgorithm&&f.add(e.signingAlgorithm),e.signingKeyId&&p.add(e.signingKeyId);if(f.size>1)throw new B(`BAD_REQUEST`,{error:`invalid_request`,error_description:`multi-resource request has conflicting signingAlgorithm pins; a single JWS signature cannot satisfy multiple algorithms`});if(p.size>1)throw new B(`BAD_REQUEST`,{error:`invalid_request`,error_description:`multi-resource request has conflicting signingKeyId pins; a single JWS signature cannot satisfy multiple key ids`});let m=f.values().next().value??null,h=p.values().next().value??null,g={};for(let e of s)e.customClaims&&typeof e.customClaims==`object`&&Object.assign(g,e.customClaims);let _=s.some(e=>e.dpopBoundAccessTokensRequired===!0),v=i?[...o,a]:o,y=[...new Set(v)];return{audienceClaim:y.length===1?y[0]:y,accessTokenTtl:u,refreshTokenTtl:d,signingAlgorithm:m,signingKeyId:h,rawCustomClaims:g,dpopBoundAccessTokensRequired:_,effectiveScopes:l}}async function Nm(e,t,n,r){if(r.length===0)return;let i=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,a=await e.context.adapter.findMany({model:i,where:[{field:`clientId`,value:n}]}),o=new Set(a?.map(e=>e.resourceId)??[]),s=r.filter(e=>!o.has(e.identifier));if(s.length>0)throw new B(`BAD_REQUEST`,{error:`invalid_target`,error_description:`client ${n} is not linked to resource(s) ${s.map(e=>e.identifier).join(`, `)}`})}async function Pm(e,t,n,r){if(r.length===0)return!1;let i=t.schema?.oauthClientResource?.modelName??`oauthClientResource`;return((await e.context.adapter.findMany({model:i,where:[{field:`clientId`,value:n},{field:`resourceId`,operator:`in`,value:r}],limit:1}))?.length??0)>0}async function Fm(e,t,n){if(n.length===0)return{};let r=await e.context.adapter.findMany({model:t.schema?.oauthResource?.modelName??`oauthResource`,where:[{field:`identifier`,operator:`in`,value:n}]}),i=new Map(r.map(e=>[e.identifier,e])),a={};for(let e of n){let t=i.get(e);t?.customClaims&&typeof t.customClaims==`object`&&Object.assign(a,t.customClaims)}return a}function Im(e){return e.enforcePerClientResources===void 0?{value:!0,source:`default`}:{value:e.enforcePerClientResources,source:`explicit`}}var Lm=new Map;function Rm(e){e===void 0?Lm.clear():Lm.delete(e)}async function zm(e,t,n){if(await Ym(e.context,t),t.cachedResources?.has(n)){let e=Lm.get(n);if(e)return Object.assign({},e)}let r=await e.context.adapter.findOne({model:t.schema?.oauthResource?.modelName??`oauthResource`,where:[{field:`identifier`,value:n}]});return r&&t.cachedResources?.has(n)&&Lm.set(n,Object.assign({},r)),r}function Bm(e){return e.name??e.identifier}function Vm(e){let t=[];if(e.resources?.length)for(let n of e.resources)t.push(typeof n==`string`?{identifier:n}:n);return t}function Hm(e,t){return{identifier:e.identifier,name:Bm(e),accessTokenTtl:e.accessTokenTtl??null,refreshTokenTtl:e.refreshTokenTtl??null,signingAlgorithm:e.signingAlgorithm??null,signingKeyId:e.signingKeyId??null,allowedScopes:e.allowedScopes??null,customClaims:e.customClaims??null,dpopBoundAccessTokensRequired:e.dpopBoundAccessTokensRequired??!1,disabled:e.disabled??!1,policyVersion:1,metadata:e.metadata??null,createdAt:t,updatedAt:t}}function Um(e,t,n){if(t===`overwrite`){let{identifier:t,createdAt:r,...i}=Hm(e,n);return i}let r={updatedAt:n};return e.name!==void 0&&(r.name=e.name),e.accessTokenTtl!==void 0&&(r.accessTokenTtl=e.accessTokenTtl),e.refreshTokenTtl!==void 0&&(r.refreshTokenTtl=e.refreshTokenTtl),e.signingAlgorithm!==void 0&&(r.signingAlgorithm=e.signingAlgorithm),e.signingKeyId!==void 0&&(r.signingKeyId=e.signingKeyId),e.allowedScopes!==void 0&&(r.allowedScopes=e.allowedScopes),e.customClaims!==void 0&&(r.customClaims=e.customClaims),e.dpopBoundAccessTokensRequired!==void 0&&(r.dpopBoundAccessTokensRequired=e.dpopBoundAccessTokensRequired),e.disabled!==void 0&&(r.disabled=e.disabled),e.metadata!==void 0&&(r.metadata=e.metadata),r}var Wm=/no such table|relation.*does not exist|table.*does(?: not|n'?t) exist|model.*(?:does not exist|was not found in the schema)/i;function Gm(e,t){let n=!1,r=t;for(let e=0;r&&!n&&e<5;e++)n=Wm.test(r instanceof Error?r.message:String(r)),r=r instanceof Error?r.cause:void 0;n?e.logger.debug(`oauth-provider: oauthResource table not yet created; deferring resource seed to first access.`):e.logger.error("oauth-provider: could not seed `resources` at startup; retrying on first resource access.",t)}var Km=new WeakMap;function qm(e,t){let n=e.adapter,r=Km.get(n);r||(r=new WeakMap,Km.set(n,r));let i=r.get(t);if(i)return i;let a={completed:!1,promise:null};return r.set(t,a),a}async function Jm(e,t){let n=Vm(t);if(n.length===0)return;let r=t.resourceSeedMode??`insertOnly`,i=t.schema?.oauthResource?.modelName??`oauthResource`;for(let a of n){let n=await Em(t,a.identifier);if(!n.ok){_e.warn(`oauth-provider: skipping resource seed for ${a.identifier} — ${n.reason}`);continue}let o=a;if(o.signingAlgorithm!=null&&!wm.has(o.signingAlgorithm)){_e.warn(`oauth-provider: dropping unsupported signingAlgorithm "${o.signingAlgorithm}" for resource ${o.identifier} — must be one of ${Cm.join(`, `)}. Continuing without an algorithm override.`);let{signingAlgorithm:e,...t}=o;o=t}let s=[{field:`identifier`,value:o.identifier}],c=await e.adapter.findOne({model:i,where:s}),l=new Date;if(!c)try{await e.adapter.create({model:i,data:Hm(o,l)});continue}catch(t){if(!await e.adapter.findOne({model:i,where:s}).catch(()=>null))throw t}r!==`insertOnly`&&await e.adapter.update({model:i,where:s,update:Um(o,r,l)})}}async function Ym(e,t){let n=qm(e,t);if(n.completed!==!0)return n.promise===null&&(n.promise=Jm(e,t).then(()=>{n.completed=!0}).catch(e=>{throw n.promise=null,e})),n.promise}function Xm(e){let t=Im(e);_e.info(`oauth-provider: enforcePerClientResources resolved to ${t.value} (${t.source})`)}function Zm(e){return e.headers?.get(`dpop`)??void 0}function Qm(e,t){return e.request?.url??`${e.context.baseURL}${t}`}var $m=new Set([`openid`,`profile`,`email`,`offline_access`]);function eh(e){return $m.has(e)}function th(e){return[...new Set(e.map(e=>e.trim()).filter(Boolean))]}function nh(e,t,n,r){if(e.length===0)return;if(!t.includes(`client_credentials`))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`client_credentials_scopes requires the client_credentials grant`});if(n===`none`)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`public clients cannot be assigned client_credentials scopes`});let i=new Set(r.scopes??[]),a=e.filter(e=>!i.has(e)||eh(e));if(a.length>0)throw new B(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`The following client_credentials scopes are invalid: ${a.join(`, `)}`})}function rh(e,t,n=[]){let r=new Set(n),i={sub:e.id??void 0};for(let[n,a]of Object.entries(am))(t.includes(a.scope)||r.has(n))&&(i[n]=a.resolve(e));return i}function ih(e,t){let n={};for(let[r,i]of Object.entries(e??{}))i!==void 0&&(t&&r in t||(n[r]=i));return n}function ah(e){let t=e.headers?.get(`authorization`),n=fc(t),r=e.request?.method===`POST`?e.body?.access_token??void 0:void 0;if(n&&r)throw new B(`BAD_REQUEST`,{error_description:`Multiple access token transport methods are not allowed`,error:`invalid_request`});let i=n??(r?{scheme:`Bearer`,token:r}:void 0);return{authorization:i,token:i?.token}}async function oh(e,t){let{authorization:n}=ah(e);if(!n?.token)throw new B(`UNAUTHORIZED`,{error_description:`access token not found`,error:`invalid_request`});let{payload:r,requestedUserInfoClaims:i}=await sg(e,t,n.token);if(vc(r)&&!e.request)throw new B(`UNAUTHORIZED`,{error_description:`DPoP-bound access token requires an HTTP request context`,error:`invalid_token`});try{await Oc({payload:r,authorization:n,proofJwt:Zm(e),method:e.request?.method??`GET`,url:Qm(e,`/oauth2/userinfo`),proofMaxAgeSeconds:t.dpop?.proofMaxAgeSeconds,signingAlgorithms:t.dpop?.signingAlgorithms,replayStore:uc(e.context.internalAdapter)})}catch(e){throw Dc(e)?new B(`UNAUTHORIZED`,{error_description:e.message,error:e.code}):e}let a=r.scope?.split(` `);if(!a?.includes(`openid`))throw new B(`BAD_REQUEST`,{error_description:`Missing required scope`,error:`invalid_scope`});if(!r.sub)throw new B(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let o=await e.context.internalAdapter.findUserById(r.sub);if(!o)throw new B(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let s=rh(o,a??[],i),c=r.client_id??r.azp,l=c&&(t.pairwiseSecret||ll(t))?await xl(e,t,c):void 0;t.pairwiseSecret&&l&&(s.sub=await Kl(o.id,l,t));let u=a?.length?await cl(t,{ctx:e,opts:t,user:o,scopes:a,jwt:r,client:l??void 0,requestedClaims:i}):{},d=t.customUserInfoClaims&&a?.length?await t.customUserInfoClaims({user:o,scopes:a,jwt:r,requestedClaims:i}):{};return{...s,...ih(u,s),...ih(d),sub:s.sub}}var sh=Object.fromEntries(om.map(e=>[e,void 0]));function ch(e){return _c(e)?`DPoP`:`Bearer`}var lh=`at+jwt`;async function uh(e,t){let n=e.body.grant_type;if(!Qc(t).includes(n))throw new B(`BAD_REQUEST`,{error_description:`unsupported grant_type ${n}`,error:`unsupported_grant_type`});switch(n){case`authorization_code`:return Wh(e,t);case`client_credentials`:return Gh(e,t);case`refresh_token`:return Kh(e,t);default:{let r=$c(t,n);if(r)return r({ctx:e,opts:t,grantType:n,provider:dh(e,t,n)});throw new B(`BAD_REQUEST`,{error_description:`unsupported grant_type ${n}`,error:`unsupported_grant_type`})}}}function dh(e,t,n){return{getClient:n=>xl(e,t,n),authenticateClient:async r=>{let{clientId:i,clientSecret:a,preVerified:o,authMethod:s,confirmation:c}=Vl(await Hl(e,t,`${e.context.baseURL}${e.path??`/oauth2/token`}`));if(!i)throw new B(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});if(r?.requireCredentials!==!1&&!a&&!o)throw new B(`BAD_REQUEST`,{error_description:`Missing required client credentials`,error:`invalid_client`});return{clientId:i,client:await zl(e,t,i,a,r?.scopes,o,n,s),method:s,confirmation:c}},issueTokens:r=>{if(!n)throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`issueTokens requires a grant type; pass it to getOAuthProviderApi(ctx, opts, grantType).`,error:`server_error`});return Hh(e,t,{...r,grantType:n})},hashToken:(e,n)=>Dl(t.storeTokens,e,n),validateAccessToken:async(n,r)=>{let{validateAccessToken:i}=await Promise.resolve().then(()=>qh);return i(e,t,n,r)},requireActiveAccessToken:async(n,r)=>{let{requireActiveAccessToken:i}=await Promise.resolve().then(()=>qh);return i(e,t,n,r)}}}async function fh(e,t,n,r,i,a,o){let s=o?.iat??Math.floor(Date.now()/1e3),c=o?.exp??s+(t.accessTokenExpiresIn??3600),l=pl(e.context).options,u=n?.id??r.clientId;return Vp(e,{options:l,header:{typ:lh},signingKeyId:o?.signingKeyId??void 0,signingAlgorithm:o?.signingAlgorithm??void 0,payload:{...o?.accessTokenClaims??{},sub:u,aud:_l(i),client_id:r.clientId,azp:r.clientId,scope:a.join(` `),sid:o?.sid,iss:l?.jwt?.issuer??e.context.baseURL,iat:s,exp:c,jti:Fi(32),...o?.confirmation?{cnf:o.confirmation}:{}}})}async function ph(e,t){let n;n=t===`EdDSA`?`SHA-512`:t.endsWith(`384`)?`SHA-384`:t.endsWith(`512`)?`SHA-512`:`SHA-256`;let r=new Uint8Array(await crypto.subtle.digest(n,new TextEncoder().encode(e)));return G(r.slice(0,r.length/2))}async function mh(e,t,n,r,i,a,o,s,c,l){let u=Math.floor(Date.now()/1e3),d=u+(t.idTokenExpiresIn??36e3),f=await Kl(n.id,r,t),p=s==null?void 0:Math.floor(s.getTime()/1e3),m=Wp(t.customIdTokenClaims?await t.customIdTokenClaims({user:n,scopes:i,metadata:Bl(r.metadata)}):void 0),h=t.disableJwtPlugin?void 0:pl(e.context).options,g=!t.disableJwtPlugin&&!h?.jwt?.sign?await Bp(e,h):void 0,_=t.disableJwtPlugin?`HS256`:g?.alg??h?.jwks?.keyPairConfig?.alg,v=c?await ph(c,_):void 0,y=!!(r.enableEndSession||r.backchannelLogoutUri),b={...sh,auth_time:p,acr:`0`,...m,at_hash:v,iss:h?.jwt?.issuer??e.context.baseURL,sub:f,aud:r.clientId,nonce:a,iat:u,exp:d,sid:y?o:void 0},x=Wp(l);if(Object.assign(b,ih(x,b)),t.disableJwtPlugin&&!r.clientSecret)return;let S=t.disableJwtPlugin?await new Kr(b).setProtectedHeader({alg:`HS256`}).sign(new TextEncoder().encode(await wl(e,t.storeClientSecret,r.clientSecret))):await Vp(e,{options:h,payload:b,resolvedKey:g??void 0});if(S&&v&&h?.jwt?.sign){let e=vi(S);if(e.alg!==_)throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`ID token signed with "${e.alg}" but at_hash was computed for "${_}". Ensure jwt.sign uses the algorithm declared in keyPairConfig.alg.`,error:`server_error`})}return S}async function hh(e,t,n){return(e.prefix?.refreshToken??``)+(e.formatRefreshToken?.encrypt?e.formatRefreshToken.encrypt(t,n):t)}async function gh(e,t){if(e.prefix?.refreshToken){if(t.startsWith(e.prefix.refreshToken))t=t.replace(e.prefix.refreshToken,``);else throw new B(`BAD_REQUEST`,{error_description:`refresh token not found`,error:`invalid_token`})}return e.formatRefreshToken?.decrypt?e.formatRefreshToken?.decrypt(t):{token:t}}async function _h(e,t,n,r,i,a,o,s,c,l,u,d){let f=a.iat??Math.floor(Date.now()/1e3),p=a?.exp??f+(t.accessTokenExpiresIn??3600),m=t.generateOpaqueAccessToken?await t.generateOpaqueAccessToken():Fi(32,`A-Z`,`a-z`);return await e.context.adapter.create({model:`oauthAccessToken`,data:{token:await Dl(t.storeTokens,m,`access_token`),clientId:r.clientId,sessionId:a?.sid,userId:n?.id,referenceId:s,authorizationCodeId:c,resources:o,refreshId:l,confirmation:u,requestedUserInfoClaims:d?.length?d:void 0,scopes:i,createdAt:new Date(f*1e3),expiresAt:new Date(p*1e3)}}),(t.prefix?.opaqueAccessToken??``)+m}async function vh(e,t,n){let r=await e.context.adapter.findMany({model:`oauthRefreshToken`,where:[{field:`clientId`,value:t},{field:`userId`,value:n}]});r.length&&await e.context.adapter.deleteMany({model:`oauthAccessToken`,where:[{field:`refreshId`,operator:`in`,value:r.map(e=>e.id)}]}),await e.context.adapter.deleteMany({model:`oauthRefreshToken`,where:[{field:`clientId`,value:t},{field:`userId`,value:n}]})}async function yh(e,t){let n=async n=>{try{await e.context.adapter.deleteMany({model:n,where:[{field:`authorizationCodeId`,value:t}]})}catch(t){e.context.logger.error(`authorization code replay cleanup failed`,t)}};await n(`oauthAccessToken`),await n(`oauthRefreshToken`)}async function bh(e,t,n,r,i,a,o,s,c,l,u,d,f){let p=s.iat??Math.floor(Date.now()/1e3),m=s?.exp??p+(t.refreshTokenExpiresIn??2592e3),h=t.generateRefreshToken?await t.generateRefreshToken():Fi(32,`A-Z`,`a-z`),g=s?.sid,_={token:await Dl(t.storeTokens,h,`refresh_token`),clientId:a.clientId,sessionId:g,userId:n.id,referenceId:r,authorizationCodeId:i,authTime:l,confirmation:d,requestedUserInfoClaims:f?.length?f:void 0,scopes:o,resources:u,createdAt:new Date(p*1e3),expiresAt:new Date(m*1e3)};if(!c?.id)return{id:(await e.context.adapter.create({model:`oauthRefreshToken`,data:_})).id,token:await hh(t,h,g)};let v=new Date(p*1e3),y={revoked:v,rotatedAt:v},b=t.refreshTokenReuseInterval??0;if(b>0&&(y.rotationReplayExpiresAt=new Date((p+b)*1e3)),!await e.context.adapter.incrementOne({model:`oauthRefreshToken`,where:[{field:`id`,value:c.id},{field:`revoked`,operator:`eq`,value:null}],increment:{},set:y}))throw new B(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`});return{id:(await e.context.adapter.create({model:`oauthRefreshToken`,data:_})).id,token:await hh(t,h,g)}}async function xh(e,t,n){let r=await Mm(e,t,{resource:n.resources,clientId:n.clientId,requestedScopes:n.requestedScopes}),i=r.accessTokenTtl===null?n.scopeExpiresAtSeconds:n.iat+r.accessTokenTtl,a=t.refreshTokenExpiresIn??2592e3,o=r.refreshTokenTtl===null?a:Math.min(r.refreshTokenTtl,a);return{audienceClaim:r.audienceClaim,effectiveScopes:r.effectiveScopes,accessTokenExpiresAtSeconds:Math.min(n.scopeExpiresAtSeconds,i),refreshTokenExpiresAtSeconds:n.iat+o,refreshResources:n.refreshToken?.resources??n.originalResources??n.resources,signingAlgorithm:r.signingAlgorithm,signingKeyId:r.signingKeyId,resourceCustomClaims:r.rawCustomClaims,dpopBoundAccessTokensRequired:r.dpopBoundAccessTokensRequired}}function Sh(e){throw new B(`BAD_REQUEST`,{error:`invalid_dpop_proof`,error_description:e})}function Ch(e){let t=Bl(e.metadata)??{};return e.dpopBoundAccessTokens===!0||t.dpop_bound_access_tokens===!0}async function wh(e,t,n){let r=n.verificationValue?.query.dpop_jkt,i=_c(n.refreshToken?.confirmation),a=i??r,o=Zm(e),s=Ch(n.client)||n.grantIssuance.dpopBoundAccessTokensRequired||!!r||!!i;if(!o)s&&Sh(`DPoP proof header is required`);else try{return{jkt:(await Tc({proofJwt:o,method:`POST`,url:Qm(e,`/oauth2/token`),expectedJkt:a,proofMaxAgeSeconds:t.dpop?.proofMaxAgeSeconds,signingAlgorithms:t.dpop?.signingAlgorithms,replayStore:uc(e.context.internalAdapter)})).jkt}}catch(e){throw dc(e)&&Sh(e.message),e}}function Th(e){return e?[...new Set(e)].sort():void 0}function Eh(e,t){let n=Th(e),r=Th(t);return n===void 0||r===void 0?n===r:n.length===r.length&&n.every((e,t)=>e===r[t])}function Dh(e){if(e)return`jkt`in e?`jkt:${e.jkt}`:`x5t#S256:${e[`x5t#S256`]}`}function Oh(e,t){return Dh(e)===Dh(t)}function kh(e){if(!e||typeof e!=`object`)return!1;let t=e;return typeof t.jkt==`string`&&t[`x5t#S256`]===void 0||typeof t[`x5t#S256`]==`string`&&t.jkt===void 0}function Ah(e){return e===`Bearer`||e===`DPoP`}function jh(e){if(!e||typeof e!=`object`)return!1;let t=e;return typeof t.access_token==`string`&&typeof t.expires_in==`number`&&typeof t.expires_at==`number`&&Ah(t.token_type)&&typeof t.scope==`string`&&(t.refresh_token===void 0||typeof t.refresh_token==`string`)&&(t.id_token===void 0||typeof t.id_token==`string`)}function Mh(e){if(!e||typeof e!=`object`)return!1;let t=e,n=t.request;return!!n&&Array.isArray(n.effectiveScopes)&&n.effectiveScopes.every(e=>typeof e==`string`)&&(n.requestedResources===void 0||Array.isArray(n.requestedResources)&&n.requestedResources.every(e=>typeof e==`string`))&&(n.confirmation===void 0||kh(n.confirmation))&&jh(t.response)}function Nh(e){let t=Th(e.requestedResources);return{effectiveScopes:Th(e.effectiveScopes)??[],...t?{requestedResources:t}:{},...e.confirmation?{confirmation:e.confirmation}:{}}}function Ph(e,t){return Eh(e.effectiveScopes,t.effectiveScopes)&&Eh(e.requestedResources,t.requestedResources)&&Oh(e.confirmation,t.confirmation)}async function Fh(e,t){return Ha({key:e.context.secretConfig,data:JSON.stringify(t)})}async function Ih(e,t){let n=await Ua({key:e.context.secretConfig,data:t}),r=JSON.parse(n);if(Mh(r))return r}function Lh(e){return!!e.rotatedAt&&!!e.rotationReplayExpiresAt&&e.rotationReplayExpiresAt>=new Date}async function Rh(e,t,n,r,i){(t.refreshTokenReuseInterval??0)<=0||await e.context.adapter.update({model:`oauthRefreshToken`,where:[{field:`id`,value:n.id}],update:{rotationReplayResponse:await Fh(e,{request:r,response:i})}})}async function zh(e,t,n){if(Lh(t)&&t.rotationReplayResponse)try{let r=await Ih(e,t.rotationReplayResponse);return!r||!Ph(r.request,n)?void 0:r.response}catch(t){e.context.logger.error(`refresh token rotation replay failed`,t);return}}async function Bh(e,t,n){let r=Math.floor(Date.now()/1e3),i=await xh(e,t,{clientId:n.client.clientId,requestedScopes:n.scopes,resources:n.resources,refreshToken:n.refreshToken,iat:r,scopeExpiresAtSeconds:r+(t.accessTokenExpiresIn??3600)}),a=await wh(e,t,{client:n.client,grantIssuance:i,refreshToken:n.refreshToken});return Nh({effectiveScopes:i.effectiveScopes,requestedResources:n.resources,confirmation:a})}function Vh(e,t){let n=Math.floor(Date.now()/1e3);return e.json({...t,expires_in:Math.max(0,t.expires_at-n)})}async function Hh(e,t,n){let{client:r,scopes:i,user:a,grantType:o,referenceId:s,sessionId:c,nonce:l,refreshToken:u,authTime:d,verificationValue:f}=n,p=Math.floor(Date.now()/1e3),m=p+(a?t.accessTokenExpiresIn??3600:t.m2mAccessTokenExpiresIn??3600),h=t.scopeExpirations?i.map(e=>t.scopeExpirations?.[e]?Lp(t.scopeExpirations[e],p):m).reduce((e,t)=>e<t?e:t,m):m,g=await xh(e,t,{clientId:r.clientId,requestedScopes:i,resources:n.resources,originalResources:n.originalResources,refreshToken:n.refreshToken,iat:p,scopeExpiresAtSeconds:h}),_=g.audienceClaim,v=g.effectiveScopes,y=g.accessTokenExpiresAtSeconds,b=g.refreshTokenExpiresAtSeconds,x=a&&Il(r,`refresh_token`)&&(u?.scopes?.includes(`offline_access`)||i.includes(`offline_access`)),S=_&&!t.disableJwtPlugin,C=a&&v.includes(`openid`),w=Bl(r.metadata),T=C&&a?{...await sl(t,{ctx:e,opts:t,user:a,client:r,scopes:v,grantType:o,referenceId:s,sessionId:c,resources:n.resources,metadata:w}),...n.idTokenClaims??{}}:void 0,E=t.customTokenResponseFields?await t.customTokenResponseFields({grantType:o,user:a,scopes:v,metadata:w,verificationValue:f}):void 0,D=g.refreshResources,O=n.confirmation??await wh(e,t,{client:r,grantIssuance:g,verificationValue:f,refreshToken:u}),k=n.requestedUserInfoClaims??u?.requestedUserInfoClaims??[],A=x&&a&&!S?await bh(e,t,a,s,n.authorizationCodeId,r,v,{iat:p,exp:b,sid:c},u,d,D,O,k):void 0,j=S?await um({ctx:e,opts:t,user:a,client:r,scopes:v,grantType:o,sessionId:c,resources:n.resources,referenceId:s,metadata:w,perRequestClaims:n.accessTokenClaims,resourcePolicyClaims:g.resourceCustomClaims}):void 0,[M,N]=await Promise.all([S?fh(e,t,a,r,_,v,{iat:p,exp:y,sid:c,signingAlgorithm:g.signingAlgorithm,signingKeyId:g.signingKeyId,accessTokenClaims:j,confirmation:O}):_h(e,t,a,r,v,{iat:p,exp:y,sid:c},n?.resources,s,n.authorizationCodeId,A?.id,O,k),A||(x&&a?bh(e,t,a,s,n.authorizationCodeId,r,v,{iat:p,exp:b,sid:c},u,d,D,O,k):void 0)]),P=C?await mh(e,t,a,r,v,l,c,d,M,T):void 0,F={...E,...n.tokenResponse??{},access_token:M,expires_in:y-p,expires_at:y,token_type:ch(O),refresh_token:N?.token,scope:v.join(` `),id_token:P};if(u?.id&&N?.id)try{await Rh(e,t,u,Nh({effectiveScopes:v,requestedResources:n.resources,confirmation:O}),F)}catch(t){e.context.logger.error(`failed to store refresh token rotation replay`,t)}return e.json(F)}async function Uh(e,t,n,r,i,a){let o=await Dl(t.storeTokens,n,`authorization_code`),s=await e.context.internalAdapter.consumeVerificationValue(o);if(!s)throw await yh(e,o),new B(`BAD_REQUEST`,{error_description:`invalid code`,error:`invalid_grant`});let c;try{c=JSON.parse(s.value)}catch{throw new B(`BAD_REQUEST`,{error_description:`malformed verification value`,error:`invalid_grant`})}let l=bm.safeParse(c);if(!l.success)throw new B(`BAD_REQUEST`,{error_description:`malformed verification value`,error:`invalid_grant`});let u=l.data;if(u.query.client_id!==r)throw new B(`BAD_REQUEST`,{error_description:`invalid client_id`,error:`invalid_grant`});let d=u.query.redirect_uri;if(d){if(!i)throw new B(`BAD_REQUEST`,{error_description:`redirect_uri is required`,error:`invalid_request`});if(d!==i)throw new B(`BAD_REQUEST`,{error_description:`redirect_uri mismatch`,error:`invalid_grant`})}else if(i)throw new B(`BAD_REQUEST`,{error_description:`redirect_uri mismatch`,error:`invalid_grant`});let f=gl(u.resource)??gl(u.query.resource),p=a??f;if(a&&f){let e=new Set(a),t=new Set(f);for(let n of e)if(!t.has(n))throw new B(`BAD_REQUEST`,{error_description:`requested resource not authorized`,error:`invalid_target`})}return{verificationValue:u,effectiveResources:p,authorizedResources:f,authorizationCodeId:o}}async function Wh(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=Vl(await Hl(e,t,`${e.context.baseURL}/oauth2/token`)),{code:o,code_verifier:s,redirect_uri:c,resource:l}=e.body,u=gl(l);if(!n)throw new B(`BAD_REQUEST`,{error_description:`client_id is required`,error:`invalid_request`});if(!o)throw new B(`BAD_REQUEST`,{error_description:`code is required`,error:`invalid_request`});let d=n&&r,f=n&&o&&s;if(!d&&!f&&!i)throw new B(`BAD_REQUEST`,{error_description:`Either code_verifier or client_secret is required`,error:`invalid_request`});let{verificationValue:p,effectiveResources:m,authorizedResources:h,authorizationCodeId:g}=await Uh(e,t,o,n,c,u),_=p.query.scope?.split(` `);if(!_)throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`verification scope unset`,error:`invalid_scope`});let v=await zl(e,t,n,r,_,i,`authorization_code`,a);if(Zl(v,{scopes:(p.query?.scope)?.split(` `)||[],nonce:p.query?.nonce})){if(!f)throw new B(`BAD_REQUEST`,{error_description:`PKCE is required for this client`,error:`invalid_request`})}else if(!(f||d||i))throw new B(`BAD_REQUEST`,{error_description:`Either PKCE (code_verifier) or client authentication (client_secret or client_assertion) is required`,error:`invalid_request`});let y=!!p.query?.code_challenge,b=!!s;if(y||b){if(y&&!b)throw new B(`UNAUTHORIZED`,{error_description:`code_verifier required because PKCE was used in authorization`,error:`invalid_request`});if(!y&&b)throw new B(`UNAUTHORIZED`,{error_description:`code_verifier provided but PKCE was not used in authorization`,error:`invalid_request`});if((p.query?.code_challenge_method===`S256`?await us(s):void 0)!==p.query?.code_challenge)throw new B(`UNAUTHORIZED`,{error_description:`code verification failed`,error:`invalid_request`})}if(!p.userId)throw new B(`BAD_REQUEST`,{error_description:`missing user, user may have been deleted`,error:`invalid_user`});let x=await e.context.internalAdapter.findUserById(p.userId);if(!x)throw new B(`BAD_REQUEST`,{error_description:`missing user, user may have been deleted`,error:`invalid_user`});let S=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:p.sessionId}]});if(!S||S.expiresAt<new Date)throw new B(`BAD_REQUEST`,{error_description:`session no longer exists`,error:`invalid_request`});let C=p.authTime==null?hl(S):ml(p.authTime),w=tm(p.query.claims,sm(t));return Hh(e,t,{client:v,scopes:p.query.scope?.split(` `)??[],user:x,grantType:`authorization_code`,referenceId:p.referenceId,sessionId:S.id,nonce:p.query?.nonce,authTime:C,verificationValue:p,authorizationCodeId:g,requestedUserInfoClaims:w,resources:m,originalResources:h})}async function Gh(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=Vl(await Hl(e,t,`${e.context.baseURL}/oauth2/token`)),{scope:o,resource:s}=e.body,c=gl(s);if(!n)throw new B(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});let l=await zl(e,t,n,r,void 0,i,`client_credentials`,a);if(l.tokenEndpointAuthMethod===`none`)throw new B(`BAD_REQUEST`,{error_description:`public clients cannot use the client_credentials grant`,error:`unauthorized_client`});let u=l.clientCredentialsScopes;if(!u?.length)throw new B(`BAD_REQUEST`,{error_description:`client has no authorized client_credentials scopes`,error:`unauthorized_client`});let d=o?.split(` `);if(d){let e=new Set(u),t=d.filter(t=>!e.has(t)||eh(t));if(t.length)throw new B(`BAD_REQUEST`,{error_description:`The following scopes are invalid: ${t.join(`, `)}`,error:`invalid_scope`})}return d||=[...u],Hh(e,t,{client:l,scopes:d,grantType:`client_credentials`,resources:c})}async function Kh(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=Vl(await Hl(e,t,`${e.context.baseURL}/oauth2/token`)),{refresh_token:o,scope:s,resource:c}=e.body,l=gl(c);if(!n)throw new B(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});if(!o)throw new B(`BAD_REQUEST`,{error_description:`Missing a required refresh_token for refresh_token grant`,error:`invalid_request`});let u=await gh(t,o),d=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await Ol(t.storeTokens,u.token,`refresh_token`)}]});if(!d)throw new B(`BAD_REQUEST`,{error_description:`session not found`,error:`invalid_grant`});if(d.clientId!==n||d.expiresAt<new Date)throw new B(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`});if(l&&d.resources&&!l.every(e=>d.resources?.includes(e)))throw new B(`BAD_REQUEST`,{error_description:`requested resource invalid`,error:`invalid_target`});let f=d?.scopes,p=s?.split(` `);if(p){let e=new Set(f);for(let t of p)if(!e.has(t))throw new B(`BAD_REQUEST`,{error_description:`unable to issue scope ${t}`,error:`invalid_scope`})}let m=await zl(e,t,n,r,p??f,i,`refresh_token`,a);if(d.revoked){if(Lh(d)){let n=await zh(e,d,await Bh(e,t,{client:m,refreshToken:d,scopes:p??f,resources:l??d.resources}));if(n)return Vh(e,n);throw new B(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`})}throw await vh(e,n,d.userId),new B(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`})}let h=await e.context.internalAdapter.findUserById(d.userId);if(!h)throw new B(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let g=d.authTime==null?void 0:ml(d.authTime);return Hh(e,t,{client:m,scopes:p??f,user:h,grantType:`refresh_token`,referenceId:d.referenceId,authorizationCodeId:d.authorizationCodeId,sessionId:d.sessionId,refreshToken:d,resources:l??d.resources,authTime:g,requestedUserInfoClaims:d.requestedUserInfoClaims})}var qh=Ce({introspectEndpoint:()=>lg,requireActiveAccessToken:()=>og,requireActiveAccessTokenWithClaims:()=>sg,validateAccessToken:()=>ag}),Jh=`Invalid access token`,Yh=`Bearer error="invalid_token", error_description="${Jh}"`;function Xh(){return{payload:{active:!1},requestedUserInfoClaims:[]}}function Zh(e,t){return e==null?[]:(Array.isArray(e)?e:[e]).filter(e=>typeof e==`string`&&e!==t)}async function Qh(e,t,n){let{introspectingClientId:r,issuerClientId:i,audienceResources:a}=n;return!r||r===i||a.length!==0&&Pm(e,t,r,a)}async function $h(e,t,n,r){let i=t.disableJwtPlugin?void 0:pl(e.context),a=i?.options,o=`${e.context.baseURL??``}/oauth2/userinfo`,s=a?.jwt?.issuer??e.context.baseURL,c;try{c=(await Vr(n,hi(await Pc(n,{jwksFetch:a?.jwks?.remoteUrl?a.jwks.remoteUrl:async()=>(await i?.endpoints.getJwks(e))?.response,jwksCacheKey:i})),{issuer:s})).payload}catch(e){if(e instanceof Error){if(e.name===`TypeError`||e.name===`JWSInvalid`)throw new z(`BAD_REQUEST`,{error_description:`invalid JWT signature`,error:`invalid_request`});if(e.name===`JWTExpired`||e.name===`JWTInvalid`)return{active:!1};throw e}throw Error(e)}let l=c.aud;if(!await jm(e,t,l,[o])||!c.azp)return{active:!1};let u=await xl(e,t,c.azp);if(!u||u?.disabled||!await Qh(e,t,{introspectingClientId:r,issuerClientId:c.azp,audienceResources:Zh(l,o)}))return{active:!1};let d=c.sid;if(d){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:d}]});if(!t||t.expiresAt<new Date)return{active:!1}}return c.client_id=c.azp,c.active=!0,c.token_type=ch(c.cnf),c}async function eg(e,t,n,r){let i=n;if(t.prefix?.opaqueAccessToken){if(i.startsWith(t.prefix.opaqueAccessToken))i=i.replace(t.prefix.opaqueAccessToken,``);else throw new z(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`})}let a=await e.context.adapter.findOne({model:`oauthAccessToken`,where:[{field:`token`,value:await Ol(t.storeTokens,i,`access_token`)}]});if(!a)throw new z(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_token`});if(!a.expiresAt||a.expiresAt<new Date||a.revoked)return Xh();let o=Array.isArray(a.resources)?a.resources:void 0,s;if(a.clientId&&(s=await xl(e,t,a.clientId),!s||s?.disabled||!await Qh(e,t,{introspectingClientId:r,issuerClientId:a.clientId,audienceResources:o??[]})))return Xh();let c=a.sessionId??void 0;if(c){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:c}]});if(!t||t.expiresAt<new Date)return Xh()}let l;a.userId&&(l=await e.context.internalAdapter.findUserById(a?.userId));let u=`${e.context.baseURL}/oauth2/userinfo`;if(o?.length&&!await jm(e,t,o,[u]))return Xh();let d=o?[...o]:void 0;d?.length&&a.scopes?.includes(`openid`)&&(d.includes(u)||d.push(u));let f=o?.length?await Fm(e,t,o):{},p=s?await um({ctx:e,opts:t,user:l,client:s,scopes:a.scopes??[],grantType:void 0,sessionId:void 0,resources:o,referenceId:a.referenceId,metadata:Bl(s.metadata),perRequestClaims:void 0,resourcePolicyClaims:f}):{},m=(t.disableJwtPlugin?void 0:pl(e.context))?.options;return{payload:{...p,active:!0,iss:m?.jwt?.issuer??e.context.baseURL,aud:_l(d),client_id:a.clientId,azp:a.clientId,sub:l?.id,sid:c,exp:Math.floor(new Date(a.expiresAt).getTime()/1e3),iat:Math.floor(new Date(a.createdAt).getTime()/1e3),scope:a.scopes?.join(` `),token_type:ch(a.confirmation),...a.confirmation?{cnf:a.confirmation}:{}},requestedUserInfoClaims:a.requestedUserInfoClaims??[]}}async function tg(e,t,n,r){let i=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await Ol(t.storeTokens,n,`refresh_token`)}]});if(!i)throw new z(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_token`});if(!i.clientId||i.clientId!==r||!i.expiresAt||i.expiresAt<new Date||i.revoked)return{active:!1};let a=i.sessionId??void 0;if(a){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:a}]});(!t||t.expiresAt<new Date)&&(a=void 0)}let o;return i.userId&&(o=await e.context.internalAdapter.findUserById(i?.userId)??void 0),{active:!0,client_id:r,iss:((t.disableJwtPlugin?void 0:pl(e.context))?.options)?.jwt?.issuer??e.context.baseURL,sub:o?.id,sid:a,exp:Math.floor(new Date(i.expiresAt).getTime()/1e3),iat:Math.floor(new Date(i.createdAt).getTime()/1e3),scope:i.scopes?.join(` `),token_type:ch(i.confirmation),...i.confirmation?{cnf:i.confirmation}:{}}}function ng(){return new z(`UNAUTHORIZED`,{error_description:Jh,error:`invalid_token`},{"WWW-Authenticate":Yh})}function rg(e){return e.status===`BAD_REQUEST`||e.body?.error===`invalid_token`}async function ig(e,t,n,r){try{return{payload:await $h(e,t,n,r),requestedUserInfoClaims:[]}}catch(e){if(!(e instanceof z))throw e instanceof Error?e:Error(e)}try{return await eg(e,t,n,r)}catch(e){if(!(e instanceof z))throw e instanceof Error?e:Error(`Unknown error validating access token`)}throw ng()}async function ag(e,t,n,r){return(await ig(e,t,n,r)).payload}async function og(e,t,n,r){let i=await ag(e,t,n,r);if(i.active)return i;throw ng()}async function sg(e,t,n,r){let{payload:i,requestedUserInfoClaims:a}=await ig(e,t,n,r);if(i.active)return{payload:i,requestedUserInfoClaims:a};throw ng()}async function cg(e,t,n,r){if(!n.active||!n.sub)return n;let i=n.client_id??n.azp;if(!i)return n;let a=i===r.clientId?r:await xl(e,t,i);if(!a)return n;let o=await Kl(n.sub,a,t);return{...n,sub:o}}async function lg(e,t){let{token:n,token_type_hint:r}=e.body;r!==`access_token`&&r!==`refresh_token`&&(r=void 0);let{clientId:i,clientSecret:a,preVerified:o,authMethod:s}=Vl(await Hl(e,t,`${e.context.baseURL}/oauth2/introspect`));if(!i||!a&&!o)throw new z(`UNAUTHORIZED`,{error_description:`missing required credentials`,error:`invalid_client`});if(n&&typeof n==`string`&&(n=pc(n)),!n?.length)throw new z(`BAD_REQUEST`,{error_description:`missing a required token for introspection`,error:`invalid_request`});let c=await zl(e,t,i,a,void 0,o,void 0,s);try{if(r===void 0||r===`access_token`)try{return cg(e,t,await ag(e,t,n,c.clientId),c)}catch(e){if(e instanceof z){if(r===`access_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}if(r===void 0||r===`refresh_token`)try{return cg(e,t,await tg(e,t,(await gh(t,n)).token,c.clientId),c)}catch(e){if(e instanceof z){if(r===`refresh_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}throw new z(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`})}catch(e){if(e instanceof z){if(rg(e))return{active:!1};throw e}throw e instanceof Error?(_e.error(`Introspection error:`,e.message,e.stack),new z(`INTERNAL_SERVER_ERROR`)):(_e.error(`Introspection error:`,e),new z(`INTERNAL_SERVER_ERROR`))}}var ug=`1.7.8`;function dg(e){return e?.get(`sec-fetch-mode`)===`cors`}var fg=e({a:()=>Ev,c:()=>k_,d:()=>c_,f:()=>a_,h:()=>o_,i:()=>Ly,l:()=>w_,n:()=>Ay,o:()=>N_,r:()=>Ny,s:()=>Q_,t:()=>Jy,u:()=>r_});async function pg(e,t,n){let r=await My.get(),i=r?.query;if(!i)throw new B(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let a=new URLSearchParams(i),o=a.get(`scope`)?.split(` `)??[],s=sm(t),c=tm(a.get(`claims`),s),l=a.get(`client_id`);if(!l)throw new B(`BAD_REQUEST`,{error_description:`client_id is required`,error:`invalid_client`});let u=e.body.scope?.split(` `);if(u&&!u.every(e=>o?.includes(e)))throw new B(`BAD_REQUEST`,{error_description:`Scope not originally requested`,error:`invalid_request`});let d=e.body.claims,f=d===void 0?c:tm(d,s);if(d!==void 0&&!f.every(e=>c.includes(e)))throw new B(`BAD_REQUEST`,{error_description:`Claim not originally requested`,error:`invalid_request`});if(e.body.accept!==!0)return{redirect:!0,url:By(a.get(`redirect_uri`)??``,`access_denied`,`User denied access`,a.get(`state`)??void 0,Jy(e,t))};let p=await Z(e),m=Ul(a.get(`prompt`)??``).has(`login`),h=m&&Jl(p?.session.createdAt,r?.signedQueryIssuedAt);if(m&&!h)return e?.headers?.set(`accept`,`application/json`),e.query=ql(a),await n(e);let g=await t.postLogin?.consentReferenceId?.({user:p?.user,session:p?.session,scopes:u??o}),_=await e.context.adapter.findOne({model:`oauthConsent`,where:[{field:`clientId`,value:l},{field:`userId`,value:p?.user.id},...g?[{field:`referenceId`,value:g}]:[]]}),v=Math.floor(Date.now()/1e3),y=a.getAll(`resource`),b={clientId:l,userId:p?.user.id,scopes:u??o,requestedUserInfoClaims:f,createdAt:new Date(v*1e3),updatedAt:new Date(v*1e3),resources:y.length?y:void 0,referenceId:g};if(_?.id?await e.context.adapter.update({model:`oauthConsent`,where:[{field:`id`,value:_.id}],update:{resources:b.resources,scopes:b.scopes,requestedUserInfoClaims:b.requestedUserInfoClaims,updatedAt:new Date(v*1e3)}}):await e.context.adapter.create({model:`oauthConsent`,data:{...b,scopes:b.scopes}}),u&&a.set(`scope`,b.scopes.join(` `)),d!==void 0){let e=rm(a.get(`claims`),f);e?a.set(`claims`,JSON.stringify(e)):a.delete(`claims`)}e?.headers?.set(`accept`,`application/json`);let x=Yl(a,`consent`);return h&&(x=Yl(x,`login`),x=Xl(x)),e.query=ql(x),await n(e,{postLogin:r?.postLoginClearedForSession!==void 0&&r.postLoginClearedForSession===p?.session.id})}async function mg(e,t){if(e.body.selected===!0)return await hg(e,t);if(e.body.created===!0)return await gg(e,t);if(e.body.postLogin===!0)return await _g(e,t);throw new B(`BAD_REQUEST`,{error_description:`Missing parameters`,error:`invalid_request`})}async function hg(e,t){let n=(await My.get())?.query;if(!n)throw new B(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});return e.headers?.set(`accept`,`application/json`),e.query=ql(Yl(new URLSearchParams(n),`select_account`)),await t(e)}async function gg(e,t){let n=(await My.get())?.query;if(!n)throw new B(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let r=new URLSearchParams(n);return e.headers?.set(`accept`,`application/json`),e.query=ql(Yl(r,`create`)),await t(e)}async function _g(e,t){let n=await My.get(),r=n?.query;if(!r)throw new B(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let i=new URLSearchParams(r);e.headers?.set(`accept`,`application/json`),e.query=ql(i);let a=await Z(e);return await t(e,{postLogin:n?.postLoginClearedForSession!==void 0&&n.postLoginClearedForSession===a?.session.id})}var vg=`http://schemas.openid.net/event/backchannel-logout`,yg=`logout+jwt`,bg=120,xg=5e3;async function Sg(e,t,n,r){return Vp(e,{options:t,payload:{...r,events:{[vg]:{}}},header:{typ:yg},resolvedKey:n??void 0})}async function Cg(e,t,n){let{sessionId:r,userId:i}=n;if(!i)return null;let a=e.context.logger;try{let n=await pd(e.context.adapter),o=[{field:`sessionId`,value:r}],[s,c]=await Promise.all([n.findMany({model:`oauthAccessToken`,where:o}),n.findMany({model:`oauthRefreshToken`,where:o})]),l=new Set;for(let e of s)l.add(e.clientId);for(let e of c)l.add(e.clientId);if(l.size===0)return null;let u=await n.findMany({model:`oauthClient`,where:[{field:`clientId`,operator:`in`,value:Array.from(l)}]}),d=s.filter(e=>!e.revoked).map(e=>e.id),f=c.filter(e=>!e.revoked&&!e.scopes?.includes(`offline_access`)).map(e=>e.id),p=t.disableJwtPlugin?[]:u.filter(e=>!!e.backchannelLogoutUri&&!e.disabled);return{accessTokenIds:d,refreshTokenIds:f,sessionId:r,targets:(await Promise.all(p.map(async e=>{try{return{client:e,sub:await Kl(i,e,t)}}catch(t){return a.warn(`back-channel logout: unable to resolve subject for client ${e.clientId}`,t),null}}))).filter(e=>e!==null)}}catch(e){return a.error(`back-channel logout planning failed`,e),null}}async function wg(e,t){let n=new Date,r=await pd(e.context.adapter),i=await Promise.allSettled([t.accessTokenIds.length>0?r.updateMany({model:`oauthAccessToken`,where:[{field:`id`,operator:`in`,value:t.accessTokenIds}],update:{revoked:n}}):Promise.resolve(),t.refreshTokenIds.length>0?r.updateMany({model:`oauthRefreshToken`,where:[{field:`id`,operator:`in`,value:t.refreshTokenIds}],update:{revoked:n}}):Promise.resolve()]);for(let t of i)t.status===`rejected`&&e.context.logger.error(`back-channel logout: token revocation update failed`,t.reason);t.targets.length>0&&await Tg(e,t)}async function Tg(e,t){let n=e.context.logger,r=pl(e.context)?.options,i=r?.jwt?.issuer??e.context.baseURL,a=Math.floor(Date.now()/1e3),o=a+bg,s=r?.jwt?.sign?null:await Bp(e,r);await Promise.allSettled(t.targets.map(async({client:c,sub:l})=>{try{let u=Fi(32,`a-z`,`A-Z`,`0-9`),d=await Sg(e,r,s,{iss:i,aud:c.clientId,sub:l,sid:t.sessionId,iat:a,exp:o,jti:u}),f=await fetch(c.backchannelLogoutUri,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`,Accept:`application/json`},body:new URLSearchParams({logout_token:d}),signal:AbortSignal.timeout(xg),redirect:`error`});f.status!==200&&f.status!==204&&n.warn(`back-channel logout to client ${c.clientId} returned ${f.status}`)}catch(e){n.warn(`back-channel logout to client ${c.clientId} failed`,e)}}))}var Eg=300,Dg=`.oauth_logout_confirmation`;function Og(e){return e.replace(/[&<>"']/g,e=>{switch(e){case`&`:return`&amp;`;case`<`:return`&lt;`;case`>`:return`&gt;`;case`"`:return`&quot;`;case`'`:return`&#39;`;default:return e}})}function kg(e){let t=e.request?.headers??e.headers;if(!t||dg(t))return!1;let n=t.get(`accept`)??``;return t.get(`sec-fetch-mode`)===`navigate`||n.includes(`text/html`)||n.includes(`application/xhtml+xml`)}function Ag(e,t,n=200){return new Response(`<!doctype html><html><head><meta charset="utf-8"><title>${Og(e)}</title></head><body>${t}</body></html>`,{status:n,headers:{"cache-control":`no-store`,"content-security-policy":`default-src 'none'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'`,"content-type":`text/html; charset=utf-8`,pragma:`no-cache`,"x-content-type-options":`nosniff`}})}function jg(e){return`${e.context.baseURL.replace(/\/$/,``)}/oauth2/end-session/confirm`}function Mg(e){try{return new URL(jg(e)).pathname}catch{return`/oauth2/end-session/confirm`}}function Ng(e){return Ag(`Confirm logout`,`<main><h1>Confirm logout</h1><p>Do you want to log out of this account?</p><form method="post" data-oidc-logout-confirmation action="${Og(jg(e))}"><button type="submit" name="action" value="confirm">Confirm logout</button></form></main>`)}function Pg(e){return Ag(`Logged out`,`<main><p data-oidc-logout-state="logged-out">${e?`Logged out. ${Og(e)}`:`Logged out.`}</p></main>`)}function Fg(e,t){return Ag(`Logout error`,`<main><h1>Logout error</h1><p data-oidc-logout-state="error">${Og(e)}</p></main>`,t)}function Ig(e,t,n,r){if(kg(e))return Fg(r,t===`BAD_REQUEST`?400:t===`UNAUTHORIZED`?401:500);throw new z(t,{error:n,error_description:r})}function Lg(e){return`${e.context.authCookies.sessionToken.name}${Dg}`}function Rg(e,t){return{...e.context.authCookies.sessionToken.attributes,httpOnly:!0,maxAge:t,path:Mg(e),sameSite:`lax`}}async function zg(e,t,n={}){let r={...t?{sessionId:t}:{},...n,expiresAt:Date.now()+Eg*1e3};await e.setSignedCookie(Lg(e),JSON.stringify(r),e.context.secret,Rg(e,Eg))}async function Bg(e){let t=await e.getSignedCookie(Lg(e),e.context.secret);if(typeof t!=`string`)return null;try{let e=JSON.parse(t);if(typeof e!=`object`||!e)return null;let n=e;return n.sessionId!==void 0&&(typeof n.sessionId!=`string`||n.sessionId.length===0)||n.clientId!==void 0&&(typeof n.clientId!=`string`||n.clientId.length===0)||n.postLogoutRedirectUri!==void 0&&(typeof n.postLogoutRedirectUri!=`string`||n.postLogoutRedirectUri.length===0)||n.state!==void 0&&typeof n.state!=`string`||n.redirectInvalid!==void 0&&typeof n.redirectInvalid!=`boolean`||n.postLogoutRedirectUri!==void 0&&n.clientId===void 0||typeof n.expiresAt!=`number`||!Number.isFinite(n.expiresAt)?null:{...typeof n.sessionId==`string`?{sessionId:n.sessionId}:{},...typeof n.clientId==`string`?{clientId:n.clientId}:{},...typeof n.postLogoutRedirectUri==`string`?{postLogoutRedirectUri:n.postLogoutRedirectUri}:{},...typeof n.state==`string`?{state:n.state}:{},...typeof n.redirectInvalid==`boolean`?{redirectInvalid:n.redirectInvalid}:{},expiresAt:n.expiresAt}}catch{return null}}function Vg(e){e.setCookie(Lg(e),``,Rg(e,0))}async function Hg(e){let t=await e.getSignedCookie(e.context.authCookies.sessionToken.name,e.context.secret);if(typeof t!=`string`||t.length===0)return null;try{let n=await e.context.internalAdapter.findSession(t);return n?{session:n.session}:null}catch(t){throw e.context.logger.error(`Failed to read the current logout session`,t),new z(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to read the current session`})}}async function Ug(e,t){try{return await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:t}]})}catch(t){throw e.context.logger.error(`Failed to read the hinted logout session`,t),new z(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to read the hinted session`})}}async function Wg(e,t){if(typeof t.token!=`string`||t.token.length===0)throw new z(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to complete logout`});try{await e.context.internalAdapter.deleteSession(t.token)}catch(t){throw e.context.logger.error(`Failed to delete the logout session`,t),new z(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to complete logout`})}}async function Gg(e,t,n){try{return await xl(e,t,n)}catch(t){throw e.context.logger.error(`Failed to resolve the logout client`,t),new z(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to resolve the logout client`})}}function Kg(e){return(Array.isArray(e)?e:[e]).filter(e=>typeof e==`string`)}function qg(e){if(typeof e.aud==`string`&&e.aud.length>0)return e.aud;if(typeof e.azp==`string`&&e.azp.length>0)return e.azp;let t=Kg(e.aud);return t.length===1?t[0]:null}async function Jg(e,t,n,r){if(r)return Gg(e,t,r);let i;try{i=yi(n)}catch{return null}let a=qg(i);return a?Gg(e,t,a):null}async function Yg(e,t,n,r){try{let i;if(t.disableJwtPlugin){if(!r.clientSecret)return null;let a=await wl(e,t.storeClientSecret,r.clientSecret),{payload:o}=await br(n,new TextEncoder().encode(a));i=JSON.parse(new TextDecoder().decode(o))}else{let t=pl(e.context).options,{payload:r}=await br(n,hi(await Pc(n,{jwksFetch:t?.jwks?.remoteUrl??`${e.context.baseURL}${t?.jwks?.jwksPath??`/jwks`}`})));i=JSON.parse(new TextDecoder().decode(r))}return i.iss!==Jy(e,t)||!Kg(i.aud).includes(r.clientId)||typeof i.sid!=`string`||i.sid.length===0||typeof i.sub!=`string`||i.sub.length===0?null:i}catch{return null}}function Xg(e,t,n){if(!t)return{invalid:!1};if(!e.postLogoutRedirectUris?.includes(t))return{invalid:!0};if(!n)return{uri:t,invalid:!1};try{let e=new URL(t);return e.searchParams.set(`state`,n),{uri:e.toString(),invalid:!1}}catch{return{invalid:!0}}}function Zg(e,t){return t.post_logout_redirect_uri?Xg(e,t.post_logout_redirect_uri,t.state).invalid?{redirectInvalid:!0}:{clientId:e.clientId,postLogoutRedirectUri:t.post_logout_redirect_uri,...t.state===void 0?{}:{state:t.state}}:{}}async function Qg(e,t,n){if(n.redirectInvalid)return{invalid:!0};if(!n.clientId||!n.postLogoutRedirectUri)return{invalid:!1};let r=await Gg(e,t,n.clientId);return!r||r.disabled||!r.enableEndSession?{invalid:!0}:Xg(r,n.postLogoutRedirectUri,n.state)}async function $g(e,t,n={}){return t?kg(e)?(await zg(e,t.session.id,n),Ng(e)):Ig(e,`BAD_REQUEST`,`invalid_request`,`User confirmation is required to complete logout`):kg(e)?(await zg(e,void 0,n),Ng(e)):Ig(e,`BAD_REQUEST`,`invalid_request`,`No active session is available for logout`)}async function e_(e,t){let n=await Bg(e),r=await Hg(e);if(!n||n.expiresAt<=Date.now())return Ig(e,`BAD_REQUEST`,`invalid_request`,`The logout confirmation is invalid or expired`);let i=await Qg(e,t,n);return r?n.sessionId&&n.sessionId!==r.session.id?Ig(e,`BAD_REQUEST`,`invalid_request`,`The logout confirmation is invalid or expired`):(await Wg(e,r.session),Uf(e),Vg(e),i.uri?$(e,i.uri):kg(e)?Pg(i.invalid?`The requested post-logout redirect was not registered.`:void 0):null):(Vg(e),i.uri?$(e,i.uri):kg(e)?Pg(i.invalid?`The requested post-logout redirect was not registered.`:void 0):Ig(e,`BAD_REQUEST`,`invalid_request`,`No active session is available for logout`))}async function t_(e,t){let n=e.query??{},r=e.body??{},i={...n,...r},a=await Hg(e);if(i.id_token_hint===void 0){let n={};if(i.client_id){let r=await Gg(e,t,i.client_id);if(!r)return Ig(e,`BAD_REQUEST`,`invalid_client`,`The logout client does not exist`);if(r.disabled)return Ig(e,`BAD_REQUEST`,`invalid_client`,`The logout client is disabled`);if(!r.enableEndSession)return Ig(e,`UNAUTHORIZED`,`invalid_client`,`The client is not allowed to initiate logout`);n=Zg(r,i)}return $g(e,a,n)}let o=await Jg(e,t,i.id_token_hint,i.client_id);if(!o)return a&&kg(e)?$g(e,a):Ig(e,`BAD_REQUEST`,`invalid_client`,`The logout client does not exist`);if(o.disabled)return Ig(e,`BAD_REQUEST`,`invalid_client`,`The logout client is disabled`);if(!o.enableEndSession)return Ig(e,`UNAUTHORIZED`,`invalid_client`,`The client is not allowed to initiate logout`);let s=await Yg(e,t,i.id_token_hint,o);if(!s)return a&&kg(e)?$g(e,a,i.client_id?Zg(o,i):{}):Ig(e,`UNAUTHORIZED`,`invalid_token`,`The id_token_hint is invalid`);let c=s.sid,l=await Ug(e,c),u=a?.session.id===c;if(a&&!u)return $g(e,a,Zg(o,i));let d=Xg(o,i.post_logout_redirect_uri,i.state),f=l??(u?a?.session:null);return f&&await Wg(e,f),u&&Uf(e),Vg(e),d.uri?$(e,d.uri):kg(e)?Pg(d.invalid?`The requested post-logout redirect was not registered.`:void 0):null}async function n_(e,t){return e_(e,t)}function r_(e,t,n){let r=e.context.baseURL,i=!n?.jwt_disabled;return{scopes_supported:n?.scopes_supported,issuer:qy(t?.jwt?.issuer??r),authorization_endpoint:`${r}/oauth2/authorize`,token_endpoint:`${r}/oauth2/token`,jwks_uri:n?.jwt_disabled?void 0:t?.jwks?.remoteUrl??`${r}${t?.jwks?.jwksPath??`/jwks`}`,registration_endpoint:n?.dynamic_client_registration_supported?`${r}/oauth2/register`:void 0,introspection_endpoint:`${r}/oauth2/introspect`,revocation_endpoint:`${r}/oauth2/revoke`,response_types_supported:n?.grant_types_supported&&!n.grant_types_supported.includes(`authorization_code`)?[]:[`code`],response_modes_supported:[`query`],grant_types_supported:n?.grant_types_supported??[`authorization_code`,`client_credentials`,`refresh_token`],token_endpoint_auth_methods_supported:n?.token_endpoint_auth_methods_supported??[...n?.public_client_supported?[`none`]:[],`client_secret_basic`,`client_secret_post`,`private_key_jwt`],token_endpoint_auth_signing_alg_values_supported:[...gs],introspection_endpoint_auth_methods_supported:n?.endpoint_auth_methods_supported??[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],introspection_endpoint_auth_signing_alg_values_supported:[...gs],revocation_endpoint_auth_methods_supported:n?.endpoint_auth_methods_supported??[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],revocation_endpoint_auth_signing_alg_values_supported:[...gs],code_challenge_methods_supported:[`S256`],authorization_response_iss_parameter_supported:!0,dpop_signing_alg_values_supported:n?.dpop_signing_alg_values_supported??[...oc],backchannel_logout_supported:i,backchannel_logout_session_supported:i}}function i_(e,t){let n=t.disableJwtPlugin?void 0:pl(e.context).options,r=Yc(t),i=t.allowUnauthenticatedClientRegistration||r.length>0;return{jwtPluginOptions:n,clientDiscoveries:r,authMetadata:r_(e,n,{scopes_supported:t.advertisedMetadata?.scopes_supported??t.scopes,dynamic_client_registration_supported:t.allowDynamicClientRegistration,public_client_supported:i,grant_types_supported:Qc(t),token_endpoint_auth_methods_supported:tl(t,{includeNone:i}),endpoint_auth_methods_supported:tl(t),jwt_disabled:t.disableJwtPlugin,dpop_signing_alg_values_supported:t.dpop?.signingAlgorithms})}}function a_(e,t){let{clientDiscoveries:n,authMetadata:r}=i_(e,t);return il(e,t,`oauth-authorization-server`,{...Sl(n),...r})}function o_(e,t){let n=e.context.baseURL,{jwtPluginOptions:r,clientDiscoveries:i,authMetadata:a}=i_(e,t),o={...a,claims_supported:sm(t),claims_parameter_supported:!0,userinfo_endpoint:`${n}/oauth2/userinfo`,subject_types_supported:t.pairwiseSecret?[`public`,`pairwise`]:[`public`],acr_values_supported:[`0`],id_token_signing_alg_values_supported:(()=>{if(t.disableJwtPlugin)return[`HS256`];let e=r?.jwks?.keyPairConfig?.alg??`EdDSA`,n=r?.jwks?.keyPairConfigs?.map(e=>e.alg)??[];return Array.from(new Set([e,...n]))})(),end_session_endpoint:`${n}/oauth2/end-session`,request_parameter_supported:!1,request_uri_parameter_supported:!1,prompt_values_supported:[`login`,`consent`,`create`,`select_account`,`none`]};return il(e,t,`openid-configuration`,{...Sl(i),...o})}var s_=`public, max-age=15, stale-while-revalidate=15, stale-if-error=86400`;function c_(e,t){let n=new Headers(t);return n.has(`Cache-Control`)||n.set(`Cache-Control`,s_),n.set(`Content-Type`,`application/json`),new Response(JSON.stringify(e),{status:200,headers:n})}function l_(e,t,n){let{redirectOnError:r,onValidationError:i,errorCodesByField:a,defaultError:o=`invalid_request`,...s}=t;if(!r)return X(e,{...s,onValidationError:async e=>{throw i&&await i(e),new z(`BAD_REQUEST`,{...u_(e.issues,a,o)})}},n);let c=r,{body:l,query:u,...d}=s;async function f(e,t,n){if(!n)return{ok:!0};let r=await n.safeParseAsync(e[t]??{});return r.success?(e[t]=r.data,{ok:!0}):(i&&await i({message:r.error.message,issues:r.error.issues}),{ok:!1,response:c({...u_(r.error.issues,a,o),ctx:e})})}return X(e,d,async e=>{let t=await f(e,`body`,l);if(!t.ok)return t.response;let r=await f(e,`query`,u);return r.ok?n(e):r.response})}function u_(e,t,n=`invalid_request`){let r=e[0];if(!r)return{error:n,error_description:`Invalid request.`};let i=r.path?.[0],a=typeof i==`string`?i:void 0,o=a?t?.[a]:void 0,s=r.path?.length?g(r.path):``;return{error:d_(r,o,n),error_description:p_(r,s)}}function d_(e,t,n){return typeof t==`string`?t:f_(e)?t?.missing??n:e.code===`invalid_value`?t?.invalid??n:n}function f_(e){return e.code===`invalid_type`&&e.message.endsWith(`received undefined`)}function p_(e,t){if(!t)return e.message;if(e.code===`invalid_type`)return e.message.endsWith(`received undefined`)?`${t} is required`:e.message.endsWith(`received array`)?`${t} must not appear more than once`:`${t} must be a ${e.expected??`valid value`}`;if(e.code===`invalid_value`){let n=e.values;if(Array.isArray(n)&&n.length>0)return`${t} must be one of: ${n.join(`, `)}`}return`${t}: ${e.message}`}var m_=e=>du(async t=>{if(!e.allowPublicClientPrelogin)throw new B(`BAD_REQUEST`);let n=t.body.oauth_query;if(!await bl(n,t.context.secret))throw new B(`UNAUTHORIZED`,{error:`invalid_signature`})}),h_={"P-256":`ES256`,"P-384":`ES384`,"P-521":`ES512`},g_=[`Ed25519`],__=[`d`,`p`,`q`,`dp`,`dq`,`qi`,`oth`];function v_(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function y_(e,t){return typeof e[t]==`string`&&e[t].length>0}function b_(e){return typeof e==`string`&&Object.prototype.hasOwnProperty.call(h_,e)}function x_(e){return g_.some(t=>t===e)}function S_(e){switch(e.kty){case`RSA`:return y_(e,`n`)&&y_(e,`e`);case`EC`:return b_(e.crv)&&y_(e,`x`)&&y_(e,`y`);case`OKP`:return x_(e.crv)&&y_(e,`x`);default:return!1}}function C_(e){if(e.alg===void 0)return!0;if(typeof e.alg!=`string`||!gs.some(t=>t===e.alg))return!1;switch(e.kty){case`RSA`:return e.alg.startsWith(`RS`)||e.alg.startsWith(`PS`);case`EC`:return b_(e.crv)&&h_[e.crv]===e.alg;case`OKP`:return x_(e.crv)&&e.alg===`EdDSA`;default:return!1}}function w_(e){let t=v_(e)&&Array.isArray(e.keys)?e.keys:void 0;if(!t?.length)return{valid:!1,error:`jwks must be an RFC 7517 JWK Set object with a non-empty keys array`};for(let e of t){if(!v_(e))return{valid:!1,error:`jwks keys must be supported public JWKs with required key parameters`};if(e.kty===`oct`||`k`in e||__.some(t=>t in e))return{valid:!1,error:`jwks must contain only public asymmetric keys`};if(!S_(e))return{valid:!1,error:`jwks keys must be supported public JWKs with required key parameters`};if(!C_(e))return{valid:!1,error:`jwks key alg must be supported for private_key_jwt and compatible with its key type and signing curve`}}return{valid:!0,jwks:{keys:t}}}var T_=Object.freeze(Object.keys({clientId:!0,clientSecret:!0,clientDiscoveryId:!0,disabled:!0,scopes:!0,clientCredentialsScopes:!0,userId:!0,createdAt:!0,updatedAt:!0,expiresAt:!0,name:!0,uri:!0,icon:!0,contacts:!0,tos:!0,policy:!0,softwareId:!0,softwareVersion:!0,softwareStatement:!0,redirectUris:!0,postLogoutRedirectUris:!0,backchannelLogoutUri:!0,backchannelLogoutSessionRequired:!0,tokenEndpointAuthMethod:!0,grantTypes:!0,responseTypes:!0,applicationType:!0,jwks:!0,jwksUri:!0,requirePKCE:!0,dpopBoundAccessTokens:!0,skipConsent:!0,enableEndSession:!0,subjectType:!0,referenceId:!0,metadata:!0})),E_=`client_id.client_secret.client_secret_expires_at.scope.user_id.client_id_issued_at.client_name.client_uri.logo_uri.contacts.tos_uri.policy_uri.jwks.jwks_uri.software_id.software_version.software_statement.redirect_uris.post_logout_redirect_uris.backchannel_logout_uri.backchannel_logout_session_required.token_endpoint_auth_method.grant_types.response_types.application_type.disabled.skip_consent.enable_end_session.require_pkce.dpop_bound_access_tokens.subject_type.reference_id`.split(`.`),D_=new Set([...T_,...E_,`public`,`type`,`resources`,`client_credentials_scopes`]),O_=new Set(`disabled.client_secret.client_secret_expires_at.client_id_issued_at.skip_consent.enable_end_session.require_pkce.reference_id.user_id.resources.clientSecret.clientDiscoveryId.skipConsent.enableEndSession.requirePKCE.referenceId.userId.clientId.applicationType.tokenEndpointAuthMethod.redirectUris.postLogoutRedirectUris.grantTypes.responseTypes.scopes.expiresAt.createdAt.updatedAt.softwareId.softwareVersion.softwareStatement.backchannelLogoutUri.backchannelLogoutSessionRequired.jwksUri.dpopBoundAccessTokens.subjectType`.split(`.`));function k_(e){return O_.has(e)}function A_(e){if(e)return Object.fromEntries(Object.entries(e).filter(([e])=>!D_.has(e)))}async function j_(e,t,n,r,i){if(!t)throw new B(`UNAUTHORIZED`);if(!e.headers)throw new B(`BAD_REQUEST`);if(r===`configure-client-credentials-scopes`&&!n.clientPrivileges||n.clientPrivileges&&!await n.clientPrivileges({headers:e.headers,action:r,session:t.session,user:t.user,clientId:i}))throw new B(`UNAUTHORIZED`)}async function M_(e,t,n,r,i){if(!t)throw new B(`UNAUTHORIZED`);if(!e.headers)throw new B(`BAD_REQUEST`);if(n.resourcePrivileges&&!await n.resourcePrivileges({headers:e.headers,action:r,session:t.session,user:t.user,resourceId:i}))throw new B(`UNAUTHORIZED`)}var N_=Ce({consumeClientAssertion:()=>Q_,isPrivateHostname:()=>W_,verifyClientAssertion:()=>$_}),P_=new WeakMap,F_=3e5,I_=500,L_=5e3,R_=65536,z_=/^application\/(?:[-\w.]+\+)?json\s*(?:;|$)/i;function B_(e,t,n,r){if(e.set(t,{jwks:n,fetchedAt:r}),e.size>I_){let t=e.keys().next().value;t!==void 0&&e.delete(t)}}function V_(e){let t=P_.get(e);if(t)return t;let n=new Map;return P_.set(e,n),n}function H_(e){return`${e.clientDiscoveryId??`managed`}:${e.jwksUri??``}`}var U_=[...gs];function W_(e){return!xp(e)}function G_(e,t,n){let r=new URL(t);if(r.protocol!==`https:`)throw new z(`BAD_REQUEST`,{error_description:`jwks_uri must use HTTPS`,error:`invalid_client`});if(r.username||r.password)throw new z(`BAD_REQUEST`,{error_description:`jwks_uri must not contain credentials`,error:`invalid_client`});if(t.includes(`#`))throw new z(`BAD_REQUEST`,{error_description:`jwks_uri must not include a fragment component`,error:`invalid_client`});if(W_(r.hostname))throw new z(`BAD_REQUEST`,{error_description:`jwks_uri must not point to a private or reserved address`,error:`invalid_client`});if(!(n&&r.origin===n)&&!e.context.isTrustedOrigin(r.href))throw new z(`BAD_REQUEST`,{error_description:`client jwks_uri is not trusted`,error:`invalid_client`})}function K_(e){try{let t=new URL(e);return t.protocol!==`https:`&&t.protocol!==`http:`?void 0:t.origin}catch{return}}async function q_(e){let t=e.headers.get(`content-length`);if(t!==null&&Number.isFinite(Number(t))&&Number(t)>R_)throw await e.body?.cancel(),Error(`JWKS response exceeds 64 KiB`);if(!e.body)return``;let n=e.body.getReader(),r=[],i=0;for(;;){let{done:e,value:t}=await n.read();if(e)break;if(i+=t.byteLength,i>R_)throw await n.cancel(),Error(`JWKS response exceeds 64 KiB`);r.push(t)}let a=new Uint8Array(i),o=0;for(let e of r)a.set(e,o),o+=e.byteLength;return new TextDecoder().decode(a)}async function J_(e,t=globalThis.fetch){let n=new AbortController,r=setTimeout(()=>n.abort(),L_);try{let r=await t(e,{signal:n.signal,headers:{accept:`application/json`},redirect:`error`});if(r.redirected)throw Error(`JWKS fetch redirected`);if(r.status!==200)throw Error(`JWKS fetch returned ${r.status}`);let i=r.headers.get(`content-type`);if(!i||!z_.test(i))throw Error(`JWKS response must use a JSON media type`);let a=await q_(r),o;try{o=JSON.parse(a)}catch{return{valid:!1}}let s=w_(o);return s.valid?{valid:!0,jwks:s.jwks}:{valid:!1}}finally{clearTimeout(r)}}function Y_(){return new z(`BAD_REQUEST`,{error_description:`failed to fetch client JWKS`,error:`invalid_client`})}async function X_(e,t,n){if(n.jwks)return JSON.parse(n.jwks);if(!n.jwksUri)throw new z(`BAD_REQUEST`,{error_description:`client has no JWKS configured`,error:`invalid_client`});let r=n.clientDiscoveryId?Yc(t).find(e=>e.id===n.clientDiscoveryId):void 0;if(n.clientDiscoveryId&&!r?.fetchClientMetadataResource)throw new z(`BAD_REQUEST`,{error_description:`client discovery does not provide a metadata resource transport`,error:`invalid_client`});G_(e,n.jwksUri,n.clientDiscoveryId?K_(n.clientId):void 0);let i=Date.now(),a=H_(n),o=V_(t),s=o.get(a);if(s&&i-s.fetchedAt<F_)return s.jwks;let c;try{c=await J_(n.jwksUri,r?.fetchClientMetadataResource)}catch{let e=F_*2;if(s&&i-s.fetchedAt<e)return s.jwks;throw Y_()}if(!c.valid)throw Y_();return B_(o,a,c.jwks,i),c.jwks}async function Z_(e,t){if(!t.jwksUri)return null;let n=t.clientDiscoveryId?Yc(e).find(e=>e.id===t.clientDiscoveryId):void 0;if(t.clientDiscoveryId&&!n?.fetchClientMetadataResource)return null;try{let r=await J_(t.jwksUri,n?.fetchClientMetadataResource);return r.valid?(B_(V_(e),H_(t),r.jwks,Date.now()),r.jwks):null}catch{return null}}async function Q_(e,t,n){let{namespace:r,payload:i,expectedAudience:a}=n;if(!(Array.isArray(i.aud)?i.aud:i.aud==null?[]:[i.aud]).includes(a))throw new z(`BAD_REQUEST`,{error_description:`client assertion aud does not match the endpoint`,error:`invalid_client`});let o=t.assertionMaxLifetime??300,s=Math.floor(Date.now()/1e3);if(typeof i.exp!=`number`)throw new z(`BAD_REQUEST`,{error_description:`client assertion must include exp claim`,error:`invalid_client`});if(i.exp<=s)throw new z(`BAD_REQUEST`,{error_description:`client assertion has expired`,error:`invalid_client`});if(i.exp-s>o)throw new z(`BAD_REQUEST`,{error_description:`client assertion exp is too far in the future (max ${o}s)`,error:`invalid_client`});if(typeof i.iat==`number`&&s-i.iat>o)throw new z(`BAD_REQUEST`,{error_description:`client assertion iat is too far in the past (max ${o}s)`,error:`invalid_client`});if(typeof i.jti!=`string`||i.jti.length===0)throw new z(`BAD_REQUEST`,{error_description:`client assertion must include jti claim`,error:`invalid_client`});let c=await Li(`SHA-256`).digest(new TextEncoder().encode(`${r}:${i.jti}`)),l=me(new Uint8Array(c).slice(0,24),e.context.options);try{await e.context.adapter.create({model:`oauthClientAssertion`,data:{id:l,expiresAt:new Date(i.exp*1e3)},forceAllowId:!0})}catch(t){let n=!1;try{n=!!await e.context.adapter.findOne({model:`oauthClientAssertion`,where:[{field:`id`,value:l}]})}catch{}throw n?new z(`BAD_REQUEST`,{error_description:`client assertion jti has already been used`,error:`invalid_client`}):t}}async function $_(e,t,n,r,i,a){if(r!==`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)throw new z(`BAD_REQUEST`,{error_description:`unsupported client_assertion_type`,error:`invalid_client`});let o;try{o=vi(n)}catch{throw new z(`BAD_REQUEST`,{error_description:`malformed client assertion: invalid JWT header`,error:`invalid_client`})}if(!o.alg||!U_.includes(o.alg))throw new z(`BAD_REQUEST`,{error_description:`unsupported assertion signing algorithm: ${o.alg}`,error:`invalid_client`});let s;try{s=yi(n)}catch{throw new z(`BAD_REQUEST`,{error_description:`malformed client assertion: invalid JWT payload`,error:`invalid_client`})}let c=s.sub??s.iss;if(!c)throw new z(`BAD_REQUEST`,{error_description:`client assertion must contain sub or iss claim identifying the client`,error:`invalid_client`});if(i&&i!==c)throw new z(`BAD_REQUEST`,{error_description:`client_id in body does not match assertion sub/iss`,error:`invalid_client`});let l=await xl(e,t,c);if(!l)throw new z(`BAD_REQUEST`,{error_description:`unknown client`,error:`invalid_client`});if(l.disabled)throw new z(`BAD_REQUEST`,{error_description:`client is disabled`,error:`invalid_client`});if(l.tokenEndpointAuthMethod!==`private_key_jwt`)throw new z(`BAD_REQUEST`,{error_description:`client is not registered for private_key_jwt authentication`,error:`invalid_client`});let u=await X_(e,t,l),d=a??`${e.context.baseURL}/oauth2/token`,f=Jy(e,t),p=[...new Set([d,f])],m={issuer:c,subject:c,audience:p,algorithms:U_},h;try{({payload:h}=await Vr(n,hi(u),m))}catch(e){if(e instanceof Error&&/no matching key|no applicable key/i.test(e.message)){let e=await Z_(t,l);if(e)try{({payload:h}=await Vr(n,hi(e),m))}catch{throw new z(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}else throw new z(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}else throw new z(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}let g=(Array.isArray(h.aud)?h.aud:[h.aud]).find(e=>typeof e==`string`&&p.includes(e));return await Q_(e,t,{namespace:`private_key_jwt:${c}`,payload:h,expectedAudience:g}),{clientId:c}}function ev(e,t,n){return new z(e,{error:t,error_description:n},{"WWW-Authenticate":`Bearer error="${t}"`,...cu})}async function tv(e,t,n){let r=e.headers,i;try{i=ul(r?.get(`authorization`))}catch{throw ev(`BAD_REQUEST`,`invalid_request`,`Malformed initial access token Authorization header`)}if(!i||!r)return;if(!t.validateInitialAccessToken)throw ev(`UNAUTHORIZED`,`invalid_token`,`Invalid initial access token`);let a;try{a=await t.validateInitialAccessToken({initialAccessToken:i,headers:r,clientMetadata:n})}catch(e){throw e instanceof z?e:new z(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Initial access token validation failed`})}if(!a)throw ev(`UNAUTHORIZED`,`invalid_token`,`Invalid initial access token`);return a}var nv=[`authorization_code`];function rv(e){return[...new Set([...e.clientRegistrationDefaultScopes??e.scopes??[],...e.clientRegistrationAllowedScopes??[]])]}function iv(e){let t=e.grant_types??[...nv];if(t.length>0)return t;throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`grant_types must contain at least one grant type`})}function av(e,t){return e.response_types?e.response_types:t.includes(`authorization_code`)?[`code`]:void 0}function ov(e,t=`web`){let n=iv(e);return{...e,token_endpoint_auth_method:e.token_endpoint_auth_method??`client_secret_basic`,application_type:e.application_type??(t===null?void 0:t),grant_types:n,response_types:av(e,n)}}function sv(e){let t=new URL(e);return t.protocol!==`http:`&&t.protocol!==`https:`&&t.host!==``}function cv(e){try{let t=new URL(e).protocol;return t!==`http:`&&t!==`https:`}catch{return!1}}function lv(e,t){let n=e.clientRegistrationDefaultApplicationType??`web`;return n===`infer`?(t.redirect_uris??[]).some(cv)?`native`:`web`:n}function uv(e){throw new B(`BAD_REQUEST`,{error:`invalid_redirect_uri`,error_description:e})}function dv(e){let t=/^http:\/\/([^/?#]*)/i.exec(e)?.[1];if(!t)return null;let n=t.slice(t.lastIndexOf(`@`)+1);if(n.startsWith(`[`)){let e=n.indexOf(`]`);return e<0?null:n.slice(0,e+1).toLowerCase()}return(n.split(`:`)[0]??``).toLowerCase()}function fv(e,t){let n=new Set([...e.clientRegistrationDefaultResources??[],...e.clientRegistrationAllowedResources??[]]);for(let e of t)if(!n.has(e))throw new B(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${e} is not allowed for client registration`})}async function pv(e,t,n){let r=t.clientRegistrationDefaultResources??[],i=[...new Set([...r,...n])];for(let n of i){let r=await zm(e,t,n);if(!r)throw new B(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} does not exist`});if(r.disabled)throw new B(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is disabled`})}return i}function mv(e,t){let n;try{n=new URL(e)}catch{uv(`redirect URI must be an absolute URI: ${e}`)}(e.includes(`#`)||n.username.length>0||n.password.length>0)&&uv(`redirect URI must not include credentials or a fragment: ${e}`);let r=n.protocol===`http:`,i=n.protocol===`https:`;/^localhost\.+$/i.test(n.hostname)&&uv(`redirect URI localhost must not include trailing dots: ${e}`);let a=yp(n.hostname)||n.hostname===`localhost`,o=dv(e);t===`web`?(!i||a)&&uv(`web clients require https redirect URIs on non-loopback hosts: ${e}`):i?a&&uv(`native clients must not use https loopback redirect URIs: ${e}`):r?o===`localhost`||o===`127.0.0.1`||o===`[::1]`||uv(`native clients may use http only on the exact loopback hosts localhost, 127.0.0.1, or [::1]: ${e}`):Fp(n)||uv(`native private-use redirect URI schemes must not use a reserved scheme; they must be an authority-free reverse-domain URI or a custom-scheme URI with a host and a path: ${e}`)}function hv(e){let t=w_(e);if(!t.valid)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:t.error})}async function gv(e,t){let n=e.body;if(!t.allowDynamicClientRegistration)throw new B(`FORBIDDEN`,{error:`access_denied`,error_description:`Client registration is disabled`});let r=await Z(e),i=r?void 0:await tv(e,t,n),a=!!i;if(!(r||a||t.allowUnauthenticatedClientRegistration))throw new B(`UNAUTHORIZED`,{error_description:`Authentication required for client registration`},{"WWW-Authenticate":`Bearer`,...cu});if(!r&&!a&&n.grant_types?.includes(`client_credentials`))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`client_credentials grant requires authenticated registration`});let o=Array.isArray(n.resources)?n.resources.filter(e=>typeof e==`string`&&e.length>0):[];r&&await j_(e,r,t,`create`);let s=i?.referenceId??(r&&t.clientReference?await t.clientReference({user:r.user,session:r.session}):void 0),c=await Cv(e,t,{metadata:n,registrationSource:`dynamic`,userId:s?void 0:r?.session.userId,referenceId:s,requestedResources:o});return e.setStatus(201),e.json(c)}async function _v(e,t,n){let r=n?.registrationSource===`clientMetadataDocument`,i=ov(e,r?null:n?.registrationSource===`dynamic`?lv(t,e):`web`),a=i.token_endpoint_auth_method??`client_secret_basic`;if(!new Set(tl(t,{includeNone:!0})).has(a))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`unsupported token_endpoint_auth_method ${a}`});if(i.dpop_bound_access_tokens!==void 0&&typeof i.dpop_bound_access_tokens!=`boolean`)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`dpop_bound_access_tokens must be a boolean`});let o=i.grant_types??[],s=i.response_types,c=i.application_type;if(c!==void 0&&c!==`web`&&c!==`native`)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`application_type must be web or native`});if(o.includes(`authorization_code`)&&(!i.redirect_uris||i.redirect_uris.length===0))throw new B(`BAD_REQUEST`,{error:`invalid_redirect_uri`,error_description:`Redirect URIs are required for authorization_code and implicit grant types`});for(let e of i.redirect_uris??[])mv(e,c??(r?`native`:`web`));let l=new Set(Qc(t));if(r){if(!o.some(e=>l.has(e)))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`no mutually supported grant_type among ${o.join(`, `)}`})}else for(let e of o)if(!l.has(e))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`unsupported grant_type ${e}`});if(o.includes(`authorization_code`)&&!s?.includes(`code`))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`When 'authorization_code' grant type is used, 'code' response type must be included`});if(!o.includes(`authorization_code`)&&s?.includes(`code`))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`When 'code' response type is used, 'authorization_code' grant type must be included`});if(i.subject_type!==void 0){if(i.subject_type!==`public`&&i.subject_type!==`pairwise`)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`subject_type must be "public" or "pairwise"`});if(i.subject_type===`pairwise`&&!t.pairwiseSecret)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise subject_type requires server pairwiseSecret configuration`});if(i.subject_type===`pairwise`&&i.redirect_uris?.some(sv))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise clients cannot use custom-scheme redirect URIs that include a host`});if(i.subject_type===`pairwise`&&i.redirect_uris&&i.redirect_uris.length>1&&new Set(i.redirect_uris.map(e=>new URL(e).host)).size>1)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise clients with redirect_uris on different hosts require a sector_identifier_uri, which is not yet supported. All redirect_uris must share the same host.`})}let u=(i?.scope)?.split(` `).filter(e=>e.length),d=n?.registrationSource===`dynamic`||n?.registrationSource===`clientMetadataDocument`,f=d?rv(t):t.scopes;if(f){let e=new Set(f);for(let t of u??[])if(!e?.has(t))throw new B(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`cannot request scope ${t}`})}if(d&&i.require_pkce===!1)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pkce is required for registered clients.`});if(i.jwks||i.jwks_uri){if(i.jwks&&i.jwks_uri)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks and jwks_uri are mutually exclusive`});if(i.jwks_uri)try{let e=new URL(i.jwks_uri);if(e.protocol!==`https:`)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must use HTTPS`});if(e.username||e.password)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not contain credentials`});if(i.jwks_uri.includes(`#`))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not include a fragment component`});if(W_(e.hostname))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not point to a private or reserved address`});if(n?.ctx&&!n.ctx.context.isTrustedOrigin(e.href)){let t=typeof i.client_id==`string`?i.client_id:void 0;if(!(r&&t!==void 0&&URL.canParse(t)&&new URL(t).origin===e.origin))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must belong to a trusted origin or the Client ID Metadata Document origin`})}}catch(e){throw e instanceof B?e:new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must be a valid URL`})}i.jwks&&hv(i.jwks)}if(a===`private_key_jwt`&&!i.jwks&&!i.jwks_uri)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`private_key_jwt requires either jwks or jwks_uri`});if(i.backchannel_logout_uri!==void 0){if(t.disableJwtPlugin)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri requires the jwt plugin (disableJwtPlugin must be false)`});let e;try{e=new URL(i.backchannel_logout_uri)}catch{throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must be an absolute URL`})}if(i.backchannel_logout_uri.includes(`#`))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not include a fragment component`});if(e.protocol!==`https:`)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must use https`});if(e.username||e.password)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not contain credentials`});if(W_(e.hostname))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not point to a private or reserved address`})}}var vv=Symbol(`client-registration-collision`);function yv(e){if(!e||typeof e!=`object`)return!1;let t=e;return t[vv]===!0&&(t.kind===`oauth-client-row-unique`||t.kind===`oauth-client-resource-link-unique`)&&`cause`in t}async function bv(e,t,n){let r=n.registrationSource===`dynamic`&&!n.metadata.scope?{...n.metadata,scope:(t.clientRegistrationDefaultScopes??t.scopes)?.join(` `)}:n.metadata,i=ov(r,n.registrationSource===`clientMetadataDocument`?null:n.registrationSource===`dynamic`?lv(t,r):`web`),a=i.token_endpoint_auth_method===`none`,o=i.token_endpoint_auth_method===`private_key_jwt`,s=nl(t,i.token_endpoint_auth_method);await _v(i,t,{registrationSource:n.registrationSource,ctx:e});let c=n.clientId??t.generateClientId?.()??Fi(32,`a-z`,`A-Z`),l=a||o||s?void 0:t.generateClientSecret?.()||Fi(32,`a-z`,`A-Z`),u=l?await El(e,t,l):void 0,d=n.registrationSource===`dynamic`&&!a&&t.clientRegistrationRequirePKCE===!1,f=i.require_pkce??(!d&&void 0),p=Math.floor(Date.now()/1e3),{resources:m,...h}=n.registrationSource===`dynamic`||n.registrationSource===`clientMetadataDocument`?{...i,scope:rv(t).join(` `)}:i,g=n.registrationSource===`clientMetadataDocument`?void 0:{userId:n.userId,referenceId:n.referenceId},_=kv({...h,redirect_uris:i.redirect_uris??[],disabled:void 0,client_secret_expires_at:u?n.registrationSource===`dynamic`&&t.clientRegistrationClientSecretExpiration?Lp(t.clientRegistrationClientSecretExpiration,p):0:void 0,client_id:c,client_secret:u,client_id_issued_at:p,require_pkce:f,user_id:g?.referenceId?void 0:g?.userId,reference_id:g?.referenceId});_.clientCredentialsScopes=n.registrationSource===`clientMetadataDocument`?n.existingClient?.clientCredentialsScopes??[]:n.registrationSource===`managed`?n.clientCredentialsScopes??[]:[],_.clientDiscoveryId=n.registrationSource===`clientMetadataDocument`?n.clientDiscoveryId:null,n.registrationSource===`clientMetadataDocument`&&i.application_type===void 0&&(_.applicationType=null);let v=n.registrationSource===`clientMetadataDocument`?[]:n.requestedResources??[];n.registrationSource===`dynamic`&&fv(t,v);let y=await pv(e,t,v),b=t.schema?.oauthClient?.modelName??`oauthClient`,x=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,S=n.registrationSource===`clientMetadataDocument`?n.existingClient:void 0,C=n.registrationSource===`clientMetadataDocument`?n.clientDiscoveryId:null,w=await hd(e.context.adapter,async()=>{let t=await pd(e.context.adapter),r,i=!1;if(S){let e=await t.update({model:b,where:[{field:`clientId`,value:c},{field:`clientDiscoveryId`,value:C}],update:{..._,disabled:S.disabled,skipConsent:S.skipConsent,enableEndSession:S.enableEndSession,createdAt:S.createdAt,updatedAt:new Date(p*1e3)}});if(!e)throw new B(`BAD_REQUEST`,{error:`invalid_client`,error_description:`client no longer exists`});r=e}else{try{r=await t.create({model:b,data:{..._,createdAt:new Date(p*1e3),updatedAt:new Date(p*1e3)}})}catch(e){throw n.registrationSource===`clientMetadataDocument`&&Dv(e)?{[vv]:!0,kind:`oauth-client-row-unique`,clientId:c,cause:e}:e}i=!0}let a=y.length===0?[]:await t.findMany({model:x,where:[{field:`clientId`,value:c}]}),o=new Set(a.map(e=>e.resourceId)),s=new Date;for(let e of y)if(!o.has(e))try{await t.create({model:x,data:{clientId:c,resourceId:e,createdAt:s}})}catch(t){throw n.registrationSource===`clientMetadataDocument`&&Dv(t)?{[vv]:!0,kind:`oauth-client-resource-link-unique`,clientId:c,resourceId:e,cause:t}:t}return{client:r,created:i}});return{client:w.client,clientSecret:l,resources:y,created:w.created}}function xv(e,t){let n=Av({...e.client,clientSecret:e.clientSecret?(t.prefix?.clientSecret??``)+e.clientSecret:void 0});return e.resources.length>0&&(n.resources=e.resources),n}function Sv(e,t){return{...xv(e,t),client_credentials_scopes:[...e.client.clientCredentialsScopes??[]]}}async function Cv(e,t,n){return xv(await bv(e,t,n),t)}async function wv(e,t,n){return Sv(await bv(e,t,n),t)}function Tv(e,t){if(e&&e.clientDiscoveryId!==t)throw new B(`BAD_REQUEST`,{error:`invalid_client`,error_description:`client_id is already owned by a different registration source`})}async function Ev(e,t,n){if(Tv(n.existingClient,n.clientDiscoveryId),n.metadata.backchannel_logout_uri!==void 0||n.metadata.backchannel_logout_session_required!==void 0)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`Client ID Metadata Documents cannot register a back-channel logout target`});if((n.metadata.token_endpoint_auth_method??`none`)!==`none`&&n.metadata.token_endpoint_auth_method!==`private_key_jwt`)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`Client ID Metadata Document clients cannot use a shared secret`});let r={...n,metadata:{...n.metadata,token_endpoint_auth_method:n.metadata.token_endpoint_auth_method??`none`,client_secret:void 0,client_secret_expires_at:void 0},registrationSource:`clientMetadataDocument`};try{return await bv(e,t,r)}catch(i){if(!yv(i))throw i;let a=t.schema?.oauthClient?.modelName??`oauthClient`,o=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,s=await e.context.adapter.findOne({model:a,where:[{field:`clientId`,value:n.clientId}]});if(i.clientId!==n.clientId||!s||s.clientDiscoveryId!==n.clientDiscoveryId||i.kind===`oauth-client-resource-link-unique`&&!await e.context.adapter.findOne({model:o,where:[{field:`clientId`,value:i.clientId},{field:`resourceId`,value:i.resourceId}]}))throw i.cause;try{return await bv(e,t,{...r,existingClient:s})}catch(e){throw yv(e)?e.cause:e}}}function Dv(e){if(!e||typeof e!=`object`)return!1;let t=e,n=String(t.code??t.errno??``);return[`1062`,`11000`,`23505`,`ER_DUP_ENTRY`,`P2002`,`SQLITE_CONSTRAINT_UNIQUE`].includes(n)||t.name===`MongoServerError`&&t.code===11e3?!0:typeof t.message==`string`&&/(?:duplicate|unique constraint|unique key)/i.test(t.message)}async function Ov(e,t,n){let r=await Z(e);if(await j_(e,r,t,`create`),!r)throw new B(`UNAUTHORIZED`);let i=t.clientReference?await t.clientReference({user:r.user,session:r.session}):void 0,{client_credentials_scopes:a,...o}=e.body,s=n?.admin?th(a??[]):[];nh(s,iv(o),o.token_endpoint_auth_method,t),s.length>0&&await j_(e,r,t,`configure-client-credentials-scopes`);let c=n?.admin?o.resources:void 0;for(let n of new Set(c??[]))await M_(e,r,t,`link`,n);let l={metadata:o,registrationSource:`managed`,userId:i?void 0:r.session.userId,referenceId:i,clientCredentialsScopes:s,...c?{requestedResources:c}:{}},u=n?.admin?await wv(e,t,l):await Cv(e,t,l);return e.setStatus(201),e.json(u)}function kv(e){let{client_id:t,client_secret:n,client_secret_expires_at:r,scope:i,user_id:a,client_id_issued_at:o,client_name:s,client_uri:c,logo_uri:l,contacts:u,tos_uri:d,policy_uri:f,jwks:p,jwks_uri:m,software_id:h,software_version:g,software_statement:_,redirect_uris:v,post_logout_redirect_uris:y,backchannel_logout_uri:b,backchannel_logout_session_required:x,token_endpoint_auth_method:S,grant_types:C,response_types:w,application_type:T,disabled:E,skip_consent:D,enable_end_session:O,require_pkce:k,dpop_bound_access_tokens:A,subject_type:j,reference_id:M,metadata:N}=e,P=r?new Date(Number(r)*1e3):void 0,F=o?new Date(o*1e3):void 0,I=i?.split(` `),L=A_(N??{}),R=L&&Object.keys(L).length?JSON.stringify(L):void 0;return{clientId:t,clientSecret:n,disabled:E,scopes:I,userId:a,createdAt:F,expiresAt:P,name:s,uri:c,icon:l,contacts:u,tos:d,policy:f,softwareId:h,softwareVersion:g,softwareStatement:_,redirectUris:v,postLogoutRedirectUris:y,backchannelLogoutUri:b,backchannelLogoutSessionRequired:x,tokenEndpointAuthMethod:S,grantTypes:C,responseTypes:w,jwks:p?JSON.stringify(p):void 0,jwksUri:m,applicationType:T,skipConsent:D,enableEndSession:O,requirePKCE:k,dpopBoundAccessTokens:A,subjectType:j,referenceId:M,metadata:R}}function Av(e){let{clientId:t,clientSecret:n,disabled:r,scopes:i,userId:a,createdAt:o,updatedAt:s,expiresAt:c,name:l,uri:u,icon:d,contacts:f,tos:p,policy:m,softwareId:h,softwareVersion:g,softwareStatement:_,redirectUris:v,postLogoutRedirectUris:y,backchannelLogoutUri:b,backchannelLogoutSessionRequired:x,tokenEndpointAuthMethod:S,grantTypes:C,responseTypes:w,applicationType:T,jwks:E,jwksUri:D,skipConsent:O,enableEndSession:k,requirePKCE:A,dpopBoundAccessTokens:j,subjectType:M,referenceId:N,metadata:P}=e,F=c?Math.round(new Date(c).getTime()/1e3):void 0,I=o?Math.round(new Date(o).getTime()/1e3):void 0,L=i?.join(` `);return{...A_(Bl(P)),client_id:t,client_secret:n??void 0,client_secret_expires_at:n?F??0:void 0,scope:L??void 0,user_id:a??void 0,client_id_issued_at:I??void 0,client_name:l??void 0,client_uri:u??void 0,logo_uri:d??void 0,contacts:f??void 0,tos_uri:p??void 0,policy_uri:m??void 0,jwks:E?JSON.parse(E):void 0,jwks_uri:D??void 0,software_id:h??void 0,software_version:g??void 0,software_statement:_??void 0,redirect_uris:v??[],post_logout_redirect_uris:y??void 0,backchannel_logout_uri:b??void 0,backchannel_logout_session_required:x??void 0,token_endpoint_auth_method:S??void 0,grant_types:C??void 0,response_types:w??void 0,application_type:T??void 0,disabled:r??void 0,skip_consent:O??void 0,enable_end_session:k??void 0,require_pkce:A??void 0,dpop_bound_access_tokens:j??void 0,subject_type:M??void 0,reference_id:N??void 0}}async function jv(e,t){let n=await Z(e);if(await j_(e,n,t,`read`,e.query.client_id),!n)throw new B(`UNAUTHORIZED`);let r=await xl(e,t,e.query.client_id);if(!r)throw new B(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(r.userId){if(r.userId!==n.user.id)throw new B(`UNAUTHORIZED`)}else if(r.referenceId&&t.clientReference){if(r.referenceId!==await t.clientReference(n))throw new B(`UNAUTHORIZED`)}else throw new B(`UNAUTHORIZED`);let i=Av(r);return i.client_secret=void 0,i}async function Mv(e,t,n){let r=await xl(e,t,n);if(!r||r.disabled)throw new B(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});return Av({clientId:r.clientId,name:r.name,uri:r.uri,contacts:r.contacts,icon:r.icon,tos:r.tos,policy:r.policy})}async function Nv(e,t){let n=await Z(e);if(await j_(e,n,t,`list`),!n)throw new B(`UNAUTHORIZED`);let r=await t.clientReference?.(n);if(r)return await e.context.adapter.findMany({model:`oauthClient`,where:[{field:`referenceId`,value:r}]}).then(e=>e?e.map(e=>{let t=Av(e);return t.client_secret=void 0,t}):null);if(n.user.id)return await e.context.adapter.findMany({model:`oauthClient`,where:[{field:`userId`,value:n.user.id}]}).then(e=>e?e.map(e=>{let t=Av(e);return t.client_secret=void 0,t}):null);throw new B(`BAD_REQUEST`,{message:`either user_id or reference_id must be provided`})}async function Pv(e,t){let n=await Z(e);if(await j_(e,n,t,`delete`,e.body.client_id),!n)throw new B(`UNAUTHORIZED`);let r=e.body.client_id;if(t.cachedTrustedClients?.has(r))throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`trusted clients must be updated manually`,error:`invalid_client`});let i=await xl(e,t,r);if(!i)throw new B(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(i.userId){if(i.userId!==n.user.id)throw new B(`UNAUTHORIZED`)}else if(i.referenceId&&t.clientReference){if(i.referenceId!==await t.clientReference(n))throw new B(`UNAUTHORIZED`)}else throw new B(`UNAUTHORIZED`);await e.context.adapter.delete({model:`oauthClient`,where:[{field:`clientId`,value:r}]})}async function Fv(e,t,n){let r=await Z(e);if(await j_(e,r,t,`update`,e.body.client_id),!r)throw new B(`UNAUTHORIZED`);let i=e.body.client_id;if(t.cachedTrustedClients?.has(i))throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`trusted clients must be updated manually`,error:`invalid_client`});let a=await xl(e,t,i);if(!a)throw new B(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});let{client_credentials_scopes:o,...s}=e.body.update,c=a.userId?a.userId===r.user.id:a.referenceId&&t.clientReference?a.referenceId===await t.clientReference(r):!1,l=!c&&n?.admin&&o!==void 0&&Object.keys(s).length===0;if(!c&&!l)throw new B(`UNAUTHORIZED`);if(l&&await j_(e,r,t,`configure-client-credentials-scopes`,i),Object.keys(s).length===0&&o===void 0){let e=Av(a);return e.client_secret=void 0,n?.admin?{...e,client_credentials_scopes:[...a.clientCredentialsScopes??[]]}:e}let u=s.grant_types??a.grantTypes??[],d=s.token_endpoint_auth_method??a.tokenEndpointAuthMethod,f=o===void 0?void 0:th(o);f!==void 0&&(nh(f,u,d,t),f.length>0&&!l&&await j_(e,r,t,`configure-client-credentials-scopes`,i)),await _v({...Av(a),...s},t,{ctx:e});let p={...kv(s)};!u.includes(`client_credentials`)||d===`none`?p.clientCredentialsScopes=[]:f!==void 0&&(p.clientCredentialsScopes=f),s.token_endpoint_auth_method&&(s.token_endpoint_auth_method===`private_key_jwt`?p.clientSecret=null:(p.jwks=null,p.jwksUri=null,p.clientSecret||=await El(e,t,t.generateClientSecret?.()||Fi(32,`a-z`,`A-Z`))));let m=await e.context.adapter.update({model:`oauthClient`,where:[{field:`clientId`,value:i}],update:{...p,updatedAt:new Date(Math.floor(Date.now()/1e3)*1e3)}});if(!m)throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`unable to update client`,error:`invalid_client`});let h=Av(m);return h.client_secret=void 0,n?.admin?{...h,client_credentials_scopes:[...m.clientCredentialsScopes??[]]}:h}async function Iv(e,t){let n=await Z(e);if(await j_(e,n,t,`rotate`,e.body.client_id),!n)throw new B(`UNAUTHORIZED`);let r=e.body.client_id;if(t.cachedTrustedClients?.has(r))throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`trusted clients must be updated manually`,error:`invalid_client`});let i=await xl(e,t,r);if(!i)throw new B(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(i.userId){if(i.userId!==n.user.id)throw new B(`UNAUTHORIZED`)}else if(i.referenceId&&t.clientReference){if(i.referenceId!==await t.clientReference(n))throw new B(`UNAUTHORIZED`)}else throw new B(`UNAUTHORIZED`);if(i.tokenEndpointAuthMethod===`none`||!i.clientSecret)throw new B(`BAD_REQUEST`,{error_description:`secret rotation is only available for clients using client_secret authentication`,error:`invalid_client`});let a=t.generateClientSecret?.()||Fi(32,`a-z`,`A-Z`),o=a?await El(e,t,a):void 0,s=await e.context.adapter.update({model:`oauthClient`,where:[{field:`clientId`,value:r}],update:{clientSecret:o,updatedAt:new Date(Math.floor(Date.now()/1e3)*1e3)}});if(!s)throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`unable to update client`,error:`invalid_client`});return Av({...s,clientSecret:(t.prefix?.clientSecret??``)+a})}var Lv=c().trim().min(1),Rv=x(c().trim().min(1)).min(1),zv=e=>X(`/admin/oauth2/create-client`,{method:`POST`,body:w({redirect_uris:x(Q).min(1).optional(),scope:c().optional(),client_name:c().optional(),client_uri:c().optional(),logo_uri:c().optional(),contacts:x(c().min(1)).min(1).optional(),tos_uri:c().optional(),policy_uri:c().optional(),software_id:c().optional(),software_version:c().optional(),software_statement:c().optional(),post_logout_redirect_uris:x(Q).min(1).optional(),backchannel_logout_uri:Q.optional(),backchannel_logout_session_required:v().optional(),token_endpoint_auth_method:Lv.optional(),application_type:u([`web`,`native`]).optional(),jwks:hm.optional(),jwks_uri:c().optional(),grant_types:Rv.optional(),client_credentials_scopes:x(c().trim().min(1)).optional(),resources:x(fm).optional(),response_types:x(u([`code`])).optional(),client_secret_expires_at:a([c(),d()]).optional().default(0),skip_consent:v().optional(),enable_end_session:v().optional(),require_pkce:v().optional(),dpop_bound_access_tokens:v().optional(),subject_type:u([`public`,`pairwise`]).optional(),metadata:i(c(),o()).optional()}),metadata:{noStore:!0,SERVER_ONLY:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},client_credentials_scopes:{type:`array`,items:{type:`string`},description:`Server-authorized scope ceiling for client_credentials tokens`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`URI of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URI for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final server-owned resources linked to the client`},disabled:{type:`boolean`,description:`Whether the client is disabled`},require_pkce:{type:`boolean`,description:`Whether the client requires PKCE`,default:!0},metadata:{type:`object`,additionalProperties:!0,nullable:!0,description:`Additional metadata for the application`}},required:[`client_id`]}}}}}}}},async t=>Ov(t,e,{admin:!0})),Bv=e=>X(`/oauth2/create-client`,{method:`POST`,use:[qf],body:w({redirect_uris:x(Q).min(1).optional(),scope:c().optional(),client_name:c().optional(),client_uri:c().optional(),logo_uri:c().optional(),contacts:x(c().min(1)).min(1).optional(),tos_uri:c().optional(),policy_uri:c().optional(),software_id:c().optional(),software_version:c().optional(),software_statement:c().optional(),post_logout_redirect_uris:x(Q).min(1).optional(),backchannel_logout_uri:Q.optional(),backchannel_logout_session_required:v().optional(),token_endpoint_auth_method:Lv.optional(),application_type:u([`web`,`native`]).optional(),jwks:hm.optional(),jwks_uri:c().optional(),grant_types:Rv.optional(),response_types:x(u([`code`])).optional(),dpop_bound_access_tokens:v().optional()}),metadata:{noStore:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`URI of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URI for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final server-owned resources linked to the client`},disabled:{type:`boolean`,description:`Whether the client is disabled`},metadata:{type:`object`,additionalProperties:!0,nullable:!0,description:`Additional metadata for the application`}},required:[`client_id`]}}}}}}}},async t=>Ov(t,e)),Vv=e=>X(`/oauth2/get-client`,{method:`GET`,use:[qf],query:w({client_id:c()}),metadata:{openapi:{description:`Get OAuth2 formatted client details`}}},async t=>jv(t,e)),Hv=e=>X(`/oauth2/public-client`,{method:`GET`,use:[qf],query:w({client_id:c()}),metadata:{openapi:{description:`Gets publicly available client fields`}}},async t=>{let n=t.query.client_id;return Mv(t,e,n)}),Uv=e=>X(`/oauth2/public-client-prelogin`,{method:`POST`,use:[m_(e)],body:w({client_id:c(),oauth_query:c().optional()}),metadata:{openapi:{description:`Gets publicly available client fields (prior to login)`}}},async t=>{let n=t.body.client_id;return Mv(t,e,n)}),Wv=e=>X(`/oauth2/get-clients`,{method:`GET`,use:[qf],metadata:{openapi:{description:`Get OAuth2 formatted client details for a user or organization`}}},async t=>Nv(t,e)),Gv=e=>X(`/admin/oauth2/update-client`,{method:`PATCH`,body:w({client_id:c(),update:w({redirect_uris:x(Q).min(1).optional(),scope:c().optional(),client_name:c().optional(),client_uri:c().optional(),logo_uri:c().optional(),contacts:x(c().min(1)).min(1).optional(),tos_uri:c().optional(),policy_uri:c().optional(),software_id:c().optional(),software_version:c().optional(),software_statement:c().optional(),post_logout_redirect_uris:x(Q).min(1).optional(),backchannel_logout_uri:Q.optional(),backchannel_logout_session_required:v().optional(),application_type:u([`web`,`native`]).optional(),grant_types:Rv.optional(),client_credentials_scopes:x(c().trim().min(1)).optional(),response_types:x(u([`code`])).optional(),client_secret_expires_at:a([c(),d()]).optional(),skip_consent:v().optional(),enable_end_session:v().optional(),disabled:v().optional(),dpop_bound_access_tokens:v().optional(),metadata:i(c(),o()).optional()})}),metadata:{SERVER_ONLY:!0,openapi:{description:`Updates OAuth2 formatted client details.`}}},async t=>Fv(t,e,{admin:!0})),Kv=e=>X(`/oauth2/update-client`,{method:`POST`,use:[qf],body:w({client_id:c(),update:w({redirect_uris:x(Q).min(1).optional(),scope:c().optional(),client_name:c().optional(),client_uri:c().optional(),logo_uri:c().optional(),contacts:x(c().min(1)).min(1).optional(),tos_uri:c().optional(),policy_uri:c().optional(),software_id:c().optional(),software_version:c().optional(),software_statement:c().optional(),post_logout_redirect_uris:x(Q).min(1).optional(),backchannel_logout_uri:Q.optional(),backchannel_logout_session_required:v().optional(),application_type:u([`web`,`native`]).optional(),grant_types:Rv.optional(),response_types:x(u([`code`])).optional()})}),metadata:{openapi:{description:`Updates OAuth2 formatted client details.`}}},async t=>Fv(t,e)),qv=e=>X(`/oauth2/client/rotate-secret`,{method:`POST`,use:[qf],body:w({client_id:c()}),metadata:{noStore:!0,openapi:{description:`Rotates a confidential client's secret`}}},async t=>Iv(t,e)),Jv=e=>X(`/oauth2/delete-client`,{method:`POST`,use:[qf],body:w({client_id:c()}),metadata:{openapi:{description:`Deletes an oauth client`}}},async t=>Pv(t,e));async function Yv(e,t,n){return await e.context.adapter.findOne({model:`oauthConsent`,where:[{field:`id`,value:n}]})}async function Xv(e,t){let n=await Z(e);if(!n)throw new B(`UNAUTHORIZED`);let{id:r}=e.query;if(!r)throw new B(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await Yv(e,t,r);if(!i)throw new B(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new B(`UNAUTHORIZED`);return i}async function Zv(e,t){let n=await Z(e);if(!n)throw new B(`UNAUTHORIZED`);return await e.context.adapter.findMany({model:`oauthConsent`,where:[{field:`userId`,value:n.user.id}]})}async function Qv(e,t){let n=await Z(e);if(!n)throw new B(`UNAUTHORIZED`);let{id:r}=e.body;if(!r)throw new B(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await Yv(e,t,r);if(!i)throw new B(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new B(`UNAUTHORIZED`);await e.context.adapter.delete({model:`oauthConsent`,where:[{field:`id`,value:r}]})}async function $v(e,t){let n=await Z(e);if(!n)throw new B(`UNAUTHORIZED`);let{id:r}=e.body;if(!r)throw new B(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await Yv(e,t,r);if(!i)throw new B(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new B(`UNAUTHORIZED`);let a=await xl(e,t,i.clientId);if(!a)throw new B(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});let o=a?.scopes??t.scopes??[],s=e.body.update,c=s.scopes;if(c&&!c.every(e=>o?.includes(e)))throw new B(`BAD_REQUEST`,{error_description:`unable to provide scopes to ${a?.referenceId??a?.userId}`,error:`invalid_request`});let l=Math.floor(Date.now()/1e3);return await e.context.adapter.update({model:`oauthConsent`,where:[{field:`id`,value:r}],update:{...s,updatedAt:new Date(l*1e3)}})}var ey=e=>X(`/oauth2/get-consent`,{method:`GET`,query:w({id:c()}),use:[qf],metadata:{openapi:{description:`Gets details of a specific OAuth2 consent for a user`}}},async t=>Xv(t,e)),ty=e=>X(`/oauth2/get-consents`,{method:`GET`,use:[qf],metadata:{openapi:{description:`Gets all available OAuth2 consents for a user`}}},async t=>Zv(t,e)),ny=e=>X(`/oauth2/update-consent`,{method:`POST`,use:[qf],body:w({id:c(),update:w({scopes:x(c())})}),metadata:{openapi:{description:`Updates consent granted to a client.`}}},async t=>$v(t,e)),ry=e=>X(`/oauth2/delete-consent`,{method:`POST`,use:[qf],body:w({id:c()}),metadata:{openapi:{description:`Deletes consent granted to a client`}}},async t=>Qv(t,e)),iy=e=>e.schema?.oauthResource?.modelName??`oauthResource`,ay=e=>e.schema?.oauthClientResource?.modelName??`oauthClientResource`,oy=e=>e.schema?.oauthClient?.modelName??`oauthClient`;function sy(e){try{return decodeURIComponent(e)}catch{return e}}function cy(e,t){return{identifier:e.identifier,name:e.name??e.identifier,accessTokenTtl:e.accessTokenTtl??null,refreshTokenTtl:e.refreshTokenTtl??null,signingAlgorithm:e.signingAlgorithm??null,signingKeyId:e.signingKeyId??null,allowedScopes:e.allowedScopes??null,customClaims:e.customClaims??null,dpopBoundAccessTokensRequired:e.dpopBoundAccessTokensRequired??!1,disabled:e.disabled??!1,policyVersion:1,metadata:e.metadata??null,createdAt:t,updatedAt:t}}async function ly(e,t){await M_(e,await Z(e),t,`create`);let n=e.body;if(!n?.identifier)throw new B(`BAD_REQUEST`,{error:`invalid_request`,error_description:`identifier is required`});await Dm(t,n.identifier);let r=new Date,i;try{i=await e.context.adapter.create({model:iy(t),data:cy(n,r)})}catch(e){let t=e instanceof Error?e.message:String(e);throw/unique|duplicate|UNIQUE/i.test(t)?new B(`BAD_REQUEST`,{error:`invalid_request`,error_description:`resource ${n.identifier} already exists`}):e}if(!i)throw new B(`BAD_REQUEST`,{error:`invalid_request`,error_description:`resource ${n.identifier} could not be created`});return Rm(i.identifier),e.json(i,{status:201})}async function uy(e,t){await M_(e,await Z(e),t,`list`);let n=await e.context.adapter.findMany({model:iy(t)});return e.json(n??[])}async function dy(e,t){let n=sy(e.params.identifier);await M_(e,await Z(e),t,`read`,n);let r=await e.context.adapter.findOne({model:iy(t),where:[{field:`identifier`,value:n}]});if(!r)throw new B(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return e.json(r)}async function fy(e,t){let n=sy(e.params.identifier);if(await M_(e,await Z(e),t,`update`,n),!await e.context.adapter.findOne({model:iy(t),where:[{field:`identifier`,value:n}]}))throw new B(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});let r={updatedAt:new Date};for(let t of[`name`,`accessTokenTtl`,`refreshTokenTtl`,`signingAlgorithm`,`signingKeyId`,`allowedScopes`,`customClaims`,`dpopBoundAccessTokensRequired`,`disabled`,`metadata`])Object.prototype.hasOwnProperty.call(e.body,t)&&(r[t]=e.body[t]);await e.context.adapter.update({model:iy(t),where:[{field:`identifier`,value:n}],update:r}),Rm(n);let i=await e.context.adapter.findOne({model:iy(t),where:[{field:`identifier`,value:n}]});if(!i)throw new B(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return e.json(i)}async function py(e,t){let n=sy(e.params.identifier);if(await M_(e,await Z(e),t,`delete`,n),!await e.context.adapter.findOne({model:iy(t),where:[{field:`identifier`,value:n}]}))throw new B(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return await e.context.adapter.delete({model:iy(t),where:[{field:`identifier`,value:n}]}),Rm(n),e.json({deleted:!0})}async function my(e,t){let n=await Z(e),r=sy(e.params.identifier),i=sy(e.params.client_id);if(await M_(e,n,t,`link`,r),!await e.context.adapter.findOne({model:iy(t),where:[{field:`identifier`,value:r}]}))throw new B(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${r} not found`});if(!await e.context.adapter.findOne({model:oy(t),where:[{field:`clientId`,value:i}]}))throw new B(`NOT_FOUND`,{error:`not_found`,error_description:`client ${i} not found`});try{await e.context.adapter.create({model:ay(t),data:{clientId:i,resourceId:r,createdAt:new Date}})}catch(t){let n=t instanceof Error?t.message:String(t);if(/unique|duplicate|UNIQUE/i.test(n))return e.json({linked:!0,alreadyLinked:!0});throw t}return e.json({linked:!0})}async function hy(e,t){let n=await Z(e),r=sy(e.params.identifier),i=sy(e.params.client_id);return await M_(e,n,t,`unlink`,r),await e.context.adapter.deleteMany({model:ay(t),where:[{field:`clientId`,value:i},{field:`resourceId`,value:r}]}),e.json({unlinked:!0})}var gy=w({identifier:c().min(1).optional(),name:c().optional(),accessTokenTtl:d().int().positive().nullable().optional(),refreshTokenTtl:d().int().positive().nullable().optional(),signingAlgorithm:u(Cm).nullable().optional(),signingKeyId:c().nullable().optional(),allowedScopes:x(c()).nullable().optional(),customClaims:i(c(),o()).nullable().optional(),dpopBoundAccessTokensRequired:v().optional(),disabled:v().optional(),metadata:i(c(),o()).nullable().optional()}),_y=e=>X(`/admin/oauth2/resources`,{method:`POST`,body:gy.required({identifier:!0}),metadata:{SERVER_ONLY:!0}},async t=>ly(t,e)),vy=e=>X(`/admin/oauth2/resources`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async t=>uy(t,e)),yy=e=>X(`/admin/oauth2/resources/:identifier`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async t=>dy(t,e)),by=e=>X(`/admin/oauth2/resources/:identifier`,{method:`PATCH`,body:gy,metadata:{SERVER_ONLY:!0}},async t=>fy(t,e)),xy=e=>X(`/admin/oauth2/resources/:identifier`,{method:`DELETE`,metadata:{SERVER_ONLY:!0}},async t=>py(t,e)),Sy=e=>X(`/admin/oauth2/resources/:identifier/clients/:client_id`,{method:`POST`,metadata:{SERVER_ONLY:!0}},async t=>my(t,e)),Cy=e=>X(`/admin/oauth2/resources/:identifier/clients/:client_id`,{method:`DELETE`,metadata:{SERVER_ONLY:!0}},async t=>hy(t,e));async function wy(e,t,n){let r=t.disableJwtPlugin?void 0:pl(e.context),i=r?.options;try{let a=await Vr(n,hi(await Pc(n,{jwksFetch:i?.jwks?.remoteUrl?i.jwks.remoteUrl:async()=>(await r?.endpoints.getJwks(e))?.response,jwksCacheKey:r})),{issuer:i?.jwt?.issuer??e.context.baseURL}),o=`${e.context.baseURL}/oauth2/userinfo`;if(!a.payload.azp||!await jm(e,t,a.payload.aud,[o]))return null}catch(e){if(e instanceof Error){if(e.name===`TypeError`||e.name===`JWSInvalid`)throw new z(`BAD_REQUEST`,{error_description:`invalid JWT signature`,error:`invalid_request`});if(e.name===`JWTExpired`||e.name===`JWTInvalid`)return null;throw e}throw Error(e)}throw new z(`BAD_REQUEST`,{error_description:`JWT access tokens are self-contained and cannot be revoked server-side`,error:`unsupported_token_type`})}async function Ty(e,t,n,r){let i=n;if(t.prefix?.opaqueAccessToken){if(i.startsWith(t.prefix.opaqueAccessToken))i=i.replace(t.prefix.opaqueAccessToken,``);else throw new z(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`})}let a=await e.context.adapter.findOne({model:`oauthAccessToken`,where:[{field:`token`,value:await Ol(t.storeTokens,i,`access_token`)}]});if(!a)throw new z(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`});if(!a.clientId||a.clientId!==r)return null;a.id?await e.context.adapter.delete({model:`oauthAccessToken`,where:[{field:`id`,value:a.id}]}):await e.context.adapter.delete({model:`oauthAccessToken`,where:[{field:`token`,value:a.token}]})}async function Ey(e,t,n,r){let i=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await Ol(t.storeTokens,n,`refresh_token`)}]});if(!i)throw new z(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`});if(i.revoked)throw await vh(e,r,i.userId),new z(`BAD_REQUEST`,{error_description:`refresh token revoked`,error:`invalid_request`});if(!i.clientId||i.clientId!==r)return null;let a=Math.floor(Date.now()/1e3);if(!await e.context.adapter.incrementOne({model:`oauthRefreshToken`,where:[{field:`id`,value:i.id},{field:`revoked`,operator:`eq`,value:null}],increment:{},set:{revoked:new Date(a*1e3)}}))throw await vh(e,r,i.userId),new z(`BAD_REQUEST`,{error_description:`refresh token revoked`,error:`invalid_request`});await e.context.adapter.deleteMany({model:`oauthAccessToken`,where:[{field:`refreshId`,value:i.id}]})}async function Dy(e,t,n,r){try{return await wy(e,t,r)}catch(e){if(e instanceof z){if(e.body?.error===`unsupported_token_type`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}try{return await Ty(e,t,r,n)}catch(e){if(!(e instanceof z))throw e instanceof Error?e:Error(`Unknown error validating access token`)}throw new z(`BAD_REQUEST`,{error_description:`Invalid access token`,error:`invalid_request`})}async function Oy(e,t){let{token:n,token_type_hint:r}=e.body;r!==`access_token`&&r!==`refresh_token`&&(r=void 0);let{clientId:i,clientSecret:a,preVerified:o,authMethod:s}=Vl(await Hl(e,t,`${e.context.baseURL}/oauth2/revoke`));if(!i)throw new z(`UNAUTHORIZED`,{error_description:`missing required credentials`,error:`invalid_client`});if(typeof n==`string`&&(n=pc(n)),!n?.length)throw new z(`BAD_REQUEST`,{error_description:`missing a required token for introspection`,error:`invalid_request`});let c=await zl(e,t,i,a,void 0,o,void 0,s);try{if(r===void 0||r===`access_token`)try{return await Dy(e,t,c.clientId,n)}catch(e){if(e instanceof z){if(r===`access_token`||e.body?.error===`unsupported_token_type`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}if(r===void 0||r===`refresh_token`)try{return await Ey(e,t,(await gh(t,n)).token,c.clientId)}catch(e){if(e instanceof z){if(r===`refresh_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}throw new z(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`})}catch(e){if(e instanceof z){if(e.body?.error===`unsupported_token_type`)throw e;if(e.name===`BAD_REQUEST`)return null;throw e}throw e instanceof Error?(_e.error(`Introspection error:`,e.message,e.stack),new z(`INTERNAL_SERVER_ERROR`)):(_e.error(`Introspection error:`,e),new z(`INTERNAL_SERVER_ERROR`))}}var ky={oauthClient:{modelName:`oauthClient`,fields:{clientId:{type:`string`,unique:!0,required:!0},clientSecret:{type:`string`,required:!1},clientDiscoveryId:{type:`string`,required:!1},disabled:{type:`boolean`,defaultValue:!1,required:!1},skipConsent:{type:`boolean`,required:!1},enableEndSession:{type:`boolean`,required:!1},subjectType:{type:`string`,required:!1},scopes:{type:`string[]`,required:!1},clientCredentialsScopes:{type:`string[]`,required:!1,defaultValue:[]},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},createdAt:{type:`date`,required:!1},updatedAt:{type:`date`,required:!1},name:{type:`string`,required:!1},uri:{type:`string`,required:!1},icon:{type:`string`,required:!1},contacts:{type:`string[]`,required:!1},tos:{type:`string`,required:!1},policy:{type:`string`,required:!1},softwareId:{type:`string`,required:!1},softwareVersion:{type:`string`,required:!1},softwareStatement:{type:`string`,required:!1},redirectUris:{type:`string[]`,required:!0},postLogoutRedirectUris:{type:`string[]`,required:!1},backchannelLogoutUri:{type:`string`,required:!1},backchannelLogoutSessionRequired:{type:`boolean`,required:!1},tokenEndpointAuthMethod:{type:`string`,required:!1},applicationType:{type:`string`,required:!1},jwks:{type:`string`,required:!1},jwksUri:{type:`string`,required:!1},grantTypes:{type:`string[]`,required:!1},responseTypes:{type:`string[]`,required:!1},requirePKCE:{type:`boolean`,required:!1},dpopBoundAccessTokens:{type:`boolean`,required:!1,defaultValue:!1},referenceId:{type:`string`,required:!1},metadata:{type:`json`,required:!1}}},oauthResource:{modelName:`oauthResource`,fields:{identifier:{type:`string`,required:!0,unique:!0},name:{type:`string`,required:!0},accessTokenTtl:{type:`number`,required:!1},refreshTokenTtl:{type:`number`,required:!1},signingAlgorithm:{type:`string`,required:!1},signingKeyId:{type:`string`,required:!1},allowedScopes:{type:`string[]`,required:!1},customClaims:{type:`json`,required:!1},dpopBoundAccessTokensRequired:{type:`boolean`,required:!1,defaultValue:!1},disabled:{type:`boolean`,required:!1,defaultValue:!1},createdAt:{type:`date`,required:!1},updatedAt:{type:`date`,required:!1},policyVersion:{type:`number`,required:!1,defaultValue:1},metadata:{type:`json`,required:!1}}},oauthClientResource:{modelName:`oauthClientResource`,fields:{clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`,onDelete:`cascade`},index:!0},resourceId:{type:`string`,required:!0,references:{model:`oauthResource`,field:`identifier`,onDelete:`cascade`},index:!0},metadata:{type:`json`,required:!1},createdAt:{type:`date`,required:!1}},indexes:[{fields:[`clientId`,`resourceId`],unique:!0}]},oauthRefreshToken:{fields:{token:{type:`string`,required:!0,unique:!0},clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},sessionId:{type:`string`,required:!1,references:{model:`session`,field:`id`,onDelete:`set null`},index:!0},userId:{type:`string`,required:!0,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},authorizationCodeId:{type:`string`,required:!1,index:!0},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},expiresAt:{type:`date`},createdAt:{type:`date`},revoked:{type:`date`,required:!1},rotatedAt:{type:`date`,required:!1},rotationReplayResponse:{type:`string`,required:!1},rotationReplayExpiresAt:{type:`date`,required:!1},authTime:{type:`date`,required:!1},confirmation:{type:`json`,required:!1},scopes:{type:`string[]`,required:!0}}},oauthAccessToken:{modelName:`oauthAccessToken`,fields:{token:{type:`string`,unique:!0},clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},sessionId:{type:`string`,required:!1,references:{model:`session`,field:`id`,onDelete:`set null`},index:!0},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},authorizationCodeId:{type:`string`,required:!1,index:!0},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},refreshId:{type:`string`,required:!1,references:{model:`oauthRefreshToken`,field:`id`},index:!0},expiresAt:{type:`date`},createdAt:{type:`date`},revoked:{type:`date`,required:!1},confirmation:{type:`json`,required:!1},scopes:{type:`string[]`,required:!0}}},oauthConsent:{modelName:`oauthConsent`,fields:{clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},scopes:{type:`string[]`,required:!0},createdAt:{type:`date`},updatedAt:{type:`date`}}},oauthClientAssertion:{modelName:`oauthClientAssertion`,fields:{expiresAt:{type:`date`,required:!0}}}},Ay=[`openid`,`profile`,`email`,`offline_access`],jy=w({id_token_hint:c().optional(),client_id:c().optional(),post_logout_redirect_uri:Q.optional(),state:c().optional()}),My=dd(()=>null),Ny=My.get,Py=new WeakMap,Fy=`signedQueryIssuedAtMs`;function Iy(e){let t=typeof e==`number`?e:typeof e==`string`?Number(e):void 0;if(!(!t||!Number.isFinite(t)||t<=0))return new Date(t)}var Ly=e=>{let t=e.clientRegistrationAllowedScopes;if(e.clientRegistrationDefaultScopes){let n=t?new Set([...t,...e.clientRegistrationDefaultScopes]):new Set([...e.clientRegistrationDefaultScopes]);t=Array.from(n)}let n=new Set((e.scopes??Ay).filter(e=>e.length));if(t){for(let e of t)if(!n.has(e))throw new V(`clientRegistrationAllowedScope ${e} not found in scopes`)}for(let t of e.advertisedMetadata?.scopes_supported??[])if(!n?.has(t))throw new V(`advertisedMetadata.scopes_supported ${t} not found in scopes`);let r=new Set((e.resources??[]).map(e=>typeof e==`string`?e:e.identifier));for(let[t,n]of[[`clientRegistrationDefaultResources`,e.clientRegistrationDefaultResources],[`clientRegistrationAllowedResources`,e.clientRegistrationAllowedResources]])for(let e of n??[])if(!r.has(e))throw new V(`${t} resource ${e} not found in resources`);let i=new Set([`sub`,`iss`,`aud`,`exp`,`iat`,`sid`,`scope`,`azp`,...om.filter(e=>n.has(am[e].scope))]),o={codeExpiresIn:600,accessTokenExpiresIn:3600,m2mAccessTokenExpiresIn:3600,refreshTokenExpiresIn:2592e3,refreshTokenReuseInterval:0,allowUnauthenticatedClientRegistration:!1,allowDynamicClientRegistration:!1,disableJwtPlugin:!1,storeClientSecret:e.disableJwtPlugin?`encrypted`:`hashed`,storeTokens:`hashed`,grantTypes:[`authorization_code`,`client_credentials`,`refresh_token`],...e,scopes:Array.from(n),claims:Array.from(i),clientRegistrationAllowedScopes:t};if(qc(o.extensions),o.pairwiseSecret&&o.pairwiseSecret.length<32)throw new V(`pairwiseSecret must be at least 32 characters long for adequate HMAC-SHA256 security`);if(o.grantTypes&&o.grantTypes.includes(`refresh_token`)&&!o.grantTypes.includes(`authorization_code`))throw new V(`refresh_token grant requires authorization_code grant`);if(o.disableJwtPlugin&&(o.storeClientSecret===`hashed`||typeof o.storeClientSecret==`object`&&`hash`in o.storeClientSecret))throw new V(`unable to store hashed secrets because id tokens will be signed with secret`);if(!o.disableJwtPlugin&&(o.storeClientSecret===`encrypted`||typeof o.storeClientSecret==`object`&&(`encrypt`in o.storeClientSecret||`decrypt`in o.storeClientSecret)))throw new V(`encryption method not recommended, please use 'hashed' or the 'hash' function`);let s=async(e,t)=>{let n=new URL(e.url).pathname,r=t.options.advanced?.skipTrailingSlashes?n.replace(/\/+$/,``)||`/`:n,i=o.disableJwtPlugin?t.baseURL:pl(t)?.options?.jwt?.issuer??t.baseURL,a=`/`;try{a=new URL(i).pathname.replace(/\/$/,``)||``}catch{a=new URL(t.baseURL).pathname.replace(/\/$/,``)||``}let s={context:t},c=new Set([`/.well-known/oauth-authorization-server${a}`,`${a}/.well-known/oauth-authorization-server`]),l=`${a}/.well-known/openid-configuration`,u=c.has(r),d=o.scopes?.includes(`openid`)&&r===l,f=t=>{let n=c_(t);return e.method===`HEAD`?new Response(null,{status:n.status,headers:n.headers}):n};if((u||d)&&e.method!==`GET`&&e.method!==`HEAD`)return{response:new Response(null,{status:405,headers:{Allow:`GET, HEAD`}})};if(u)return o.scopes?.includes(`openid`)?{response:f(o_(s,o))}:{response:f(a_(s,o))};if(d)return{response:f(o_(s,o))}},u=l_(`/oauth2/authorize`,{method:[`GET`,`POST`],body:w({}).passthrough(),redirectOnError:eb(o),metadata:{allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Authorize an OAuth 2.1 request from query parameters or an application/x-www-form-urlencoded POST body`,parameters:[{name:`response_type`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 response type (e.g., 'code')`},{name:`client_id`,in:`query`,required:!0,schema:{type:`string`},description:`OAuth 2.1 client ID`},{name:`redirect_uri`,in:`query`,required:!1,schema:{type:`string`,format:`uri`},description:`OAuth 2.1 redirect URI`},{name:`scope`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 scopes (space-separated)`},{name:`state`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 state parameter`},{name:`request_uri`,in:`query`,required:!1,schema:{type:`string`},description:`Pushed Authorization Request URI referencing stored parameters`},{name:`code_challenge`,in:`query`,required:!1,schema:{type:`string`},description:`PKCE code challenge`},{name:`code_challenge_method`,in:`query`,required:!1,schema:{type:`string`},description:`PKCE code challenge method`},{name:`nonce`,in:`query`,required:!1,schema:{type:`string`},description:`OpenID Connect nonce`},{name:`max_age`,in:`query`,required:!1,schema:{type:`integer`,minimum:0},description:`Maximum authentication age in seconds; forces re-authentication when exceeded`},{name:`resource`,in:`query`,required:!1,schema:{type:`array`,items:{type:`string`}},description:`Requested protected resource(s) for the access token. May be supplied multiple times as repeated 'resource' query parameters (RFC 8707) or as an array of strings.`},{name:`prompt`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth2 prompt parameter`}],responses:{302:{description:`Redirect to client with code or error`,headers:{Location:{description:`Redirect URI with code or error`,schema:{type:`string`,format:`uri`}}}},400:{description:`Invalid request`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},state:{type:`string`}},required:[`error`]}}}}}}}},async e=>tb(e,o,e.authorizeSettings??{isAuthorize:!0})),d=(e,t)=>Ap(u,{...e,asResponse:!1,returnHeaders:!1,returnStatus:!1,authorizeSettings:t??{}});return{id:`oauth-provider`,version:ug,options:o,onRequest:s,init:async e=>{if(e.options.secondaryStorage&&e.options.session?.storeSessionInDatabase!==!0)throw new V("OAuth Provider requires `session.storeSessionInDatabase: true` when using secondaryStorage");if(await Ym(e,o).catch(t=>Gm(e,t)),Xm(o),!o.disableJwtPlugin){let t=pl(e)?.options,n=t?.jwt?.issuer??e.baseURL,r=t?.jwt?.issuer==null&&typeof e.options.baseURL==`object`&&e.options.baseURL!==null&&`allowedHosts`in e.options.baseURL;try{new URL(n)}catch(e){if(!r||n!==``)throw e}}return{options:{databaseHooks:{session:{delete:{async before(e,t){if(!t)return;let n=await Cg(t,o,{sessionId:e.id,userId:e.userId});if(!n)return;let r=Py.get(t)??new Map;r.set(e.id,n),Py.set(t,r)},async after(e,t){if(!t)return;let n=Py.get(t);if(!n)return;let r=n.get(e.id);if(n.delete(e.id),n.size===0&&Py.delete(t),!r)return;let i=wg(t,r).catch(e=>{t.context.logger.error(`Back-channel logout failed after session deletion`,e)});await t.context.runInBackgroundOrAwait(i)}}}}}}},hooks:{before:[{matcher(e){return e.body?.oauth_query},handler:du(async e=>{let t=e.body.oauth_query;if(!await bl(t,e.context.secret))throw new B(`BAD_REQUEST`,{error:`invalid_signature`});let n=ke(t),r=new URLSearchParams(t),i=r.get(`ba_pl`)??void 0;r.delete(`sig`),r.delete(`exp`),r.delete(we),r.delete(Te),await My.set({query:r.toString(),signedQueryIssuedAt:n??void 0,postLoginClearedForSession:i}),e.path===`/sign-in/social`&&await Sd({query:r.toString(),...n?{[Fy]:n.getTime()}:{}})})}],after:[{matcher(e){return Jd(e.context.responseHeaders?.get(`set-cookie`)||``).has(e.context.authCookies.sessionToken.name)},handler:du(async e=>{let t=Jd(e.context.responseHeaders?.get(`set-cookie`)||``).get(e.context.authCookies.sessionToken.name)?.value.split(`.`)[0];if(!t)return;let n=await My.get(),r=(await yd())?.serverContext,i=n?.query??r?.query;if(!i)return;let a=new URLSearchParams(i),o=await e.context.internalAdapter.findSession(t);if(!o)return;e.context.session=o;let s=e.request?.headers?.get(`sec-fetch-mode`)?.toLowerCase(),c=e.request?.headers?.get(`accept`)?.toLowerCase()??``;s===`navigate`||!s&&(c.includes(`text/html`)||c.includes(`application/xhtml+xml`))||e.headers?.set(`accept`,`application/json`);let l=n?.signedQueryIssuedAt??Iy(r?.[Fy]),u=Yl(a,`login`);return Jl(o.session.createdAt,l)&&(u=Xl(u)),e.query=ql(u),await d(e)})}]},endpoints:{getOAuthServerConfig:X(`/.well-known/oauth-authorization-server`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async e=>o.scopes&&o.scopes.includes(`openid`)?o_(e,o):a_(e,o)),getOpenIdConfig:X(`/.well-known/openid-configuration`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async e=>{if(o.scopes&&!o.scopes.includes(`openid`))throw new B(`NOT_FOUND`);return o_(e,o)}),oauth2Authorize:u,oauth2Consent:X(`/oauth2/consent`,{method:`POST`,body:w({accept:v().meta({description:`Accept or deny user consent for a set of scopes`}),scope:c().optional().meta({description:`List of accept of accepted space-separated scopes. If none is provided, then all originally requested scopes are accepted.`}),claims:$p.optional().meta({description:`Accepted OIDC claims request object. If none is provided, then all originally requested claims are accepted.`}),oauth_query:c().optional().meta({description:`The redirected page's query parameters`})}),use:[qf],metadata:{openapi:{description:`Handle OAuth2 consent`,responses:{200:{description:`Consent processed successfully`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`The URI to redirect to, either with an authorization code or an error`}},required:[`redirect_uri`]}}}}}}}},async e=>pg(e,o,d)),oauth2Continue:X(`/oauth2/continue`,{method:`POST`,body:w({selected:v().optional().meta({description:`Confirms an account has been selected and authorization can proceed.`}),created:v().optional().meta({description:`Confirms an account was registered`}),postLogin:v().optional().meta({description:`Confirms organization and/or team selection.`}),oauth_query:c().optional().meta({description:`The redirected page's query parameters`})}),use:[qf],metadata:{openapi:{description:`Continues OAuth2 authorization flow`,responses:{200:{description:`Consent processed successfully`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`The URI to redirect to, either with an authorization code or an error`}},required:[`redirect_uri`]}}}}}}}},async e=>mg(e,d)),oauth2Token:l_(`/oauth2/token`,{method:`POST`,cloneRequest:!0,body:w({grant_type:c().trim().min(1),client_id:c().optional(),client_secret:c().optional(),client_assertion:c().optional(),client_assertion_type:c().optional(),code:c().optional(),code_verifier:c().optional(),redirect_uri:Q.optional(),refresh_token:c().optional(),resource:a([fm,x(fm).min(1)]).optional(),scope:c().optional()}).passthrough(),errorCodesByField:{grant_type:{missing:`invalid_request`,invalid:`unsupported_grant_type`},resource:{invalid:`invalid_target`}},metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Obtain an OAuth2.1 access token`,parameters:[{name:`DPoP`,in:`header`,required:!1,schema:{type:`string`},description:`RFC 9449 DPoP proof JWT for issuing DPoP-bound tokens`}],requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{grant_type:{type:`string`,description:`OAuth2 grant type`},client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},code:{type:`string`,description:`Authorization code (for authorization_code grant)`},code_verifier:{type:`string`,description:`PKCE code verifier (for authorization_code grant)`},redirect_uri:{type:`string`,format:`uri`,description:`Redirect URI (for authorization_code grant)`},refresh_token:{type:`string`,description:`Refresh token (for refresh_token grant)`},resource:{oneOf:[{type:`string`,description:`Single resource (URL)`},{type:`array`,items:{type:`string`},description:`Multiple resources (URLs)`}],description:`Requested protected resource(s) for the access token`},scope:{type:`string`,description:`Requested scopes (for client_credentials grant)`}},required:[`grant_type`]}}}},responses:{200:{description:`Access token response`,content:{"application/json":{schema:{type:`object`,properties:{access_token:{type:`string`,description:`The access token issued by the authorization server`},token_type:{type:`string`,description:`The type of the token issued`,enum:[`Bearer`,`DPoP`]},expires_in:{type:`number`,description:`Lifetime in seconds of the access token`},refresh_token:{type:`string`,description:`Refresh token, if issued`},scope:{type:`string`,description:`Scopes granted by the access token`},id_token:{type:`string`,description:`ID Token (if OpenID Connect)`}},required:[`access_token`,`token_type`,`expires_in`]}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>{if(e.request){let t=await km(e.request);t&&t.length>1&&(e.body.resource=t)}return uh(e,o)}),oauth2Introspect:l_(`/oauth2/introspect`,{method:`POST`,cloneRequest:!0,body:w({client_id:c().optional(),client_secret:c().optional(),client_assertion:c().optional(),client_assertion_type:c().optional(),token:c(),token_type_hint:c().optional()}),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Introspect an OAuth2 access or refresh token`,requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},token:{type:`string`,description:`The token to introspect (access or refresh token)`},token_type_hint:{type:`string`,description:"Hint about the token type. Recognized values: `access_token`, `refresh_token`."}},required:[`token`]}}}},responses:{200:{description:`Token introspection response`,content:{"application/json":{schema:{type:`object`,properties:{active:{type:`boolean`,description:`Whether the token is active`},scope:{type:`string`,description:`Scopes associated with the token`},client_id:{type:`string`,description:`Client ID associated with the token`},username:{type:`string`,description:`Username associated with the token`},token_type:{type:`string`,description:`Type of the token`},exp:{type:`number`,description:`Expiration time of the token (seconds since epoch)`},iat:{type:`number`,description:`Issued at time (seconds since epoch)`},nbf:{type:`number`,description:`Not before time (seconds since epoch)`},sub:{type:`string`,description:`Subject of the token`},aud:{type:`string`,description:`Audience of the token`},iss:{type:`string`,description:`Issuer of the token`},jti:{type:`string`,description:`JWT ID`}},required:[`active`]}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>lg(e,o)),oauth2Revoke:l_(`/oauth2/revoke`,{method:`POST`,cloneRequest:!0,body:w({client_id:c().optional(),client_secret:c().optional(),client_assertion:c().optional(),client_assertion_type:c().optional(),token:c(),token_type_hint:c().optional()}),metadata:{allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Revoke an OAuth2 access or refresh token`,requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},token:{type:`string`,description:`The token to revoke (access or refresh token)`},token_type_hint:{type:`string`,description:"Hint about the token type. Recognized values: `access_token`, `refresh_token`."}},required:[`token`]}}}},responses:{200:{description:`Token revoked successfully. The response body is empty.`,content:{"application/json":{schema:{type:`object`,description:`Empty object on success`}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>Oy(e,o)),oauth2UserInfo:X(`/oauth2/userinfo`,{method:[`GET`,`POST`],body:w({access_token:c().optional()}).passthrough().optional(),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Get OpenID Connect user information (UserInfo endpoint)`,security:[{bearerAuth:[]},{OAuth2:[`openid`,`profile`,`email`]}],parameters:[{name:`Authorization`,in:`header`,required:!1,schema:{type:`string`},description:`Bearer or DPoP access token`},{name:`DPoP`,in:`header`,required:!1,schema:{type:`string`},description:`RFC 9449 DPoP proof JWT when using a DPoP-bound access token`}],responses:{200:{description:`User information retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{sub:{type:`string`,description:`Subject identifier (user ID)`},email:{type:`string`,format:`email`,nullable:!0,description:`User's email address, included if 'email' scope is granted`},name:{type:`string`,nullable:!0,description:`User's full name, included if 'profile' scope is granted`},picture:{type:`string`,format:`uri`,nullable:!0,description:`User's profile picture URL, included if 'profile' scope is granted`},given_name:{type:`string`,nullable:!0,description:`User's given name, included if 'profile' scope is granted`},family_name:{type:`string`,nullable:!0,description:`User's family name, included if 'profile' scope is granted`},email_verified:{type:`boolean`,nullable:!0,description:`Whether the email is verified, included if 'email' scope is granted`}},required:[`sub`]}}}},401:{description:`Unauthorized - invalid or missing access token`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`}},required:[`error`]}}}},403:{description:`Forbidden - insufficient scope`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`}},required:[`error`]}}}}}}}},async e=>oh(e,o)),oauth2EndSession:l_(`/oauth2/end-session`,{method:[`GET`,`POST`],body:jy.optional(),query:jy.optional(),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`,`application/json`],$Infer:{body:{},query:{}},openapi:{description:`RP-Initiated Logout endpoint. Accepts standard logout parameters through GET or an application/x-www-form-urlencoded POST body, plus JSON for Better Auth generated-client calls. Requests without a usable id_token_hint may require explicit OP confirmation.`,responses:{200:{description:`Logout completed, or an HTML confirmation page was returned for browser navigation. A redirect is used only for an exact registered post_logout_redirect_uri.`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`URI to redirect to after logout (if post_logout_redirect_uri was provided)`},message:{type:`string`,description:`Success message`}}}},"text/html":{schema:{type:`string`}}}}}}}},async e=>t_(e,o)),oauth2EndSessionConfirmation:l_(`/oauth2/end-session/confirm`,{method:`POST`,body:w({action:l(`confirm`)}),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],scope:`http`}},async e=>n_(e,o)),registerOAuthClient:l_(`/oauth2/register`,{method:`POST`,body:xm,errorCodesByField:{redirect_uris:`invalid_redirect_uri`,post_logout_redirect_uris:`invalid_redirect_uri`,software_statement:`invalid_software_statement`,resources:`invalid_target`},defaultError:`invalid_client_metadata`,metadata:{noStore:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`Name of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URL for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},post_logout_redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed logout redirect uris`},backchannel_logout_uri:{type:`string`,format:`uri`,description:`RP URL to receive signed Logout Tokens when the end-user's OP session terminates`},backchannel_logout_session_required:{type:`boolean`,description:"Whether the RP requires a `sid` claim in every Logout Token"},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final resource identifiers linked to the registered client`},disabled:{type:`boolean`,description:`Whether the client is disabled`}},required:[`client_id`]}}}}}}}},async e=>gv(e,o)),adminCreateOAuthClient:zv(o),createOAuthClient:Bv(o),getOAuthClient:Vv(o),getOAuthClientPublic:Hv(o),getOAuthClientPublicPrelogin:Uv(o),getOAuthClients:Wv(o),adminUpdateOAuthClient:Gv(o),updateOAuthClient:Kv(o),rotateClientSecret:qv(o),deleteOAuthClient:Jv(o),getOAuthConsent:ey(o),getOAuthConsents:ty(o),updateOAuthConsent:ny(o),deleteOAuthConsent:ry(o),adminCreateOAuthResource:_y(o),adminListOAuthResources:vy(o),adminGetOAuthResource:yy(o),adminUpdateOAuthResource:by(o),adminDeleteOAuthResource:xy(o),adminLinkClientResource:Sy(o),adminUnlinkClientResource:Cy(o)},schema:Ud(structuredClone(ky),o?.schema),rateLimit:[...o.rateLimit?.token===!1?[]:[{pathMatcher:e=>e===`/oauth2/token`,window:o.rateLimit?.token?.window??60,max:o.rateLimit?.token?.max??20}],...o.rateLimit?.authorize===!1?[]:[{pathMatcher:e=>e===`/oauth2/authorize`,window:o.rateLimit?.authorize?.window??60,max:o.rateLimit?.authorize?.max??30}],...o.rateLimit?.introspect===!1?[]:[{pathMatcher:e=>e===`/oauth2/introspect`,window:o.rateLimit?.introspect?.window??60,max:o.rateLimit?.introspect?.max??100}],...o.rateLimit?.revoke===!1?[]:[{pathMatcher:e=>e===`/oauth2/revoke`,window:o.rateLimit?.revoke?.window??60,max:o.rateLimit?.revoke?.max??30}],...o.rateLimit?.register===!1?[]:[{pathMatcher:e=>e===`/oauth2/register`,window:o.rateLimit?.register?.window??60,max:o.rateLimit?.register?.max??5}],...o.rateLimit?.userinfo===!1?[]:[{pathMatcher:e=>e===`/oauth2/userinfo`,window:o.rateLimit?.userinfo?.window??60,max:o.rateLimit?.userinfo?.max??60}]]}};function Ry(e,t,n){return t!==0&&n.getTime()-e.getTime()<=t*1e3}function zy(e){let{max_age:t,...n}=e;return n}function By(e,t,n,r,i,a=`query`){let o=new URLSearchParams({error:t,error_description:n});return r&&o.append(`state`,r),i&&o.append(`iss`,i),a===`fragment`?`${e}#${o.toString()}`:Bu(e,o)}function Vy(e){let t=typeof e.response_mode==`string`?e.response_mode:void 0;if(t===`fragment`)return`fragment`;if(t===`query`)return`query`;let n=typeof e.response_type==`string`?e.response_type:void 0;return n&&/\b(token|id_token)\b/.test(n)?`fragment`:`query`}var Hy={response_type:{invalid:`unsupported_response_type`},resource:{invalid:`invalid_target`}};function Uy(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function Wy(e){return typeof e==`string`?e:void 0}function Gy(e,t){let n=e.method===`POST`&&t?.isAuthorize===!0?e.body:e.query;return{...Uy(n)?n:{}}}var $=(e,t)=>{let n=dg(e.request?.headers),r=e.headers?.get(`accept`)?.includes(`application/json`);if(n||r)return{redirect:!0,url:t.toString()};throw e.redirect(t)};function Ky(e,t,n,r,i){return $(e,By(n.redirect_uri,r,i,n.state,Jy(e,t)))}function qy(e){try{let t=new URL(e);return t.protocol!==`https:`&&!bp(t.host)&&(t.protocol=`https:`),t.search=``,t.hash=``,t.toString().replace(/\/$/,``)}catch{return e}}function Jy(e,t){let n;if(t.disableJwtPlugin)n=e.context.baseURL;else try{n=pl(e.context).options?.jwt?.issuer??e.context.baseURL}catch{n=e.context.baseURL}return qy(n)}function Yy(e,t,n){return By(e.context.options.onAPIError?.errorURL||`${e.context.baseURL}/error`,t,n)}function Xy(e){let t;try{t=new URL(e)}catch{return}let n=yp(t.hostname)||t.hostname===`localhost`;if(t.protocol!==`http:`||!n)return;let r=e.indexOf(`://`);if(r<0)return;let i=r+3,a=e.slice(i).search(/[/?#]/u),o=e.length;a>=0&&(o=i+a);let s=e.slice(i,o),c;if(s.startsWith(`[`)){let t=s.indexOf(`]`);if(t<0)return;if(s[t+1]!==`:`)return e;c=t+1}else if(c=s.lastIndexOf(`:`),c<0)return e;let l=s.slice(c+1);if(!/^\d*$/u.test(l))return;let u=i+c;return`${e.slice(0,u)}${e.slice(o)}`}function Zy(e,t){if(!e||!t)return;let n;try{n=new URL(t)}catch{return}let r=t.includes(`#`),i=n.username.length>0||n.password.length>0;if(r||i)return;let a=Xy(t);return e.find(e=>e===t?!0:a?Xy(e)===a:!1)}function Qy(e){if(!Q.safeParse(e).success)return!1;let t=new URL(e);return t.username.length===0&&t.password.length===0}async function $y(e,t,n,r){if(!n||!r)return null;let i;try{i=await xl(e,t,n)}catch{return null}if(!i||i.disabled)return null;let a=i.redirectUris??[],o=Zy(a,r);if(t.validateRedirectUri){if(!Qy(r))return null;try{return await t.validateRedirectUri(r,a,!!o)?r:null}catch{return null}}return o?r:null}function eb(e){return async({error:t,error_description:n,ctx:r})=>{let i=r.query??{},a=await $y(r,e,typeof i.client_id==`string`?i.client_id:void 0,typeof i.redirect_uri==`string`?i.redirect_uri:void 0);return a?$(r,By(a,t,n,typeof i.state==`string`?i.state:void 0,Jy(r,e),Vy(i))):$(r,Yy(r,t,n))}}async function tb(e,t,n){if(t.grantTypes&&!t.grantTypes.includes(`authorization_code`))throw new z(`NOT_FOUND`);if(!e.request)throw new z(`UNAUTHORIZED`,{error_description:`request not found`,error:`invalid_request`});let r=e.request,i=Gy(e,n);e.query=i;let a=Wy(i.request),o=Wy(i.request_uri);if(a!==void 0&&o!==void 0)return eb(t)({error:`invalid_request`,error_description:`request and request_uri cannot be used together`,ctx:e});if(a!==void 0)return eb(t)({error:`request_not_supported`,error_description:`request object not supported`,ctx:e});if(o!==void 0){let n=Wy(i.client_id);if(!n)return eb(t)({error:`invalid_request`,error_description:`client_id is required`,ctx:e});if(!t.requestUriResolver)return eb(t)({error:`request_uri_not_supported`,error_description:`request_uri not supported`,ctx:e});let r=await t.requestUriResolver({requestUri:o,clientId:n,ctx:e});if(!r)return eb(t)({error:`invalid_request_uri`,error_description:`request_uri is invalid or expired`,ctx:e});let a=i.client_id;i=r,a&&(i.client_id=a)}e.query=i;let s=vm.safeParse(i);if(!s.success){let n=u_(s.error.issues,Hy);return eb(t)({...n,ctx:e})}if(i=s.data,e.query=i,await My.set({query:nb(i).toString()}),!i.response_type)return eb(t)({error:`invalid_request`,error_description:`response_type is required`,ctx:e});let c=e.query?.prompt?Ul(e.query?.prompt):void 0,l=c?.has(`none`)??!1;if(c?.has(`select_account`)&&!t.selectAccount?.page)return $(e,Yy(e,`unsupported_prompt_select_account`,`unsupported prompt type`));if(i.response_type!==`code`)return $(e,Yy(e,`unsupported_response_type`,`unsupported response type`));let u=await xl(e,t,i.client_id);if(!u)return $(e,Yy(e,`invalid_client`,`client_id is required`));if(u.disabled)return $(e,Yy(e,`client_disabled`,`client is disabled`));if(!Il(u,`authorization_code`))return $(e,Yy(e,`unauthorized_client`,`client is not authorized to use the authorization_code grant`));let d=u.redirectUris??[],f=!1;if(i.redirect_uri){let e=!!Zy(d,i.redirect_uri);if(t.validateRedirectUri&&Qy(i.redirect_uri))try{f=await t.validateRedirectUri(i.redirect_uri,d,e)}catch{f=!1}else t.validateRedirectUri||(f=e)}if(!f)return $(e,Yy(e,`invalid_redirect`,`invalid redirect uri`));let p=i.scope?.split(` `).filter(e=>e);if(p){let n=new Set(u.scopes??t.scopes),r=p.filter(e=>!n?.has(e));if(r.length)return $(e,By(i.redirect_uri,`invalid_scope`,`The following scopes are invalid: ${r.join(`, `)}`,i.state,Jy(e,t)))}p||(p=u.scopes??t.scopes??[],i.scope=p.join(` `));let m=p.includes(`openid`);if(i.claims!==void 0&&!m)return $(e,By(i.redirect_uri,`invalid_request`,`openid scope must be requested when using the claims parameter`,i.state,Jy(e,t)));if(m&&!em(i.claims))return $(e,By(i.redirect_uri,`invalid_request`,`claims must be a valid Claims request object`,i.state,Jy(e,t)));if(m&&!nm(i.claims,`0`))return $(e,By(i.redirect_uri,`access_denied`,`essential acr requirement cannot be met`,i.state,Jy(e,t)));let h=tm(i.claims,sm(t));if(i.resource!==void 0)try{await Mm(e,t,{resource:i.resource,clientId:u.clientId,requestedScopes:p})}catch(n){if(n instanceof z){let r=n.body?.error??`invalid_target`,a=n.body?.error_description??`requested resource invalid`;return $(e,By(i.redirect_uri,r,a,i.state,Jy(e,t)))}throw n}let g=Zl(u,{scopes:p,nonce:i.nonce});if(g&&(!i.code_challenge||!i.code_challenge_method))return $(e,By(i.redirect_uri,`invalid_request`,g.valueOf(),i.state,Jy(e,t)));if(i.code_challenge||i.code_challenge_method){if(!i.code_challenge||!i.code_challenge_method)return $(e,By(i.redirect_uri,`invalid_request`,`code_challenge and code_challenge_method must both be provided`,i.state,Jy(e,t)));if(![`S256`].includes(i.code_challenge_method))return $(e,By(i.redirect_uri,`invalid_request`,`invalid code_challenge method, only S256 is supported`,i.state,Jy(e,t)))}let _=gl(i.resource)??[],v=await Z(e),y=i.max_age,b=v!=null&&y!==void 0&&Ry(new Date(v.session.createdAt),y,new Date);if(!v||v!=null&&y!==void 0&&!b||c?.has(`login`)||c?.has(`create`))return l?Ky(e,t,i,`login_required`,`authentication required`):ib(e,t,c?.has(`create`)?`create`:`login`);if(b&&(i=zy(i),e.query=i),n?.isAuthorize&&c?.has(`select_account`))return ib(e,t,`select_account`);if(n?.isAuthorize&&t.selectAccount&&await t.selectAccount.shouldRedirect({headers:r.headers,user:v.user,session:v.session,scopes:p}))return l?Ky(e,t,i,`account_selection_required`,`End-User account selection is required`):ib(e,t,`select_account`);if(t.signup?.shouldRedirect){let n=await t.signup.shouldRedirect({headers:r.headers,user:v.user,session:v.session,scopes:p});if(n)return l?Ky(e,t,i,`interaction_required`,`End-User interaction is required`):ib(e,t,`create`,{page:typeof n==`string`?n:void 0})}if(!n?.postLogin&&t.postLogin&&await t.postLogin.shouldRedirect({headers:r.headers,user:v.user,session:v.session,scopes:p}))return l?Ky(e,t,i,`interaction_required`,`End-User interaction is required`):ib(e,t,`post_login`);if(c?.has(`consent`))return ib(e,t,`consent`,{sessionId:v.session.id});let x=await t.postLogin?.consentReferenceId?.({user:v.user,session:v.session,scopes:p});if(u.skipConsent)return rb(e,t,{query:i,clientId:u.clientId,userId:v.user.id,sessionId:v.session.id,authTime:new Date(v.session.createdAt).getTime(),referenceId:x,resource:_});let S=await e.context.adapter.findOne({model:`oauthConsent`,where:[{field:`clientId`,value:u.clientId},{field:`userId`,value:v.user.id},...x?[{field:`referenceId`,value:x}]:[]]});if(!S||!p.every(e=>S.scopes.includes(e))||!h.every(e=>(S.requestedUserInfoClaims??[]).includes(e)))return l?Ky(e,t,i,`consent_required`,`End-User consent is required`):ib(e,t,`consent`,{sessionId:v.session.id});let C=S?.resources??[];return _.some(e=>!C.includes(e))?l?Ky(e,t,i,`consent_required`,`End-User consent is required`):ib(e,t,`consent`,{sessionId:v.session.id}):rb(e,t,{query:i,clientId:u.clientId,userId:v.user.id,sessionId:v.session.id,authTime:new Date(v.session.createdAt).getTime(),referenceId:x,resource:_})}function nb(e){let t=new URLSearchParams;for(let[n,r]of Object.entries(e))if(r!=null){if(Array.isArray(r))for(let e of r)t.append(n,String(e));else n===`claims`&&typeof r==`object`?t.set(n,JSON.stringify(r)):t.set(n,String(r))}return t}async function rb(e,t,n){let r=Fi(32,`a-z`,`A-Z`,`0-9`),i=Math.floor(Date.now()/1e3),a=i+(t.codeExpiresIn??600),o={identifier:await Dl(t.storeTokens,r,`authorization_code`),updatedAt:new Date(i*1e3),expiresAt:new Date(a*1e3),value:JSON.stringify({type:`authorization_code`,query:n.query,userId:n.userId,sessionId:n?.sessionId,referenceId:n.referenceId,authTime:n.authTime,resource:n.resource})};await e.context.internalAdapter.createVerificationValue({...o,createdAt:new Date(i*1e3)});let s=new URL(n.query.redirect_uri);return s.searchParams.set(`code`,r),n.query.state&&s.searchParams.set(`state`,n.query.state),s.searchParams.set(`iss`,Jy(e,t)),$(e,s.toString())}async function ib(e,t,n,r){let i=await ab(e,t,{postLoginClearedForSession:n===`consent`&&t.postLogin?r?.sessionId:void 0}),a=t.loginPage;if(n===`select_account`)a=t.selectAccount?.page??t.loginPage;else if(n===`post_login`){if(!t.postLogin?.page)throw new z(`INTERNAL_SERVER_ERROR`,{error_description:`postLogin should have been defined`});a=t.postLogin?.page}else n===`consent`?a=t.consentPage:n===`create`&&(a=t.signup?.page??t.loginPage);return $(e,`${r?.page??a}?${i}`)}async function ab(e,t,n){let r=Date.now(),i=Math.floor(r/1e3)+(t.codeExpiresIn??600),a=nb(e.query);a.set(`exp`,String(i)),a.set(we,String(r)),a.delete(`sig`),a.delete(Te),n?.postLoginClearedForSession&&a.set(Te,n.postLoginClearedForSession),Oe(a);let o=await Ga(De(a).toString(),e.context.secret);return a.set(`sig`,o),a.toString()}export{Vd as $,Ua as $t,Xf as A,au as At,Lf as B,ic as Bt,op as C,ju as Ct,Wf as D,X as Dt,Yf as E,yu as Et,qf as F,Pl as Ft,pf as G,us as Gt,kf as H,vs as Ht,Ff as I,_l as It,Fd as J,cs as Jt,ff as K,ss as Kt,Uf as L,gl as Lt,Zf as M,Xc as Mt,Qf as N,xl as Nt,Z as O,du as Ot,Jf as P,fl as Pt,Bd as Q,rs as Qt,Hf as R,Ll as Rt,xp as S,be as Sn,ku as St,tp as T,Lu as Tt,Tf as U,hs as Ut,zf as V,$s as Vt,hf as W,ms as Wt,Ud as X,as as Xt,Hd as Y,os as Yt,Ld as Z,is as Zt,Fp as _,ct as _n,Bu as _t,w_ as a,yi as an,wd as at,wp as b,qe as bn,Au as bt,dh as c,gi as cn,pd as ct,Hp as d,Vr as dn,hd as dt,Ha as en,Id as et,Bp as f,br as fn,cd as ft,Ip as g,_t as gn,ad as gt,Lp as h,ht as hn,td as ht,Ev as i,Si as in,Dd as it,$f as j,Ql as jt,Gf as k,ou as kt,Sm as l,hi as ln,gd as lt,zp as m,st as mn,od as mt,k_ as n,Fi as nn,Pd as nt,fm as o,vi as on,bd as ot,Vp as p,Ct as pn,ud as pt,Wd as q,ls as qt,Ly as r,Pi as rn,Td as rt,km as s,_i as sn,vd as st,Ny as t,Li as tn,zd as tt,Mm as u,Kr as un,md as ut,Np as v,lt as vn,Ru as vt,np as w,Mu as wt,bp as x,Fe as xn,Ou as xt,Ap as y,ft as yn,Du as yt,If as z,bl as zt};
-//# sourceMappingURL=authorize-C95F-9E1-b9zG-W8w.js.map
+</html>`,jo=(()=>{let e=function(){};return e.prototype=Object.create(null),Object.freeze(e.prototype),e})();function Mo(){return{root:{key:``},static:new jo}}function No(e){let t=0,n=0;for(;t<e.length;t++){let r=e.charCodeAt(t);if(r===92)t++;else if(r===40)n++;else if(r===41&&n>0)n--;else if(r===123&&n===0)break}if(t>=e.length)return;let r=t+1;for(n=0;r<e.length;r++){let t=e.charCodeAt(r);if(t===92)r++;else if(t===40)n++;else if(t===41&&n>0)n--;else if(t===125&&n===0)break}if(r>=e.length)return;let i=e[r+1],a=i===`?`||i===`+`||i===`*`;return[e.slice(0,t),e.slice(t+1,r),e.slice(r+(a?2:1)),a?i:void 0]}function Po(e){if(!e.includes(`{`))return;let t=No(e);if(!t)return;let[n,r,i,a]=t;if(!a)return[n+r+i];if(a===`?`)return[n+r+i,n+i];if(r.includes(`/`))throw Error(`unsupported group repetition across segments`);return[`${n}(?:${r})${a}${i}`]}var Fo=`__rou3_unnamed_`,Io=`__rou3_esc_`;function Lo(e){return`${Fo}${e}`}function Ro(e){return/^(?!__rou3_|_\d)[A-Za-z_]\w*$/.test(e)?e:Io+e.replace(/[_-]/g,e=>e===`_`?`__`:`_h`)}function zo(e){return e.charCodeAt(0)===95?e.startsWith(`__rou3_esc_`)?e.slice(11).replace(/__|_h/g,e=>e===`__`?`_`:`-`):e.startsWith(`__rou3_unnamed_`)?e.slice(15):e:e}function Bo(e){let t=0;for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);if(r===92)n++;else if(r===40)t++;else if(r===41&&t>0)t--;else if(r===42&&t===0)return!0}return!1}function Vo(e,t,n=Lo){let r=0,i=t,a=``;for(let t=0;t<e.length;t++){let o=e.charCodeAt(t);o===92?(a+=e[t],t+1<e.length&&(a+=e[++t])):o===40?(r++,a+=e[t]):o===41&&r>0?(r--,a+=e[t]):a+=o===42&&r===0?`(?<${n(i++)}>[^/]*)`:e[t]}return[a,i]}function Ho(e){return e.includes(`\\`)?e.replace(/\\([:(){}])/g,(e,t)=>`�`+`ABCDE`[`:(){}`.indexOf(t)]):e}function Uo(e){return e.startsWith(`**`)?2:e===`*`||e.includes(`:`)||e.includes(`(`)||Bo(e)?1:e===`\\*`?`*`:e===`\\*\\*`?`**`:e.includes(`�`)?e.replace(/\uFFFD([A-E])/g,(e,t)=>t===`A`?`:`:t===`B`?`(`:t===`C`?`)`:t===`D`?`{`:`}`):e}function Wo(e){for(let t=0;t<e.length;t++){let n=e[t].charCodeAt(e[t].length-1);if(n!==63&&n!==43&&n!==42)continue;let r=e[t].match(/^(.*:[\w-]+(?:\([^)]*\))?)([?+*])$/);if(!r)continue;let i=e.slice(0,t),a=e.slice(t+1);if(r[2]===`?`)return[`/`+i.concat(r[1]).concat(a).join(`/`),`/`+i.concat(a).join(`/`)];let o=r[1].match(/:([\w-]+)/)?.[1]||`_`,s=`/`+[...i,`**:${o}`,...a].join(`/`),c=`/`+[...i,...a].join(`/`);return r[2]===`+`?[s]:[s,c]}}function Go(e){if(!e.includes(`/.`))return e;let t=[];for(let n of e.split(`/`))if(n===`.`)continue;else n===`..`&&t.length>1?t.pop():t.push(n);return t.join(`/`)||`/`}function Ko(e){let t=e.split(`/`);return t.shift(),t[t.length-1]===``&&t.pop(),t}function qo(e){let t=Ko(e);for(;t[t.length-1]===``;)t.pop();return t}function Jo(e,t){let n=new jo;for(let[r,i]of t){let t=r<0?e.slice(-(r+1)).join(`/`):e[r];if(typeof i==`string`)n[i]=t;else{let e=t.match(i);if(e)for(let t in e.groups)n[zo(t)]=e.groups[t]}}return n}function Yo(e,t=``,n,r){t=t.toUpperCase(),n.charCodeAt(0)!==47&&(n=`/${n}`);let i=Po(n);if(i){for(let n of i)Yo(e,t,n,r);return}n=Ho(n);let a=qo(n),o=Wo(a);if(o){for(let n of o)Yo(e,t,n,r);return}let s=e.root,c=0,l=[],u=[];for(let e=0;e<a.length;e++){let t=a[e],n=Uo(t);if(n===2){s.wildcard||(s.wildcard={key:`**`}),s=s.wildcard,l.push([-(e+1),t.split(`:`)[1]||`_`,t.length===2]);break}if(n===1){if(s.param||(s.param={key:`*`}),s=s.param,t===`*`)l.push([e,String(c++),!0]);else if(t.includes(`(`)||t.includes(`:`,1)||!/^:[\w-]+$/.test(t)){let[n,r]=Xo(t,c);c=r,u[e]=n,s.hasRegexParam=!0,l.push([e,n,!1])}else l.push([e,t.slice(1),!1]);continue}t=a[e]=n;let r=s.static?.[t];if(r)s=r;else{let e={key:t};s.static||(s.static=new jo),s.static[t]=e,s=e}}let d=l.length>0,f=s.methods??=new jo;(f[t]??=[]).push({data:r||null,paramsRegexp:u,paramsMap:d?l:void 0}),d||(e.static[`/`+a.join(`/`)]=s)}function Xo(e,t=0){let n=t,r=``,i=0;for(let t=0;t<e.length;t++){let n=e.charCodeAt(t);if(n===40)i++;else if(n===41&&i>0)i--;else if(n===92&&i===0&&t+1<e.length){let n=e[t+1];if(n!==`:`&&n!==`(`&&n!==`*`&&n!==`\\`){r+=`￾`+n,t++;continue}}else if(n===46&&i===0){r+=`\\.`;continue}r+=e[t]}[r,n]=Vo(r,n);let a=r.replace(/:([\w-]+)(?:\(([^)]*)\))?/g,(e,t,n)=>`(?<${Ro(t)}>${n||`[^/]+`})`).replace(/\((?![?<])/g,()=>`(?<${Lo(n++)}>`).replace(/\uFFFE(.)/g,(e,t)=>/[.*+?^${}()|[\]\\]/.test(t)?`\\${t}`:t);return[RegExp(`^${a}$`),n]}function Zo(e,t=``,n,r){r?.normalize&&(n=Go(n)),n.charCodeAt(n.length-1)===47&&(n=n.slice(0,-1));let i=e.static[n];if(i&&i.methods){let e=i.methods[t]||i.methods[``];if(e!==void 0)return e[0]}let a=Ko(n),o=Qo(e.root,t,a,0);if(o!==void 0)return r?.params===!1?o:{data:o.data,params:o.paramsMap?Jo(a,o.paramsMap):void 0}}function Qo(e,t,n,r){if(r===n.length){if(e.methods){let r=$o(e.methods,t,n,e.key===`*`,!1);if(r)return r}return e.param?.methods&&$o(e.param.methods,t,n,!0,!0)||e.wildcard?.methods&&$o(e.wildcard.methods,t,n,!0,!0)||void 0}let i=n[r];if(e.static){let a=e.static[i];if(a){let e=Qo(a,t,n,r+1);if(e)return e}}if(e.param){let i=Qo(e.param,t,n,r+1);if(i)return i}if(e.wildcard&&e.wildcard.methods)return $o(e.wildcard.methods,t,n,!0,!1)}function $o(e,t,n,r,i){let a=e[t]||e[``];if(!a)return;let o=a[0];if(a.length===1&&o.paramsRegexp.length===0){if(!i)return o;let e=o.paramsMap;return e?.[e.length-1]?.[2]?o:void 0}let s,c=-1;for(let e of a){let t=e.paramsMap,a=t?.[t.length-1]?.[2];if(i&&!a)continue;let o=r&&t&&!a?1:0,l=e.paramsRegexp;for(let e=0;e<l.length;e++)if(l[e]){if(!l[e].test(n[e])){o=-1;break}o++}o>c&&(s=e,c=o)}return s}function es(e,t=``,n,r){r?.normalize&&(n=Go(n)),n.charCodeAt(n.length-1)===47&&(n=n.slice(0,-1));let i=Ko(n),a=ts(e.root,t,i,0);return r?.params===!1?a:a.map(e=>({data:e.data,params:e.paramsMap?Jo(i,e.paramsMap):void 0}))}function ts(e,t,n,r,i=[]){let a=n[r];if(e.wildcard&&e.wildcard.methods){let a=e.wildcard.methods[t]||e.wildcard.methods[``];if(a){if(r<n.length)ns(i,a,!0);else{let e=[];for(let t of a){let n=t.paramsMap;n?.[n.length-1]?.[2]&&e.push(t)}ns(i,e,!0)}}}if(e.param){if(r<n.length){let o=i.length;if(ts(e.param,t,n,r+1,i),e.param.hasRegexParam)for(let e=i.length-1;e>=o;e--)i[e].paramsRegexp[r]?.test(a)===!1&&i.splice(e,1)}else if(e.param.methods){let n=e.param.methods[t]||e.param.methods[``];if(n){let e=[];for(let t of n){let n=t.paramsMap;n?.[n.length-1]?.[2]&&e.push(t)}ns(i,e,!0)}}}if(r<n.length){let o=e.static?.[a];o&&ts(o,t,n,r+1,i)}if(r===n.length&&e.methods){let n=e.methods[t]||e.methods[``];n&&ns(i,n,e.key===`*`)}return i}function ns(e,t,n){t.length>1&&(t=t.map(e=>{let t=0,{paramsRegexp:r,paramsMap:i}=e;for(let e=0;e<r.length;e++)r[e]&&t++;return n&&i&&!i[i.length-1][2]&&t++,[e,t]}).sort((e,t)=>e[1]-t[1]).map(e=>e[0]));for(let n of t)e.push(n)}var rs=(e,t)=>{if(!t?.openapi?.disabled){let n={path:`/api/reference`,...t?.openapi};e.openapi=xo(n.path,{method:`GET`},async t=>{let r=await ko(e);return new Response(Ao(r,n.scalar),{headers:{"Content-Type":`text/html`}})})}let n=Mo(),r=Mo();for(let t of Object.values(e)){if(!t.options||!t.path||t.options?.metadata?.SERVER_ONLY)continue;let e=Array.isArray(t.options?.method)?t.options.method:[t.options?.method];for(let r of e)Yo(n,r,t.path,t)}if(t?.routerMiddleware?.length)for(let{path:e,middleware:n}of t.routerMiddleware)Yo(r,`*`,e,n);let i=t?.basePath&&t.basePath!==`/`?t.basePath.replace(/\/+$/,``):``,a=async e=>{let a=new URL(e.url),o=a.pathname,s;if(i){if(!o.startsWith(`${i}/`))return new Response(null,{status:404,statusText:`Not Found`});s=o.slice(i.length)}else s=o;if(s.length===0||/\/{2,}/.test(s))return new Response(null,{status:404,statusText:`Not Found`});let c=Zo(n,e.method,s);if(s.endsWith(`/`)!==c?.data?.path?.endsWith(`/`)&&!t?.skipTrailingSlashes||!c?.data)return new Response(null,{status:404,statusText:`Not Found`});let l={};a.searchParams.forEach((e,t)=>{t in l?Array.isArray(l[t])?l[t].push(e):l[t]=[l[t],e]:l[t]=e});let u=c.data;try{let n=u.options.metadata?.allowedMediaTypes||t?.allowedMediaTypes,i={path:s,method:e.method,headers:e.headers,params:c.params?{...c.params}:{},request:e,body:u.options.disableBody?void 0:await Qa(u.options.cloneRequest?e.clone():e,n),query:l,_flag:`router`,asResponse:!0,context:t?.routerContext},a=es(r,`*`,s);if(a?.length)for(let{data:e,params:t}of a){let n=await e({...i,params:t?{...t}:{},asResponse:!1});if(n instanceof Response)return n}return await u(i)}catch(n){if(t?.onError)try{let r=await t.onError(n,e);if(r instanceof Response)return bo(r)}catch(e){if($a(e))return bo(e);throw e}if(t?.throwError)throw n;return $a(n)?bo(n):(console.error(`# SERVER_ERROR: `,n),new Response(null,{status:500,statusText:`Internal Server Error`}))}};return{handler:async e=>{let n=await t?.onRequest?.(e);if(n instanceof Response)return n;let r=no(n)?n:e,i=await a(r),o=await t?.onResponse?.(i,r);return o instanceof Response?o:i},endpoints:e}};function is(e){return Object.fromEntries(Object.entries(e).map(([e,t])=>[e,{code:e,message:t,toString:()=>e}]))}var as=is({USER_NOT_FOUND:`User not found`,FAILED_TO_CREATE_USER:`Failed to create user`,FAILED_TO_CREATE_SESSION:`Failed to create session`,FAILED_TO_UPDATE_USER:`Failed to update user`,FAILED_TO_GET_SESSION:`Failed to get session`,INVALID_PASSWORD:`Invalid password`,INVALID_EMAIL:`Invalid email`,INVALID_EMAIL_OR_PASSWORD:`Invalid email or password`,INVALID_USER:`Invalid user`,SOCIAL_ACCOUNT_ALREADY_LINKED:`Social account already linked`,PROVIDER_NOT_FOUND:`Provider not found`,INVALID_TOKEN:`Invalid token`,TOKEN_EXPIRED:`Token expired`,ID_TOKEN_NOT_SUPPORTED:`id_token not supported`,FAILED_TO_GET_USER_INFO:`Failed to get user info`,USER_EMAIL_NOT_FOUND:`User email not found`,EMAIL_NOT_VERIFIED:`Email not verified`,PASSWORD_TOO_SHORT:`Password too short`,PASSWORD_TOO_LONG:`Password too long`,USER_ALREADY_EXISTS:`User already exists.`,USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL:`User already exists. Use another email.`,EMAIL_CAN_NOT_BE_UPDATED:`Email can not be updated`,CHANGE_EMAIL_DISABLED:`Change email is disabled`,CREDENTIAL_ACCOUNT_NOT_FOUND:`Credential account not found`,SESSION_EXPIRED:`Session expired. Re-authenticate to perform this action.`,FAILED_TO_UNLINK_LAST_ACCOUNT:`You can't unlink your last account`,ACCOUNT_NOT_FOUND:`Account not found`,USER_ALREADY_HAS_PASSWORD:`User already has a password. Provide that to delete the account.`,CROSS_SITE_NAVIGATION_LOGIN_BLOCKED:`Cross-site navigation login blocked. This request appears to be a CSRF attack.`,VERIFICATION_EMAIL_NOT_ENABLED:`Verification email isn't enabled`,EMAIL_ALREADY_VERIFIED:`Email is already verified`,EMAIL_MISMATCH:`Email mismatch`,SESSION_NOT_FRESH:`Session is not fresh`,LINKED_ACCOUNT_ALREADY_EXISTS:`Linked account already exists`,INVALID_ORIGIN:`Invalid origin`,INVALID_CALLBACK_URL:`Invalid callbackURL`,INVALID_REDIRECT_URL:`Invalid redirectURL`,INVALID_ERROR_CALLBACK_URL:`Invalid errorCallbackURL`,INVALID_NEW_USER_CALLBACK_URL:`Invalid newUserCallbackURL`,MISSING_OR_NULL_ORIGIN:`Missing or null Origin`,CALLBACK_URL_REQUIRED:`callbackURL is required`,FAILED_TO_CREATE_VERIFICATION:`Unable to create verification`,FIELD_NOT_ALLOWED:`Field not allowed to be set`,ASYNC_VALIDATION_NOT_SUPPORTED:`Async validation is not supported`,VALIDATION_ERROR:`Validation Error`,MISSING_FIELD:`Field is required`,METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED:`POST method requires deferSessionRefresh to be enabled in session config`,BODY_MUST_BE_AN_OBJECT:`Body must be an object`,PASSWORD_ALREADY_SET:`User already has a password set`});function os(e){return Array.isArray(e)?e.map(e=>typeof e==`string`?e.trim():``).filter(Boolean):typeof e==`string`?e.trim().split(/\s+/).filter(Boolean):[]}function ss(e){let t=e=>new Date(new Date().getTime()+e*1e3);return{tokenType:e.token_type,accessToken:e.access_token,refreshToken:e.refresh_token,accessTokenExpiresAt:e.expires_in?t(e.expires_in):void 0,refreshTokenExpiresAt:e.refresh_token_expires_in?t(e.refresh_token_expires_in):void 0,scopes:os(e.scope),idToken:e.id_token,raw:e}}function cs(e,t){let n=e?e.split(`,`).map(e=>e.trim()).filter(Boolean):[],r=(t??[]).map(e=>e.trim()).filter(Boolean);return[...new Set([...n,...r])].join(`,`)}function ls(e){let t=Array.isArray(e)?e[0]:e;return typeof t==`string`&&t.length>0?t:void 0}async function us(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest(`SHA-256`,t);return ve.encode(new Uint8Array(n),{padding:!1})}var ds=/^Basic +(.*)$/i;function fs(e){return new URLSearchParams({v:e}).toString().slice(2)}function ps(e){let t=new URLSearchParams(`v=${e}`).get(`v`);if(t===null)throw Error(`form-url-encoded value could not be decoded`);return t}function ms(e,t){let n=`${fs(e)}:${fs(t)}`;return`Basic ${te.encode(n)}`}function hs(e){let t=e.match(ds);if(!t)throw Error(`Authorization header is not a Basic credential`);let n=t[1]??``,r=new TextDecoder().decode(te.decode(n)),i=r.indexOf(`:`);if(i===-1)throw Error(`Basic credential is missing the client id/secret separator`);let a=r.slice(0,i),o=r.slice(i+1);if(!a||!o)throw Error(`Basic credential client id and secret must both be non-empty`);return{clientId:ps(a),clientSecret:ps(o)}}var gs=[`RS256`,`RS384`,`RS512`,`PS256`,`PS384`,`PS512`,`ES256`,`ES384`,`ES512`,`EdDSA`],_s=`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`;async function vs({getClientAssertion:e,context:t}){return{client_assertion:await e(t),client_assertion_type:_s}}var ys=class extends Error{constructor(e,t,n){super(t||e.toString(),{cause:n}),this.status=e,this.statusText=t,this.error=n,Error.captureStackTrace(this,this.constructor)}},bs=async(e,t)=>{let n=t||{},r={onRequest:[t?.onRequest],onResponse:[t?.onResponse],onSuccess:[t?.onSuccess],onError:[t?.onError],onRetry:[t?.onRetry]};if(!t||!t?.plugins)return{url:e,options:n,hooks:r};for(let i of t?.plugins||[]){if(i.init){let t=await i.init?.call(i,e.toString(),n);n=t.options||n,e=t.url}r.onRequest.push(i.hooks?.onRequest),r.onResponse.push(i.hooks?.onResponse),r.onSuccess.push(i.hooks?.onSuccess),r.onError.push(i.hooks?.onError),r.onRetry.push(i.hooks?.onRetry)}return{url:e,options:n,hooks:r}},xs=class{constructor(e){this.options=e}shouldAttemptRetry(e,t){return this.options.shouldRetry?Promise.resolve(e<this.options.attempts&&this.options.shouldRetry(t)):Promise.resolve(e<this.options.attempts)}getDelay(){return this.options.delay}},Ss=class{constructor(e){this.options=e}shouldAttemptRetry(e,t){return this.options.shouldRetry?Promise.resolve(e<this.options.attempts&&this.options.shouldRetry(t)):Promise.resolve(e<this.options.attempts)}getDelay(e){return Math.min(this.options.maxDelay,this.options.baseDelay*2**e)}};function Cs(e){if(typeof e==`number`)return new xs({type:`linear`,attempts:e,delay:1e3});switch(e.type){case`linear`:return new xs(e);case`exponential`:return new Ss(e);default:throw Error(`Invalid retry strategy`)}}var ws=[`get`,`post`,`put`,`patch`,`delete`];function Ts(e){if(!e.startsWith(`@`))return{method:void 0,path:e};let t=e.indexOf(`/`),n=e.slice(1,t===-1?void 0:t);return ws.includes(n)?{method:n,path:t===-1?e:e.slice(t+1)}:{method:void 0,path:e}}var Es=e=>e===`.`||e===`..`,Ds=e=>e.split(`:`).map(e=>encodeURIComponent(e)).join(`:`);function Os(e,t){let n=t.get(e);if(n===void 0)return Ds(e);if(Es(n))throw TypeError(`Path parameters cannot be reserved path segments`);return encodeURIComponent(n)}function ks(e,t){let{baseURL:n,params:r,query:i}=t||{query:{},params:{},baseURL:``},a=e.startsWith(`http`)?e.split(`/`).slice(0,3).join(`/`):n||``,{path:o}=Ts(e);o!==e&&(e=`/${o}`),a.endsWith(`/`)||(a+=`/`);let[s,c]=e.replace(a,``).split(`?`),l=new URLSearchParams(c);for(let[e,t]of Object.entries(i||{})){if(t==null)continue;let n;if(typeof t==`string`)n=t;else if(Array.isArray(t)){for(let n of t)l.append(e,n);continue}else n=JSON.stringify(t);l.set(e,n)}let u=new Map;if(r){if(Array.isArray(r)){let e=s.split(`/`).filter(e=>e.startsWith(`:`));for(let[t,n]of e.entries()){let e=r[t];u.set(n,String(e))}}else for(let[e,t]of Object.entries(r))u.set(`:${e}`,String(t))}s=s.split(`/`).map(e=>Os(e,u)).join(`/`),s=s.replace(/^\/+/,``);let d=l.toString();return d=d.length>0?`?${d}`.replace(/\+/g,`%20`):``,a.startsWith(`http`)?new URL(`${s}${d}`,a):`${a}${s}${d}`}var As=async e=>{let t={},n=async e=>typeof e==`function`?await e():e;if(e?.auth){if(e.auth.type===`Bearer`){let r=await n(e.auth.token);if(!r)return t;t.authorization=`Bearer ${r}`}else if(e.auth.type===`Basic`){let[r,i]=await Promise.all([n(e.auth.username),n(e.auth.password)]);if(!r||!i)return t;t.authorization=`Basic ${btoa(`${r}:${i}`)}`}else if(e.auth.type===`Custom`){let[r,i]=await Promise.all([n(e.auth.prefix),n(e.auth.value)]);if(!i)return t;t.authorization=`${r??``} ${i}`}}return t},js=/^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;function Ms(e){let t=e.headers.get(`content-type`),n=new Set([`image/svg`,`application/xml`,`application/xhtml`,`application/html`]);if(!t)return`json`;let r=t.split(`;`).shift()||``;return js.test(r)?`json`:n.has(r)||r.startsWith(`text/`)?`text`:`blob`}function Ns(e){try{return JSON.parse(e),!0}catch{return!1}}function Ps(e){if(e===void 0)return!1;let t=typeof e;return t===`string`||t===`number`||t===`boolean`||t===null?!0:t===`object`?Array.isArray(e)?!0:e.buffer?!1:e.constructor&&e.constructor.name===`Object`||typeof e.toJSON==`function`:!1}function Fs(e){try{return JSON.parse(e)}catch{return e}}function Is(e){return typeof e==`function`}function Ls(e){if(e?.customFetchImpl)return e.customFetchImpl;if(typeof globalThis<`u`&&Is(globalThis.fetch))return globalThis.fetch;if(typeof window<`u`&&Is(window.fetch))return window.fetch;throw Error(`No fetch implementation found`)}function Rs(...e){let t={};for(let n of e)if(n){if(n instanceof Headers)n.forEach((e,n)=>{t[n]=e});else{let e=Array.isArray(n)?n:Object.entries(n);for(let[n,r]of e)r!=null&&(t[n]=r)}}return t}async function zs(e){let t=new Headers(Rs(e?.headers,await As(e)));if(!t.has(`content-type`)){let n=Bs(e?.body);n&&t.set(`content-type`,n)}return t}function Bs(e){return Ps(e)?`application/json`:null}function Vs(e){let t=e.get(`content-type`);return t?t.split(`;`)[0].trim().toLowerCase():null}function Hs(e,t){let{body:n}=e;return n?!Ps(n)||typeof n==`string`?n:Vs(t)===`application/x-www-form-urlencoded`?new URLSearchParams(n).toString():JSON.stringify(n):null}function Us(e,t){if(t?.method)return t.method.toUpperCase();let{method:n}=Ts(e);return n?n.toUpperCase():t?.body?`POST`:`GET`}function Ws(e,t){let n;return!e?.signal&&e?.timeout&&(n=setTimeout(()=>t?.abort(),e?.timeout)),{abortTimeout:n,clearTimeout:()=>{n&&clearTimeout(n)}}}var Gs=class e extends Error{constructor(t,n){super(n||JSON.stringify(t,null,2)),this.issues=t,Object.setPrototypeOf(this,e.prototype)}};async function Ks(e,t){let n=await e[`~standard`].validate(t);if(n.issues)throw new Gs(n.issues);return n.value}function qs(e){"@babel/helpers - typeof";return qs=typeof Symbol==`function`&&typeof Symbol.iterator==`symbol`?function(e){return typeof e}:function(e){return e&&typeof Symbol==`function`&&e.constructor===Symbol&&e!==Symbol.prototype?`symbol`:typeof e},qs(e)}function Js(e,t){if(qs(e)!=`object`||!e)return e;var n=e[Symbol.toPrimitive];if(n!==void 0){var r=n.call(e,t||`default`);if(qs(r)!=`object`)return r;throw TypeError(`@@toPrimitive must return a primitive value.`)}return(t===`string`?String:Number)(e)}function Ys(e){var t=Js(e,`string`);return qs(t)==`symbol`?t:t+``}function Xs(e,t,n){return(t=Ys(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Zs(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,r)}return n}function Qs(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]==null?{}:arguments[t];t%2?Zs(Object(n),!0).forEach(function(t){Xs(e,t,n[t])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Zs(Object(n)).forEach(function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))})}return e}var $s=async(e,t)=>{var n;let{hooks:r,url:i,options:a}=await bs(e,t),o=Ls(a),s=new AbortController,c=a.signal??s.signal,l=ks(i,a),u=await zs(a),d=Hs(a,u),f=Us(i,a),p=Qs(Qs({},a),{},{url:l,headers:u,body:d,method:f,signal:c});for(let e of r.onRequest)if(e){let t=await e(p);typeof t==`object`&&t&&Object.assign(p,t)}(`pipeTo`in p&&typeof p.pipeTo==`function`||typeof(t==null||(n=t.body)==null?void 0:n.pipe)==`function`)&&(`duplex`in p||(p.duplex=`half`));let{clearTimeout:m}=Ws(a,s),h=await o(p.url,p);m();let g={response:h,request:p};for(let e of r.onResponse)if(e){var _;let n=await e(Qs(Qs({},g),{},{response:t!=null&&(_=t.hookOptions)!=null&&_.cloneResponse?h.clone():h}));n instanceof Response?h=n:typeof n==`object`&&n&&(h=n.response)}if(h.ok){if(p.method===`HEAD`)return{data:``,error:null};let e=Ms(h),n={data:null,response:h,request:p};if(e===`json`||e===`text`){let e=await h.text();n.data=await(p.jsonParser??Fs)(e)}else n.data=await h[e]();p?.output&&p.output&&!p.disableValidation&&(n.data=await Ks(p.output,n.data));for(let e of r.onSuccess)if(e){var v;await e(Qs(Qs({},n),{},{response:t!=null&&(v=t.hookOptions)!=null&&v.cloneResponse?h.clone():h}))}return t?.throw?n.data:{data:n.data,error:null}}let y=t?.jsonParser??Fs,b=await h.text(),x=Ns(b),S=x?await y(b):null,C={response:h,responseText:b,request:p,error:Qs(Qs({},S),{},{status:h.status,statusText:h.statusText})};for(let e of r.onError)if(e){var w;await e(Qs(Qs({},C),{},{response:t!=null&&(w=t.hookOptions)!=null&&w.cloneResponse?h.clone():h}))}if(t?.retry){let n=Cs(t.retry),i=t.retryAttempt??0;if(await n.shouldAttemptRetry(i,h)){for(let e of r.onRetry)e&&await e(g);let a=n.getDelay(i);return await new Promise(e=>setTimeout(e,a)),await $s(e,Qs(Qs({},t),{},{retryAttempt:i+1}))}}if(t?.throw)throw new ys(h.status,h.statusText,x?S:b);return{data:null,error:Qs(Qs({},S),{},{status:h.status,statusText:h.statusText})}},ec=new Set([301,302,303,307,308]);function tc(e){return e.type===`opaqueredirect`||ec.has(e.status)}function nc(e){return new V(`The OAuth endpoint "${e}" returned an HTTP redirect. Server-side OAuth fetches refuse redirects to prevent SSRF; configure the final endpoint URL.`)}var rc={redirect:`manual`};async function ic(e,t){let n=!1,r=t?.onError,i=await $s(e,{...t,...rc,async onError(e){tc(e.response)&&(n=!0),await r?.(e)}}).catch(t=>{throw n?nc(e):t});if(n)throw nc(e);return i}var ac=`dpop+jwt`,oc=[`EdDSA`,`ES256`,`ES512`,`PS256`,`RS256`],sc=300,cc=512,lc=new Set([`d`,`p`,`q`,`dp`,`dq`,`qi`,`oth`,`k`]);function uc(e){return{reserve:({key:t,expiresAt:n})=>e.reserveVerificationValue({identifier:`dpop-proof:${t}`,value:t,expiresAt:n})}}function Y(e,t){return Object.assign(Error(t),{code:e})}function dc(e){return e instanceof Error&&`code`in e&&e.code===`invalid_dpop_proof`}function fc(e){if(!e)return;let t=e.trim();if(!t)return;let n=/^([A-Za-z][A-Za-z0-9!#$%&'*+.^_`|~-]*)\s+(.+)$/.exec(t);if(!n)return{scheme:`Unknown`,token:t};let r=n[1]??``,i=n[2]?.trim()??``;return r.toLowerCase()===`bearer`?{scheme:`Bearer`,token:i}:r.toLowerCase()===`dpop`?{scheme:`DPoP`,token:i}:{scheme:`Unknown`,token:t}}function pc(e){return fc(e)?.token??e}function mc(e){let t=new URL(e);if(t.hash)throw Error(`DPoP proof htu must not contain a fragment`);return`${t.origin}${t.pathname}`}async function hc(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return G(new Uint8Array(t))}async function gc(e){return fi(e,`sha256`)}function _c(e){if(!e||typeof e!=`object`||Array.isArray(e))return;let t=e.jkt;return typeof t==`string`&&t.length>0?t:void 0}function vc(e){return _c(e.cnf)}function yc(e,t){let n=e[t];return typeof n==`string`&&n.length>0?n:void 0}function bc(e,t){let n=e[t];return typeof n==`number`&&Number.isFinite(n)?n:void 0}function xc(e,t){if(!e||e===`none`||e.startsWith(`HS`))throw Y(`invalid_dpop_proof`,`DPoP proof must use an asymmetric JWS algorithm`);if(!t.includes(e))throw Y(`invalid_dpop_proof`,`DPoP proof uses an unsupported JWS algorithm`)}function Sc(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Y(`invalid_dpop_proof`,`DPoP proof header must include a public jwk`);if(e.kty===`oct`)throw Y(`invalid_dpop_proof`,`DPoP proof jwk must be asymmetric`);for(let t of lc)if(t in e)throw Y(`invalid_dpop_proof`,`DPoP proof jwk must not contain private key material`)}async function Cc(e){let t=`${e.jkt}\n${e.htm}\n${e.htu}\n${e.jti}`,n=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(t));return G(new Uint8Array(n))}async function wc(e,t){if(e&&!await e.reserve(t))throw Y(`invalid_dpop_proof`,`DPoP proof jti has already been used`)}async function Tc({proofJwt:e,method:t,url:n,accessToken:r,expectedJkt:i,requireAth:a=!1,nowSeconds:o=Math.floor(Date.now()/1e3),proofMaxAgeSeconds:s=sc,signingAlgorithms:c=oc,replayStore:l}){if(!e||e.split(`.`).length!==3)throw Y(`invalid_dpop_proof`,`DPoP proof must be a compact JWT`);let u;try{u=vi(e)}catch(e){throw Y(`invalid_dpop_proof`,e instanceof Error?e.message:`DPoP proof header is invalid`)}if(u.typ!==`dpop+jwt`)throw Y(`invalid_dpop_proof`,`DPoP proof typ must be "dpop+jwt"`);xc(u.alg,c),Sc(u.jwk);let d;try{d=(await Vr(e,await _i(u.jwk,u.alg),{typ:ac})).payload}catch(e){throw Y(`invalid_dpop_proof`,e instanceof Error?e.message:`DPoP proof signature is invalid`)}let f=yc(d,`htm`),p=yc(d,`htu`),m=yc(d,`jti`),h=bc(d,`iat`);if(!f||!p||!m||h===void 0)throw Y(`invalid_dpop_proof`,`DPoP proof must include htm, htu, jti, and iat claims`);if(m.length>cc)throw Y(`invalid_dpop_proof`,`DPoP proof jti is too large`);if(f.toUpperCase()!==t.toUpperCase())throw Y(`invalid_dpop_proof`,`DPoP proof htm does not match the request method`);let g,_;try{g=mc(n),_=mc(p)}catch(e){throw Y(`invalid_dpop_proof`,e instanceof Error?e.message:`DPoP proof htu is invalid`)}if(_!==g)throw Y(`invalid_dpop_proof`,`DPoP proof htu does not match the request URL`);if(h>o+5||o-h>s)throw Y(`invalid_dpop_proof`,`DPoP proof iat is outside the accepted window`);let v=yc(d,`ath`);if(a&&!v)throw Y(`invalid_dpop_proof`,`DPoP proof must include an ath claim`);if(r!==void 0&&v!==await hc(r))throw Y(`invalid_dpop_proof`,`DPoP proof ath does not match the access token`);let y=await gc(u.jwk);if(i!==void 0&&y!==i)throw Y(`invalid_dpop_proof`,`DPoP proof key does not match the bound token`);let b=await Cc({jkt:y,htm:f.toUpperCase(),htu:g,jti:m}),x=new Date((h+s)*1e3);return await wc(l,{key:b,expiresAt:x,now:new Date(o*1e3)}),{jwk:u.jwk,jkt:y,jti:m,htm:f,htu:g,iat:h,ath:v,replayKey:b,expiresAt:x}}function Ec(e,t){return Object.assign(Error(t),{code:e})}function Dc(e){return e instanceof Error&&`code`in e&&(e.code===`invalid_token`||e.code===`invalid_dpop_proof`)}async function Oc({payload:e,authorization:t,proofJwt:n,method:r,url:i,replayStore:a,proofMaxAgeSeconds:o,signingAlgorithms:s}){let c=vc(e);if(c){if(t.scheme!==`DPoP`)throw Ec(`invalid_token`,`DPoP-bound access token requires the DPoP authorization scheme`);if(!n)throw Ec(`invalid_dpop_proof`,`DPoP proof header is required`);try{await Tc({proofJwt:n,method:r,url:i,accessToken:t.token,expectedJkt:c,requireAth:!0,proofMaxAgeSeconds:o,signingAlgorithms:s,replayStore:a})}catch(e){throw dc(e)?Ec(`invalid_dpop_proof`,e.message):e}}else if(t.scheme===`DPoP`)throw Ec(`invalid_token`,`DPoP authorization requires a DPoP-bound access token`)}_t.code,mt.code,gt.code;var kc=new Map,Ac=new WeakMap,jc=3e5;function Mc(e,t){if(e&&!(Date.now()-e.fetchedAt>=jc)&&(!t||e.jwks.keys.some(e=>e.kid===t)))return e.jwks}async function Nc(e){let t=typeof e==`string`?await ic(e,{headers:{Accept:`application/json`}}).then(async e=>{if(e.error)throw Error(`Jwks failed: ${e.error.message??e.error.statusText}`);return e.data}):await e();if(!t)throw Error(`No jwks found`);return t}async function Pc(e,t){return(await Fc(e,t)).jwks}async function Fc(e,t){let n;try{n=vi(e)}catch(e){throw e instanceof Error?e:Error(e)}let r=n.kid;if(typeof t.jwksFetch!=`string`){let e=t.jwksCacheKey;if(!e){let e=await t.jwksFetch();if(!e)throw Error(`No jwks found`);return{jwks:e,fromCache:!1,kid:r}}let n=Ac.get(e),i=t.forceRefresh?void 0:Mc(n,r);if(i)return{jwks:i,fromCache:!0,kid:r,noKidRefetchedAt:n?.noKidRefetchedAt};let a=await t.jwksFetch();if(!a)throw Error(`No jwks found`);let o=Date.now();return Ac.set(e,{jwks:a,fetchedAt:o,...t.forceRefresh&&!r?{noKidRefetchedAt:o}:{}}),{jwks:a,fromCache:!1,kid:r}}let i=t.jwksFetch,a=kc.get(i),o=t.forceRefresh?void 0:Mc(a,r);if(!o){let e=await Nc(t.jwksFetch),n=Date.now();return kc.set(i,{jwks:e,fetchedAt:n,...t.forceRefresh&&!r?{noKidRefetchedAt:n}:{}}),{jwks:e,fromCache:!1,kid:r}}return{jwks:o,fromCache:!0,kid:r,noKidRefetchedAt:a?.noKidRefetchedAt}}var Ic=[`authorization_code`,`client_credentials`,`refresh_token`],Lc=[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],Rc=[`none`,...Lc],zc=new Set(Rc);function Bc(e,t){if(!(t.trim().length>0))throw new V(`OAuth Provider extension ${e} cannot be empty`)}function Vc(e,t){Bc(e,t);let n;try{n=new URL(t)}catch{n=void 0}if(!n?.protocol)throw new V(`OAuth Provider extension ${e} must be an absolute URI: ${t}`)}function Hc(e){Vc(`grant type`,e)}function Uc(e){if(Bc(`token_endpoint_auth_method`,e),zc.has(e))throw new V(`OAuth Provider extension token_endpoint_auth_method is reserved: ${e}`)}function Wc(e){if(Vc(`client_assertion_type`,e),e===`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)throw new V(`OAuth Provider extension client_assertion_type is reserved: ${e}`)}function Gc(e){let t=Object.keys(e.grants??{});for(let e of t)Hc(e);let n=[],r=[];for(let[t,i]of Object.entries(e.clientAuthentication??{})){Uc(t),n.push(t);let e=i.assertionTypes??[t];if(e.length===0)throw new V(`OAuth Provider extension client_assertion_type list cannot be empty for ${t}`);for(let t of e)Wc(t),r.push(t)}let i=(e.clientDiscovery?Array.isArray(e.clientDiscovery)?e.clientDiscovery:[e.clientDiscovery]:[]).map(e=>e.id);for(let e of i)Bc(`client discovery id`,e);return{grantTypes:t,authMethods:n,assertionTypes:r,clientDiscoveryIds:i}}function Kc(e,t){let n=new Set;for(let r of t){if(n.has(r))throw new V(`OAuth Provider extensions register ${e} "${r}" more than once. Extension contributions must be disjoint.`);n.add(r)}}function qc(e){let t=(e??[]).map(Gc);Kc(`grant type`,t.flatMap(e=>e.grantTypes)),Kc(`token_endpoint_auth_method`,t.flatMap(e=>e.authMethods)),Kc(`client_assertion_type`,t.flatMap(e=>e.assertionTypes)),Kc(`client discovery id`,t.flatMap(e=>e.clientDiscoveryIds))}function Jc(e){return e.extensions??[]}function Yc(e){return Jc(e).flatMap(e=>{let t=e.clientDiscovery;return t?Array.isArray(t)?t:[t]:[]})}function Xc(e,t){let n=e.getPlugin(`oauth-provider`);if(!n)throw new V(`extendOAuthProvider requires the oauth-provider plugin.`);let r=n.options.extensions??[];if(r.includes(t))return;let i=[...r,t];qc(i),n.options.extensions=i}function Zc(e){return Jc(e).flatMap(e=>Object.keys(e.grants??{}))}function Qc(e){return Array.from(new Set([...e.grantTypes??Ic,...Zc(e)]))}function $c(e,t){for(let n of Jc(e)){let e=n.grants?.[t];if(e)return e}}function el(e){return Jc(e).flatMap(e=>Object.keys(e.clientAuthentication??{}))}function tl(e,t){return Array.from(new Set([...t?.includeNone?[`none`]:[],...Lc,...el(e)]))}function nl(e,t){return t?el(e).includes(t):!1}function rl(e,t){if(t!==`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)for(let n of Jc(e)){let e=n.clientAuthentication??{};for(let[n,r]of Object.entries(e))if((r.assertionTypes??[n]).includes(t))return{method:n,strategy:r}}}function il(e,t,n,r){let i={...r};for(let a of Jc(t)){let o=a.metadata?.({ctx:e,opts:t,type:n,document:r});for(let[e,t]of Object.entries(o??{}))e in i||(i[e]=t)}return i}async function al(e,t){let n={};for(let r of Jc(e)){let e=await t(r)??{};for(let[t,r]of Object.entries(e))t in n?_e.warn(`oauth-provider: two extensions contributed the claim "${t}"; keeping the first-registered value.`):n[t]=r}return n}function ol(e,t){return al(e,e=>e.claims?.accessToken?.(t))}function sl(e,t){return al(e,e=>e.claims?.idToken?.(t))}function cl(e,t){return al(e,e=>e.claims?.userInfo?.(t))}function ll(e){return Jc(e).some(e=>e.claims?.userInfo)}function ul(e){if(!e)return;let[t,n,...r]=e.trim().split(/\s+/);if(t?.toLowerCase()===`bearer`){if(!n||r.length>0)throw new z(`BAD_REQUEST`,{error:`invalid_request`,error_description:`Malformed Bearer Authorization header`});return n}}function dl(){let e=new Map;return{get(t){let n=e.get(t);if(n){if(n.expiresAt&&n.expiresAt<new Date)e.delete(t);else return n}},set(t,n){e.set(t,n)}}}var fl=e=>e.getPlugin(`oauth-provider`),pl=e=>{let t=e.getPlugin(`jwt`);if(!t)throw new V(`jwt_config`);return t};function ml(e){if(e!=null){if(e instanceof Date)return Number.isFinite(e.getTime())?e:void 0;if(typeof e==`number`){if(!Number.isFinite(e))return;let t=new Date(e);return Number.isFinite(t.getTime())?t:void 0}if(typeof e==`string`){let t=e.trim();if(!t.length)return;let n=Number(t);if(Number.isFinite(n)){let e=new Date(n);return Number.isFinite(e.getTime())?e:void 0}let r=new Date(t);return Number.isFinite(r.getTime())?r:void 0}}}function hl(e){if(e instanceof Date||!e||typeof e!=`object`)return ml(e);let t=ml(e.createdAt)??ml(e.created_at);if(t)return t;let n=e.session;if(n&&typeof n==`object`)return ml(n.createdAt)??ml(n.created_at)}function gl(e){if(typeof e==`string`)return[e];if(e?.length)return e}function _l(e){if(typeof e==`string`)return e;if(e?.length)return e.length===1?e.at(0):e}var vl=new WeakMap;function yl(e){let t=vl.get(e);if(t)return t;let n=dl();return vl.set(e,n),n}async function bl(e,t){let n=new URLSearchParams(e),r=n.get(`sig`),i=n.getAll(`sig`),a=Number(n.get(`exp`));n.delete(`sig`);let o=await Ga(De(n).toString(),t);return i.length===1&&!!r&&Pi(r,o)&&new Date(a*1e3)>=new Date}async function xl(e,t,n){let r=yl(t),i=r.get(n);if(i&&!i.clientDiscoveryId)return Object.assign({},i);let a=await e.context.adapter.findOne({model:t.schema?.oauthClient?.modelName??`oauthClient`,where:[{field:`clientId`,value:n}]}),o=Yc(t);if(a?.clientDiscoveryId){let t=a.clientDiscoveryId,r=o.find(e=>e.id===t);if(!r?.matches(n)||(a=await r.resolve(e,n,a),!a))return null}else if(a)return t.cachedTrustedClients?.has(n)&&r.set(n,Object.assign({},a)),a;else for(let t of o){if(!t.matches(n))continue;let r=await t.resolve(e,n,null);if(r){a=r;break}}return a}function Sl(e){return e.reduce((e,t)=>({...e,...t.discoveryMetadata??{}}),{})}var Cl=async e=>{let t=await Li(`SHA-256`).digest(new TextEncoder().encode(e));return ve.encode(new Uint8Array(t),{padding:!1})};async function wl(e,t,n){if(t===`encrypted`)return await Ua({key:e.context.secretConfig,data:n});if(typeof t==`object`&&`decrypt`in t)return await t.decrypt(n);throw new V(`Unsupported decryption storageMethod type '${t}'`)}async function Tl(e,t,n,r){let i=t.storeClientSecret??(t.disableJwtPlugin?`encrypted`:`hashed`);if(r&&t.prefix?.clientSecret){if(r.startsWith(t.prefix?.clientSecret))r=r.replace(t.prefix.clientSecret,``);else throw new z(`UNAUTHORIZED`,{error_description:`invalid client_secret`,error:`invalid_client`})}if(i===`hashed`){let e=r?await Cl(r):void 0;return!!e&&Pi(e,n)}if(typeof i==`object`&&`hash`in i){if(i.verify)return!!r&&await i.verify(r,n);{let e=r?await i.hash(r):void 0;return!!e&&Pi(e,n)}}if(i===`encrypted`)try{let t=await wl(e,i,n);return!!r&&Pi(t,r)}catch{return!1}if(typeof i==`object`&&`decrypt`in i){let t=await wl(e,i,n);return!!r&&Pi(t,r)}throw new V(`Unsupported verify storageMethod type '${i}'`)}async function El(e,t,n){let r=t.storeClientSecret??(t.disableJwtPlugin?`encrypted`:`hashed`);if(r===`encrypted`)return await Ha({key:e.context.secretConfig,data:n});if(r===`hashed`)return await Cl(n);if(typeof r==`object`&&`hash`in r)return await r.hash(n);if(typeof r==`object`&&`encrypt`in r)return await r.encrypt(n);throw new V(`Unsupported storeClientSecret type '${r}'`)}async function Dl(e=`hashed`,t,n){if(e===`hashed`)return await Cl(t);if(typeof e==`object`&&`hash`in e)return await e.hash(t,n);throw new V(`storeToken: unsupported storageMethod type '${e}'`)}async function Ol(e=`hashed`,t,n){if(e===`hashed`)return await Cl(t);if(typeof e==`object`&&`hash`in e)return await e.hash(t,n);throw new V(`getStoredToken: unsupported storageMethod type '${e}'`)}var kl=/^Basic +/i,Al=/^([!#$%&'*+\-.^_`|~0-9A-Za-z]+)(?=\s|$)/;function jl(e){return e.match(Al)?.[1]}var Ml=[`client_secret`,`client_assertion`,`client_assertion_type`];function Nl(e){throw new z(`BAD_REQUEST`,{error:`invalid_request`,error_description:e})}async function Pl(e,t={}){let n;t.client_id!==void 0&&t.client_id!==``&&(typeof t.client_id!=`string`&&Nl(`client_id must be a string`),n=t.client_id);let r={},i=(e,t)=>{t!==void 0&&t!==``&&(typeof t!=`string`&&Nl(`${e} must be a string`),r[e]=t)};for(let e of Ml)Object.hasOwn(t,e)&&i(e,t[e]);let a=!!e?.headers.get(`authorization`);if(e&&(e.headers.get(`content-type`)?.toLowerCase()??``).includes(`application/x-www-form-urlencoded`)){let t=new URLSearchParams(await e.clone().text()),r=t.getAll(`client_id`).filter(e=>e.length>0);r.length>1&&Nl(`client_id must not be repeated`),n=r[0];for(let e of Ml){let n=t.getAll(e).filter(e=>e.length>0);n.length>1&&Nl(`${e} must not be repeated`),n.length===1&&i(e,n[0])}}let o=r.client_secret!==void 0,s=r.client_assertion!==void 0||r.client_assertion_type!==void 0;(a&&(o||s)||o&&s)&&Nl(`A request must use only one client authentication method`),t.client_id=n;for(let e of Ml)t[e]=r[e];return{detected:a||Object.keys(r).length>0}}function Fl(e){if(kl.test(e))try{let{clientId:t,clientSecret:n}=hs(e);return{client_id:t,client_secret:n}}catch{throw new z(`UNAUTHORIZED`,{error_description:`invalid authorization header format`,error:`invalid_client`},{"WWW-Authenticate":`Basic`})}}function Il(e,t){let n=e.grantTypes&&e.grantTypes.length>0?e.grantTypes:[`authorization_code`];return t===`refresh_token`&&n.includes(`authorization_code`)?!0:n.includes(t)}function Ll(e,t){if(!t||!e.scopes)return;let n=new Set(e.scopes);for(let e of t)if(!n.has(e))throw new z(`BAD_REQUEST`,{error_description:`client does not allow scope ${e}`,error:`invalid_scope`})}function Rl(e,t){let n=t?.method===`client_secret_basic`,r=t?.scheme??(n?`Basic`:void 0);throw new z(r?`UNAUTHORIZED`:`BAD_REQUEST`,{error_description:e,error:`invalid_client`},r?{"WWW-Authenticate":r}:void 0)}async function zl(e,t,n,r,i,a,o,s){let c=await xl(e,t,n);c||Rl(`missing client`,{method:s}),c.disabled&&Rl(`client is disabled`,{method:s});let l=c.tokenEndpointAuthMethod??`client_secret_basic`;if(s&&l!==s&&Rl(`client registered for ${l} cannot use ${s}`,{method:s}),(c.tokenEndpointAuthMethod===`private_key_jwt`||nl(t,c.tokenEndpointAuthMethod))&&!a)throw new z(`BAD_REQUEST`,{error_description:`client registered for ${c.tokenEndpointAuthMethod} must use client_assertion`,error:`invalid_client`});if(a||(c.tokenEndpointAuthMethod!==`none`&&!r&&Rl(`client secret must be provided`,{method:s}),r&&!c.clientSecret&&Rl(`public client, client secret should not be received`,{method:s}),r&&!await Tl(e,t,c.clientSecret,r)&&Rl(`invalid client_secret`,{method:s})),Ll(c,i),o&&!Il(c,o))throw new z(`BAD_REQUEST`,{error_description:`client is not authorized to use grant type ${o}`,error:`unauthorized_client`});return c}function Bl(e){if(e)return typeof e==`string`?JSON.parse(e):e}function Vl(e){return{clientId:e?.clientId,clientSecret:e?.kind===`client_secret`?e.clientSecret:void 0,preVerified:e?.kind===`pre_verified`,authMethod:e?.method,confirmation:e?.kind===`pre_verified`?e.confirmation:void 0}}async function Hl(e,t,n){let r={...e.body??{}};await Pl(e.request,r);let i=e.request?.headers.get(`authorization`)??void 0;if(r.client_assertion_type||r.client_assertion){if(!r.client_assertion||!r.client_assertion_type)throw new z(`BAD_REQUEST`,{error_description:`client_assertion and client_assertion_type must both be provided`,error:`invalid_client`});let i=r.client_assertion,a=r.client_assertion_type,o=rl(t,a);if(o){let s=await o.strategy.authenticate({ctx:e,opts:t,assertion:i,assertionType:a,clientId:r.client_id,expectedAudience:n});return{kind:`pre_verified`,method:o.method,clientId:s.clientId,confirmation:s.confirmation}}let{verifyClientAssertion:s}=await Promise.resolve().then(()=>fg).then(e=>e.o);return{kind:`pre_verified`,method:`private_key_jwt`,clientId:(await s(e,t,i,a,r.client_id,n)).clientId}}if(i&&!kl.test(i)){let e=jl(i);if(!e)throw new z(`BAD_REQUEST`,{error:`invalid_request`,error_description:`Invalid authorization header format`});Rl(`unsupported authorization scheme`,{scheme:e})}if(i&&kl.test(i)){let e=Fl(i);if(e)return{kind:`client_secret`,method:`client_secret_basic`,clientId:e.client_id,clientSecret:e.client_secret}}return r.client_id&&r.client_secret?{kind:`client_secret`,method:`client_secret_post`,clientId:r.client_id,clientSecret:r.client_secret}:r.client_id?{kind:`public`,method:`none`,clientId:r.client_id}:null}function Ul(e){let t=e.split(` `).map(e=>e.trim()),n=new Set;for(let e of t)(e===`login`||e===`consent`||e===`create`||e===`select_account`||e===`none`)&&n.add(e);return new Set(n)}function Wl(e){let t=e.redirectUris?.[0];if(!t)throw new V(`Client has no redirect URIs for sector identifier`);return new URL(t).host}async function Gl(e,t,n){return Ga(`${Wl(t)}.${e}`,n)}async function Kl(e,t,n){return t.subjectType===`pairwise`&&n.pairwiseSecret?Gl(e,t,n.pairwiseSecret):e}function ql(e){let t=Object.create(null);for(let n of new Set(e.keys())){let r=e.getAll(n);t[n]=r.length===1?r[0]:r}return t}function Jl(e,t){if(!t)return!1;let n=ml(e);return n?n.getTime()>=t.getTime():!1}function Yl(e,t){let n=new URLSearchParams(e),r=n.get(`prompt`)?.split(` `),i=r?.findIndex(e=>e===t)??-1;return i>=0&&(r?.splice(i,1),r?.length?n.set(`prompt`,r.join(` `)):n.delete(`prompt`)),n}function Xl(e){let t=new URLSearchParams(e);return t.delete(`max_age`),t}function Zl(e,t){if(e.tokenEndpointAuthMethod===`none`)return`pkce is required for public clients`;let n=t?.scopes??[],r=n.includes(`openid`),i=typeof t?.nonce==`string`&&t.nonce.length>0,a=r&&i;return n.includes(`offline_access`)&&!a?`pkce or OIDC nonce is required when requesting offline_access scope`:e.requirePKCE??!0?`pkce is required for this client`:!1}function Ql(e){return e instanceof z||e instanceof B||e?.name===`APIError`}var $l,eu=!1;function tu(){try{return globalThis.process?.getBuiltinModule?.(`node:async_hooks`)?.AsyncLocalStorage}catch{return}}async function nu(){if($l)return $l;let e=tu();if(e)return $l??=e,$l;try{let{AsyncLocalStorage:e}=await import(`node:async_hooks`);return $l??=e,$l}catch(e){let t=globalThis.AsyncLocalStorage;if(typeof t==`function`)return $l??=t,$l;throw typeof window<`u`?Error(`getAsyncLocalStorage is only available in server code`):(eu||(eu=!0,console.warn(`[better-auth] Warning: AsyncLocalStorage is not available in this environment. Some features may not work as expected.`),console.warn(`[better-auth] Please read more about this warning at https://better-auth.com/docs/installation#mount-handler`),console.warn(`[better-auth] If you are using Cloudflare Workers, please see: https://developers.cloudflare.com/workers/configuration/compatibility-flags/#nodejs-compatibility-flag`)),e)}}var ru=()=>O().context.endpointContextAsyncStorage,iu=async()=>{let e=ru();if(e)return e;let t=await nu(),n=O().context;return n.endpointContextAsyncStorage??=new t};function au(){return ge()}function ou(){let e=au();if(!e)throw Error("No auth context found. Please make sure you are calling this function within a `runWithEndpointContext` callback.");return e}async function su(e,t){return(await iu()).run(e,t)}var cu={"Cache-Control":`no-store`,Pragma:`no-cache`};function lu(e,t){Ql(t)&&e&&Object.defineProperty(t,F,{enumerable:!1,configurable:!0,value:e,writable:!1})}var uu=Co(async()=>({})),du=Co.create({use:[uu,Co(async()=>({}))]}),fu=xo.create({use:[uu]});function pu(e,t){let n=t.metadata?.noStore===!0;return async t=>{if(n)for(let[e,n]of Object.entries(cu))t.setHeader(e,n);try{return await su(t,()=>e(t))}catch(e){throw lu(t.responseHeaders,e),e}}}function X(...e){if(e.length===3){let[t,n,r]=e;return fu(t,n,pu(r,n))}let[t,n]=e;return fu(t,pu(n,t))}function mu(e){return{...e,metadata:{...e.metadata,SERVER_ONLY:!0}}}X.serverOnly=(e,t)=>X(mu(e),t);function hu(e){return e===`-`||e===`^`||e===`$`||e===`+`||e===`.`||e===`(`||e===`)`||e===`|`||e===`[`||e===`]`||e===`{`||e===`}`||e===`*`||e===`?`||e===`\\`?`\\${e}`:e}function gu(e){let t=``;for(let n=0;n<e.length;n++)t+=hu(e[n]);return t}function _u(e,t=!0){if(Array.isArray(e))return`(?:${e.map(e=>`^${_u(e,t)}$`).join(`|`)})`;let n=``,r=``,i=`.`;t===!0?(n=`/`,r=`[/\\\\]`,i=`[^/\\\\]`):t&&(n=t,r=gu(n),r.length>1?(r=`(?:${r})`,i=`((?!${r}).)`):i=`[^${r}]`);let a=t?`${r}+?`:``,o=t?`${r}*?`:``,s=t?e.split(n):[e],c=``;for(let e=0;e<s.length;e++){let n=s[e],r=s[e+1],l=``;if(!(!n&&e>0)){if(t&&(l=e===s.length-1?o:r===`**`?``:a),t&&n===`**`)l&&(c+=e===0?``:l,c+=`(?:${i}*?${l})*?`);else{for(let e=0;e<n.length;e++){let t=n[e];t===`\\`?e<n.length-1&&(c+=hu(n[e+1]),e++):c+=t===`?`?i:t===`*`?`${i}*?`:hu(t)}c+=l}}}return c}function vu(e,t){if(typeof t!=`string`)throw TypeError(`Sample must be a string, but ${typeof t} given`);return e.test(t)}function yu(e,t){if(typeof e!=`string`&&!Array.isArray(e))throw TypeError(`The first argument must be a single pattern string or an array of patterns, but ${typeof e} given`);if((typeof t==`string`||typeof t==`boolean`)&&(t={separator:t}),arguments.length===2&&!(t===void 0||typeof t==`object`&&t&&!Array.isArray(t)))throw TypeError(`The second argument must be an options object or a string/boolean separator, but ${typeof t} given`);if(t||={},t.separator===`\\`)throw Error("\\ is not a valid separator because it is used for escaping. Try setting the separator to `true` instead");let n=_u(e,t.separator),r=RegExp(`^${n}$`,t.flags),i=vu.bind(null,r);return i.options=t,i.pattern=e,i.regexp=r,i}var bu=47;function xu(e){let t=e.replace(/:\d+$/,``).replace(/^\[|\]$/g,``).toLowerCase();return t===`localhost`||t.endsWith(`.localhost`)||t===`::1`||t.startsWith(`127.`)}function Su(e){let t=e.length;for(;t>0&&e.charCodeAt(t-1)===bu;)t--;return t===e.length?e:e.slice(0,t)}function Cu(e){try{return(Su(new URL(e).pathname)||`/`)!==`/`}catch{throw new V(`Invalid base URL: ${e}. Please provide a valid base URL.`)}}function wu(e){try{let t=new URL(e);if(t.protocol!==`http:`&&t.protocol!==`https:`)throw new V(`Invalid base URL: ${e}. URL must include 'http://' or 'https://'`)}catch(t){throw t instanceof V?t:new V(`Invalid base URL: ${e}. Please provide a valid base URL.`,{cause:t})}}function Tu(e,t=`/api/auth`){if(wu(e),Cu(e))return e;let n=Su(e);return!t||t===`/`?n:(t=t.startsWith(`/`)?t:`/${t}`,`${n}${t}`)}function Eu(e,t){return!e||e.trim()===``?!1:t===`proto`?e===`http`||e===`https`:t===`host`?[/\.\./,/\0/,/[\s]/,/^[.]/,/[<>'"]/,/javascript:/i,/file:/i,/data:/i].some(t=>t.test(e))?!1:/^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(:[0-9]{1,5})?$/.test(e)||/^(\d{1,3}\.){3}\d{1,3}(:[0-9]{1,5})?$/.test(e)||/^\[[0-9a-fA-F:]+\](:[0-9]{1,5})?$/.test(e)||/^localhost(:[0-9]{1,5})?$/i.test(e):!1}function Du(e,t,n,r,i){if(e)return Tu(e,t);if(r!==!1){let e=R.BETTER_AUTH_URL||R.NEXT_PUBLIC_BETTER_AUTH_URL||R.PUBLIC_BETTER_AUTH_URL||R.NUXT_PUBLIC_BETTER_AUTH_URL||R.NUXT_PUBLIC_AUTH_URL||(R.BASE_URL===`/`?void 0:R.BASE_URL);if(e)return Tu(e,t)}let a=n?.headers.get(`x-forwarded-host`),o=n?.headers.get(`x-forwarded-proto`);if(a&&o&&i&&Eu(o,`proto`)&&Eu(a,`host`))try{return Tu(`${o}://${a}`,t)}catch{}if(n){let e=Ou(n.url);if(!e)throw new V(`Could not get origin from request. Please provide a valid base URL.`);return Tu(e,t)}if(typeof window<`u`&&window.location)return Tu(window.location.origin,t)}function Ou(e){try{let t=new URL(e);return t.origin===`null`?null:t.origin}catch{return null}}function ku(e){try{return new URL(e).protocol}catch{return null}}function Au(e){try{return new URL(e).host}catch{return null}}function ju(e){return typeof e==`object`&&!!e&&`allowedHosts`in e&&Array.isArray(e.allowedHosts)}function Mu(e){if(e instanceof Request)return!0;if(typeof e!=`object`||!e||Object.prototype.toString.call(e)!==`[object Request]`)return!1;let t=e;return typeof t.url==`string`&&typeof t.headers==`object`&&t.headers!==null&&typeof t.headers.get==`function`}function Nu(e,t){let n=Mu(e)?e.headers:e;if(t){let e=n.get(`x-forwarded-host`);if(e&&Eu(e,`host`))return e}let r=n.get(`host`);if(r&&Eu(r,`host`))return r;if(Mu(e))try{return new URL(e.url).host}catch{return null}return null}function Pu(e,t,n){if(t===`http`||t===`https`)return t;let r=Mu(e)?e.headers:e;if(n){let e=r.get(`x-forwarded-proto`);if(e&&Eu(e,`proto`))return e}if(Mu(e))try{let t=new URL(e.url);if(t.protocol===`http:`||t.protocol===`https:`)return t.protocol.slice(0,-1)}catch{}let i=Nu(e,n);return i&&xu(i)?`http`:`https`}var Fu=(e,t)=>{if(!e||!t)return!1;let n=e.replace(/^https?:\/\//,``).split(`/`)[0].toLowerCase(),r=t.replace(/^https?:\/\//,``).split(`/`)[0].toLowerCase();return r.includes(`*`)||r.includes(`?`)?yu(r)(n):n.toLowerCase()===r.toLowerCase()};function Iu(e,t,n,r){let i=Nu(t,r);if(!i){if(e.fallback)return Tu(e.fallback,n);throw new V(`Could not determine host from request headers. Please provide a fallback URL in your baseURL config.`)}if(e.allowedHosts.some(e=>Fu(i,e)))return Tu(`${Pu(t,e.protocol,r)}://${i}`,n);if(e.fallback)return Tu(e.fallback,n);throw new V(`Host "${i}" is not in the allowed hosts list. Allowed hosts: ${e.allowedHosts.join(`, `)}. Add this host to your allowedHosts config or provide a fallback URL.`)}function Lu(e,t,n,r,i){if(ju(e))return n?Iu(e,n,t,i):e.fallback?Tu(e.fallback,t):Du(void 0,t,void 0,r,i);let a=Mu(n)?n:void 0;return Du(typeof e==`string`?e:void 0,t,a,r,i)}function Ru(e,t){let n;try{n=new URL(e).pathname.replace(/\/+$/,``)||`/`}catch{return`/`}let r=t.replace(/\/+$/,``);return r===``?n:n===r?`/`:n.startsWith(r+`/`)?n.slice(r.length).replace(/\/+$/,``)||`/`:n}var zu=`https://better-auth.invalid`;function Bu(e,t){let n=e.startsWith(`/`);if(e.startsWith(`//`)||e.startsWith(`/\\`))throw TypeError(`Expected an absolute or root-relative URL`);let r=n?new URL(e,zu):new URL(e);if(n&&r.origin!==zu)throw TypeError(`Expected an absolute or root-relative URL`);let i=t.toString();if(!i)return e;let a=r.search.endsWith(`&`)?``:`&`;return r.search=r.search?`${r.search}${a}${i}`:i,n?r.href.slice(r.origin.length):r.href}var Vu=[`javascript:`,`data:`,`vbscript:`],Hu=m(),Uu=p();function Wu(e){return Gu(e)||Ku(e)}function Gu(e){return n(Hu,e)}function Ku(e){return n(Uu,e)}function qu(e){let t=e.toLowerCase();if(t.startsWith(`::ffff:`)){let e=t.substring(7);if(Gu(e))return e}let n=e.split(`:`);if(n.length===7&&n[5]?.toLowerCase()===`ffff`){let e=n[6];if(e&&Gu(e))return e}if(t.includes(`::ffff:`)||t.includes(`:ffff:`)){let t=Ju(e);if(t.length===8&&t[0]===`0000`&&t[1]===`0000`&&t[2]===`0000`&&t[3]===`0000`&&t[4]===`0000`&&t[5]===`ffff`&&t[6]&&t[7])return`${Number.parseInt(t[6].substring(0,2),16)}.${Number.parseInt(t[6].substring(2,4),16)}.${Number.parseInt(t[7].substring(0,2),16)}.${Number.parseInt(t[7].substring(2,4),16)}`}return null}function Ju(e){if(e.includes(`::`)){let t=e.split(`::`),n=t[0]?t[0].split(`:`):[],r=t[1]?t[1].split(`:`):[],i=8-n.length-r.length,a=Array(i).fill(`0000`),o=n.map(e=>e.padStart(4,`0`)),s=r.map(e=>e.padStart(4,`0`));return[...o,...a,...s]}return e.split(`:`).map(e=>e.padStart(4,`0`))}function Yu(e,t){let n=Ju(e);if(t!==void 0&&t<128){let e=Math.max(0,Math.floor(t));return n.map(t=>{if(e<=0)return`0000`;if(e>=16)return e-=16,t;let n=Number.parseInt(t,16)&65535<<16-e&65535;return e=0,n.toString(16).padStart(4,`0`)}).join(`:`).toLowerCase()}return n.join(`:`).toLowerCase()}function Xu(e,t={}){if(Gu(e)||!Ku(e))return e.toLowerCase();let n=qu(e);return n?n.toLowerCase():Yu(e,t.ipv6Subnet??64)}function Zu(e){if(Gu(e))return Uint8Array.from(e.split(`.`).map(e=>Number(e)));if(!Ku(e))return null;let t=qu(e);if(t)return Uint8Array.from(t.split(`.`).map(e=>Number(e)));let n=Ju(e),r=new Uint8Array(16);for(let e=0;e<8;e++){let t=Number.parseInt(n[e]??`0`,16);r[e*2]=t>>8&255,r[e*2+1]=t&255}return r}var Qu=/^\d+$/;function $u(e){let t=e.lastIndexOf(`/`),n=Zu(t===-1?e:e.slice(0,t));if(!n)return null;let r=n.length*8;if(t===-1)return{bytes:n,prefix:r};let i=e.slice(t+1);if(!Qu.test(i))return null;let a=Number(i);return a<=r?{bytes:n,prefix:a}:null}function ed(e,t){if(e.length!==t.bytes.length)return!1;let n=t.prefix;for(let r=0;r<e.length&&n>0;r++){let i=n>=8?8:n,a=i===8?255:255<<8-i&255;if(((e[r]??0)&a)!==((t.bytes[r]??0)&a))return!1;n-=8}return!0}function td(e){return e.filter(e=>$u(e)===null)}function nd(e,t={}){let n=e.split(`,`).map(e=>e.trim()).filter(Boolean);if(n.length===0)return null;let r=(t.trustedProxies??[]).map($u).filter(e=>e!==null);if(r.length>0){for(let e=n.length-1;e>=0;e--){let i=n[e],a=i?Zu(i):null;if(!i||!a)return null;if(!r.some(e=>ed(a,e)))return Xu(i,{ipv6Subnet:t.ipv6Subnet})}return null}if(n.length!==1)return null;let i=n[0];return!i||!Wu(i)?null:Xu(i,{ipv6Subnet:t.ipv6Subnet})}var rd=`127.0.0.1`,id=[`x-forwarded-for`];function ad(e,t){if(t.advanced?.ipAddress?.disableIpTracking)return null;let n=`headers`in e?e.headers:e,r=t.advanced?.ipAddress?.ipAddressHeaders||id;for(let e of r){let r=`get`in n?n.get(e):n[e];if(typeof r==`string`){let e=nd(r,{ipv6Subnet:t.advanced?.ipAddress?.ipv6Subnet,trustedProxies:t.advanced?.ipAddress?.trustedProxies});if(e)return e}}return L()||fe()?rd:null}function od(e,t){return`${e}|${t}`}var sd=async()=>{let e=O(),t=e.context.requestStateAsyncStorage;if(t)return t;let n=await nu();return e.context.requestStateAsyncStorage??=new n,e.context.requestStateAsyncStorage};async function cd(){return(await sd()).getStore()!==void 0}async function ld(){let e=(await sd()).getStore();if(!e)throw Error("No request state found. Please make sure you are calling this function within a `runWithRequestState` callback.");return e}async function ud(e,t){return(await sd()).run(e,t)}function dd(e){let t=Object.freeze({});return{get ref(){return t},async get(){let n=await ld();if(!n.has(t)){let r=await e();return n.set(t,r),r}return n.get(t)},async set(e){(await ld()).set(t,e)}}}var fd=async()=>{let e=O(),t=e.context.adapterAsyncStorage;if(t)return t;let n=await nu();return e.context.adapterAsyncStorage??=new n,e.context.adapterAsyncStorage},pd=async e=>fd().then(t=>t.getStore()?.adapter||e).catch(()=>e),md=async(e,t)=>{let n=!1;return fd().then(async r=>{n=!0;let i=[],a,o,s=!1;try{a=await r.run({adapter:e,pendingHooks:i,isTransactionActive:!1},t)}catch(e){o=e,s=!0}for(let e of i)await e();if(s)throw o;return a}).catch(e=>{if(!n)return t();throw e})},hd=async(e,t,n)=>{let r=!1;return fd().then(async i=>{if(r=!0,i.getStore()?.isTransactionActive)return t();let a=ye(e)?.();a&&await a;let o=[],s,c,l=!1;try{s=await e.transaction(async e=>(o=[],i.run({adapter:e,pendingHooks:o,isTransactionActive:!0},t)))}catch(e){l=!0,c=e}let u=async e=>{for(let t of o)try{await t()}catch(t){if(!n?.onAfterCommitHookError){if(e===`throw`)throw t;try{_e.error(`Failed to run an after-commit hook for work that could not roll back`,t)}catch{}continue}try{await n.onAfterCommitHookError(t)}catch{}}};if(l)throw e.options?.adapterConfig.transaction===!1&&await u(`log`),c;return await u(`throw`),s}).catch(e=>{if(!r)return t();throw e})},gd=async(e,t)=>{let n=async()=>{try{await e()}catch(e){if(!t?.onError)throw e;await t.onError(e)}},r;try{r=await fd()}catch{return n()}let i=r.getStore();if(!i?.isTransactionActive)return n();i.pendingHooks.push(n)},{get:_d,set:vd}=dd(()=>null),yd=async()=>await _d(),{get:bd,set:xd}=dd(()=>null),Sd=async e=>{await xd({...await bd()??{},...e})},{get:Cd,set:wd}=dd(()=>!1);function Td(e){return!!e.database||!!e.secondaryStorage}function Ed(e){return!!e.database}function Dd(e){return Ed(e)}var Od=w({id:c(),createdAt:f().default(()=>new Date),updatedAt:f().default(()=>new Date)}),kd=Od.extend({userId:be(),expiresAt:f(),token:c(),ipAddress:c().nullish(),userAgent:c().nullish()}),Ad=Od.extend({email:c().transform(e=>e.toLowerCase()),emailVerified:v().default(!1),name:c(),image:c().nullish()});function jd(e,t){if(!e||!t)return e;let n=Object.entries(t).filter(([,{returned:e}])=>e===!1).map(([e])=>e);return Object.entries(structuredClone(e)).filter(([e])=>!n.includes(e)).reduce((e,[t,n])=>({...e,[t]:n}),{})}var Md=new WeakMap;function Nd(e,t,n){let r=`${t}:${n}`;Md.has(e)||Md.set(e,new Map);let i=Md.get(e);if(i.has(r))return i.get(r);let a=n===`output`?de(e)[t]?.fields??{}:{},o=t===`user`||t===`session`||t===`account`?e[t]?.additionalFields:void 0,s={...a,...o??{}};for(let n of e.plugins||[])n.schema&&n.schema[t]&&(s={...s,...n.schema[t].fields});return i.set(r,s),s}function Pd(e,t){return jd(t,Nd(e,`user`,`output`))}function Fd(e,t){let n=Nd(e,`user`,`output`),r={};for(let e in n){let i=n[e];i.returned!==!1&&(e in t&&t[e]!==void 0?r[e]=t[e]:i.defaultValue===void 0?i.required||(r[e]=null):r[e]=typeof i.defaultValue==`function`?i.defaultValue():i.defaultValue)}return`id`in t&&(r.id=t.id),r}function Id(e,t){return jd(t,Nd(e,`session`,`output`))}function Ld(e,t){let{accessToken:n,refreshToken:r,idToken:i,accessTokenExpiresAt:a,refreshTokenExpiresAt:o,password:s,...c}=jd(t,Nd(e,`account`,`output`));return c}function Rd(e,t){let n=t.action||`create`,r=t.fields,i=Object.create(null);for(let t in r)if(t in e){if(r[t].input===!1){if(r[t].defaultValue!==void 0&&n!==`update`){i[t]=r[t].defaultValue;continue}if(e[t])throw B.from(`BAD_REQUEST`,{...as.FIELD_NOT_ALLOWED,message:`${t} is not allowed to be set`});continue}if(r[t].validator?.input&&e[t]!==void 0){let n=r[t].validator.input[`~standard`].validate(e[t]);if(n instanceof Promise)throw B.from(`INTERNAL_SERVER_ERROR`,as.ASYNC_VALIDATION_NOT_SUPPORTED);if(`issues`in n&&n.issues)throw B.from(`BAD_REQUEST`,{...as.VALIDATION_ERROR,message:n.issues[0]?.message||`Validation Error`});i[t]=n.value;continue}if(r[t].transform?.input&&e[t]!==void 0){i[t]=r[t].transform?.input(e[t]);continue}i[t]=e[t]}else if(r[t].defaultValue!==void 0&&n===`create`){if(typeof r[t].defaultValue==`function`){i[t]=r[t].defaultValue();continue}i[t]=r[t].defaultValue}else if(r[t].required&&n===`create`)throw B.from(`BAD_REQUEST`,{...as.MISSING_FIELD,message:`${t} is required`});return i}function zd(e,t={},n){return Rd(t,{fields:Nd(e,`user`,`input`),action:n})}function Bd(e,t={},n){let r=Nd(e,`user`,`input`),i=Object.create(null);for(let e of Object.keys(t))r[e]?.input!==!1&&(i[e]=t[e]);return Rd(i,{fields:r,action:n})}function Vd(e,t,n){return Rd(t,{fields:Nd(e,`session`,`input`),action:n})}function Hd(e){let t=Nd(e,`session`,`input`),n={};for(let e in t)t[e].defaultValue!==void 0&&(n[e]=typeof t[e].defaultValue==`function`?t[e].defaultValue():t[e].defaultValue);return n}function Ud(e,t){if(!t)return e;for(let n in t){let r=t[n]?.modelName;r&&(e[n].modelName=r);for(let r in e[n].fields){let i=t[n]?.fields?.[r];i&&(e[n].fields[r].fieldName=i)}}return e}var Wd=(e,t=`ms`)=>new Date(Date.now()+(t===`sec`?e*1e3:e));function Gd(e){if(e.indexOf(`%`)===-1)return e;try{return decodeURIComponent(e)}catch{return e}}var Kd=`__Secure-`;function qd(e){if(!e)return[];let t=[],n=0,r=0;for(;r<e.length;){if(e[r]===`,`){let i=r+1;for(;i<e.length&&e[i]===` `;)i++;for(;i<e.length&&e[i]!==`=`&&e[i]!==`;`&&e[i]!==`,`;)i++;if(i<e.length&&e[i]===`=`){let i=e.slice(n,r).trim();for(i&&t.push(i),n=r+1;n<e.length&&e[n]===` `;)n++;r=n;continue}}r++}let i=e.slice(n).trim();return i&&t.push(i),t}function Jd(e){let t=new Map;return qd(e).forEach(e=>{let[n,...r]=e.split(`;`).map(e=>e.trim()),[i,...a]=(n||``).split(`=`),o=Zd(a.join(`=`));if(!i)return;let s={value:Gd(o)};r.forEach(e=>{let[t,...n]=e.split(`=`),r=n.join(`=`),i=t.trim().toLowerCase();switch(i){case`max-age`:s[`max-age`]=r?parseInt(r.trim(),10):void 0;break;case`expires`:s.expires=r?new Date(r.trim()):void 0;break;case`domain`:s.domain=r?r.trim():void 0;break;case`path`:s.path=r?r.trim():void 0;break;case`secure`:s.secure=!0;break;case`httponly`:s.httponly=!0;break;case`samesite`:s.samesite=r?r.trim().toLowerCase():void 0;break;case`partitioned`:s.partitioned=!0;break;default:s[i]=!r||r.trim()}}),t.set(i,s)}),t}var Yd=/^[\x21\x23-\x27\x2A\x2B\x2D\x2E\x30-\x39\x41-\x5A\x5E\x5F\x60\x61-\x7A\x7C\x7E]+$/,Xd=/^[\x20\x21\x23-\x3A\x3C-\x5B\x5D-\x7E]*$/;function Zd(e){return e.length<2||!e.startsWith(`"`)||!e.endsWith(`"`)?e:e.slice(1,-1)}function Qd(e){let t=0,n=e.length;for(;t<n;){let n=e.charCodeAt(t);if(n!==32&&n!==9)break;t++}for(;n>t;){let t=e.charCodeAt(n-1);if(t!==32&&t!==9)break;n--}return t===0&&n===e.length?e:e.slice(t,n)}function $d(e){let t=new Map;if(e.length<2)return t;for(let n of e.split(`;`)){let e=n.indexOf(`=`);if(e===-1)continue;let r=Qd(n.slice(0,e)),i=Zd(Qd(n.slice(e+1)));Yd.test(r)&&Xd.test(i)&&t.set(r,Gd(i))}return t}var ef=4050,tf=100;function nf(e,t){return ef-co(e,``,{...t}).length}function rf(e,t){let n=`${e}.`;if(!t.startsWith(n))return null;let r=t.slice(n.length),i=Number(r);return!Number.isSafeInteger(i)||i<0||String(i)!==r?null:i}function af(e,t){let n={},r=$d(t.headers?.get(`cookie`)||``);for(let[t,i]of r)(t===e||rf(e,t)!==null)&&(n[t]=i);return n}function of(e,t,n,r){let i=nf(`${t.name}.99`,t.attributes),a=i>0?Math.ceil(t.value.length/i):1/0;if(a<=1)return n[t.name]=t.value,[t];if(a>tf)return r.warn(`${e} cookie is too large to store even after chunking, so the cookie cache was skipped. Reduce the cached data size or avoid storing this data in cookies.`),[];let o=[];for(let e=0;e<a;e++){let r=`${t.name}.${e}`,a=e*i,s=t.value.substring(a,a+i);o.push({...t,name:r,value:s}),n[r]=s}return r.debug(`CHUNKING_${e.toUpperCase()}_COOKIE`,{message:`${e} cookie exceeds the ${ef} byte limit and was split into ${a} chunks.`,valueSize:t.value.length,chunkCount:a,chunkSizes:o.map(e=>e.value.length)}),o}function sf(e,t){let n={};for(let r in e)n[r]={name:r,value:``,attributes:{...t,maxAge:0}};return n}var cf=e=>(t,n,r)=>{let i=af(t,r),a=r.context.logger,o=()=>{let e=sf(i,n);for(let e in i)delete i[e];return e};return{chunk(r,s){let c=o(),l=of(e,{name:t,value:r,attributes:{...n,...s}},i,a);for(let e of l)c[e.name]=e;return Object.values(c)},clean(){return Object.values(o())},setCookies(e){for(let t of e)r.setCookie(t.name,t.value,t.attributes)}}},lf=cf(`Session`),uf=cf(`Account`);function df(e,t){let n=e.getCookie(t);if(n)return n;let r=[],i=e.headers?.get(`cookie`);if(!i)return null;for(let[e,n]of $d(i)){let i=rf(t,e);i!==null&&r.push({index:i,value:n})}return r.length>0?(r.sort((e,t)=>e.index-t.index),r.map(e=>e.value).join(``)):null}async function ff(e,t){let n=e.context.authCookies.accountData,r={maxAge:300,...n.attributes},i=await ji(t,e.context.secretConfig,`better-auth-account`,r.maxAge),a=uf(n.name,r,e);a.setCookies(a.chunk(i,r))}async function pf(e){let t=df(e,e.context.authCookies.accountData.name);if(t){let n=ue(await Ni(t,e.context.secretConfig,`better-auth-account`));if(n)return n}return null}var mf=s(w({disableCookieCache:xe().meta({description:`Disable cookie cache and fetch session from database`}).optional(),disableRefresh:xe().meta({description:`Disable session refresh. Useful for checking session status, without updating the session`}).optional()}));function hf(e){return!!e&&(typeof e==`object`||typeof e==`function`)&&typeof e.then==`function`}var gf=1e3,_f=gf*60,vf=_f*60,yf=vf*24,bf=yf*7,xf=yf*30,Sf=yf*365.25,Cf=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|months?|mo|years?|yrs?|y)(?: (ago|from now))?$/i;function wf(e){let t=Cf.exec(e);if(!t||t[4]&&t[1])throw TypeError(`Invalid time string format: "${e}". Use formats like "7d", "30m", "1 hour", etc.`);let n=parseFloat(t[2]),r=t[3].toLowerCase(),i;switch(r){case`years`:case`year`:case`yrs`:case`yr`:case`y`:i=n*Sf;break;case`months`:case`month`:case`mo`:i=n*xf;break;case`weeks`:case`week`:case`w`:i=n*bf;break;case`days`:case`day`:case`d`:i=n*yf;break;case`hours`:case`hour`:case`hrs`:case`hr`:case`h`:i=n*vf;break;case`minutes`:case`minute`:case`mins`:case`min`:case`m`:i=n*_f;break;case`seconds`:case`second`:case`secs`:case`sec`:case`s`:i=n*gf;break;default:throw TypeError(`Unknown time unit: "${r}"`)}return t[1]===`-`||t[4]===`ago`?-i:i}function Tf(e){return wf(e)}function Ef(e){return Math.round(wf(e)/1e3)}var Df=C({session:kd.loose(),user:Ad.loose(),updatedAt:d(),version:c().optional()}),Of=w({session:i(c(),o()),expiresAt:d(),signature:c()});function kf(e){let t=ue(e);if(t===null)return null;let n=Df.safeParse(t);return n.success?n.data:(_e.warn(`Cookie cache payload failed schema validation`,{issues:n.error.issues.map(({code:e,path:t})=>({code:e,path:t}))}),null)}function Af(e){let t=Of.safeParse(e);return t.success?t.data:null}var jf=new Map,Mf=new TextEncoder,Nf={decode:(e,t=`utf-8`)=>(jf.has(t)||jf.set(t,new TextDecoder(t)),jf.get(t).decode(e)),encode:e=>Mf.encode(e)},Pf=(e=`SHA-256`,t=`none`)=>{let n={importKey:async(t,n)=>Ii().importKey(`raw`,D(t),{name:`HMAC`,hash:{name:e}},!1,[n]),sign:async(e,r)=>{typeof e==`string`&&(e=await n.importKey(e,`sign`));let i=await Ii().sign(`HMAC`,e,D(r));return t===`hex`?he.encode(i):t===`base64`?te.encode(i):t===`base64url`||t===`base64urlnopad`?ve.encode(i,{padding:t!==`base64urlnopad`}):i},verify:async(e,r,i)=>(typeof e==`string`&&(e=await n.importKey(e,`verify`)),t===`hex`&&(i=typeof i==`string`?he.toBytes(i):i),(t===`base64`||t===`base64url`||t===`base64urlnopad`)&&(i=await te.decode(i)),Ii().verify(`HMAC`,e,D(i),D(r)))};return n};function Ff(e){let t=typeof e.baseURL==`string`?e.baseURL:void 0,n=typeof e.baseURL==`object`&&e.baseURL!==null?e.baseURL.protocol:void 0,r=(e.advanced?.useSecureCookies===void 0?n===`https`||n!==`http`&&(t?t.startsWith(`https://`):I):e.advanced?.useSecureCookies)?Kd:``,i=!!e.advanced?.crossSubDomainCookies?.enabled,a=i?e.advanced?.crossSubDomainCookies?.domain||(t?new URL(t).hostname:void 0):void 0;if(i&&!a&&!ju(e.baseURL))throw new V(`baseURL is required when crossSubdomainCookies are enabled.`);function o(t,n={}){let o=e.advanced?.cookiePrefix||`better-auth`,s=e.advanced?.cookies?.[t]?.name||`${o}.${t}`,c=e.advanced?.cookies?.[t]?.attributes??{};return{name:`${r}${s}`,attributes:{secure:!!r,sameSite:`lax`,path:`/`,httpOnly:!0,...i?{domain:a}:{},...e.advanced?.defaultCookieAttributes,...n,...c}}}return o}function If(e){let t=Ff(e),n=t(`session_token`,{maxAge:e.session?.expiresIn||Ef(`7d`)}),r=t(`session_data`,{maxAge:e.session?.cookieCache?.maxAge||300}),i=t(`account_data`,{maxAge:e.session?.cookieCache?.maxAge||300}),a=t(`dont_remember`);return{sessionToken:{name:n.name,attributes:n.attributes},sessionData:{name:r.name,attributes:r.attributes},dontRememberToken:{name:a.name,attributes:a.attributes},accountData:{name:i.name,attributes:i.attributes}}}async function Lf(e,t,n){if(!e.context.options.session?.cookieCache?.enabled)return;let r=jd(t.session,e.context.options.session?.additionalFields),i=Pd(e.context.options,t.user),a=e.context.options.session?.cookieCache?.version,o=`1`;if(a){if(typeof a==`string`)o=a;else if(typeof a==`function`){let e=a(t.session,t.user);o=hf(e)?await e:e}}let s={session:r,user:i,updatedAt:Date.now(),version:o},c={...e.context.authCookies.sessionData.attributes,maxAge:n?void 0:e.context.authCookies.sessionData.attributes.maxAge},l=Wd(c.maxAge||60,`sec`).getTime(),u=e.context.options.session?.cookieCache?.strategy||`compact`,d;if(u===`jwe`)d=await ji(s,e.context.secretConfig,`better-auth-session`,c.maxAge||300);else if(u===`jwt`){let t=e.context.sessionConfig.cookieCacheSigner;d=t?await t.sign(e,s,c.maxAge||300):await Si(s,e.context.secret,c.maxAge||300)}else d=ve.encode(JSON.stringify({session:s,expiresAt:l,signature:await Pf(`SHA-256`,`base64urlnopad`).sign(e.context.secret,JSON.stringify({...s,expiresAt:l}))}),{padding:!1});let f=lf(e.context.authCookies.sessionData.name,c,e);if(f.setCookies(f.chunk(d,c)),e.context.options.account?.storeAccountCookie&&!Vf(e,e.context.authCookies.accountData.name)){let n=await pf(e);if(n){if(!Dd(e.context.options)||n.userId===t.user.id)await ff(e,n);else{Hf(e,e.context.authCookies.accountData);let t=uf(e.context.authCookies.accountData.name,e.context.authCookies.accountData.attributes,e);t.setCookies(t.clean())}}}}async function Rf(e,t){let n=e.context.options.session?.cookieCache?.strategy||`compact`;if(n===`jwe`){let n=await Ni(t,e.context.secretConfig,`better-auth-session`),r=kf(n);return r?{session:r,expiresAt:n?.exp?n.exp*1e3:Date.now()}:null}if(n===`jwt`){let n=e.context.sessionConfig.cookieCacheSigner;if(n){let r=await n.verify(e,t);return r?{session:r.payload,expiresAt:r.expiresAt}:null}let r=await Ci(t,e.context.secret),i=kf(r);return i?{session:i,expiresAt:r?.exp?r.exp*1e3:Date.now()}:null}let r=Af(ue(Nf.decode(ve.decode(t))));if(!r||!await Pf(`SHA-256`,`base64urlnopad`).verify(e.context.secret,JSON.stringify({...r.session,expiresAt:r.expiresAt}),r.signature))return null;let i=kf(r.session);return i?{session:i,expiresAt:r.expiresAt}:null}async function zf(e,t,n,r){let i=await e.getSignedCookie(e.context.authCookies.dontRememberToken.name,e.context.secret);n=n===void 0?!!i:n;let a=e.context.authCookies.sessionToken.attributes,o=n?void 0:e.context.sessionConfig.expiresIn;await e.setSignedCookie(e.context.authCookies.sessionToken.name,t.session.token,e.context.secret,{...a,maxAge:o,...r}),n&&await e.setSignedCookie(e.context.authCookies.dontRememberToken.name,`true`,e.context.secret,e.context.authCookies.dontRememberToken.attributes),await Lf(e,t,n),e.context.setNewSession(t)}function Bf(e,t){let n=e,r=new Set;n.responseHeaders&&r.add(n.responseHeaders),n.context?.responseHeaders&&r.add(n.context.responseHeaders);let i=`${t}=`,a=`${t}.`;for(let e of r){let t=typeof e.getSetCookie==`function`?e.getSetCookie():qd(e.get(`set-cookie`)||``);if(!t.length)continue;let n=t.filter(e=>!e.startsWith(i)&&!e.startsWith(a));if(n.length!==t.length){e.delete(`set-cookie`);for(let t of n)e.append(`set-cookie`,t)}}}function Vf(e,t){let n=e,r=new Set;n.responseHeaders&&r.add(n.responseHeaders),n.context?.responseHeaders&&r.add(n.context.responseHeaders);let i=`${t}=`,a=`${t}.`;for(let e of r)if((typeof e.getSetCookie==`function`?e.getSetCookie():qd(e.get(`set-cookie`)||``)).some(e=>e.startsWith(i)||e.startsWith(a)))return!0;return!1}function Hf(e,t){Bf(e,t.name),e.setCookie(t.name,``,{...t.attributes,maxAge:0})}function Uf(e,t){if(Hf(e,e.context.authCookies.sessionToken),Hf(e,e.context.authCookies.sessionData),e.context.options.account?.storeAccountCookie){Hf(e,e.context.authCookies.accountData);let t=uf(e.context.authCookies.accountData.name,e.context.authCookies.accountData.attributes,e),n=t.clean();t.setCookies(n)}e.context.oauthConfig.storeStateStrategy===`cookie`&&Hf(e,e.context.createAuthCookie(`oauth_state`));let n=lf(e.context.authCookies.sessionData.name,e.context.authCookies.sessionData.attributes,e),r=n.clean();n.setCookies(r),t||Hf(e,e.context.authCookies.dontRememberToken)}var Wf=()=>X(`/get-session`,{method:[`GET`,`POST`],operationId:`getSession`,query:mf,requireHeaders:!0,metadata:{openapi:{operationId:`getSession`,description:`Get the current session`,responses:{200:{description:`Success`,content:{"application/json":{schema:{type:[`object`,`null`],properties:{session:{$ref:`#/components/schemas/Session`},user:{$ref:`#/components/schemas/User`}},required:[`session`,`user`]}}}}}}}},async e=>{e.setHeader(`cache-control`,`no-store`),e.setHeader(`pragma`,`no-cache`);let t=e.context.options.session?.deferSessionRefresh,n=e.method===`POST`;if(n&&!t)throw B.from(`METHOD_NOT_ALLOWED`,as.METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED);try{let r=e.context.options.session?.cookieCache?.enabled===!0,i=await e.getSignedCookie(e.context.authCookies.sessionToken.name,e.context.secret);if(!i&&r)return null;let a=df(e,e.context.authCookies.sessionData.name);if(a&&!r){let t=lf(e.context.authCookies.sessionData.name,e.context.authCookies.sessionData.attributes,e);t.setCookies(t.clean())}if(!i)return null;let o=r&&!e.query?.disableCookieCache,s=o&&a?await Rf(e,a):null;o&&a&&!s&&Hf(e,e.context.authCookies.sessionData);let c=await e.getSignedCookie(e.context.authCookies.dontRememberToken.name,e.context.secret);if(s?.session){let t=s.session,n=t.session.token!==i;if(!n){let r=e.context.options.session?.cookieCache?.version,i=`1`;if(r){if(typeof r==`string`)i=r;else if(typeof r==`function`){let e=r(t.session,t.user);i=e instanceof Promise?await e:e}}n=(t.version||`1`)!==i}if(!n){let e=Date.now(),r=new Date(t.session.expiresAt).getTime();n=s.expiresAt<e||!Number.isFinite(r)||r<e}if(n)Hf(e,e.context.authCookies.sessionData);else{let n=e.context.sessionConfig.cookieRefreshCache;if(n===!1){e.context.session=t;let n=Id(e.context.options,{...t.session,expiresAt:new Date(t.session.expiresAt),createdAt:new Date(t.session.createdAt),updatedAt:new Date(t.session.updatedAt)}),r=Pd(e.context.options,{...t.user,createdAt:new Date(t.user.createdAt),updatedAt:new Date(t.user.updatedAt)});return e.json({session:n,user:r})}let r=s.expiresAt-Date.now(),i=n.updateAge*1e3,a=await Cd();if(r<i&&!a){let n={session:{...t.session},user:t.user,updatedAt:Date.now()};await Lf(e,n,!1);let r=e.context.authCookies.sessionToken.attributes,i=c?void 0:e.context.sessionConfig.expiresIn;await e.setSignedCookie(e.context.authCookies.sessionToken.name,t.session.token,e.context.secret,{...r,maxAge:i});let a=Id(e.context.options,{...n.session,expiresAt:new Date(n.session.expiresAt),createdAt:new Date(n.session.createdAt),updatedAt:new Date(n.session.updatedAt)}),o=Pd(e.context.options,{...n.user,createdAt:new Date(n.user.createdAt),updatedAt:new Date(n.user.updatedAt)});return e.context.session={session:a,user:o},e.json({session:a,user:o})}let o=Id(e.context.options,{...t.session,expiresAt:new Date(t.session.expiresAt),createdAt:new Date(t.session.createdAt),updatedAt:new Date(t.session.updatedAt)}),l=Pd(e.context.options,{...t.user,createdAt:new Date(t.user.createdAt),updatedAt:new Date(t.user.updatedAt)});return e.context.session={session:o,user:l},e.json({session:o,user:l})}}let l=await e.context.internalAdapter.findSession(i);if(e.context.session=l,!l||l.session.expiresAt<new Date)return Uf(e),l&&(!t||n)&&await e.context.internalAdapter.deleteSession(l.session.token),e.json(null);if(c||e.query?.disableRefresh){let t=Id(e.context.options,l.session),n=Pd(e.context.options,l.user);return e.json({session:t,user:n})}let u=e.context.sessionConfig.expiresIn,d=e.context.sessionConfig.updateAge,f=l.session.expiresAt.valueOf()-u*1e3+d*1e3<=Date.now(),p=e.query?.disableRefresh||e.context.options.session?.disableSessionRefresh,m=await Cd(),h=f&&!p&&!m;if(t&&!n){await Lf(e,l,!!c);let t=Id(e.context.options,l.session),n=Pd(e.context.options,l.user);return e.json({session:t,user:n,needsRefresh:h})}if(h){let t=await e.context.internalAdapter.updateSession(l.session.token,{expiresAt:Wd(e.context.sessionConfig.expiresIn,`sec`),updatedAt:new Date});if(!t)throw Uf(e),B.from(`UNAUTHORIZED`,as.FAILED_TO_GET_SESSION);let n=e.context.sessionConfig.expiresIn;await zf(e,{session:t,user:l.user},!1,{maxAge:n});let r=Id(e.context.options,t),i=Pd(e.context.options,l.user);return e.json({session:r,user:i})}await Lf(e,l,!!c);let g=Id(e.context.options,l.session),_=Pd(e.context.options,l.user);return e.json({session:g,user:_})}catch(t){throw Ql(t)?t:(e.context.logger.error(`INTERNAL_SERVER_ERROR`,t),B.from(`INTERNAL_SERVER_ERROR`,as.FAILED_TO_GET_SESSION))}}),Gf=e=>Td(e.context.options),Z=async(e,t)=>{if(e.context.session)return e.context.session;let n=await Wf()({...e,method:`GET`,asResponse:!1,headers:e.headers,returnHeaders:!0,returnStatus:!1,query:{...t,...e.query,disableCookieCache:t?.disableCookieCache||e.query?.disableCookieCache,disableRefresh:t?.disableRefresh||e.query?.disableRefresh}}).catch(()=>null);return n?(n.headers&&n.headers.forEach((t,n)=>{let r=n.toLowerCase();r!==`cache-control`&&r!==`pragma`&&(r===`set-cookie`?e.responseHeaders.append(n,t):e.responseHeaders.set(n,t))}),e.context.session=n.response,n.response):(e.context.session=null,null)},Kf=async e=>Gf(e)?(e.context.session=null,Z(e,{disableCookieCache:!0})):Z(e),qf=du(async e=>{let t=await Z(e);if(!t?.session)throw B.from(`UNAUTHORIZED`,{message:`Unauthorized`,code:`UNAUTHORIZED`});return{session:t}}),Jf=du(async e=>{let t=await Kf(e);if(!t?.session)throw B.from(`UNAUTHORIZED`,{message:`Unauthorized`,code:`UNAUTHORIZED`});return{session:t}});du(async e=>{let t=await Z(e);if(!t?.session&&(e.request||e.headers))throw B.from(`UNAUTHORIZED`,{message:`Unauthorized`,code:`UNAUTHORIZED`});return{session:t}});var Yf=du(async e=>{let t=await Z(e);if(!t?.session)throw B.from(`UNAUTHORIZED`,{message:`Unauthorized`,code:`UNAUTHORIZED`});if(e.context.sessionConfig.freshAge!==0){let n=new Date(t.session.createdAt).getTime(),r=e.context.sessionConfig.freshAge*1e3;if(Date.now()-n>=r)throw B.from(`FORBIDDEN`,as.SESSION_NOT_FRESH)}return{session:t}}),Xf=()=>X(`/list-sessions`,{method:`GET`,operationId:`listUserSessions`,use:[Yf],requireHeaders:!0,metadata:{openapi:{operationId:`listUserSessions`,description:`List all active sessions for the user`,responses:{200:{description:`Success`,content:{"application/json":{schema:{type:`array`,items:{$ref:`#/components/schemas/Session`}}}}}}}}},async e=>{try{let t=(await e.context.internalAdapter.listSessions(e.context.session.user.id,{onlyActiveSessions:!0})).filter(e=>e.expiresAt>new Date);return e.json(t.map(t=>Id(e.context.options,t)))}catch(t){throw e.context.logger.error(t),e.error(`INTERNAL_SERVER_ERROR`)}}),Zf=X(`/revoke-session`,{method:`POST`,body:w({token:c().meta({description:`The token to revoke`})}),use:[Jf],requireHeaders:!0,metadata:{openapi:{description:`Revoke a single session`,requestBody:{content:{"application/json":{schema:{type:`object`,properties:{token:{type:`string`,description:`The token to revoke`}},required:[`token`]}}}},responses:{200:{description:`Success`,content:{"application/json":{schema:{type:`object`,properties:{status:{type:`boolean`,description:`Indicates if the session was revoked successfully`}},required:[`status`]}}}}}}}},async e=>{let t=e.body.token;if((await e.context.internalAdapter.findSession(t))?.session.userId===e.context.session.user.id)try{await e.context.internalAdapter.deleteSession(t)}catch(t){throw e.context.logger.error(t&&typeof t==`object`&&`name`in t?t.name:``,t),B.from(`INTERNAL_SERVER_ERROR`,{message:`Internal Server Error`,code:`INTERNAL_SERVER_ERROR`})}return e.json({status:!0})}),Qf=X(`/revoke-sessions`,{method:`POST`,use:[Jf],requireHeaders:!0,metadata:{openapi:{description:`Revoke all sessions for the user`,responses:{200:{description:`Success`,content:{"application/json":{schema:{type:`object`,properties:{status:{type:`boolean`,description:`Indicates if all sessions were revoked successfully`}},required:[`status`]}}}}}}}},async e=>{try{await e.context.internalAdapter.deleteUserSessions(e.context.session.user.id)}catch(t){throw e.context.logger.error(t&&typeof t==`object`&&`name`in t?t.name:``,t),B.from(`INTERNAL_SERVER_ERROR`,{message:`Internal Server Error`,code:`INTERNAL_SERVER_ERROR`})}return e.json({status:!0})}),$f=X(`/revoke-other-sessions`,{method:`POST`,requireHeaders:!0,use:[Jf],metadata:{openapi:{description:`Revoke all other sessions for the user except the current one`,responses:{200:{description:`Success`,content:{"application/json":{schema:{type:`object`,properties:{status:{type:`boolean`,description:`Indicates if all other sessions were revoked successfully`}},required:[`status`]}}}}}}}},async e=>{let t=e.context.session;if(!t.user)throw B.from(`UNAUTHORIZED`,{message:`Unauthorized`,code:`UNAUTHORIZED`});let n=(await e.context.internalAdapter.listSessions(t.user.id)).filter(e=>e.expiresAt>new Date).filter(t=>t.token!==e.context.session.session.token);return await Promise.all(n.map(t=>e.context.internalAdapter.deleteSession(t.token))),e.json({status:!0})}),ep=`better_auth.operation_id`,tp=`better_auth.hook.type`,np=`better_auth.context`;function rp(e){if(typeof e!=`object`||!e)return!1;let t=Object.getPrototypeOf(e);return t!==null&&t!==Object.prototype&&Object.getPrototypeOf(t)!==null||Symbol.iterator in e?!1:Symbol.toStringTag in e?Object.prototype.toString.call(e)===`[object Module]`:!0}function ip(e,t,n=`.`,r){if(!rp(t))return ip(e,{},n,r);let i={...t};for(let t of Object.keys(e)){if(t===`__proto__`||t===`constructor`)continue;let a=e[t];a!=null&&(r&&r(i,t,a,n)||(i[t]=Array.isArray(a)&&Array.isArray(i[t])?[...a,...i[t]]:rp(a)&&rp(i[t])?ip(a,i[t],(n?`${n}.`:``)+t.toString(),r):a))}return i}function ap(e){return(...t)=>t.reduce((t,n)=>ip(t,n,``,e),{})}var op=ap(),sp=new Set([`metadata.google.internal`,`metadata.goog`,`metadata`,`instance-data`,`instance-data.ec2.internal`]);function cp(e){return e.length>=2&&e.startsWith(`[`)&&e.endsWith(`]`)?e.slice(1,-1):e}function lp(e){if(e.startsWith(`[`)){let t=e.indexOf(`]`);return t===-1?e:e.slice(0,t+1)}let t=e.indexOf(`:`);return t===-1||e.indexOf(`:`,t+1)!==-1?e:e.slice(0,t)}function up(e){let t=e.indexOf(`%`);return t===-1?e:e.slice(0,t)}function dp(e){return e.replace(/\.+$/,``)}function fp(e){return/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(e)}function pp(e){let t=e.split(`.`);return(Number(t[0])<<24|Number(t[1])<<16|Number(t[2])<<8|Number(t[3]))>>>0}function mp(e,t,n){if(n===0)return!0;let r=n===32?4294967295:-1<<32-n>>>0;return(e&r)===(t&r)}function hp(e){if(e===`0.0.0.0`)return`unspecified`;if(e===`255.255.255.255`)return`broadcast`;let t=pp(e);return mp(t,pp(`127.0.0.0`),8)?`loopback`:mp(t,pp(`10.0.0.0`),8)||mp(t,pp(`172.16.0.0`),12)||mp(t,pp(`192.168.0.0`),16)?`private`:mp(t,pp(`169.254.0.0`),16)?`linkLocal`:mp(t,pp(`100.64.0.0`),10)?`sharedAddressSpace`:mp(t,pp(`192.0.2.0`),24)||mp(t,pp(`198.51.100.0`),24)||mp(t,pp(`203.0.113.0`),24)?`documentation`:mp(t,pp(`198.18.0.0`),15)?`benchmarking`:mp(t,pp(`224.0.0.0`),4)?`multicast`:mp(t,pp(`0.0.0.0`),8)||mp(t,pp(`192.0.0.0`),24)||mp(t,pp(`192.88.99.0`),24)||mp(t,pp(`240.0.0.0`),4)?`reserved`:`public`}function gp(e,t,n={}){let r=t*5,i=Number.parseInt(e.slice(r,r+4),16),a=Number.parseInt(e.slice(r+5,r+9),16);if(!Number.isFinite(i)||!Number.isFinite(a))return null;let o=(i<<16|a)>>>0;return n.xor&&(o=(o^4294967295)>>>0),`${o>>>24&255}.${o>>>16&255}.${o>>>8&255}.${o&255}`}function _p(e){if(e===`0000:0000:0000:0000:0000:0000:0000:0000`)return`unspecified`;if(e===`0000:0000:0000:0000:0000:0000:0000:0001`)return`loopback`;let t=Number.parseInt(e.slice(0,2),16),n=Number.parseInt(e.slice(2,4),16);if(t===255)return`multicast`;if(t===254&&(n&192)==128)return`linkLocal`;if(t===254&&(n&192)==192)return`reserved`;if((t&254)==252)return`private`;if(e.startsWith(`2001:0db8:`))return`documentation`;if(e.startsWith(`2001:0002:0000:`))return`benchmarking`;if(e.startsWith(`2002:`)){let t=gp(e,1);return t&&hp(t)!==`public`?`reserved`:`public`}if(e.startsWith(`0064:ff9b:0000:0000:0000:0000:`)){let t=gp(e,6);return t&&hp(t),`reserved`}if(e.startsWith(`0064:ff9b:0001:`))return`reserved`;if(e.startsWith(`2001:0000:`)){let t=gp(e,6,{xor:!0});return t&&hp(t),`reserved`}return e.startsWith(`0100:0000:0000:0000:`)?`reserved`:e.startsWith(`3fff:0`)?`documentation`:e.startsWith(`5f00:`)||e.startsWith(`0000:0000:0000:0000:0000:0000:`)?`reserved`:`public`}function vp(e){let t=dp(up(cp(lp(e.trim())))).toLowerCase();if(t===``)return{kind:`reserved`,literal:`fqdn`,canonical:``};if(!Wu(t))return t===`localhost`||t.endsWith(`.localhost`)?{kind:`localhost`,literal:`fqdn`,canonical:t}:sp.has(t)?{kind:`cloudMetadata`,literal:`fqdn`,canonical:t}:{kind:`public`,literal:`fqdn`,canonical:t};if(fp(t))return{kind:hp(t),literal:`ipv4`,canonical:t};let n=Xu(t,{ipv6Subnet:128});return fp(n)?{kind:hp(n),literal:`ipv4`,canonical:n}:{kind:_p(n),literal:`ipv6`,canonical:n}}function yp(e){return vp(e).kind===`loopback`}function bp(e){let t=vp(e).kind;return t===`loopback`||t===`localhost`}function xp(e){return vp(e).kind===`public`}var Sp=ap((e,t,n)=>{if(Array.isArray(e[t])&&Array.isArray(n))return e[t]=n,!0}),Cp=new WeakMap;function wp(e,t){let n=e.options;return n?.operationId??n?.metadata?.openapi?.operationId??t??e.path??`/:virtual`}function Tp(e,t){t&&t.forEach((t,n)=>{e.responseHeaders?n.toLowerCase()===`set-cookie`?e.responseHeaders.append(n,t):e.responseHeaders.set(n,t):e.responseHeaders=new Headers({[n]:t})})}function Ep(e){let t=e[F],n=e.headers&&e.headers!==t?new Headers(e.headers):null;if(!t&&!n)return null;let r=new Headers;return t?.forEach((e,t)=>{r.append(t,e)}),n?.forEach((e,t)=>{t.toLowerCase()===`set-cookie`?r.append(t,e):r.set(t,e)}),r}async function Dp(e,t,n,r){let i=le(e.context.options),a={};for(let o of t){let t=!1;try{t=o.matcher(e)}catch(t){let n=Cp.get(o.handler)??`unknown`;throw e.context.logger.error(`An error occurred during ${n} hook matcher execution:`,t),new B(`INTERNAL_SERVER_ERROR`,{message:`An error occurred during hook matcher execution. Check the logs for more details.`})}if(!t)continue;let s=Cp.get(o.handler)??`unknown`,c=n.path??`/:virtual`,l=await i(`hook before ${c} ${s}`,{[tp]:`before`,[pe]:c,[np]:s,[ep]:r},()=>o.handler({...e,returnHeaders:!0})).catch(t=>{throw Ql(t)&&ne(e.context.logger.level,`debug`)&&(t.stack=t.errorStack),t});Tp(e.context,l?.headers);let u=l?.response;if(u&&typeof u==`object`){if(`context`in u&&typeof u.context==`object`){let{headers:e,...t}=u.context;e instanceof Headers&&(a.headers?e.forEach((e,t)=>{a.headers?.set(t,e)}):a.headers=e),a=Sp(t,a);continue}return u}}return{context:a}}async function Op(e,t,n,r){let i=le(e.context.options);for(let a of t){if(!a.matcher(e))continue;let t=Cp.get(a.handler)??`unknown`,o=n.path??`/:virtual`,s=await i(`hook after ${o} ${t}`,{[tp]:`after`,[pe]:o,[np]:t,[ep]:r},()=>a.handler(e)).catch(t=>{if(Ql(t))return ne(e.context.logger.level,`debug`)&&(t.stack=t.errorStack),{response:t,headers:Ep(t)};throw t});Tp(e.context,s.headers),s.response!==void 0&&(e.context.returned=s.response)}return{response:e.context.returned,headers:e.context.responseHeaders}}function kp(e){let t=e.options.plugins||[],n=[],r=[],i=e.options.hooks?.before;i&&(Cp.set(i,`user`),n.push({matcher:()=>!0,handler:i}));let a=e.options.hooks?.after;a&&(Cp.set(a,`user`),r.push({matcher:()=>!0,handler:a}));let o=t.flatMap(e=>(e.hooks?.before??[]).map(t=>(Cp.set(t.handler,`plugin:${e.id}`),t))),s=t.flatMap(e=>(e.hooks?.after??[]).map(t=>(Cp.set(t.handler,`plugin:${e.id}`),t)));return o.length&&n.push(...o),s.length&&r.push(...s),{beforeHooks:n,afterHooks:r}}async function Ap(e,t){let n=le(t.context.options),r=t.operationId??wp(e),i=e.path??`/:virtual`,a=e.options?.method,o=Array.isArray(a)?a[0]:a,s=t.method??t.request?.method??o??`?`,c=t.asResponse??Mu(t.request),l={...t,context:{...t.context,returned:void 0,responseHeaders:void 0,session:t.context.session??null},path:e.path,headers:t.headers?new Headers(t.headers):void 0};return n(`${s} ${i}`,{[pe]:i,[ep]:r},async()=>su(l,async()=>{let{beforeHooks:a,afterHooks:o}=kp(l.context),s=await Dp(l,a,e,r);if(`context`in s&&s.context&&typeof s.context==`object`){let{headers:e,...t}=s.context;if(e){l.headers||(l.headers=new Headers);let t=l.headers;e.forEach((e,n)=>{t.set(n,e)})}l=Sp(t,l)}else if(s){let e=l.context.responseHeaders;return c?bo(s,{headers:e}):t.returnHeaders?{headers:e,response:s}:s}l.asResponse=!1,l.returnHeaders=!0,l.returnStatus=!0;let u=await su(l,()=>n(`handler ${i}`,{[pe]:i,[ep]:r},()=>e(l))).catch(e=>{if(Ql(e))return{response:e,status:e.statusCode,headers:Ep(e)};throw e});if(u instanceof Response)return u;l.context.returned=u.response,l.context.responseHeaders=u.headers??void 0;let d=await Op(l,o,e,r);if(d.response!==void 0&&(u.response=d.response),u.headers=d.headers??u.headers,Ql(u.response)&&ne(l.context.logger.level,`debug`)&&(u.response.stack=u.response.errorStack),Ql(u.response)&&!c)throw u.headers&&Object.defineProperty(u.response,F,{enumerable:!1,configurable:!0,writable:!1,value:u.headers}),u.response;return c?bo(u.response,{headers:u.headers??void 0,status:u.status}):t.returnHeaders?t.returnStatus?{headers:u.headers,response:u.response,status:u.status}:{headers:u.headers,response:u.response}:t.returnStatus?{response:u.response,status:u.status}:u.response}))}var jp=/^[a-z](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/i,Mp=new Set([`http:`,`https:`,`ws:`,`wss:`,`file:`,`ftp:`,`mailto:`,`javascript:`,`data:`,`vbscript:`,`blob:`,`about:`,`view-source:`]);function Np(e){let t=e.protocol.slice(0,-1),n=e.href.slice(e.protocol.length);return e.protocol!==`http:`&&e.protocol!==`https:`&&e.host.length===0&&n.startsWith(`/`)&&!n.startsWith(`//`)&&jp.test(t)}function Pp(e){return Mp.has(e.protocol)||e.host.length===0?!1:e.pathname.startsWith(`/`)}function Fp(e){return Np(e)||Pp(e)}var Q=_().superRefine((e,n)=>{let r;try{r=new URL(e)}catch{return n.addIssue({code:`custom`,message:`URL must be parseable`,fatal:!0}),t}Vu.includes(r.protocol)?n.addIssue({code:`custom`,message:`URL cannot use javascript:, data:, or vbscript: scheme`}):(e.includes(`#`)&&n.addIssue({code:`custom`,message:`Redirect URI must not contain a fragment component`}),r.protocol===`http:`&&!bp(r.host)&&n.addIssue({code:`custom`,message:`Redirect URI must use HTTPS (HTTP allowed only for loopback hosts)`}))}),Ip=(e,t)=>({getAllKeys:async n=>t?.adapter?.getJwks?await t.adapter.getJwks(n):await(await pd(e)).findMany({model:`jwks`}),getLatestKey:async n=>{let r=new Date,i=e=>!e.expiresAt||e.expiresAt>r;return t?.adapter?.getJwks?(await t.adapter.getJwks(n))?.filter(i).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]:(await(await pd(e)).findMany({model:`jwks`}))?.filter(i).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]},getKeyById:async(n,r)=>t?.adapter?.getJwks?(await t.adapter.getJwks(n))?.find(e=>e.id===r):await(await pd(e)).findOne({model:`jwks`,where:[{field:`id`,value:r}]})??void 0,getLatestKeyByAlg:async(n,r)=>{let i=t?.adapter?.getJwks?await t.adapter.getJwks(n):await(await pd(e)).findMany({model:`jwks`});if(!i)return;let a=t?.jwks?.keyPairConfig?.alg??`EdDSA`,o=new Date;return i.filter(e=>e.alg===r||e.alg==null&&a===r).filter(e=>!e.expiresAt||e.expiresAt>o).sort((e,t)=>t.createdAt.getTime()-e.createdAt.getTime())[0]},createJwk:async(n,r)=>t?.adapter?.createJwk?await t.adapter.createJwk(r,n):await(await pd(e)).create({model:`jwks`,data:{...r,createdAt:new Date}})});function Lp(e,t){return typeof e==`number`?e:e instanceof Date?Math.floor(e.getTime()/1e3):t+Ef(e)}async function Rp(e){let{alg:t,...n}=e?.jwks?.keyPairConfig??{alg:`EdDSA`,crv:`Ed25519`},{publicKey:r,privateKey:i}=await xi(t,{...n,extractable:!0});return{publicWebKey:await ui(r),privateWebKey:await ui(i),alg:t,cfg:n}}async function zp(e,t){let{publicWebKey:n,privateWebKey:r,alg:i,cfg:a}=await Rp(t),o=a&&`crv`in a?a.crv:void 0,s=typeof n.crv==`string`?n.crv:void 0,c=o??s,l=JSON.stringify(r),u=!t?.jwks?.disablePrivateKeyEncryption,d={alg:i,...c?{crv:c}:{},publicKey:JSON.stringify(n),privateKey:u?JSON.stringify(await Ha({key:e.context.secretConfig,data:l})):l,createdAt:new Date,...t?.jwks?.rotationInterval?{expiresAt:new Date(Date.now()+t.jwks.rotationInterval*1e3)}:{}};return await Ip(e.context.adapter,t).createJwk(e,d)}async function Bp(e,t,n){if(t?.jwt?.sign)return null;let r=Ip(e.context.adapter,t),i;if(n?.signingKeyId!==void 0){if(i=await r.getKeyById(e,n.signingKeyId),!i)throw new V(`signJWT: signingKeyId "${n.signingKeyId}" not found in JWKS. The key must be provisioned before it can be referenced.`);if(n.signingAlgorithm!==void 0){let e=t?.jwks?.keyPairConfig?.alg??`EdDSA`;if((i.alg??e)!==n.signingAlgorithm)throw new V(`signJWT: signingKeyId "${n.signingKeyId}" has alg "${i.alg??`unset (inherits keyPairConfig.alg "${e}")`}" but signingAlgorithm was set to "${n.signingAlgorithm}".`)}}else if(n?.signingAlgorithm!==void 0){if(i=await r.getLatestKeyByAlg(e,n.signingAlgorithm),!i){let r=t?.jwks?.keyPairConfig?.alg??`EdDSA`,a=t?.jwks?.keyPairConfigs?.find(e=>e.alg===n.signingAlgorithm),o=r===n.signingAlgorithm;if(a||o)i=await zp(e,{...t,jwks:{...t?.jwks,keyPairConfig:a??t?.jwks?.keyPairConfig}});else{let e=t?.jwks?.keyPairConfigs?.map(e=>e.alg).join(`, `)||`none`;throw new V(`signJWT: no key with alg "${n.signingAlgorithm}" found in JWKS. The plugin auto-mints only one key matching keyPairConfig.alg="${r}"; additional algs configured via keyPairConfigs: ${e}. Add "${n.signingAlgorithm}" to jwks.keyPairConfigs so the plugin provisions it on first use, or mint the key explicitly via createJwk().`)}}}else{let n=t?.jwks?.keyPairConfig?.alg??`EdDSA`;i=await r.getLatestKeyByAlg(e,n)??await r.getLatestKey(e)}if(!i||i.expiresAt&&i.expiresAt<new Date){if(n?.signingKeyId!==void 0||n?.signingAlgorithm!==void 0)throw new V(`signJWT: requested signing key is expired and an explicit kid/alg was provided; not auto-minting a replacement. Rotate the key explicitly.`);i=await zp(e,t)}let a=t?.jwks?.disablePrivateKeyEncryption?i.privateKey:await Ua({key:e.context.secretConfig,data:JSON.parse(i.privateKey)}).catch(()=>{throw new V(`Failed to decrypt private key. Make sure the secret currently in use is the same as the one used to encrypt the private key. If you are using a different secret, either clean up your JWKS or disable private key encryption.`)}),o=i.alg??t?.jwks?.keyPairConfig?.alg??`EdDSA`,s=await _i(JSON.parse(a),o);return{alg:o,kid:i.id,privateKey:s}}async function Vp(e,t){let{options:n}=t,r=t.payload,i=Math.floor(Date.now()/1e3),a=r.iat,o=r.exp,s=Lp(n?.jwt?.expirationTime??`15m`,a??i);o??=s;let c=r.nbf,l=typeof e.context.options.baseURL==`string`?e.context.options.baseURL:``,u=r.iss,d=n?.jwt?.issuer??l,f=r.aud,p=n?.jwt?.audience??l;if(n?.jwt?.sign){let e={...r,iat:a,exp:o,nbf:c,iss:u??d,aud:f??p};return n.jwt.sign(e,t.header,{signingKeyId:t.signingKeyId,signingAlgorithm:t.signingAlgorithm})}let{alg:m,kid:h,privateKey:g}=t.resolvedKey??await Bp(e,n,{signingKeyId:t.signingKeyId,signingAlgorithm:t.signingAlgorithm}),_=new Kr(r).setProtectedHeader({...t.header,alg:m,kid:h}).setExpirationTime(o).setIssuer(u??d).setAudience(f??p);return a&&_.setIssuedAt(a),r.sub&&_.setSubject(r.sub),r.nbf&&_.setNotBefore(r.nbf),r.jti&&_.setJti(r.jti),await _.sign(g)}async function Hp(e,t){let n=t?.jwt?.definePayload?await t.jwt.definePayload(e.context.session):e.context.session.user;return await Vp(e,{options:t,payload:{iat:Math.floor(Date.now()/1e3),...n,sub:await t?.jwt?.getSubject?.(e.context.session)??e.context.session.user.id}})}var Up=new Set([`iss`,`sub`,`aud`,`exp`,`nbf`,`iat`,`jti`,`auth_time`,`nonce`,`acr`,`amr`,`azp`,`sid`,`at_hash`,`c_hash`,`s_hash`]);function Wp(e){if(!e)return{};let t=[],n=Object.create(null);for(let[r,i]of Object.entries(e))Up.has(r)?t.push(r):n[r]=i;return t.length>0&&_e.warn(`oauth-provider: stripped reserved id-token claim name(s): ${t.join(`, `)}. The AS owns these claim values.`),n}var Gp=i(c(),o()).nullable(),Kp=C({essential:v().optional(),value:c().optional(),values:x(c()).optional()}).nullable(),qp=w({acr:Kp.optional()}).catchall(Gp),Jp=C({userinfo:i(c(),Gp).optional(),id_token:qp.optional()});function Yp(e){if(typeof e==`string`)try{return JSON.parse(e)}catch{return}return e}function Xp(e){let t=Yp(e),n=Jp.safeParse(t);return n.success?n.data:void 0}var Zp=a([c(),i(c(),o())]),Qp=Zp,$p=Zp.refine(e=>Xp(e)!==void 0,{error:`claims must be a valid Claims request object`});function em(e){return e===void 0||Xp(e)!==void 0}function tm(e,t){let n=Xp(e)?.userinfo;if(!n)return[];let r=Object.keys(n);if(!t)return r;let i=new Set(t);return r.filter(e=>i.has(e))}function nm(e,t){let n=Xp(e);if(!n)return e===void 0;let r=n.id_token?.acr;if(!r||r.essential!==!0)return!0;let i=r.value===void 0||r.value===t,a=r.values===void 0||r.values.includes(t);return i&&a}function rm(e,t){let n=Xp(e);if(!n)return;let r=new Set(t),i=Object.fromEntries(Object.entries(n.userinfo??{}).filter(([e])=>r.has(e))),a=Object.keys(i).length?{...n,userinfo:i}:Object.fromEntries(Object.entries(n).filter(([e])=>e!==`userinfo`));return Object.keys(a).length?a:void 0}function im(e){let t=e.split(` `).filter(e=>e!==``);return t.length<=1?{}:{given:t.slice(0,-1).join(` `),family:t.at(-1)}}var am={name:{scope:`profile`,resolve:e=>e.name??void 0},picture:{scope:`profile`,resolve:e=>e.image??void 0},given_name:{scope:`profile`,resolve:e=>im(e.name).given},family_name:{scope:`profile`,resolve:e=>im(e.name).family},email:{scope:`email`,resolve:e=>e.email??void 0},email_verified:{scope:`email`,resolve:e=>e.emailVerified??!1}},om=Object.keys(am);function sm(e){return e.advertisedMetadata?.claims_supported??e.claims??[]}var cm=new Set([`iss`,`sub`,`aud`,`exp`,`iat`,`jti`,`client_id`,`scope`,`auth_time`,`acr`,`amr`,`cnf`]);function lm(e){if(!e)return{};let t=[],n={};for(let[r,i]of Object.entries(e))cm.has(r)?t.push(r):n[r]=i;return t.length>0&&_e.warn(`oauth-provider: stripped reserved access-token claim name(s): ${t.join(`, `)}. The AS owns these claim values.`),n}async function um(e){let{ctx:t,opts:n,user:r,client:i,scopes:a,resources:o,referenceId:s,metadata:c,grantType:l,sessionId:u,perRequestClaims:d,resourcePolicyClaims:f}=e,p=await ol(n,{ctx:t,opts:n,user:r,client:i,scopes:a,grantType:l,referenceId:s,sessionId:u,resources:o,metadata:c}),m=n.customAccessTokenClaims?await n.customAccessTokenClaims({user:r,scopes:a,resources:o,referenceId:s,metadata:c}):{};return lm({...p,...d??{},...m,...f})}var dm=[`javascript:`,`data:`,`vbscript:`],fm=c().superRefine((e,n)=>{if(!URL.canParse(e))return n.addIssue({code:`custom`,message:`resource must be an absolute URI`,fatal:!0}),t;e.includes(`#`)?n.addIssue({code:`custom`,message:`resource must not contain a fragment`}):dm.includes(new URL(e).protocol)&&n.addIssue({code:`custom`,message:`resource cannot use javascript:, data:, or vbscript: scheme`})}),pm=u([`none`,`consent`,`login`,`create`,`select_account`]),mm=c().superRefine((e,t)=>{let n=e.split(` `).map(e=>e.trim()).filter(Boolean),r=new Set;if(!n.length)t.addIssue({code:`custom`,message:`prompt must include at least one value`});else{for(let e of n){let n=pm.safeParse(e);n.success?r.add(n.data):t.addIssue({code:`custom`,message:`unsupported prompt value: ${e}`})}r.has(`none`)&&r.size>1&&t.addIssue({code:`custom`,message:`prompt=none cannot be combined with other prompt values`})}}),hm=w({keys:x(i(c(),o())).min(1)}),gm=a([d(),c().trim().min(1)]).transform((e,n)=>{let r=typeof e==`number`?e:Number(e);return!Number.isInteger(r)||r<0?(n.addIssue({code:`custom`,message:`max_age must be a non-negative integer`}),t):r}),_m=c().regex(/^[A-Za-z0-9_-]{43}$/,`dpop_jkt must be a base64url-encoded SHA-256 JWK thumbprint`),vm=w({response_type:c().pipe(u([`code`])).optional(),request:c().optional(),request_uri:c().optional(),redirect_uri:Q.optional(),scope:c().optional(),state:c().optional(),client_id:c().min(1,`client_id is required`),prompt:mm.optional(),display:c().optional(),ui_locales:c().optional(),max_age:gm.optional(),acr_values:c().optional(),login_hint:c().optional(),id_token_hint:c().optional(),code_challenge:c().optional(),code_challenge_method:c().pipe(u([`S256`])).optional(),nonce:c().optional(),claims:Qp.optional(),dpop_jkt:_m.optional(),resource:a([fm,x(fm).min(1)]).optional()}).passthrough(),ym=vm.extend({redirect_uri:Q.optional(),claims:$p.optional()}),bm=w({type:l(`authorization_code`),query:ym,sessionId:c(),userId:c(),referenceId:c().optional(),authTime:d().optional(),resource:x(c()).optional()}).passthrough(),xm=w({redirect_uris:x(Q).min(1).optional(),scope:c().optional(),client_name:c().refine(e=>e.trim().length>0,`client_name cannot be empty`).optional(),client_uri:c().optional(),logo_uri:c().optional(),contacts:x(c().min(1)).min(1).optional(),tos_uri:c().optional(),policy_uri:c().optional(),software_id:c().optional(),software_version:c().optional(),software_statement:c().optional(),post_logout_redirect_uris:x(Q).min(1).optional(),backchannel_logout_uri:Q.optional(),backchannel_logout_session_required:v().optional(),token_endpoint_auth_method:c().trim().min(1).optional(),jwks:hm.optional(),jwks_uri:c().optional(),grant_types:x(c().trim().min(1)).min(1).optional(),response_types:x(u([`code`])).optional(),application_type:u([`web`,`native`]).optional(),subject_type:u([`public`,`pairwise`]).optional(),dpop_bound_access_tokens:v().optional(),resources:x(fm).optional(),skip_consent:T({error:`skip_consent cannot be set during dynamic client registration`}).optional()}),Sm=xm.omit({skip_consent:!0}).extend({client_id:c().refine(e=>e.trim().length>0,`client_id cannot be empty`),client_secret:c().optional(),client_secret_expires_at:d().int().nonnegative().optional(),client_id_issued_at:d().int().nonnegative().optional()}).loose(),Cm=[`EdDSA`,`ES256`,`ES512`,`PS256`,`RS256`],wm=new Set(Cm),Tm=64;async function Em(e,t){let n=e.identifierValidator;if(n)return await n(t)?{ok:!0}:{ok:!1,reason:`resource identifier ${t} failed validation`};let r=fm.safeParse(t);return r.success?{ok:!0}:{ok:!1,reason:`resource identifier ${t} is invalid: ${r.error.issues[0]?.message??`not an absolute URI`}`}}async function Dm(e,t){let n=await Em(e,t);if(!n.ok)throw new B(`BAD_REQUEST`,{error:`invalid_target`,error_description:n.reason})}var Om=e=>`${e}/oauth2/userinfo`;async function km(e){if(!(e.headers.get(`content-type`)?.toLowerCase()??``).includes(`application/x-www-form-urlencoded`))return;let t;try{t=await e.clone().text()}catch{return}if(!t)return;let n=new URLSearchParams(t).getAll(`resource`).filter(e=>e.length>0);return n.length>0?n:void 0}function Am(e){if(e!=null){if(typeof e==`string`)return[e];if(Array.isArray(e)){let t=e.filter(e=>typeof e==`string`&&e.length>0);return t.length>0?t:void 0}}}async function jm(e,t,n,r=[]){if(n===void 0)return!0;let i=Array.isArray(n)?n:[n];if(i.length>Tm)return!1;let a=new Set(r),o=new Set;for(let e of i)a.has(e)||o.add(e);return o.size===0||(await Promise.all(Array.from(o,n=>zm(e,t,n)))).every(Boolean)}async function Mm(e,t,n){let r=Am(n.resource),i=n.requestedScopes.includes(`openid`),a=Om(e.context.baseURL??``);if(!r)return{audienceClaim:void 0,accessTokenTtl:null,refreshTokenTtl:null,signingAlgorithm:null,signingKeyId:null,rawCustomClaims:{},dpopBoundAccessTokensRequired:!1,effectiveScopes:[...n.requestedScopes]};let o=[...new Set(r)],s=[];for(let n of o){if(n===a)continue;let r=await zm(e,t,n);if(r){if(r.disabled)throw new B(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is disabled`});s.push(r)}else throw new B(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is not configured`})}let{value:c}=Im(t);c&&s.length>0&&await Nm(e,t,n.clientId,s);let l=[...n.requestedScopes];for(let e of s){if(e.allowedScopes===null||e.allowedScopes===void 0)continue;let t=new Set(e.allowedScopes),n=l.filter(e=>t.has(e));if(n.length===0)throw new B(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`none of the requested scopes are allowed for resource ${e.identifier}`});l=n}let u=null,d=null;for(let e of s)e.accessTokenTtl!=null&&(u=u===null?e.accessTokenTtl:Math.min(u,e.accessTokenTtl)),e.refreshTokenTtl!=null&&(d=d===null?e.refreshTokenTtl:Math.min(d,e.refreshTokenTtl));let f=new Set,p=new Set;for(let e of s)e.signingAlgorithm&&f.add(e.signingAlgorithm),e.signingKeyId&&p.add(e.signingKeyId);if(f.size>1)throw new B(`BAD_REQUEST`,{error:`invalid_request`,error_description:`multi-resource request has conflicting signingAlgorithm pins; a single JWS signature cannot satisfy multiple algorithms`});if(p.size>1)throw new B(`BAD_REQUEST`,{error:`invalid_request`,error_description:`multi-resource request has conflicting signingKeyId pins; a single JWS signature cannot satisfy multiple key ids`});let m=f.values().next().value??null,h=p.values().next().value??null,g={};for(let e of s)e.customClaims&&typeof e.customClaims==`object`&&Object.assign(g,e.customClaims);let _=s.some(e=>e.dpopBoundAccessTokensRequired===!0),v=i?[...o,a]:o,y=[...new Set(v)];return{audienceClaim:y.length===1?y[0]:y,accessTokenTtl:u,refreshTokenTtl:d,signingAlgorithm:m,signingKeyId:h,rawCustomClaims:g,dpopBoundAccessTokensRequired:_,effectiveScopes:l}}async function Nm(e,t,n,r){if(r.length===0)return;let i=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,a=await e.context.adapter.findMany({model:i,where:[{field:`clientId`,value:n}]}),o=new Set(a?.map(e=>e.resourceId)??[]),s=r.filter(e=>!o.has(e.identifier));if(s.length>0)throw new B(`BAD_REQUEST`,{error:`invalid_target`,error_description:`client ${n} is not linked to resource(s) ${s.map(e=>e.identifier).join(`, `)}`})}async function Pm(e,t,n,r){if(r.length===0)return!1;let i=t.schema?.oauthClientResource?.modelName??`oauthClientResource`;return((await e.context.adapter.findMany({model:i,where:[{field:`clientId`,value:n},{field:`resourceId`,operator:`in`,value:r}],limit:1}))?.length??0)>0}async function Fm(e,t,n){if(n.length===0)return{};let r=await e.context.adapter.findMany({model:t.schema?.oauthResource?.modelName??`oauthResource`,where:[{field:`identifier`,operator:`in`,value:n}]}),i=new Map(r.map(e=>[e.identifier,e])),a={};for(let e of n){let t=i.get(e);t?.customClaims&&typeof t.customClaims==`object`&&Object.assign(a,t.customClaims)}return a}function Im(e){return e.enforcePerClientResources===void 0?{value:!0,source:`default`}:{value:e.enforcePerClientResources,source:`explicit`}}var Lm=new Map;function Rm(e){e===void 0?Lm.clear():Lm.delete(e)}async function zm(e,t,n){if(await Ym(e.context,t),t.cachedResources?.has(n)){let e=Lm.get(n);if(e)return Object.assign({},e)}let r=await e.context.adapter.findOne({model:t.schema?.oauthResource?.modelName??`oauthResource`,where:[{field:`identifier`,value:n}]});return r&&t.cachedResources?.has(n)&&Lm.set(n,Object.assign({},r)),r}function Bm(e){return e.name??e.identifier}function Vm(e){let t=[];if(e.resources?.length)for(let n of e.resources)t.push(typeof n==`string`?{identifier:n}:n);return t}function Hm(e,t){return{identifier:e.identifier,name:Bm(e),accessTokenTtl:e.accessTokenTtl??null,refreshTokenTtl:e.refreshTokenTtl??null,signingAlgorithm:e.signingAlgorithm??null,signingKeyId:e.signingKeyId??null,allowedScopes:e.allowedScopes??null,customClaims:e.customClaims??null,dpopBoundAccessTokensRequired:e.dpopBoundAccessTokensRequired??!1,disabled:e.disabled??!1,policyVersion:1,metadata:e.metadata??null,createdAt:t,updatedAt:t}}function Um(e,t,n){if(t===`overwrite`){let{identifier:t,createdAt:r,...i}=Hm(e,n);return i}let r={updatedAt:n};return e.name!==void 0&&(r.name=e.name),e.accessTokenTtl!==void 0&&(r.accessTokenTtl=e.accessTokenTtl),e.refreshTokenTtl!==void 0&&(r.refreshTokenTtl=e.refreshTokenTtl),e.signingAlgorithm!==void 0&&(r.signingAlgorithm=e.signingAlgorithm),e.signingKeyId!==void 0&&(r.signingKeyId=e.signingKeyId),e.allowedScopes!==void 0&&(r.allowedScopes=e.allowedScopes),e.customClaims!==void 0&&(r.customClaims=e.customClaims),e.dpopBoundAccessTokensRequired!==void 0&&(r.dpopBoundAccessTokensRequired=e.dpopBoundAccessTokensRequired),e.disabled!==void 0&&(r.disabled=e.disabled),e.metadata!==void 0&&(r.metadata=e.metadata),r}var Wm=/no such table|relation.*does not exist|table.*does(?: not|n'?t) exist|model.*(?:does not exist|was not found in the schema)/i;function Gm(e,t){let n=!1,r=t;for(let e=0;r&&!n&&e<5;e++)n=Wm.test(r instanceof Error?r.message:String(r)),r=r instanceof Error?r.cause:void 0;n?e.logger.debug(`oauth-provider: oauthResource table not yet created; deferring resource seed to first access.`):e.logger.error("oauth-provider: could not seed `resources` at startup; retrying on first resource access.",t)}var Km=new WeakMap;function qm(e,t){let n=e.adapter,r=Km.get(n);r||(r=new WeakMap,Km.set(n,r));let i=r.get(t);if(i)return i;let a={completed:!1,promise:null};return r.set(t,a),a}async function Jm(e,t){let n=Vm(t);if(n.length===0)return;let r=t.resourceSeedMode??`insertOnly`,i=t.schema?.oauthResource?.modelName??`oauthResource`;for(let a of n){let n=await Em(t,a.identifier);if(!n.ok){_e.warn(`oauth-provider: skipping resource seed for ${a.identifier} — ${n.reason}`);continue}let o=a;if(o.signingAlgorithm!=null&&!wm.has(o.signingAlgorithm)){_e.warn(`oauth-provider: dropping unsupported signingAlgorithm "${o.signingAlgorithm}" for resource ${o.identifier} — must be one of ${Cm.join(`, `)}. Continuing without an algorithm override.`);let{signingAlgorithm:e,...t}=o;o=t}let s=[{field:`identifier`,value:o.identifier}],c=await e.adapter.findOne({model:i,where:s}),l=new Date;if(!c)try{await e.adapter.create({model:i,data:Hm(o,l)});continue}catch(t){if(!await e.adapter.findOne({model:i,where:s}).catch(()=>null))throw t}r!==`insertOnly`&&await e.adapter.update({model:i,where:s,update:Um(o,r,l)})}}async function Ym(e,t){let n=qm(e,t);if(n.completed!==!0)return n.promise===null&&(n.promise=Jm(e,t).then(()=>{n.completed=!0}).catch(e=>{throw n.promise=null,e})),n.promise}function Xm(e){let t=Im(e);_e.info(`oauth-provider: enforcePerClientResources resolved to ${t.value} (${t.source})`)}function Zm(e){return e.headers?.get(`dpop`)??void 0}function Qm(e,t){return e.request?.url??`${e.context.baseURL}${t}`}var $m=new Set([`openid`,`profile`,`email`,`offline_access`]);function eh(e){return $m.has(e)}function th(e){return[...new Set(e.map(e=>e.trim()).filter(Boolean))]}function nh(e,t,n,r){if(e.length===0)return;if(!t.includes(`client_credentials`))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`client_credentials_scopes requires the client_credentials grant`});if(n===`none`)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`public clients cannot be assigned client_credentials scopes`});let i=new Set(r.scopes??[]),a=e.filter(e=>!i.has(e)||eh(e));if(a.length>0)throw new B(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`The following client_credentials scopes are invalid: ${a.join(`, `)}`})}function rh(e,t,n=[]){let r=new Set(n),i={sub:e.id??void 0};for(let[n,a]of Object.entries(am))(t.includes(a.scope)||r.has(n))&&(i[n]=a.resolve(e));return i}function ih(e,t){let n={};for(let[r,i]of Object.entries(e??{}))i!==void 0&&(t&&r in t||(n[r]=i));return n}function ah(e){let t=e.headers?.get(`authorization`),n=fc(t),r=e.request?.method===`POST`?e.body?.access_token??void 0:void 0;if(n&&r)throw new B(`BAD_REQUEST`,{error_description:`Multiple access token transport methods are not allowed`,error:`invalid_request`});let i=n??(r?{scheme:`Bearer`,token:r}:void 0);return{authorization:i,token:i?.token}}async function oh(e,t){let{authorization:n}=ah(e);if(!n?.token)throw new B(`UNAUTHORIZED`,{error_description:`access token not found`,error:`invalid_request`});let{payload:r,requestedUserInfoClaims:i}=await sg(e,t,n.token);if(vc(r)&&!e.request)throw new B(`UNAUTHORIZED`,{error_description:`DPoP-bound access token requires an HTTP request context`,error:`invalid_token`});try{await Oc({payload:r,authorization:n,proofJwt:Zm(e),method:e.request?.method??`GET`,url:Qm(e,`/oauth2/userinfo`),proofMaxAgeSeconds:t.dpop?.proofMaxAgeSeconds,signingAlgorithms:t.dpop?.signingAlgorithms,replayStore:uc(e.context.internalAdapter)})}catch(e){throw Dc(e)?new B(`UNAUTHORIZED`,{error_description:e.message,error:e.code}):e}let a=r.scope?.split(` `);if(!a?.includes(`openid`))throw new B(`BAD_REQUEST`,{error_description:`Missing required scope`,error:`invalid_scope`});if(!r.sub)throw new B(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let o=await e.context.internalAdapter.findUserById(r.sub);if(!o)throw new B(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let s=rh(o,a??[],i),c=r.client_id??r.azp,l=c&&(t.pairwiseSecret||ll(t))?await xl(e,t,c):void 0;t.pairwiseSecret&&l&&(s.sub=await Kl(o.id,l,t));let u=a?.length?await cl(t,{ctx:e,opts:t,user:o,scopes:a,jwt:r,client:l??void 0,requestedClaims:i}):{},d=t.customUserInfoClaims&&a?.length?await t.customUserInfoClaims({user:o,scopes:a,jwt:r,requestedClaims:i}):{};return{...s,...ih(u,s),...ih(d),sub:s.sub}}var sh=Object.fromEntries(om.map(e=>[e,void 0]));function ch(e){return _c(e)?`DPoP`:`Bearer`}var lh=`at+jwt`;async function uh(e,t){let n=e.body.grant_type;if(!Qc(t).includes(n))throw new B(`BAD_REQUEST`,{error_description:`unsupported grant_type ${n}`,error:`unsupported_grant_type`});switch(n){case`authorization_code`:return Wh(e,t);case`client_credentials`:return Gh(e,t);case`refresh_token`:return Kh(e,t);default:{let r=$c(t,n);if(r)return r({ctx:e,opts:t,grantType:n,provider:dh(e,t,n)});throw new B(`BAD_REQUEST`,{error_description:`unsupported grant_type ${n}`,error:`unsupported_grant_type`})}}}function dh(e,t,n){return{getClient:n=>xl(e,t,n),authenticateClient:async r=>{let{clientId:i,clientSecret:a,preVerified:o,authMethod:s,confirmation:c}=Vl(await Hl(e,t,`${e.context.baseURL}${e.path??`/oauth2/token`}`));if(!i)throw new B(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});if(r?.requireCredentials!==!1&&!a&&!o)throw new B(`BAD_REQUEST`,{error_description:`Missing required client credentials`,error:`invalid_client`});return{clientId:i,client:await zl(e,t,i,a,r?.scopes,o,n,s),method:s,confirmation:c}},issueTokens:r=>{if(!n)throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`issueTokens requires a grant type; pass it to getOAuthProviderApi(ctx, opts, grantType).`,error:`server_error`});return Hh(e,t,{...r,grantType:n})},hashToken:(e,n)=>Dl(t.storeTokens,e,n),validateAccessToken:async(n,r)=>{let{validateAccessToken:i}=await Promise.resolve().then(()=>qh);return i(e,t,n,r)},requireActiveAccessToken:async(n,r)=>{let{requireActiveAccessToken:i}=await Promise.resolve().then(()=>qh);return i(e,t,n,r)}}}async function fh(e,t,n,r,i,a,o){let s=o?.iat??Math.floor(Date.now()/1e3),c=o?.exp??s+(t.accessTokenExpiresIn??3600),l=pl(e.context).options,u=n?.id??r.clientId;return Vp(e,{options:l,header:{typ:lh},signingKeyId:o?.signingKeyId??void 0,signingAlgorithm:o?.signingAlgorithm??void 0,payload:{...o?.accessTokenClaims??{},sub:u,aud:_l(i),client_id:r.clientId,azp:r.clientId,scope:a.join(` `),sid:o?.sid,iss:l?.jwt?.issuer??e.context.baseURL,iat:s,exp:c,jti:Fi(32),...o?.confirmation?{cnf:o.confirmation}:{}}})}async function ph(e,t){let n;n=t===`EdDSA`?`SHA-512`:t.endsWith(`384`)?`SHA-384`:t.endsWith(`512`)?`SHA-512`:`SHA-256`;let r=new Uint8Array(await crypto.subtle.digest(n,new TextEncoder().encode(e)));return G(r.slice(0,r.length/2))}async function mh(e,t,n,r,i,a,o,s,c,l){let u=Math.floor(Date.now()/1e3),d=u+(t.idTokenExpiresIn??36e3),f=await Kl(n.id,r,t),p=s==null?void 0:Math.floor(s.getTime()/1e3),m=Wp(t.customIdTokenClaims?await t.customIdTokenClaims({user:n,scopes:i,metadata:Bl(r.metadata)}):void 0),h=t.disableJwtPlugin?void 0:pl(e.context).options,g=!t.disableJwtPlugin&&!h?.jwt?.sign?await Bp(e,h):void 0,_=t.disableJwtPlugin?`HS256`:g?.alg??h?.jwks?.keyPairConfig?.alg,v=c?await ph(c,_):void 0,y=!!(r.enableEndSession||r.backchannelLogoutUri),b={...sh,auth_time:p,acr:`0`,...m,at_hash:v,iss:h?.jwt?.issuer??e.context.baseURL,sub:f,aud:r.clientId,nonce:a,iat:u,exp:d,sid:y?o:void 0},x=Wp(l);if(Object.assign(b,ih(x,b)),t.disableJwtPlugin&&!r.clientSecret)return;let S=t.disableJwtPlugin?await new Kr(b).setProtectedHeader({alg:`HS256`}).sign(new TextEncoder().encode(await wl(e,t.storeClientSecret,r.clientSecret))):await Vp(e,{options:h,payload:b,resolvedKey:g??void 0});if(S&&v&&h?.jwt?.sign){let e=vi(S);if(e.alg!==_)throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`ID token signed with "${e.alg}" but at_hash was computed for "${_}". Ensure jwt.sign uses the algorithm declared in keyPairConfig.alg.`,error:`server_error`})}return S}async function hh(e,t,n){return(e.prefix?.refreshToken??``)+(e.formatRefreshToken?.encrypt?e.formatRefreshToken.encrypt(t,n):t)}async function gh(e,t){if(e.prefix?.refreshToken){if(t.startsWith(e.prefix.refreshToken))t=t.replace(e.prefix.refreshToken,``);else throw new B(`BAD_REQUEST`,{error_description:`refresh token not found`,error:`invalid_token`})}return e.formatRefreshToken?.decrypt?e.formatRefreshToken?.decrypt(t):{token:t}}async function _h(e,t,n,r,i,a,o,s,c,l,u,d){let f=a.iat??Math.floor(Date.now()/1e3),p=a?.exp??f+(t.accessTokenExpiresIn??3600),m=t.generateOpaqueAccessToken?await t.generateOpaqueAccessToken():Fi(32,`A-Z`,`a-z`);return await e.context.adapter.create({model:`oauthAccessToken`,data:{token:await Dl(t.storeTokens,m,`access_token`),clientId:r.clientId,sessionId:a?.sid,userId:n?.id,referenceId:s,authorizationCodeId:c,resources:o,refreshId:l,confirmation:u,requestedUserInfoClaims:d?.length?d:void 0,scopes:i,createdAt:new Date(f*1e3),expiresAt:new Date(p*1e3)}}),(t.prefix?.opaqueAccessToken??``)+m}async function vh(e,t,n){let r=await e.context.adapter.findMany({model:`oauthRefreshToken`,where:[{field:`clientId`,value:t},{field:`userId`,value:n}]});r.length&&await e.context.adapter.deleteMany({model:`oauthAccessToken`,where:[{field:`refreshId`,operator:`in`,value:r.map(e=>e.id)}]}),await e.context.adapter.deleteMany({model:`oauthRefreshToken`,where:[{field:`clientId`,value:t},{field:`userId`,value:n}]})}async function yh(e,t){let n=async n=>{try{await e.context.adapter.deleteMany({model:n,where:[{field:`authorizationCodeId`,value:t}]})}catch(t){e.context.logger.error(`authorization code replay cleanup failed`,t)}};await n(`oauthAccessToken`),await n(`oauthRefreshToken`)}async function bh(e,t,n,r,i,a,o,s,c,l,u,d,f){let p=s.iat??Math.floor(Date.now()/1e3),m=s?.exp??p+(t.refreshTokenExpiresIn??2592e3),h=t.generateRefreshToken?await t.generateRefreshToken():Fi(32,`A-Z`,`a-z`),g=s?.sid,_={token:await Dl(t.storeTokens,h,`refresh_token`),clientId:a.clientId,sessionId:g,userId:n.id,referenceId:r,authorizationCodeId:i,authTime:l,confirmation:d,requestedUserInfoClaims:f?.length?f:void 0,scopes:o,resources:u,createdAt:new Date(p*1e3),expiresAt:new Date(m*1e3)};if(!c?.id)return{id:(await e.context.adapter.create({model:`oauthRefreshToken`,data:_})).id,token:await hh(t,h,g)};let v=new Date(p*1e3),y={revoked:v,rotatedAt:v},b=t.refreshTokenReuseInterval??0;if(b>0&&(y.rotationReplayExpiresAt=new Date((p+b)*1e3)),!await e.context.adapter.incrementOne({model:`oauthRefreshToken`,where:[{field:`id`,value:c.id},{field:`revoked`,operator:`eq`,value:null}],increment:{},set:y}))throw new B(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`});return{id:(await e.context.adapter.create({model:`oauthRefreshToken`,data:_})).id,token:await hh(t,h,g)}}async function xh(e,t,n){let r=await Mm(e,t,{resource:n.resources,clientId:n.clientId,requestedScopes:n.requestedScopes}),i=r.accessTokenTtl===null?n.scopeExpiresAtSeconds:n.iat+r.accessTokenTtl,a=t.refreshTokenExpiresIn??2592e3,o=r.refreshTokenTtl===null?a:Math.min(r.refreshTokenTtl,a);return{audienceClaim:r.audienceClaim,effectiveScopes:r.effectiveScopes,accessTokenExpiresAtSeconds:Math.min(n.scopeExpiresAtSeconds,i),refreshTokenExpiresAtSeconds:n.iat+o,refreshResources:n.refreshToken?.resources??n.originalResources??n.resources,signingAlgorithm:r.signingAlgorithm,signingKeyId:r.signingKeyId,resourceCustomClaims:r.rawCustomClaims,dpopBoundAccessTokensRequired:r.dpopBoundAccessTokensRequired}}function Sh(e){throw new B(`BAD_REQUEST`,{error:`invalid_dpop_proof`,error_description:e})}function Ch(e){let t=Bl(e.metadata)??{};return e.dpopBoundAccessTokens===!0||t.dpop_bound_access_tokens===!0}async function wh(e,t,n){let r=n.verificationValue?.query.dpop_jkt,i=_c(n.refreshToken?.confirmation),a=i??r,o=Zm(e),s=Ch(n.client)||n.grantIssuance.dpopBoundAccessTokensRequired||!!r||!!i;if(!o)s&&Sh(`DPoP proof header is required`);else try{return{jkt:(await Tc({proofJwt:o,method:`POST`,url:Qm(e,`/oauth2/token`),expectedJkt:a,proofMaxAgeSeconds:t.dpop?.proofMaxAgeSeconds,signingAlgorithms:t.dpop?.signingAlgorithms,replayStore:uc(e.context.internalAdapter)})).jkt}}catch(e){throw dc(e)&&Sh(e.message),e}}function Th(e){return e?[...new Set(e)].sort():void 0}function Eh(e,t){let n=Th(e),r=Th(t);return n===void 0||r===void 0?n===r:n.length===r.length&&n.every((e,t)=>e===r[t])}function Dh(e){if(e)return`jkt`in e?`jkt:${e.jkt}`:`x5t#S256:${e[`x5t#S256`]}`}function Oh(e,t){return Dh(e)===Dh(t)}function kh(e){if(!e||typeof e!=`object`)return!1;let t=e;return typeof t.jkt==`string`&&t[`x5t#S256`]===void 0||typeof t[`x5t#S256`]==`string`&&t.jkt===void 0}function Ah(e){return e===`Bearer`||e===`DPoP`}function jh(e){if(!e||typeof e!=`object`)return!1;let t=e;return typeof t.access_token==`string`&&typeof t.expires_in==`number`&&typeof t.expires_at==`number`&&Ah(t.token_type)&&typeof t.scope==`string`&&(t.refresh_token===void 0||typeof t.refresh_token==`string`)&&(t.id_token===void 0||typeof t.id_token==`string`)}function Mh(e){if(!e||typeof e!=`object`)return!1;let t=e,n=t.request;return!!n&&Array.isArray(n.effectiveScopes)&&n.effectiveScopes.every(e=>typeof e==`string`)&&(n.requestedResources===void 0||Array.isArray(n.requestedResources)&&n.requestedResources.every(e=>typeof e==`string`))&&(n.confirmation===void 0||kh(n.confirmation))&&jh(t.response)}function Nh(e){let t=Th(e.requestedResources);return{effectiveScopes:Th(e.effectiveScopes)??[],...t?{requestedResources:t}:{},...e.confirmation?{confirmation:e.confirmation}:{}}}function Ph(e,t){return Eh(e.effectiveScopes,t.effectiveScopes)&&Eh(e.requestedResources,t.requestedResources)&&Oh(e.confirmation,t.confirmation)}async function Fh(e,t){return Ha({key:e.context.secretConfig,data:JSON.stringify(t)})}async function Ih(e,t){let n=await Ua({key:e.context.secretConfig,data:t}),r=JSON.parse(n);if(Mh(r))return r}function Lh(e){return!!e.rotatedAt&&!!e.rotationReplayExpiresAt&&e.rotationReplayExpiresAt>=new Date}async function Rh(e,t,n,r,i){(t.refreshTokenReuseInterval??0)<=0||await e.context.adapter.update({model:`oauthRefreshToken`,where:[{field:`id`,value:n.id}],update:{rotationReplayResponse:await Fh(e,{request:r,response:i})}})}async function zh(e,t,n){if(Lh(t)&&t.rotationReplayResponse)try{let r=await Ih(e,t.rotationReplayResponse);return!r||!Ph(r.request,n)?void 0:r.response}catch(t){e.context.logger.error(`refresh token rotation replay failed`,t);return}}async function Bh(e,t,n){let r=Math.floor(Date.now()/1e3),i=await xh(e,t,{clientId:n.client.clientId,requestedScopes:n.scopes,resources:n.resources,refreshToken:n.refreshToken,iat:r,scopeExpiresAtSeconds:r+(t.accessTokenExpiresIn??3600)}),a=await wh(e,t,{client:n.client,grantIssuance:i,refreshToken:n.refreshToken});return Nh({effectiveScopes:i.effectiveScopes,requestedResources:n.resources,confirmation:a})}function Vh(e,t){let n=Math.floor(Date.now()/1e3);return e.json({...t,expires_in:Math.max(0,t.expires_at-n)})}async function Hh(e,t,n){let{client:r,scopes:i,user:a,grantType:o,referenceId:s,sessionId:c,nonce:l,refreshToken:u,authTime:d,verificationValue:f}=n,p=Math.floor(Date.now()/1e3),m=p+(a?t.accessTokenExpiresIn??3600:t.m2mAccessTokenExpiresIn??3600),h=t.scopeExpirations?i.map(e=>t.scopeExpirations?.[e]?Lp(t.scopeExpirations[e],p):m).reduce((e,t)=>e<t?e:t,m):m,g=await xh(e,t,{clientId:r.clientId,requestedScopes:i,resources:n.resources,originalResources:n.originalResources,refreshToken:n.refreshToken,iat:p,scopeExpiresAtSeconds:h}),_=g.audienceClaim,v=g.effectiveScopes,y=g.accessTokenExpiresAtSeconds,b=g.refreshTokenExpiresAtSeconds,x=a&&Il(r,`refresh_token`)&&(u?.scopes?.includes(`offline_access`)||i.includes(`offline_access`)),S=_&&!t.disableJwtPlugin,C=a&&v.includes(`openid`),w=Bl(r.metadata),T=C&&a?{...await sl(t,{ctx:e,opts:t,user:a,client:r,scopes:v,grantType:o,referenceId:s,sessionId:c,resources:n.resources,metadata:w}),...n.idTokenClaims??{}}:void 0,E=t.customTokenResponseFields?await t.customTokenResponseFields({grantType:o,user:a,scopes:v,metadata:w,verificationValue:f}):void 0,D=g.refreshResources,O=n.confirmation??await wh(e,t,{client:r,grantIssuance:g,verificationValue:f,refreshToken:u}),k=n.requestedUserInfoClaims??u?.requestedUserInfoClaims??[],A=x&&a&&!S?await bh(e,t,a,s,n.authorizationCodeId,r,v,{iat:p,exp:b,sid:c},u,d,D,O,k):void 0,j=S?await um({ctx:e,opts:t,user:a,client:r,scopes:v,grantType:o,sessionId:c,resources:n.resources,referenceId:s,metadata:w,perRequestClaims:n.accessTokenClaims,resourcePolicyClaims:g.resourceCustomClaims}):void 0,[M,N]=await Promise.all([S?fh(e,t,a,r,_,v,{iat:p,exp:y,sid:c,signingAlgorithm:g.signingAlgorithm,signingKeyId:g.signingKeyId,accessTokenClaims:j,confirmation:O}):_h(e,t,a,r,v,{iat:p,exp:y,sid:c},n?.resources,s,n.authorizationCodeId,A?.id,O,k),A||(x&&a?bh(e,t,a,s,n.authorizationCodeId,r,v,{iat:p,exp:b,sid:c},u,d,D,O,k):void 0)]),P=C?await mh(e,t,a,r,v,l,c,d,M,T):void 0,F={...E,...n.tokenResponse??{},access_token:M,expires_in:y-p,expires_at:y,token_type:ch(O),refresh_token:N?.token,scope:v.join(` `),id_token:P};if(u?.id&&N?.id)try{await Rh(e,t,u,Nh({effectiveScopes:v,requestedResources:n.resources,confirmation:O}),F)}catch(t){e.context.logger.error(`failed to store refresh token rotation replay`,t)}return e.json(F)}async function Uh(e,t,n,r,i,a){let o=await Dl(t.storeTokens,n,`authorization_code`),s=await e.context.internalAdapter.consumeVerificationValue(o);if(!s)throw await yh(e,o),new B(`BAD_REQUEST`,{error_description:`invalid code`,error:`invalid_grant`});let c;try{c=JSON.parse(s.value)}catch{throw new B(`BAD_REQUEST`,{error_description:`malformed verification value`,error:`invalid_grant`})}let l=bm.safeParse(c);if(!l.success)throw new B(`BAD_REQUEST`,{error_description:`malformed verification value`,error:`invalid_grant`});let u=l.data;if(u.query.client_id!==r)throw new B(`BAD_REQUEST`,{error_description:`invalid client_id`,error:`invalid_grant`});let d=u.query.redirect_uri;if(d){if(!i)throw new B(`BAD_REQUEST`,{error_description:`redirect_uri is required`,error:`invalid_request`});if(d!==i)throw new B(`BAD_REQUEST`,{error_description:`redirect_uri mismatch`,error:`invalid_grant`})}else if(i)throw new B(`BAD_REQUEST`,{error_description:`redirect_uri mismatch`,error:`invalid_grant`});let f=gl(u.resource)??gl(u.query.resource),p=a??f;if(a&&f){let e=new Set(a),t=new Set(f);for(let n of e)if(!t.has(n))throw new B(`BAD_REQUEST`,{error_description:`requested resource not authorized`,error:`invalid_target`})}return{verificationValue:u,effectiveResources:p,authorizedResources:f,authorizationCodeId:o}}async function Wh(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=Vl(await Hl(e,t,`${e.context.baseURL}/oauth2/token`)),{code:o,code_verifier:s,redirect_uri:c,resource:l}=e.body,u=gl(l);if(!n)throw new B(`BAD_REQUEST`,{error_description:`client_id is required`,error:`invalid_request`});if(!o)throw new B(`BAD_REQUEST`,{error_description:`code is required`,error:`invalid_request`});let d=n&&r,f=n&&o&&s;if(!d&&!f&&!i)throw new B(`BAD_REQUEST`,{error_description:`Either code_verifier or client_secret is required`,error:`invalid_request`});let{verificationValue:p,effectiveResources:m,authorizedResources:h,authorizationCodeId:g}=await Uh(e,t,o,n,c,u),_=p.query.scope?.split(` `);if(!_)throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`verification scope unset`,error:`invalid_scope`});let v=await zl(e,t,n,r,_,i,`authorization_code`,a);if(Zl(v,{scopes:(p.query?.scope)?.split(` `)||[],nonce:p.query?.nonce})){if(!f)throw new B(`BAD_REQUEST`,{error_description:`PKCE is required for this client`,error:`invalid_request`})}else if(!(f||d||i))throw new B(`BAD_REQUEST`,{error_description:`Either PKCE (code_verifier) or client authentication (client_secret or client_assertion) is required`,error:`invalid_request`});let y=!!p.query?.code_challenge,b=!!s;if(y||b){if(y&&!b)throw new B(`UNAUTHORIZED`,{error_description:`code_verifier required because PKCE was used in authorization`,error:`invalid_request`});if(!y&&b)throw new B(`UNAUTHORIZED`,{error_description:`code_verifier provided but PKCE was not used in authorization`,error:`invalid_request`});if((p.query?.code_challenge_method===`S256`?await us(s):void 0)!==p.query?.code_challenge)throw new B(`UNAUTHORIZED`,{error_description:`code verification failed`,error:`invalid_request`})}if(!p.userId)throw new B(`BAD_REQUEST`,{error_description:`missing user, user may have been deleted`,error:`invalid_user`});let x=await e.context.internalAdapter.findUserById(p.userId);if(!x)throw new B(`BAD_REQUEST`,{error_description:`missing user, user may have been deleted`,error:`invalid_user`});let S=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:p.sessionId}]});if(!S||S.expiresAt<new Date)throw new B(`BAD_REQUEST`,{error_description:`session no longer exists`,error:`invalid_request`});let C=p.authTime==null?hl(S):ml(p.authTime),w=tm(p.query.claims,sm(t));return Hh(e,t,{client:v,scopes:p.query.scope?.split(` `)??[],user:x,grantType:`authorization_code`,referenceId:p.referenceId,sessionId:S.id,nonce:p.query?.nonce,authTime:C,verificationValue:p,authorizationCodeId:g,requestedUserInfoClaims:w,resources:m,originalResources:h})}async function Gh(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=Vl(await Hl(e,t,`${e.context.baseURL}/oauth2/token`)),{scope:o,resource:s}=e.body,c=gl(s);if(!n)throw new B(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});let l=await zl(e,t,n,r,void 0,i,`client_credentials`,a);if(l.tokenEndpointAuthMethod===`none`)throw new B(`BAD_REQUEST`,{error_description:`public clients cannot use the client_credentials grant`,error:`unauthorized_client`});let u=l.clientCredentialsScopes;if(!u?.length)throw new B(`BAD_REQUEST`,{error_description:`client has no authorized client_credentials scopes`,error:`unauthorized_client`});let d=o?.split(` `);if(d){let e=new Set(u),t=d.filter(t=>!e.has(t)||eh(t));if(t.length)throw new B(`BAD_REQUEST`,{error_description:`The following scopes are invalid: ${t.join(`, `)}`,error:`invalid_scope`})}return d||=[...u],Hh(e,t,{client:l,scopes:d,grantType:`client_credentials`,resources:c})}async function Kh(e,t){let{clientId:n,clientSecret:r,preVerified:i,authMethod:a}=Vl(await Hl(e,t,`${e.context.baseURL}/oauth2/token`)),{refresh_token:o,scope:s,resource:c}=e.body,l=gl(c);if(!n)throw new B(`BAD_REQUEST`,{error_description:`Missing required client_id`,error:`invalid_request`});if(!o)throw new B(`BAD_REQUEST`,{error_description:`Missing a required refresh_token for refresh_token grant`,error:`invalid_request`});let u=await gh(t,o),d=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await Ol(t.storeTokens,u.token,`refresh_token`)}]});if(!d)throw new B(`BAD_REQUEST`,{error_description:`session not found`,error:`invalid_grant`});if(d.clientId!==n||d.expiresAt<new Date)throw new B(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`});if(l&&d.resources&&!l.every(e=>d.resources?.includes(e)))throw new B(`BAD_REQUEST`,{error_description:`requested resource invalid`,error:`invalid_target`});let f=d?.scopes,p=s?.split(` `);if(p){let e=new Set(f);for(let t of p)if(!e.has(t))throw new B(`BAD_REQUEST`,{error_description:`unable to issue scope ${t}`,error:`invalid_scope`})}let m=await zl(e,t,n,r,p??f,i,`refresh_token`,a);if(d.revoked){if(Lh(d)){let n=await zh(e,d,await Bh(e,t,{client:m,refreshToken:d,scopes:p??f,resources:l??d.resources}));if(n)return Vh(e,n);throw new B(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`})}throw await vh(e,n,d.userId),new B(`BAD_REQUEST`,{error_description:`invalid refresh token`,error:`invalid_grant`})}let h=await e.context.internalAdapter.findUserById(d.userId);if(!h)throw new B(`BAD_REQUEST`,{error_description:`user not found`,error:`invalid_request`});let g=d.authTime==null?void 0:ml(d.authTime);return Hh(e,t,{client:m,scopes:p??f,user:h,grantType:`refresh_token`,referenceId:d.referenceId,authorizationCodeId:d.authorizationCodeId,sessionId:d.sessionId,refreshToken:d,resources:l??d.resources,authTime:g,requestedUserInfoClaims:d.requestedUserInfoClaims})}var qh=Ce({introspectEndpoint:()=>lg,requireActiveAccessToken:()=>og,requireActiveAccessTokenWithClaims:()=>sg,validateAccessToken:()=>ag}),Jh=`Invalid access token`,Yh=`Bearer error="invalid_token", error_description="${Jh}"`;function Xh(){return{payload:{active:!1},requestedUserInfoClaims:[]}}function Zh(e,t){return e==null?[]:(Array.isArray(e)?e:[e]).filter(e=>typeof e==`string`&&e!==t)}async function Qh(e,t,n){let{introspectingClientId:r,issuerClientId:i,audienceResources:a}=n;return!r||r===i||a.length!==0&&Pm(e,t,r,a)}async function $h(e,t,n,r){let i=t.disableJwtPlugin?void 0:pl(e.context),a=i?.options,o=`${e.context.baseURL??``}/oauth2/userinfo`,s=a?.jwt?.issuer??e.context.baseURL,c;try{c=(await Vr(n,hi(await Pc(n,{jwksFetch:a?.jwks?.remoteUrl?a.jwks.remoteUrl:async()=>(await i?.endpoints.getJwks(e))?.response,jwksCacheKey:i})),{issuer:s})).payload}catch(e){if(e instanceof Error){if(e.name===`TypeError`||e.name===`JWSInvalid`)throw new z(`BAD_REQUEST`,{error_description:`invalid JWT signature`,error:`invalid_request`});if(e.name===`JWTExpired`||e.name===`JWTInvalid`)return{active:!1};throw e}throw Error(e)}let l=c.aud;if(!await jm(e,t,l,[o])||!c.azp)return{active:!1};let u=await xl(e,t,c.azp);if(!u||u?.disabled||!await Qh(e,t,{introspectingClientId:r,issuerClientId:c.azp,audienceResources:Zh(l,o)}))return{active:!1};let d=c.sid;if(d){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:d}]});if(!t||t.expiresAt<new Date)return{active:!1}}return c.client_id=c.azp,c.active=!0,c.token_type=ch(c.cnf),c}async function eg(e,t,n,r){let i=n;if(t.prefix?.opaqueAccessToken){if(i.startsWith(t.prefix.opaqueAccessToken))i=i.replace(t.prefix.opaqueAccessToken,``);else throw new z(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`})}let a=await e.context.adapter.findOne({model:`oauthAccessToken`,where:[{field:`token`,value:await Ol(t.storeTokens,i,`access_token`)}]});if(!a)throw new z(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_token`});if(!a.expiresAt||a.expiresAt<new Date||a.revoked)return Xh();let o=Array.isArray(a.resources)?a.resources:void 0,s;if(a.clientId&&(s=await xl(e,t,a.clientId),!s||s?.disabled||!await Qh(e,t,{introspectingClientId:r,issuerClientId:a.clientId,audienceResources:o??[]})))return Xh();let c=a.sessionId??void 0;if(c){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:c}]});if(!t||t.expiresAt<new Date)return Xh()}let l;a.userId&&(l=await e.context.internalAdapter.findUserById(a?.userId));let u=`${e.context.baseURL}/oauth2/userinfo`;if(o?.length&&!await jm(e,t,o,[u]))return Xh();let d=o?[...o]:void 0;d?.length&&a.scopes?.includes(`openid`)&&(d.includes(u)||d.push(u));let f=o?.length?await Fm(e,t,o):{},p=s?await um({ctx:e,opts:t,user:l,client:s,scopes:a.scopes??[],grantType:void 0,sessionId:void 0,resources:o,referenceId:a.referenceId,metadata:Bl(s.metadata),perRequestClaims:void 0,resourcePolicyClaims:f}):{},m=(t.disableJwtPlugin?void 0:pl(e.context))?.options;return{payload:{...p,active:!0,iss:m?.jwt?.issuer??e.context.baseURL,aud:_l(d),client_id:a.clientId,azp:a.clientId,sub:l?.id,sid:c,exp:Math.floor(new Date(a.expiresAt).getTime()/1e3),iat:Math.floor(new Date(a.createdAt).getTime()/1e3),scope:a.scopes?.join(` `),token_type:ch(a.confirmation),...a.confirmation?{cnf:a.confirmation}:{}},requestedUserInfoClaims:a.requestedUserInfoClaims??[]}}async function tg(e,t,n,r){let i=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await Ol(t.storeTokens,n,`refresh_token`)}]});if(!i)throw new z(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_token`});if(!i.clientId||i.clientId!==r||!i.expiresAt||i.expiresAt<new Date||i.revoked)return{active:!1};let a=i.sessionId??void 0;if(a){let t=await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:a}]});(!t||t.expiresAt<new Date)&&(a=void 0)}let o;return i.userId&&(o=await e.context.internalAdapter.findUserById(i?.userId)??void 0),{active:!0,client_id:r,iss:((t.disableJwtPlugin?void 0:pl(e.context))?.options)?.jwt?.issuer??e.context.baseURL,sub:o?.id,sid:a,exp:Math.floor(new Date(i.expiresAt).getTime()/1e3),iat:Math.floor(new Date(i.createdAt).getTime()/1e3),scope:i.scopes?.join(` `),token_type:ch(i.confirmation),...i.confirmation?{cnf:i.confirmation}:{}}}function ng(){return new z(`UNAUTHORIZED`,{error_description:Jh,error:`invalid_token`},{"WWW-Authenticate":Yh})}function rg(e){return e.status===`BAD_REQUEST`||e.body?.error===`invalid_token`}async function ig(e,t,n,r){try{return{payload:await $h(e,t,n,r),requestedUserInfoClaims:[]}}catch(e){if(!(e instanceof z))throw e instanceof Error?e:Error(e)}try{return await eg(e,t,n,r)}catch(e){if(!(e instanceof z))throw e instanceof Error?e:Error(`Unknown error validating access token`)}throw ng()}async function ag(e,t,n,r){return(await ig(e,t,n,r)).payload}async function og(e,t,n,r){let i=await ag(e,t,n,r);if(i.active)return i;throw ng()}async function sg(e,t,n,r){let{payload:i,requestedUserInfoClaims:a}=await ig(e,t,n,r);if(i.active)return{payload:i,requestedUserInfoClaims:a};throw ng()}async function cg(e,t,n,r){if(!n.active||!n.sub)return n;let i=n.client_id??n.azp;if(!i)return n;let a=i===r.clientId?r:await xl(e,t,i);if(!a)return n;let o=await Kl(n.sub,a,t);return{...n,sub:o}}async function lg(e,t){let{token:n,token_type_hint:r}=e.body;r!==`access_token`&&r!==`refresh_token`&&(r=void 0);let{clientId:i,clientSecret:a,preVerified:o,authMethod:s}=Vl(await Hl(e,t,`${e.context.baseURL}/oauth2/introspect`));if(!i||!a&&!o)throw new z(`UNAUTHORIZED`,{error_description:`missing required credentials`,error:`invalid_client`});if(n&&typeof n==`string`&&(n=pc(n)),!n?.length)throw new z(`BAD_REQUEST`,{error_description:`missing a required token for introspection`,error:`invalid_request`});let c=await zl(e,t,i,a,void 0,o,void 0,s);try{if(r===void 0||r===`access_token`)try{return cg(e,t,await ag(e,t,n,c.clientId),c)}catch(e){if(e instanceof z){if(r===`access_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}if(r===void 0||r===`refresh_token`)try{return cg(e,t,await tg(e,t,(await gh(t,n)).token,c.clientId),c)}catch(e){if(e instanceof z){if(r===`refresh_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}throw new z(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`})}catch(e){if(e instanceof z){if(rg(e))return{active:!1};throw e}throw e instanceof Error?(_e.error(`Introspection error:`,e.message,e.stack),new z(`INTERNAL_SERVER_ERROR`)):(_e.error(`Introspection error:`,e),new z(`INTERNAL_SERVER_ERROR`))}}var ug=`1.7.8`;function dg(e){return e?.get(`sec-fetch-mode`)===`cors`}var fg=e({a:()=>Ev,c:()=>k_,d:()=>c_,f:()=>a_,h:()=>o_,i:()=>Ly,l:()=>w_,n:()=>Ay,o:()=>N_,r:()=>Ny,s:()=>Q_,t:()=>Jy,u:()=>r_});async function pg(e,t,n){let r=await My.get(),i=r?.query;if(!i)throw new B(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let a=new URLSearchParams(i),o=a.get(`scope`)?.split(` `)??[],s=sm(t),c=tm(a.get(`claims`),s),l=a.get(`client_id`);if(!l)throw new B(`BAD_REQUEST`,{error_description:`client_id is required`,error:`invalid_client`});let u=e.body.scope?.split(` `);if(u&&!u.every(e=>o?.includes(e)))throw new B(`BAD_REQUEST`,{error_description:`Scope not originally requested`,error:`invalid_request`});let d=e.body.claims,f=d===void 0?c:tm(d,s);if(d!==void 0&&!f.every(e=>c.includes(e)))throw new B(`BAD_REQUEST`,{error_description:`Claim not originally requested`,error:`invalid_request`});if(e.body.accept!==!0)return{redirect:!0,url:By(a.get(`redirect_uri`)??``,`access_denied`,`User denied access`,a.get(`state`)??void 0,Jy(e,t))};let p=await Z(e),m=Ul(a.get(`prompt`)??``).has(`login`),h=m&&Jl(p?.session.createdAt,r?.signedQueryIssuedAt);if(m&&!h)return e?.headers?.set(`accept`,`application/json`),e.query=ql(a),await n(e);let g=await t.postLogin?.consentReferenceId?.({user:p?.user,session:p?.session,scopes:u??o}),_=await e.context.adapter.findOne({model:`oauthConsent`,where:[{field:`clientId`,value:l},{field:`userId`,value:p?.user.id},...g?[{field:`referenceId`,value:g}]:[]]}),v=Math.floor(Date.now()/1e3),y=a.getAll(`resource`),b={clientId:l,userId:p?.user.id,scopes:u??o,requestedUserInfoClaims:f,createdAt:new Date(v*1e3),updatedAt:new Date(v*1e3),resources:y.length?y:void 0,referenceId:g};if(_?.id?await e.context.adapter.update({model:`oauthConsent`,where:[{field:`id`,value:_.id}],update:{resources:b.resources,scopes:b.scopes,requestedUserInfoClaims:b.requestedUserInfoClaims,updatedAt:new Date(v*1e3)}}):await e.context.adapter.create({model:`oauthConsent`,data:{...b,scopes:b.scopes}}),u&&a.set(`scope`,b.scopes.join(` `)),d!==void 0){let e=rm(a.get(`claims`),f);e?a.set(`claims`,JSON.stringify(e)):a.delete(`claims`)}e?.headers?.set(`accept`,`application/json`);let x=Yl(a,`consent`);return h&&(x=Yl(x,`login`),x=Xl(x)),e.query=ql(x),await n(e,{postLogin:r?.postLoginClearedForSession!==void 0&&r.postLoginClearedForSession===p?.session.id})}async function mg(e,t){if(e.body.selected===!0)return await hg(e,t);if(e.body.created===!0)return await gg(e,t);if(e.body.postLogin===!0)return await _g(e,t);throw new B(`BAD_REQUEST`,{error_description:`Missing parameters`,error:`invalid_request`})}async function hg(e,t){let n=(await My.get())?.query;if(!n)throw new B(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});return e.headers?.set(`accept`,`application/json`),e.query=ql(Yl(new URLSearchParams(n),`select_account`)),await t(e)}async function gg(e,t){let n=(await My.get())?.query;if(!n)throw new B(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let r=new URLSearchParams(n);return e.headers?.set(`accept`,`application/json`),e.query=ql(Yl(r,`create`)),await t(e)}async function _g(e,t){let n=await My.get(),r=n?.query;if(!r)throw new B(`BAD_REQUEST`,{error_description:`missing oauth query`,error:`invalid_request`});let i=new URLSearchParams(r);e.headers?.set(`accept`,`application/json`),e.query=ql(i);let a=await Z(e);return await t(e,{postLogin:n?.postLoginClearedForSession!==void 0&&n.postLoginClearedForSession===a?.session.id})}var vg=`http://schemas.openid.net/event/backchannel-logout`,yg=`logout+jwt`,bg=120,xg=5e3;async function Sg(e,t,n,r){return Vp(e,{options:t,payload:{...r,events:{[vg]:{}}},header:{typ:yg},resolvedKey:n??void 0})}async function Cg(e,t,n){let{sessionId:r,userId:i}=n;if(!i)return null;let a=e.context.logger;try{let n=await pd(e.context.adapter),o=[{field:`sessionId`,value:r}],[s,c]=await Promise.all([n.findMany({model:`oauthAccessToken`,where:o}),n.findMany({model:`oauthRefreshToken`,where:o})]),l=new Set;for(let e of s)l.add(e.clientId);for(let e of c)l.add(e.clientId);if(l.size===0)return null;let u=await n.findMany({model:`oauthClient`,where:[{field:`clientId`,operator:`in`,value:Array.from(l)}]}),d=s.filter(e=>!e.revoked).map(e=>e.id),f=c.filter(e=>!e.revoked&&!e.scopes?.includes(`offline_access`)).map(e=>e.id),p=t.disableJwtPlugin?[]:u.filter(e=>!!e.backchannelLogoutUri&&!e.disabled);return{accessTokenIds:d,refreshTokenIds:f,sessionId:r,targets:(await Promise.all(p.map(async e=>{try{return{client:e,sub:await Kl(i,e,t)}}catch(t){return a.warn(`back-channel logout: unable to resolve subject for client ${e.clientId}`,t),null}}))).filter(e=>e!==null)}}catch(e){return a.error(`back-channel logout planning failed`,e),null}}async function wg(e,t){let n=new Date,r=await pd(e.context.adapter),i=await Promise.allSettled([t.accessTokenIds.length>0?r.updateMany({model:`oauthAccessToken`,where:[{field:`id`,operator:`in`,value:t.accessTokenIds}],update:{revoked:n}}):Promise.resolve(),t.refreshTokenIds.length>0?r.updateMany({model:`oauthRefreshToken`,where:[{field:`id`,operator:`in`,value:t.refreshTokenIds}],update:{revoked:n}}):Promise.resolve()]);for(let t of i)t.status===`rejected`&&e.context.logger.error(`back-channel logout: token revocation update failed`,t.reason);t.targets.length>0&&await Tg(e,t)}async function Tg(e,t){let n=e.context.logger,r=pl(e.context)?.options,i=r?.jwt?.issuer??e.context.baseURL,a=Math.floor(Date.now()/1e3),o=a+bg,s=r?.jwt?.sign?null:await Bp(e,r);await Promise.allSettled(t.targets.map(async({client:c,sub:l})=>{try{let u=Fi(32,`a-z`,`A-Z`,`0-9`),d=await Sg(e,r,s,{iss:i,aud:c.clientId,sub:l,sid:t.sessionId,iat:a,exp:o,jti:u}),f=await fetch(c.backchannelLogoutUri,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`,Accept:`application/json`},body:new URLSearchParams({logout_token:d}),signal:AbortSignal.timeout(xg),redirect:`error`});f.status!==200&&f.status!==204&&n.warn(`back-channel logout to client ${c.clientId} returned ${f.status}`)}catch(e){n.warn(`back-channel logout to client ${c.clientId} failed`,e)}}))}var Eg=300,Dg=`.oauth_logout_confirmation`;function Og(e){return e.replace(/[&<>"']/g,e=>{switch(e){case`&`:return`&amp;`;case`<`:return`&lt;`;case`>`:return`&gt;`;case`"`:return`&quot;`;case`'`:return`&#39;`;default:return e}})}function kg(e){let t=e.request?.headers??e.headers;if(!t||dg(t))return!1;let n=t.get(`accept`)??``;return t.get(`sec-fetch-mode`)===`navigate`||n.includes(`text/html`)||n.includes(`application/xhtml+xml`)}function Ag(e,t,n=200){return new Response(`<!doctype html><html><head><meta charset="utf-8"><title>${Og(e)}</title></head><body>${t}</body></html>`,{status:n,headers:{"cache-control":`no-store`,"content-security-policy":`default-src 'none'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'`,"content-type":`text/html; charset=utf-8`,pragma:`no-cache`,"x-content-type-options":`nosniff`}})}function jg(e){return`${e.context.baseURL.replace(/\/$/,``)}/oauth2/end-session/confirm`}function Mg(e){try{return new URL(jg(e)).pathname}catch{return`/oauth2/end-session/confirm`}}function Ng(e){return Ag(`Confirm logout`,`<main><h1>Confirm logout</h1><p>Do you want to log out of this account?</p><form method="post" data-oidc-logout-confirmation action="${Og(jg(e))}"><button type="submit" name="action" value="confirm">Confirm logout</button></form></main>`)}function Pg(e){return Ag(`Logged out`,`<main><p data-oidc-logout-state="logged-out">${e?`Logged out. ${Og(e)}`:`Logged out.`}</p></main>`)}function Fg(e,t){return Ag(`Logout error`,`<main><h1>Logout error</h1><p data-oidc-logout-state="error">${Og(e)}</p></main>`,t)}function Ig(e,t,n,r){if(kg(e))return Fg(r,t===`BAD_REQUEST`?400:t===`UNAUTHORIZED`?401:500);throw new z(t,{error:n,error_description:r})}function Lg(e){return`${e.context.authCookies.sessionToken.name}${Dg}`}function Rg(e,t){return{...e.context.authCookies.sessionToken.attributes,httpOnly:!0,maxAge:t,path:Mg(e),sameSite:`lax`}}async function zg(e,t,n={}){let r={...t?{sessionId:t}:{},...n,expiresAt:Date.now()+Eg*1e3};await e.setSignedCookie(Lg(e),JSON.stringify(r),e.context.secret,Rg(e,Eg))}async function Bg(e){let t=await e.getSignedCookie(Lg(e),e.context.secret);if(typeof t!=`string`)return null;try{let e=JSON.parse(t);if(typeof e!=`object`||!e)return null;let n=e;return n.sessionId!==void 0&&(typeof n.sessionId!=`string`||n.sessionId.length===0)||n.clientId!==void 0&&(typeof n.clientId!=`string`||n.clientId.length===0)||n.postLogoutRedirectUri!==void 0&&(typeof n.postLogoutRedirectUri!=`string`||n.postLogoutRedirectUri.length===0)||n.state!==void 0&&typeof n.state!=`string`||n.redirectInvalid!==void 0&&typeof n.redirectInvalid!=`boolean`||n.postLogoutRedirectUri!==void 0&&n.clientId===void 0||typeof n.expiresAt!=`number`||!Number.isFinite(n.expiresAt)?null:{...typeof n.sessionId==`string`?{sessionId:n.sessionId}:{},...typeof n.clientId==`string`?{clientId:n.clientId}:{},...typeof n.postLogoutRedirectUri==`string`?{postLogoutRedirectUri:n.postLogoutRedirectUri}:{},...typeof n.state==`string`?{state:n.state}:{},...typeof n.redirectInvalid==`boolean`?{redirectInvalid:n.redirectInvalid}:{},expiresAt:n.expiresAt}}catch{return null}}function Vg(e){e.setCookie(Lg(e),``,Rg(e,0))}async function Hg(e){let t=await e.getSignedCookie(e.context.authCookies.sessionToken.name,e.context.secret);if(typeof t!=`string`||t.length===0)return null;try{let n=await e.context.internalAdapter.findSession(t);return n?{session:n.session}:null}catch(t){throw e.context.logger.error(`Failed to read the current logout session`,t),new z(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to read the current session`})}}async function Ug(e,t){try{return await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:t}]})}catch(t){throw e.context.logger.error(`Failed to read the hinted logout session`,t),new z(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to read the hinted session`})}}async function Wg(e,t){if(typeof t.token!=`string`||t.token.length===0)throw new z(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to complete logout`});try{await e.context.internalAdapter.deleteSession(t.token)}catch(t){throw e.context.logger.error(`Failed to delete the logout session`,t),new z(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to complete logout`})}}async function Gg(e,t,n){try{return await xl(e,t,n)}catch(t){throw e.context.logger.error(`Failed to resolve the logout client`,t),new z(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to resolve the logout client`})}}function Kg(e){return(Array.isArray(e)?e:[e]).filter(e=>typeof e==`string`)}function qg(e){if(typeof e.aud==`string`&&e.aud.length>0)return e.aud;if(typeof e.azp==`string`&&e.azp.length>0)return e.azp;let t=Kg(e.aud);return t.length===1?t[0]:null}async function Jg(e,t,n,r){if(r)return Gg(e,t,r);let i;try{i=yi(n)}catch{return null}let a=qg(i);return a?Gg(e,t,a):null}async function Yg(e,t,n,r){try{let i;if(t.disableJwtPlugin){if(!r.clientSecret)return null;let a=await wl(e,t.storeClientSecret,r.clientSecret),{payload:o}=await br(n,new TextEncoder().encode(a));i=JSON.parse(new TextDecoder().decode(o))}else{let t=pl(e.context).options,{payload:r}=await br(n,hi(await Pc(n,{jwksFetch:t?.jwks?.remoteUrl??`${e.context.baseURL}${t?.jwks?.jwksPath??`/jwks`}`})));i=JSON.parse(new TextDecoder().decode(r))}return i.iss!==Jy(e,t)||!Kg(i.aud).includes(r.clientId)||typeof i.sid!=`string`||i.sid.length===0||typeof i.sub!=`string`||i.sub.length===0?null:i}catch{return null}}function Xg(e,t,n){if(!t)return{invalid:!1};if(!e.postLogoutRedirectUris?.includes(t))return{invalid:!0};if(!n)return{uri:t,invalid:!1};try{let e=new URL(t);return e.searchParams.set(`state`,n),{uri:e.toString(),invalid:!1}}catch{return{invalid:!0}}}function Zg(e,t){return t.post_logout_redirect_uri?Xg(e,t.post_logout_redirect_uri,t.state).invalid?{redirectInvalid:!0}:{clientId:e.clientId,postLogoutRedirectUri:t.post_logout_redirect_uri,...t.state===void 0?{}:{state:t.state}}:{}}async function Qg(e,t,n){if(n.redirectInvalid)return{invalid:!0};if(!n.clientId||!n.postLogoutRedirectUri)return{invalid:!1};let r=await Gg(e,t,n.clientId);return!r||r.disabled||!r.enableEndSession?{invalid:!0}:Xg(r,n.postLogoutRedirectUri,n.state)}async function $g(e,t,n={}){return t?kg(e)?(await zg(e,t.session.id,n),Ng(e)):Ig(e,`BAD_REQUEST`,`invalid_request`,`User confirmation is required to complete logout`):kg(e)?(await zg(e,void 0,n),Ng(e)):Ig(e,`BAD_REQUEST`,`invalid_request`,`No active session is available for logout`)}async function e_(e,t){let n=await Bg(e),r=await Hg(e);if(!n||n.expiresAt<=Date.now())return Ig(e,`BAD_REQUEST`,`invalid_request`,`The logout confirmation is invalid or expired`);let i=await Qg(e,t,n);return r?n.sessionId&&n.sessionId!==r.session.id?Ig(e,`BAD_REQUEST`,`invalid_request`,`The logout confirmation is invalid or expired`):(await Wg(e,r.session),Uf(e),Vg(e),i.uri?$(e,i.uri):kg(e)?Pg(i.invalid?`The requested post-logout redirect was not registered.`:void 0):null):(Vg(e),i.uri?$(e,i.uri):kg(e)?Pg(i.invalid?`The requested post-logout redirect was not registered.`:void 0):Ig(e,`BAD_REQUEST`,`invalid_request`,`No active session is available for logout`))}async function t_(e,t){let n=e.query??{},r=e.body??{},i={...n,...r},a=await Hg(e);if(i.id_token_hint===void 0){let n={};if(i.client_id){let r=await Gg(e,t,i.client_id);if(!r)return Ig(e,`BAD_REQUEST`,`invalid_client`,`The logout client does not exist`);if(r.disabled)return Ig(e,`BAD_REQUEST`,`invalid_client`,`The logout client is disabled`);if(!r.enableEndSession)return Ig(e,`UNAUTHORIZED`,`invalid_client`,`The client is not allowed to initiate logout`);n=Zg(r,i)}return $g(e,a,n)}let o=await Jg(e,t,i.id_token_hint,i.client_id);if(!o)return a&&kg(e)?$g(e,a):Ig(e,`BAD_REQUEST`,`invalid_client`,`The logout client does not exist`);if(o.disabled)return Ig(e,`BAD_REQUEST`,`invalid_client`,`The logout client is disabled`);if(!o.enableEndSession)return Ig(e,`UNAUTHORIZED`,`invalid_client`,`The client is not allowed to initiate logout`);let s=await Yg(e,t,i.id_token_hint,o);if(!s)return a&&kg(e)?$g(e,a,i.client_id?Zg(o,i):{}):Ig(e,`UNAUTHORIZED`,`invalid_token`,`The id_token_hint is invalid`);let c=s.sid,l=await Ug(e,c),u=a?.session.id===c;if(a&&!u)return $g(e,a,Zg(o,i));let d=Xg(o,i.post_logout_redirect_uri,i.state),f=l??(u?a?.session:null);return f&&await Wg(e,f),u&&Uf(e),Vg(e),d.uri?$(e,d.uri):kg(e)?Pg(d.invalid?`The requested post-logout redirect was not registered.`:void 0):null}async function n_(e,t){return e_(e,t)}function r_(e,t,n){let r=e.context.baseURL,i=!n?.jwt_disabled;return{scopes_supported:n?.scopes_supported,issuer:qy(t?.jwt?.issuer??r),authorization_endpoint:`${r}/oauth2/authorize`,token_endpoint:`${r}/oauth2/token`,jwks_uri:n?.jwt_disabled?void 0:t?.jwks?.remoteUrl??`${r}${t?.jwks?.jwksPath??`/jwks`}`,registration_endpoint:n?.dynamic_client_registration_supported?`${r}/oauth2/register`:void 0,introspection_endpoint:`${r}/oauth2/introspect`,revocation_endpoint:`${r}/oauth2/revoke`,response_types_supported:n?.grant_types_supported&&!n.grant_types_supported.includes(`authorization_code`)?[]:[`code`],response_modes_supported:[`query`],grant_types_supported:n?.grant_types_supported??[`authorization_code`,`client_credentials`,`refresh_token`],token_endpoint_auth_methods_supported:n?.token_endpoint_auth_methods_supported??[...n?.public_client_supported?[`none`]:[],`client_secret_basic`,`client_secret_post`,`private_key_jwt`],token_endpoint_auth_signing_alg_values_supported:[...gs],introspection_endpoint_auth_methods_supported:n?.endpoint_auth_methods_supported??[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],introspection_endpoint_auth_signing_alg_values_supported:[...gs],revocation_endpoint_auth_methods_supported:n?.endpoint_auth_methods_supported??[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],revocation_endpoint_auth_signing_alg_values_supported:[...gs],code_challenge_methods_supported:[`S256`],authorization_response_iss_parameter_supported:!0,dpop_signing_alg_values_supported:n?.dpop_signing_alg_values_supported??[...oc],backchannel_logout_supported:i,backchannel_logout_session_supported:i}}function i_(e,t){let n=t.disableJwtPlugin?void 0:pl(e.context).options,r=Yc(t),i=t.allowUnauthenticatedClientRegistration||r.length>0;return{jwtPluginOptions:n,clientDiscoveries:r,authMetadata:r_(e,n,{scopes_supported:t.advertisedMetadata?.scopes_supported??t.scopes,dynamic_client_registration_supported:t.allowDynamicClientRegistration,public_client_supported:i,grant_types_supported:Qc(t),token_endpoint_auth_methods_supported:tl(t,{includeNone:i}),endpoint_auth_methods_supported:tl(t),jwt_disabled:t.disableJwtPlugin,dpop_signing_alg_values_supported:t.dpop?.signingAlgorithms})}}function a_(e,t){let{clientDiscoveries:n,authMetadata:r}=i_(e,t);return il(e,t,`oauth-authorization-server`,{...Sl(n),...r})}function o_(e,t){let n=e.context.baseURL,{jwtPluginOptions:r,clientDiscoveries:i,authMetadata:a}=i_(e,t),o={...a,claims_supported:sm(t),claims_parameter_supported:!0,userinfo_endpoint:`${n}/oauth2/userinfo`,subject_types_supported:t.pairwiseSecret?[`public`,`pairwise`]:[`public`],acr_values_supported:[`0`],id_token_signing_alg_values_supported:(()=>{if(t.disableJwtPlugin)return[`HS256`];let e=r?.jwks?.keyPairConfig?.alg??`EdDSA`,n=r?.jwks?.keyPairConfigs?.map(e=>e.alg)??[];return Array.from(new Set([e,...n]))})(),end_session_endpoint:`${n}/oauth2/end-session`,request_parameter_supported:!1,request_uri_parameter_supported:!1,prompt_values_supported:[`login`,`consent`,`create`,`select_account`,`none`]};return il(e,t,`openid-configuration`,{...Sl(i),...o})}var s_=`public, max-age=15, stale-while-revalidate=15, stale-if-error=86400`;function c_(e,t){let n=new Headers(t);return n.has(`Cache-Control`)||n.set(`Cache-Control`,s_),n.set(`Content-Type`,`application/json`),new Response(JSON.stringify(e),{status:200,headers:n})}function l_(e,t,n){let{redirectOnError:r,onValidationError:i,errorCodesByField:a,defaultError:o=`invalid_request`,...s}=t;if(!r)return X(e,{...s,onValidationError:async e=>{throw i&&await i(e),new z(`BAD_REQUEST`,{...u_(e.issues,a,o)})}},n);let c=r,{body:l,query:u,...d}=s;async function f(e,t,n){if(!n)return{ok:!0};let r=await n.safeParseAsync(e[t]??{});return r.success?(e[t]=r.data,{ok:!0}):(i&&await i({message:r.error.message,issues:r.error.issues}),{ok:!1,response:c({...u_(r.error.issues,a,o),ctx:e})})}return X(e,d,async e=>{let t=await f(e,`body`,l);if(!t.ok)return t.response;let r=await f(e,`query`,u);return r.ok?n(e):r.response})}function u_(e,t,n=`invalid_request`){let r=e[0];if(!r)return{error:n,error_description:`Invalid request.`};let i=r.path?.[0],a=typeof i==`string`?i:void 0,o=a?t?.[a]:void 0,s=r.path?.length?g(r.path):``;return{error:d_(r,o,n),error_description:p_(r,s)}}function d_(e,t,n){return typeof t==`string`?t:f_(e)?t?.missing??n:e.code===`invalid_value`?t?.invalid??n:n}function f_(e){return e.code===`invalid_type`&&e.message.endsWith(`received undefined`)}function p_(e,t){if(!t)return e.message;if(e.code===`invalid_type`)return e.message.endsWith(`received undefined`)?`${t} is required`:e.message.endsWith(`received array`)?`${t} must not appear more than once`:`${t} must be a ${e.expected??`valid value`}`;if(e.code===`invalid_value`){let n=e.values;if(Array.isArray(n)&&n.length>0)return`${t} must be one of: ${n.join(`, `)}`}return`${t}: ${e.message}`}var m_=e=>du(async t=>{if(!e.allowPublicClientPrelogin)throw new B(`BAD_REQUEST`);let n=t.body.oauth_query;if(!await bl(n,t.context.secret))throw new B(`UNAUTHORIZED`,{error:`invalid_signature`})}),h_={"P-256":`ES256`,"P-384":`ES384`,"P-521":`ES512`},g_=[`Ed25519`],__=[`d`,`p`,`q`,`dp`,`dq`,`qi`,`oth`];function v_(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function y_(e,t){return typeof e[t]==`string`&&e[t].length>0}function b_(e){return typeof e==`string`&&Object.prototype.hasOwnProperty.call(h_,e)}function x_(e){return g_.some(t=>t===e)}function S_(e){switch(e.kty){case`RSA`:return y_(e,`n`)&&y_(e,`e`);case`EC`:return b_(e.crv)&&y_(e,`x`)&&y_(e,`y`);case`OKP`:return x_(e.crv)&&y_(e,`x`);default:return!1}}function C_(e){if(e.alg===void 0)return!0;if(typeof e.alg!=`string`||!gs.some(t=>t===e.alg))return!1;switch(e.kty){case`RSA`:return e.alg.startsWith(`RS`)||e.alg.startsWith(`PS`);case`EC`:return b_(e.crv)&&h_[e.crv]===e.alg;case`OKP`:return x_(e.crv)&&e.alg===`EdDSA`;default:return!1}}function w_(e){let t=v_(e)&&Array.isArray(e.keys)?e.keys:void 0;if(!t?.length)return{valid:!1,error:`jwks must be an RFC 7517 JWK Set object with a non-empty keys array`};for(let e of t){if(!v_(e))return{valid:!1,error:`jwks keys must be supported public JWKs with required key parameters`};if(e.kty===`oct`||`k`in e||__.some(t=>t in e))return{valid:!1,error:`jwks must contain only public asymmetric keys`};if(!S_(e))return{valid:!1,error:`jwks keys must be supported public JWKs with required key parameters`};if(!C_(e))return{valid:!1,error:`jwks key alg must be supported for private_key_jwt and compatible with its key type and signing curve`}}return{valid:!0,jwks:{keys:t}}}var T_=Object.freeze(Object.keys({clientId:!0,clientSecret:!0,clientDiscoveryId:!0,disabled:!0,scopes:!0,clientCredentialsScopes:!0,userId:!0,createdAt:!0,updatedAt:!0,expiresAt:!0,name:!0,uri:!0,icon:!0,contacts:!0,tos:!0,policy:!0,softwareId:!0,softwareVersion:!0,softwareStatement:!0,redirectUris:!0,postLogoutRedirectUris:!0,backchannelLogoutUri:!0,backchannelLogoutSessionRequired:!0,tokenEndpointAuthMethod:!0,grantTypes:!0,responseTypes:!0,applicationType:!0,jwks:!0,jwksUri:!0,requirePKCE:!0,dpopBoundAccessTokens:!0,skipConsent:!0,enableEndSession:!0,subjectType:!0,referenceId:!0,metadata:!0})),E_=`client_id.client_secret.client_secret_expires_at.scope.user_id.client_id_issued_at.client_name.client_uri.logo_uri.contacts.tos_uri.policy_uri.jwks.jwks_uri.software_id.software_version.software_statement.redirect_uris.post_logout_redirect_uris.backchannel_logout_uri.backchannel_logout_session_required.token_endpoint_auth_method.grant_types.response_types.application_type.disabled.skip_consent.enable_end_session.require_pkce.dpop_bound_access_tokens.subject_type.reference_id`.split(`.`),D_=new Set([...T_,...E_,`public`,`type`,`resources`,`client_credentials_scopes`]),O_=new Set(`disabled.client_secret.client_secret_expires_at.client_id_issued_at.skip_consent.enable_end_session.require_pkce.reference_id.user_id.resources.clientSecret.clientDiscoveryId.skipConsent.enableEndSession.requirePKCE.referenceId.userId.clientId.applicationType.tokenEndpointAuthMethod.redirectUris.postLogoutRedirectUris.grantTypes.responseTypes.scopes.expiresAt.createdAt.updatedAt.softwareId.softwareVersion.softwareStatement.backchannelLogoutUri.backchannelLogoutSessionRequired.jwksUri.dpopBoundAccessTokens.subjectType`.split(`.`));function k_(e){return O_.has(e)}function A_(e){if(e)return Object.fromEntries(Object.entries(e).filter(([e])=>!D_.has(e)))}async function j_(e,t,n,r,i){if(!t)throw new B(`UNAUTHORIZED`);if(!e.headers)throw new B(`BAD_REQUEST`);if(r===`configure-client-credentials-scopes`&&!n.clientPrivileges||n.clientPrivileges&&!await n.clientPrivileges({headers:e.headers,action:r,session:t.session,user:t.user,clientId:i}))throw new B(`UNAUTHORIZED`)}async function M_(e,t,n,r,i){if(!t)throw new B(`UNAUTHORIZED`);if(!e.headers)throw new B(`BAD_REQUEST`);if(n.resourcePrivileges&&!await n.resourcePrivileges({headers:e.headers,action:r,session:t.session,user:t.user,resourceId:i}))throw new B(`UNAUTHORIZED`)}var N_=Ce({consumeClientAssertion:()=>Q_,isPrivateHostname:()=>W_,verifyClientAssertion:()=>$_}),P_=new WeakMap,F_=3e5,I_=500,L_=5e3,R_=65536,z_=/^application\/(?:[-\w.]+\+)?json\s*(?:;|$)/i;function B_(e,t,n,r){if(e.set(t,{jwks:n,fetchedAt:r}),e.size>I_){let t=e.keys().next().value;t!==void 0&&e.delete(t)}}function V_(e){let t=P_.get(e);if(t)return t;let n=new Map;return P_.set(e,n),n}function H_(e){return`${e.clientDiscoveryId??`managed`}:${e.jwksUri??``}`}var U_=[...gs];function W_(e){return!xp(e)}function G_(e,t,n){let r=new URL(t);if(r.protocol!==`https:`)throw new z(`BAD_REQUEST`,{error_description:`jwks_uri must use HTTPS`,error:`invalid_client`});if(r.username||r.password)throw new z(`BAD_REQUEST`,{error_description:`jwks_uri must not contain credentials`,error:`invalid_client`});if(t.includes(`#`))throw new z(`BAD_REQUEST`,{error_description:`jwks_uri must not include a fragment component`,error:`invalid_client`});if(W_(r.hostname))throw new z(`BAD_REQUEST`,{error_description:`jwks_uri must not point to a private or reserved address`,error:`invalid_client`});if(!(n&&r.origin===n)&&!e.context.isTrustedOrigin(r.href))throw new z(`BAD_REQUEST`,{error_description:`client jwks_uri is not trusted`,error:`invalid_client`})}function K_(e){try{let t=new URL(e);return t.protocol!==`https:`&&t.protocol!==`http:`?void 0:t.origin}catch{return}}async function q_(e){let t=e.headers.get(`content-length`);if(t!==null&&Number.isFinite(Number(t))&&Number(t)>R_)throw await e.body?.cancel(),Error(`JWKS response exceeds 64 KiB`);if(!e.body)return``;let n=e.body.getReader(),r=[],i=0;for(;;){let{done:e,value:t}=await n.read();if(e)break;if(i+=t.byteLength,i>R_)throw await n.cancel(),Error(`JWKS response exceeds 64 KiB`);r.push(t)}let a=new Uint8Array(i),o=0;for(let e of r)a.set(e,o),o+=e.byteLength;return new TextDecoder().decode(a)}async function J_(e,t=globalThis.fetch){let n=new AbortController,r=setTimeout(()=>n.abort(),L_);try{let r=await t(e,{signal:n.signal,headers:{accept:`application/json`},redirect:`error`});if(r.redirected)throw Error(`JWKS fetch redirected`);if(r.status!==200)throw Error(`JWKS fetch returned ${r.status}`);let i=r.headers.get(`content-type`);if(!i||!z_.test(i))throw Error(`JWKS response must use a JSON media type`);let a=await q_(r),o;try{o=JSON.parse(a)}catch{return{valid:!1}}let s=w_(o);return s.valid?{valid:!0,jwks:s.jwks}:{valid:!1}}finally{clearTimeout(r)}}function Y_(){return new z(`BAD_REQUEST`,{error_description:`failed to fetch client JWKS`,error:`invalid_client`})}async function X_(e,t,n){if(n.jwks)return JSON.parse(n.jwks);if(!n.jwksUri)throw new z(`BAD_REQUEST`,{error_description:`client has no JWKS configured`,error:`invalid_client`});let r=n.clientDiscoveryId?Yc(t).find(e=>e.id===n.clientDiscoveryId):void 0;if(n.clientDiscoveryId&&!r?.fetchClientMetadataResource)throw new z(`BAD_REQUEST`,{error_description:`client discovery does not provide a metadata resource transport`,error:`invalid_client`});G_(e,n.jwksUri,n.clientDiscoveryId?K_(n.clientId):void 0);let i=Date.now(),a=H_(n),o=V_(t),s=o.get(a);if(s&&i-s.fetchedAt<F_)return s.jwks;let c;try{c=await J_(n.jwksUri,r?.fetchClientMetadataResource)}catch{let e=F_*2;if(s&&i-s.fetchedAt<e)return s.jwks;throw Y_()}if(!c.valid)throw Y_();return B_(o,a,c.jwks,i),c.jwks}async function Z_(e,t){if(!t.jwksUri)return null;let n=t.clientDiscoveryId?Yc(e).find(e=>e.id===t.clientDiscoveryId):void 0;if(t.clientDiscoveryId&&!n?.fetchClientMetadataResource)return null;try{let r=await J_(t.jwksUri,n?.fetchClientMetadataResource);return r.valid?(B_(V_(e),H_(t),r.jwks,Date.now()),r.jwks):null}catch{return null}}async function Q_(e,t,n){let{namespace:r,payload:i,expectedAudience:a}=n;if(!(Array.isArray(i.aud)?i.aud:i.aud==null?[]:[i.aud]).includes(a))throw new z(`BAD_REQUEST`,{error_description:`client assertion aud does not match the endpoint`,error:`invalid_client`});let o=t.assertionMaxLifetime??300,s=Math.floor(Date.now()/1e3);if(typeof i.exp!=`number`)throw new z(`BAD_REQUEST`,{error_description:`client assertion must include exp claim`,error:`invalid_client`});if(i.exp<=s)throw new z(`BAD_REQUEST`,{error_description:`client assertion has expired`,error:`invalid_client`});if(i.exp-s>o)throw new z(`BAD_REQUEST`,{error_description:`client assertion exp is too far in the future (max ${o}s)`,error:`invalid_client`});if(typeof i.iat==`number`&&s-i.iat>o)throw new z(`BAD_REQUEST`,{error_description:`client assertion iat is too far in the past (max ${o}s)`,error:`invalid_client`});if(typeof i.jti!=`string`||i.jti.length===0)throw new z(`BAD_REQUEST`,{error_description:`client assertion must include jti claim`,error:`invalid_client`});let c=await Li(`SHA-256`).digest(new TextEncoder().encode(`${r}:${i.jti}`)),l=me(new Uint8Array(c).slice(0,24),e.context.options);try{await e.context.adapter.create({model:`oauthClientAssertion`,data:{id:l,expiresAt:new Date(i.exp*1e3)},forceAllowId:!0})}catch(t){let n=!1;try{n=!!await e.context.adapter.findOne({model:`oauthClientAssertion`,where:[{field:`id`,value:l}]})}catch{}throw n?new z(`BAD_REQUEST`,{error_description:`client assertion jti has already been used`,error:`invalid_client`}):t}}async function $_(e,t,n,r,i,a){if(r!==`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)throw new z(`BAD_REQUEST`,{error_description:`unsupported client_assertion_type`,error:`invalid_client`});let o;try{o=vi(n)}catch{throw new z(`BAD_REQUEST`,{error_description:`malformed client assertion: invalid JWT header`,error:`invalid_client`})}if(!o.alg||!U_.includes(o.alg))throw new z(`BAD_REQUEST`,{error_description:`unsupported assertion signing algorithm: ${o.alg}`,error:`invalid_client`});let s;try{s=yi(n)}catch{throw new z(`BAD_REQUEST`,{error_description:`malformed client assertion: invalid JWT payload`,error:`invalid_client`})}let c=s.sub??s.iss;if(!c)throw new z(`BAD_REQUEST`,{error_description:`client assertion must contain sub or iss claim identifying the client`,error:`invalid_client`});if(i&&i!==c)throw new z(`BAD_REQUEST`,{error_description:`client_id in body does not match assertion sub/iss`,error:`invalid_client`});let l=await xl(e,t,c);if(!l)throw new z(`BAD_REQUEST`,{error_description:`unknown client`,error:`invalid_client`});if(l.disabled)throw new z(`BAD_REQUEST`,{error_description:`client is disabled`,error:`invalid_client`});if(l.tokenEndpointAuthMethod!==`private_key_jwt`)throw new z(`BAD_REQUEST`,{error_description:`client is not registered for private_key_jwt authentication`,error:`invalid_client`});let u=await X_(e,t,l),d=a??`${e.context.baseURL}/oauth2/token`,f=Jy(e,t),p=[...new Set([d,f])],m={issuer:c,subject:c,audience:p,algorithms:U_},h;try{({payload:h}=await Vr(n,hi(u),m))}catch(e){if(e instanceof Error&&/no matching key|no applicable key/i.test(e.message)){let e=await Z_(t,l);if(e)try{({payload:h}=await Vr(n,hi(e),m))}catch{throw new z(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}else throw new z(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}else throw new z(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}let g=(Array.isArray(h.aud)?h.aud:[h.aud]).find(e=>typeof e==`string`&&p.includes(e));return await Q_(e,t,{namespace:`private_key_jwt:${c}`,payload:h,expectedAudience:g}),{clientId:c}}function ev(e,t,n){return new z(e,{error:t,error_description:n},{"WWW-Authenticate":`Bearer error="${t}"`,...cu})}async function tv(e,t,n){let r=e.headers,i;try{i=ul(r?.get(`authorization`))}catch{throw ev(`BAD_REQUEST`,`invalid_request`,`Malformed initial access token Authorization header`)}if(!i||!r)return;if(!t.validateInitialAccessToken)throw ev(`UNAUTHORIZED`,`invalid_token`,`Invalid initial access token`);let a;try{a=await t.validateInitialAccessToken({initialAccessToken:i,headers:r,clientMetadata:n})}catch(e){throw e instanceof z?e:new z(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Initial access token validation failed`})}if(!a)throw ev(`UNAUTHORIZED`,`invalid_token`,`Invalid initial access token`);return a}var nv=[`authorization_code`];function rv(e){return[...new Set([...e.clientRegistrationDefaultScopes??e.scopes??[],...e.clientRegistrationAllowedScopes??[]])]}function iv(e){let t=e.grant_types??[...nv];if(t.length>0)return t;throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`grant_types must contain at least one grant type`})}function av(e,t){return e.response_types?e.response_types:t.includes(`authorization_code`)?[`code`]:void 0}function ov(e,t=`web`){let n=iv(e);return{...e,token_endpoint_auth_method:e.token_endpoint_auth_method??`client_secret_basic`,application_type:e.application_type??(t===null?void 0:t),grant_types:n,response_types:av(e,n)}}function sv(e){let t=new URL(e);return t.protocol!==`http:`&&t.protocol!==`https:`&&t.host!==``}function cv(e){try{let t=new URL(e).protocol;return t!==`http:`&&t!==`https:`}catch{return!1}}function lv(e,t){let n=e.clientRegistrationDefaultApplicationType??`web`;return n===`infer`?(t.redirect_uris??[]).some(cv)?`native`:`web`:n}function uv(e){throw new B(`BAD_REQUEST`,{error:`invalid_redirect_uri`,error_description:e})}function dv(e){let t=/^http:\/\/([^/?#]*)/i.exec(e)?.[1];if(!t)return null;let n=t.slice(t.lastIndexOf(`@`)+1);if(n.startsWith(`[`)){let e=n.indexOf(`]`);return e<0?null:n.slice(0,e+1).toLowerCase()}return(n.split(`:`)[0]??``).toLowerCase()}function fv(e,t){let n=new Set([...e.clientRegistrationDefaultResources??[],...e.clientRegistrationAllowedResources??[]]);for(let e of t)if(!n.has(e))throw new B(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${e} is not allowed for client registration`})}async function pv(e,t,n){let r=t.clientRegistrationDefaultResources??[],i=[...new Set([...r,...n])];for(let n of i){let r=await zm(e,t,n);if(!r)throw new B(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} does not exist`});if(r.disabled)throw new B(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is disabled`})}return i}function mv(e,t){let n;try{n=new URL(e)}catch{uv(`redirect URI must be an absolute URI: ${e}`)}(e.includes(`#`)||n.username.length>0||n.password.length>0)&&uv(`redirect URI must not include credentials or a fragment: ${e}`);let r=n.protocol===`http:`,i=n.protocol===`https:`;/^localhost\.+$/i.test(n.hostname)&&uv(`redirect URI localhost must not include trailing dots: ${e}`);let a=yp(n.hostname)||n.hostname===`localhost`,o=dv(e);t===`web`?(!i||a)&&uv(`web clients require https redirect URIs on non-loopback hosts: ${e}`):i?a&&uv(`native clients must not use https loopback redirect URIs: ${e}`):r?o===`localhost`||o===`127.0.0.1`||o===`[::1]`||uv(`native clients may use http only on the exact loopback hosts localhost, 127.0.0.1, or [::1]: ${e}`):Fp(n)||uv(`native private-use redirect URI schemes must not use a reserved scheme; they must be an authority-free reverse-domain URI or a custom-scheme URI with a host and a path: ${e}`)}function hv(e){let t=w_(e);if(!t.valid)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:t.error})}async function gv(e,t){let n=e.body;if(!t.allowDynamicClientRegistration)throw new B(`FORBIDDEN`,{error:`access_denied`,error_description:`Client registration is disabled`});let r=await Z(e),i=r?void 0:await tv(e,t,n),a=!!i;if(!(r||a||t.allowUnauthenticatedClientRegistration))throw new B(`UNAUTHORIZED`,{error_description:`Authentication required for client registration`},{"WWW-Authenticate":`Bearer`,...cu});if(!r&&!a&&n.grant_types?.includes(`client_credentials`))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`client_credentials grant requires authenticated registration`});let o=Array.isArray(n.resources)?n.resources.filter(e=>typeof e==`string`&&e.length>0):[];r&&await j_(e,r,t,`create`);let s=i?.referenceId??(r&&t.clientReference?await t.clientReference({user:r.user,session:r.session}):void 0),c=await Cv(e,t,{metadata:n,registrationSource:`dynamic`,userId:s?void 0:r?.session.userId,referenceId:s,requestedResources:o});return e.setStatus(201),e.json(c)}async function _v(e,t,n){let r=n?.registrationSource===`clientMetadataDocument`,i=ov(e,r?null:n?.registrationSource===`dynamic`?lv(t,e):`web`),a=i.token_endpoint_auth_method??`client_secret_basic`;if(!new Set(tl(t,{includeNone:!0})).has(a))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`unsupported token_endpoint_auth_method ${a}`});if(i.dpop_bound_access_tokens!==void 0&&typeof i.dpop_bound_access_tokens!=`boolean`)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`dpop_bound_access_tokens must be a boolean`});let o=i.grant_types??[],s=i.response_types,c=i.application_type;if(c!==void 0&&c!==`web`&&c!==`native`)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`application_type must be web or native`});if(o.includes(`authorization_code`)&&(!i.redirect_uris||i.redirect_uris.length===0))throw new B(`BAD_REQUEST`,{error:`invalid_redirect_uri`,error_description:`Redirect URIs are required for authorization_code and implicit grant types`});for(let e of i.redirect_uris??[])mv(e,c??(r?`native`:`web`));let l=new Set(Qc(t));if(r){if(!o.some(e=>l.has(e)))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`no mutually supported grant_type among ${o.join(`, `)}`})}else for(let e of o)if(!l.has(e))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`unsupported grant_type ${e}`});if(o.includes(`authorization_code`)&&!s?.includes(`code`))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`When 'authorization_code' grant type is used, 'code' response type must be included`});if(!o.includes(`authorization_code`)&&s?.includes(`code`))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`When 'code' response type is used, 'authorization_code' grant type must be included`});if(i.subject_type!==void 0){if(i.subject_type!==`public`&&i.subject_type!==`pairwise`)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`subject_type must be "public" or "pairwise"`});if(i.subject_type===`pairwise`&&!t.pairwiseSecret)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise subject_type requires server pairwiseSecret configuration`});if(i.subject_type===`pairwise`&&i.redirect_uris?.some(sv))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise clients cannot use custom-scheme redirect URIs that include a host`});if(i.subject_type===`pairwise`&&i.redirect_uris&&i.redirect_uris.length>1&&new Set(i.redirect_uris.map(e=>new URL(e).host)).size>1)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise clients with redirect_uris on different hosts require a sector_identifier_uri, which is not yet supported. All redirect_uris must share the same host.`})}let u=(i?.scope)?.split(` `).filter(e=>e.length),d=n?.registrationSource===`dynamic`||n?.registrationSource===`clientMetadataDocument`,f=d?rv(t):t.scopes;if(f){let e=new Set(f);for(let t of u??[])if(!e?.has(t))throw new B(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`cannot request scope ${t}`})}if(d&&i.require_pkce===!1)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pkce is required for registered clients.`});if(i.jwks||i.jwks_uri){if(i.jwks&&i.jwks_uri)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks and jwks_uri are mutually exclusive`});if(i.jwks_uri)try{let e=new URL(i.jwks_uri);if(e.protocol!==`https:`)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must use HTTPS`});if(e.username||e.password)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not contain credentials`});if(i.jwks_uri.includes(`#`))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not include a fragment component`});if(W_(e.hostname))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not point to a private or reserved address`});if(n?.ctx&&!n.ctx.context.isTrustedOrigin(e.href)){let t=typeof i.client_id==`string`?i.client_id:void 0;if(!(r&&t!==void 0&&URL.canParse(t)&&new URL(t).origin===e.origin))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must belong to a trusted origin or the Client ID Metadata Document origin`})}}catch(e){throw e instanceof B?e:new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must be a valid URL`})}i.jwks&&hv(i.jwks)}if(a===`private_key_jwt`&&!i.jwks&&!i.jwks_uri)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`private_key_jwt requires either jwks or jwks_uri`});if(i.backchannel_logout_uri!==void 0){if(t.disableJwtPlugin)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri requires the jwt plugin (disableJwtPlugin must be false)`});let e;try{e=new URL(i.backchannel_logout_uri)}catch{throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must be an absolute URL`})}if(i.backchannel_logout_uri.includes(`#`))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not include a fragment component`});if(e.protocol!==`https:`)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must use https`});if(e.username||e.password)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not contain credentials`});if(W_(e.hostname))throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri must not point to a private or reserved address`})}}var vv=Symbol(`client-registration-collision`);function yv(e){if(!e||typeof e!=`object`)return!1;let t=e;return t[vv]===!0&&(t.kind===`oauth-client-row-unique`||t.kind===`oauth-client-resource-link-unique`)&&`cause`in t}async function bv(e,t,n){let r=n.registrationSource===`dynamic`&&!n.metadata.scope?{...n.metadata,scope:(t.clientRegistrationDefaultScopes??t.scopes)?.join(` `)}:n.metadata,i=ov(r,n.registrationSource===`clientMetadataDocument`?null:n.registrationSource===`dynamic`?lv(t,r):`web`),a=i.token_endpoint_auth_method===`none`,o=i.token_endpoint_auth_method===`private_key_jwt`,s=nl(t,i.token_endpoint_auth_method);await _v(i,t,{registrationSource:n.registrationSource,ctx:e});let c=n.clientId??t.generateClientId?.()??Fi(32,`a-z`,`A-Z`),l=a||o||s?void 0:t.generateClientSecret?.()||Fi(32,`a-z`,`A-Z`),u=l?await El(e,t,l):void 0,d=n.registrationSource===`dynamic`&&!a&&t.clientRegistrationRequirePKCE===!1,f=i.require_pkce??(!d&&void 0),p=Math.floor(Date.now()/1e3),{resources:m,...h}=n.registrationSource===`dynamic`||n.registrationSource===`clientMetadataDocument`?{...i,scope:rv(t).join(` `)}:i,g=n.registrationSource===`clientMetadataDocument`?void 0:{userId:n.userId,referenceId:n.referenceId},_=kv({...h,redirect_uris:i.redirect_uris??[],disabled:void 0,client_secret_expires_at:u?n.registrationSource===`dynamic`&&t.clientRegistrationClientSecretExpiration?Lp(t.clientRegistrationClientSecretExpiration,p):0:void 0,client_id:c,client_secret:u,client_id_issued_at:p,require_pkce:f,user_id:g?.referenceId?void 0:g?.userId,reference_id:g?.referenceId});_.clientCredentialsScopes=n.registrationSource===`clientMetadataDocument`?n.existingClient?.clientCredentialsScopes??[]:n.registrationSource===`managed`?n.clientCredentialsScopes??[]:[],_.clientDiscoveryId=n.registrationSource===`clientMetadataDocument`?n.clientDiscoveryId:null,n.registrationSource===`clientMetadataDocument`&&i.application_type===void 0&&(_.applicationType=null);let v=n.registrationSource===`clientMetadataDocument`?[]:n.requestedResources??[];n.registrationSource===`dynamic`&&fv(t,v);let y=await pv(e,t,v),b=t.schema?.oauthClient?.modelName??`oauthClient`,x=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,S=n.registrationSource===`clientMetadataDocument`?n.existingClient:void 0,C=n.registrationSource===`clientMetadataDocument`?n.clientDiscoveryId:null,w=await hd(e.context.adapter,async()=>{let t=await pd(e.context.adapter),r,i=!1;if(S){let e=await t.update({model:b,where:[{field:`clientId`,value:c},{field:`clientDiscoveryId`,value:C}],update:{..._,disabled:S.disabled,skipConsent:S.skipConsent,enableEndSession:S.enableEndSession,createdAt:S.createdAt,updatedAt:new Date(p*1e3)}});if(!e)throw new B(`BAD_REQUEST`,{error:`invalid_client`,error_description:`client no longer exists`});r=e}else{try{r=await t.create({model:b,data:{..._,createdAt:new Date(p*1e3),updatedAt:new Date(p*1e3)}})}catch(e){throw n.registrationSource===`clientMetadataDocument`&&Dv(e)?{[vv]:!0,kind:`oauth-client-row-unique`,clientId:c,cause:e}:e}i=!0}let a=y.length===0?[]:await t.findMany({model:x,where:[{field:`clientId`,value:c}]}),o=new Set(a.map(e=>e.resourceId)),s=new Date;for(let e of y)if(!o.has(e))try{await t.create({model:x,data:{clientId:c,resourceId:e,createdAt:s}})}catch(t){throw n.registrationSource===`clientMetadataDocument`&&Dv(t)?{[vv]:!0,kind:`oauth-client-resource-link-unique`,clientId:c,resourceId:e,cause:t}:t}return{client:r,created:i}});return{client:w.client,clientSecret:l,resources:y,created:w.created}}function xv(e,t){let n=Av({...e.client,clientSecret:e.clientSecret?(t.prefix?.clientSecret??``)+e.clientSecret:void 0});return e.resources.length>0&&(n.resources=e.resources),n}function Sv(e,t){return{...xv(e,t),client_credentials_scopes:[...e.client.clientCredentialsScopes??[]]}}async function Cv(e,t,n){return xv(await bv(e,t,n),t)}async function wv(e,t,n){return Sv(await bv(e,t,n),t)}function Tv(e,t){if(e&&e.clientDiscoveryId!==t)throw new B(`BAD_REQUEST`,{error:`invalid_client`,error_description:`client_id is already owned by a different registration source`})}async function Ev(e,t,n){if(Tv(n.existingClient,n.clientDiscoveryId),n.metadata.backchannel_logout_uri!==void 0||n.metadata.backchannel_logout_session_required!==void 0)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`Client ID Metadata Documents cannot register a back-channel logout target`});if((n.metadata.token_endpoint_auth_method??`none`)!==`none`&&n.metadata.token_endpoint_auth_method!==`private_key_jwt`)throw new B(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`Client ID Metadata Document clients cannot use a shared secret`});let r={...n,metadata:{...n.metadata,token_endpoint_auth_method:n.metadata.token_endpoint_auth_method??`none`,client_secret:void 0,client_secret_expires_at:void 0},registrationSource:`clientMetadataDocument`};try{return await bv(e,t,r)}catch(i){if(!yv(i))throw i;let a=t.schema?.oauthClient?.modelName??`oauthClient`,o=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,s=await e.context.adapter.findOne({model:a,where:[{field:`clientId`,value:n.clientId}]});if(i.clientId!==n.clientId||!s||s.clientDiscoveryId!==n.clientDiscoveryId||i.kind===`oauth-client-resource-link-unique`&&!await e.context.adapter.findOne({model:o,where:[{field:`clientId`,value:i.clientId},{field:`resourceId`,value:i.resourceId}]}))throw i.cause;try{return await bv(e,t,{...r,existingClient:s})}catch(e){throw yv(e)?e.cause:e}}}function Dv(e){if(!e||typeof e!=`object`)return!1;let t=e,n=String(t.code??t.errno??``);return[`1062`,`11000`,`23505`,`ER_DUP_ENTRY`,`P2002`,`SQLITE_CONSTRAINT_UNIQUE`].includes(n)||t.name===`MongoServerError`&&t.code===11e3?!0:typeof t.message==`string`&&/(?:duplicate|unique constraint|unique key)/i.test(t.message)}async function Ov(e,t,n){let r=await Z(e);if(await j_(e,r,t,`create`),!r)throw new B(`UNAUTHORIZED`);let i=t.clientReference?await t.clientReference({user:r.user,session:r.session}):void 0,{client_credentials_scopes:a,...o}=e.body,s=n?.admin?th(a??[]):[];nh(s,iv(o),o.token_endpoint_auth_method,t),s.length>0&&await j_(e,r,t,`configure-client-credentials-scopes`);let c=n?.admin?o.resources:void 0;for(let n of new Set(c??[]))await M_(e,r,t,`link`,n);let l={metadata:o,registrationSource:`managed`,userId:i?void 0:r.session.userId,referenceId:i,clientCredentialsScopes:s,...c?{requestedResources:c}:{}},u=n?.admin?await wv(e,t,l):await Cv(e,t,l);return e.setStatus(201),e.json(u)}function kv(e){let{client_id:t,client_secret:n,client_secret_expires_at:r,scope:i,user_id:a,client_id_issued_at:o,client_name:s,client_uri:c,logo_uri:l,contacts:u,tos_uri:d,policy_uri:f,jwks:p,jwks_uri:m,software_id:h,software_version:g,software_statement:_,redirect_uris:v,post_logout_redirect_uris:y,backchannel_logout_uri:b,backchannel_logout_session_required:x,token_endpoint_auth_method:S,grant_types:C,response_types:w,application_type:T,disabled:E,skip_consent:D,enable_end_session:O,require_pkce:k,dpop_bound_access_tokens:A,subject_type:j,reference_id:M,metadata:N}=e,P=r?new Date(Number(r)*1e3):void 0,F=o?new Date(o*1e3):void 0,I=i?.split(` `),L=A_(N??{}),R=L&&Object.keys(L).length?JSON.stringify(L):void 0;return{clientId:t,clientSecret:n,disabled:E,scopes:I,userId:a,createdAt:F,expiresAt:P,name:s,uri:c,icon:l,contacts:u,tos:d,policy:f,softwareId:h,softwareVersion:g,softwareStatement:_,redirectUris:v,postLogoutRedirectUris:y,backchannelLogoutUri:b,backchannelLogoutSessionRequired:x,tokenEndpointAuthMethod:S,grantTypes:C,responseTypes:w,jwks:p?JSON.stringify(p):void 0,jwksUri:m,applicationType:T,skipConsent:D,enableEndSession:O,requirePKCE:k,dpopBoundAccessTokens:A,subjectType:j,referenceId:M,metadata:R}}function Av(e){let{clientId:t,clientSecret:n,disabled:r,scopes:i,userId:a,createdAt:o,updatedAt:s,expiresAt:c,name:l,uri:u,icon:d,contacts:f,tos:p,policy:m,softwareId:h,softwareVersion:g,softwareStatement:_,redirectUris:v,postLogoutRedirectUris:y,backchannelLogoutUri:b,backchannelLogoutSessionRequired:x,tokenEndpointAuthMethod:S,grantTypes:C,responseTypes:w,applicationType:T,jwks:E,jwksUri:D,skipConsent:O,enableEndSession:k,requirePKCE:A,dpopBoundAccessTokens:j,subjectType:M,referenceId:N,metadata:P}=e,F=c?Math.round(new Date(c).getTime()/1e3):void 0,I=o?Math.round(new Date(o).getTime()/1e3):void 0,L=i?.join(` `);return{...A_(Bl(P)),client_id:t,client_secret:n??void 0,client_secret_expires_at:n?F??0:void 0,scope:L??void 0,user_id:a??void 0,client_id_issued_at:I??void 0,client_name:l??void 0,client_uri:u??void 0,logo_uri:d??void 0,contacts:f??void 0,tos_uri:p??void 0,policy_uri:m??void 0,jwks:E?JSON.parse(E):void 0,jwks_uri:D??void 0,software_id:h??void 0,software_version:g??void 0,software_statement:_??void 0,redirect_uris:v??[],post_logout_redirect_uris:y??void 0,backchannel_logout_uri:b??void 0,backchannel_logout_session_required:x??void 0,token_endpoint_auth_method:S??void 0,grant_types:C??void 0,response_types:w??void 0,application_type:T??void 0,disabled:r??void 0,skip_consent:O??void 0,enable_end_session:k??void 0,require_pkce:A??void 0,dpop_bound_access_tokens:j??void 0,subject_type:M??void 0,reference_id:N??void 0}}async function jv(e,t){let n=await Z(e);if(await j_(e,n,t,`read`,e.query.client_id),!n)throw new B(`UNAUTHORIZED`);let r=await xl(e,t,e.query.client_id);if(!r)throw new B(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(r.userId){if(r.userId!==n.user.id)throw new B(`UNAUTHORIZED`)}else if(r.referenceId&&t.clientReference){if(r.referenceId!==await t.clientReference(n))throw new B(`UNAUTHORIZED`)}else throw new B(`UNAUTHORIZED`);let i=Av(r);return i.client_secret=void 0,i}async function Mv(e,t,n){let r=await xl(e,t,n);if(!r||r.disabled)throw new B(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});return Av({clientId:r.clientId,name:r.name,uri:r.uri,contacts:r.contacts,icon:r.icon,tos:r.tos,policy:r.policy})}async function Nv(e,t){let n=await Z(e);if(await j_(e,n,t,`list`),!n)throw new B(`UNAUTHORIZED`);let r=await t.clientReference?.(n);if(r)return await e.context.adapter.findMany({model:`oauthClient`,where:[{field:`referenceId`,value:r}]}).then(e=>e?e.map(e=>{let t=Av(e);return t.client_secret=void 0,t}):null);if(n.user.id)return await e.context.adapter.findMany({model:`oauthClient`,where:[{field:`userId`,value:n.user.id}]}).then(e=>e?e.map(e=>{let t=Av(e);return t.client_secret=void 0,t}):null);throw new B(`BAD_REQUEST`,{message:`either user_id or reference_id must be provided`})}async function Pv(e,t){let n=await Z(e);if(await j_(e,n,t,`delete`,e.body.client_id),!n)throw new B(`UNAUTHORIZED`);let r=e.body.client_id;if(t.cachedTrustedClients?.has(r))throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`trusted clients must be updated manually`,error:`invalid_client`});let i=await xl(e,t,r);if(!i)throw new B(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(i.userId){if(i.userId!==n.user.id)throw new B(`UNAUTHORIZED`)}else if(i.referenceId&&t.clientReference){if(i.referenceId!==await t.clientReference(n))throw new B(`UNAUTHORIZED`)}else throw new B(`UNAUTHORIZED`);await e.context.adapter.delete({model:`oauthClient`,where:[{field:`clientId`,value:r}]})}async function Fv(e,t,n){let r=await Z(e);if(await j_(e,r,t,`update`,e.body.client_id),!r)throw new B(`UNAUTHORIZED`);let i=e.body.client_id;if(t.cachedTrustedClients?.has(i))throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`trusted clients must be updated manually`,error:`invalid_client`});let a=await xl(e,t,i);if(!a)throw new B(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});let{client_credentials_scopes:o,...s}=e.body.update,c=a.userId?a.userId===r.user.id:a.referenceId&&t.clientReference?a.referenceId===await t.clientReference(r):!1,l=!c&&n?.admin&&o!==void 0&&Object.keys(s).length===0;if(!c&&!l)throw new B(`UNAUTHORIZED`);if(l&&await j_(e,r,t,`configure-client-credentials-scopes`,i),Object.keys(s).length===0&&o===void 0){let e=Av(a);return e.client_secret=void 0,n?.admin?{...e,client_credentials_scopes:[...a.clientCredentialsScopes??[]]}:e}let u=s.grant_types??a.grantTypes??[],d=s.token_endpoint_auth_method??a.tokenEndpointAuthMethod,f=o===void 0?void 0:th(o);f!==void 0&&(nh(f,u,d,t),f.length>0&&!l&&await j_(e,r,t,`configure-client-credentials-scopes`,i)),await _v({...Av(a),...s},t,{ctx:e});let p={...kv(s)};!u.includes(`client_credentials`)||d===`none`?p.clientCredentialsScopes=[]:f!==void 0&&(p.clientCredentialsScopes=f),s.token_endpoint_auth_method&&(s.token_endpoint_auth_method===`private_key_jwt`?p.clientSecret=null:(p.jwks=null,p.jwksUri=null,p.clientSecret||=await El(e,t,t.generateClientSecret?.()||Fi(32,`a-z`,`A-Z`))));let m=await e.context.adapter.update({model:`oauthClient`,where:[{field:`clientId`,value:i}],update:{...p,updatedAt:new Date(Math.floor(Date.now()/1e3)*1e3)}});if(!m)throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`unable to update client`,error:`invalid_client`});let h=Av(m);return h.client_secret=void 0,n?.admin?{...h,client_credentials_scopes:[...m.clientCredentialsScopes??[]]}:h}async function Iv(e,t){let n=await Z(e);if(await j_(e,n,t,`rotate`,e.body.client_id),!n)throw new B(`UNAUTHORIZED`);let r=e.body.client_id;if(t.cachedTrustedClients?.has(r))throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`trusted clients must be updated manually`,error:`invalid_client`});let i=await xl(e,t,r);if(!i)throw new B(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(i.userId){if(i.userId!==n.user.id)throw new B(`UNAUTHORIZED`)}else if(i.referenceId&&t.clientReference){if(i.referenceId!==await t.clientReference(n))throw new B(`UNAUTHORIZED`)}else throw new B(`UNAUTHORIZED`);if(i.tokenEndpointAuthMethod===`none`||!i.clientSecret)throw new B(`BAD_REQUEST`,{error_description:`secret rotation is only available for clients using client_secret authentication`,error:`invalid_client`});let a=t.generateClientSecret?.()||Fi(32,`a-z`,`A-Z`),o=a?await El(e,t,a):void 0,s=await e.context.adapter.update({model:`oauthClient`,where:[{field:`clientId`,value:r}],update:{clientSecret:o,updatedAt:new Date(Math.floor(Date.now()/1e3)*1e3)}});if(!s)throw new B(`INTERNAL_SERVER_ERROR`,{error_description:`unable to update client`,error:`invalid_client`});return Av({...s,clientSecret:(t.prefix?.clientSecret??``)+a})}var Lv=c().trim().min(1),Rv=x(c().trim().min(1)).min(1),zv=e=>X(`/admin/oauth2/create-client`,{method:`POST`,body:w({redirect_uris:x(Q).min(1).optional(),scope:c().optional(),client_name:c().optional(),client_uri:c().optional(),logo_uri:c().optional(),contacts:x(c().min(1)).min(1).optional(),tos_uri:c().optional(),policy_uri:c().optional(),software_id:c().optional(),software_version:c().optional(),software_statement:c().optional(),post_logout_redirect_uris:x(Q).min(1).optional(),backchannel_logout_uri:Q.optional(),backchannel_logout_session_required:v().optional(),token_endpoint_auth_method:Lv.optional(),application_type:u([`web`,`native`]).optional(),jwks:hm.optional(),jwks_uri:c().optional(),grant_types:Rv.optional(),client_credentials_scopes:x(c().trim().min(1)).optional(),resources:x(fm).optional(),response_types:x(u([`code`])).optional(),client_secret_expires_at:a([c(),d()]).optional().default(0),skip_consent:v().optional(),enable_end_session:v().optional(),require_pkce:v().optional(),dpop_bound_access_tokens:v().optional(),subject_type:u([`public`,`pairwise`]).optional(),metadata:i(c(),o()).optional()}),metadata:{noStore:!0,SERVER_ONLY:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},client_credentials_scopes:{type:`array`,items:{type:`string`},description:`Server-authorized scope ceiling for client_credentials tokens`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`URI of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URI for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final server-owned resources linked to the client`},disabled:{type:`boolean`,description:`Whether the client is disabled`},require_pkce:{type:`boolean`,description:`Whether the client requires PKCE`,default:!0},metadata:{type:`object`,additionalProperties:!0,nullable:!0,description:`Additional metadata for the application`}},required:[`client_id`]}}}}}}}},async t=>Ov(t,e,{admin:!0})),Bv=e=>X(`/oauth2/create-client`,{method:`POST`,use:[qf],body:w({redirect_uris:x(Q).min(1).optional(),scope:c().optional(),client_name:c().optional(),client_uri:c().optional(),logo_uri:c().optional(),contacts:x(c().min(1)).min(1).optional(),tos_uri:c().optional(),policy_uri:c().optional(),software_id:c().optional(),software_version:c().optional(),software_statement:c().optional(),post_logout_redirect_uris:x(Q).min(1).optional(),backchannel_logout_uri:Q.optional(),backchannel_logout_session_required:v().optional(),token_endpoint_auth_method:Lv.optional(),application_type:u([`web`,`native`]).optional(),jwks:hm.optional(),jwks_uri:c().optional(),grant_types:Rv.optional(),response_types:x(u([`code`])).optional(),dpop_bound_access_tokens:v().optional()}),metadata:{noStore:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`URI of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URI for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final server-owned resources linked to the client`},disabled:{type:`boolean`,description:`Whether the client is disabled`},metadata:{type:`object`,additionalProperties:!0,nullable:!0,description:`Additional metadata for the application`}},required:[`client_id`]}}}}}}}},async t=>Ov(t,e)),Vv=e=>X(`/oauth2/get-client`,{method:`GET`,use:[qf],query:w({client_id:c()}),metadata:{openapi:{description:`Get OAuth2 formatted client details`}}},async t=>jv(t,e)),Hv=e=>X(`/oauth2/public-client`,{method:`GET`,use:[qf],query:w({client_id:c()}),metadata:{openapi:{description:`Gets publicly available client fields`}}},async t=>{let n=t.query.client_id;return Mv(t,e,n)}),Uv=e=>X(`/oauth2/public-client-prelogin`,{method:`POST`,use:[m_(e)],body:w({client_id:c(),oauth_query:c().optional()}),metadata:{openapi:{description:`Gets publicly available client fields (prior to login)`}}},async t=>{let n=t.body.client_id;return Mv(t,e,n)}),Wv=e=>X(`/oauth2/get-clients`,{method:`GET`,use:[qf],metadata:{openapi:{description:`Get OAuth2 formatted client details for a user or organization`}}},async t=>Nv(t,e)),Gv=e=>X(`/admin/oauth2/update-client`,{method:`PATCH`,body:w({client_id:c(),update:w({redirect_uris:x(Q).min(1).optional(),scope:c().optional(),client_name:c().optional(),client_uri:c().optional(),logo_uri:c().optional(),contacts:x(c().min(1)).min(1).optional(),tos_uri:c().optional(),policy_uri:c().optional(),software_id:c().optional(),software_version:c().optional(),software_statement:c().optional(),post_logout_redirect_uris:x(Q).min(1).optional(),backchannel_logout_uri:Q.optional(),backchannel_logout_session_required:v().optional(),application_type:u([`web`,`native`]).optional(),grant_types:Rv.optional(),client_credentials_scopes:x(c().trim().min(1)).optional(),response_types:x(u([`code`])).optional(),client_secret_expires_at:a([c(),d()]).optional(),skip_consent:v().optional(),enable_end_session:v().optional(),disabled:v().optional(),dpop_bound_access_tokens:v().optional(),metadata:i(c(),o()).optional()})}),metadata:{SERVER_ONLY:!0,openapi:{description:`Updates OAuth2 formatted client details.`}}},async t=>Fv(t,e,{admin:!0})),Kv=e=>X(`/oauth2/update-client`,{method:`POST`,use:[qf],body:w({client_id:c(),update:w({redirect_uris:x(Q).min(1).optional(),scope:c().optional(),client_name:c().optional(),client_uri:c().optional(),logo_uri:c().optional(),contacts:x(c().min(1)).min(1).optional(),tos_uri:c().optional(),policy_uri:c().optional(),software_id:c().optional(),software_version:c().optional(),software_statement:c().optional(),post_logout_redirect_uris:x(Q).min(1).optional(),backchannel_logout_uri:Q.optional(),backchannel_logout_session_required:v().optional(),application_type:u([`web`,`native`]).optional(),grant_types:Rv.optional(),response_types:x(u([`code`])).optional()})}),metadata:{openapi:{description:`Updates OAuth2 formatted client details.`}}},async t=>Fv(t,e)),qv=e=>X(`/oauth2/client/rotate-secret`,{method:`POST`,use:[qf],body:w({client_id:c()}),metadata:{noStore:!0,openapi:{description:`Rotates a confidential client's secret`}}},async t=>Iv(t,e)),Jv=e=>X(`/oauth2/delete-client`,{method:`POST`,use:[qf],body:w({client_id:c()}),metadata:{openapi:{description:`Deletes an oauth client`}}},async t=>Pv(t,e));async function Yv(e,t,n){return await e.context.adapter.findOne({model:`oauthConsent`,where:[{field:`id`,value:n}]})}async function Xv(e,t){let n=await Z(e);if(!n)throw new B(`UNAUTHORIZED`);let{id:r}=e.query;if(!r)throw new B(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await Yv(e,t,r);if(!i)throw new B(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new B(`UNAUTHORIZED`);return i}async function Zv(e,t){let n=await Z(e);if(!n)throw new B(`UNAUTHORIZED`);return await e.context.adapter.findMany({model:`oauthConsent`,where:[{field:`userId`,value:n.user.id}]})}async function Qv(e,t){let n=await Z(e);if(!n)throw new B(`UNAUTHORIZED`);let{id:r}=e.body;if(!r)throw new B(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await Yv(e,t,r);if(!i)throw new B(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new B(`UNAUTHORIZED`);await e.context.adapter.delete({model:`oauthConsent`,where:[{field:`id`,value:r}]})}async function $v(e,t){let n=await Z(e);if(!n)throw new B(`UNAUTHORIZED`);let{id:r}=e.body;if(!r)throw new B(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await Yv(e,t,r);if(!i)throw new B(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new B(`UNAUTHORIZED`);let a=await xl(e,t,i.clientId);if(!a)throw new B(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});let o=a?.scopes??t.scopes??[],s=e.body.update,c=s.scopes;if(c&&!c.every(e=>o?.includes(e)))throw new B(`BAD_REQUEST`,{error_description:`unable to provide scopes to ${a?.referenceId??a?.userId}`,error:`invalid_request`});let l=Math.floor(Date.now()/1e3);return await e.context.adapter.update({model:`oauthConsent`,where:[{field:`id`,value:r}],update:{...s,updatedAt:new Date(l*1e3)}})}var ey=e=>X(`/oauth2/get-consent`,{method:`GET`,query:w({id:c()}),use:[qf],metadata:{openapi:{description:`Gets details of a specific OAuth2 consent for a user`}}},async t=>Xv(t,e)),ty=e=>X(`/oauth2/get-consents`,{method:`GET`,use:[qf],metadata:{openapi:{description:`Gets all available OAuth2 consents for a user`}}},async t=>Zv(t,e)),ny=e=>X(`/oauth2/update-consent`,{method:`POST`,use:[qf],body:w({id:c(),update:w({scopes:x(c())})}),metadata:{openapi:{description:`Updates consent granted to a client.`}}},async t=>$v(t,e)),ry=e=>X(`/oauth2/delete-consent`,{method:`POST`,use:[qf],body:w({id:c()}),metadata:{openapi:{description:`Deletes consent granted to a client`}}},async t=>Qv(t,e)),iy=e=>e.schema?.oauthResource?.modelName??`oauthResource`,ay=e=>e.schema?.oauthClientResource?.modelName??`oauthClientResource`,oy=e=>e.schema?.oauthClient?.modelName??`oauthClient`;function sy(e){try{return decodeURIComponent(e)}catch{return e}}function cy(e,t){return{identifier:e.identifier,name:e.name??e.identifier,accessTokenTtl:e.accessTokenTtl??null,refreshTokenTtl:e.refreshTokenTtl??null,signingAlgorithm:e.signingAlgorithm??null,signingKeyId:e.signingKeyId??null,allowedScopes:e.allowedScopes??null,customClaims:e.customClaims??null,dpopBoundAccessTokensRequired:e.dpopBoundAccessTokensRequired??!1,disabled:e.disabled??!1,policyVersion:1,metadata:e.metadata??null,createdAt:t,updatedAt:t}}async function ly(e,t){await M_(e,await Z(e),t,`create`);let n=e.body;if(!n?.identifier)throw new B(`BAD_REQUEST`,{error:`invalid_request`,error_description:`identifier is required`});await Dm(t,n.identifier);let r=new Date,i;try{i=await e.context.adapter.create({model:iy(t),data:cy(n,r)})}catch(e){let t=e instanceof Error?e.message:String(e);throw/unique|duplicate|UNIQUE/i.test(t)?new B(`BAD_REQUEST`,{error:`invalid_request`,error_description:`resource ${n.identifier} already exists`}):e}if(!i)throw new B(`BAD_REQUEST`,{error:`invalid_request`,error_description:`resource ${n.identifier} could not be created`});return Rm(i.identifier),e.json(i,{status:201})}async function uy(e,t){await M_(e,await Z(e),t,`list`);let n=await e.context.adapter.findMany({model:iy(t)});return e.json(n??[])}async function dy(e,t){let n=sy(e.params.identifier);await M_(e,await Z(e),t,`read`,n);let r=await e.context.adapter.findOne({model:iy(t),where:[{field:`identifier`,value:n}]});if(!r)throw new B(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return e.json(r)}async function fy(e,t){let n=sy(e.params.identifier);if(await M_(e,await Z(e),t,`update`,n),!await e.context.adapter.findOne({model:iy(t),where:[{field:`identifier`,value:n}]}))throw new B(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});let r={updatedAt:new Date};for(let t of[`name`,`accessTokenTtl`,`refreshTokenTtl`,`signingAlgorithm`,`signingKeyId`,`allowedScopes`,`customClaims`,`dpopBoundAccessTokensRequired`,`disabled`,`metadata`])Object.prototype.hasOwnProperty.call(e.body,t)&&(r[t]=e.body[t]);await e.context.adapter.update({model:iy(t),where:[{field:`identifier`,value:n}],update:r}),Rm(n);let i=await e.context.adapter.findOne({model:iy(t),where:[{field:`identifier`,value:n}]});if(!i)throw new B(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return e.json(i)}async function py(e,t){let n=sy(e.params.identifier);if(await M_(e,await Z(e),t,`delete`,n),!await e.context.adapter.findOne({model:iy(t),where:[{field:`identifier`,value:n}]}))throw new B(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return await e.context.adapter.delete({model:iy(t),where:[{field:`identifier`,value:n}]}),Rm(n),e.json({deleted:!0})}async function my(e,t){let n=await Z(e),r=sy(e.params.identifier),i=sy(e.params.client_id);if(await M_(e,n,t,`link`,r),!await e.context.adapter.findOne({model:iy(t),where:[{field:`identifier`,value:r}]}))throw new B(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${r} not found`});if(!await e.context.adapter.findOne({model:oy(t),where:[{field:`clientId`,value:i}]}))throw new B(`NOT_FOUND`,{error:`not_found`,error_description:`client ${i} not found`});try{await e.context.adapter.create({model:ay(t),data:{clientId:i,resourceId:r,createdAt:new Date}})}catch(t){let n=t instanceof Error?t.message:String(t);if(/unique|duplicate|UNIQUE/i.test(n))return e.json({linked:!0,alreadyLinked:!0});throw t}return e.json({linked:!0})}async function hy(e,t){let n=await Z(e),r=sy(e.params.identifier),i=sy(e.params.client_id);return await M_(e,n,t,`unlink`,r),await e.context.adapter.deleteMany({model:ay(t),where:[{field:`clientId`,value:i},{field:`resourceId`,value:r}]}),e.json({unlinked:!0})}var gy=w({identifier:c().min(1).optional(),name:c().optional(),accessTokenTtl:d().int().positive().nullable().optional(),refreshTokenTtl:d().int().positive().nullable().optional(),signingAlgorithm:u(Cm).nullable().optional(),signingKeyId:c().nullable().optional(),allowedScopes:x(c()).nullable().optional(),customClaims:i(c(),o()).nullable().optional(),dpopBoundAccessTokensRequired:v().optional(),disabled:v().optional(),metadata:i(c(),o()).nullable().optional()}),_y=e=>X(`/admin/oauth2/resources`,{method:`POST`,body:gy.required({identifier:!0}),metadata:{SERVER_ONLY:!0}},async t=>ly(t,e)),vy=e=>X(`/admin/oauth2/resources`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async t=>uy(t,e)),yy=e=>X(`/admin/oauth2/resources/:identifier`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async t=>dy(t,e)),by=e=>X(`/admin/oauth2/resources/:identifier`,{method:`PATCH`,body:gy,metadata:{SERVER_ONLY:!0}},async t=>fy(t,e)),xy=e=>X(`/admin/oauth2/resources/:identifier`,{method:`DELETE`,metadata:{SERVER_ONLY:!0}},async t=>py(t,e)),Sy=e=>X(`/admin/oauth2/resources/:identifier/clients/:client_id`,{method:`POST`,metadata:{SERVER_ONLY:!0}},async t=>my(t,e)),Cy=e=>X(`/admin/oauth2/resources/:identifier/clients/:client_id`,{method:`DELETE`,metadata:{SERVER_ONLY:!0}},async t=>hy(t,e));async function wy(e,t,n){let r=t.disableJwtPlugin?void 0:pl(e.context),i=r?.options;try{let a=await Vr(n,hi(await Pc(n,{jwksFetch:i?.jwks?.remoteUrl?i.jwks.remoteUrl:async()=>(await r?.endpoints.getJwks(e))?.response,jwksCacheKey:r})),{issuer:i?.jwt?.issuer??e.context.baseURL}),o=`${e.context.baseURL}/oauth2/userinfo`;if(!a.payload.azp||!await jm(e,t,a.payload.aud,[o]))return null}catch(e){if(e instanceof Error){if(e.name===`TypeError`||e.name===`JWSInvalid`)throw new z(`BAD_REQUEST`,{error_description:`invalid JWT signature`,error:`invalid_request`});if(e.name===`JWTExpired`||e.name===`JWTInvalid`)return null;throw e}throw Error(e)}throw new z(`BAD_REQUEST`,{error_description:`JWT access tokens are self-contained and cannot be revoked server-side`,error:`unsupported_token_type`})}async function Ty(e,t,n,r){let i=n;if(t.prefix?.opaqueAccessToken){if(i.startsWith(t.prefix.opaqueAccessToken))i=i.replace(t.prefix.opaqueAccessToken,``);else throw new z(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`})}let a=await e.context.adapter.findOne({model:`oauthAccessToken`,where:[{field:`token`,value:await Ol(t.storeTokens,i,`access_token`)}]});if(!a)throw new z(`BAD_REQUEST`,{error_description:`opaque access token not found`,error:`invalid_request`});if(!a.clientId||a.clientId!==r)return null;a.id?await e.context.adapter.delete({model:`oauthAccessToken`,where:[{field:`id`,value:a.id}]}):await e.context.adapter.delete({model:`oauthAccessToken`,where:[{field:`token`,value:a.token}]})}async function Ey(e,t,n,r){let i=await e.context.adapter.findOne({model:`oauthRefreshToken`,where:[{field:`token`,value:await Ol(t.storeTokens,n,`refresh_token`)}]});if(!i)throw new z(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`});if(i.revoked)throw await vh(e,r,i.userId),new z(`BAD_REQUEST`,{error_description:`refresh token revoked`,error:`invalid_request`});if(!i.clientId||i.clientId!==r)return null;let a=Math.floor(Date.now()/1e3);if(!await e.context.adapter.incrementOne({model:`oauthRefreshToken`,where:[{field:`id`,value:i.id},{field:`revoked`,operator:`eq`,value:null}],increment:{},set:{revoked:new Date(a*1e3)}}))throw await vh(e,r,i.userId),new z(`BAD_REQUEST`,{error_description:`refresh token revoked`,error:`invalid_request`});await e.context.adapter.deleteMany({model:`oauthAccessToken`,where:[{field:`refreshId`,value:i.id}]})}async function Dy(e,t,n,r){try{return await wy(e,t,r)}catch(e){if(e instanceof z){if(e.body?.error===`unsupported_token_type`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}try{return await Ty(e,t,r,n)}catch(e){if(!(e instanceof z))throw e instanceof Error?e:Error(`Unknown error validating access token`)}throw new z(`BAD_REQUEST`,{error_description:`Invalid access token`,error:`invalid_request`})}async function Oy(e,t){let{token:n,token_type_hint:r}=e.body;r!==`access_token`&&r!==`refresh_token`&&(r=void 0);let{clientId:i,clientSecret:a,preVerified:o,authMethod:s}=Vl(await Hl(e,t,`${e.context.baseURL}/oauth2/revoke`));if(!i)throw new z(`UNAUTHORIZED`,{error_description:`missing required credentials`,error:`invalid_client`});if(typeof n==`string`&&(n=pc(n)),!n?.length)throw new z(`BAD_REQUEST`,{error_description:`missing a required token for introspection`,error:`invalid_request`});let c=await zl(e,t,i,a,void 0,o,void 0,s);try{if(r===void 0||r===`access_token`)try{return await Dy(e,t,c.clientId,n)}catch(e){if(e instanceof z){if(r===`access_token`||e.body?.error===`unsupported_token_type`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}if(r===void 0||r===`refresh_token`)try{return await Ey(e,t,(await gh(t,n)).token,c.clientId)}catch(e){if(e instanceof z){if(r===`refresh_token`)throw e}else if(e instanceof Error)throw e;else throw Error(e)}throw new z(`BAD_REQUEST`,{error_description:`token not found`,error:`invalid_request`})}catch(e){if(e instanceof z){if(e.body?.error===`unsupported_token_type`)throw e;if(e.name===`BAD_REQUEST`)return null;throw e}throw e instanceof Error?(_e.error(`Introspection error:`,e.message,e.stack),new z(`INTERNAL_SERVER_ERROR`)):(_e.error(`Introspection error:`,e),new z(`INTERNAL_SERVER_ERROR`))}}var ky={oauthClient:{modelName:`oauthClient`,fields:{clientId:{type:`string`,unique:!0,required:!0},clientSecret:{type:`string`,required:!1},clientDiscoveryId:{type:`string`,required:!1},disabled:{type:`boolean`,defaultValue:!1,required:!1},skipConsent:{type:`boolean`,required:!1},enableEndSession:{type:`boolean`,required:!1},subjectType:{type:`string`,required:!1},scopes:{type:`string[]`,required:!1},clientCredentialsScopes:{type:`string[]`,required:!1,defaultValue:[]},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},createdAt:{type:`date`,required:!1},updatedAt:{type:`date`,required:!1},name:{type:`string`,required:!1},uri:{type:`string`,required:!1},icon:{type:`string`,required:!1},contacts:{type:`string[]`,required:!1},tos:{type:`string`,required:!1},policy:{type:`string`,required:!1},softwareId:{type:`string`,required:!1},softwareVersion:{type:`string`,required:!1},softwareStatement:{type:`string`,required:!1},redirectUris:{type:`string[]`,required:!0},postLogoutRedirectUris:{type:`string[]`,required:!1},backchannelLogoutUri:{type:`string`,required:!1},backchannelLogoutSessionRequired:{type:`boolean`,required:!1},tokenEndpointAuthMethod:{type:`string`,required:!1},applicationType:{type:`string`,required:!1},jwks:{type:`string`,required:!1},jwksUri:{type:`string`,required:!1},grantTypes:{type:`string[]`,required:!1},responseTypes:{type:`string[]`,required:!1},requirePKCE:{type:`boolean`,required:!1},dpopBoundAccessTokens:{type:`boolean`,required:!1,defaultValue:!1},referenceId:{type:`string`,required:!1},metadata:{type:`json`,required:!1}}},oauthResource:{modelName:`oauthResource`,fields:{identifier:{type:`string`,required:!0,unique:!0},name:{type:`string`,required:!0},accessTokenTtl:{type:`number`,required:!1},refreshTokenTtl:{type:`number`,required:!1},signingAlgorithm:{type:`string`,required:!1},signingKeyId:{type:`string`,required:!1},allowedScopes:{type:`string[]`,required:!1},customClaims:{type:`json`,required:!1},dpopBoundAccessTokensRequired:{type:`boolean`,required:!1,defaultValue:!1},disabled:{type:`boolean`,required:!1,defaultValue:!1},createdAt:{type:`date`,required:!1},updatedAt:{type:`date`,required:!1},policyVersion:{type:`number`,required:!1,defaultValue:1},metadata:{type:`json`,required:!1}}},oauthClientResource:{modelName:`oauthClientResource`,fields:{clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`,onDelete:`cascade`},index:!0},resourceId:{type:`string`,required:!0,references:{model:`oauthResource`,field:`identifier`,onDelete:`cascade`},index:!0},metadata:{type:`json`,required:!1},createdAt:{type:`date`,required:!1}},indexes:[{fields:[`clientId`,`resourceId`],unique:!0}]},oauthRefreshToken:{fields:{token:{type:`string`,required:!0,unique:!0},clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},sessionId:{type:`string`,required:!1,references:{model:`session`,field:`id`,onDelete:`set null`},index:!0},userId:{type:`string`,required:!0,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},authorizationCodeId:{type:`string`,required:!1,index:!0},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},expiresAt:{type:`date`},createdAt:{type:`date`},revoked:{type:`date`,required:!1},rotatedAt:{type:`date`,required:!1},rotationReplayResponse:{type:`string`,required:!1},rotationReplayExpiresAt:{type:`date`,required:!1},authTime:{type:`date`,required:!1},confirmation:{type:`json`,required:!1},scopes:{type:`string[]`,required:!0}}},oauthAccessToken:{modelName:`oauthAccessToken`,fields:{token:{type:`string`,unique:!0},clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},sessionId:{type:`string`,required:!1,references:{model:`session`,field:`id`,onDelete:`set null`},index:!0},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},authorizationCodeId:{type:`string`,required:!1,index:!0},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},refreshId:{type:`string`,required:!1,references:{model:`oauthRefreshToken`,field:`id`},index:!0},expiresAt:{type:`date`},createdAt:{type:`date`},revoked:{type:`date`,required:!1},confirmation:{type:`json`,required:!1},scopes:{type:`string[]`,required:!0}}},oauthConsent:{modelName:`oauthConsent`,fields:{clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},scopes:{type:`string[]`,required:!0},createdAt:{type:`date`},updatedAt:{type:`date`}}},oauthClientAssertion:{modelName:`oauthClientAssertion`,fields:{expiresAt:{type:`date`,required:!0}}}},Ay=[`openid`,`profile`,`email`,`offline_access`],jy=w({id_token_hint:c().optional(),client_id:c().optional(),post_logout_redirect_uri:Q.optional(),state:c().optional()}),My=dd(()=>null),Ny=My.get,Py=new WeakMap,Fy=`signedQueryIssuedAtMs`;function Iy(e){let t=typeof e==`number`?e:typeof e==`string`?Number(e):void 0;if(!(!t||!Number.isFinite(t)||t<=0))return new Date(t)}var Ly=e=>{let t=e.clientRegistrationAllowedScopes;if(e.clientRegistrationDefaultScopes){let n=t?new Set([...t,...e.clientRegistrationDefaultScopes]):new Set([...e.clientRegistrationDefaultScopes]);t=Array.from(n)}let n=new Set((e.scopes??Ay).filter(e=>e.length));if(t){for(let e of t)if(!n.has(e))throw new V(`clientRegistrationAllowedScope ${e} not found in scopes`)}for(let t of e.advertisedMetadata?.scopes_supported??[])if(!n?.has(t))throw new V(`advertisedMetadata.scopes_supported ${t} not found in scopes`);let r=new Set((e.resources??[]).map(e=>typeof e==`string`?e:e.identifier));for(let[t,n]of[[`clientRegistrationDefaultResources`,e.clientRegistrationDefaultResources],[`clientRegistrationAllowedResources`,e.clientRegistrationAllowedResources]])for(let e of n??[])if(!r.has(e))throw new V(`${t} resource ${e} not found in resources`);let i=new Set([`sub`,`iss`,`aud`,`exp`,`iat`,`sid`,`scope`,`azp`,...om.filter(e=>n.has(am[e].scope))]),o={codeExpiresIn:600,accessTokenExpiresIn:3600,m2mAccessTokenExpiresIn:3600,refreshTokenExpiresIn:2592e3,refreshTokenReuseInterval:0,allowUnauthenticatedClientRegistration:!1,allowDynamicClientRegistration:!1,disableJwtPlugin:!1,storeClientSecret:e.disableJwtPlugin?`encrypted`:`hashed`,storeTokens:`hashed`,grantTypes:[`authorization_code`,`client_credentials`,`refresh_token`],...e,scopes:Array.from(n),claims:Array.from(i),clientRegistrationAllowedScopes:t};if(qc(o.extensions),o.pairwiseSecret&&o.pairwiseSecret.length<32)throw new V(`pairwiseSecret must be at least 32 characters long for adequate HMAC-SHA256 security`);if(o.grantTypes&&o.grantTypes.includes(`refresh_token`)&&!o.grantTypes.includes(`authorization_code`))throw new V(`refresh_token grant requires authorization_code grant`);if(o.disableJwtPlugin&&(o.storeClientSecret===`hashed`||typeof o.storeClientSecret==`object`&&`hash`in o.storeClientSecret))throw new V(`unable to store hashed secrets because id tokens will be signed with secret`);if(!o.disableJwtPlugin&&(o.storeClientSecret===`encrypted`||typeof o.storeClientSecret==`object`&&(`encrypt`in o.storeClientSecret||`decrypt`in o.storeClientSecret)))throw new V(`encryption method not recommended, please use 'hashed' or the 'hash' function`);let s=async(e,t)=>{let n=new URL(e.url).pathname,r=t.options.advanced?.skipTrailingSlashes?n.replace(/\/+$/,``)||`/`:n,i=o.disableJwtPlugin?t.baseURL:pl(t)?.options?.jwt?.issuer??t.baseURL,a=`/`;try{a=new URL(i).pathname.replace(/\/$/,``)||``}catch{a=new URL(t.baseURL).pathname.replace(/\/$/,``)||``}let s={context:t},c=new Set([`/.well-known/oauth-authorization-server${a}`,`${a}/.well-known/oauth-authorization-server`]),l=`${a}/.well-known/openid-configuration`,u=c.has(r),d=o.scopes?.includes(`openid`)&&r===l,f=t=>{let n=c_(t);return e.method===`HEAD`?new Response(null,{status:n.status,headers:n.headers}):n};if((u||d)&&e.method!==`GET`&&e.method!==`HEAD`)return{response:new Response(null,{status:405,headers:{Allow:`GET, HEAD`}})};if(u)return o.scopes?.includes(`openid`)?{response:f(o_(s,o))}:{response:f(a_(s,o))};if(d)return{response:f(o_(s,o))}},u=l_(`/oauth2/authorize`,{method:[`GET`,`POST`],body:w({}).passthrough(),redirectOnError:eb(o),metadata:{allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Authorize an OAuth 2.1 request from query parameters or an application/x-www-form-urlencoded POST body`,parameters:[{name:`response_type`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 response type (e.g., 'code')`},{name:`client_id`,in:`query`,required:!0,schema:{type:`string`},description:`OAuth 2.1 client ID`},{name:`redirect_uri`,in:`query`,required:!1,schema:{type:`string`,format:`uri`},description:`OAuth 2.1 redirect URI`},{name:`scope`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 scopes (space-separated)`},{name:`state`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 state parameter`},{name:`request_uri`,in:`query`,required:!1,schema:{type:`string`},description:`Pushed Authorization Request URI referencing stored parameters`},{name:`code_challenge`,in:`query`,required:!1,schema:{type:`string`},description:`PKCE code challenge`},{name:`code_challenge_method`,in:`query`,required:!1,schema:{type:`string`},description:`PKCE code challenge method`},{name:`nonce`,in:`query`,required:!1,schema:{type:`string`},description:`OpenID Connect nonce`},{name:`max_age`,in:`query`,required:!1,schema:{type:`integer`,minimum:0},description:`Maximum authentication age in seconds; forces re-authentication when exceeded`},{name:`resource`,in:`query`,required:!1,schema:{type:`array`,items:{type:`string`}},description:`Requested protected resource(s) for the access token. May be supplied multiple times as repeated 'resource' query parameters (RFC 8707) or as an array of strings.`},{name:`prompt`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth2 prompt parameter`}],responses:{302:{description:`Redirect to client with code or error`,headers:{Location:{description:`Redirect URI with code or error`,schema:{type:`string`,format:`uri`}}}},400:{description:`Invalid request`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},state:{type:`string`}},required:[`error`]}}}}}}}},async e=>tb(e,o,e.authorizeSettings??{isAuthorize:!0})),d=(e,t)=>Ap(u,{...e,asResponse:!1,returnHeaders:!1,returnStatus:!1,authorizeSettings:t??{}});return{id:`oauth-provider`,version:ug,options:o,onRequest:s,init:async e=>{if(e.options.secondaryStorage&&e.options.session?.storeSessionInDatabase!==!0)throw new V("OAuth Provider requires `session.storeSessionInDatabase: true` when using secondaryStorage");if(await Ym(e,o).catch(t=>Gm(e,t)),Xm(o),!o.disableJwtPlugin){let t=pl(e)?.options,n=t?.jwt?.issuer??e.baseURL,r=t?.jwt?.issuer==null&&typeof e.options.baseURL==`object`&&e.options.baseURL!==null&&`allowedHosts`in e.options.baseURL;try{new URL(n)}catch(e){if(!r||n!==``)throw e}}return{options:{databaseHooks:{session:{delete:{async before(e,t){if(!t)return;let n=await Cg(t,o,{sessionId:e.id,userId:e.userId});if(!n)return;let r=Py.get(t)??new Map;r.set(e.id,n),Py.set(t,r)},async after(e,t){if(!t)return;let n=Py.get(t);if(!n)return;let r=n.get(e.id);if(n.delete(e.id),n.size===0&&Py.delete(t),!r)return;let i=wg(t,r).catch(e=>{t.context.logger.error(`Back-channel logout failed after session deletion`,e)});await t.context.runInBackgroundOrAwait(i)}}}}}}},hooks:{before:[{matcher(e){return e.body?.oauth_query},handler:du(async e=>{let t=e.body.oauth_query;if(!await bl(t,e.context.secret))throw new B(`BAD_REQUEST`,{error:`invalid_signature`});let n=ke(t),r=new URLSearchParams(t),i=r.get(`ba_pl`)??void 0;r.delete(`sig`),r.delete(`exp`),r.delete(we),r.delete(Te),await My.set({query:r.toString(),signedQueryIssuedAt:n??void 0,postLoginClearedForSession:i}),e.path===`/sign-in/social`&&await Sd({query:r.toString(),...n?{[Fy]:n.getTime()}:{}})})}],after:[{matcher(e){return Jd(e.context.responseHeaders?.get(`set-cookie`)||``).has(e.context.authCookies.sessionToken.name)},handler:du(async e=>{let t=Jd(e.context.responseHeaders?.get(`set-cookie`)||``).get(e.context.authCookies.sessionToken.name)?.value.split(`.`)[0];if(!t)return;let n=await My.get(),r=(await yd())?.serverContext,i=n?.query??r?.query;if(!i)return;let a=new URLSearchParams(i),o=await e.context.internalAdapter.findSession(t);if(!o)return;e.context.session=o;let s=e.request?.headers?.get(`sec-fetch-mode`)?.toLowerCase(),c=e.request?.headers?.get(`accept`)?.toLowerCase()??``;s===`navigate`||!s&&(c.includes(`text/html`)||c.includes(`application/xhtml+xml`))||e.headers?.set(`accept`,`application/json`);let l=n?.signedQueryIssuedAt??Iy(r?.[Fy]),u=Yl(a,`login`);return Jl(o.session.createdAt,l)&&(u=Xl(u)),e.query=ql(u),await d(e)})}]},endpoints:{getOAuthServerConfig:X(`/.well-known/oauth-authorization-server`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async e=>o.scopes&&o.scopes.includes(`openid`)?o_(e,o):a_(e,o)),getOpenIdConfig:X(`/.well-known/openid-configuration`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async e=>{if(o.scopes&&!o.scopes.includes(`openid`))throw new B(`NOT_FOUND`);return o_(e,o)}),oauth2Authorize:u,oauth2Consent:X(`/oauth2/consent`,{method:`POST`,body:w({accept:v().meta({description:`Accept or deny user consent for a set of scopes`}),scope:c().optional().meta({description:`List of accept of accepted space-separated scopes. If none is provided, then all originally requested scopes are accepted.`}),claims:$p.optional().meta({description:`Accepted OIDC claims request object. If none is provided, then all originally requested claims are accepted.`}),oauth_query:c().optional().meta({description:`The redirected page's query parameters`})}),use:[qf],metadata:{openapi:{description:`Handle OAuth2 consent`,responses:{200:{description:`Consent processed successfully`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`The URI to redirect to, either with an authorization code or an error`}},required:[`redirect_uri`]}}}}}}}},async e=>pg(e,o,d)),oauth2Continue:X(`/oauth2/continue`,{method:`POST`,body:w({selected:v().optional().meta({description:`Confirms an account has been selected and authorization can proceed.`}),created:v().optional().meta({description:`Confirms an account was registered`}),postLogin:v().optional().meta({description:`Confirms organization and/or team selection.`}),oauth_query:c().optional().meta({description:`The redirected page's query parameters`})}),use:[qf],metadata:{openapi:{description:`Continues OAuth2 authorization flow`,responses:{200:{description:`Consent processed successfully`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`The URI to redirect to, either with an authorization code or an error`}},required:[`redirect_uri`]}}}}}}}},async e=>mg(e,d)),oauth2Token:l_(`/oauth2/token`,{method:`POST`,cloneRequest:!0,body:w({grant_type:c().trim().min(1),client_id:c().optional(),client_secret:c().optional(),client_assertion:c().optional(),client_assertion_type:c().optional(),code:c().optional(),code_verifier:c().optional(),redirect_uri:Q.optional(),refresh_token:c().optional(),resource:a([fm,x(fm).min(1)]).optional(),scope:c().optional()}).passthrough(),errorCodesByField:{grant_type:{missing:`invalid_request`,invalid:`unsupported_grant_type`},resource:{invalid:`invalid_target`}},metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Obtain an OAuth2.1 access token`,parameters:[{name:`DPoP`,in:`header`,required:!1,schema:{type:`string`},description:`RFC 9449 DPoP proof JWT for issuing DPoP-bound tokens`}],requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{grant_type:{type:`string`,description:`OAuth2 grant type`},client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},code:{type:`string`,description:`Authorization code (for authorization_code grant)`},code_verifier:{type:`string`,description:`PKCE code verifier (for authorization_code grant)`},redirect_uri:{type:`string`,format:`uri`,description:`Redirect URI (for authorization_code grant)`},refresh_token:{type:`string`,description:`Refresh token (for refresh_token grant)`},resource:{oneOf:[{type:`string`,description:`Single resource (URL)`},{type:`array`,items:{type:`string`},description:`Multiple resources (URLs)`}],description:`Requested protected resource(s) for the access token`},scope:{type:`string`,description:`Requested scopes (for client_credentials grant)`}},required:[`grant_type`]}}}},responses:{200:{description:`Access token response`,content:{"application/json":{schema:{type:`object`,properties:{access_token:{type:`string`,description:`The access token issued by the authorization server`},token_type:{type:`string`,description:`The type of the token issued`,enum:[`Bearer`,`DPoP`]},expires_in:{type:`number`,description:`Lifetime in seconds of the access token`},refresh_token:{type:`string`,description:`Refresh token, if issued`},scope:{type:`string`,description:`Scopes granted by the access token`},id_token:{type:`string`,description:`ID Token (if OpenID Connect)`}},required:[`access_token`,`token_type`,`expires_in`]}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>{if(e.request){let t=await km(e.request);t&&t.length>1&&(e.body.resource=t)}return uh(e,o)}),oauth2Introspect:l_(`/oauth2/introspect`,{method:`POST`,cloneRequest:!0,body:w({client_id:c().optional(),client_secret:c().optional(),client_assertion:c().optional(),client_assertion_type:c().optional(),token:c(),token_type_hint:c().optional()}),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Introspect an OAuth2 access or refresh token`,requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},token:{type:`string`,description:`The token to introspect (access or refresh token)`},token_type_hint:{type:`string`,description:"Hint about the token type. Recognized values: `access_token`, `refresh_token`."}},required:[`token`]}}}},responses:{200:{description:`Token introspection response`,content:{"application/json":{schema:{type:`object`,properties:{active:{type:`boolean`,description:`Whether the token is active`},scope:{type:`string`,description:`Scopes associated with the token`},client_id:{type:`string`,description:`Client ID associated with the token`},username:{type:`string`,description:`Username associated with the token`},token_type:{type:`string`,description:`Type of the token`},exp:{type:`number`,description:`Expiration time of the token (seconds since epoch)`},iat:{type:`number`,description:`Issued at time (seconds since epoch)`},nbf:{type:`number`,description:`Not before time (seconds since epoch)`},sub:{type:`string`,description:`Subject of the token`},aud:{type:`string`,description:`Audience of the token`},iss:{type:`string`,description:`Issuer of the token`},jti:{type:`string`,description:`JWT ID`}},required:[`active`]}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>lg(e,o)),oauth2Revoke:l_(`/oauth2/revoke`,{method:`POST`,cloneRequest:!0,body:w({client_id:c().optional(),client_secret:c().optional(),client_assertion:c().optional(),client_assertion_type:c().optional(),token:c(),token_type_hint:c().optional()}),metadata:{allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Revoke an OAuth2 access or refresh token`,requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},token:{type:`string`,description:`The token to revoke (access or refresh token)`},token_type_hint:{type:`string`,description:"Hint about the token type. Recognized values: `access_token`, `refresh_token`."}},required:[`token`]}}}},responses:{200:{description:`Token revoked successfully. The response body is empty.`,content:{"application/json":{schema:{type:`object`,description:`Empty object on success`}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>Oy(e,o)),oauth2UserInfo:X(`/oauth2/userinfo`,{method:[`GET`,`POST`],body:w({access_token:c().optional()}).passthrough().optional(),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Get OpenID Connect user information (UserInfo endpoint)`,security:[{bearerAuth:[]},{OAuth2:[`openid`,`profile`,`email`]}],parameters:[{name:`Authorization`,in:`header`,required:!1,schema:{type:`string`},description:`Bearer or DPoP access token`},{name:`DPoP`,in:`header`,required:!1,schema:{type:`string`},description:`RFC 9449 DPoP proof JWT when using a DPoP-bound access token`}],responses:{200:{description:`User information retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{sub:{type:`string`,description:`Subject identifier (user ID)`},email:{type:`string`,format:`email`,nullable:!0,description:`User's email address, included if 'email' scope is granted`},name:{type:`string`,nullable:!0,description:`User's full name, included if 'profile' scope is granted`},picture:{type:`string`,format:`uri`,nullable:!0,description:`User's profile picture URL, included if 'profile' scope is granted`},given_name:{type:`string`,nullable:!0,description:`User's given name, included if 'profile' scope is granted`},family_name:{type:`string`,nullable:!0,description:`User's family name, included if 'profile' scope is granted`},email_verified:{type:`boolean`,nullable:!0,description:`Whether the email is verified, included if 'email' scope is granted`}},required:[`sub`]}}}},401:{description:`Unauthorized - invalid or missing access token`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`}},required:[`error`]}}}},403:{description:`Forbidden - insufficient scope`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`}},required:[`error`]}}}}}}}},async e=>oh(e,o)),oauth2EndSession:l_(`/oauth2/end-session`,{method:[`GET`,`POST`],body:jy.optional(),query:jy.optional(),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`,`application/json`],$Infer:{body:{},query:{}},openapi:{description:`RP-Initiated Logout endpoint. Accepts standard logout parameters through GET or an application/x-www-form-urlencoded POST body, plus JSON for Better Auth generated-client calls. Requests without a usable id_token_hint may require explicit OP confirmation.`,responses:{200:{description:`Logout completed, or an HTML confirmation page was returned for browser navigation. A redirect is used only for an exact registered post_logout_redirect_uri.`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`URI to redirect to after logout (if post_logout_redirect_uri was provided)`},message:{type:`string`,description:`Success message`}}}},"text/html":{schema:{type:`string`}}}}}}}},async e=>t_(e,o)),oauth2EndSessionConfirmation:l_(`/oauth2/end-session/confirm`,{method:`POST`,body:w({action:l(`confirm`)}),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],scope:`http`}},async e=>n_(e,o)),registerOAuthClient:l_(`/oauth2/register`,{method:`POST`,body:xm,errorCodesByField:{redirect_uris:`invalid_redirect_uri`,post_logout_redirect_uris:`invalid_redirect_uri`,software_statement:`invalid_software_statement`,resources:`invalid_target`},defaultError:`invalid_client_metadata`,metadata:{noStore:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`Name of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URL for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},post_logout_redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed logout redirect uris`},backchannel_logout_uri:{type:`string`,format:`uri`,description:`RP URL to receive signed Logout Tokens when the end-user's OP session terminates`},backchannel_logout_session_required:{type:`boolean`,description:"Whether the RP requires a `sid` claim in every Logout Token"},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final resource identifiers linked to the registered client`},disabled:{type:`boolean`,description:`Whether the client is disabled`}},required:[`client_id`]}}}}}}}},async e=>gv(e,o)),adminCreateOAuthClient:zv(o),createOAuthClient:Bv(o),getOAuthClient:Vv(o),getOAuthClientPublic:Hv(o),getOAuthClientPublicPrelogin:Uv(o),getOAuthClients:Wv(o),adminUpdateOAuthClient:Gv(o),updateOAuthClient:Kv(o),rotateClientSecret:qv(o),deleteOAuthClient:Jv(o),getOAuthConsent:ey(o),getOAuthConsents:ty(o),updateOAuthConsent:ny(o),deleteOAuthConsent:ry(o),adminCreateOAuthResource:_y(o),adminListOAuthResources:vy(o),adminGetOAuthResource:yy(o),adminUpdateOAuthResource:by(o),adminDeleteOAuthResource:xy(o),adminLinkClientResource:Sy(o),adminUnlinkClientResource:Cy(o)},schema:Ud(structuredClone(ky),o?.schema),rateLimit:[...o.rateLimit?.token===!1?[]:[{pathMatcher:e=>e===`/oauth2/token`,window:o.rateLimit?.token?.window??60,max:o.rateLimit?.token?.max??20}],...o.rateLimit?.authorize===!1?[]:[{pathMatcher:e=>e===`/oauth2/authorize`,window:o.rateLimit?.authorize?.window??60,max:o.rateLimit?.authorize?.max??30}],...o.rateLimit?.introspect===!1?[]:[{pathMatcher:e=>e===`/oauth2/introspect`,window:o.rateLimit?.introspect?.window??60,max:o.rateLimit?.introspect?.max??100}],...o.rateLimit?.revoke===!1?[]:[{pathMatcher:e=>e===`/oauth2/revoke`,window:o.rateLimit?.revoke?.window??60,max:o.rateLimit?.revoke?.max??30}],...o.rateLimit?.register===!1?[]:[{pathMatcher:e=>e===`/oauth2/register`,window:o.rateLimit?.register?.window??60,max:o.rateLimit?.register?.max??5}],...o.rateLimit?.userinfo===!1?[]:[{pathMatcher:e=>e===`/oauth2/userinfo`,window:o.rateLimit?.userinfo?.window??60,max:o.rateLimit?.userinfo?.max??60}]]}};function Ry(e,t,n){return t!==0&&n.getTime()-e.getTime()<=t*1e3}function zy(e){let{max_age:t,...n}=e;return n}function By(e,t,n,r,i,a=`query`){let o=new URLSearchParams({error:t,error_description:n});return r&&o.append(`state`,r),i&&o.append(`iss`,i),a===`fragment`?`${e}#${o.toString()}`:Bu(e,o)}function Vy(e){let t=typeof e.response_mode==`string`?e.response_mode:void 0;if(t===`fragment`)return`fragment`;if(t===`query`)return`query`;let n=typeof e.response_type==`string`?e.response_type:void 0;return n&&/\b(token|id_token)\b/.test(n)?`fragment`:`query`}var Hy={response_type:{invalid:`unsupported_response_type`},resource:{invalid:`invalid_target`}};function Uy(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function Wy(e){return typeof e==`string`?e:void 0}function Gy(e,t){let n=e.method===`POST`&&t?.isAuthorize===!0?e.body:e.query;return{...Uy(n)?n:{}}}var $=(e,t)=>{let n=dg(e.request?.headers),r=e.headers?.get(`accept`)?.includes(`application/json`);if(n||r)return{redirect:!0,url:t.toString()};throw e.redirect(t)};function Ky(e,t,n,r,i){return $(e,By(n.redirect_uri,r,i,n.state,Jy(e,t)))}function qy(e){try{let t=new URL(e);return t.protocol!==`https:`&&!bp(t.host)&&(t.protocol=`https:`),t.search=``,t.hash=``,t.toString().replace(/\/$/,``)}catch{return e}}function Jy(e,t){let n;if(t.disableJwtPlugin)n=e.context.baseURL;else try{n=pl(e.context).options?.jwt?.issuer??e.context.baseURL}catch{n=e.context.baseURL}return qy(n)}function Yy(e,t,n){return By(e.context.options.onAPIError?.errorURL||`${e.context.baseURL}/error`,t,n)}function Xy(e){let t;try{t=new URL(e)}catch{return}let n=yp(t.hostname)||t.hostname===`localhost`;if(t.protocol!==`http:`||!n)return;let r=e.indexOf(`://`);if(r<0)return;let i=r+3,a=e.slice(i).search(/[/?#]/u),o=e.length;a>=0&&(o=i+a);let s=e.slice(i,o),c;if(s.startsWith(`[`)){let t=s.indexOf(`]`);if(t<0)return;if(s[t+1]!==`:`)return e;c=t+1}else if(c=s.lastIndexOf(`:`),c<0)return e;let l=s.slice(c+1);if(!/^\d*$/u.test(l))return;let u=i+c;return`${e.slice(0,u)}${e.slice(o)}`}function Zy(e,t){if(!e||!t)return;let n;try{n=new URL(t)}catch{return}let r=t.includes(`#`),i=n.username.length>0||n.password.length>0;if(r||i)return;let a=Xy(t);return e.find(e=>e===t?!0:a?Xy(e)===a:!1)}function Qy(e){if(!Q.safeParse(e).success)return!1;let t=new URL(e);return t.username.length===0&&t.password.length===0}async function $y(e,t,n,r){if(!n||!r)return null;let i;try{i=await xl(e,t,n)}catch{return null}if(!i||i.disabled)return null;let a=i.redirectUris??[],o=Zy(a,r);if(t.validateRedirectUri){if(!Qy(r))return null;try{return await t.validateRedirectUri(r,a,!!o)?r:null}catch{return null}}return o?r:null}function eb(e){return async({error:t,error_description:n,ctx:r})=>{let i=r.query??{},a=await $y(r,e,typeof i.client_id==`string`?i.client_id:void 0,typeof i.redirect_uri==`string`?i.redirect_uri:void 0);return a?$(r,By(a,t,n,typeof i.state==`string`?i.state:void 0,Jy(r,e),Vy(i))):$(r,Yy(r,t,n))}}async function tb(e,t,n){if(t.grantTypes&&!t.grantTypes.includes(`authorization_code`))throw new z(`NOT_FOUND`);if(!e.request)throw new z(`UNAUTHORIZED`,{error_description:`request not found`,error:`invalid_request`});let r=e.request,i=Gy(e,n);e.query=i;let a=Wy(i.request),o=Wy(i.request_uri);if(a!==void 0&&o!==void 0)return eb(t)({error:`invalid_request`,error_description:`request and request_uri cannot be used together`,ctx:e});if(a!==void 0)return eb(t)({error:`request_not_supported`,error_description:`request object not supported`,ctx:e});if(o!==void 0){let n=Wy(i.client_id);if(!n)return eb(t)({error:`invalid_request`,error_description:`client_id is required`,ctx:e});if(!t.requestUriResolver)return eb(t)({error:`request_uri_not_supported`,error_description:`request_uri not supported`,ctx:e});let r=await t.requestUriResolver({requestUri:o,clientId:n,ctx:e});if(!r)return eb(t)({error:`invalid_request_uri`,error_description:`request_uri is invalid or expired`,ctx:e});let a=i.client_id;i=r,a&&(i.client_id=a)}e.query=i;let s=vm.safeParse(i);if(!s.success){let n=u_(s.error.issues,Hy);return eb(t)({...n,ctx:e})}if(i=s.data,e.query=i,await My.set({query:nb(i).toString()}),!i.response_type)return eb(t)({error:`invalid_request`,error_description:`response_type is required`,ctx:e});let c=e.query?.prompt?Ul(e.query?.prompt):void 0,l=c?.has(`none`)??!1;if(c?.has(`select_account`)&&!t.selectAccount?.page)return $(e,Yy(e,`unsupported_prompt_select_account`,`unsupported prompt type`));if(i.response_type!==`code`)return $(e,Yy(e,`unsupported_response_type`,`unsupported response type`));let u=await xl(e,t,i.client_id);if(!u)return $(e,Yy(e,`invalid_client`,`client_id is required`));if(u.disabled)return $(e,Yy(e,`client_disabled`,`client is disabled`));if(!Il(u,`authorization_code`))return $(e,Yy(e,`unauthorized_client`,`client is not authorized to use the authorization_code grant`));let d=u.redirectUris??[],f=!1;if(i.redirect_uri){let e=!!Zy(d,i.redirect_uri);if(t.validateRedirectUri&&Qy(i.redirect_uri))try{f=await t.validateRedirectUri(i.redirect_uri,d,e)}catch{f=!1}else t.validateRedirectUri||(f=e)}if(!f)return $(e,Yy(e,`invalid_redirect`,`invalid redirect uri`));let p=i.scope?.split(` `).filter(e=>e);if(p){let n=new Set(u.scopes??t.scopes),r=p.filter(e=>!n?.has(e));if(r.length)return $(e,By(i.redirect_uri,`invalid_scope`,`The following scopes are invalid: ${r.join(`, `)}`,i.state,Jy(e,t)))}p||(p=u.scopes??t.scopes??[],i.scope=p.join(` `));let m=p.includes(`openid`);if(i.claims!==void 0&&!m)return $(e,By(i.redirect_uri,`invalid_request`,`openid scope must be requested when using the claims parameter`,i.state,Jy(e,t)));if(m&&!em(i.claims))return $(e,By(i.redirect_uri,`invalid_request`,`claims must be a valid Claims request object`,i.state,Jy(e,t)));if(m&&!nm(i.claims,`0`))return $(e,By(i.redirect_uri,`access_denied`,`essential acr requirement cannot be met`,i.state,Jy(e,t)));let h=tm(i.claims,sm(t));if(i.resource!==void 0)try{await Mm(e,t,{resource:i.resource,clientId:u.clientId,requestedScopes:p})}catch(n){if(n instanceof z){let r=n.body?.error??`invalid_target`,a=n.body?.error_description??`requested resource invalid`;return $(e,By(i.redirect_uri,r,a,i.state,Jy(e,t)))}throw n}let g=Zl(u,{scopes:p,nonce:i.nonce});if(g&&(!i.code_challenge||!i.code_challenge_method))return $(e,By(i.redirect_uri,`invalid_request`,g.valueOf(),i.state,Jy(e,t)));if(i.code_challenge||i.code_challenge_method){if(!i.code_challenge||!i.code_challenge_method)return $(e,By(i.redirect_uri,`invalid_request`,`code_challenge and code_challenge_method must both be provided`,i.state,Jy(e,t)));if(![`S256`].includes(i.code_challenge_method))return $(e,By(i.redirect_uri,`invalid_request`,`invalid code_challenge method, only S256 is supported`,i.state,Jy(e,t)))}let _=gl(i.resource)??[],v=await Z(e),y=i.max_age,b=v!=null&&y!==void 0&&Ry(new Date(v.session.createdAt),y,new Date);if(!v||v!=null&&y!==void 0&&!b||c?.has(`login`)||c?.has(`create`))return l?Ky(e,t,i,`login_required`,`authentication required`):ib(e,t,c?.has(`create`)?`create`:`login`);if(b&&(i=zy(i),e.query=i),n?.isAuthorize&&c?.has(`select_account`))return ib(e,t,`select_account`);if(n?.isAuthorize&&t.selectAccount&&await t.selectAccount.shouldRedirect({headers:r.headers,user:v.user,session:v.session,scopes:p}))return l?Ky(e,t,i,`account_selection_required`,`End-User account selection is required`):ib(e,t,`select_account`);if(t.signup?.shouldRedirect){let n=await t.signup.shouldRedirect({headers:r.headers,user:v.user,session:v.session,scopes:p});if(n)return l?Ky(e,t,i,`interaction_required`,`End-User interaction is required`):ib(e,t,`create`,{page:typeof n==`string`?n:void 0})}if(!n?.postLogin&&t.postLogin&&await t.postLogin.shouldRedirect({headers:r.headers,user:v.user,session:v.session,scopes:p}))return l?Ky(e,t,i,`interaction_required`,`End-User interaction is required`):ib(e,t,`post_login`);if(c?.has(`consent`))return ib(e,t,`consent`,{sessionId:v.session.id});let x=await t.postLogin?.consentReferenceId?.({user:v.user,session:v.session,scopes:p});if(u.skipConsent)return rb(e,t,{query:i,clientId:u.clientId,userId:v.user.id,sessionId:v.session.id,authTime:new Date(v.session.createdAt).getTime(),referenceId:x,resource:_});let S=await e.context.adapter.findOne({model:`oauthConsent`,where:[{field:`clientId`,value:u.clientId},{field:`userId`,value:v.user.id},...x?[{field:`referenceId`,value:x}]:[]]});if(!S||!p.every(e=>S.scopes.includes(e))||!h.every(e=>(S.requestedUserInfoClaims??[]).includes(e)))return l?Ky(e,t,i,`consent_required`,`End-User consent is required`):ib(e,t,`consent`,{sessionId:v.session.id});let C=S?.resources??[];return _.some(e=>!C.includes(e))?l?Ky(e,t,i,`consent_required`,`End-User consent is required`):ib(e,t,`consent`,{sessionId:v.session.id}):rb(e,t,{query:i,clientId:u.clientId,userId:v.user.id,sessionId:v.session.id,authTime:new Date(v.session.createdAt).getTime(),referenceId:x,resource:_})}function nb(e){let t=new URLSearchParams;for(let[n,r]of Object.entries(e))if(r!=null){if(Array.isArray(r))for(let e of r)t.append(n,String(e));else n===`claims`&&typeof r==`object`?t.set(n,JSON.stringify(r)):t.set(n,String(r))}return t}async function rb(e,t,n){let r=Fi(32,`a-z`,`A-Z`,`0-9`),i=Math.floor(Date.now()/1e3),a=i+(t.codeExpiresIn??600),o={identifier:await Dl(t.storeTokens,r,`authorization_code`),updatedAt:new Date(i*1e3),expiresAt:new Date(a*1e3),value:JSON.stringify({type:`authorization_code`,query:n.query,userId:n.userId,sessionId:n?.sessionId,referenceId:n.referenceId,authTime:n.authTime,resource:n.resource})};await e.context.internalAdapter.createVerificationValue({...o,createdAt:new Date(i*1e3)});let s=new URL(n.query.redirect_uri);return s.searchParams.set(`code`,r),n.query.state&&s.searchParams.set(`state`,n.query.state),s.searchParams.set(`iss`,Jy(e,t)),$(e,s.toString())}async function ib(e,t,n,r){let i=await ab(e,t,{postLoginClearedForSession:n===`consent`&&t.postLogin?r?.sessionId:void 0}),a=t.loginPage;if(n===`select_account`)a=t.selectAccount?.page??t.loginPage;else if(n===`post_login`){if(!t.postLogin?.page)throw new z(`INTERNAL_SERVER_ERROR`,{error_description:`postLogin should have been defined`});a=t.postLogin?.page}else n===`consent`?a=t.consentPage:n===`create`&&(a=t.signup?.page??t.loginPage);return $(e,`${r?.page??a}?${i}`)}async function ab(e,t,n){let r=Date.now(),i=Math.floor(r/1e3)+(t.codeExpiresIn??600),a=nb(e.query);a.set(`exp`,String(i)),a.set(we,String(r)),a.delete(`sig`),a.delete(Te),n?.postLoginClearedForSession&&a.set(Te,n.postLoginClearedForSession),Oe(a);let o=await Ga(De(a).toString(),e.context.secret);return a.set(`sig`,o),a.toString()}export{Vd as $,Ha as $t,Xf as A,Ql as At,Lf as B,$s as Bt,op as C,Mu as Ct,Wf as D,du as Dt,Yf as E,X as Et,qf as F,_l as Ft,pf as G,ss as Gt,kf as H,hs as Ht,Ff as I,gl as It,Fd as J,os as Jt,ff as K,ls as Kt,Uf as L,Ll as Lt,Zf as M,xl as Mt,Qf as N,fl as Nt,Z as O,ou as Ot,Jf as P,Pl as Pt,Bd as Q,Ua as Qt,Hf as R,bl as Rt,xp as S,ju as St,tp as T,yu as Tt,Tf as U,ms as Ut,zf as V,vs as Vt,hf as W,us as Wt,Ud as X,is as Xt,Hd as Y,as as Yt,Ld as Z,rs as Zt,Fp as _,lt as _n,Ru as _t,w_ as a,vi as an,bd as at,wp as b,Fe as bn,Ou as bt,dh as c,hi as cn,gd as ct,Hp as d,br as dn,cd as dt,Li as en,Id as et,Bp as f,Ct as fn,ud as ft,Ip as g,ct as gn,Bu as gt,Lp as h,_t as hn,ad as ht,Ev as i,yi as in,Dd as it,$f as j,Xc as jt,Gf as k,au as kt,Sm as l,Kr as ln,md as lt,zp as m,ht as mn,td as mt,k_ as n,Pi as nn,Pd as nt,fm as o,_i as on,vd as ot,Vp as p,st as pn,od as pt,Wd as q,cs as qt,Ly as r,Si as rn,Td as rt,km as s,gi as sn,pd as st,Ny as t,Fi as tn,zd as tt,Mm as u,Vr as un,hd as ut,Np as v,ft as vn,Du as vt,np as w,Lu as wt,bp as x,be as xn,ku as xt,Ap as y,qe as yn,Au as yt,If as z,ic as zt};
+//# sourceMappingURL=authorize-C95F-9E1-D4G4zT66.js.map