@tempoxyz/id 0.0.0-pr-293.sha-db2bcd0 → 0.0.0-pr-293.sha-e314a6e

package/dist/app/server/assets/{authorize-DXYo-K2n-08rIhXFT.js → authorize-DXYo-K2n-Bc8o9t1x.js}

@@ -1,4 +1,4 @@
-import{k as e}from"./react-dom-DtwtyQPy.js";import{Zt as t}from"./core-Dxqe4Tzf.js";import{$t as n,B as r,C as i,D as a,O as o,S as s,T as c,_ as l,a as u,b as d,f,g as p,h as m,i as h,in as g,k as _,l as v,n as y,r as b,s as x,t as S,v as C,x as w,y as T,z as E}from"./schemas-fV27l6kI.js";import{$ as D,B as O,D as k,E as A,F as j,G as M,H as N,I as P,J as F,K as I,L,P as R,Q as ee,R as te,T as ne,U as re,V as ie,W as ae,Y as oe,Z as se,a as ce,b as z,d as le,et as ue,f as de,h as fe,j as pe,l as me,m as he,o as ge,p as _e,q as ve,t as ye,tt as be,w as xe,x as B,z as Se}from"./get-id-field-DS9IzViQ.js";import{a as Ce}from"./schema-check-DB26iPrr.js";function we(e){return r(h,e)}function Te(e){return E(S,e)}var Ee=Object.defineProperty,De=(e,t)=>{let n={};for(var r in e)Ee(n,r,{get:e[r],enumerable:!0});return t||Ee(n,Symbol.toStringTag,{value:`Module`}),n},Oe=`ba_iat`,ke=`ba_pl`,Ae=`ba_param`;function je(e){let t=new URLSearchParams,n=[...e.entries()].sort(([e,t],[n,r])=>e<n?-1:e>n?1:t<r?-1:+(t>r));for(let[e,r]of n)t.append(e,r);return t}function Me(e){e.delete(Ae);let t=[...new Set([...e.keys(),Ae])].sort();for(let n of t)e.append(Ae,n)}function Ne(e){let t=new URLSearchParams(e).get(Oe);if(!t)return null;let n=Number(t);return!Number.isFinite(n)||n<=0?null:new Date(n)}function Pe(e){let t=new URLSearchParams(e),n=t.get(`ba_pl`)??void 0;for(let e of[`sig`,`exp`,Oe,Ae,ke])t.delete(e);return{query:t.toString(),signedQueryIssuedAt:Ne(e)??void 0,postLoginClearedForSession:n}}var Fe=class{oHash;iHash;blockLen;outputLen;canXOF=!1;finished=!1;destroyed=!1;constructor(e,t){if(ve(e),M(t,void 0,`key`),this.iHash=e.create(),typeof this.iHash.update!=`function`)throw Error(`expected Hash instance`);this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,r=new Uint8Array(n);r.set(t.length>n?e.create().update(t).digest():t);for(let e=0;e<r.length;e++)r[e]^=54;this.iHash.update(r),this.oHash=e.create();for(let e=0;e<r.length;e++)r[e]^=106;this.oHash.update(r),se(r)}update(e){return I(this),this.iHash.update(e),this}digestInto(e){I(this),oe(e,this),this.finished=!0;let t=e.subarray(0,this.outputLen);this.iHash.digestInto(t),this.oHash.update(t),this.oHash.digestInto(t),this.destroy()}digest(){let e=new Uint8Array(this.oHash.outputLen);return this.digestInto(e),e}_cloneInto(e){e||=Object.create(Object.getPrototypeOf(this),{});let{oHash:t,iHash:n,finished:r,destroyed:i,blockLen:a,outputLen:o,canXOF:s}=this;return e=e,e.finished=r,e.destroyed=i,e.blockLen=a,e.outputLen=o,e.canXOF=s,e.oHash=t._cloneInto(e.oHash),e.iHash=n._cloneInto(e.iHash),e}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},Ie=(()=>{let e=((e,t,n)=>new Fe(e,t).update(n).digest());return e.create=(e,t)=>new Fe(e,t),e})(),Le=Uint8Array.of(0),Re=Uint8Array.of();function ze(e,t,n,r=32,i){ve(e),F(r,`length`),M(t,void 0,`prk`);let a=e.outputLen;if(t.length<a)throw Error(`"prk" must be at least HashLen octets`);if(r>255*a)throw Error(`Length must be <= 255*HashLen`);let o=Math.ceil(r/a);if(n===void 0?n=Re:M(n,void 0,`info`),!o)return i&&se(t),new Uint8Array;let s=i&&o===1?t:new Uint8Array(o*a),{iHash:c,oHash:l}=Ie.create(e,t),u=i?t:new Uint8Array(a),d=o>1?i?.iHash||e.create():void 0;for(let e=0;e<o-1;e++){Le[0]=e+1;let t=c._cloneInto(d);e&&t.update(u),t.update(n).update(Le).digestInto(u),l._cloneInto(d).update(u).digestInto(u),s.set(u,a*e)}if(Le[0]=o,o>1&&c.update(u),c.update(n).update(Le).digestInto(u),l.update(u).digestInto(u),s.set(u,a*(o-1)),c.destroy(),l.destroy(),d?.destroy(),u!==s&&se(u),se(Le),r===s.length)return s;let f=s.slice(0,r);return se(s),f}var Be=(e,t,n,r,i)=>{ve(e),n===void 0&&(n=new Uint8Array(e.outputLen));let a=Ie.create(e,n).update(t);return ze(e,a.digest(),r,i,a)},Ve=e=>e/2**32|0,He=e=>e>>>0;function Ue(e,t,n,r){let i=Ve(n),a=He(n);e.setUint32(t,r?a:i,r),e.setUint32(t+4,r?i:a,r)}function We(e,t,n){return e&t^~e&n}function Ge(e,t,n){return e&t^e&n^t&n}var Ke=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,t,n,r){this.blockLen=e,this.outputLen=t,this.padOffset=n,this.isLE=r,this.buffer=new Uint8Array(e),this.view=D(this.buffer)}update(e){I(this),M(e);let{view:t,buffer:n,blockLen:r}=this,i=e.length,a=!1;for(let o=0;o<i;){let s=Math.min(r-this.pos,i-o);if(s===r){let t=D(e);for(;r<=i-o;o+=r)this.process(t,o);a=!0}else n.set(o===0&&s===i?e:e.subarray(o,o+s),this.pos),this.pos+=s,o+=s,this.pos===r&&(this.process(t,0),this.pos=0,a=!0)}return this.length+=e.length,a&&this.roundClean(),this}digestInto(e){I(this),oe(e,this),this.finished=!0;let{buffer:t,view:n,blockLen:r,isLE:i}=this,{pos:a}=this;t[a++]=128,t.fill(0,a),this.padOffset>r-a&&(this.process(n,0),t.fill(0)),Ue(n,r-8,this.length*8,i),this.process(n,0),this.roundClean();let o=e===t?n:D(e),s=this.outputLen,c=s/4,l=this.get();if(s%4||c>l.length)throw Error(`invalid outputLen`);for(let e=0;e<c;e++)o.setUint32(4*e,l[e],i)}digest(){let{buffer:e,outputLen:t}=this;this.digestInto(e);let n=e.slice(0,t);return this.destroy(),n}_cloneIntoMeta(e){let{buffer:t,length:n,finished:r,destroyed:i,pos:a}=this;return e.destroyed=i,e.finished=r,e.length=n,e.pos=a,a&&e.buffer.set(t),e}clone(){return this._cloneInto()}},qe=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),Je=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),Ye=new Uint32Array(64),Xe=class extends Ke{A=0;B=0;C=0;D=0;E=0;F=0;G=0;H=0;constructor(e,t){super(64,e,8,!1),this.A=t[0]|0,this.B=t[1]|0,this.C=t[2]|0,this.D=t[3]|0,this.E=t[4]|0,this.F=t[5]|0,this.G=t[6]|0,this.H=t[7]|0}get(){let{A:e,B:t,C:n,D:r,E:i,F:a,G:o,H:s}=this;return[e,t,n,r,i,a,o,s]}set(e,t,n,r,i,a,o,s){this.A=e|0,this.B=t|0,this.C=n|0,this.D=r|0,this.E=i|0,this.F=a|0,this.G=o|0,this.H=s|0}_cloneInto(e){return(e||=new this.constructor).set(...this.get()),this._cloneIntoMeta(e)}process(e,t){for(let n=0;n<16;n++,t+=4)Ye[n]=e.getUint32(t,!1);for(let e=16;e<64;e++){let t=Ye[e-15],n=Ye[e-2],r=be(t,7)^be(t,18)^t>>>3,i=be(n,17)^be(n,19)^n>>>10;Ye[e]=i+Ye[e-7]+r+Ye[e-16]|0}let{A:n,B:r,C:i,D:a,E:o,F:s,G:c,H:l}=this;for(let e=0;e<64;e++){let t=be(o,6)^be(o,11)^be(o,25),u=l+t+We(o,s,c)+Je[e]+Ye[e]|0,d=(be(n,2)^be(n,13)^be(n,22))+Ge(n,r,i)|0;l=c,c=s,s=o,o=a+u|0,a=i,i=r,r=n,n=u+d|0}n=n+this.A|0,r=r+this.B|0,i=i+this.C|0,a=a+this.D|0,o=o+this.E|0,s=s+this.F|0,c=c+this.G|0,l=l+this.H|0,this.set(n,r,i,a,o,s,c,l)}roundClean(){se(Ye)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),se(this.buffer)}},Ze=class extends Xe{constructor(){super(32,qe)}},Qe=ee(()=>new Ze,ue(1)),$e=new TextEncoder,et=new TextDecoder,tt=new TextDecoder(`utf-8`,{fatal:!0}),nt=2**32;function rt(...e){let t=e.reduce((e,{length:t})=>e+t,0),n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function it(e,t,n){if(t<0||t>=nt)throw RangeError(`value must be >= 0 and <= ${nt-1}. Received ${t}`);e.set([t>>>24,t>>>16,t>>>8,t&255],n)}function at(e){let t=Math.floor(e/nt),n=e%nt,r=new Uint8Array(8);return it(r,t,0),it(r,n,4),r}function ot(e){let t=new Uint8Array(4);return it(t,e),t}var st=/[^\x00-\x7f]/;function ct(e){if(typeof e==`string`&&e.length>=128){if(st.test(e))throw TypeError(`non-ASCII string encountered in encode()`);return $e.encode(e)}let t=new Uint8Array(e.length);for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);if(r>127)throw TypeError(`non-ASCII string encountered in encode()`);t[n]=r}return t}function lt(e,t=!1){if(Uint8Array.prototype.toBase64)return e.toBase64({alphabet:t?`base64url`:`base64`,omitPadding:t});let n=32768,r=[];for(let t=0;t<e.length;t+=n)r.push(String.fromCharCode.apply(null,e.subarray(t,t+n)));let i=btoa(r.join(``));return t?i.replace(/=/g,``).replace(/\+/g,`-`).replace(/\//g,`_`):i}function ut(e,t=!1){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e,{alphabet:t?`base64url`:`base64`});if(t){if(e.includes(`+`)||e.includes(`/`))throw TypeError(`Invalid base64url`);e=e.replace(/-/g,`+`).replace(/_/g,`/`)}let n=atob(e),r=new Uint8Array(n.length);for(let e=0;e<n.length;e++)r[e]=n.charCodeAt(e);return r}async function dt(e,t){let n=`SHA-${e.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(n,t))}var V=class extends Error{static code=`ERR_JOSE_GENERIC`;code=`ERR_JOSE_GENERIC`;constructor(e,t){super(e,t),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},ft=class extends V{static code=`ERR_JWT_CLAIM_VALIDATION_FAILED`;code=`ERR_JWT_CLAIM_VALIDATION_FAILED`;claim;reason;payload;constructor(e,t,n=`unspecified`,r=`unspecified`){super(e,{cause:{claim:n,reason:r,payload:t}}),this.claim=n,this.reason=r,this.payload=t}},pt=class extends V{static code=`ERR_JWT_EXPIRED`;code=`ERR_JWT_EXPIRED`;claim;reason;payload;constructor(e,t,n=`unspecified`,r=`unspecified`){super(e,{cause:{claim:n,reason:r,payload:t}}),this.claim=n,this.reason=r,this.payload=t}},mt=class extends V{static code=`ERR_JOSE_ALG_NOT_ALLOWED`;code=`ERR_JOSE_ALG_NOT_ALLOWED`},H=class extends V{static code=`ERR_JOSE_NOT_SUPPORTED`;code=`ERR_JOSE_NOT_SUPPORTED`},ht=class extends V{static code=`ERR_JWE_DECRYPTION_FAILED`;code=`ERR_JWE_DECRYPTION_FAILED`;constructor(e=`decryption operation failed`,t){super(e,t)}},U=class extends V{static code=`ERR_JWE_INVALID`;code=`ERR_JWE_INVALID`},W=class extends V{static code=`ERR_JWS_INVALID`;code=`ERR_JWS_INVALID`},gt=class extends V{static code=`ERR_JWT_INVALID`;code=`ERR_JWT_INVALID`},_t=class extends V{static code=`ERR_JWK_INVALID`;code=`ERR_JWK_INVALID`},vt=class extends V{static code=`ERR_JWKS_INVALID`;code=`ERR_JWKS_INVALID`},yt=class extends V{static code=`ERR_JWKS_NO_MATCHING_KEY`;code=`ERR_JWKS_NO_MATCHING_KEY`;constructor(e=`no applicable key found in the JSON Web Key Set`,t){super(e,t)}},bt=class extends V{[Symbol.asyncIterator]=async function*(){};static code=`ERR_JWKS_MULTIPLE_MATCHING_KEYS`;code=`ERR_JWKS_MULTIPLE_MATCHING_KEYS`;constructor(e=`multiple matching keys found in the JSON Web Key Set`,t){super(e,t)}},xt=class extends V{static code=`ERR_JWKS_TIMEOUT`;code=`ERR_JWKS_TIMEOUT`;constructor(e=`request timed out`,t){super(e,t)}},St=class extends V{static code=`ERR_JWS_SIGNATURE_VERIFICATION_FAILED`;code=`ERR_JWS_SIGNATURE_VERIFICATION_FAILED`;constructor(e=`signature verification failed`,t){super(e,t)}},Ct=`The input to be decoded is not correctly encoded.`;function wt(e){try{return ut(typeof e==`string`?e:et.decode(e),!0)}catch(e){throw TypeError(Ct,{cause:e})}}function G(e){return lt(typeof e==`string`?$e.encode(e):e,!0)}function Tt(e,t){if(!(e instanceof Uint8Array))throw TypeError(`${t} must be an instance of Uint8Array`)}function Et(e){if(typeof e!=`object`||!e||Object.prototype.toString.call(e)!==`[object Object]`)return!1;let t=Object.getPrototypeOf(e);return t===null||Object.getPrototypeOf(t)===null}function Dt(e){return Et(e)&&Array.isArray(e.keys)&&Array.from(e.keys).every(Et)}function Ot(...e){let t=new Set;for(let n of e)if(n)for(let e of Object.keys(n)){if(t.has(e))return!1;t.add(e)}return!0}function kt(e,t){if(e!==void 0)throw TypeError(`${t} can only be called once`)}function At(e,t,n){try{return wt(e)}catch{throw new n(`Failed to base64url decode the ${t}`)}}function jt(e,t,n){try{return ct(e)}catch{throw new n(`The ${t} is not a valid base64url string`)}}function Mt(e,t,n){let r;try{r=JSON.parse(tt.decode(wt(e)))}catch{throw new t(n)}if(!Et(r))throw new t(n);return r}var Nt={__proto__:null,b64:!0},Pt={__proto__:null};function Ft(e,t){if(t!==void 0&&(!Array.isArray(t)||t.some(e=>typeof e!=`string`)))throw TypeError(`"${e}" option must be an array of strings`);return t===void 0?void 0:new Set(t)}function It(e,t){let{crit:n}=t??{};if(Array.isArray(n)&&new Set(n).size!==n.length)throw new e(`"crit" (Critical) Header Parameter MUST NOT contain duplicate values`)}function Lt(e,t,n,r,i){if(i.crit!==void 0&&r?.crit===void 0)throw new e(`"crit" (Critical) Header Parameter MUST be integrity protected`);if(!r||r.crit===void 0)return[];if(!Array.isArray(r.crit)||r.crit.length===0||r.crit.some(e=>typeof e!=`string`||e.length===0))throw new e(`"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present`);let a=n===void 0?t:{__proto__:null,...n,...t};for(let t of r.crit){if(!(t in a))throw new H(`Extension Header Parameter "${t}" is not recognized`);if(!Object.hasOwn(i,t)||i[t]===void 0)throw new e(`Extension Header Parameter "${t}" is missing`);if(a[t]&&(!Object.hasOwn(r,t)||r[t]===void 0))throw new e(`Extension Header Parameter "${t}" MUST be integrity protected`)}return r.crit}function Rt(e,t){if(t.includes(`b64`)){let t=e.b64;if(typeof t!=`boolean`)throw new W(`The "b64" (base64url-encode payload) Header Parameter must be a boolean`);return t}return!0}function zt(e,t){let n,r;try{n=JSON.stringify(t),r=JSON.parse(n)}catch(t){throw new e(`JOSE Header is not valid JSON`,{cause:t})}if(!Et(r))throw new e(`JOSE Header is not a JSON object`);return[r,n]}var Bt=e=>e[Symbol.toStringTag],Vt=(e,t,n)=>{let{alg:r}=e;if(t.use!==void 0){let e=n===`sign`||n===`verify`?`sig`:`enc`;if(t.use!==e)throw TypeError(`Invalid key for this operation, its "use" must be "${e}" when present`)}if(t.alg!==void 0&&t.alg!==r)throw TypeError(`Invalid key for this operation, its "alg" must be "${r}" when present`);if(Array.isArray(t.key_ops)){let r=n===`encrypt`||n===`decrypt`?e.ops?.[n===`encrypt`?0:1]:n;if(r&&!t.key_ops.includes(r))throw TypeError(`Invalid key for this operation, its "key_ops" must include "${r}" when present`)}};async function Ht(e,t,n){let{alg:r,secret:i}=e,a=n===`decrypt`||n===`sign`;if(i&&t instanceof Uint8Array)return t;let o,s;if(Et(t)){if(o=rn(t),typeof o.kty!=`string`)throw Zt(r,t,i);if(!(i?o.kty===`oct`&&typeof o.k==`string`:o.kty!==`oct`&&(a?o.kty===`AKP`&&typeof o.priv==`string`||typeof o.d==`string`:o.d===void 0&&o.priv===void 0)))throw TypeError(i?`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`:`JSON Web Key for this operation must be a ${a?`private`:`public`} JWK`);if(Vt(e,o,n),o.kty===`oct`)return wt(o.k);if(!Object.isFrozen(t)){let{key_ops:e}=t;Array.isArray(e)&&Object.freeze(e),Object.freeze(t)}}else{if(!Jt(t))throw Zt(r,t,i);let e=i?`secret`:a?`private`:`public`;if(t.type!==e&&(i||[`secret`,`public`,`private`].includes(t.type)))throw TypeError(`${Bt(t)} instances must be of type "${e}" for the ${r} algorithm`);if(Kt(t))return t;if(s=t,s.type===`secret`)return s.export()}Ut||=new WeakMap;let c=t,l=Ut.get(c);if(l?.[r])return l[r];if(l||Ut.set(c,l={}),s&&typeof s.toCryptoKey==`function`){let t=s.type===`public`,n=Wt[s.asymmetricKeyDetails?.namedCurve],i=e.resolve?.({crv:n,asymmetricKeyType:s.asymmetricKeyType})??e.subtle;return l[r]=s.toCryptoKey(i,t,e.usages[+!t])}return o??=s.export({format:`jwk`}),o.alg=r,l[r]=await on(e,o)}var Ut,Wt={__proto__:null,prime256v1:`P-256`,secp384r1:`P-384`,secp521r1:`P-521`};function Gt(e){if(!Kt(e))throw Error(`CryptoKey instance expected`)}var Kt=e=>{if(e?.[Symbol.toStringTag]===`CryptoKey`)return!0;try{return e instanceof CryptoKey}catch{return!1}},qt=e=>e?.[Symbol.toStringTag]===`KeyObject`,Jt=e=>Kt(e)||qt(e);function Yt(e,t,...n){if(n.length>2){let t=n.pop();e+=`one of type ${n.join(`, `)}, or ${t}.`}else n.length===2?e+=`one of type ${n[0]} or ${n[1]}.`:e+=`of type ${n[0]}.`;return t==null?e+=` Received ${t}`:typeof t==`function`&&t.name?e+=` Received function ${t.name}`:typeof t==`object`&&t&&t.constructor?.name&&(e+=` Received an instance of ${t.constructor.name}`),e}var Xt=(e,...t)=>Yt(`Key must be `,e,...t);function Zt(e,t,n){let r=[`CryptoKey`,`KeyObject`,`JSON Web Key`];return n&&r.push(`Uint8Array`),TypeError(Yt(`Key for the ${e} algorithm must be `,t,...r))}var Qt=(e,t=`algorithm.name`)=>TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`);function $t(e,t){if(t&&!e.usages.includes(t))throw TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`)}function en(e,t){let{modulusLength:n}=t.algorithm;if(typeof n!=`number`||n<2048)throw TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}function tn(e,t,n){let r=e.algorithm;if(r.name!==t.name)throw Qt(t.name);if(t.hash&&r.hash?.name!==t.hash)throw Qt(t.hash,`algorithm.hash`);if(t.namedCurve&&r.namedCurve!==t.namedCurve)throw Qt(t.namedCurve,`algorithm.namedCurve`);if(t.length!==void 0&&r.length!==t.length)throw Qt(t.length,`algorithm.length`);$t(e,n)}function nn(e){return{__proto__:null,...e}}function rn(e){let t=nn(e);if(t.ext!==void 0&&typeof t.ext!=`boolean`)throw TypeError(`"ext" (Extractable) Parameter must be a boolean`);if(t.key_ops!==void 0){let e=t.key_ops,n=Array.isArray(e)?[...e]:void 0;if(!n||n.some(e=>typeof e!=`string`)||new Set(n).size!==n.length)throw TypeError(`"key_ops" (Key Operations) Parameter must be an array of unique strings`);t.key_ops=n}return t}function an(e){if(e!==void 0&&typeof e!=`boolean`)throw TypeError(`"extractable" option must be a boolean`);return e}async function on(e,t,n){if(!e.kty.includes(t.kty))throw new H(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value`);let r=e.resolve?.({kty:t.kty,crv:t.crv})??e.subtle,i=!!(t.d||t.priv),a={...t,ext:n??t.ext};return a.kty!==`AKP`&&delete a.alg,delete a.use,crypto.subtle.importKey(`jwk`,a,r,a.ext??!i,t.key_ops??e.usages[+!!i])}async function sn(e,t,n,r=!1){return e instanceof Uint8Array&&(e=await crypto.subtle.importKey(`raw`,e,t,r,[n])),tn(e,t,n),e}var cn=e=>crypto.getRandomValues(new Uint8Array(e.cekBits>>3));function ln(e,t){let n=e.byteLength<<3;if(n!==t)throw new U(`Invalid Content Encryption Key length. Expected ${t} bits, got ${n} bits`)}var un=e=>crypto.getRandomValues(new Uint8Array(e.ivBits>>3));function dn(e,t){if(t.length<<3!==e.ivBits)throw new U(`Invalid Initialization Vector length`)}async function fn(e,t,n){if(!(t instanceof Uint8Array))throw TypeError(Xt(t,`Uint8Array`));let r=e.cekBits>>1;return[await crypto.subtle.importKey(`raw`,t.subarray(r>>3),`AES-CBC`,!1,[n]),await crypto.subtle.importKey(`raw`,t.subarray(0,r>>3),{hash:`SHA-${r<<1}`,name:`HMAC`},!1,[`sign`]),r]}async function pn(e,t,n){return new Uint8Array((await crypto.subtle.sign(`HMAC`,e,t)).slice(0,n>>3))}async function mn(e,t,n,r,i){let[a,o,s]=await fn(e,n,`encrypt`),c=new Uint8Array(await crypto.subtle.encrypt({iv:r,name:`AES-CBC`},a,t));return{ciphertext:c,tag:await pn(o,rt(i,r,c,at(i.length*8)),s),iv:r}}async function hn(e,t){let n={name:`HMAC`,hash:`SHA-256`},r=await crypto.subtle.generateKey(n,!1,[`sign`,`verify`]),i=await crypto.subtle.sign(n,r,e);return crypto.subtle.verify(n,r,i,t)}async function gn(e,t,n,r,i,a){let[o,s,c]=await fn(e,t,`decrypt`),l=await pn(s,rt(a,r,n,at(a.length*8)),c);try{if(await hn(i,l))return new Uint8Array(await crypto.subtle.decrypt({iv:r,name:`AES-CBC`},o,n))}catch{}throw new ht}async function _n(e,t,n,r,i){if(!Kt(n)&&!(n instanceof Uint8Array))throw TypeError(Xt(n,`CryptoKey`,`KeyObject`,`Uint8Array`,`JSON Web Key`));if(r?dn(e,r):r=un(e),n instanceof Uint8Array&&ln(n,e.cekBits),e.cbc)return mn(e,t,n,r,i);let a=await sn(n,e.subtle,`encrypt`),o=new Uint8Array(await crypto.subtle.encrypt({additionalData:i,iv:r,name:`AES-GCM`,tagLength:128},a,t));return{ciphertext:o.subarray(0,-16),tag:o.subarray(-16),iv:r}}async function vn(e,t,n,r,i,a){if(!Kt(t)&&!(t instanceof Uint8Array))throw TypeError(Xt(t,`CryptoKey`,`KeyObject`,`Uint8Array`,`JSON Web Key`));if(!r)throw new U(`JWE Initialization Vector missing`);if(!i)throw new U(`JWE Authentication Tag missing`);if(!e.cbc&&i.length!==16)throw new U(`Invalid Authentication Tag length`);if(dn(e,r),t instanceof Uint8Array&&ln(t,e.cekBits),e.cbc)return gn(e,t,n,r,i,a);let o=await sn(t,e.subtle,`decrypt`);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:a,iv:r,name:`AES-GCM`,tagLength:128},o,rt(n,i)))}catch{throw new ht}}function yn(e){let t={__proto__:null};for(let n in e)t[n]={...e[n],alg:n};return t}var bn=[[`encrypt`,`wrapKey`],[`decrypt`,`unwrapKey`]],xn=[[],[`deriveBits`]],Sn=[[],[]];function Cn(e){return{kty:[`RSA`],mode:`key-encryption`,subtle:{name:`RSA-OAEP`,hash:`SHA-${e}`},usages:bn,ops:[`wrapKey`,`unwrapKey`]}}function wn(e){return{kty:[`EC`,`OKP`],mode:e,subtle:{name:`ECDH`},resolve:({kty:e,crv:t,asymmetricKeyType:n})=>{if(t===`X25519`||n===`x25519`)return{name:`X25519`};if(e===`OKP`)throw new H(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value`);return{name:`ECDH`,namedCurve:t}},usages:xn,ops:[void 0,`deriveBits`]}}function Tn(e,t=!1){return{kty:[`oct`],mode:`key-wrapping`,secret:!0,subtle:{name:t?`AES-GCM`:`AES-KW`,length:e},usages:Sn,ops:t?[`encrypt`,`decrypt`]:[`wrapKey`,`unwrapKey`]}}function En(){return{kty:[`oct`],mode:`key-wrapping`,secret:!0,subtle:{name:`PBKDF2`},usages:Sn,ops:[`deriveBits`,`deriveBits`]}}var Dn=yn({dir:{kty:[`oct`],mode:`direct-encryption`,secret:!0,subtle:{name:`AES-GCM`},usages:Sn,ops:[`encrypt`,`decrypt`]},"RSA-OAEP":Cn(1),"RSA-OAEP-256":Cn(256),"RSA-OAEP-384":Cn(384),"RSA-OAEP-512":Cn(512),"ECDH-ES":wn(`direct-key-agreement`),"ECDH-ES+A128KW":wn(`key-agreement-with-key-wrapping`),"ECDH-ES+A192KW":wn(`key-agreement-with-key-wrapping`),"ECDH-ES+A256KW":wn(`key-agreement-with-key-wrapping`),A128KW:Tn(128),A192KW:Tn(192),A256KW:Tn(256),A128GCMKW:Tn(128,!0),A192GCMKW:Tn(192,!0),A256GCMKW:Tn(256,!0),"PBES2-HS256+A128KW":En(),"PBES2-HS384+A192KW":En(),"PBES2-HS512+A256KW":En()}),On=[`encrypt`,`decrypt`];function kn(e,t=!1){return{kty:[`oct`],secret:!0,subtle:{name:t?`AES-CBC`:`AES-GCM`,length:e},usages:Sn,ops:On,cekBits:e,ivBits:t?128:96,cbc:t}}var An=yn({A128GCM:kn(128),A192GCM:kn(192),A256GCM:kn(256),"A128CBC-HS256":kn(256,!0),"A192CBC-HS384":kn(384,!0),"A256CBC-HS512":kn(512,!0)});function jn(e,t){throw new H(`Invalid or unsupported "${e}" (JWE ${t}) header value`)}function Mn(e){return(typeof e==`string`?Dn[e]:void 0)??jn(`alg`,`Algorithm`)}function Nn(e){return e.mode===`key-wrapping`||e.mode===`key-encryption`||e.mode===`key-agreement-with-key-wrapping`}function Pn(e){return(typeof e==`string`?An[e]:void 0)??jn(`enc`,`Encryption Algorithm`)}function Fn(e,t){if(e.algorithm.name!==`ECDH`&&e.algorithm.name!==`X25519`)throw TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519`);$t(e,t)}async function In(e,t,n){let r=await sn(t,Mn(e).subtle,`wrapKey`,!0),i=await crypto.subtle.importKey(`raw`,n,{hash:`SHA-256`,name:`HMAC`},!0,[`sign`]);return new Uint8Array(await crypto.subtle.wrapKey(`raw`,i,r,`AES-KW`))}async function Ln(e,t,n){let r=await sn(t,Mn(e).subtle,`unwrapKey`,!0),i=await crypto.subtle.unwrapKey(`raw`,n,r,`AES-KW`,{hash:`SHA-256`,name:`HMAC`},!0,[`sign`]);return new Uint8Array(await crypto.subtle.exportKey(`raw`,i))}function Rn(e,t,n){tn(t,Mn(e).subtle,n),en(e,t)}async function zn(e,t,n,r){if(!(e instanceof Uint8Array)||e.length<8)throw new U(`PBES2 Salt Input must be 8 or more octets`);if(!Number.isSafeInteger(n)||Math.sign(n)!==1)throw new U(`PBES2 Count Input must be a positive integer`);let i=rt(ct(t),Uint8Array.of(0),e),a=parseInt(t.slice(13,16),10),o={hash:`SHA-${t.slice(8,11)}`,iterations:n,name:`PBKDF2`,salt:i},s=await sn(r,Mn(t).subtle,`deriveBits`);return new Uint8Array(await crypto.subtle.deriveBits(o,s,a))}function Bn(e){return rt(ot(e.length),e)}async function Vn(e,t,n){let r=t>>3,i=Math.ceil(r/32),a=new Uint8Array(i*32);for(let t=1;t<=i;t++){let r=await dt(`sha256`,rt(ot(t),e,n));a.set(r,(t-1)*32)}return a.slice(0,r)}async function Hn(e,t,n,r,i=new Uint8Array,a=new Uint8Array){Fn(e),Fn(t,`deriveBits`);let o=rt(Bn(ct(n)),Bn(i),Bn(a),ot(r));return Vn(new Uint8Array(await crypto.subtle.deriveBits({name:e.algorithm.name,public:e},t,e.algorithm.name===`X25519`?256:Math.ceil(parseInt(e.algorithm.namedCurve.slice(-3),10)/8)<<3)),r,o)}function Un(e){Gt(e);let t=e.algorithm.namedCurve;if(t!==`P-256`&&t!==`P-384`&&t!==`P-521`&&e.algorithm.name!==`X25519`)throw new H(`ECDH with the provided key is not allowed or not supported by your javascript runtime`)}function Wn(e,t){let n=e[t];if(n!==void 0){if(typeof n!=`string`)throw new U(`JOSE Header "${t}" (Agreement Party${t===`apu`?`U`:`V`}Info) invalid`);return At(n,t,U)}}function Gn(e,t){if(e!==void 0&&t!==void 0&&e.byteLength===t.byteLength){for(let n=0;n<e.byteLength;n++)if(e[n]!==t[n])return;throw new U(`JOSE Header "apu" and "apv" values must be distinct`)}}function Kn(e){if(e===void 0)throw new U(`JWE Encrypted Key missing`)}function qn(e){if(e!==void 0)throw new U(`Encountered unexpected JWE Encrypted Key`)}function Jn(e){if(e!==void 0&&e!==1/0&&(!Number.isSafeInteger(e)||e<1))throw TypeError(`maxPBES2Count must be a positive safe integer or Infinity`)}async function Yn(e,t,n,r,i,a){let{alg:o}=e,s=e.mode;if(s===`direct-encryption`)return qn(r),n;let c=s===`direct-key-agreement`;switch(c?qn(r):Kn(r),e.subtle.name){case`ECDH`:{let{epk:r}=i;if(!Et(r)||[`d`,`k`,`p`,`q`,`dp`,`dq`,`qi`,`oth`,`priv`].some(e=>Object.hasOwn(r,e)))throw new U(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);Un(n);let a=await on(e,r),s=Wn(i,`apu`),l=Wn(i,`apv`);Gn(s,l);let u=await Hn(a,n,c?t.alg:o,c?t.cekBits:parseInt(o.slice(-5,-2),10),s,l);if(c)return u;n=u;break}case`RSA-OAEP`:return Gt(n),Rn(o,n,`decrypt`),new Uint8Array(await crypto.subtle.decrypt(`RSA-OAEP`,n,r));case`PBKDF2`:{if(typeof i.p2c!=`number`)throw new U(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);Jn(a);let e=a??1e4;if(i.p2c>e)throw new U(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);if(typeof i.p2s!=`string`)throw new U(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);n=await zn(At(i.p2s,`p2s`,U),o,i.p2c,n);break}case`AES-GCM`:{if(typeof i.iv!=`string`)throw new U(`JOSE Header "iv" (Initialization Vector) missing or invalid`);if(typeof i.tag!=`string`)throw new U(`JOSE Header "tag" (Authentication Tag) missing or invalid`);let e=At(i.iv,`iv`,U),t=At(i.tag,`tag`,U);if(e.byteLength!==12)throw new U(`Invalid Initialization Vector length`);if(t.byteLength!==16)throw new U(`Invalid Authentication Tag length`);return vn(Pn(o.slice(0,-2)),n,r,e,t,new Uint8Array)}}return Ln(o.slice(-6),n,r)}async function Xn(e,t,n,r,i,a={}){let{alg:o,mode:s}=e,c=Nn(e);if(i!==void 0&&!c)throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${o}`);let l=await Ht(s===`direct-encryption`?t:e,n,`encrypt`);if(s===`direct-encryption`)return[l,void 0,void 0];let u=c?i??cn(t):void 0;u&&ln(u,t.cekBits);let d,f;switch(e.subtle.name){case`ECDH`:{Un(l);let{apu:n,apv:i}=a;n!==void 0&&Tt(n,`"apu"`),i!==void 0&&Tt(i,`"apv"`);let c=n??Wn(r,`apu`),u=i??Wn(r,`apv`);Gn(c,u);let d;d=a.epk===void 0?(await crypto.subtle.generateKey(l.algorithm,!0,[`deriveBits`])).privateKey:await Ht(e,a.epk,`decrypt`);let p=crypto.subtle,m=d;if(!m.extractable){if(typeof p.getPublicKey!=`function`)throw TypeError(`CryptoKey for "epk" must be extractable`);m=await p.getPublicKey(d,[])}let{x:h,y:g,crv:_,kty:v}=await p.exportKey(`jwk`,m),y=s===`direct-key-agreement`,b=await Hn(l,d,y?t.alg:o,y?t.cekBits:parseInt(o.slice(-5,-2),10),c,u),x={x:h,crv:_,kty:v};if(v===`EC`&&(x.y=g),f={epk:x},n!==void 0&&(f.apu=G(n)),i!==void 0&&(f.apv=G(i)),y)return[b,void 0,f];l=b;break}case`RSA-OAEP`:Gt(l),Rn(o,l,`encrypt`),d=new Uint8Array(await crypto.subtle.encrypt(`RSA-OAEP`,l,u));break;case`PBKDF2`:{let{p2c:e=2048,p2s:t=crypto.getRandomValues(new Uint8Array(16))}=a;l=await zn(t,o,e,l),f={p2c:e,p2s:G(t)};break}case`AES-GCM`:{let e=a.iv===void 0?crypto.getRandomValues(new Uint8Array(12)):a.iv;if(!(e instanceof Uint8Array))throw TypeError(`"iv" must be an instance of Uint8Array`);let t=await _n(Pn(o.slice(0,-2)),u,l,e,new Uint8Array);d=t.ciphertext,f={iv:G(t.iv),tag:G(t.tag)}}}if(d??=await In(o.slice(-6),l,u),!(d instanceof Uint8Array)||!d.byteLength)throw TypeError(`JWE key management algorithm did not produce an Encrypted Key`);return[u,d,f]}function Zn(e,t){if(e.zip!==void 0&&e.zip!==`DEF`)throw new H(`Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.`);if(e.zip!==void 0&&!t?.zip)throw new U(`JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.`)}function Qn(e){if(typeof globalThis[e]>`u`)throw new H(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${e} API.`)}async function $n(e,t,n=1/0){let r=e.writable.getWriter();r.write(t).catch(()=>{}),r.close().catch(()=>{});let i=[],a=0,o=e.readable.getReader();for(;;){let{value:e,done:t}=await o.read();if(t)break;if(i.push(e),a+=e.byteLength,n!==1/0&&a>n)throw new U(`Decompressed plaintext exceeded the configured limit`)}return rt(...i)}async function er(e){return Qn(`CompressionStream`),$n(new CompressionStream(`deflate-raw`),e)}async function tr(e,t){return Qn(`DecompressionStream`),$n(new DecompressionStream(`deflate-raw`),e,t)}function nr(e){let{protected:t,ciphertext:n,iv:r,tag:i,aad:a}=e,o;return t!==void 0&&(o=Mt(t,U,`JWE Protected Header is invalid`)),[o,At(n,`ciphertext`,U),r===void 0?void 0:At(r,`iv`,U),i===void 0?void 0:At(i,`tag`,U),jt((t??``)+(a===void 0?``:`.${a}`),`aad`,U)]}function rr(e){return[e&&Ft(`keyManagementAlgorithms`,e.keyManagementAlgorithms),e&&Ft(`contentEncryptionAlgorithms`,e.contentEncryptionAlgorithms),e?.crit,e?.maxPBES2Count,e?.maxDecompressedLength]}async function ir(e,t,n,r=nr(e)){let[i,a,o,s,c]=r,{header:l,unprotected:u,aad:d}=e,f;if(l!==void 0||u!==void 0){if(!Ot(i,l,u))throw new U(`JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint`);f={...i,...l,...u}}else f=i??{};let[p,m,h,g,_]=t,{encrypted_key:v}=e;Lt(U,Pt,h,i,f),Zn(f,i);let{alg:y,enc:b}=f;if(typeof y!=`string`||!y)throw new U(`missing JWE Algorithm (alg) in JWE Header`);let x=Dn[y];if(v===``&&(!x||!Nn(x)))throw new U(`JWE Encrypted Key incorrect type`);let S=x?.mode===`integrated-encryption`;if(!S&&(typeof b!=`string`||!b))throw new U(`missing JWE Encryption Algorithm (enc) in JWE Header`);if(p&&!p.has(y)||!p&&y.startsWith(`PBES2`))throw new mt(`"alg" (Algorithm) Header Parameter value not allowed`);let C;if(S){if(b!==void 0)throw new U(`JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption`);if(o?.byteLength)throw new U(`JWE Initialization Vector must be empty for integrated encryption`);if(s?.byteLength)throw new U(`JWE Authentication Tag must be empty for integrated encryption`)}else{if(m&&!m.has(b))throw new mt(`"enc" (Encryption Algorithm) Header Parameter value not allowed`);C=Pn(b)}let w;if(v!==void 0)try{w=At(v,`encrypted_key`,U)}catch(e){if(!x||!Nn(x))throw e;w=new Uint8Array}let T=!1;typeof n==`function`&&(n=await n(i,e),T=!0);let E=x??Mn(y);Nn(E)&&w===void 0&&(w=new Uint8Array);let D=await Ht(E.mode===`direct-encryption`?C:E,n,`decrypt`),O;if(E.mode===`integrated-encryption`)O=await E.decrypt(D,w,a,c,i,f);else{let e=C,t;try{t=await Yn(E,e,D,w,f,g),Nn(E)&&t instanceof Uint8Array&&t.byteLength<<3!==e.cekBits&&(t=cn(e))}catch(n){if(n instanceof TypeError||n instanceof U||n instanceof H)throw n;t=cn(e)}O=await vn(e,t,a,o,s,c)}if(f.zip===`DEF`){let e=_??25e4;if(e===0)throw new H(`JWE "zip" (Compression Algorithm) Header Parameter is not supported.`);if(e!==1/0&&(!Number.isSafeInteger(e)||e<1))throw TypeError(`maxDecompressedLength must be 0, a positive safe integer, or Infinity`);O=await tr(O,e).catch(e=>{throw e instanceof U?e:new U(`Failed to decompress plaintext`,{cause:e})})}return{plaintext:O,...i&&{protectedHeader:i},...d!==void 0&&{additionalAuthenticatedData:At(d,`aad`,U)},...u&&{sharedUnprotectedHeader:u},...l&&{unprotectedHeader:l},...T&&{key:D}}}async function ar(e,t,n){if(e instanceof Uint8Array&&(e=et.decode(e)),typeof e!=`string`)throw new U(`Compact JWE must be a string or Uint8Array`);let{0:r,1:i,2:a,3:o,4:s,length:c}=e.split(`.`);if(c!==5)throw new U(`Invalid Compact JWE`);return ir({ciphertext:o,iv:a||void 0,protected:r,tag:s||void 0,encrypted_key:i||void 0},t,n)}function or(e,t,n){if(!Ot(e,t,n))throw new U(`JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint`)}function sr(e,t,n=!1){if(!e[1]&&!e[2]&&!e[3])throw new U(`either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()`);t!==void 0&&(e[8]=t?.crit);let[,r,i,a,o,s,c,l,u]=e;if(o!==void 0&&Tt(o,`JWE Additional Authenticated Data`),s!==void 0&&Tt(s,`JWE Content Encryption Key`),c!==void 0&&Tt(c,`JWE Initialization Vector`),!n&&r!==void 0&&(r=zt(U,r)[0],e[1]=r),i!==void 0&&(i=zt(U,i)[0],e[2]=i),!n&&a!==void 0&&(a=zt(U,a)[0],e[3]=a),l!==void 0&&!Et(l))throw TypeError(`JWE Key Management Parameters must be an object`);or(r,i,a);let d={...r,...i,...a};It(U,r),Lt(U,Pt,u,r,d),Zn(d,r);let{alg:f,enc:p}=d;if(typeof f!=`string`||!f)throw new U(`JWE "alg" (Algorithm) Header Parameter missing or invalid`);let m=Dn[f];if(m?.mode===`integrated-encryption`){if(p!==void 0)throw new U(`JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption`);if(s!==void 0)throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${f}`);if(c!==void 0)throw TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${f}`);return[d,void 0,m]}if(typeof p!=`string`||!p)throw new U(`JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid`);return[d,Pn(p),m]}async function cr(e,t,n){let[r,i,a]=t,[o,s,c,l,u,d,f,p,,m]=e,h=s,g=c,_=a??Mn(r.alg),v,y,b;_.mode===`integrated-encryption`?b=await Ht(_,n,`encrypt`):[b,v,y]=await Xn(_,i,n,r,d,p),y&&(m?g=g?{...g,...y}:y:h=h?{...h,...y}:y,or(h,g,l));let x=h?G(JSON.stringify(h)):``,S=u?.byteLength?G(u):void 0,C=ct(S?`${x}.${S}`:x),w=o;r.zip===`DEF`&&(w=await er(w).catch(e=>{throw new U(`Failed to compress plaintext`,{cause:e})}));let T,E,D;_.mode===`integrated-encryption`?[v,T]=await _.encrypt(b,w,C,h,r,p):{ciphertext:T,tag:E,iv:D}=await _n(i,w,b,f,C);let O={ciphertext:G(T)};return D&&(O.iv=G(D)),E&&(O.tag=G(E)),v?.byteLength&&(O.encrypted_key=G(v)),S&&(O.aad=S),h&&(O.protected=x),l&&(O.unprotected=l),g&&(O.header=g),O}async function lr(e,t,n){return cr(e,sr(e,n),t)}function ur(e){return[e.protected,e.encrypted_key,e.iv,e.ciphertext,e.tag].join(`.`)}var dr=[[`verify`],[`sign`]];function fr(e){let t={name:`HMAC`,hash:`SHA-${e}`};return{kty:[`oct`],secret:!0,subtle:t,signing:t,usages:dr}}function pr(e,t){let n={name:t?`RSA-PSS`:`RSASSA-PKCS1-v1_5`,hash:`SHA-${e}`};return{kty:[`RSA`],subtle:n,signing:t?{...n,saltLength:t}:n,usages:dr,minRsaBits:2048}}function mr(e,t){return{kty:[`EC`],crv:e,subtle:{name:`ECDSA`,namedCurve:e},signing:{name:`ECDSA`,hash:`SHA-${t}`},usages:dr}}function hr(){let e={name:`Ed25519`};return{kty:[`OKP`],crv:`Ed25519`,subtle:e,signing:e,usages:dr}}function gr(e){let t={name:`ML-DSA-${e}`};return{kty:[`AKP`],subtle:t,signing:t,usages:dr}}var _r=yn({HS256:fr(256),HS384:fr(384),HS512:fr(512),RS256:pr(256),RS384:pr(384),RS512:pr(512),PS256:pr(256,32),PS384:pr(384,48),PS512:pr(512,64),ES256:mr(`P-256`,256),ES384:mr(`P-384`,384),ES512:mr(`P-521`,512),EdDSA:hr(),Ed25519:hr(),"ML-DSA-44":gr(44),"ML-DSA-65":gr(65),"ML-DSA-87":gr(87)});function vr(e){let t=typeof e==`string`?_r[e]:void 0;if(!t)throw new H(`alg ${e} is not supported either by JOSE or your javascript runtime`);return t}function yr(e){return[e&&Ft(`algorithms`,e.algorithms),e?.crit]}function br(e){return e===void 0?{}:Mt(e,W,`JWS Protected Header is invalid`)}function xr(e){try{return ct(e)}catch{throw new W(`JWS Compact Serialization payload must use only ASCII characters`)}}async function Sr(e,t,n,r,i){let{protected:a,header:o,payload:s}=e,c=i??br(a);if(!Ot(c,o))throw new W(`JWS Protected and JWS Unprotected Header Parameter names must be disjoint`);let l={...c,...o},u=Rt(c,Lt(W,Nt,t[1],c,l)),{alg:d}=l;if(typeof d!=`string`||!d)throw new W(`JWS "alg" (Algorithm) Header Parameter missing or invalid`);if(t[0]&&!t[0].has(d))throw new mt(`"alg" (Algorithm) Header Parameter value not allowed`);if(u){if(typeof s!=`string`)throw new W(`JWS Payload must be a string`)}else if(typeof s!=`string`&&!(s instanceof Uint8Array))throw new W(`JWS Payload must be a string or an Uint8Array instance`);let f=u||typeof s!=`string`?s:r(s),p=!1;typeof n==`function`&&(n=await n(c,e),p=!0);let m=vr(d),h=rt(a===void 0?new Uint8Array:ct(a),ct(`.`),typeof f==`string`?t[2]??=jt(f,`payload`,W):f),g=At(e.signature,`signature`,W),_=await Ht(m,n,`verify`),v=await sn(_,m.subtle,`verify`);m.minRsaBits&&en(m.alg,v);let y=!1;try{y=await crypto.subtle.verify(m.signing,v,g,h)}catch{}if(!y)throw new St;let b={payload:typeof f==`string`?At(f,`payload`,W):f};return a!==void 0&&(b.protectedHeader=c),o!==void 0&&(b.unprotectedHeader=o),p?[{...b,key:_},u]:[b,u]}async function Cr(e,t,n){if(e instanceof Uint8Array&&(e=et.decode(e)),typeof e!=`string`)throw new W(`Compact JWS must be a string or Uint8Array`);let{0:r,1:i,2:a,length:o}=e.split(`.`);if(o!==3)throw new W(`Invalid Compact JWS`);return Sr({payload:i,protected:r,signature:a},t,n,xr)}async function wr(e,t,n){let[r]=await Cr(e,yr(n),t);return r}var Tr=e=>Math.floor(e.getTime()/1e3),Er={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},Dr=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,Or=`check_failed`;function kr(){throw TypeError(`Invalid time period format`)}function Ar(e){typeof e!=`string`&&kr();let t=Dr.exec(e);(!t||t[4]&&t[1])&&kr();let n=parseFloat(t[2]),r=Math.round(n*Er[t[3][0].toLowerCase()]);return Number.isFinite(r)||kr(),t[1]===`-`||t[4]===`ago`?-r:r}function jr(e,t){if(!Number.isFinite(t))throw TypeError(`Invalid ${e} input`);return t}function Mr(e,t){if(typeof t!=`string`)throw TypeError(`"${e}" claim must be a string`)}function Nr(e){if(typeof e!=`string`&&(!Array.isArray(e)||Array.from(e).some(e=>typeof e!=`string`)))throw TypeError(`"aud" claim must be a string or an array of strings`)}function Pr(e,t){return typeof e==`number`?jr(t,e):e instanceof Date?jr(t,Tr(e)):Tr(new Date)+Ar(e)}var Fr=e=>{let t=e.toLowerCase();return e.includes(`/`)?t:`application/${t}`},Ir=(e,t)=>typeof e==`string`?t.includes(e):Array.isArray(e)?t.some(t=>e.includes(t)):!1;function Lr(e,t,n=!1){let r=e[t];if(r!==void 0||n){if(typeof r!=`number`)throw new ft(`"${t}" claim must be a number`,e,t,`invalid`);return r}}function Rr(e,t){throw new ft(`unexpected "${t}" claim value`,e,t,Or)}function zr(e,t,n={}){let r;try{r=JSON.parse(tt.decode(t))}catch{}if(!Et(r))throw new gt(`JWT Claims Set must be a top-level JSON object`);let{typ:i}=n;if(i!==void 0&&(typeof e.typ!=`string`||Fr(e.typ)!==Fr(i)))throw new ft(`unexpected "typ" JWT header value`,r,`typ`,Or);let{requiredClaims:a=[],issuer:o,subject:s,audience:c,maxTokenAge:l}=n,u=[...a];l!==void 0&&u.push(`iat`),c!==void 0&&u.push(`aud`),s!==void 0&&u.push(`sub`),o!==void 0&&u.push(`iss`);for(let e of new Set(u.reverse()))if(!Object.hasOwn(r,e))throw new ft(`missing required "${e}" claim`,r,e,`missing`);o!==void 0&&!(Array.isArray(o)?o:[o]).includes(r.iss)&&Rr(r,`iss`),s!==void 0&&r.sub!==s&&Rr(r,`sub`),c!==void 0&&!Ir(r.aud,typeof c==`string`?[c]:c)&&Rr(r,`aud`);let{clockTolerance:d}=n,f=0;if(typeof d==`string`)f=Ar(d);else if(d!==void 0){if(typeof d!=`number`)throw TypeError(`Invalid clockTolerance option type`);f=d}jr(`clockTolerance option`,f);let{currentDate:p}=n,m=jr(`currentDate option`,Tr(p===void 0?new Date:p)),h=Lr(r,`iat`,l!==void 0),g=Lr(r,`nbf`);if(g!==void 0&&g>m+f)throw new ft(`"nbf" claim timestamp check failed`,r,`nbf`,Or);let _=Lr(r,`exp`);if(_!==void 0&&_<=m-f)throw new pt(`"exp" claim timestamp check failed`,r,`exp`,Or);if(l!==void 0){let e=m-h,t=jr(`maxTokenAge option`,typeof l==`number`?l:Ar(l));if(e-f>t)throw new pt(`"iat" claim timestamp check failed (too far in the past)`,r,`iat`,Or);if(e<-f)throw new ft(`"iat" claim timestamp check failed (it should be in the past)`,r,`iat`,Or)}return r}var Br;function Vr(e){return Br.get(e)}function Hr(e){let t=Vr(e);for(let e of[`iat`,`nbf`,`exp`]){let n=t[e];if(typeof n==`number`&&!Number.isFinite(n))throw TypeError(`"${e}" claim must be a finite number`)}return $e.encode(JSON.stringify(t))}function Ur(e,t){return Vr(e)[t]}var Wr=class{constructor(e={}){if(!Et(e))throw TypeError(`JWT Claims Set MUST be an object`);(Br||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return Mr(`iss`,e),Vr(this).iss=e,this}setSubject(e){return Mr(`sub`,e),Vr(this).sub=e,this}setAudience(e){return Nr(e),Vr(this).aud=e,this}setJti(e){return Mr(`jti`,e),Vr(this).jti=e,this}setNotBefore(e){return Vr(this).nbf=Pr(e,`setNotBefore`),this}setExpirationTime(e){return Vr(this).exp=Pr(e,`setExpirationTime`),this}setIssuedAt(e){let t=Vr(this);return t.iat=e===void 0?Tr(new Date):typeof e==`string`?jr(`setIssuedAt`,Tr(new Date)+Ar(e)):Pr(e,`setIssuedAt`),this}};async function Gr(e,t,n){let[r,i]=await Cr(e,yr(n),t);if(!i)throw new gt(`JWTs MUST NOT use unencoded payload`);let a=zr(r.protectedHeader,r.payload,n);return{...r,payload:a}}async function Kr(e,t,n){let{plaintext:r,...i}=await ar(e,rr(n),t),{protectedHeader:a}=i,o=zr(a,r,n);for(let e of[`iss`,`sub`,`aud`])if(a[e]!==void 0&&(e===`aud`?JSON.stringify(a.aud)!==JSON.stringify(o.aud):a[e]!==o[e]))throw new ft(`replicated "${e}" claim header parameter mismatch`,o,e,`mismatch`);return{payload:o,...i}}async function qr(e,t,n){let[r,i,a,o]=e,s=``;if(i!==void 0){let e=zt(W,i);i=e[0],s=G(e[1])}if(a!==void 0&&(a=zt(W,a)[0]),!i&&!a)throw new W(`either setProtectedHeader or setUnprotectedHeader must be called before #sign()`);if(!Ot(i,a))throw new W(`JWS Protected and JWS Unprotected Header Parameter names must be disjoint`);let c={...i,...a};It(W,i);let l=Rt(i,Lt(W,Nt,o,i,c));l||n?.();let{alg:u}=c;if(typeof u!=`string`||!u)throw new W(`JWS "alg" (Algorithm) Header Parameter missing or invalid`);let d=vr(u),f=``,p=r,m;if(l){let t=e[4];t?(f=t[0]??=G(r),p=t[1]??=ct(f)):(f=G(r),m=$e.encode(`${s}.${f}`))}m??=rt(ct(s),ct(`.`),p);let h=await sn(await Ht(d,t,`sign`),d.subtle,`sign`);d.minRsaBits&&en(d.alg,h);let g={signature:G(new Uint8Array(await crypto.subtle.sign(d.signing,h,m))),payload:f};return i&&(g.protected=s),a&&(g.header=a),[g,l]}async function Jr(e,t,n,r,i){let[a]=await qr([e,t,void 0,n],r,i);return`${a.protected}.${a.payload}.${a.signature}`}var Yr=Wr,Xr=class extends Yr{#e;setProtectedHeader(e){return kt(this.#e,`setProtectedHeader`),this.#e=e,this}async sign(e,t){return Jr(Hr(this),this.#e,t?.crit,e,()=>{throw new gt(`JWTs MUST NOT use unencoded payload`)})}},Zr=Wr,Qr=class extends Zr{#e=[void 0];#t;#n;#r;setProtectedHeader(e){return kt(this.#e[1],`setProtectedHeader`),this.#e[1]=e,this}setKeyManagementParameters(e){return kt(this.#e[7],`setKeyManagementParameters`),this.#e[7]=e,this}setContentEncryptionKey(e){return kt(this.#e[5],`setContentEncryptionKey`),this.#e[5]=e,this}setInitializationVector(e){return kt(this.#e[6],`setInitializationVector`),this.#e[6]=e,this}replicateIssuerAsHeader(){return this.#t=!0,this}replicateSubjectAsHeader(){return this.#n=!0,this}replicateAudienceAsHeader(){return this.#r=!0,this}async encrypt(e,t){let n=Hr(this);this.#e[1]&&(this.#t||this.#n||this.#r)&&(this.#e[1]={...this.#e[1],iss:this.#t?Ur(this,`iss`):void 0,sub:this.#n?Ur(this,`sub`):void 0,aud:this.#r?Ur(this,`aud`):void 0});let r=[...this.#e];return r[0]=n,ur(await lr(r,e,t))}},$r=`"alg" (Algorithm)`;function ei(e=`JWK "alg" (Algorithm) Parameter`){throw new H(`Invalid or unsupported ${e} value`)}function ti(e,t){return(typeof e==`string`?_r[e]??Dn[e]:void 0)??ei(t)}var ni=(e,t)=>{if(e.byteLength!==t.length)return!1;for(let n=0;n<e.byteLength;n++)if(e[n]!==t[n])return!1;return!0},ri=e=>({data:e,pos:0}),ii=e=>{let t=e.data[e.pos++];if(t===void 0)throw Error(`Unexpected end of ASN.1 input`);return t},ai=e=>{let t=ii(e);if(t&128){let n=t&127,r=0;for(let t=0;t<n;t++)r=r<<8|ii(e);return r}return t},oi=(e,t,n)=>{if(ii(e)!==t)throw Error(n)},si=(e,t)=>{if(t<0||e.pos+t>e.data.length)throw Error(`Unexpected end of ASN.1 input`);let n=e.data.subarray(e.pos,e.pos+t);return e.pos+=t,n},ci=e=>(oi(e,6,`Expected algorithm OID`),si(e,ai(e)));function li(e,t){if(oi(e,48,`Invalid ${t===`spki`?`SPKI`:`PKCS#8`} structure`),ai(e),t===`pkcs8`){oi(e,2,`Expected version field`);let t=ai(e);e.pos+=t}oi(e,48,`Expected algorithm identifier`),ai(e)}var ui=e=>{let t=ci(e);if(ni(t,[43,101,110]))return`X25519`;if(!ni(t,[42,134,72,206,61,2,1]))throw Error(`Unsupported key algorithm`);oi(e,6,`Expected curve OID`);let n=si(e,ai(e));if(ni(n,[42,134,72,206,61,3,1,7]))return`P-256`;if(ni(n,[43,129,4,0,34]))return`P-384`;if(ni(n,[43,129,4,0,35]))return`P-521`;throw Error(`Unsupported named curve`)},di=async(e,t,n,r)=>{let i=an(r?.extractable),a=ti(n,$r);a.secret&&ei(`"alg" (Algorithm)`);let o=e===`spki`,s;if(a.resolve)try{let n=ri(t);li(n,e),s=a.resolve({crv:ui(n)})}catch{throw new H(`Invalid or unsupported key format`)}else s=a.subtle;return crypto.subtle.importKey(e,t,s,i??o,a.usages[+!o])},fi=(e,t)=>ut(e.replace(t,``)),pi=(e,t,n)=>di(`spki`,fi(e,/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g),t,n);async function mi(e){if(qt(e)){if(e.type===`secret`)e=e.export();else return e.export({format:`jwk`})}if(e instanceof Uint8Array)return{kty:`oct`,k:G(e)};if(!Kt(e))throw TypeError(Xt(e,`CryptoKey`,`KeyObject`,`Uint8Array`));if(!e.extractable)throw TypeError(`non-extractable CryptoKey cannot be exported as a JWK`);let t=await crypto.subtle.exportKey(`jwk`,e);delete t.ext,delete t.key_ops,delete t.use,t.kty!==`AKP`&&delete t.alg;for(let e of Object.keys(t))t[e]===void 0&&delete t[e];return t}var hi=(e,t)=>{if(typeof e!=`string`||!e)throw new _t(`${t} missing or invalid`)};async function gi(e,t){let n;if(Et(e)){if(n=nn(e),typeof n.kty!=`string`)throw TypeError(Xt(e,`CryptoKey`,`KeyObject`,`JSON Web Key`))}else if(Jt(e))n=nn(await mi(e));else throw TypeError(Xt(e,`CryptoKey`,`KeyObject`,`JSON Web Key`));if(t??=`sha256`,t!==`sha256`&&t!==`sha384`&&t!==`sha512`)throw TypeError(`digestAlgorithm must one of "sha256", "sha384", or "sha512"`);let r;switch(n.kty){case`AKP`:hi(n.alg,`"alg" (Algorithm) Parameter`),hi(n.pub,`"pub" (Public key) Parameter`),r={alg:n.alg,kty:n.kty,pub:n.pub};break;case`EC`:hi(n.crv,`"crv" (Curve) Parameter`),hi(n.x,`"x" (X Coordinate) Parameter`),hi(n.y,`"y" (Y Coordinate) Parameter`),r={crv:n.crv,kty:n.kty,x:n.x,y:n.y};break;case`OKP`:hi(n.crv,`"crv" (Subtype of Key Pair) Parameter`),hi(n.x,`"x" (Public Key) Parameter`),r={crv:n.crv,kty:n.kty,x:n.x};break;case`RSA`:hi(n.e,`"e" (Exponent) Parameter`),hi(n.n,`"n" (Modulus) Parameter`),r={e:n.e,kty:n.kty,n:n.n};break;case`oct`:if(typeof n.k!=`string`)throw new _t(`"k" (Key Value) Parameter missing or invalid`);r={k:n.k,kty:n.kty};break;default:throw new H(`"kty" (Key Type) Parameter missing or unsupported`)}let i=ct(JSON.stringify(r));return G(await dt(t,i))}function _i(e,t,n,r){let{kty:i,key_ops:a,ext:o,kid:s,alg:c,use:l,crv:u}=e;return(o===void 0||typeof o==`boolean`)&&(a===void 0||Array.isArray(a)&&a.every((e,t)=>typeof e==`string`&&a.indexOf(e)===t)&&a.includes(`verify`))&&t.kty.includes(i)&&(r===void 0||typeof r==`string`&&r===s)&&(c===void 0?i!==`AKP`:n===c)&&(l===void 0||l===`sig`)&&(!t.crv||u===t.crv)}async function vi(e,t,n){let r=e.get(t)||e.set(t,{}).get(t),{alg:i}=n;if(r[i]===void 0){let e=on(n,t,!0).then(e=>{if(e.type!==`public`)throw new vt(`JSON Web Key Set members must be public keys`);return r[i]=e,e}).catch(t=>{throw r[i]===e&&delete r[i],t});r[i]=e}return r[i]}function yi(e){let t;try{t=structuredClone(e)}catch{}if(!Dt(t))throw new vt(`JSON Web Key Set malformed`);let n=t.keys.map(e=>{let t=nn(e);return Array.isArray(t.key_ops)&&(t.key_ops=[...t.key_ops]),t}),r=new WeakMap;return Object.defineProperty(async(e,i)=>{let{alg:a,kid:o}={...e,...i?.header},s=typeof a==`string`?_r[a]:void 0;if(!s||s.secret)throw new H(`Unsupported "alg" value for a JSON Web Key Set`);let c=t.keys.filter((e,t)=>_i(n[t],s,a,o)),{0:l,length:u}=c;if(!u)throw new yt;if(u!==1){let e=new bt;throw e[Symbol.asyncIterator]=async function*(){for(let e of c)try{yield await vi(r,e,s)}catch{}},e}return vi(r,l,s)},"jwks",{value:()=>structuredClone(t)})}async function bi(e,t,n){if(typeof e!=`string`||e.indexOf(`-----BEGIN PUBLIC KEY-----`)!==0)throw TypeError(`"spki" must be SPKI formatted string`);return pi(e,t,n)}async function xi(e,t,n){if(!Et(e))throw TypeError(`JWK must be an object`);let r=rn(e),i=an(n?.extractable),{alg:a}=r;if(t??=a,r.kty!==`oct`&&!t)throw TypeError(`"alg" argument is required when "jwk.alg" is not present`);switch(r.kty){case`oct`:if(typeof r.k!=`string`)throw TypeError(`missing "k" (Key Value) Parameter value`);return wt(r.k);case`AKP`:if(typeof a!=`string`||!a)throw TypeError(`missing "alg" (Algorithm) Parameter value`);if(t!==a)throw TypeError(`JWK alg and alg option value mismatch`);return on(ti(t),r,i);case`RSA`:case`EC`:case`OKP`:return on(ti(t),r,i);default:throw new H(`Unsupported "kty" (Key Type) Parameter value`)}}function Si(e){let t;if(typeof e==`string`){let n=e.split(`.`);(n.length===3||n.length===5)&&([t]=n)}else if(typeof e==`object`&&e){if(`protected`in e)t=e.protected;else throw TypeError(`Token does not contain a Protected Header`)}let n=`Invalid Token or Protected Header formatting`;if(typeof t!=`string`||!t)throw TypeError(n);return Mt(t,TypeError,n)}function Ci(e){if(typeof e!=`string`)throw new gt(`JWTs must use Compact JWS serialization, JWT must be a string`);let{1:t,length:n}=e.split(`.`);if(n===5)throw new gt(`Only JWTs using Compact JWS serialization can be decoded`);if(n!==3)throw new gt(`Invalid JWT`);if(!t)throw new gt(`JWTs must contain a payload`);let r;try{r=wt(t)}catch{throw new gt(`Failed to base64url decode the payload`)}let i;try{i=JSON.parse(tt.decode(r))}catch{throw new gt(`Failed to parse the decoded payload as JSON`)}if(!Et(i))throw new gt(`Invalid JWT Claims Set`);return i}function wi(e){let t=e?.modulusLength??2048;if(typeof t!=`number`||!Number.isInteger(t)||t<2048)throw new H(`Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used`);return t}async function Ti(e,t){let n=an(t?.extractable),r=ti(e,$r);r.secret&&ei(`"alg" (Algorithm)`);let i;if(r.resolve){let e=t?.crv??`P-256`;if(![`P-256`,`P-384`,`P-521`,`X25519`].includes(e))throw new H(`Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519`);i=r.resolve({crv:e})}else{if(r.crv!==void 0&&t?.crv!==void 0&&t.crv!==r.crv)throw new H(`Invalid or unsupported crv option provided, the only supported value for ${e} is ${r.crv}`);i=r.kty[0]===`RSA`?{...r.subtle,publicExponent:Uint8Array.of(1,0,1),modulusLength:wi(t)}:r.subtle}return crypto.subtle.generateKey(i,n??!1,[...r.usages[1],...r.usages[0]])}async function Ei(e,t,n=3600){return await new Xr(e).setProtectedHeader({alg:`HS256`}).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+n).sign(new TextEncoder().encode(t))}async function Di(e,t){try{return(await Gr(e,new TextEncoder().encode(t))).payload}catch{return null}}var Oi=new Uint8Array([66,101,116,116,101,114,65,117,116,104,46,106,115,32,71,101,110,101,114,97,116,101,100,32,69,110,99,114,121,112,116,105,111,110,32,75,101,121]),ki=()=>Date.now()/1e3|0,Ai=`dir`,ji=`A256CBC-HS512`;function Mi(e,t){return Be(Qe,new TextEncoder().encode(e),new TextEncoder().encode(t),Oi,64)}function Ni(e){if(typeof e==`string`)return e;let t=e.keys.get(e.currentVersion);if(!t)throw Error(`Secret version ${e.currentVersion} not found in keys`);return t}function Pi(e){if(typeof e==`string`)return[{version:0,value:e}];let t=[];for(let[n,r]of e.keys)t.push({version:n,value:r});return e.legacySecret&&!t.some(t=>t.value===e.legacySecret)&&t.push({version:-1,value:e.legacySecret}),t}async function Fi(e,t,n,r=3600){let i=Mi(Ni(t),n),a=await gi({kty:`oct`,k:G(i)},`sha256`);return await new Qr(e).setProtectedHeader({alg:Ai,enc:ji,kid:a}).setIssuedAt().setExpirationTime(ki()+r).setJti(crypto.randomUUID()).encrypt(i)}var Ii={clockTolerance:15,keyManagementAlgorithms:[Ai],contentEncryptionAlgorithms:[ji,`A256GCM`]};async function Li(e,t,n){if(!e)return null;let r=!1;try{r=Si(e).kid!==void 0}catch{return null}try{let r=Pi(t),{payload:i}=await Kr(e,async e=>{let t=e.kid;if(t!==void 0){for(let e of r){let r=Mi(e.value,n);if(t===await gi({kty:`oct`,k:G(r)},`sha256`))return r}throw Error(`no matching decryption secret`)}return r.length,Mi(r[0].value,n)},Ii);return i}catch{if(r)return null;let i=Pi(t);if(i.length<=1)return null;for(let t=1;t<i.length;t++)try{let r=i[t],{payload:a}=await Kr(e,Mi(r.value,n),Ii);return a}catch{continue}return null}}function Ri(e,t){typeof e==`string`&&(e=new TextEncoder().encode(e)),typeof t==`string`&&(t=new TextEncoder().encode(t));let n=new Uint8Array(e),r=new Uint8Array(t),i=n.length^r.length,a=Math.max(n.length,r.length);for(let e=0;e<a;e++)i|=(e<n.length?n[e]:0)^(e<r.length?r[e]:0);return i===0}var zi=ae(`a-z`,`0-9`,`A-Z`,`-_`);function Bi(){let e=typeof globalThis<`u`&&globalThis.crypto;if(e&&typeof e.subtle==`object`&&e.subtle!=null)return e.subtle;throw Error(`crypto.subtle must be defined`)}function Vi(e,t){return{digest:async n=>{let r=re(n),i=await Bi().digest(e,r);return t===`hex`?Array.from(new Uint8Array(i)).map(e=>e.toString(16).padStart(2,`0`)).join(``):t===`base64`||t===`base64url`||t===`base64urlnopad`?t.includes(`url`)?N.encode(i,{padding:t!==`base64urlnopad`}):ie.encode(i):i}}}function Hi(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name===`Uint8Array`&&`BYTES_PER_ELEMENT`in e&&e.BYTES_PER_ELEMENT===1}var Ui=e=>e?`"${e}" `:``;function Wi(e,t=``){if(typeof e!=`boolean`)throw TypeError(Ui(t)+`expected boolean, got type=`+typeof e);return e}function Gi(e,t=``){if(typeof e!=`number`)throw TypeError(Ui(t)+`expected number, got `+typeof e);if(!Number.isSafeInteger(e)||e<0)throw RangeError(Ui(t)+`expected integer >= 0, got `+e);return e}function K(e,t,n=``){if(Hi(e)&&(t===void 0||e.length===t))return e;t!==void 0&&Gi(t,`length`);let r=Hi(e),i=t===void 0?``:` of length ${t}`,a=r?`length=${e.length}`:`type=${typeof e}`,o=Ui(n)+`expected Uint8Array`+i+`, got `+a;throw r?RangeError(o):TypeError(o)}var Ki=(e,t)=>{if(typeof e!=`object`||!e||Array.isArray(e))throw TypeError(t===`object`?`expected valid options object`:`"${t}" expected object, got type=${typeof e}`)};function qi(e,t=!0){if(e.destroyed)throw Error(`hash was destroyed`);if(t&&e.finished)throw Error(`digest() was already called`)}function Ji(e,t){K(e,void 0,`output`);let n=t.outputLen;if(!(e.length>=n))throw RangeError(`"output" expected length >= `+n)}function Yi(e){return new Uint32Array(e.buffer,e.byteOffset,Math.floor(e.byteLength/4))}function Xi(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function Zi(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}var Qi=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function $i(e){return e<<24&4278190080|e<<8&16711680|e>>>8&65280|e>>>24&255}function ea(e){for(let t=0;t<e.length;t++)e[t]=$i(e[t]);return e}var ta=Qi?e=>e:ea,na=typeof Uint8Array.from([]).toHex==`function`&&typeof Uint8Array.fromHex==`function`,ra=Array.from({length:256},(e,t)=>t.toString(16).padStart(2,`0`));function ia(e){if(K(e),na)return e.toHex();let t=``;for(let n=0;n<e.length;n++)t+=ra[e[n]];return t}function aa(e){return e>=48&&e<=57?e-48:e>=65&&e<=70?e-55:e>=97&&e<=102?e-87:void 0}function oa(e){if(typeof e!=`string`)throw TypeError(`hex string expected, got `+typeof e);if(na)try{return Uint8Array.fromHex(e)}catch(e){throw e instanceof SyntaxError?RangeError(e.message):e}let t=e.length,n=t/2;if(t%2)throw RangeError(`hex string expected, got unpadded hex of length `+t);let r=new Uint8Array(n);for(let t=0,i=0;t<n;t++,i+=2){let n=aa(e.charCodeAt(i)),a=aa(e.charCodeAt(i+1));if(n===void 0||a===void 0){let t=e[i]+e[i+1];throw RangeError(`hex string expected, got non-hex character "`+t+`" at index `+i)}r[t]=n*16+a}return r}function sa(e){if(typeof e!=`string`)throw TypeError(`string expected`);return new Uint8Array(new TextEncoder().encode(e))}function ca(e,t){return!e.byteLength||!t.byteLength?!1:e.buffer===t.buffer&&e.byteOffset<t.byteOffset+t.byteLength&&t.byteOffset<e.byteOffset+e.byteLength}function la(e,t){if(ca(e,t)&&e.byteOffset<t.byteOffset)throw Error(`complex overlap of input and output is not supported`)}function ua(...e){let t=0;for(let n=0;n<e.length;n++){let r=e[n];K(r),t+=r.length}let n=new Uint8Array(t);for(let t=0,r=0;t<e.length;t++){let i=e[t];n.set(i,r),r+=i.length}return n}function da(e,t){return Ki(e,`defaults`),Ki(t,`opts`),Object.assign(e,t)}function fa(e,t){if(e=K(e),t=K(t),e.length!==t.length)return!1;let n=0;for(let r=0;r<e.length;r++)n|=e[r]^t[r];return n===0}function pa(e,t,n){let r=t,i=n||(()=>[]),a=(e,t)=>r(t,...i(e)).update(e).digest(),o=r(new Uint8Array(e),...i(new Uint8Array));return a.outputLen=o.outputLen,a.blockLen=o.blockLen,a.create=(e,...t)=>r(e,...t),a}var ma=(e,t)=>{function n(n,...r){if(K(n,void 0,`key`),e.nonceLength!==void 0){let t=r[0];K(t,e.varSizeNonce?void 0:e.nonceLength,`nonce`)}let i=e.tagLength,a=e.nonceLength===void 0?0:1;if(!e.withAAD){for(let e=a;e<r.length;e++)if(Hi(r[e]))throw Error(`AAD not supported`)}e.withAAD&&r[a]!==void 0&&K(r[a],void 0,`AAD`);let o=t(n,...r),s=(e,t)=>{if(t!==void 0){if(e!==2)throw Error(`cipher output not supported`);K(t,void 0,`output`)}},c=!1;return{encrypt(e,t){if(c)throw Error(`cannot encrypt() twice with same key + nonce`);return c=!0,K(e,void 0,`data`),s(o.encrypt.length,t),o.encrypt(e,t)},decrypt(e,t){if(K(e,void 0,`data`),i&&e.length<i)throw Error(`"ciphertext" expected length >= tagLength=`+i);return s(o.decrypt.length,t),o.decrypt(e,t)}}}return Object.assign(n,e),n};function ha(e,t,n=!0){if(t===void 0)return new Uint8Array(e);if(K(t,e,`output`),n&&!_a(t))throw Error(`invalid output, must be aligned`);return t}function ga(e,t,n){Gi(e),Gi(t),Wi(n);let r=new Uint8Array(16),i=Zi(r);return i.setBigUint64(0,BigInt(t),n),i.setBigUint64(8,BigInt(e),n),r}function _a(e){return e.byteOffset%4==0}function va(e){return Uint8Array.from(K(e))}function ya(e=32){Gi(e,`bytesLength`);let t=typeof globalThis==`object`?globalThis.crypto:null;if(typeof t?.getRandomValues!=`function`)throw Error(`crypto.getRandomValues must be defined`);if(e>65536)throw RangeError(`"bytesLength" expected <= 65536, got ${e}`);return t.getRandomValues(new Uint8Array(e))}function ba(e,t=ya){if(typeof e!=`function`)throw TypeError(`"fn" expected cipher constructor, got type=`+typeof e);if(typeof t!=`function`)throw TypeError(`"randomBytes_" expected function, got type=`+typeof t);let{nonceLength:n}=e;Gi(n,`fn.nonceLength`);let r=(e,t,n)=>{let r=ua(e,t);return ca(n,t)||t.fill(0),r},i=((i,...a)=>({encrypt(o){K(o,void 0,`data`);let s=t(n),c=e(i,s,...a).encrypt(o);return c instanceof Promise?c.then(e=>r(s,e,o)):r(s,c,o)},decrypt(t){K(t,void 0,`data`);let r=t.subarray(0,n),o=t.subarray(n);return e(i,r,...a).decrypt(o)}}));return`blockSize`in e&&(i.blockSize=e.blockSize),`tagLength`in e&&(i.tagLength=e.tagLength),`withAAD`in e&&(i.withAAD=e.withAAD),i}var xa=e=>Uint8Array.from(e.split(``),e=>e.charCodeAt(0)),Sa=ta(Yi(xa(`expand 16-byte k`))),Ca=ta(Yi(xa(`expand 32-byte k`)));function q(e,t){return e<<t|e>>>32-t}var wa=64,Ta=16,Ea=2**32-1,Da=Uint32Array.of();function Oa(e,t,n,r,i,a,o,s){let c=i.length,l=new Uint8Array(wa),u=Yi(l),d=Qi&&_a(i)&&_a(a),f=d?Yi(i):Da,p=d?Yi(a):Da;if(Qi)for(let m=0;m<c;o++){if(e(t,n,r,u,o,s),o>=Ea)throw Error(`arx: counter overflow`);let h=Math.min(wa,c-m);if(d&&h===wa){let e=m/4;if(m%4!=0)throw Error(`arx: invalid block position`);for(let t=0,n;t<Ta;t++)n=e+t,p[n]=f[n]^u[t];m+=wa}else{for(let e=0,t;e<h;e++)t=m+e,a[t]=i[t]^l[e];m+=h}}else for(let d=0;d<c;o++){if(e(t,n,r,u,o,s),ta(u),o>=Ea)throw Error(`arx: counter overflow`);let f=Math.min(wa,c-d);for(let e=0,t;e<f;e++)t=d+e,a[t]=i[t]^l[e];d+=f}}function ka(e,t){let{allowShortKeys:n,extendNonceFn:r,counterLength:i,counterRight:a,rounds:o}=da({allowShortKeys:!1,counterLength:8,counterRight:!1,rounds:20},t);if(typeof e!=`function`)throw Error(`core must be a function`);return Gi(i),Gi(o),Wi(a),Wi(n),(t,s,c,l,u=0)=>{K(t,void 0,`key`),K(s,void 0,`nonce`),K(c,void 0,`data`);let d=c.length,f=l!==void 0;if(l=ha(d,l,!1),f&&la(c,l),Gi(u),u<0||u>=Ea)throw Error(`arx: counter overflow`);let p=[],m=t.length,h,g;if(m===32)p.push(h=va(t)),g=Ca;else if(m===16&&n)h=new Uint8Array(32),h.set(t),h.set(t,16),g=Sa,p.push(h);else throw K(t,32,`arx key`),Error(`invalid key size`);(!Qi||!_a(s))&&p.push(s=va(s));let _=Yi(h);if(r){if(s.length!==24)throw Error(`arx: extended nonce must be 24 bytes`);let e=s.subarray(0,16);if(Qi)r(g,_,Yi(e),_);else{let t=ta(Uint32Array.from(g));r(t,_,Yi(e),_),Xi(t),ta(_)}s=s.subarray(16)}else Qi||ta(_);let v=16-i;if(v!==s.length)throw Error(`arx: nonce must be ${v} or 16 bytes`);if(v!==12){let e=new Uint8Array(12);e.set(s,a?0:12-s.length),s=e,p.push(s)}let y=ta(Yi(s));try{return Oa(e,g,_,y,c,l,u,o),l}finally{Xi(...p)}}}function J(e,t){return e[t++]&255|(e[t++]&255)<<8}var Aa=class{blockLen=16;outputLen=16;buffer=new Uint8Array(16);r=new Uint16Array(10);h=new Uint16Array(10);pad=new Uint16Array(8);pos=0;finished=!1;destroyed=!1;constructor(e){e=va(K(e,32,`key`));let t=J(e,0),n=J(e,2),r=J(e,4),i=J(e,6),a=J(e,8),o=J(e,10),s=J(e,12),c=J(e,14);this.r[0]=t&8191,this.r[1]=(t>>>13|n<<3)&8191,this.r[2]=(n>>>10|r<<6)&7939,this.r[3]=(r>>>7|i<<9)&8191,this.r[4]=(i>>>4|a<<12)&255,this.r[5]=a>>>1&8190,this.r[6]=(a>>>14|o<<2)&8191,this.r[7]=(o>>>11|s<<5)&8065,this.r[8]=(s>>>8|c<<8)&8191,this.r[9]=c>>>5&127;for(let t=0;t<8;t++)this.pad[t]=J(e,16+2*t)}process(e,t,n=!1){let r=n?0:2048,{h:i,r:a}=this,o=a[0],s=a[1],c=a[2],l=a[3],u=a[4],d=a[5],f=a[6],p=a[7],m=a[8],h=a[9],g=J(e,t+0),_=J(e,t+2),v=J(e,t+4),y=J(e,t+6),b=J(e,t+8),x=J(e,t+10),S=J(e,t+12),C=J(e,t+14),w=i[0]+(g&8191),T=i[1]+((g>>>13|_<<3)&8191),E=i[2]+((_>>>10|v<<6)&8191),D=i[3]+((v>>>7|y<<9)&8191),O=i[4]+((y>>>4|b<<12)&8191),k=i[5]+(b>>>1&8191),A=i[6]+((b>>>14|x<<2)&8191),j=i[7]+((x>>>11|S<<5)&8191),M=i[8]+((S>>>8|C<<8)&8191),N=i[9]+(C>>>5|r),P=0,F=P+w*o+5*h*T+5*m*E+5*p*D+5*f*O;P=F>>>13,F&=8191,F+=5*d*k+5*u*A+5*l*j+5*c*M+5*s*N,P+=F>>>13,F&=8191;let I=P+w*s+T*o+5*h*E+5*m*D+5*p*O;P=I>>>13,I&=8191,I+=5*f*k+5*d*A+5*u*j+5*l*M+5*c*N,P+=I>>>13,I&=8191;let L=P+w*c+T*s+E*o+5*h*D+5*m*O;P=L>>>13,L&=8191,L+=5*p*k+5*f*A+5*d*j+5*u*M+5*l*N,P+=L>>>13,L&=8191;let R=P+w*l+T*c+E*s+D*o+5*h*O;P=R>>>13,R&=8191,R+=5*m*k+5*p*A+5*f*j+5*d*M+5*u*N,P+=R>>>13,R&=8191;let ee=P+w*u+T*l+E*c+D*s+O*o;P=ee>>>13,ee&=8191,ee+=5*h*k+5*m*A+5*p*j+5*f*M+5*d*N,P+=ee>>>13,ee&=8191;let te=P+w*d+T*u+E*l+D*c+O*s;P=te>>>13,te&=8191,te+=k*o+5*h*A+5*m*j+5*p*M+5*f*N,P+=te>>>13,te&=8191;let ne=P+w*f+T*d+E*u+D*l+O*c;P=ne>>>13,ne&=8191,ne+=k*s+A*o+5*h*j+5*m*M+5*p*N,P+=ne>>>13,ne&=8191;let re=P+w*p+T*f+E*d+D*u+O*l;P=re>>>13,re&=8191,re+=k*c+A*s+j*o+5*h*M+5*m*N,P+=re>>>13,re&=8191;let ie=P+w*m+T*p+E*f+D*d+O*u;P=ie>>>13,ie&=8191,ie+=k*l+A*c+j*s+M*o+5*h*N,P+=ie>>>13,ie&=8191;let ae=P+w*h+T*m+E*p+D*f+O*d;P=ae>>>13,ae&=8191,ae+=k*u+A*l+j*c+M*s+N*o,P+=ae>>>13,ae&=8191,P=(P<<2)+P|0,P=P+F|0,F=P&8191,P>>>=13,I+=P,i[0]=F,i[1]=I,i[2]=L,i[3]=R,i[4]=ee,i[5]=te,i[6]=ne,i[7]=re,i[8]=ie,i[9]=ae}finalize(){let{h:e,pad:t}=this,n=new Uint16Array(10),r=e[1]>>>13;e[1]&=8191;for(let t=2;t<10;t++)e[t]+=r,r=e[t]>>>13,e[t]&=8191;e[0]+=r*5,r=e[0]>>>13,e[0]&=8191,e[1]+=r,r=e[1]>>>13,e[1]&=8191,e[2]+=r,n[0]=e[0]+5,r=n[0]>>>13,n[0]&=8191;for(let t=1;t<10;t++)n[t]=e[t]+r,r=n[t]>>>13,n[t]&=8191;n[9]-=8192;let i=(r^1)-1;for(let e=0;e<10;e++)n[e]&=i;i=~i;for(let t=0;t<10;t++)e[t]=e[t]&i|n[t];e[0]=(e[0]|e[1]<<13)&65535,e[1]=(e[1]>>>3|e[2]<<10)&65535,e[2]=(e[2]>>>6|e[3]<<7)&65535,e[3]=(e[3]>>>9|e[4]<<4)&65535,e[4]=(e[4]>>>12|e[5]<<1|e[6]<<14)&65535,e[5]=(e[6]>>>2|e[7]<<11)&65535,e[6]=(e[7]>>>5|e[8]<<8)&65535,e[7]=(e[8]>>>8|e[9]<<5)&65535;let a=e[0]+t[0];e[0]=a&65535;for(let n=1;n<8;n++)a=(e[n]+t[n]|0)+(a>>>16)|0,e[n]=a&65535;Xi(n)}update(e){qi(this),K(e),e=va(e);let{buffer:t,blockLen:n}=this,r=e.length;for(let i=0;i<r;){let a=Math.min(n-this.pos,r-i);if(a===n)for(;n<=r-i;i+=n)this.process(e,i);else t.set(e.subarray(i,i+a),this.pos),this.pos+=a,i+=a,this.pos===n&&(this.process(t,0,!1),this.pos=0)}return this}destroy(){this.destroyed=!0,Xi(this.h,this.r,this.buffer,this.pad)}digestInto(e){qi(this),Ji(e,this),this.finished=!0;let{buffer:t,h:n}=this,{pos:r}=this;if(r){for(t[r++]=1;r<16;r++)t[r]=0;this.process(t,0,!0)}this.finalize();let i=0;for(let t=0;t<8;t++)e[i++]=n[t]>>>0,e[i++]=n[t]>>>8}digest(){let{buffer:e,outputLen:t}=this;this.digestInto(e);let n=e.slice(0,t);return this.destroy(),n}},ja=pa(32,e=>new Aa(e));function Ma(e,t,n,r,i,a=20){let o=e[0],s=e[1],c=e[2],l=e[3],u=t[0],d=t[1],f=t[2],p=t[3],m=t[4],h=t[5],g=t[6],_=t[7],v=i,y=n[0],b=n[1],x=n[2],S=o,C=s,w=c,T=l,E=u,D=d,O=f,k=p,A=m,j=h,M=g,N=_,P=v,F=y,I=b,L=x;for(let e=0;e<a;e+=2)S=S+E|0,P=q(P^S,16),A=A+P|0,E=q(E^A,12),S=S+E|0,P=q(P^S,8),A=A+P|0,E=q(E^A,7),C=C+D|0,F=q(F^C,16),j=j+F|0,D=q(D^j,12),C=C+D|0,F=q(F^C,8),j=j+F|0,D=q(D^j,7),w=w+O|0,I=q(I^w,16),M=M+I|0,O=q(O^M,12),w=w+O|0,I=q(I^w,8),M=M+I|0,O=q(O^M,7),T=T+k|0,L=q(L^T,16),N=N+L|0,k=q(k^N,12),T=T+k|0,L=q(L^T,8),N=N+L|0,k=q(k^N,7),S=S+D|0,L=q(L^S,16),M=M+L|0,D=q(D^M,12),S=S+D|0,L=q(L^S,8),M=M+L|0,D=q(D^M,7),C=C+O|0,P=q(P^C,16),N=N+P|0,O=q(O^N,12),C=C+O|0,P=q(P^C,8),N=N+P|0,O=q(O^N,7),w=w+k|0,F=q(F^w,16),A=A+F|0,k=q(k^A,12),w=w+k|0,F=q(F^w,8),A=A+F|0,k=q(k^A,7),T=T+E|0,I=q(I^T,16),j=j+I|0,E=q(E^j,12),T=T+E|0,I=q(I^T,8),j=j+I|0,E=q(E^j,7);let R=0;r[R++]=o+S|0,r[R++]=s+C|0,r[R++]=c+w|0,r[R++]=l+T|0,r[R++]=u+E|0,r[R++]=d+D|0,r[R++]=f+O|0,r[R++]=p+k|0,r[R++]=m+A|0,r[R++]=h+j|0,r[R++]=g+M|0,r[R++]=_+N|0,r[R++]=v+P|0,r[R++]=y+F|0,r[R++]=b+I|0,r[R++]=x+L|0}function Na(e,t,n,r){let i=Qi?e:ta(e.slice(0,4)),a=Qi?t:ta(t.slice(0,8)),o=Qi?n:ta(n.slice(0,4)),s=new Uint32Array(16);Ma(i,a,o.subarray(1),s,o[0]);let c=0;r[c++]=s[0]-i[0]|0,r[c++]=s[1]-i[1]|0,r[c++]=s[2]-i[2]|0,r[c++]=s[3]-i[3]|0,r[c++]=s[12]-o[0]|0,r[c++]=s[13]-o[1]|0,r[c++]=s[14]-o[2]|0,r[c++]=s[15]-o[3]|0,ta(r),Qi||Xi(i,a,o),Xi(s)}var Pa=ka(Ma,{counterRight:!1,counterLength:8,extendNonceFn:Na,allowShortKeys:!1}),Fa=new Uint8Array(16),Ia=(e,t)=>{e.update(t);let n=t.length%16;n&&e.update(Fa.subarray(n))},La=new Uint8Array(32);function Ra(e,t,n,r,i){i!==void 0&&K(i,void 0,`AAD`);let a=e(t,n,La),o=ga(r.length,i?i.length:0,!0),s=ja.create(a);i&&Ia(s,i),Ia(s,r),s.update(o);let c=s.digest();return Xi(a,o),c}var za=ma({blockSize:64,nonceLength:24,tagLength:16,withAAD:!0},(e=>(t,n,r)=>({encrypt(i,a){let o=i.length;a=ha(o+16,a,!1),a.set(i);let s=a.subarray(0,-16);e(t,n,s,s,1);let c=Ra(e,t,n,s,r);return a.set(c,o),Xi(c),a},decrypt(i,a){a=ha(i.length-16,a,!1);let o=i.subarray(0,-16),s=i.subarray(-16),c=Ra(e,t,n,o,r);if(!fa(s,c))throw Xi(c),Error(`invalid tag`);return a.set(i.subarray(0,-16)),e(t,n,a,a,1),Xi(c),a}}))(Pa)),Ba={name:`HMAC`,hash:`SHA-256`},Va=`$ba$`;function Ha(e){if(!e.startsWith(Va))return null;let t=e.indexOf(`$`,4);if(t===-1)return null;let n=parseInt(e.slice(4,t),10);return!Number.isInteger(n)||n<0?null:{version:n,ciphertext:e.slice(t+1)}}function Ua(e,t){return`${Va}${e}$${t}`}async function Wa(e,t){let n=await Vi(`SHA-256`).digest(e),r=sa(t);return ia(ba(za)(new Uint8Array(n)).encrypt(r))}async function Ga(e,t){let n=await Vi(`SHA-256`).digest(e),r=oa(t),i=ba(za)(new Uint8Array(n));return new TextDecoder().decode(i.decrypt(r))}var Ka=async({key:e,data:t})=>{if(typeof e==`string`)return Wa(e,t);let n=e.keys.get(e.currentVersion);if(!n)throw Error(`Secret version ${e.currentVersion} not found in keys`);let r=await Wa(n,t);return Ua(e.currentVersion,r)},qa=async({key:e,data:t})=>{if(typeof e==`string`)return Ga(e,t);let n=Ha(t);if(n){let t=e.keys.get(n.version);if(!t)throw Error(`Secret version ${n.version} not found in keys (key may have been retired)`);return Ga(t,n.ciphertext)}if(e.legacySecret)return Ga(e.legacySecret,t);throw Error(`Cannot decrypt legacy bare-hex payload: no legacy secret available. Set BETTER_AUTH_SECRET for backwards compatibility.`)},Ja=async e=>{let t=typeof e==`string`?new TextEncoder().encode(e):e;return await Bi().importKey(`raw`,t,Ba,!1,[`sign`,`verify`])},Ya=async(e,t)=>{let n=await Ja(t),r=await Bi().sign(Ba.name,n,new TextEncoder().encode(e));return btoa(String.fromCharCode(...new Uint8Array(r)))},Xa={name:`HMAC`,hash:`SHA-256`},Za=async e=>{let t=typeof e==`string`?new TextEncoder().encode(e):e;return await Bi().importKey(`raw`,t,Xa,!1,[`sign`,`verify`])},Qa=async(e,t,n)=>{try{let r=atob(e),i=new Uint8Array(r.length);for(let e=0,t=r.length;e<t;e++)i[e]=r.charCodeAt(e);return await Bi().verify(Xa,n,i,new TextEncoder().encode(t))}catch{return!1}},$a=async(e,t)=>{let n=await Za(t),r=await Bi().sign(Xa.name,n,new TextEncoder().encode(e));return btoa(String.fromCharCode(...new Uint8Array(r)))},eo=async(e,t)=>{let n=await $a(e,t);return e=`${e}.${n}`,e=encodeURIComponent(e),e},to=/^application\/([a-z0-9.+-]*\+)?json/i;async function no(e,t){let n=e.headers.get(`content-type`)||``,r=n.toLowerCase();if(e.body){if(t&&t.length>0&&!t.some(e=>{let t=r.split(`;`)[0].trim(),n=e.toLowerCase().trim();return t===n||t.includes(n)}))throw r?new L(415,{message:`Content-Type "${n}" is not allowed. Allowed types: ${t.join(`, `)}`,code:`UNSUPPORTED_MEDIA_TYPE`}):new L(415,{message:`Content-Type is required. Allowed types: ${t.join(`, `)}`,code:`UNSUPPORTED_MEDIA_TYPE`});if(to.test(r))try{return await e.json()}catch(e){throw e instanceof SyntaxError?new L(400,{message:`Invalid JSON in request body`,code:`BAD_REQUEST`}):e}if(r.includes(`application/x-www-form-urlencoded`)){let t=await e.formData(),n={};return t.forEach((e,t)=>{n[t]=e.toString()}),n}if(r.includes(`multipart/form-data`)){let t=await e.formData(),n={};return t.forEach((e,t)=>{n[t]=e}),n}return r.includes(`text/plain`)?await e.text():r.includes(`application/octet-stream`)?await e.arrayBuffer():r.includes(`application/pdf`)||r.includes(`image/`)||r.includes(`video/`)?await e.blob():r.includes(`application/stream`)||e.body instanceof ReadableStream?e.body:await e.text()}}function ro(e){return e instanceof L||e?.name===`APIError`}function io(e){try{return e.includes(`%`)?decodeURIComponent(e):e}catch{return e}}async function ao(e){try{return{data:await e,error:null}}catch(e){return{data:null,error:e}}}function oo(e){return e instanceof Request||Object.prototype.toString.call(e)===`[object Request]`}var so={secure:`__Secure-`,host:`__Host-`},co=(e,t)=>{if(!t)return e;if(t===`secure`||t===`host`)return so[t]+e};function lo(e){if(typeof e!=`string`)throw TypeError(`argument str must be a string`);let t=new Map,n=0;for(;n<e.length;){let r=e.indexOf(`=`,n);if(r===-1)break;let i=e.indexOf(`;`,n);if(i===-1)i=e.length;else if(i<r){n=e.lastIndexOf(`;`,r-1)+1;continue}let a=e.slice(n,r).trim();if(!t.has(a)){let n=e.slice(r+1,i).trim();n.codePointAt(0)===34&&(n=n.slice(1,-1)),t.set(a,io(n))}n=i+1}return t}function uo(e,t,n={}){let r=co(e,n.prefix)??e,i={...n},a=r.toLowerCase();return a.startsWith(`__host-`)?(i.secure=!0,i.path=`/`,i.domain=void 0):a.startsWith(`__secure-`)&&(i.secure=!0),(i.partitioned===!0||i.sameSite?.toLowerCase()===`none`)&&(i.secure=!0),{name:r,value:t,options:i}}function fo({name:e,value:t,options:n}){let r=`${e}=${t}`;if(typeof n.maxAge==`number`&&n.maxAge>=0){if(n.maxAge>3456e4)throw Error(`Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.`);r+=`; Max-Age=${Math.floor(n.maxAge)}`}if(n.domain&&(r+=`; Domain=${n.domain}`),n.path&&(r+=`; Path=${n.path}`),n.expires){if(n.expires.getTime()-Date.now()>3456e7)throw Error(`Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.`);r+=`; Expires=${n.expires.toUTCString()}`}return n.httpOnly&&(r+=`; HttpOnly`),n.secure&&(r+=`; Secure`),n.sameSite&&(r+=`; SameSite=${n.sameSite.charAt(0).toUpperCase()+n.sameSite.slice(1)}`),n.partitioned&&(r+=`; Partitioned`),r}var po=(e,t,n)=>(t=encodeURIComponent(t),fo(uo(e,t,n))),mo=async(e,t,n,r)=>(t=await eo(t,n),fo(uo(e,t,r)));async function ho(e,t={}){let n={body:t.body,query:t.query};if(e.body){let r=await e.body[`~standard`].validate(t.body);if(r.issues)return{data:null,error:go(r.issues,`body`)};n.body=r.value}if(e.query){let r=await e.query[`~standard`].validate(t.query);if(r.issues)return{data:null,error:go(r.issues,`query`)};n.query=r.value}return e.requireHeaders&&!t.headers?{data:null,error:{message:`Headers is required`,issues:[]}}:e.requireRequest&&!t.request?{data:null,error:{message:`Request is required`,issues:[]}}:{data:n,error:null}}function go(e,t){return{message:e.map(e=>`[${e.path?.length?`${t}.`+e.path.map(e=>typeof e==`object`?e.key:e).join(`.`):t}] ${e.message}`).join(`; `),issues:e}}var _o=async(e,{options:t,path:n})=>{let r=new Headers,i,{data:a,error:o}=await ho(t,e);if(o)throw new Se(o.message,o.issues);let s=e.headers===void 0?`request`in e&&oo(e.request)?e.request.headers:null:e.headers instanceof Headers?e.headers:new Headers(e.headers),c=s?.get(`cookie`),l=c?lo(c):void 0,u={...e,body:a.body,query:a.query,path:e.path||n||`virtual:`,context:`context`in e&&e.context?e.context:{},returned:void 0,headers:e?.headers,request:e?.request,params:`params`in e?e.params:void 0,method:e.method??(Array.isArray(t.method)?t.method[0]:t.method===`*`?`GET`:t.method),setHeader:(e,t)=>{r.set(e,t)},getHeader:e=>s?s.get(e):null,getCookie:(e,t)=>{let n=co(e,t);return n&&l?.get(n)||null},getSignedCookie:async(e,t,n)=>{let r=co(e,n);if(!r)return null;let i=l?.get(r);if(!i)return null;let a=i.lastIndexOf(`.`);if(a<1)return null;let o=i.substring(0,a),s=i.substring(a+1);return s.length!==44||!s.endsWith(`=`)?null:await Qa(s,o,await Za(t))?o:!1},setCookie:(e,t,n)=>{let i=po(e,t,n);return r.append(`set-cookie`,i),i},setSignedCookie:async(e,t,n,i)=>{let a=await mo(e,t,n,i);return r.append(`set-cookie`,a),a},redirect:e=>(r.set(`location`,e),new L(`FOUND`,void 0,r)),error:(e,t,n)=>new L(e,t,n),setStatus:e=>{i=e},json:(t,n)=>e.asResponse?{body:n?.body||t,routerResponse:n,_flag:`json`}:t,responseHeaders:r,get responseStatus(){return i}};for(let e of t.use||[]){let t=await e({...u,returnHeaders:!0,asResponse:!1});t.response&&Object.assign(u.context,t.response),t.headers&&t.headers.forEach((e,t)=>{u.responseHeaders.set(t,e)})}return u};function vo(e){if(e===void 0)return!1;let t=typeof e;return t===`string`||t===`number`||t===`boolean`||t===null?!0:t===`object`?Array.isArray(e)?!0:e.buffer?!1:e.constructor&&e.constructor.name===`Object`||typeof e.toJSON==`function`:!1}function yo(e){let t=new WeakMap,n=new WeakMap,r=0,i=(e,n)=>{let r=n;for(;r;){if(r===e)return!0;r=t.get(r)}return!1};return JSON.stringify(e,function(e,a){if(typeof a==`bigint`)return a.toString();if(typeof a==`object`&&a){if(i(a,this))return`[Circular ref-${n.get(a)}]`;t.set(a,this),n.has(a)||n.set(a,r++)}return a})}function bo(e){return!e||typeof e!=`object`?!1:`_flag`in e&&e._flag===`json`}var xo=new Set(`host.user-agent.referer.from.expect.authorization.proxy-authorization.cookie.origin.accept-charset.accept-encoding.accept-language.if-match.if-none-match.if-modified-since.if-unmodified-since.if-range.range.max-forwards.connection.keep-alive.transfer-encoding.te.upgrade.trailer.proxy-connection.content-length`.split(`.`));function So(e){for(let t of xo)e.delete(t)}function Co(e,t){if(t)for(let[n,r]of new Headers(t).entries())n.toLowerCase()===`set-cookie`?e.append(n,r):e.set(n,r)}function wo(e,t){if(e instanceof Response){if(t?.headers){let n=new Headers(t.headers);So(n),Co(e.headers,n)}return e}if(bo(e)){let n=e.body,r=e.routerResponse;if(r instanceof Response)return r;let i=new Headers;if(Co(i,r?.headers),Co(i,e.headers),t?.headers){let e=new Headers(t.headers);So(e),Co(i,e)}i.set(`Content-Type`,`application/json`);let a=e.status??t?.status??r?.status,o=t?.statusText??r?.statusText;return new Response(JSON.stringify(n),{...r,headers:i,...a===void 0?{}:{status:a},...o===void 0?{}:{statusText:o}})}if(ro(e))return wo(e.body,{status:t?.status??e.statusCode,statusText:e.status.toString(),headers:t?.headers||e.headers});let n=e,r=new Headers(t?.headers);return So(r),e?typeof e==`string`?(n=e,r.set(`Content-Type`,`text/plain`)):e instanceof ArrayBuffer||ArrayBuffer.isView(e)?(n=e,r.set(`Content-Type`,`application/octet-stream`)):e instanceof Blob?(n=e,r.set(`Content-Type`,e.type||`application/octet-stream`)):e instanceof FormData?n=e:e instanceof URLSearchParams?(n=e,r.set(`Content-Type`,`application/x-www-form-urlencoded`)):e instanceof ReadableStream?(n=e,r.set(`Content-Type`,`application/octet-stream`)):vo(e)&&(n=yo(e),r.set(`Content-Type`,`application/json`)):(e===null&&(n=JSON.stringify(null)),r.set(`content-type`,`application/json`)),new Response(n,{...t,headers:r})}function To(e,t,n){let r=typeof e==`string`?e:void 0,i=typeof t==`object`?t:e,a=typeof t==`function`?t:n;if((i.method===`GET`||i.method===`HEAD`)&&i.body)throw new te(`Body is not allowed with GET or HEAD methods`);if(r&&/\/{2,}/.test(r))throw new te(`Path cannot contain consecutive slashes`);let o=async(...e)=>{let t=e[0]||{},{data:n,error:o}=await ao(_o(t,{options:i,path:r}));if(o)throw o instanceof Se?(i.onValidationError&&await i.onValidationError({message:o.message,issues:o.issues}),new L(400,{message:o.message,code:`VALIDATION_ERROR`})):o;let s=await a(n).catch(async e=>{if(ro(e)){let n=i.onAPIError;if(n&&await n(e),t.asResponse)return e}throw e}),c=n.responseHeaders,l=n.responseStatus;return t.asResponse?wo(s,l===void 0?{headers:c}:{headers:c,status:l}):t.returnHeaders?t.returnStatus?{headers:c,response:s,status:l}:{headers:c,response:s}:t.returnStatus?{response:s,status:l}:s};return o.options=i,o.path=r,o}function Eo(e,t){return[...e??[],...t??[]]}To.create=e=>{function t(...t){if(t.length===3){let[n,r,i]=t;return To(n,{...r,use:Eo(r.use,e?.use)},i)}let[n,r]=t;return To({...n,use:Eo(n.use,e?.use)},r)}return t};function Do(e,t){let n=async n=>{let r=n,i=typeof e==`function`?e:t,a=await _o(r,{options:typeof e==`function`?{}:e,path:`/`});if(!i)throw Error(`handler must be defined`);try{let e=await i(a),t=a.responseHeaders;return r.returnHeaders?{headers:t,response:e}:e}catch(e){throw ro(e)&&Object.defineProperty(e,O,{enumerable:!1,configurable:!0,get(){return a.responseHeaders}}),e}};return n.options=typeof e==`function`?{}:e,n}Do.create=e=>{function t(t,n){if(typeof t==`function`)return Do({use:e?.use},t);if(!n)throw Error(`Middleware handler is required`);return Do({...t,method:`*`,use:[...e?.use||[],...t.use||[]]},n)}return t};var Oo={};function ko(e){switch(e.constructor.name){case`ZodString`:return`string`;case`ZodNumber`:return`number`;case`ZodBoolean`:return`boolean`;case`ZodObject`:return`object`;case`ZodArray`:return`array`;default:return`string`}}function Ao(e){let t=[];return e.metadata?.openapi?.parameters?(t.push(...e.metadata.openapi.parameters),t):(e.query instanceof y&&Object.entries(e.query.shape).forEach(([e,n])=>{n instanceof y&&t.push({name:e,in:`query`,schema:{type:ko(n),...`minLength`in n&&n.minLength?{minLength:n.minLength}:{},description:n.description}})}),t)}function jo(e){if(e.metadata?.openapi?.requestBody)return e.metadata.openapi.requestBody;if(e.body&&(e.body instanceof y||e.body instanceof b)){let t=e.body.shape;if(!t)return;let n={},r=[];return Object.entries(t).forEach(([e,t])=>{t instanceof y&&(n[e]={type:ko(t),description:t.description},t instanceof b||r.push(e))}),{required:e.body instanceof b?!1:!!e.body,content:{"application/json":{schema:{type:`object`,properties:n,required:r}}}}}}function Mo(e){return{400:{content:{"application/json":{schema:{type:`object`,properties:{message:{type:`string`}},required:[`message`]}}},description:`Bad Request. Usually due to missing parameters, or invalid parameters.`},401:{content:{"application/json":{schema:{type:`object`,properties:{message:{type:`string`}},required:[`message`]}}},description:`Unauthorized. Due to missing or invalid authentication.`},403:{content:{"application/json":{schema:{type:`object`,properties:{message:{type:`string`}}}}},description:`Forbidden. You do not have permission to access this resource or to perform this action.`},404:{content:{"application/json":{schema:{type:`object`,properties:{message:{type:`string`}}}}},description:`Not Found. The requested resource was not found.`},429:{content:{"application/json":{schema:{type:`object`,properties:{message:{type:`string`}}}}},description:`Too Many Requests. You have exceeded the rate limit. Try again later.`},500:{content:{"application/json":{schema:{type:`object`,properties:{message:{type:`string`}}}}},description:`Internal Server Error. This is a problem with the server that you cannot fix.`},...e}}async function No(e,t){return Object.entries(e).forEach(([e,t])=>{let n=t.options;if(t.path&&!n.metadata?.SERVER_ONLY&&(n.method===`GET`&&(Oo[t.path]={get:{tags:[`Default`,...n.metadata?.openapi?.tags||[]],description:n.metadata?.openapi?.description,operationId:n.metadata?.openapi?.operationId,security:[{bearerAuth:[]}],parameters:Ao(n),responses:Mo(n.metadata?.openapi?.responses)}}),n.method===`POST`)){let e=jo(n);Oo[t.path]={post:{tags:[`Default`,...n.metadata?.openapi?.tags||[]],description:n.metadata?.openapi?.description,operationId:n.metadata?.openapi?.operationId,security:[{bearerAuth:[]}],parameters:Ao(n),...e?{requestBody:e}:{requestBody:{content:{"application/json":{schema:{type:`object`,properties:{}}}}}},responses:Mo(n.metadata?.openapi?.responses)}}}}),{openapi:`3.1.1`,info:{title:`Better Auth`,description:`API Reference for your Better Auth Instance`,version:`1.1.0`},components:{schemas:{}},security:[{apiKeyCookie:[]}],servers:[{url:t?.url}],tags:[{name:`Default`,description:`Default endpoints that are included with Better Auth by default. These endpoints are not part of any plugin.`}],paths:Oo}}var Po=(e,t)=>`<!doctype html>
+import{k as e}from"./react-dom-pSpaua7D.js";import{Zt as t}from"./core-Ci_AVqAl.js";import{$t as n,B as r,C as i,D as a,O as o,S as s,T as c,_ as l,a as u,b as d,f,g as p,h as m,i as h,in as g,k as _,l as v,n as y,r as b,s as x,t as S,v as C,x as w,y as T,z as E}from"./schemas-CFw4XgfH.js";import{$ as D,B as O,D as k,E as A,F as j,G as M,H as N,I as P,J as F,K as I,L,P as R,Q as ee,R as te,T as ne,U as re,V as ie,W as ae,Y as oe,Z as se,a as ce,b as z,d as le,et as ue,f as de,h as fe,j as pe,l as me,m as he,o as ge,p as _e,q as ve,t as ye,tt as be,w as xe,x as B,z as Se}from"./get-id-field-DS9IzViQ.js";import{a as Ce}from"./schema-check-DB26iPrr.js";function we(e){return r(h,e)}function Te(e){return E(S,e)}var Ee=Object.defineProperty,De=(e,t)=>{let n={};for(var r in e)Ee(n,r,{get:e[r],enumerable:!0});return t||Ee(n,Symbol.toStringTag,{value:`Module`}),n},Oe=`ba_iat`,ke=`ba_pl`,Ae=`ba_param`;function je(e){let t=new URLSearchParams,n=[...e.entries()].sort(([e,t],[n,r])=>e<n?-1:e>n?1:t<r?-1:+(t>r));for(let[e,r]of n)t.append(e,r);return t}function Me(e){e.delete(Ae);let t=[...new Set([...e.keys(),Ae])].sort();for(let n of t)e.append(Ae,n)}function Ne(e){let t=new URLSearchParams(e).get(Oe);if(!t)return null;let n=Number(t);return!Number.isFinite(n)||n<=0?null:new Date(n)}function Pe(e){let t=new URLSearchParams(e),n=t.get(`ba_pl`)??void 0;for(let e of[`sig`,`exp`,Oe,Ae,ke])t.delete(e);return{query:t.toString(),signedQueryIssuedAt:Ne(e)??void 0,postLoginClearedForSession:n}}var Fe=class{oHash;iHash;blockLen;outputLen;canXOF=!1;finished=!1;destroyed=!1;constructor(e,t){if(ve(e),M(t,void 0,`key`),this.iHash=e.create(),typeof this.iHash.update!=`function`)throw Error(`expected Hash instance`);this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,r=new Uint8Array(n);r.set(t.length>n?e.create().update(t).digest():t);for(let e=0;e<r.length;e++)r[e]^=54;this.iHash.update(r),this.oHash=e.create();for(let e=0;e<r.length;e++)r[e]^=106;this.oHash.update(r),se(r)}update(e){return I(this),this.iHash.update(e),this}digestInto(e){I(this),oe(e,this),this.finished=!0;let t=e.subarray(0,this.outputLen);this.iHash.digestInto(t),this.oHash.update(t),this.oHash.digestInto(t),this.destroy()}digest(){let e=new Uint8Array(this.oHash.outputLen);return this.digestInto(e),e}_cloneInto(e){e||=Object.create(Object.getPrototypeOf(this),{});let{oHash:t,iHash:n,finished:r,destroyed:i,blockLen:a,outputLen:o,canXOF:s}=this;return e=e,e.finished=r,e.destroyed=i,e.blockLen=a,e.outputLen=o,e.canXOF=s,e.oHash=t._cloneInto(e.oHash),e.iHash=n._cloneInto(e.iHash),e}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},Ie=(()=>{let e=((e,t,n)=>new Fe(e,t).update(n).digest());return e.create=(e,t)=>new Fe(e,t),e})(),Le=Uint8Array.of(0),Re=Uint8Array.of();function ze(e,t,n,r=32,i){ve(e),F(r,`length`),M(t,void 0,`prk`);let a=e.outputLen;if(t.length<a)throw Error(`"prk" must be at least HashLen octets`);if(r>255*a)throw Error(`Length must be <= 255*HashLen`);let o=Math.ceil(r/a);if(n===void 0?n=Re:M(n,void 0,`info`),!o)return i&&se(t),new Uint8Array;let s=i&&o===1?t:new Uint8Array(o*a),{iHash:c,oHash:l}=Ie.create(e,t),u=i?t:new Uint8Array(a),d=o>1?i?.iHash||e.create():void 0;for(let e=0;e<o-1;e++){Le[0]=e+1;let t=c._cloneInto(d);e&&t.update(u),t.update(n).update(Le).digestInto(u),l._cloneInto(d).update(u).digestInto(u),s.set(u,a*e)}if(Le[0]=o,o>1&&c.update(u),c.update(n).update(Le).digestInto(u),l.update(u).digestInto(u),s.set(u,a*(o-1)),c.destroy(),l.destroy(),d?.destroy(),u!==s&&se(u),se(Le),r===s.length)return s;let f=s.slice(0,r);return se(s),f}var Be=(e,t,n,r,i)=>{ve(e),n===void 0&&(n=new Uint8Array(e.outputLen));let a=Ie.create(e,n).update(t);return ze(e,a.digest(),r,i,a)},Ve=e=>e/2**32|0,He=e=>e>>>0;function Ue(e,t,n,r){let i=Ve(n),a=He(n);e.setUint32(t,r?a:i,r),e.setUint32(t+4,r?i:a,r)}function We(e,t,n){return e&t^~e&n}function Ge(e,t,n){return e&t^e&n^t&n}var Ke=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,t,n,r){this.blockLen=e,this.outputLen=t,this.padOffset=n,this.isLE=r,this.buffer=new Uint8Array(e),this.view=D(this.buffer)}update(e){I(this),M(e);let{view:t,buffer:n,blockLen:r}=this,i=e.length,a=!1;for(let o=0;o<i;){let s=Math.min(r-this.pos,i-o);if(s===r){let t=D(e);for(;r<=i-o;o+=r)this.process(t,o);a=!0}else n.set(o===0&&s===i?e:e.subarray(o,o+s),this.pos),this.pos+=s,o+=s,this.pos===r&&(this.process(t,0),this.pos=0,a=!0)}return this.length+=e.length,a&&this.roundClean(),this}digestInto(e){I(this),oe(e,this),this.finished=!0;let{buffer:t,view:n,blockLen:r,isLE:i}=this,{pos:a}=this;t[a++]=128,t.fill(0,a),this.padOffset>r-a&&(this.process(n,0),t.fill(0)),Ue(n,r-8,this.length*8,i),this.process(n,0),this.roundClean();let o=e===t?n:D(e),s=this.outputLen,c=s/4,l=this.get();if(s%4||c>l.length)throw Error(`invalid outputLen`);for(let e=0;e<c;e++)o.setUint32(4*e,l[e],i)}digest(){let{buffer:e,outputLen:t}=this;this.digestInto(e);let n=e.slice(0,t);return this.destroy(),n}_cloneIntoMeta(e){let{buffer:t,length:n,finished:r,destroyed:i,pos:a}=this;return e.destroyed=i,e.finished=r,e.length=n,e.pos=a,a&&e.buffer.set(t),e}clone(){return this._cloneInto()}},qe=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),Je=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),Ye=new Uint32Array(64),Xe=class extends Ke{A=0;B=0;C=0;D=0;E=0;F=0;G=0;H=0;constructor(e,t){super(64,e,8,!1),this.A=t[0]|0,this.B=t[1]|0,this.C=t[2]|0,this.D=t[3]|0,this.E=t[4]|0,this.F=t[5]|0,this.G=t[6]|0,this.H=t[7]|0}get(){let{A:e,B:t,C:n,D:r,E:i,F:a,G:o,H:s}=this;return[e,t,n,r,i,a,o,s]}set(e,t,n,r,i,a,o,s){this.A=e|0,this.B=t|0,this.C=n|0,this.D=r|0,this.E=i|0,this.F=a|0,this.G=o|0,this.H=s|0}_cloneInto(e){return(e||=new this.constructor).set(...this.get()),this._cloneIntoMeta(e)}process(e,t){for(let n=0;n<16;n++,t+=4)Ye[n]=e.getUint32(t,!1);for(let e=16;e<64;e++){let t=Ye[e-15],n=Ye[e-2],r=be(t,7)^be(t,18)^t>>>3,i=be(n,17)^be(n,19)^n>>>10;Ye[e]=i+Ye[e-7]+r+Ye[e-16]|0}let{A:n,B:r,C:i,D:a,E:o,F:s,G:c,H:l}=this;for(let e=0;e<64;e++){let t=be(o,6)^be(o,11)^be(o,25),u=l+t+We(o,s,c)+Je[e]+Ye[e]|0,d=(be(n,2)^be(n,13)^be(n,22))+Ge(n,r,i)|0;l=c,c=s,s=o,o=a+u|0,a=i,i=r,r=n,n=u+d|0}n=n+this.A|0,r=r+this.B|0,i=i+this.C|0,a=a+this.D|0,o=o+this.E|0,s=s+this.F|0,c=c+this.G|0,l=l+this.H|0,this.set(n,r,i,a,o,s,c,l)}roundClean(){se(Ye)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),se(this.buffer)}},Ze=class extends Xe{constructor(){super(32,qe)}},Qe=ee(()=>new Ze,ue(1)),$e=new TextEncoder,et=new TextDecoder,tt=new TextDecoder(`utf-8`,{fatal:!0}),nt=2**32;function rt(...e){let t=e.reduce((e,{length:t})=>e+t,0),n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function it(e,t,n){if(t<0||t>=nt)throw RangeError(`value must be >= 0 and <= ${nt-1}. Received ${t}`);e.set([t>>>24,t>>>16,t>>>8,t&255],n)}function at(e){let t=Math.floor(e/nt),n=e%nt,r=new Uint8Array(8);return it(r,t,0),it(r,n,4),r}function ot(e){let t=new Uint8Array(4);return it(t,e),t}var st=/[^\x00-\x7f]/;function ct(e){if(typeof e==`string`&&e.length>=128){if(st.test(e))throw TypeError(`non-ASCII string encountered in encode()`);return $e.encode(e)}let t=new Uint8Array(e.length);for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);if(r>127)throw TypeError(`non-ASCII string encountered in encode()`);t[n]=r}return t}function lt(e,t=!1){if(Uint8Array.prototype.toBase64)return e.toBase64({alphabet:t?`base64url`:`base64`,omitPadding:t});let n=32768,r=[];for(let t=0;t<e.length;t+=n)r.push(String.fromCharCode.apply(null,e.subarray(t,t+n)));let i=btoa(r.join(``));return t?i.replace(/=/g,``).replace(/\+/g,`-`).replace(/\//g,`_`):i}function ut(e,t=!1){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e,{alphabet:t?`base64url`:`base64`});if(t){if(e.includes(`+`)||e.includes(`/`))throw TypeError(`Invalid base64url`);e=e.replace(/-/g,`+`).replace(/_/g,`/`)}let n=atob(e),r=new Uint8Array(n.length);for(let e=0;e<n.length;e++)r[e]=n.charCodeAt(e);return r}async function dt(e,t){let n=`SHA-${e.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(n,t))}var V=class extends Error{static code=`ERR_JOSE_GENERIC`;code=`ERR_JOSE_GENERIC`;constructor(e,t){super(e,t),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},ft=class extends V{static code=`ERR_JWT_CLAIM_VALIDATION_FAILED`;code=`ERR_JWT_CLAIM_VALIDATION_FAILED`;claim;reason;payload;constructor(e,t,n=`unspecified`,r=`unspecified`){super(e,{cause:{claim:n,reason:r,payload:t}}),this.claim=n,this.reason=r,this.payload=t}},pt=class extends V{static code=`ERR_JWT_EXPIRED`;code=`ERR_JWT_EXPIRED`;claim;reason;payload;constructor(e,t,n=`unspecified`,r=`unspecified`){super(e,{cause:{claim:n,reason:r,payload:t}}),this.claim=n,this.reason=r,this.payload=t}},mt=class extends V{static code=`ERR_JOSE_ALG_NOT_ALLOWED`;code=`ERR_JOSE_ALG_NOT_ALLOWED`},H=class extends V{static code=`ERR_JOSE_NOT_SUPPORTED`;code=`ERR_JOSE_NOT_SUPPORTED`},ht=class extends V{static code=`ERR_JWE_DECRYPTION_FAILED`;code=`ERR_JWE_DECRYPTION_FAILED`;constructor(e=`decryption operation failed`,t){super(e,t)}},U=class extends V{static code=`ERR_JWE_INVALID`;code=`ERR_JWE_INVALID`},W=class extends V{static code=`ERR_JWS_INVALID`;code=`ERR_JWS_INVALID`},gt=class extends V{static code=`ERR_JWT_INVALID`;code=`ERR_JWT_INVALID`},_t=class extends V{static code=`ERR_JWK_INVALID`;code=`ERR_JWK_INVALID`},vt=class extends V{static code=`ERR_JWKS_INVALID`;code=`ERR_JWKS_INVALID`},yt=class extends V{static code=`ERR_JWKS_NO_MATCHING_KEY`;code=`ERR_JWKS_NO_MATCHING_KEY`;constructor(e=`no applicable key found in the JSON Web Key Set`,t){super(e,t)}},bt=class extends V{[Symbol.asyncIterator]=async function*(){};static code=`ERR_JWKS_MULTIPLE_MATCHING_KEYS`;code=`ERR_JWKS_MULTIPLE_MATCHING_KEYS`;constructor(e=`multiple matching keys found in the JSON Web Key Set`,t){super(e,t)}},xt=class extends V{static code=`ERR_JWKS_TIMEOUT`;code=`ERR_JWKS_TIMEOUT`;constructor(e=`request timed out`,t){super(e,t)}},St=class extends V{static code=`ERR_JWS_SIGNATURE_VERIFICATION_FAILED`;code=`ERR_JWS_SIGNATURE_VERIFICATION_FAILED`;constructor(e=`signature verification failed`,t){super(e,t)}},Ct=`The input to be decoded is not correctly encoded.`;function wt(e){try{return ut(typeof e==`string`?e:et.decode(e),!0)}catch(e){throw TypeError(Ct,{cause:e})}}function G(e){return lt(typeof e==`string`?$e.encode(e):e,!0)}function Tt(e,t){if(!(e instanceof Uint8Array))throw TypeError(`${t} must be an instance of Uint8Array`)}function Et(e){if(typeof e!=`object`||!e||Object.prototype.toString.call(e)!==`[object Object]`)return!1;let t=Object.getPrototypeOf(e);return t===null||Object.getPrototypeOf(t)===null}function Dt(e){return Et(e)&&Array.isArray(e.keys)&&Array.from(e.keys).every(Et)}function Ot(...e){let t=new Set;for(let n of e)if(n)for(let e of Object.keys(n)){if(t.has(e))return!1;t.add(e)}return!0}function kt(e,t){if(e!==void 0)throw TypeError(`${t} can only be called once`)}function At(e,t,n){try{return wt(e)}catch{throw new n(`Failed to base64url decode the ${t}`)}}function jt(e,t,n){try{return ct(e)}catch{throw new n(`The ${t} is not a valid base64url string`)}}function Mt(e,t,n){let r;try{r=JSON.parse(tt.decode(wt(e)))}catch{throw new t(n)}if(!Et(r))throw new t(n);return r}var Nt={__proto__:null,b64:!0},Pt={__proto__:null};function Ft(e,t){if(t!==void 0&&(!Array.isArray(t)||t.some(e=>typeof e!=`string`)))throw TypeError(`"${e}" option must be an array of strings`);return t===void 0?void 0:new Set(t)}function It(e,t){let{crit:n}=t??{};if(Array.isArray(n)&&new Set(n).size!==n.length)throw new e(`"crit" (Critical) Header Parameter MUST NOT contain duplicate values`)}function Lt(e,t,n,r,i){if(i.crit!==void 0&&r?.crit===void 0)throw new e(`"crit" (Critical) Header Parameter MUST be integrity protected`);if(!r||r.crit===void 0)return[];if(!Array.isArray(r.crit)||r.crit.length===0||r.crit.some(e=>typeof e!=`string`||e.length===0))throw new e(`"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present`);let a=n===void 0?t:{__proto__:null,...n,...t};for(let t of r.crit){if(!(t in a))throw new H(`Extension Header Parameter "${t}" is not recognized`);if(!Object.hasOwn(i,t)||i[t]===void 0)throw new e(`Extension Header Parameter "${t}" is missing`);if(a[t]&&(!Object.hasOwn(r,t)||r[t]===void 0))throw new e(`Extension Header Parameter "${t}" MUST be integrity protected`)}return r.crit}function Rt(e,t){if(t.includes(`b64`)){let t=e.b64;if(typeof t!=`boolean`)throw new W(`The "b64" (base64url-encode payload) Header Parameter must be a boolean`);return t}return!0}function zt(e,t){let n,r;try{n=JSON.stringify(t),r=JSON.parse(n)}catch(t){throw new e(`JOSE Header is not valid JSON`,{cause:t})}if(!Et(r))throw new e(`JOSE Header is not a JSON object`);return[r,n]}var Bt=e=>e[Symbol.toStringTag],Vt=(e,t,n)=>{let{alg:r}=e;if(t.use!==void 0){let e=n===`sign`||n===`verify`?`sig`:`enc`;if(t.use!==e)throw TypeError(`Invalid key for this operation, its "use" must be "${e}" when present`)}if(t.alg!==void 0&&t.alg!==r)throw TypeError(`Invalid key for this operation, its "alg" must be "${r}" when present`);if(Array.isArray(t.key_ops)){let r=n===`encrypt`||n===`decrypt`?e.ops?.[n===`encrypt`?0:1]:n;if(r&&!t.key_ops.includes(r))throw TypeError(`Invalid key for this operation, its "key_ops" must include "${r}" when present`)}};async function Ht(e,t,n){let{alg:r,secret:i}=e,a=n===`decrypt`||n===`sign`;if(i&&t instanceof Uint8Array)return t;let o,s;if(Et(t)){if(o=rn(t),typeof o.kty!=`string`)throw Zt(r,t,i);if(!(i?o.kty===`oct`&&typeof o.k==`string`:o.kty!==`oct`&&(a?o.kty===`AKP`&&typeof o.priv==`string`||typeof o.d==`string`:o.d===void 0&&o.priv===void 0)))throw TypeError(i?`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`:`JSON Web Key for this operation must be a ${a?`private`:`public`} JWK`);if(Vt(e,o,n),o.kty===`oct`)return wt(o.k);if(!Object.isFrozen(t)){let{key_ops:e}=t;Array.isArray(e)&&Object.freeze(e),Object.freeze(t)}}else{if(!Jt(t))throw Zt(r,t,i);let e=i?`secret`:a?`private`:`public`;if(t.type!==e&&(i||[`secret`,`public`,`private`].includes(t.type)))throw TypeError(`${Bt(t)} instances must be of type "${e}" for the ${r} algorithm`);if(Kt(t))return t;if(s=t,s.type===`secret`)return s.export()}Ut||=new WeakMap;let c=t,l=Ut.get(c);if(l?.[r])return l[r];if(l||Ut.set(c,l={}),s&&typeof s.toCryptoKey==`function`){let t=s.type===`public`,n=Wt[s.asymmetricKeyDetails?.namedCurve],i=e.resolve?.({crv:n,asymmetricKeyType:s.asymmetricKeyType})??e.subtle;return l[r]=s.toCryptoKey(i,t,e.usages[+!t])}return o??=s.export({format:`jwk`}),o.alg=r,l[r]=await on(e,o)}var Ut,Wt={__proto__:null,prime256v1:`P-256`,secp384r1:`P-384`,secp521r1:`P-521`};function Gt(e){if(!Kt(e))throw Error(`CryptoKey instance expected`)}var Kt=e=>{if(e?.[Symbol.toStringTag]===`CryptoKey`)return!0;try{return e instanceof CryptoKey}catch{return!1}},qt=e=>e?.[Symbol.toStringTag]===`KeyObject`,Jt=e=>Kt(e)||qt(e);function Yt(e,t,...n){if(n.length>2){let t=n.pop();e+=`one of type ${n.join(`, `)}, or ${t}.`}else n.length===2?e+=`one of type ${n[0]} or ${n[1]}.`:e+=`of type ${n[0]}.`;return t==null?e+=` Received ${t}`:typeof t==`function`&&t.name?e+=` Received function ${t.name}`:typeof t==`object`&&t&&t.constructor?.name&&(e+=` Received an instance of ${t.constructor.name}`),e}var Xt=(e,...t)=>Yt(`Key must be `,e,...t);function Zt(e,t,n){let r=[`CryptoKey`,`KeyObject`,`JSON Web Key`];return n&&r.push(`Uint8Array`),TypeError(Yt(`Key for the ${e} algorithm must be `,t,...r))}var Qt=(e,t=`algorithm.name`)=>TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`);function $t(e,t){if(t&&!e.usages.includes(t))throw TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`)}function en(e,t){let{modulusLength:n}=t.algorithm;if(typeof n!=`number`||n<2048)throw TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}function tn(e,t,n){let r=e.algorithm;if(r.name!==t.name)throw Qt(t.name);if(t.hash&&r.hash?.name!==t.hash)throw Qt(t.hash,`algorithm.hash`);if(t.namedCurve&&r.namedCurve!==t.namedCurve)throw Qt(t.namedCurve,`algorithm.namedCurve`);if(t.length!==void 0&&r.length!==t.length)throw Qt(t.length,`algorithm.length`);$t(e,n)}function nn(e){return{__proto__:null,...e}}function rn(e){let t=nn(e);if(t.ext!==void 0&&typeof t.ext!=`boolean`)throw TypeError(`"ext" (Extractable) Parameter must be a boolean`);if(t.key_ops!==void 0){let e=t.key_ops,n=Array.isArray(e)?[...e]:void 0;if(!n||n.some(e=>typeof e!=`string`)||new Set(n).size!==n.length)throw TypeError(`"key_ops" (Key Operations) Parameter must be an array of unique strings`);t.key_ops=n}return t}function an(e){if(e!==void 0&&typeof e!=`boolean`)throw TypeError(`"extractable" option must be a boolean`);return e}async function on(e,t,n){if(!e.kty.includes(t.kty))throw new H(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value`);let r=e.resolve?.({kty:t.kty,crv:t.crv})??e.subtle,i=!!(t.d||t.priv),a={...t,ext:n??t.ext};return a.kty!==`AKP`&&delete a.alg,delete a.use,crypto.subtle.importKey(`jwk`,a,r,a.ext??!i,t.key_ops??e.usages[+!!i])}async function sn(e,t,n,r=!1){return e instanceof Uint8Array&&(e=await crypto.subtle.importKey(`raw`,e,t,r,[n])),tn(e,t,n),e}var cn=e=>crypto.getRandomValues(new Uint8Array(e.cekBits>>3));function ln(e,t){let n=e.byteLength<<3;if(n!==t)throw new U(`Invalid Content Encryption Key length. Expected ${t} bits, got ${n} bits`)}var un=e=>crypto.getRandomValues(new Uint8Array(e.ivBits>>3));function dn(e,t){if(t.length<<3!==e.ivBits)throw new U(`Invalid Initialization Vector length`)}async function fn(e,t,n){if(!(t instanceof Uint8Array))throw TypeError(Xt(t,`Uint8Array`));let r=e.cekBits>>1;return[await crypto.subtle.importKey(`raw`,t.subarray(r>>3),`AES-CBC`,!1,[n]),await crypto.subtle.importKey(`raw`,t.subarray(0,r>>3),{hash:`SHA-${r<<1}`,name:`HMAC`},!1,[`sign`]),r]}async function pn(e,t,n){return new Uint8Array((await crypto.subtle.sign(`HMAC`,e,t)).slice(0,n>>3))}async function mn(e,t,n,r,i){let[a,o,s]=await fn(e,n,`encrypt`),c=new Uint8Array(await crypto.subtle.encrypt({iv:r,name:`AES-CBC`},a,t));return{ciphertext:c,tag:await pn(o,rt(i,r,c,at(i.length*8)),s),iv:r}}async function hn(e,t){let n={name:`HMAC`,hash:`SHA-256`},r=await crypto.subtle.generateKey(n,!1,[`sign`,`verify`]),i=await crypto.subtle.sign(n,r,e);return crypto.subtle.verify(n,r,i,t)}async function gn(e,t,n,r,i,a){let[o,s,c]=await fn(e,t,`decrypt`),l=await pn(s,rt(a,r,n,at(a.length*8)),c);try{if(await hn(i,l))return new Uint8Array(await crypto.subtle.decrypt({iv:r,name:`AES-CBC`},o,n))}catch{}throw new ht}async function _n(e,t,n,r,i){if(!Kt(n)&&!(n instanceof Uint8Array))throw TypeError(Xt(n,`CryptoKey`,`KeyObject`,`Uint8Array`,`JSON Web Key`));if(r?dn(e,r):r=un(e),n instanceof Uint8Array&&ln(n,e.cekBits),e.cbc)return mn(e,t,n,r,i);let a=await sn(n,e.subtle,`encrypt`),o=new Uint8Array(await crypto.subtle.encrypt({additionalData:i,iv:r,name:`AES-GCM`,tagLength:128},a,t));return{ciphertext:o.subarray(0,-16),tag:o.subarray(-16),iv:r}}async function vn(e,t,n,r,i,a){if(!Kt(t)&&!(t instanceof Uint8Array))throw TypeError(Xt(t,`CryptoKey`,`KeyObject`,`Uint8Array`,`JSON Web Key`));if(!r)throw new U(`JWE Initialization Vector missing`);if(!i)throw new U(`JWE Authentication Tag missing`);if(!e.cbc&&i.length!==16)throw new U(`Invalid Authentication Tag length`);if(dn(e,r),t instanceof Uint8Array&&ln(t,e.cekBits),e.cbc)return gn(e,t,n,r,i,a);let o=await sn(t,e.subtle,`decrypt`);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:a,iv:r,name:`AES-GCM`,tagLength:128},o,rt(n,i)))}catch{throw new ht}}function yn(e){let t={__proto__:null};for(let n in e)t[n]={...e[n],alg:n};return t}var bn=[[`encrypt`,`wrapKey`],[`decrypt`,`unwrapKey`]],xn=[[],[`deriveBits`]],Sn=[[],[]];function Cn(e){return{kty:[`RSA`],mode:`key-encryption`,subtle:{name:`RSA-OAEP`,hash:`SHA-${e}`},usages:bn,ops:[`wrapKey`,`unwrapKey`]}}function wn(e){return{kty:[`EC`,`OKP`],mode:e,subtle:{name:`ECDH`},resolve:({kty:e,crv:t,asymmetricKeyType:n})=>{if(t===`X25519`||n===`x25519`)return{name:`X25519`};if(e===`OKP`)throw new H(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value`);return{name:`ECDH`,namedCurve:t}},usages:xn,ops:[void 0,`deriveBits`]}}function Tn(e,t=!1){return{kty:[`oct`],mode:`key-wrapping`,secret:!0,subtle:{name:t?`AES-GCM`:`AES-KW`,length:e},usages:Sn,ops:t?[`encrypt`,`decrypt`]:[`wrapKey`,`unwrapKey`]}}function En(){return{kty:[`oct`],mode:`key-wrapping`,secret:!0,subtle:{name:`PBKDF2`},usages:Sn,ops:[`deriveBits`,`deriveBits`]}}var Dn=yn({dir:{kty:[`oct`],mode:`direct-encryption`,secret:!0,subtle:{name:`AES-GCM`},usages:Sn,ops:[`encrypt`,`decrypt`]},"RSA-OAEP":Cn(1),"RSA-OAEP-256":Cn(256),"RSA-OAEP-384":Cn(384),"RSA-OAEP-512":Cn(512),"ECDH-ES":wn(`direct-key-agreement`),"ECDH-ES+A128KW":wn(`key-agreement-with-key-wrapping`),"ECDH-ES+A192KW":wn(`key-agreement-with-key-wrapping`),"ECDH-ES+A256KW":wn(`key-agreement-with-key-wrapping`),A128KW:Tn(128),A192KW:Tn(192),A256KW:Tn(256),A128GCMKW:Tn(128,!0),A192GCMKW:Tn(192,!0),A256GCMKW:Tn(256,!0),"PBES2-HS256+A128KW":En(),"PBES2-HS384+A192KW":En(),"PBES2-HS512+A256KW":En()}),On=[`encrypt`,`decrypt`];function kn(e,t=!1){return{kty:[`oct`],secret:!0,subtle:{name:t?`AES-CBC`:`AES-GCM`,length:e},usages:Sn,ops:On,cekBits:e,ivBits:t?128:96,cbc:t}}var An=yn({A128GCM:kn(128),A192GCM:kn(192),A256GCM:kn(256),"A128CBC-HS256":kn(256,!0),"A192CBC-HS384":kn(384,!0),"A256CBC-HS512":kn(512,!0)});function jn(e,t){throw new H(`Invalid or unsupported "${e}" (JWE ${t}) header value`)}function Mn(e){return(typeof e==`string`?Dn[e]:void 0)??jn(`alg`,`Algorithm`)}function Nn(e){return e.mode===`key-wrapping`||e.mode===`key-encryption`||e.mode===`key-agreement-with-key-wrapping`}function Pn(e){return(typeof e==`string`?An[e]:void 0)??jn(`enc`,`Encryption Algorithm`)}function Fn(e,t){if(e.algorithm.name!==`ECDH`&&e.algorithm.name!==`X25519`)throw TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519`);$t(e,t)}async function In(e,t,n){let r=await sn(t,Mn(e).subtle,`wrapKey`,!0),i=await crypto.subtle.importKey(`raw`,n,{hash:`SHA-256`,name:`HMAC`},!0,[`sign`]);return new Uint8Array(await crypto.subtle.wrapKey(`raw`,i,r,`AES-KW`))}async function Ln(e,t,n){let r=await sn(t,Mn(e).subtle,`unwrapKey`,!0),i=await crypto.subtle.unwrapKey(`raw`,n,r,`AES-KW`,{hash:`SHA-256`,name:`HMAC`},!0,[`sign`]);return new Uint8Array(await crypto.subtle.exportKey(`raw`,i))}function Rn(e,t,n){tn(t,Mn(e).subtle,n),en(e,t)}async function zn(e,t,n,r){if(!(e instanceof Uint8Array)||e.length<8)throw new U(`PBES2 Salt Input must be 8 or more octets`);if(!Number.isSafeInteger(n)||Math.sign(n)!==1)throw new U(`PBES2 Count Input must be a positive integer`);let i=rt(ct(t),Uint8Array.of(0),e),a=parseInt(t.slice(13,16),10),o={hash:`SHA-${t.slice(8,11)}`,iterations:n,name:`PBKDF2`,salt:i},s=await sn(r,Mn(t).subtle,`deriveBits`);return new Uint8Array(await crypto.subtle.deriveBits(o,s,a))}function Bn(e){return rt(ot(e.length),e)}async function Vn(e,t,n){let r=t>>3,i=Math.ceil(r/32),a=new Uint8Array(i*32);for(let t=1;t<=i;t++){let r=await dt(`sha256`,rt(ot(t),e,n));a.set(r,(t-1)*32)}return a.slice(0,r)}async function Hn(e,t,n,r,i=new Uint8Array,a=new Uint8Array){Fn(e),Fn(t,`deriveBits`);let o=rt(Bn(ct(n)),Bn(i),Bn(a),ot(r));return Vn(new Uint8Array(await crypto.subtle.deriveBits({name:e.algorithm.name,public:e},t,e.algorithm.name===`X25519`?256:Math.ceil(parseInt(e.algorithm.namedCurve.slice(-3),10)/8)<<3)),r,o)}function Un(e){Gt(e);let t=e.algorithm.namedCurve;if(t!==`P-256`&&t!==`P-384`&&t!==`P-521`&&e.algorithm.name!==`X25519`)throw new H(`ECDH with the provided key is not allowed or not supported by your javascript runtime`)}function Wn(e,t){let n=e[t];if(n!==void 0){if(typeof n!=`string`)throw new U(`JOSE Header "${t}" (Agreement Party${t===`apu`?`U`:`V`}Info) invalid`);return At(n,t,U)}}function Gn(e,t){if(e!==void 0&&t!==void 0&&e.byteLength===t.byteLength){for(let n=0;n<e.byteLength;n++)if(e[n]!==t[n])return;throw new U(`JOSE Header "apu" and "apv" values must be distinct`)}}function Kn(e){if(e===void 0)throw new U(`JWE Encrypted Key missing`)}function qn(e){if(e!==void 0)throw new U(`Encountered unexpected JWE Encrypted Key`)}function Jn(e){if(e!==void 0&&e!==1/0&&(!Number.isSafeInteger(e)||e<1))throw TypeError(`maxPBES2Count must be a positive safe integer or Infinity`)}async function Yn(e,t,n,r,i,a){let{alg:o}=e,s=e.mode;if(s===`direct-encryption`)return qn(r),n;let c=s===`direct-key-agreement`;switch(c?qn(r):Kn(r),e.subtle.name){case`ECDH`:{let{epk:r}=i;if(!Et(r)||[`d`,`k`,`p`,`q`,`dp`,`dq`,`qi`,`oth`,`priv`].some(e=>Object.hasOwn(r,e)))throw new U(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);Un(n);let a=await on(e,r),s=Wn(i,`apu`),l=Wn(i,`apv`);Gn(s,l);let u=await Hn(a,n,c?t.alg:o,c?t.cekBits:parseInt(o.slice(-5,-2),10),s,l);if(c)return u;n=u;break}case`RSA-OAEP`:return Gt(n),Rn(o,n,`decrypt`),new Uint8Array(await crypto.subtle.decrypt(`RSA-OAEP`,n,r));case`PBKDF2`:{if(typeof i.p2c!=`number`)throw new U(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);Jn(a);let e=a??1e4;if(i.p2c>e)throw new U(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);if(typeof i.p2s!=`string`)throw new U(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);n=await zn(At(i.p2s,`p2s`,U),o,i.p2c,n);break}case`AES-GCM`:{if(typeof i.iv!=`string`)throw new U(`JOSE Header "iv" (Initialization Vector) missing or invalid`);if(typeof i.tag!=`string`)throw new U(`JOSE Header "tag" (Authentication Tag) missing or invalid`);let e=At(i.iv,`iv`,U),t=At(i.tag,`tag`,U);if(e.byteLength!==12)throw new U(`Invalid Initialization Vector length`);if(t.byteLength!==16)throw new U(`Invalid Authentication Tag length`);return vn(Pn(o.slice(0,-2)),n,r,e,t,new Uint8Array)}}return Ln(o.slice(-6),n,r)}async function Xn(e,t,n,r,i,a={}){let{alg:o,mode:s}=e,c=Nn(e);if(i!==void 0&&!c)throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${o}`);let l=await Ht(s===`direct-encryption`?t:e,n,`encrypt`);if(s===`direct-encryption`)return[l,void 0,void 0];let u=c?i??cn(t):void 0;u&&ln(u,t.cekBits);let d,f;switch(e.subtle.name){case`ECDH`:{Un(l);let{apu:n,apv:i}=a;n!==void 0&&Tt(n,`"apu"`),i!==void 0&&Tt(i,`"apv"`);let c=n??Wn(r,`apu`),u=i??Wn(r,`apv`);Gn(c,u);let d;d=a.epk===void 0?(await crypto.subtle.generateKey(l.algorithm,!0,[`deriveBits`])).privateKey:await Ht(e,a.epk,`decrypt`);let p=crypto.subtle,m=d;if(!m.extractable){if(typeof p.getPublicKey!=`function`)throw TypeError(`CryptoKey for "epk" must be extractable`);m=await p.getPublicKey(d,[])}let{x:h,y:g,crv:_,kty:v}=await p.exportKey(`jwk`,m),y=s===`direct-key-agreement`,b=await Hn(l,d,y?t.alg:o,y?t.cekBits:parseInt(o.slice(-5,-2),10),c,u),x={x:h,crv:_,kty:v};if(v===`EC`&&(x.y=g),f={epk:x},n!==void 0&&(f.apu=G(n)),i!==void 0&&(f.apv=G(i)),y)return[b,void 0,f];l=b;break}case`RSA-OAEP`:Gt(l),Rn(o,l,`encrypt`),d=new Uint8Array(await crypto.subtle.encrypt(`RSA-OAEP`,l,u));break;case`PBKDF2`:{let{p2c:e=2048,p2s:t=crypto.getRandomValues(new Uint8Array(16))}=a;l=await zn(t,o,e,l),f={p2c:e,p2s:G(t)};break}case`AES-GCM`:{let e=a.iv===void 0?crypto.getRandomValues(new Uint8Array(12)):a.iv;if(!(e instanceof Uint8Array))throw TypeError(`"iv" must be an instance of Uint8Array`);let t=await _n(Pn(o.slice(0,-2)),u,l,e,new Uint8Array);d=t.ciphertext,f={iv:G(t.iv),tag:G(t.tag)}}}if(d??=await In(o.slice(-6),l,u),!(d instanceof Uint8Array)||!d.byteLength)throw TypeError(`JWE key management algorithm did not produce an Encrypted Key`);return[u,d,f]}function Zn(e,t){if(e.zip!==void 0&&e.zip!==`DEF`)throw new H(`Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.`);if(e.zip!==void 0&&!t?.zip)throw new U(`JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.`)}function Qn(e){if(typeof globalThis[e]>`u`)throw new H(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${e} API.`)}async function $n(e,t,n=1/0){let r=e.writable.getWriter();r.write(t).catch(()=>{}),r.close().catch(()=>{});let i=[],a=0,o=e.readable.getReader();for(;;){let{value:e,done:t}=await o.read();if(t)break;if(i.push(e),a+=e.byteLength,n!==1/0&&a>n)throw new U(`Decompressed plaintext exceeded the configured limit`)}return rt(...i)}async function er(e){return Qn(`CompressionStream`),$n(new CompressionStream(`deflate-raw`),e)}async function tr(e,t){return Qn(`DecompressionStream`),$n(new DecompressionStream(`deflate-raw`),e,t)}function nr(e){let{protected:t,ciphertext:n,iv:r,tag:i,aad:a}=e,o;return t!==void 0&&(o=Mt(t,U,`JWE Protected Header is invalid`)),[o,At(n,`ciphertext`,U),r===void 0?void 0:At(r,`iv`,U),i===void 0?void 0:At(i,`tag`,U),jt((t??``)+(a===void 0?``:`.${a}`),`aad`,U)]}function rr(e){return[e&&Ft(`keyManagementAlgorithms`,e.keyManagementAlgorithms),e&&Ft(`contentEncryptionAlgorithms`,e.contentEncryptionAlgorithms),e?.crit,e?.maxPBES2Count,e?.maxDecompressedLength]}async function ir(e,t,n,r=nr(e)){let[i,a,o,s,c]=r,{header:l,unprotected:u,aad:d}=e,f;if(l!==void 0||u!==void 0){if(!Ot(i,l,u))throw new U(`JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint`);f={...i,...l,...u}}else f=i??{};let[p,m,h,g,_]=t,{encrypted_key:v}=e;Lt(U,Pt,h,i,f),Zn(f,i);let{alg:y,enc:b}=f;if(typeof y!=`string`||!y)throw new U(`missing JWE Algorithm (alg) in JWE Header`);let x=Dn[y];if(v===``&&(!x||!Nn(x)))throw new U(`JWE Encrypted Key incorrect type`);let S=x?.mode===`integrated-encryption`;if(!S&&(typeof b!=`string`||!b))throw new U(`missing JWE Encryption Algorithm (enc) in JWE Header`);if(p&&!p.has(y)||!p&&y.startsWith(`PBES2`))throw new mt(`"alg" (Algorithm) Header Parameter value not allowed`);let C;if(S){if(b!==void 0)throw new U(`JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption`);if(o?.byteLength)throw new U(`JWE Initialization Vector must be empty for integrated encryption`);if(s?.byteLength)throw new U(`JWE Authentication Tag must be empty for integrated encryption`)}else{if(m&&!m.has(b))throw new mt(`"enc" (Encryption Algorithm) Header Parameter value not allowed`);C=Pn(b)}let w;if(v!==void 0)try{w=At(v,`encrypted_key`,U)}catch(e){if(!x||!Nn(x))throw e;w=new Uint8Array}let T=!1;typeof n==`function`&&(n=await n(i,e),T=!0);let E=x??Mn(y);Nn(E)&&w===void 0&&(w=new Uint8Array);let D=await Ht(E.mode===`direct-encryption`?C:E,n,`decrypt`),O;if(E.mode===`integrated-encryption`)O=await E.decrypt(D,w,a,c,i,f);else{let e=C,t;try{t=await Yn(E,e,D,w,f,g),Nn(E)&&t instanceof Uint8Array&&t.byteLength<<3!==e.cekBits&&(t=cn(e))}catch(n){if(n instanceof TypeError||n instanceof U||n instanceof H)throw n;t=cn(e)}O=await vn(e,t,a,o,s,c)}if(f.zip===`DEF`){let e=_??25e4;if(e===0)throw new H(`JWE "zip" (Compression Algorithm) Header Parameter is not supported.`);if(e!==1/0&&(!Number.isSafeInteger(e)||e<1))throw TypeError(`maxDecompressedLength must be 0, a positive safe integer, or Infinity`);O=await tr(O,e).catch(e=>{throw e instanceof U?e:new U(`Failed to decompress plaintext`,{cause:e})})}return{plaintext:O,...i&&{protectedHeader:i},...d!==void 0&&{additionalAuthenticatedData:At(d,`aad`,U)},...u&&{sharedUnprotectedHeader:u},...l&&{unprotectedHeader:l},...T&&{key:D}}}async function ar(e,t,n){if(e instanceof Uint8Array&&(e=et.decode(e)),typeof e!=`string`)throw new U(`Compact JWE must be a string or Uint8Array`);let{0:r,1:i,2:a,3:o,4:s,length:c}=e.split(`.`);if(c!==5)throw new U(`Invalid Compact JWE`);return ir({ciphertext:o,iv:a||void 0,protected:r,tag:s||void 0,encrypted_key:i||void 0},t,n)}function or(e,t,n){if(!Ot(e,t,n))throw new U(`JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint`)}function sr(e,t,n=!1){if(!e[1]&&!e[2]&&!e[3])throw new U(`either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()`);t!==void 0&&(e[8]=t?.crit);let[,r,i,a,o,s,c,l,u]=e;if(o!==void 0&&Tt(o,`JWE Additional Authenticated Data`),s!==void 0&&Tt(s,`JWE Content Encryption Key`),c!==void 0&&Tt(c,`JWE Initialization Vector`),!n&&r!==void 0&&(r=zt(U,r)[0],e[1]=r),i!==void 0&&(i=zt(U,i)[0],e[2]=i),!n&&a!==void 0&&(a=zt(U,a)[0],e[3]=a),l!==void 0&&!Et(l))throw TypeError(`JWE Key Management Parameters must be an object`);or(r,i,a);let d={...r,...i,...a};It(U,r),Lt(U,Pt,u,r,d),Zn(d,r);let{alg:f,enc:p}=d;if(typeof f!=`string`||!f)throw new U(`JWE "alg" (Algorithm) Header Parameter missing or invalid`);let m=Dn[f];if(m?.mode===`integrated-encryption`){if(p!==void 0)throw new U(`JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption`);if(s!==void 0)throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${f}`);if(c!==void 0)throw TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${f}`);return[d,void 0,m]}if(typeof p!=`string`||!p)throw new U(`JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid`);return[d,Pn(p),m]}async function cr(e,t,n){let[r,i,a]=t,[o,s,c,l,u,d,f,p,,m]=e,h=s,g=c,_=a??Mn(r.alg),v,y,b;_.mode===`integrated-encryption`?b=await Ht(_,n,`encrypt`):[b,v,y]=await Xn(_,i,n,r,d,p),y&&(m?g=g?{...g,...y}:y:h=h?{...h,...y}:y,or(h,g,l));let x=h?G(JSON.stringify(h)):``,S=u?.byteLength?G(u):void 0,C=ct(S?`${x}.${S}`:x),w=o;r.zip===`DEF`&&(w=await er(w).catch(e=>{throw new U(`Failed to compress plaintext`,{cause:e})}));let T,E,D;_.mode===`integrated-encryption`?[v,T]=await _.encrypt(b,w,C,h,r,p):{ciphertext:T,tag:E,iv:D}=await _n(i,w,b,f,C);let O={ciphertext:G(T)};return D&&(O.iv=G(D)),E&&(O.tag=G(E)),v?.byteLength&&(O.encrypted_key=G(v)),S&&(O.aad=S),h&&(O.protected=x),l&&(O.unprotected=l),g&&(O.header=g),O}async function lr(e,t,n){return cr(e,sr(e,n),t)}function ur(e){return[e.protected,e.encrypted_key,e.iv,e.ciphertext,e.tag].join(`.`)}var dr=[[`verify`],[`sign`]];function fr(e){let t={name:`HMAC`,hash:`SHA-${e}`};return{kty:[`oct`],secret:!0,subtle:t,signing:t,usages:dr}}function pr(e,t){let n={name:t?`RSA-PSS`:`RSASSA-PKCS1-v1_5`,hash:`SHA-${e}`};return{kty:[`RSA`],subtle:n,signing:t?{...n,saltLength:t}:n,usages:dr,minRsaBits:2048}}function mr(e,t){return{kty:[`EC`],crv:e,subtle:{name:`ECDSA`,namedCurve:e},signing:{name:`ECDSA`,hash:`SHA-${t}`},usages:dr}}function hr(){let e={name:`Ed25519`};return{kty:[`OKP`],crv:`Ed25519`,subtle:e,signing:e,usages:dr}}function gr(e){let t={name:`ML-DSA-${e}`};return{kty:[`AKP`],subtle:t,signing:t,usages:dr}}var _r=yn({HS256:fr(256),HS384:fr(384),HS512:fr(512),RS256:pr(256),RS384:pr(384),RS512:pr(512),PS256:pr(256,32),PS384:pr(384,48),PS512:pr(512,64),ES256:mr(`P-256`,256),ES384:mr(`P-384`,384),ES512:mr(`P-521`,512),EdDSA:hr(),Ed25519:hr(),"ML-DSA-44":gr(44),"ML-DSA-65":gr(65),"ML-DSA-87":gr(87)});function vr(e){let t=typeof e==`string`?_r[e]:void 0;if(!t)throw new H(`alg ${e} is not supported either by JOSE or your javascript runtime`);return t}function yr(e){return[e&&Ft(`algorithms`,e.algorithms),e?.crit]}function br(e){return e===void 0?{}:Mt(e,W,`JWS Protected Header is invalid`)}function xr(e){try{return ct(e)}catch{throw new W(`JWS Compact Serialization payload must use only ASCII characters`)}}async function Sr(e,t,n,r,i){let{protected:a,header:o,payload:s}=e,c=i??br(a);if(!Ot(c,o))throw new W(`JWS Protected and JWS Unprotected Header Parameter names must be disjoint`);let l={...c,...o},u=Rt(c,Lt(W,Nt,t[1],c,l)),{alg:d}=l;if(typeof d!=`string`||!d)throw new W(`JWS "alg" (Algorithm) Header Parameter missing or invalid`);if(t[0]&&!t[0].has(d))throw new mt(`"alg" (Algorithm) Header Parameter value not allowed`);if(u){if(typeof s!=`string`)throw new W(`JWS Payload must be a string`)}else if(typeof s!=`string`&&!(s instanceof Uint8Array))throw new W(`JWS Payload must be a string or an Uint8Array instance`);let f=u||typeof s!=`string`?s:r(s),p=!1;typeof n==`function`&&(n=await n(c,e),p=!0);let m=vr(d),h=rt(a===void 0?new Uint8Array:ct(a),ct(`.`),typeof f==`string`?t[2]??=jt(f,`payload`,W):f),g=At(e.signature,`signature`,W),_=await Ht(m,n,`verify`),v=await sn(_,m.subtle,`verify`);m.minRsaBits&&en(m.alg,v);let y=!1;try{y=await crypto.subtle.verify(m.signing,v,g,h)}catch{}if(!y)throw new St;let b={payload:typeof f==`string`?At(f,`payload`,W):f};return a!==void 0&&(b.protectedHeader=c),o!==void 0&&(b.unprotectedHeader=o),p?[{...b,key:_},u]:[b,u]}async function Cr(e,t,n){if(e instanceof Uint8Array&&(e=et.decode(e)),typeof e!=`string`)throw new W(`Compact JWS must be a string or Uint8Array`);let{0:r,1:i,2:a,length:o}=e.split(`.`);if(o!==3)throw new W(`Invalid Compact JWS`);return Sr({payload:i,protected:r,signature:a},t,n,xr)}async function wr(e,t,n){let[r]=await Cr(e,yr(n),t);return r}var Tr=e=>Math.floor(e.getTime()/1e3),Er={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},Dr=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,Or=`check_failed`;function kr(){throw TypeError(`Invalid time period format`)}function Ar(e){typeof e!=`string`&&kr();let t=Dr.exec(e);(!t||t[4]&&t[1])&&kr();let n=parseFloat(t[2]),r=Math.round(n*Er[t[3][0].toLowerCase()]);return Number.isFinite(r)||kr(),t[1]===`-`||t[4]===`ago`?-r:r}function jr(e,t){if(!Number.isFinite(t))throw TypeError(`Invalid ${e} input`);return t}function Mr(e,t){if(typeof t!=`string`)throw TypeError(`"${e}" claim must be a string`)}function Nr(e){if(typeof e!=`string`&&(!Array.isArray(e)||Array.from(e).some(e=>typeof e!=`string`)))throw TypeError(`"aud" claim must be a string or an array of strings`)}function Pr(e,t){return typeof e==`number`?jr(t,e):e instanceof Date?jr(t,Tr(e)):Tr(new Date)+Ar(e)}var Fr=e=>{let t=e.toLowerCase();return e.includes(`/`)?t:`application/${t}`},Ir=(e,t)=>typeof e==`string`?t.includes(e):Array.isArray(e)?t.some(t=>e.includes(t)):!1;function Lr(e,t,n=!1){let r=e[t];if(r!==void 0||n){if(typeof r!=`number`)throw new ft(`"${t}" claim must be a number`,e,t,`invalid`);return r}}function Rr(e,t){throw new ft(`unexpected "${t}" claim value`,e,t,Or)}function zr(e,t,n={}){let r;try{r=JSON.parse(tt.decode(t))}catch{}if(!Et(r))throw new gt(`JWT Claims Set must be a top-level JSON object`);let{typ:i}=n;if(i!==void 0&&(typeof e.typ!=`string`||Fr(e.typ)!==Fr(i)))throw new ft(`unexpected "typ" JWT header value`,r,`typ`,Or);let{requiredClaims:a=[],issuer:o,subject:s,audience:c,maxTokenAge:l}=n,u=[...a];l!==void 0&&u.push(`iat`),c!==void 0&&u.push(`aud`),s!==void 0&&u.push(`sub`),o!==void 0&&u.push(`iss`);for(let e of new Set(u.reverse()))if(!Object.hasOwn(r,e))throw new ft(`missing required "${e}" claim`,r,e,`missing`);o!==void 0&&!(Array.isArray(o)?o:[o]).includes(r.iss)&&Rr(r,`iss`),s!==void 0&&r.sub!==s&&Rr(r,`sub`),c!==void 0&&!Ir(r.aud,typeof c==`string`?[c]:c)&&Rr(r,`aud`);let{clockTolerance:d}=n,f=0;if(typeof d==`string`)f=Ar(d);else if(d!==void 0){if(typeof d!=`number`)throw TypeError(`Invalid clockTolerance option type`);f=d}jr(`clockTolerance option`,f);let{currentDate:p}=n,m=jr(`currentDate option`,Tr(p===void 0?new Date:p)),h=Lr(r,`iat`,l!==void 0),g=Lr(r,`nbf`);if(g!==void 0&&g>m+f)throw new ft(`"nbf" claim timestamp check failed`,r,`nbf`,Or);let _=Lr(r,`exp`);if(_!==void 0&&_<=m-f)throw new pt(`"exp" claim timestamp check failed`,r,`exp`,Or);if(l!==void 0){let e=m-h,t=jr(`maxTokenAge option`,typeof l==`number`?l:Ar(l));if(e-f>t)throw new pt(`"iat" claim timestamp check failed (too far in the past)`,r,`iat`,Or);if(e<-f)throw new ft(`"iat" claim timestamp check failed (it should be in the past)`,r,`iat`,Or)}return r}var Br;function Vr(e){return Br.get(e)}function Hr(e){let t=Vr(e);for(let e of[`iat`,`nbf`,`exp`]){let n=t[e];if(typeof n==`number`&&!Number.isFinite(n))throw TypeError(`"${e}" claim must be a finite number`)}return $e.encode(JSON.stringify(t))}function Ur(e,t){return Vr(e)[t]}var Wr=class{constructor(e={}){if(!Et(e))throw TypeError(`JWT Claims Set MUST be an object`);(Br||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return Mr(`iss`,e),Vr(this).iss=e,this}setSubject(e){return Mr(`sub`,e),Vr(this).sub=e,this}setAudience(e){return Nr(e),Vr(this).aud=e,this}setJti(e){return Mr(`jti`,e),Vr(this).jti=e,this}setNotBefore(e){return Vr(this).nbf=Pr(e,`setNotBefore`),this}setExpirationTime(e){return Vr(this).exp=Pr(e,`setExpirationTime`),this}setIssuedAt(e){let t=Vr(this);return t.iat=e===void 0?Tr(new Date):typeof e==`string`?jr(`setIssuedAt`,Tr(new Date)+Ar(e)):Pr(e,`setIssuedAt`),this}};async function Gr(e,t,n){let[r,i]=await Cr(e,yr(n),t);if(!i)throw new gt(`JWTs MUST NOT use unencoded payload`);let a=zr(r.protectedHeader,r.payload,n);return{...r,payload:a}}async function Kr(e,t,n){let{plaintext:r,...i}=await ar(e,rr(n),t),{protectedHeader:a}=i,o=zr(a,r,n);for(let e of[`iss`,`sub`,`aud`])if(a[e]!==void 0&&(e===`aud`?JSON.stringify(a.aud)!==JSON.stringify(o.aud):a[e]!==o[e]))throw new ft(`replicated "${e}" claim header parameter mismatch`,o,e,`mismatch`);return{payload:o,...i}}async function qr(e,t,n){let[r,i,a,o]=e,s=``;if(i!==void 0){let e=zt(W,i);i=e[0],s=G(e[1])}if(a!==void 0&&(a=zt(W,a)[0]),!i&&!a)throw new W(`either setProtectedHeader or setUnprotectedHeader must be called before #sign()`);if(!Ot(i,a))throw new W(`JWS Protected and JWS Unprotected Header Parameter names must be disjoint`);let c={...i,...a};It(W,i);let l=Rt(i,Lt(W,Nt,o,i,c));l||n?.();let{alg:u}=c;if(typeof u!=`string`||!u)throw new W(`JWS "alg" (Algorithm) Header Parameter missing or invalid`);let d=vr(u),f=``,p=r,m;if(l){let t=e[4];t?(f=t[0]??=G(r),p=t[1]??=ct(f)):(f=G(r),m=$e.encode(`${s}.${f}`))}m??=rt(ct(s),ct(`.`),p);let h=await sn(await Ht(d,t,`sign`),d.subtle,`sign`);d.minRsaBits&&en(d.alg,h);let g={signature:G(new Uint8Array(await crypto.subtle.sign(d.signing,h,m))),payload:f};return i&&(g.protected=s),a&&(g.header=a),[g,l]}async function Jr(e,t,n,r,i){let[a]=await qr([e,t,void 0,n],r,i);return`${a.protected}.${a.payload}.${a.signature}`}var Yr=Wr,Xr=class extends Yr{#e;setProtectedHeader(e){return kt(this.#e,`setProtectedHeader`),this.#e=e,this}async sign(e,t){return Jr(Hr(this),this.#e,t?.crit,e,()=>{throw new gt(`JWTs MUST NOT use unencoded payload`)})}},Zr=Wr,Qr=class extends Zr{#e=[void 0];#t;#n;#r;setProtectedHeader(e){return kt(this.#e[1],`setProtectedHeader`),this.#e[1]=e,this}setKeyManagementParameters(e){return kt(this.#e[7],`setKeyManagementParameters`),this.#e[7]=e,this}setContentEncryptionKey(e){return kt(this.#e[5],`setContentEncryptionKey`),this.#e[5]=e,this}setInitializationVector(e){return kt(this.#e[6],`setInitializationVector`),this.#e[6]=e,this}replicateIssuerAsHeader(){return this.#t=!0,this}replicateSubjectAsHeader(){return this.#n=!0,this}replicateAudienceAsHeader(){return this.#r=!0,this}async encrypt(e,t){let n=Hr(this);this.#e[1]&&(this.#t||this.#n||this.#r)&&(this.#e[1]={...this.#e[1],iss:this.#t?Ur(this,`iss`):void 0,sub:this.#n?Ur(this,`sub`):void 0,aud:this.#r?Ur(this,`aud`):void 0});let r=[...this.#e];return r[0]=n,ur(await lr(r,e,t))}},$r=`"alg" (Algorithm)`;function ei(e=`JWK "alg" (Algorithm) Parameter`){throw new H(`Invalid or unsupported ${e} value`)}function ti(e,t){return(typeof e==`string`?_r[e]??Dn[e]:void 0)??ei(t)}var ni=(e,t)=>{if(e.byteLength!==t.length)return!1;for(let n=0;n<e.byteLength;n++)if(e[n]!==t[n])return!1;return!0},ri=e=>({data:e,pos:0}),ii=e=>{let t=e.data[e.pos++];if(t===void 0)throw Error(`Unexpected end of ASN.1 input`);return t},ai=e=>{let t=ii(e);if(t&128){let n=t&127,r=0;for(let t=0;t<n;t++)r=r<<8|ii(e);return r}return t},oi=(e,t,n)=>{if(ii(e)!==t)throw Error(n)},si=(e,t)=>{if(t<0||e.pos+t>e.data.length)throw Error(`Unexpected end of ASN.1 input`);let n=e.data.subarray(e.pos,e.pos+t);return e.pos+=t,n},ci=e=>(oi(e,6,`Expected algorithm OID`),si(e,ai(e)));function li(e,t){if(oi(e,48,`Invalid ${t===`spki`?`SPKI`:`PKCS#8`} structure`),ai(e),t===`pkcs8`){oi(e,2,`Expected version field`);let t=ai(e);e.pos+=t}oi(e,48,`Expected algorithm identifier`),ai(e)}var ui=e=>{let t=ci(e);if(ni(t,[43,101,110]))return`X25519`;if(!ni(t,[42,134,72,206,61,2,1]))throw Error(`Unsupported key algorithm`);oi(e,6,`Expected curve OID`);let n=si(e,ai(e));if(ni(n,[42,134,72,206,61,3,1,7]))return`P-256`;if(ni(n,[43,129,4,0,34]))return`P-384`;if(ni(n,[43,129,4,0,35]))return`P-521`;throw Error(`Unsupported named curve`)},di=async(e,t,n,r)=>{let i=an(r?.extractable),a=ti(n,$r);a.secret&&ei(`"alg" (Algorithm)`);let o=e===`spki`,s;if(a.resolve)try{let n=ri(t);li(n,e),s=a.resolve({crv:ui(n)})}catch{throw new H(`Invalid or unsupported key format`)}else s=a.subtle;return crypto.subtle.importKey(e,t,s,i??o,a.usages[+!o])},fi=(e,t)=>ut(e.replace(t,``)),pi=(e,t,n)=>di(`spki`,fi(e,/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g),t,n);async function mi(e){if(qt(e)){if(e.type===`secret`)e=e.export();else return e.export({format:`jwk`})}if(e instanceof Uint8Array)return{kty:`oct`,k:G(e)};if(!Kt(e))throw TypeError(Xt(e,`CryptoKey`,`KeyObject`,`Uint8Array`));if(!e.extractable)throw TypeError(`non-extractable CryptoKey cannot be exported as a JWK`);let t=await crypto.subtle.exportKey(`jwk`,e);delete t.ext,delete t.key_ops,delete t.use,t.kty!==`AKP`&&delete t.alg;for(let e of Object.keys(t))t[e]===void 0&&delete t[e];return t}var hi=(e,t)=>{if(typeof e!=`string`||!e)throw new _t(`${t} missing or invalid`)};async function gi(e,t){let n;if(Et(e)){if(n=nn(e),typeof n.kty!=`string`)throw TypeError(Xt(e,`CryptoKey`,`KeyObject`,`JSON Web Key`))}else if(Jt(e))n=nn(await mi(e));else throw TypeError(Xt(e,`CryptoKey`,`KeyObject`,`JSON Web Key`));if(t??=`sha256`,t!==`sha256`&&t!==`sha384`&&t!==`sha512`)throw TypeError(`digestAlgorithm must one of "sha256", "sha384", or "sha512"`);let r;switch(n.kty){case`AKP`:hi(n.alg,`"alg" (Algorithm) Parameter`),hi(n.pub,`"pub" (Public key) Parameter`),r={alg:n.alg,kty:n.kty,pub:n.pub};break;case`EC`:hi(n.crv,`"crv" (Curve) Parameter`),hi(n.x,`"x" (X Coordinate) Parameter`),hi(n.y,`"y" (Y Coordinate) Parameter`),r={crv:n.crv,kty:n.kty,x:n.x,y:n.y};break;case`OKP`:hi(n.crv,`"crv" (Subtype of Key Pair) Parameter`),hi(n.x,`"x" (Public Key) Parameter`),r={crv:n.crv,kty:n.kty,x:n.x};break;case`RSA`:hi(n.e,`"e" (Exponent) Parameter`),hi(n.n,`"n" (Modulus) Parameter`),r={e:n.e,kty:n.kty,n:n.n};break;case`oct`:if(typeof n.k!=`string`)throw new _t(`"k" (Key Value) Parameter missing or invalid`);r={k:n.k,kty:n.kty};break;default:throw new H(`"kty" (Key Type) Parameter missing or unsupported`)}let i=ct(JSON.stringify(r));return G(await dt(t,i))}function _i(e,t,n,r){let{kty:i,key_ops:a,ext:o,kid:s,alg:c,use:l,crv:u}=e;return(o===void 0||typeof o==`boolean`)&&(a===void 0||Array.isArray(a)&&a.every((e,t)=>typeof e==`string`&&a.indexOf(e)===t)&&a.includes(`verify`))&&t.kty.includes(i)&&(r===void 0||typeof r==`string`&&r===s)&&(c===void 0?i!==`AKP`:n===c)&&(l===void 0||l===`sig`)&&(!t.crv||u===t.crv)}async function vi(e,t,n){let r=e.get(t)||e.set(t,{}).get(t),{alg:i}=n;if(r[i]===void 0){let e=on(n,t,!0).then(e=>{if(e.type!==`public`)throw new vt(`JSON Web Key Set members must be public keys`);return r[i]=e,e}).catch(t=>{throw r[i]===e&&delete r[i],t});r[i]=e}return r[i]}function yi(e){let t;try{t=structuredClone(e)}catch{}if(!Dt(t))throw new vt(`JSON Web Key Set malformed`);let n=t.keys.map(e=>{let t=nn(e);return Array.isArray(t.key_ops)&&(t.key_ops=[...t.key_ops]),t}),r=new WeakMap;return Object.defineProperty(async(e,i)=>{let{alg:a,kid:o}={...e,...i?.header},s=typeof a==`string`?_r[a]:void 0;if(!s||s.secret)throw new H(`Unsupported "alg" value for a JSON Web Key Set`);let c=t.keys.filter((e,t)=>_i(n[t],s,a,o)),{0:l,length:u}=c;if(!u)throw new yt;if(u!==1){let e=new bt;throw e[Symbol.asyncIterator]=async function*(){for(let e of c)try{yield await vi(r,e,s)}catch{}},e}return vi(r,l,s)},"jwks",{value:()=>structuredClone(t)})}async function bi(e,t,n){if(typeof e!=`string`||e.indexOf(`-----BEGIN PUBLIC KEY-----`)!==0)throw TypeError(`"spki" must be SPKI formatted string`);return pi(e,t,n)}async function xi(e,t,n){if(!Et(e))throw TypeError(`JWK must be an object`);let r=rn(e),i=an(n?.extractable),{alg:a}=r;if(t??=a,r.kty!==`oct`&&!t)throw TypeError(`"alg" argument is required when "jwk.alg" is not present`);switch(r.kty){case`oct`:if(typeof r.k!=`string`)throw TypeError(`missing "k" (Key Value) Parameter value`);return wt(r.k);case`AKP`:if(typeof a!=`string`||!a)throw TypeError(`missing "alg" (Algorithm) Parameter value`);if(t!==a)throw TypeError(`JWK alg and alg option value mismatch`);return on(ti(t),r,i);case`RSA`:case`EC`:case`OKP`:return on(ti(t),r,i);default:throw new H(`Unsupported "kty" (Key Type) Parameter value`)}}function Si(e){let t;if(typeof e==`string`){let n=e.split(`.`);(n.length===3||n.length===5)&&([t]=n)}else if(typeof e==`object`&&e){if(`protected`in e)t=e.protected;else throw TypeError(`Token does not contain a Protected Header`)}let n=`Invalid Token or Protected Header formatting`;if(typeof t!=`string`||!t)throw TypeError(n);return Mt(t,TypeError,n)}function Ci(e){if(typeof e!=`string`)throw new gt(`JWTs must use Compact JWS serialization, JWT must be a string`);let{1:t,length:n}=e.split(`.`);if(n===5)throw new gt(`Only JWTs using Compact JWS serialization can be decoded`);if(n!==3)throw new gt(`Invalid JWT`);if(!t)throw new gt(`JWTs must contain a payload`);let r;try{r=wt(t)}catch{throw new gt(`Failed to base64url decode the payload`)}let i;try{i=JSON.parse(tt.decode(r))}catch{throw new gt(`Failed to parse the decoded payload as JSON`)}if(!Et(i))throw new gt(`Invalid JWT Claims Set`);return i}function wi(e){let t=e?.modulusLength??2048;if(typeof t!=`number`||!Number.isInteger(t)||t<2048)throw new H(`Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used`);return t}async function Ti(e,t){let n=an(t?.extractable),r=ti(e,$r);r.secret&&ei(`"alg" (Algorithm)`);let i;if(r.resolve){let e=t?.crv??`P-256`;if(![`P-256`,`P-384`,`P-521`,`X25519`].includes(e))throw new H(`Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519`);i=r.resolve({crv:e})}else{if(r.crv!==void 0&&t?.crv!==void 0&&t.crv!==r.crv)throw new H(`Invalid or unsupported crv option provided, the only supported value for ${e} is ${r.crv}`);i=r.kty[0]===`RSA`?{...r.subtle,publicExponent:Uint8Array.of(1,0,1),modulusLength:wi(t)}:r.subtle}return crypto.subtle.generateKey(i,n??!1,[...r.usages[1],...r.usages[0]])}async function Ei(e,t,n=3600){return await new Xr(e).setProtectedHeader({alg:`HS256`}).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+n).sign(new TextEncoder().encode(t))}async function Di(e,t){try{return(await Gr(e,new TextEncoder().encode(t))).payload}catch{return null}}var Oi=new Uint8Array([66,101,116,116,101,114,65,117,116,104,46,106,115,32,71,101,110,101,114,97,116,101,100,32,69,110,99,114,121,112,116,105,111,110,32,75,101,121]),ki=()=>Date.now()/1e3|0,Ai=`dir`,ji=`A256CBC-HS512`;function Mi(e,t){return Be(Qe,new TextEncoder().encode(e),new TextEncoder().encode(t),Oi,64)}function Ni(e){if(typeof e==`string`)return e;let t=e.keys.get(e.currentVersion);if(!t)throw Error(`Secret version ${e.currentVersion} not found in keys`);return t}function Pi(e){if(typeof e==`string`)return[{version:0,value:e}];let t=[];for(let[n,r]of e.keys)t.push({version:n,value:r});return e.legacySecret&&!t.some(t=>t.value===e.legacySecret)&&t.push({version:-1,value:e.legacySecret}),t}async function Fi(e,t,n,r=3600){let i=Mi(Ni(t),n),a=await gi({kty:`oct`,k:G(i)},`sha256`);return await new Qr(e).setProtectedHeader({alg:Ai,enc:ji,kid:a}).setIssuedAt().setExpirationTime(ki()+r).setJti(crypto.randomUUID()).encrypt(i)}var Ii={clockTolerance:15,keyManagementAlgorithms:[Ai],contentEncryptionAlgorithms:[ji,`A256GCM`]};async function Li(e,t,n){if(!e)return null;let r=!1;try{r=Si(e).kid!==void 0}catch{return null}try{let r=Pi(t),{payload:i}=await Kr(e,async e=>{let t=e.kid;if(t!==void 0){for(let e of r){let r=Mi(e.value,n);if(t===await gi({kty:`oct`,k:G(r)},`sha256`))return r}throw Error(`no matching decryption secret`)}return r.length,Mi(r[0].value,n)},Ii);return i}catch{if(r)return null;let i=Pi(t);if(i.length<=1)return null;for(let t=1;t<i.length;t++)try{let r=i[t],{payload:a}=await Kr(e,Mi(r.value,n),Ii);return a}catch{continue}return null}}function Ri(e,t){typeof e==`string`&&(e=new TextEncoder().encode(e)),typeof t==`string`&&(t=new TextEncoder().encode(t));let n=new Uint8Array(e),r=new Uint8Array(t),i=n.length^r.length,a=Math.max(n.length,r.length);for(let e=0;e<a;e++)i|=(e<n.length?n[e]:0)^(e<r.length?r[e]:0);return i===0}var zi=ae(`a-z`,`0-9`,`A-Z`,`-_`);function Bi(){let e=typeof globalThis<`u`&&globalThis.crypto;if(e&&typeof e.subtle==`object`&&e.subtle!=null)return e.subtle;throw Error(`crypto.subtle must be defined`)}function Vi(e,t){return{digest:async n=>{let r=re(n),i=await Bi().digest(e,r);return t===`hex`?Array.from(new Uint8Array(i)).map(e=>e.toString(16).padStart(2,`0`)).join(``):t===`base64`||t===`base64url`||t===`base64urlnopad`?t.includes(`url`)?N.encode(i,{padding:t!==`base64urlnopad`}):ie.encode(i):i}}}function Hi(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name===`Uint8Array`&&`BYTES_PER_ELEMENT`in e&&e.BYTES_PER_ELEMENT===1}var Ui=e=>e?`"${e}" `:``;function Wi(e,t=``){if(typeof e!=`boolean`)throw TypeError(Ui(t)+`expected boolean, got type=`+typeof e);return e}function Gi(e,t=``){if(typeof e!=`number`)throw TypeError(Ui(t)+`expected number, got `+typeof e);if(!Number.isSafeInteger(e)||e<0)throw RangeError(Ui(t)+`expected integer >= 0, got `+e);return e}function K(e,t,n=``){if(Hi(e)&&(t===void 0||e.length===t))return e;t!==void 0&&Gi(t,`length`);let r=Hi(e),i=t===void 0?``:` of length ${t}`,a=r?`length=${e.length}`:`type=${typeof e}`,o=Ui(n)+`expected Uint8Array`+i+`, got `+a;throw r?RangeError(o):TypeError(o)}var Ki=(e,t)=>{if(typeof e!=`object`||!e||Array.isArray(e))throw TypeError(t===`object`?`expected valid options object`:`"${t}" expected object, got type=${typeof e}`)};function qi(e,t=!0){if(e.destroyed)throw Error(`hash was destroyed`);if(t&&e.finished)throw Error(`digest() was already called`)}function Ji(e,t){K(e,void 0,`output`);let n=t.outputLen;if(!(e.length>=n))throw RangeError(`"output" expected length >= `+n)}function Yi(e){return new Uint32Array(e.buffer,e.byteOffset,Math.floor(e.byteLength/4))}function Xi(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function Zi(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}var Qi=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function $i(e){return e<<24&4278190080|e<<8&16711680|e>>>8&65280|e>>>24&255}function ea(e){for(let t=0;t<e.length;t++)e[t]=$i(e[t]);return e}var ta=Qi?e=>e:ea,na=typeof Uint8Array.from([]).toHex==`function`&&typeof Uint8Array.fromHex==`function`,ra=Array.from({length:256},(e,t)=>t.toString(16).padStart(2,`0`));function ia(e){if(K(e),na)return e.toHex();let t=``;for(let n=0;n<e.length;n++)t+=ra[e[n]];return t}function aa(e){return e>=48&&e<=57?e-48:e>=65&&e<=70?e-55:e>=97&&e<=102?e-87:void 0}function oa(e){if(typeof e!=`string`)throw TypeError(`hex string expected, got `+typeof e);if(na)try{return Uint8Array.fromHex(e)}catch(e){throw e instanceof SyntaxError?RangeError(e.message):e}let t=e.length,n=t/2;if(t%2)throw RangeError(`hex string expected, got unpadded hex of length `+t);let r=new Uint8Array(n);for(let t=0,i=0;t<n;t++,i+=2){let n=aa(e.charCodeAt(i)),a=aa(e.charCodeAt(i+1));if(n===void 0||a===void 0){let t=e[i]+e[i+1];throw RangeError(`hex string expected, got non-hex character "`+t+`" at index `+i)}r[t]=n*16+a}return r}function sa(e){if(typeof e!=`string`)throw TypeError(`string expected`);return new Uint8Array(new TextEncoder().encode(e))}function ca(e,t){return!e.byteLength||!t.byteLength?!1:e.buffer===t.buffer&&e.byteOffset<t.byteOffset+t.byteLength&&t.byteOffset<e.byteOffset+e.byteLength}function la(e,t){if(ca(e,t)&&e.byteOffset<t.byteOffset)throw Error(`complex overlap of input and output is not supported`)}function ua(...e){let t=0;for(let n=0;n<e.length;n++){let r=e[n];K(r),t+=r.length}let n=new Uint8Array(t);for(let t=0,r=0;t<e.length;t++){let i=e[t];n.set(i,r),r+=i.length}return n}function da(e,t){return Ki(e,`defaults`),Ki(t,`opts`),Object.assign(e,t)}function fa(e,t){if(e=K(e),t=K(t),e.length!==t.length)return!1;let n=0;for(let r=0;r<e.length;r++)n|=e[r]^t[r];return n===0}function pa(e,t,n){let r=t,i=n||(()=>[]),a=(e,t)=>r(t,...i(e)).update(e).digest(),o=r(new Uint8Array(e),...i(new Uint8Array));return a.outputLen=o.outputLen,a.blockLen=o.blockLen,a.create=(e,...t)=>r(e,...t),a}var ma=(e,t)=>{function n(n,...r){if(K(n,void 0,`key`),e.nonceLength!==void 0){let t=r[0];K(t,e.varSizeNonce?void 0:e.nonceLength,`nonce`)}let i=e.tagLength,a=e.nonceLength===void 0?0:1;if(!e.withAAD){for(let e=a;e<r.length;e++)if(Hi(r[e]))throw Error(`AAD not supported`)}e.withAAD&&r[a]!==void 0&&K(r[a],void 0,`AAD`);let o=t(n,...r),s=(e,t)=>{if(t!==void 0){if(e!==2)throw Error(`cipher output not supported`);K(t,void 0,`output`)}},c=!1;return{encrypt(e,t){if(c)throw Error(`cannot encrypt() twice with same key + nonce`);return c=!0,K(e,void 0,`data`),s(o.encrypt.length,t),o.encrypt(e,t)},decrypt(e,t){if(K(e,void 0,`data`),i&&e.length<i)throw Error(`"ciphertext" expected length >= tagLength=`+i);return s(o.decrypt.length,t),o.decrypt(e,t)}}}return Object.assign(n,e),n};function ha(e,t,n=!0){if(t===void 0)return new Uint8Array(e);if(K(t,e,`output`),n&&!_a(t))throw Error(`invalid output, must be aligned`);return t}function ga(e,t,n){Gi(e),Gi(t),Wi(n);let r=new Uint8Array(16),i=Zi(r);return i.setBigUint64(0,BigInt(t),n),i.setBigUint64(8,BigInt(e),n),r}function _a(e){return e.byteOffset%4==0}function va(e){return Uint8Array.from(K(e))}function ya(e=32){Gi(e,`bytesLength`);let t=typeof globalThis==`object`?globalThis.crypto:null;if(typeof t?.getRandomValues!=`function`)throw Error(`crypto.getRandomValues must be defined`);if(e>65536)throw RangeError(`"bytesLength" expected <= 65536, got ${e}`);return t.getRandomValues(new Uint8Array(e))}function ba(e,t=ya){if(typeof e!=`function`)throw TypeError(`"fn" expected cipher constructor, got type=`+typeof e);if(typeof t!=`function`)throw TypeError(`"randomBytes_" expected function, got type=`+typeof t);let{nonceLength:n}=e;Gi(n,`fn.nonceLength`);let r=(e,t,n)=>{let r=ua(e,t);return ca(n,t)||t.fill(0),r},i=((i,...a)=>({encrypt(o){K(o,void 0,`data`);let s=t(n),c=e(i,s,...a).encrypt(o);return c instanceof Promise?c.then(e=>r(s,e,o)):r(s,c,o)},decrypt(t){K(t,void 0,`data`);let r=t.subarray(0,n),o=t.subarray(n);return e(i,r,...a).decrypt(o)}}));return`blockSize`in e&&(i.blockSize=e.blockSize),`tagLength`in e&&(i.tagLength=e.tagLength),`withAAD`in e&&(i.withAAD=e.withAAD),i}var xa=e=>Uint8Array.from(e.split(``),e=>e.charCodeAt(0)),Sa=ta(Yi(xa(`expand 16-byte k`))),Ca=ta(Yi(xa(`expand 32-byte k`)));function q(e,t){return e<<t|e>>>32-t}var wa=64,Ta=16,Ea=2**32-1,Da=Uint32Array.of();function Oa(e,t,n,r,i,a,o,s){let c=i.length,l=new Uint8Array(wa),u=Yi(l),d=Qi&&_a(i)&&_a(a),f=d?Yi(i):Da,p=d?Yi(a):Da;if(Qi)for(let m=0;m<c;o++){if(e(t,n,r,u,o,s),o>=Ea)throw Error(`arx: counter overflow`);let h=Math.min(wa,c-m);if(d&&h===wa){let e=m/4;if(m%4!=0)throw Error(`arx: invalid block position`);for(let t=0,n;t<Ta;t++)n=e+t,p[n]=f[n]^u[t];m+=wa}else{for(let e=0,t;e<h;e++)t=m+e,a[t]=i[t]^l[e];m+=h}}else for(let d=0;d<c;o++){if(e(t,n,r,u,o,s),ta(u),o>=Ea)throw Error(`arx: counter overflow`);let f=Math.min(wa,c-d);for(let e=0,t;e<f;e++)t=d+e,a[t]=i[t]^l[e];d+=f}}function ka(e,t){let{allowShortKeys:n,extendNonceFn:r,counterLength:i,counterRight:a,rounds:o}=da({allowShortKeys:!1,counterLength:8,counterRight:!1,rounds:20},t);if(typeof e!=`function`)throw Error(`core must be a function`);return Gi(i),Gi(o),Wi(a),Wi(n),(t,s,c,l,u=0)=>{K(t,void 0,`key`),K(s,void 0,`nonce`),K(c,void 0,`data`);let d=c.length,f=l!==void 0;if(l=ha(d,l,!1),f&&la(c,l),Gi(u),u<0||u>=Ea)throw Error(`arx: counter overflow`);let p=[],m=t.length,h,g;if(m===32)p.push(h=va(t)),g=Ca;else if(m===16&&n)h=new Uint8Array(32),h.set(t),h.set(t,16),g=Sa,p.push(h);else throw K(t,32,`arx key`),Error(`invalid key size`);(!Qi||!_a(s))&&p.push(s=va(s));let _=Yi(h);if(r){if(s.length!==24)throw Error(`arx: extended nonce must be 24 bytes`);let e=s.subarray(0,16);if(Qi)r(g,_,Yi(e),_);else{let t=ta(Uint32Array.from(g));r(t,_,Yi(e),_),Xi(t),ta(_)}s=s.subarray(16)}else Qi||ta(_);let v=16-i;if(v!==s.length)throw Error(`arx: nonce must be ${v} or 16 bytes`);if(v!==12){let e=new Uint8Array(12);e.set(s,a?0:12-s.length),s=e,p.push(s)}let y=ta(Yi(s));try{return Oa(e,g,_,y,c,l,u,o),l}finally{Xi(...p)}}}function J(e,t){return e[t++]&255|(e[t++]&255)<<8}var Aa=class{blockLen=16;outputLen=16;buffer=new Uint8Array(16);r=new Uint16Array(10);h=new Uint16Array(10);pad=new Uint16Array(8);pos=0;finished=!1;destroyed=!1;constructor(e){e=va(K(e,32,`key`));let t=J(e,0),n=J(e,2),r=J(e,4),i=J(e,6),a=J(e,8),o=J(e,10),s=J(e,12),c=J(e,14);this.r[0]=t&8191,this.r[1]=(t>>>13|n<<3)&8191,this.r[2]=(n>>>10|r<<6)&7939,this.r[3]=(r>>>7|i<<9)&8191,this.r[4]=(i>>>4|a<<12)&255,this.r[5]=a>>>1&8190,this.r[6]=(a>>>14|o<<2)&8191,this.r[7]=(o>>>11|s<<5)&8065,this.r[8]=(s>>>8|c<<8)&8191,this.r[9]=c>>>5&127;for(let t=0;t<8;t++)this.pad[t]=J(e,16+2*t)}process(e,t,n=!1){let r=n?0:2048,{h:i,r:a}=this,o=a[0],s=a[1],c=a[2],l=a[3],u=a[4],d=a[5],f=a[6],p=a[7],m=a[8],h=a[9],g=J(e,t+0),_=J(e,t+2),v=J(e,t+4),y=J(e,t+6),b=J(e,t+8),x=J(e,t+10),S=J(e,t+12),C=J(e,t+14),w=i[0]+(g&8191),T=i[1]+((g>>>13|_<<3)&8191),E=i[2]+((_>>>10|v<<6)&8191),D=i[3]+((v>>>7|y<<9)&8191),O=i[4]+((y>>>4|b<<12)&8191),k=i[5]+(b>>>1&8191),A=i[6]+((b>>>14|x<<2)&8191),j=i[7]+((x>>>11|S<<5)&8191),M=i[8]+((S>>>8|C<<8)&8191),N=i[9]+(C>>>5|r),P=0,F=P+w*o+5*h*T+5*m*E+5*p*D+5*f*O;P=F>>>13,F&=8191,F+=5*d*k+5*u*A+5*l*j+5*c*M+5*s*N,P+=F>>>13,F&=8191;let I=P+w*s+T*o+5*h*E+5*m*D+5*p*O;P=I>>>13,I&=8191,I+=5*f*k+5*d*A+5*u*j+5*l*M+5*c*N,P+=I>>>13,I&=8191;let L=P+w*c+T*s+E*o+5*h*D+5*m*O;P=L>>>13,L&=8191,L+=5*p*k+5*f*A+5*d*j+5*u*M+5*l*N,P+=L>>>13,L&=8191;let R=P+w*l+T*c+E*s+D*o+5*h*O;P=R>>>13,R&=8191,R+=5*m*k+5*p*A+5*f*j+5*d*M+5*u*N,P+=R>>>13,R&=8191;let ee=P+w*u+T*l+E*c+D*s+O*o;P=ee>>>13,ee&=8191,ee+=5*h*k+5*m*A+5*p*j+5*f*M+5*d*N,P+=ee>>>13,ee&=8191;let te=P+w*d+T*u+E*l+D*c+O*s;P=te>>>13,te&=8191,te+=k*o+5*h*A+5*m*j+5*p*M+5*f*N,P+=te>>>13,te&=8191;let ne=P+w*f+T*d+E*u+D*l+O*c;P=ne>>>13,ne&=8191,ne+=k*s+A*o+5*h*j+5*m*M+5*p*N,P+=ne>>>13,ne&=8191;let re=P+w*p+T*f+E*d+D*u+O*l;P=re>>>13,re&=8191,re+=k*c+A*s+j*o+5*h*M+5*m*N,P+=re>>>13,re&=8191;let ie=P+w*m+T*p+E*f+D*d+O*u;P=ie>>>13,ie&=8191,ie+=k*l+A*c+j*s+M*o+5*h*N,P+=ie>>>13,ie&=8191;let ae=P+w*h+T*m+E*p+D*f+O*d;P=ae>>>13,ae&=8191,ae+=k*u+A*l+j*c+M*s+N*o,P+=ae>>>13,ae&=8191,P=(P<<2)+P|0,P=P+F|0,F=P&8191,P>>>=13,I+=P,i[0]=F,i[1]=I,i[2]=L,i[3]=R,i[4]=ee,i[5]=te,i[6]=ne,i[7]=re,i[8]=ie,i[9]=ae}finalize(){let{h:e,pad:t}=this,n=new Uint16Array(10),r=e[1]>>>13;e[1]&=8191;for(let t=2;t<10;t++)e[t]+=r,r=e[t]>>>13,e[t]&=8191;e[0]+=r*5,r=e[0]>>>13,e[0]&=8191,e[1]+=r,r=e[1]>>>13,e[1]&=8191,e[2]+=r,n[0]=e[0]+5,r=n[0]>>>13,n[0]&=8191;for(let t=1;t<10;t++)n[t]=e[t]+r,r=n[t]>>>13,n[t]&=8191;n[9]-=8192;let i=(r^1)-1;for(let e=0;e<10;e++)n[e]&=i;i=~i;for(let t=0;t<10;t++)e[t]=e[t]&i|n[t];e[0]=(e[0]|e[1]<<13)&65535,e[1]=(e[1]>>>3|e[2]<<10)&65535,e[2]=(e[2]>>>6|e[3]<<7)&65535,e[3]=(e[3]>>>9|e[4]<<4)&65535,e[4]=(e[4]>>>12|e[5]<<1|e[6]<<14)&65535,e[5]=(e[6]>>>2|e[7]<<11)&65535,e[6]=(e[7]>>>5|e[8]<<8)&65535,e[7]=(e[8]>>>8|e[9]<<5)&65535;let a=e[0]+t[0];e[0]=a&65535;for(let n=1;n<8;n++)a=(e[n]+t[n]|0)+(a>>>16)|0,e[n]=a&65535;Xi(n)}update(e){qi(this),K(e),e=va(e);let{buffer:t,blockLen:n}=this,r=e.length;for(let i=0;i<r;){let a=Math.min(n-this.pos,r-i);if(a===n)for(;n<=r-i;i+=n)this.process(e,i);else t.set(e.subarray(i,i+a),this.pos),this.pos+=a,i+=a,this.pos===n&&(this.process(t,0,!1),this.pos=0)}return this}destroy(){this.destroyed=!0,Xi(this.h,this.r,this.buffer,this.pad)}digestInto(e){qi(this),Ji(e,this),this.finished=!0;let{buffer:t,h:n}=this,{pos:r}=this;if(r){for(t[r++]=1;r<16;r++)t[r]=0;this.process(t,0,!0)}this.finalize();let i=0;for(let t=0;t<8;t++)e[i++]=n[t]>>>0,e[i++]=n[t]>>>8}digest(){let{buffer:e,outputLen:t}=this;this.digestInto(e);let n=e.slice(0,t);return this.destroy(),n}},ja=pa(32,e=>new Aa(e));function Ma(e,t,n,r,i,a=20){let o=e[0],s=e[1],c=e[2],l=e[3],u=t[0],d=t[1],f=t[2],p=t[3],m=t[4],h=t[5],g=t[6],_=t[7],v=i,y=n[0],b=n[1],x=n[2],S=o,C=s,w=c,T=l,E=u,D=d,O=f,k=p,A=m,j=h,M=g,N=_,P=v,F=y,I=b,L=x;for(let e=0;e<a;e+=2)S=S+E|0,P=q(P^S,16),A=A+P|0,E=q(E^A,12),S=S+E|0,P=q(P^S,8),A=A+P|0,E=q(E^A,7),C=C+D|0,F=q(F^C,16),j=j+F|0,D=q(D^j,12),C=C+D|0,F=q(F^C,8),j=j+F|0,D=q(D^j,7),w=w+O|0,I=q(I^w,16),M=M+I|0,O=q(O^M,12),w=w+O|0,I=q(I^w,8),M=M+I|0,O=q(O^M,7),T=T+k|0,L=q(L^T,16),N=N+L|0,k=q(k^N,12),T=T+k|0,L=q(L^T,8),N=N+L|0,k=q(k^N,7),S=S+D|0,L=q(L^S,16),M=M+L|0,D=q(D^M,12),S=S+D|0,L=q(L^S,8),M=M+L|0,D=q(D^M,7),C=C+O|0,P=q(P^C,16),N=N+P|0,O=q(O^N,12),C=C+O|0,P=q(P^C,8),N=N+P|0,O=q(O^N,7),w=w+k|0,F=q(F^w,16),A=A+F|0,k=q(k^A,12),w=w+k|0,F=q(F^w,8),A=A+F|0,k=q(k^A,7),T=T+E|0,I=q(I^T,16),j=j+I|0,E=q(E^j,12),T=T+E|0,I=q(I^T,8),j=j+I|0,E=q(E^j,7);let R=0;r[R++]=o+S|0,r[R++]=s+C|0,r[R++]=c+w|0,r[R++]=l+T|0,r[R++]=u+E|0,r[R++]=d+D|0,r[R++]=f+O|0,r[R++]=p+k|0,r[R++]=m+A|0,r[R++]=h+j|0,r[R++]=g+M|0,r[R++]=_+N|0,r[R++]=v+P|0,r[R++]=y+F|0,r[R++]=b+I|0,r[R++]=x+L|0}function Na(e,t,n,r){let i=Qi?e:ta(e.slice(0,4)),a=Qi?t:ta(t.slice(0,8)),o=Qi?n:ta(n.slice(0,4)),s=new Uint32Array(16);Ma(i,a,o.subarray(1),s,o[0]);let c=0;r[c++]=s[0]-i[0]|0,r[c++]=s[1]-i[1]|0,r[c++]=s[2]-i[2]|0,r[c++]=s[3]-i[3]|0,r[c++]=s[12]-o[0]|0,r[c++]=s[13]-o[1]|0,r[c++]=s[14]-o[2]|0,r[c++]=s[15]-o[3]|0,ta(r),Qi||Xi(i,a,o),Xi(s)}var Pa=ka(Ma,{counterRight:!1,counterLength:8,extendNonceFn:Na,allowShortKeys:!1}),Fa=new Uint8Array(16),Ia=(e,t)=>{e.update(t);let n=t.length%16;n&&e.update(Fa.subarray(n))},La=new Uint8Array(32);function Ra(e,t,n,r,i){i!==void 0&&K(i,void 0,`AAD`);let a=e(t,n,La),o=ga(r.length,i?i.length:0,!0),s=ja.create(a);i&&Ia(s,i),Ia(s,r),s.update(o);let c=s.digest();return Xi(a,o),c}var za=ma({blockSize:64,nonceLength:24,tagLength:16,withAAD:!0},(e=>(t,n,r)=>({encrypt(i,a){let o=i.length;a=ha(o+16,a,!1),a.set(i);let s=a.subarray(0,-16);e(t,n,s,s,1);let c=Ra(e,t,n,s,r);return a.set(c,o),Xi(c),a},decrypt(i,a){a=ha(i.length-16,a,!1);let o=i.subarray(0,-16),s=i.subarray(-16),c=Ra(e,t,n,o,r);if(!fa(s,c))throw Xi(c),Error(`invalid tag`);return a.set(i.subarray(0,-16)),e(t,n,a,a,1),Xi(c),a}}))(Pa)),Ba={name:`HMAC`,hash:`SHA-256`},Va=`$ba$`;function Ha(e){if(!e.startsWith(Va))return null;let t=e.indexOf(`$`,4);if(t===-1)return null;let n=parseInt(e.slice(4,t),10);return!Number.isInteger(n)||n<0?null:{version:n,ciphertext:e.slice(t+1)}}function Ua(e,t){return`${Va}${e}$${t}`}async function Wa(e,t){let n=await Vi(`SHA-256`).digest(e),r=sa(t);return ia(ba(za)(new Uint8Array(n)).encrypt(r))}async function Ga(e,t){let n=await Vi(`SHA-256`).digest(e),r=oa(t),i=ba(za)(new Uint8Array(n));return new TextDecoder().decode(i.decrypt(r))}var Ka=async({key:e,data:t})=>{if(typeof e==`string`)return Wa(e,t);let n=e.keys.get(e.currentVersion);if(!n)throw Error(`Secret version ${e.currentVersion} not found in keys`);let r=await Wa(n,t);return Ua(e.currentVersion,r)},qa=async({key:e,data:t})=>{if(typeof e==`string`)return Ga(e,t);let n=Ha(t);if(n){let t=e.keys.get(n.version);if(!t)throw Error(`Secret version ${n.version} not found in keys (key may have been retired)`);return Ga(t,n.ciphertext)}if(e.legacySecret)return Ga(e.legacySecret,t);throw Error(`Cannot decrypt legacy bare-hex payload: no legacy secret available. Set BETTER_AUTH_SECRET for backwards compatibility.`)},Ja=async e=>{let t=typeof e==`string`?new TextEncoder().encode(e):e;return await Bi().importKey(`raw`,t,Ba,!1,[`sign`,`verify`])},Ya=async(e,t)=>{let n=await Ja(t),r=await Bi().sign(Ba.name,n,new TextEncoder().encode(e));return btoa(String.fromCharCode(...new Uint8Array(r)))},Xa={name:`HMAC`,hash:`SHA-256`},Za=async e=>{let t=typeof e==`string`?new TextEncoder().encode(e):e;return await Bi().importKey(`raw`,t,Xa,!1,[`sign`,`verify`])},Qa=async(e,t,n)=>{try{let r=atob(e),i=new Uint8Array(r.length);for(let e=0,t=r.length;e<t;e++)i[e]=r.charCodeAt(e);return await Bi().verify(Xa,n,i,new TextEncoder().encode(t))}catch{return!1}},$a=async(e,t)=>{let n=await Za(t),r=await Bi().sign(Xa.name,n,new TextEncoder().encode(e));return btoa(String.fromCharCode(...new Uint8Array(r)))},eo=async(e,t)=>{let n=await $a(e,t);return e=`${e}.${n}`,e=encodeURIComponent(e),e},to=/^application\/([a-z0-9.+-]*\+)?json/i;async function no(e,t){let n=e.headers.get(`content-type`)||``,r=n.toLowerCase();if(e.body){if(t&&t.length>0&&!t.some(e=>{let t=r.split(`;`)[0].trim(),n=e.toLowerCase().trim();return t===n||t.includes(n)}))throw r?new L(415,{message:`Content-Type "${n}" is not allowed. Allowed types: ${t.join(`, `)}`,code:`UNSUPPORTED_MEDIA_TYPE`}):new L(415,{message:`Content-Type is required. Allowed types: ${t.join(`, `)}`,code:`UNSUPPORTED_MEDIA_TYPE`});if(to.test(r))try{return await e.json()}catch(e){throw e instanceof SyntaxError?new L(400,{message:`Invalid JSON in request body`,code:`BAD_REQUEST`}):e}if(r.includes(`application/x-www-form-urlencoded`)){let t=await e.formData(),n={};return t.forEach((e,t)=>{n[t]=e.toString()}),n}if(r.includes(`multipart/form-data`)){let t=await e.formData(),n={};return t.forEach((e,t)=>{n[t]=e}),n}return r.includes(`text/plain`)?await e.text():r.includes(`application/octet-stream`)?await e.arrayBuffer():r.includes(`application/pdf`)||r.includes(`image/`)||r.includes(`video/`)?await e.blob():r.includes(`application/stream`)||e.body instanceof ReadableStream?e.body:await e.text()}}function ro(e){return e instanceof L||e?.name===`APIError`}function io(e){try{return e.includes(`%`)?decodeURIComponent(e):e}catch{return e}}async function ao(e){try{return{data:await e,error:null}}catch(e){return{data:null,error:e}}}function oo(e){return e instanceof Request||Object.prototype.toString.call(e)===`[object Request]`}var so={secure:`__Secure-`,host:`__Host-`},co=(e,t)=>{if(!t)return e;if(t===`secure`||t===`host`)return so[t]+e};function lo(e){if(typeof e!=`string`)throw TypeError(`argument str must be a string`);let t=new Map,n=0;for(;n<e.length;){let r=e.indexOf(`=`,n);if(r===-1)break;let i=e.indexOf(`;`,n);if(i===-1)i=e.length;else if(i<r){n=e.lastIndexOf(`;`,r-1)+1;continue}let a=e.slice(n,r).trim();if(!t.has(a)){let n=e.slice(r+1,i).trim();n.codePointAt(0)===34&&(n=n.slice(1,-1)),t.set(a,io(n))}n=i+1}return t}function uo(e,t,n={}){let r=co(e,n.prefix)??e,i={...n},a=r.toLowerCase();return a.startsWith(`__host-`)?(i.secure=!0,i.path=`/`,i.domain=void 0):a.startsWith(`__secure-`)&&(i.secure=!0),(i.partitioned===!0||i.sameSite?.toLowerCase()===`none`)&&(i.secure=!0),{name:r,value:t,options:i}}function fo({name:e,value:t,options:n}){let r=`${e}=${t}`;if(typeof n.maxAge==`number`&&n.maxAge>=0){if(n.maxAge>3456e4)throw Error(`Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.`);r+=`; Max-Age=${Math.floor(n.maxAge)}`}if(n.domain&&(r+=`; Domain=${n.domain}`),n.path&&(r+=`; Path=${n.path}`),n.expires){if(n.expires.getTime()-Date.now()>3456e7)throw Error(`Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.`);r+=`; Expires=${n.expires.toUTCString()}`}return n.httpOnly&&(r+=`; HttpOnly`),n.secure&&(r+=`; Secure`),n.sameSite&&(r+=`; SameSite=${n.sameSite.charAt(0).toUpperCase()+n.sameSite.slice(1)}`),n.partitioned&&(r+=`; Partitioned`),r}var po=(e,t,n)=>(t=encodeURIComponent(t),fo(uo(e,t,n))),mo=async(e,t,n,r)=>(t=await eo(t,n),fo(uo(e,t,r)));async function ho(e,t={}){let n={body:t.body,query:t.query};if(e.body){let r=await e.body[`~standard`].validate(t.body);if(r.issues)return{data:null,error:go(r.issues,`body`)};n.body=r.value}if(e.query){let r=await e.query[`~standard`].validate(t.query);if(r.issues)return{data:null,error:go(r.issues,`query`)};n.query=r.value}return e.requireHeaders&&!t.headers?{data:null,error:{message:`Headers is required`,issues:[]}}:e.requireRequest&&!t.request?{data:null,error:{message:`Request is required`,issues:[]}}:{data:n,error:null}}function go(e,t){return{message:e.map(e=>`[${e.path?.length?`${t}.`+e.path.map(e=>typeof e==`object`?e.key:e).join(`.`):t}] ${e.message}`).join(`; `),issues:e}}var _o=async(e,{options:t,path:n})=>{let r=new Headers,i,{data:a,error:o}=await ho(t,e);if(o)throw new Se(o.message,o.issues);let s=e.headers===void 0?`request`in e&&oo(e.request)?e.request.headers:null:e.headers instanceof Headers?e.headers:new Headers(e.headers),c=s?.get(`cookie`),l=c?lo(c):void 0,u={...e,body:a.body,query:a.query,path:e.path||n||`virtual:`,context:`context`in e&&e.context?e.context:{},returned:void 0,headers:e?.headers,request:e?.request,params:`params`in e?e.params:void 0,method:e.method??(Array.isArray(t.method)?t.method[0]:t.method===`*`?`GET`:t.method),setHeader:(e,t)=>{r.set(e,t)},getHeader:e=>s?s.get(e):null,getCookie:(e,t)=>{let n=co(e,t);return n&&l?.get(n)||null},getSignedCookie:async(e,t,n)=>{let r=co(e,n);if(!r)return null;let i=l?.get(r);if(!i)return null;let a=i.lastIndexOf(`.`);if(a<1)return null;let o=i.substring(0,a),s=i.substring(a+1);return s.length!==44||!s.endsWith(`=`)?null:await Qa(s,o,await Za(t))?o:!1},setCookie:(e,t,n)=>{let i=po(e,t,n);return r.append(`set-cookie`,i),i},setSignedCookie:async(e,t,n,i)=>{let a=await mo(e,t,n,i);return r.append(`set-cookie`,a),a},redirect:e=>(r.set(`location`,e),new L(`FOUND`,void 0,r)),error:(e,t,n)=>new L(e,t,n),setStatus:e=>{i=e},json:(t,n)=>e.asResponse?{body:n?.body||t,routerResponse:n,_flag:`json`}:t,responseHeaders:r,get responseStatus(){return i}};for(let e of t.use||[]){let t=await e({...u,returnHeaders:!0,asResponse:!1});t.response&&Object.assign(u.context,t.response),t.headers&&t.headers.forEach((e,t)=>{u.responseHeaders.set(t,e)})}return u};function vo(e){if(e===void 0)return!1;let t=typeof e;return t===`string`||t===`number`||t===`boolean`||t===null?!0:t===`object`?Array.isArray(e)?!0:e.buffer?!1:e.constructor&&e.constructor.name===`Object`||typeof e.toJSON==`function`:!1}function yo(e){let t=new WeakMap,n=new WeakMap,r=0,i=(e,n)=>{let r=n;for(;r;){if(r===e)return!0;r=t.get(r)}return!1};return JSON.stringify(e,function(e,a){if(typeof a==`bigint`)return a.toString();if(typeof a==`object`&&a){if(i(a,this))return`[Circular ref-${n.get(a)}]`;t.set(a,this),n.has(a)||n.set(a,r++)}return a})}function bo(e){return!e||typeof e!=`object`?!1:`_flag`in e&&e._flag===`json`}var xo=new Set(`host.user-agent.referer.from.expect.authorization.proxy-authorization.cookie.origin.accept-charset.accept-encoding.accept-language.if-match.if-none-match.if-modified-since.if-unmodified-since.if-range.range.max-forwards.connection.keep-alive.transfer-encoding.te.upgrade.trailer.proxy-connection.content-length`.split(`.`));function So(e){for(let t of xo)e.delete(t)}function Co(e,t){if(t)for(let[n,r]of new Headers(t).entries())n.toLowerCase()===`set-cookie`?e.append(n,r):e.set(n,r)}function wo(e,t){if(e instanceof Response){if(t?.headers){let n=new Headers(t.headers);So(n),Co(e.headers,n)}return e}if(bo(e)){let n=e.body,r=e.routerResponse;if(r instanceof Response)return r;let i=new Headers;if(Co(i,r?.headers),Co(i,e.headers),t?.headers){let e=new Headers(t.headers);So(e),Co(i,e)}i.set(`Content-Type`,`application/json`);let a=e.status??t?.status??r?.status,o=t?.statusText??r?.statusText;return new Response(JSON.stringify(n),{...r,headers:i,...a===void 0?{}:{status:a},...o===void 0?{}:{statusText:o}})}if(ro(e))return wo(e.body,{status:t?.status??e.statusCode,statusText:e.status.toString(),headers:t?.headers||e.headers});let n=e,r=new Headers(t?.headers);return So(r),e?typeof e==`string`?(n=e,r.set(`Content-Type`,`text/plain`)):e instanceof ArrayBuffer||ArrayBuffer.isView(e)?(n=e,r.set(`Content-Type`,`application/octet-stream`)):e instanceof Blob?(n=e,r.set(`Content-Type`,e.type||`application/octet-stream`)):e instanceof FormData?n=e:e instanceof URLSearchParams?(n=e,r.set(`Content-Type`,`application/x-www-form-urlencoded`)):e instanceof ReadableStream?(n=e,r.set(`Content-Type`,`application/octet-stream`)):vo(e)&&(n=yo(e),r.set(`Content-Type`,`application/json`)):(e===null&&(n=JSON.stringify(null)),r.set(`content-type`,`application/json`)),new Response(n,{...t,headers:r})}function To(e,t,n){let r=typeof e==`string`?e:void 0,i=typeof t==`object`?t:e,a=typeof t==`function`?t:n;if((i.method===`GET`||i.method===`HEAD`)&&i.body)throw new te(`Body is not allowed with GET or HEAD methods`);if(r&&/\/{2,}/.test(r))throw new te(`Path cannot contain consecutive slashes`);let o=async(...e)=>{let t=e[0]||{},{data:n,error:o}=await ao(_o(t,{options:i,path:r}));if(o)throw o instanceof Se?(i.onValidationError&&await i.onValidationError({message:o.message,issues:o.issues}),new L(400,{message:o.message,code:`VALIDATION_ERROR`})):o;let s=await a(n).catch(async e=>{if(ro(e)){let n=i.onAPIError;if(n&&await n(e),t.asResponse)return e}throw e}),c=n.responseHeaders,l=n.responseStatus;return t.asResponse?wo(s,l===void 0?{headers:c}:{headers:c,status:l}):t.returnHeaders?t.returnStatus?{headers:c,response:s,status:l}:{headers:c,response:s}:t.returnStatus?{response:s,status:l}:s};return o.options=i,o.path=r,o}function Eo(e,t){return[...e??[],...t??[]]}To.create=e=>{function t(...t){if(t.length===3){let[n,r,i]=t;return To(n,{...r,use:Eo(r.use,e?.use)},i)}let[n,r]=t;return To({...n,use:Eo(n.use,e?.use)},r)}return t};function Do(e,t){let n=async n=>{let r=n,i=typeof e==`function`?e:t,a=await _o(r,{options:typeof e==`function`?{}:e,path:`/`});if(!i)throw Error(`handler must be defined`);try{let e=await i(a),t=a.responseHeaders;return r.returnHeaders?{headers:t,response:e}:e}catch(e){throw ro(e)&&Object.defineProperty(e,O,{enumerable:!1,configurable:!0,get(){return a.responseHeaders}}),e}};return n.options=typeof e==`function`?{}:e,n}Do.create=e=>{function t(t,n){if(typeof t==`function`)return Do({use:e?.use},t);if(!n)throw Error(`Middleware handler is required`);return Do({...t,method:`*`,use:[...e?.use||[],...t.use||[]]},n)}return t};var Oo={};function ko(e){switch(e.constructor.name){case`ZodString`:return`string`;case`ZodNumber`:return`number`;case`ZodBoolean`:return`boolean`;case`ZodObject`:return`object`;case`ZodArray`:return`array`;default:return`string`}}function Ao(e){let t=[];return e.metadata?.openapi?.parameters?(t.push(...e.metadata.openapi.parameters),t):(e.query instanceof y&&Object.entries(e.query.shape).forEach(([e,n])=>{n instanceof y&&t.push({name:e,in:`query`,schema:{type:ko(n),...`minLength`in n&&n.minLength?{minLength:n.minLength}:{},description:n.description}})}),t)}function jo(e){if(e.metadata?.openapi?.requestBody)return e.metadata.openapi.requestBody;if(e.body&&(e.body instanceof y||e.body instanceof b)){let t=e.body.shape;if(!t)return;let n={},r=[];return Object.entries(t).forEach(([e,t])=>{t instanceof y&&(n[e]={type:ko(t),description:t.description},t instanceof b||r.push(e))}),{required:e.body instanceof b?!1:!!e.body,content:{"application/json":{schema:{type:`object`,properties:n,required:r}}}}}}function Mo(e){return{400:{content:{"application/json":{schema:{type:`object`,properties:{message:{type:`string`}},required:[`message`]}}},description:`Bad Request. Usually due to missing parameters, or invalid parameters.`},401:{content:{"application/json":{schema:{type:`object`,properties:{message:{type:`string`}},required:[`message`]}}},description:`Unauthorized. Due to missing or invalid authentication.`},403:{content:{"application/json":{schema:{type:`object`,properties:{message:{type:`string`}}}}},description:`Forbidden. You do not have permission to access this resource or to perform this action.`},404:{content:{"application/json":{schema:{type:`object`,properties:{message:{type:`string`}}}}},description:`Not Found. The requested resource was not found.`},429:{content:{"application/json":{schema:{type:`object`,properties:{message:{type:`string`}}}}},description:`Too Many Requests. You have exceeded the rate limit. Try again later.`},500:{content:{"application/json":{schema:{type:`object`,properties:{message:{type:`string`}}}}},description:`Internal Server Error. This is a problem with the server that you cannot fix.`},...e}}async function No(e,t){return Object.entries(e).forEach(([e,t])=>{let n=t.options;if(t.path&&!n.metadata?.SERVER_ONLY&&(n.method===`GET`&&(Oo[t.path]={get:{tags:[`Default`,...n.metadata?.openapi?.tags||[]],description:n.metadata?.openapi?.description,operationId:n.metadata?.openapi?.operationId,security:[{bearerAuth:[]}],parameters:Ao(n),responses:Mo(n.metadata?.openapi?.responses)}}),n.method===`POST`)){let e=jo(n);Oo[t.path]={post:{tags:[`Default`,...n.metadata?.openapi?.tags||[]],description:n.metadata?.openapi?.description,operationId:n.metadata?.openapi?.operationId,security:[{bearerAuth:[]}],parameters:Ao(n),...e?{requestBody:e}:{requestBody:{content:{"application/json":{schema:{type:`object`,properties:{}}}}}},responses:Mo(n.metadata?.openapi?.responses)}}}}),{openapi:`3.1.1`,info:{title:`Better Auth`,description:`API Reference for your Better Auth Instance`,version:`1.1.0`},components:{schemas:{}},security:[{apiKeyCookie:[]}],servers:[{url:t?.url}],tags:[{name:`Default`,description:`Default endpoints that are included with Better Auth by default. These endpoints are not part of any plugin.`}],paths:Oo}}var Po=(e,t)=>`<!doctype html>
 <html>
   <head>
     <title>Scalar API Reference</title>
@@ -53,4 +53,4 @@ import{k as e}from"./react-dom-DtwtyQPy.js";import{Zt as t}from"./core-Dxqe4Tzf.
 	}
 	setTimeout(finish, ${i_});
 })();`,C_;async function w_(e,t){C_??=Vi(`SHA-256`,`base64`).digest(S_);let n=await C_,r=[...new Set(e.map(e=>new URL(e).origin))],i=t.note?`Logged out. ${t.note}`:`Logged out.`,a=e.map(e=>`<iframe hidden src="${m_(e)}"></iframe>`).join(``),o=t.uri?` data-post-logout-redirect-uri="${m_(t.uri)}"`:``,s=t.uri?`<noscript><a href="${m_(t.uri)}">Continue</a></noscript>`:`<noscript><p>${m_(i)}</p></noscript>`;return __(`Signing out`,`<main><p data-oidc-logout-state="pending" data-logged-out-message="${m_(i)}"${o}>Signing out of connected applications&hellip;</p>${s}</main>${a}<script>${S_}<\/script>`,200,{head:t.uri?`<noscript><meta http-equiv="refresh" content="${Math.ceil(i_/1e3)};url=${m_(t.uri)}"></noscript>`:void 0,contentSecurityPolicy:`${g_}; frame-src ${r.join(` `)}; script-src 'sha256-${n}'`})}function T_(e,t){return __(`Logout error`,`<main><h1>Logout error</h1><p data-oidc-logout-state="error">${m_(e)}</p></main>`,t)}function E_(e,t,n,r){if(h_(e))return T_(r,t===`BAD_REQUEST`?400:t===`UNAUTHORIZED`?401:500);throw new L(t,{error:n,error_description:r})}function D_(e){return`${e.context.authCookies.sessionToken.name}${p_}`}function O_(e,t){return{...e.context.authCookies.sessionToken.attributes,httpOnly:!0,maxAge:t,path:y_(e),sameSite:`lax`}}async function k_(e,t,n={}){let r={...t?{sessionId:t}:{},...n,expiresAt:Date.now()+f_*1e3};await e.setSignedCookie(D_(e),JSON.stringify(r),e.context.secret,O_(e,f_))}async function A_(e){let t=await e.getSignedCookie(D_(e),e.context.secret);if(typeof t!=`string`)return null;try{let e=JSON.parse(t);if(typeof e!=`object`||!e)return null;let n=e;return n.sessionId!==void 0&&(typeof n.sessionId!=`string`||n.sessionId.length===0)||n.clientId!==void 0&&(typeof n.clientId!=`string`||n.clientId.length===0)||n.postLogoutRedirectUri!==void 0&&(typeof n.postLogoutRedirectUri!=`string`||n.postLogoutRedirectUri.length===0)||n.state!==void 0&&typeof n.state!=`string`||n.redirectInvalid!==void 0&&typeof n.redirectInvalid!=`boolean`||n.postLogoutRedirectUri!==void 0&&n.clientId===void 0||typeof n.expiresAt!=`number`||!Number.isFinite(n.expiresAt)?null:{...typeof n.sessionId==`string`?{sessionId:n.sessionId}:{},...typeof n.clientId==`string`?{clientId:n.clientId}:{},...typeof n.postLogoutRedirectUri==`string`?{postLogoutRedirectUri:n.postLogoutRedirectUri}:{},...typeof n.state==`string`?{state:n.state}:{},...typeof n.redirectInvalid==`boolean`?{redirectInvalid:n.redirectInvalid}:{},expiresAt:n.expiresAt}}catch{return null}}function j_(e){e.setCookie(D_(e),``,O_(e,0))}async function M_(e){let t=await e.getSignedCookie(e.context.authCookies.sessionToken.name,e.context.secret);if(typeof t!=`string`||t.length===0)return null;try{let n=await e.context.internalAdapter.findSession(t);return n?{session:n.session}:null}catch(t){throw e.context.logger.error(`Failed to read the current logout session`,t),new L(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to read the current session`})}}async function N_(e,t){try{return await e.context.adapter.findOne({model:`session`,where:[{field:`id`,value:t}]})}catch(t){throw e.context.logger.error(`Failed to read the hinted logout session`,t),new L(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to read the hinted session`})}}async function P_(e,t){if(typeof t.token!=`string`||t.token.length===0)throw new L(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to complete logout`});try{await e.context.internalAdapter.deleteSession(t.token)}catch(t){throw e.context.logger.error(`Failed to delete the logout session`,t),new L(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to complete logout`})}}async function F_(e,t,n){try{return await Vl(e,t,n)}catch(t){throw e.context.logger.error(`Failed to resolve the logout client`,t),new L(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Unable to resolve the logout client`})}}function I_(e){return(Array.isArray(e)?e:[e]).filter(e=>typeof e==`string`)}function L_(e){if(typeof e.aud==`string`&&e.aud.length>0)return e.aud;if(typeof e.azp==`string`&&e.azp.length>0)return e.azp;let t=I_(e.aud);return t.length===1?t[0]:null}async function R_(e,t,n,r){if(r)return F_(e,t,r);let i;try{i=Ci(n)}catch{return null}let a=L_(i);return a?F_(e,t,a):null}async function z_(e,t,n,r){try{let i;if(t.disableJwtPlugin){if(!r.clientSecret)return null;let a=await Wl(e,t.storeClientSecret,r.clientSecret),{payload:o}=await wr(n,new TextEncoder().encode(a));i=JSON.parse(new TextDecoder().decode(o))}else{let t=Ml(e.context).options,{payload:r}=await wr(n,yi(await Hc(n,{jwksFetch:t?.jwks?.remoteUrl??`${e.context.baseURL}${t?.jwks?.jwksPath??`/jwks`}`})));i=JSON.parse(new TextDecoder().decode(r))}return i.iss!==Gb(e,t)||!I_(i.aud).includes(r.clientId)||typeof i.sid!=`string`||i.sid.length===0||typeof i.sub!=`string`||i.sub.length===0?null:i}catch{return null}}function B_(e,t,n){if(!t)return{invalid:!1};if(!e.postLogoutRedirectUris?.includes(t))return{invalid:!0};if(!n)return{uri:t,invalid:!1};try{let e=new URL(t);return e.searchParams.set(`state`,n),{uri:e.toString(),invalid:!1}}catch{return{invalid:!0}}}function V_(e,t){return t.post_logout_redirect_uri?B_(e,t.post_logout_redirect_uri,t.state).invalid?{redirectInvalid:!0}:{clientId:e.clientId,postLogoutRedirectUri:t.post_logout_redirect_uri,...t.state===void 0?{}:{state:t.state}}:{}}async function H_(e,t,n){if(n.redirectInvalid)return{invalid:!0};if(!n.clientId||!n.postLogoutRedirectUri)return{invalid:!1};let r=await F_(e,t,n.clientId);return!r||r.disabled||!r.enableEndSession?{invalid:!0}:B_(r,n.postLogoutRedirectUri,n.state)}async function U_(e,t,n={}){return t?h_(e)?(await k_(e,t.session.id,n),b_(e)):E_(e,`BAD_REQUEST`,`invalid_request`,`User confirmation is required to complete logout`):h_(e)?(await k_(e,void 0,n),b_(e)):E_(e,`BAD_REQUEST`,`invalid_request`,`No active session is available for logout`)}var W_=`The requested post-logout redirect was not registered.`;async function G_(e,t){let n=t.invalid?W_:void 0,r=await d_();return r.length>0&&h_(e)?w_(r,{uri:t.uri,note:n}):t.uri?$(e,t.uri):h_(e)?x_(n):null}async function K_(e,t){let n=await A_(e),r=await M_(e);if(!n||n.expiresAt<=Date.now())return E_(e,`BAD_REQUEST`,`invalid_request`,`The logout confirmation is invalid or expired`);let i=await H_(e,t,n);return r?n.sessionId&&n.sessionId!==r.session.id?E_(e,`BAD_REQUEST`,`invalid_request`,`The logout confirmation is invalid or expired`):(await P_(e,r.session),_p(e),j_(e),G_(e,i)):(j_(e),i.uri?$(e,i.uri):h_(e)?x_(i.invalid?W_:void 0):E_(e,`BAD_REQUEST`,`invalid_request`,`No active session is available for logout`))}async function q_(e,t){let n=e.query??{},r=e.body??{},i={...n,...r},a=await M_(e);if(i.id_token_hint===void 0){let n={};if(i.client_id){let r=await F_(e,t,i.client_id);if(!r)return E_(e,`BAD_REQUEST`,`invalid_client`,`The logout client does not exist`);if(r.disabled)return E_(e,`BAD_REQUEST`,`invalid_client`,`The logout client is disabled`);if(!r.enableEndSession)return E_(e,`UNAUTHORIZED`,`invalid_client`,`The client is not allowed to initiate logout`);n=V_(r,i)}return U_(e,a,n)}let o=await R_(e,t,i.id_token_hint,i.client_id);if(!o)return a&&h_(e)?U_(e,a):E_(e,`BAD_REQUEST`,`invalid_client`,`The logout client does not exist`);if(o.disabled)return E_(e,`BAD_REQUEST`,`invalid_client`,`The logout client is disabled`);if(!o.enableEndSession)return E_(e,`UNAUTHORIZED`,`invalid_client`,`The client is not allowed to initiate logout`);let s=await z_(e,t,i.id_token_hint,o);if(!s)return a&&h_(e)?U_(e,a,i.client_id?V_(o,i):{}):E_(e,`UNAUTHORIZED`,`invalid_token`,`The id_token_hint is invalid`);let c=s.sid,l=await N_(e,c),u=a?.session.id===c;if(a&&!u)return U_(e,a,V_(o,i));let d=B_(o,i.post_logout_redirect_uri,i.state),f=l??(u?a?.session:null);return f&&await P_(e,f),u&&_p(e),j_(e),G_(e,d)}async function J_(e,t){return K_(e,t)}function Y_(e,t,n){let r=e.context.baseURL,i=!n?.jwt_disabled;return{scopes_supported:n?.scopes_supported,issuer:Wb(t?.jwt?.issuer??r),authorization_endpoint:`${r}/oauth2/authorize`,token_endpoint:`${r}/oauth2/token`,jwks_uri:n?.jwt_disabled?void 0:t?.jwks?.remoteUrl??`${r}${t?.jwks?.jwksPath??`/jwks`}`,registration_endpoint:n?.dynamic_client_registration_supported?`${r}/oauth2/register`:void 0,introspection_endpoint:`${r}/oauth2/introspect`,revocation_endpoint:`${r}/oauth2/revoke`,response_types_supported:n?.grant_types_supported&&!n.grant_types_supported.includes(`authorization_code`)?[]:[`code`],response_modes_supported:[`query`],grant_types_supported:n?.grant_types_supported??[`authorization_code`,`client_credentials`,`refresh_token`],token_endpoint_auth_methods_supported:n?.token_endpoint_auth_methods_supported??[...n?.public_client_supported?[`none`]:[],`client_secret_basic`,`client_secret_post`,`private_key_jwt`],token_endpoint_auth_signing_alg_values_supported:[...bs],introspection_endpoint_auth_methods_supported:n?.endpoint_auth_methods_supported??[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],introspection_endpoint_auth_signing_alg_values_supported:[...bs],revocation_endpoint_auth_methods_supported:n?.endpoint_auth_methods_supported??[`client_secret_basic`,`client_secret_post`,`private_key_jwt`],revocation_endpoint_auth_signing_alg_values_supported:[...bs],code_challenge_methods_supported:[`S256`],authorization_response_iss_parameter_supported:!0,dpop_signing_alg_values_supported:n?.dpop_signing_alg_values_supported??[...lc],backchannel_logout_supported:i,backchannel_logout_session_supported:i,frontchannel_logout_supported:!0,frontchannel_logout_session_supported:!0}}function X_(e,t){let n=t.disableJwtPlugin?void 0:Ml(e.context).options,r=ul(t),i=t.allowUnauthenticatedClientRegistration||r.length>0;return{jwtPluginOptions:n,clientDiscoveries:r,authMetadata:Y_(e,n,{scopes_supported:t.advertisedMetadata?.scopes_supported??t.scopes,dynamic_client_registration_supported:t.allowDynamicClientRegistration,public_client_supported:i,grant_types_supported:pl(t),token_endpoint_auth_methods_supported:_l(t,{includeNone:i}),endpoint_auth_methods_supported:_l(t),jwt_disabled:t.disableJwtPlugin,dpop_signing_alg_values_supported:t.dpop?.signingAlgorithms})}}function Z_(e,t){let{clientDiscoveries:n,authMetadata:r}=X_(e,t);return bl(e,t,`oauth-authorization-server`,{...Hl(n),...r})}function Q_(e,t){let n=e.context.baseURL,{jwtPluginOptions:r,clientDiscoveries:i,authMetadata:a}=X_(e,t),o={...a,claims_supported:Lm(t),claims_parameter_supported:!0,userinfo_endpoint:`${n}/oauth2/userinfo`,subject_types_supported:t.pairwiseSecret?[`public`,`pairwise`]:[`public`],acr_values_supported:km(t),id_token_signing_alg_values_supported:(()=>{if(t.disableJwtPlugin)return[`HS256`];let e=r?.jwks?.keyPairConfig?.alg??`EdDSA`,n=r?.jwks?.keyPairConfigs?.map(e=>e.alg)??[];return Array.from(new Set([e,...n]))})(),end_session_endpoint:`${n}/oauth2/end-session`,request_parameter_supported:!1,request_uri_parameter_supported:!1,prompt_values_supported:[`login`,`consent`,`create`,`select_account`,`none`]};return bl(e,t,`openid-configuration`,{...Hl(i),...o})}var $_=`public, max-age=15, stale-while-revalidate=15, stale-if-error=86400`;function ev(e,t){let n=new Headers(t);return n.has(`Cache-Control`)||n.set(`Cache-Control`,$_),n.set(`Content-Type`,`application/json`),new Response(JSON.stringify(e),{status:200,headers:n})}function tv(e,t,n){let{redirectOnError:r,onValidationError:i,errorCodesByField:a,defaultError:o=`invalid_request`,formParams:s,...c}=t;if(!r&&!s){let t=c.metadata?.noStore===!0;return X(e,{...c,onValidationError:async e=>{throw i&&await i(e),new L(`BAD_REQUEST`,nv(e.issues,a,o),t?Iu:void 0)}},n)}let{body:l,query:u,...d}=c;s&&(d.cloneRequest=!0);async function f(e,t,n){if(!n)return{ok:!0};let s=await n.safeParseAsync(e[t]??{});if(s.success)return e[t]=s.data,{ok:!0};i&&await i({message:s.error.message,issues:s.error.issues});let c=nv(s.error.issues,a,o);if(!r)throw new L(`BAD_REQUEST`,c);return{ok:!1,response:r({...c,ctx:e})}}return X(e,d,async e=>{let t=s&&e.request?await eu(e.request):void 0;t&&(e.body=tu(t,e.body??{},s?.repeatable));let r=await f(e,`body`,l);if(!r.ok)return r.response;let i=await f(e,`query`,u);return i.ok?n(e):i.response})}function nv(e,t,n=`invalid_request`){let r=e[0];if(!r)return{error:n,error_description:`Invalid request.`};let i=r.path?.[0],a=typeof i==`string`?i:void 0,o=a?t?.[a]:void 0,s=r.path?.length?g(r.path):``,c=iv(r);return{error:rv(r,c,o,n),error_description:ov(c??r,s)}}function rv(e,t,n,r){return typeof n==`string`?n:av(e)?n?.missing??r:t?n?.invalid??r:r}function iv(e){if(e.code===`invalid_value`||e.code===`custom`)return e;if(e.code===`invalid_union`)for(let t of e.errors){let e=t.find(e=>e.code===`custom`);if(e)return e}}function av(e){return e.code===`invalid_type`&&e.message.endsWith(`received undefined`)}function ov(e,t){if(!t)return e.message;if(e.code===`invalid_type`)return e.message.endsWith(`received undefined`)?`${t} is required`:e.message.endsWith(`received array`)?`${t} must not appear more than once`:`${t} must be a ${e.expected??`valid value`}`;if(e.code===`invalid_value`){let n=e.values;if(Array.isArray(n)&&n.length>0)return`${t} must be one of: ${n.join(`, `)}`}return`${t}: ${e.message}`}var sv=e=>zu(async t=>{if(!e.allowPublicClientPrelogin)throw new z(`BAD_REQUEST`);let n=t.body.oauth_query;if(!await zl(n,t.context.secret))throw new z(`UNAUTHORIZED`,{error:`invalid_signature`})}),cv={"P-256":`ES256`,"P-384":`ES384`,"P-521":`ES512`},lv=[`Ed25519`],uv=[`d`,`p`,`q`,`dp`,`dq`,`qi`,`oth`];function dv(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function fv(e,t){return typeof e[t]==`string`&&e[t].length>0}function pv(e){return typeof e==`string`&&Object.prototype.hasOwnProperty.call(cv,e)}function mv(e){return lv.some(t=>t===e)}function hv(e){switch(e.kty){case`RSA`:return fv(e,`n`)&&fv(e,`e`);case`EC`:return pv(e.crv)&&fv(e,`x`)&&fv(e,`y`);case`OKP`:return mv(e.crv)&&fv(e,`x`);default:return!1}}function gv(e){if(e.alg===void 0)return!0;if(typeof e.alg!=`string`||!bs.some(t=>t===e.alg))return!1;switch(e.kty){case`RSA`:return e.alg.startsWith(`RS`)||e.alg.startsWith(`PS`);case`EC`:return pv(e.crv)&&cv[e.crv]===e.alg;case`OKP`:return mv(e.crv)&&e.alg===`EdDSA`;default:return!1}}function _v(e){let t=dv(e)&&Array.isArray(e.keys)?e.keys:void 0;if(!t?.length)return{valid:!1,error:`jwks must be an RFC 7517 JWK Set object with a non-empty keys array`};for(let e of t){if(!dv(e))return{valid:!1,error:`jwks keys must be supported public JWKs with required key parameters`};if(e.kty===`oct`||`k`in e||uv.some(t=>t in e))return{valid:!1,error:`jwks must contain only public asymmetric keys`};if(!hv(e))return{valid:!1,error:`jwks keys must be supported public JWKs with required key parameters`};if(!gv(e))return{valid:!1,error:`jwks key alg must be supported for private_key_jwt and compatible with its key type and signing curve`}}return{valid:!0,jwks:{keys:t}}}function vv(e){let t=_v(e);if(!t.valid)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:t.error})}async function yv(e,t,n,r,i){if(!t)throw new z(`UNAUTHORIZED`);if(!e.headers)throw new z(`BAD_REQUEST`);if(r===`configure-client-credentials-scopes`&&!n.clientPrivileges||n.clientPrivileges&&!await n.clientPrivileges({headers:e.headers,action:r,session:t.session,user:t.user,clientId:i}))throw new z(`UNAUTHORIZED`)}async function bv(e,t,n,r,i){if(!t)throw new z(`UNAUTHORIZED`);if(!e.headers)throw new z(`BAD_REQUEST`);if(n.resourcePrivileges&&!await n.resourcePrivileges({headers:e.headers,action:r,session:t.session,user:t.user,resourceId:i}))throw new z(`UNAUTHORIZED`)}var xv=De({consumeClientAssertion:()=>Bv,isPrivateHostname:()=>Mv,verifyClientAssertion:()=>Vv}),Sv=new WeakMap,Cv=3e5,wv=500,Tv=5e3,Ev=65536,Dv=/^application\/(?:[-\w.]+\+)?json\s*(?:;|$)/i;function Ov(e,t,n,r){if(e.set(t,{jwks:n,fetchedAt:r}),e.size>wv){let t=e.keys().next().value;t!==void 0&&e.delete(t)}}function kv(e){let t=Sv.get(e);if(t)return t;let n=new Map;return Sv.set(e,n),n}function Av(e){return`${e.clientDiscoveryId??`managed`}:${e.jwksUri??``}`}var jv=[...bs];function Mv(e){return!Kp(e)}function Nv(e,t,n){let r=new URL(t);if(r.protocol!==`https:`)throw new L(`BAD_REQUEST`,{error_description:`jwks_uri must use HTTPS`,error:`invalid_client`});if(r.username||r.password)throw new L(`BAD_REQUEST`,{error_description:`jwks_uri must not contain credentials`,error:`invalid_client`});if(t.includes(`#`))throw new L(`BAD_REQUEST`,{error_description:`jwks_uri must not include a fragment component`,error:`invalid_client`});if(Mv(r.hostname))throw new L(`BAD_REQUEST`,{error_description:`jwks_uri must not point to a private or reserved address`,error:`invalid_client`});if(!(n&&r.origin===n)&&!e.context.isTrustedOrigin(r.href))throw new L(`BAD_REQUEST`,{error_description:`client jwks_uri is not trusted`,error:`invalid_client`})}function Pv(e){try{let t=new URL(e);return t.protocol!==`https:`&&t.protocol!==`http:`?void 0:t.origin}catch{return}}async function Fv(e){let t=e.headers.get(`content-length`);if(t!==null&&Number.isFinite(Number(t))&&Number(t)>Ev)throw await e.body?.cancel(),Error(`JWKS response exceeds 64 KiB`);if(!e.body)return``;let n=e.body.getReader(),r=[],i=0;for(;;){let{done:e,value:t}=await n.read();if(e)break;if(i+=t.byteLength,i>Ev)throw await n.cancel(),Error(`JWKS response exceeds 64 KiB`);r.push(t)}let a=new Uint8Array(i),o=0;for(let e of r)a.set(e,o),o+=e.byteLength;return new TextDecoder().decode(a)}async function Iv(e,t=globalThis.fetch){let n=new AbortController,r=setTimeout(()=>n.abort(),Tv);try{let r=await t(e,{signal:n.signal,headers:{accept:`application/json`},redirect:`error`});if(r.redirected)throw Error(`JWKS fetch redirected`);if(r.status!==200)throw Error(`JWKS fetch returned ${r.status}`);let i=r.headers.get(`content-type`);if(!i||!Dv.test(i))throw Error(`JWKS response must use a JSON media type`);let a=await Fv(r),o;try{o=JSON.parse(a)}catch{return{valid:!1}}let s=_v(o);return s.valid?{valid:!0,jwks:s.jwks}:{valid:!1}}finally{clearTimeout(r)}}function Lv(){return new L(`BAD_REQUEST`,{error_description:`failed to fetch client JWKS`,error:`invalid_client`})}async function Rv(e,t,n){if(n.jwks)return JSON.parse(n.jwks);if(!n.jwksUri)throw new L(`BAD_REQUEST`,{error_description:`client has no JWKS configured`,error:`invalid_client`});let r=n.clientDiscoveryId?ul(t).find(e=>e.id===n.clientDiscoveryId):void 0;if(n.clientDiscoveryId&&!r?.fetchClientMetadataResource)throw new L(`BAD_REQUEST`,{error_description:`client discovery does not provide a metadata resource transport`,error:`invalid_client`});Nv(e,n.jwksUri,n.clientDiscoveryId?Pv(n.clientId):void 0);let i=Date.now(),a=Av(n),o=kv(t),s=o.get(a);if(s&&i-s.fetchedAt<Cv)return s.jwks;let c;try{c=await Iv(n.jwksUri,r?.fetchClientMetadataResource)}catch{let e=Cv*2;if(s&&i-s.fetchedAt<e)return s.jwks;throw Lv()}if(!c.valid)throw Lv();return Ov(o,a,c.jwks,i),c.jwks}async function zv(e,t){if(!t.jwksUri)return null;let n=t.clientDiscoveryId?ul(e).find(e=>e.id===t.clientDiscoveryId):void 0;if(t.clientDiscoveryId&&!n?.fetchClientMetadataResource)return null;try{let r=await Iv(t.jwksUri,n?.fetchClientMetadataResource);return r.valid?(Ov(kv(e),Av(t),r.jwks,Date.now()),r.jwks):null}catch{return null}}async function Bv(e,t,n){let{namespace:r,payload:i,expectedAudience:a}=n;if(!(Array.isArray(i.aud)?i.aud:i.aud==null?[]:[i.aud]).includes(a))throw new L(`BAD_REQUEST`,{error_description:`client assertion aud does not match the endpoint`,error:`invalid_client`});let o=t.assertionMaxLifetime??300,s=Math.floor(Date.now()/1e3);if(typeof i.exp!=`number`)throw new L(`BAD_REQUEST`,{error_description:`client assertion must include exp claim`,error:`invalid_client`});if(i.exp<=s)throw new L(`BAD_REQUEST`,{error_description:`client assertion has expired`,error:`invalid_client`});if(i.exp-s>o)throw new L(`BAD_REQUEST`,{error_description:`client assertion exp is too far in the future (max ${o}s)`,error:`invalid_client`});if(typeof i.iat==`number`&&s-i.iat>o)throw new L(`BAD_REQUEST`,{error_description:`client assertion iat is too far in the past (max ${o}s)`,error:`invalid_client`});if(typeof i.jti!=`string`||i.jti.length===0)throw new L(`BAD_REQUEST`,{error_description:`client assertion must include jti claim`,error:`invalid_client`});let c=await Vi(`SHA-256`).digest(new TextEncoder().encode(`${r}:${i.jti}`)),l=ye(new Uint8Array(c).slice(0,24),e.context.options);try{await e.context.adapter.create({model:`oauthClientAssertion`,data:{id:l,expiresAt:new Date(i.exp*1e3)},forceAllowId:!0})}catch(t){let n=!1;try{n=!!await e.context.adapter.findOne({model:`oauthClientAssertion`,where:[{field:`id`,value:l}]})}catch{}throw n?new L(`BAD_REQUEST`,{error_description:`client assertion jti has already been used`,error:`invalid_client`}):t}}async function Vv(e,t,n,r,i,a,o){if(r!==`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`)throw new L(`BAD_REQUEST`,{error_description:`unsupported client_assertion_type`,error:`invalid_client`});let s;try{s=Si(n)}catch{throw new L(`BAD_REQUEST`,{error_description:`malformed client assertion: invalid JWT header`,error:`invalid_client`})}if(!s.alg||!jv.includes(s.alg))throw new L(`BAD_REQUEST`,{error_description:`unsupported assertion signing algorithm: ${s.alg}`,error:`invalid_client`});let c;try{c=Ci(n)}catch{throw new L(`BAD_REQUEST`,{error_description:`malformed client assertion: invalid JWT payload`,error:`invalid_client`})}let l=c.sub??c.iss;if(!l)throw new L(`BAD_REQUEST`,{error_description:`client assertion must contain sub or iss claim identifying the client`,error:`invalid_client`});if(i&&i!==l)throw new L(`BAD_REQUEST`,{error_description:`client_id in body does not match assertion sub/iss`,error:`invalid_client`});let u=await Vl(e,t,l);if(!u)throw new L(`BAD_REQUEST`,{error_description:`client not found`,error:`invalid_client`});if(u.disabled)throw new L(`BAD_REQUEST`,{error_description:`client is disabled`,error:`invalid_client`});if(u.tokenEndpointAuthMethod!==`private_key_jwt`)throw new L(`BAD_REQUEST`,{error_description:`client is not registered for private_key_jwt authentication`,error:`invalid_client`});o?.assertClient?.(u);let d=await Rv(e,t,u),f=a??`${e.context.baseURL}/oauth2/token`,p=Gb(e,t),m=o?.endpointAudienceOnly?[f]:[...new Set([f,p])],h={issuer:l,subject:l,audience:m,algorithms:jv},g;try{({payload:g}=await Gr(n,yi(d),h))}catch(e){if(e instanceof Error&&/no matching key|no applicable key/i.test(e.message)){let e=await zv(t,u);if(e)try{({payload:g}=await Gr(n,yi(e),h))}catch{throw new L(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}else throw new L(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}else throw new L(`UNAUTHORIZED`,{error_description:`client assertion signature verification failed`,error:`invalid_client`})}let _=(Array.isArray(g.aud)?g.aud:[g.aud]).find(e=>typeof e==`string`&&m.includes(e));return await Bv(e,t,{namespace:`private_key_jwt:${l}`,payload:g,expectedAudience:_}),{clientId:l,client:u}}function Hv(e,t,n){return new L(e,{error:t,error_description:n},{"WWW-Authenticate":`Bearer error="${t}"`,...Iu})}async function Uv(e,t,n){let r=e.headers,i;try{i=kl(r?.get(`authorization`))}catch{throw Hv(`BAD_REQUEST`,`invalid_request`,`Malformed initial access token Authorization header`)}if(!i||!r)return;if(!t.validateInitialAccessToken)throw Hv(`UNAUTHORIZED`,`invalid_token`,`Invalid initial access token`);let a;try{a=await t.validateInitialAccessToken({initialAccessToken:i,headers:r,clientMetadata:n})}catch(e){throw e instanceof L?e:new L(`INTERNAL_SERVER_ERROR`,{error:`server_error`,error_description:`Initial access token validation failed`})}if(!a)throw Hv(`UNAUTHORIZED`,`invalid_token`,`Invalid initial access token`);return a}var Wv=[`authorization_code`];function Gv(e){return[...new Set([...e.clientRegistrationDefaultScopes??e.scopes??[],...e.clientRegistrationAllowedScopes??[]])]}function Kv(e){let t=e.grant_types??[...Wv];if(t.length>0)return t;throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`grant_types must contain at least one grant type`})}function qv(e,t){return e.response_types?e.response_types:t.includes(`authorization_code`)?[`code`]:void 0}function Jv(e,t){let n=new Set(pl(e)),r=t.filter(e=>n.has(e));if(r.length===0)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`no mutually supported grant_type among ${t.join(`, `)}`});return r}function Yv(e,t=`web`){let n=Kv(e);return{...e,token_endpoint_auth_method:e.token_endpoint_auth_method??`client_secret_basic`,application_type:e.application_type??(t===null?void 0:t),grant_types:n,response_types:qv(e,n)}}function Xv(e){let t=new URL(e);return t.protocol!==`http:`&&t.protocol!==`https:`&&t.host!==``}function Zv(e){try{let t=new URL(e).protocol;return t!==`http:`&&t!==`https:`}catch{return!1}}function Qv(e,t){let n=e.clientRegistrationDefaultApplicationType??`web`;return n===`infer`?(t.redirect_uris??[]).some(e=>Zv(e)||ty(e))?`native`:`web`:n}function $v(e){throw new z(`BAD_REQUEST`,{error:`invalid_redirect_uri`,error_description:e})}function ey(e){let t=/^http:\/\/([^/?#]*)/i.exec(e)?.[1];if(!t)return null;let n=t.slice(t.lastIndexOf(`@`)+1);if(n.startsWith(`[`)){let e=n.indexOf(`]`);return e<0?null:n.slice(0,e+1).toLowerCase()}return(n.split(`:`)[0]??``).toLowerCase()}function ty(e){let t=ey(e);return t===`localhost`||t===`127.0.0.1`||t===`[::1]`}function ny(e,t){let n=new Set([...e.clientRegistrationDefaultResources??[],...e.clientRegistrationAllowedResources??[]]);for(let e of t)if(!n.has(e))throw new z(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${e} is not allowed for client registration`})}async function ry(e,t,n){let r=t.clientRegistrationDefaultResources??[],i=[...new Set([...r,...n])];for(let n of i){let r=await mh(e,t,n);if(!r)throw new z(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} does not exist`});if(r.disabled)throw new z(`BAD_REQUEST`,{error:`invalid_target`,error_description:`requested resource ${n} is disabled`})}return i}function iy(e,t){let n;try{n=new URL(e)}catch{$v(`redirect URI must be an absolute URI: ${e}`)}(e.includes(`#`)||n.username.length>0||n.password.length>0)&&$v(`redirect URI must not include credentials or a fragment: ${e}`);let r=n.protocol===`http:`,i=n.protocol===`https:`;/^localhost\.+$/i.test(n.hostname)&&$v(`redirect URI localhost must not include trailing dots: ${e}`);let a=Wp(n.hostname)||n.hostname===`localhost`;t===`web`?(!i||a)&&$v(`web clients require https redirect URIs on non-loopback hosts: ${e}`):i?a&&$v(`native clients must not use https loopback redirect URIs: ${e}`):r?ty(e)||$v(`native clients may use http only on the exact loopback hosts localhost, 127.0.0.1, or [::1]: ${e}`):om(n)||$v(`native private-use redirect URI schemes must not use a reserved scheme; they must be an authority-free reverse-domain URI or a custom-scheme URI with a host and a path: ${e}`)}function ay(e,t){let n=t=>{throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`${e} ${t}`})},r;try{r=new URL(t)}catch{return n(`must be an absolute URL`)}t.includes(`#`)&&n(`must not include a fragment component`),r.protocol!==`https:`&&n(`must use https`),(r.username||r.password)&&n(`must not contain credentials`),Mv(r.hostname)&&n(`must not point to a private or reserved address`)}var oy=new Set(Object.keys(Zm.shape));function sy(e,t){return{body:Object.fromEntries(Object.entries(e).filter(([e])=>oy.has(e))),metadata:cy(e,t)}}function cy(e,t){let n=El(t),r=Object.fromEntries(Object.entries(e).filter(([e])=>n.has(e)));return Object.keys(r).length?r:void 0}async function ly(e,t){let{body:n,metadata:r}=sy(e.body,t);if(!t.allowDynamicClientRegistration)throw new z(`FORBIDDEN`,{error:`access_denied`,error_description:`Client registration is disabled`});let i=await Z(e),a=i?void 0:await Uv(e,t,n),o=!!a;if(!(i||o||t.allowUnauthenticatedClientRegistration))throw new z(`UNAUTHORIZED`,{error_description:`Authentication required for client registration`},{"WWW-Authenticate":`Bearer`,...Iu});let s=n.grant_types?.length?Jv(t,n.grant_types):n.grant_types,c=n.grant_types?.includes(`authorization_code`)&&!s?.includes(`authorization_code`),l={...n,grant_types:s,response_types:c?void 0:n.response_types};if(!i&&!o&&l.grant_types?.includes(`client_credentials`))throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`client_credentials grant requires authenticated registration`});let u=Array.isArray(n.resources)?n.resources.filter(e=>typeof e==`string`&&e.length>0):[];i&&await yv(e,i,t,`create`);let d=a?.referenceId??(i&&t.clientReference?await t.clientReference({user:i.user,session:i.session}):void 0),f=Ah(a?.clientCredentialsScopes??[]);jh(f,Kv(l),l.token_endpoint_auth_method,t);let p=await gy(e,t,{metadata:{...l,metadata:r},registrationSource:`dynamic`,userId:d?void 0:i?.session.userId,referenceId:d,requestedResources:u,clientCredentialsScopes:f});return e.setStatus(201),e.json(p)}async function uy(e,t,n){let r=n?.registrationSource===`clientMetadataDocument`,i=Yv(e,r?null:n?.registrationSource===`dynamic`?Qv(t,e):`web`),a=i.token_endpoint_auth_method??`client_secret_basic`;if(!new Set(_l(t,{includeNone:!0})).has(a))throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`unsupported token_endpoint_auth_method ${a}`});if(i.dpop_bound_access_tokens!==void 0&&typeof i.dpop_bound_access_tokens!=`boolean`)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`dpop_bound_access_tokens must be a boolean`});let o=i.grant_types??[],s=i.response_types,c=i.application_type;if(c!==void 0&&c!==`web`&&c!==`native`)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`application_type must be web or native`});if(o.includes(`authorization_code`)&&(!i.redirect_uris||i.redirect_uris.length===0))throw new z(`BAD_REQUEST`,{error:`invalid_redirect_uri`,error_description:`Redirect URIs are required for authorization_code and implicit grant types`});for(let e of i.redirect_uris??[])iy(e,c??(r?`native`:`web`));if(r)Jv(t,o);else{let e=new Set(pl(t));for(let t of o)if(!e.has(t))throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`unsupported grant_type ${t}`})}if(o.includes(`authorization_code`)&&!s?.includes(`code`))throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`When 'authorization_code' grant type is used, 'code' response type must be included`});if(!o.includes(`authorization_code`)&&s?.includes(`code`))throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`When 'code' response type is used, 'authorization_code' grant type must be included`});if(i.subject_type!==void 0){if(i.subject_type!==`public`&&i.subject_type!==`pairwise`)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`subject_type must be "public" or "pairwise"`});if(i.subject_type===`pairwise`&&!t.pairwiseSecret)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise subject_type requires server pairwiseSecret configuration`});if(i.subject_type===`pairwise`&&i.redirect_uris?.some(Xv))throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise clients cannot use custom-scheme redirect URIs that include a host`});if(i.subject_type===`pairwise`&&i.redirect_uris&&i.redirect_uris.length>1&&new Set(i.redirect_uris.map(e=>new URL(e).host)).size>1)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pairwise clients with redirect_uris on different hosts require a sector_identifier_uri, which is not yet supported. All redirect_uris must share the same host.`})}let l=(i?.scope)?.split(` `).filter(e=>e.length),u=n?.registrationSource===`dynamic`||n?.registrationSource===`clientMetadataDocument`,d=u?Gv(t):t.scopes;if(d){let e=new Set(d);for(let t of l??[])if(!e?.has(t))throw new z(`BAD_REQUEST`,{error:`invalid_scope`,error_description:`cannot request scope ${t}`})}if(u&&i.require_pkce===!1)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`pkce is required for registered clients.`});if(i.jwks||i.jwks_uri){if(i.jwks&&i.jwks_uri)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks and jwks_uri are mutually exclusive`});if(i.jwks_uri)try{let e=new URL(i.jwks_uri);if(e.protocol!==`https:`)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must use HTTPS`});if(e.username||e.password)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not contain credentials`});if(i.jwks_uri.includes(`#`))throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not include a fragment component`});if(Mv(e.hostname))throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must not point to a private or reserved address`});if(n?.ctx&&!n.ctx.context.isTrustedOrigin(e.href)){let t=typeof i.client_id==`string`?i.client_id:void 0;if(!(r&&t!==void 0&&URL.canParse(t)&&new URL(t).origin===e.origin))throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must belong to a trusted origin or the Client ID Metadata Document origin`})}}catch(e){throw e instanceof z?e:new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`jwks_uri must be a valid URL`})}i.jwks&&vv(i.jwks)}if(a===`private_key_jwt`&&!i.jwks&&!i.jwks_uri)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`private_key_jwt requires either jwks or jwks_uri`});if(i.backchannel_logout_uri!==void 0){if(t.disableJwtPlugin)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`backchannel_logout_uri requires the jwt plugin (disableJwtPlugin must be false)`});ay(`backchannel_logout_uri`,i.backchannel_logout_uri)}if(i.frontchannel_logout_uri!==void 0){let e;try{e=new URL(i.frontchannel_logout_uri)}catch{throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`frontchannel_logout_uri must be an absolute URL`})}if(i.frontchannel_logout_uri.includes(`#`))throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`frontchannel_logout_uri must not include a fragment component`});if(e.username||e.password)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`frontchannel_logout_uri must not contain credentials`});let t=e.protocol===`https:`||e.protocol===`http:`,n=(i.redirect_uris??[]).some(t=>{try{return new URL(t).origin===e.origin}catch{return!1}});if(!t||!n)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`frontchannel_logout_uri must use the scheme, host, and port of a registered redirect_uri`})}n?.skipExtensionValidation||await Dl(t,i,e.metadata)}var dy=Symbol(`client-registration-collision`);function fy(e){if(!e||typeof e!=`object`)return!1;let t=e;return t[dy]===!0&&(t.kind===`oauth-client-row-unique`||t.kind===`oauth-client-resource-link-unique`)&&`cause`in t}async function py(e,t,n){let r=n.registrationSource===`dynamic`&&!n.metadata.scope?{...n.metadata,scope:(t.clientRegistrationDefaultScopes??t.scopes)?.join(` `)}:n.metadata,i=Yv(r,n.registrationSource===`clientMetadataDocument`?null:n.registrationSource===`dynamic`?Qv(t,r):`web`),a=i.token_endpoint_auth_method===`none`,o=i.token_endpoint_auth_method===`private_key_jwt`,s=vl(t,i.token_endpoint_auth_method);await uy(i,t,{registrationSource:n.registrationSource,ctx:e,skipExtensionValidation:n.registrationSource===`clientMetadataDocument`&&!!n.existingClient});let c=n.clientId??t.generateClientId?.()??zi(32,`a-z`,`A-Z`),l=a||o||s?void 0:t.generateClientSecret?.()||zi(32,`a-z`,`A-Z`),u=l?await Kl(e,t,l):void 0,d=n.registrationSource===`dynamic`&&!a&&t.clientRegistrationRequirePKCE===!1,f=i.require_pkce??(!d&&void 0),p=Math.floor(Date.now()/1e3),{resources:m,...h}=n.registrationSource===`dynamic`||n.registrationSource===`clientMetadataDocument`?{...i,scope:Gv(t).join(` `)}:i,g=n.registrationSource===`clientMetadataDocument`?void 0:{userId:n.userId,referenceId:n.referenceId},_=Cy({...h,redirect_uris:i.redirect_uris??[],disabled:void 0,client_secret_expires_at:u?n.registrationSource===`dynamic`&&t.clientRegistrationClientSecretExpiration?lm(t.clientRegistrationClientSecretExpiration,p):0:void 0,client_id:c,client_secret:u,client_id_issued_at:p,require_pkce:f,user_id:g?.referenceId?void 0:g?.userId,reference_id:g?.referenceId});_.clientCredentialsScopes=n.registrationSource===`clientMetadataDocument`?[]:n.clientCredentialsScopes??[],_.clientDiscoveryId=n.registrationSource===`clientMetadataDocument`?n.clientDiscoveryId:null,_.sectorIdentifier=hu(c,i.redirect_uris),n.registrationSource===`clientMetadataDocument`&&i.application_type===void 0&&(_.applicationType=null);let v=n.registrationSource===`clientMetadataDocument`?[]:n.requestedResources??[];n.registrationSource===`dynamic`&&ny(t,v);let y=await ry(e,t,v),b=t.schema?.oauthClient?.modelName??`oauthClient`,x=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,S=n.registrationSource===`clientMetadataDocument`?n.existingClient:void 0,C=n.registrationSource===`clientMetadataDocument`?n.clientDiscoveryId:null,w=await Ud(e.context.adapter,async()=>{let r=await Vd(e.context.adapter),a,o=!1;if(S){let e;if(Tl(t)){let n=El(t),a=Xc(yy(n,(await r.findOne({model:b,where:[{field:`clientId`,value:c}]}))?.metadata,i.metadata));await Dl(t,i,a),n.size>0&&(e=a&&Object.keys(a).length>0?JSON.stringify(a):null)}let{clientCredentialsScopes:n,disabled:o,skipConsent:s,enableEndSession:l,...u}=_,d=await r.update({model:b,where:[{field:`clientId`,value:c},{field:`clientDiscoveryId`,value:C}],update:{...u,metadata:e,sectorIdentifier:S.sectorIdentifier?_.sectorIdentifier:null,createdAt:S.createdAt,updatedAt:new Date(p*1e3)}});if(!d)throw new z(`BAD_REQUEST`,{error:`invalid_client`,error_description:`client no longer exists`});a=d}else{try{a=await r.create({model:b,data:{..._,createdAt:new Date(p*1e3),updatedAt:new Date(p*1e3)}})}catch(e){throw n.registrationSource===`clientMetadataDocument`&&xy(e)?{[dy]:!0,kind:`oauth-client-row-unique`,clientId:c,cause:e}:e}o=!0}let s=y.length===0?[]:await r.findMany({model:x,where:[{field:`clientId`,value:c}]}),l=new Set(s.map(e=>e.resourceId)),u=new Date;for(let e of y)if(!l.has(e))try{await r.create({model:x,data:{clientId:c,resourceId:e,createdAt:u}})}catch(t){throw n.registrationSource===`clientMetadataDocument`&&xy(t)?{[dy]:!0,kind:`oauth-client-resource-link-unique`,clientId:c,resourceId:e,cause:t}:t}return{client:a,created:o}});return{client:w.client,clientSecret:l,resources:y,created:w.created}}function my(e,t){let n=wy({...e.client,clientSecret:e.clientSecret?(t.prefix?.clientSecret??``)+e.clientSecret:void 0});return e.resources.length>0&&(n.resources=e.resources),n}function hy(e,t){return{...my(e,t),client_credentials_scopes:[...e.client.clientCredentialsScopes??[]]}}async function gy(e,t,n){return my(await py(e,t,n),t)}async function _y(e,t,n){return hy(await py(e,t,n),t)}function vy(e,t){if(e&&e.clientDiscoveryId!==t)throw new z(`BAD_REQUEST`,{error:`invalid_client`,error_description:`client_id is already owned by a different registration source`})}function yy(e,t,n){let r=([t])=>e.has(t),i={...Object.fromEntries(Object.entries(du(t)??{}).filter(e=>!r(e))),...Object.fromEntries(Object.entries(n??{}).filter(r))};return Object.keys(i).length?i:void 0}async function by(e,t,n){if(vy(n.existingClient,n.clientDiscoveryId),n.metadata.backchannel_logout_uri!==void 0||n.metadata.backchannel_logout_session_required!==void 0)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`Client ID Metadata Documents cannot register a back-channel logout target`});if((n.metadata.token_endpoint_auth_method??`none`)!==`none`&&n.metadata.token_endpoint_auth_method!==`private_key_jwt`)throw new z(`BAD_REQUEST`,{error:`invalid_client_metadata`,error_description:`Client ID Metadata Document clients cannot use a shared secret`});let r=e=>({...n,existingClient:e,metadata:{...n.metadata,metadata:cy(n.metadata,t),token_endpoint_auth_method:n.metadata.token_endpoint_auth_method??`none`,client_secret:void 0,client_secret_expires_at:void 0},registrationSource:`clientMetadataDocument`});try{return await py(e,t,r(n.existingClient))}catch(i){if(!fy(i))throw i;let a=t.schema?.oauthClient?.modelName??`oauthClient`,o=t.schema?.oauthClientResource?.modelName??`oauthClientResource`,s=await e.context.adapter.findOne({model:a,where:[{field:`clientId`,value:n.clientId}]});if(i.clientId!==n.clientId||!s||s.clientDiscoveryId!==n.clientDiscoveryId||i.kind===`oauth-client-resource-link-unique`&&!await e.context.adapter.findOne({model:o,where:[{field:`clientId`,value:i.clientId},{field:`resourceId`,value:i.resourceId}]}))throw i.cause;try{return await py(e,t,r(s))}catch(e){throw fy(e)?e.cause:e}}}function xy(e){if(!e||typeof e!=`object`)return!1;let t=e,n=String(t.code??t.errno??``);return[`1062`,`11000`,`23505`,`ER_DUP_ENTRY`,`P2002`,`SQLITE_CONSTRAINT_UNIQUE`].includes(n)||t.name===`MongoServerError`&&t.code===11e3?!0:typeof t.message==`string`&&/(?:duplicate|unique constraint|unique key)/i.test(t.message)}async function Sy(e,t,n){let r=await Z(e);if(await yv(e,r,t,`create`),!r)throw new z(`UNAUTHORIZED`);let i=t.clientReference?await t.clientReference({user:r.user,session:r.session}):void 0,{client_credentials_scopes:a,...o}=e.body,s=n?.admin?Ah(a??[]):[];jh(s,Kv(o),o.token_endpoint_auth_method,t),s.length>0&&await yv(e,r,t,`configure-client-credentials-scopes`);let c=n?.admin?o.resources:void 0;for(let n of new Set(c??[]))await bv(e,r,t,`link`,n);let l={metadata:o,registrationSource:`managed`,userId:i?void 0:r.session.userId,referenceId:i,clientCredentialsScopes:s,...c?{requestedResources:c}:{}},u=n?.admin?await _y(e,t,l):await gy(e,t,l);return e.setStatus(201),e.json(u)}function Cy(e){let{client_id:t,client_secret:n,client_secret_expires_at:r,scope:i,user_id:a,client_id_issued_at:o,client_name:s,client_uri:c,logo_uri:l,contacts:u,tos_uri:d,policy_uri:f,jwks:p,jwks_uri:m,software_id:h,software_version:g,software_statement:_,redirect_uris:v,post_logout_redirect_uris:y,backchannel_logout_uri:b,backchannel_logout_session_required:x,frontchannel_logout_uri:S,frontchannel_logout_session_required:C,token_endpoint_auth_method:w,grant_types:T,response_types:E,application_type:D,disabled:O,skip_consent:k,enable_end_session:A,require_pkce:j,dpop_bound_access_tokens:M,subject_type:N,reference_id:P,metadata:F}=e,I=r?new Date(Number(r)*1e3):void 0,L=o?new Date(o*1e3):void 0,R=i?.split(` `),ee=Xc(F??{}),te=ee&&Object.keys(ee).length?JSON.stringify(ee):void 0;return{clientId:t,clientSecret:n,disabled:O,scopes:R,userId:a,createdAt:L,expiresAt:I,name:s,uri:c,icon:l,contacts:u,tos:d,policy:f,softwareId:h,softwareVersion:g,softwareStatement:_,redirectUris:v,postLogoutRedirectUris:y,backchannelLogoutUri:b,backchannelLogoutSessionRequired:x,frontchannelLogoutUri:S,frontchannelLogoutSessionRequired:C,tokenEndpointAuthMethod:w,grantTypes:T,responseTypes:E,jwks:p?JSON.stringify(p):void 0,jwksUri:m,applicationType:D,skipConsent:k,enableEndSession:A,requirePKCE:j,dpopBoundAccessTokens:M,subjectType:N,referenceId:P,metadata:te}}function wy(e){let{clientId:t,clientSecret:n,disabled:r,scopes:i,userId:a,createdAt:o,updatedAt:s,expiresAt:c,name:l,uri:u,icon:d,contacts:f,tos:p,policy:m,softwareId:h,softwareVersion:g,softwareStatement:_,redirectUris:v,postLogoutRedirectUris:y,backchannelLogoutUri:b,backchannelLogoutSessionRequired:x,frontchannelLogoutUri:S,frontchannelLogoutSessionRequired:C,tokenEndpointAuthMethod:w,grantTypes:T,responseTypes:E,applicationType:D,jwks:O,jwksUri:k,skipConsent:A,enableEndSession:j,requirePKCE:M,dpopBoundAccessTokens:N,subjectType:P,referenceId:F,metadata:I}=e,L=c?Math.round(new Date(c).getTime()/1e3):void 0,R=o?Math.round(new Date(o).getTime()/1e3):void 0,ee=i?.join(` `);return{...Xc(du(I)),client_id:t,client_secret:n??void 0,client_secret_expires_at:n?L??0:void 0,scope:ee??void 0,user_id:a??void 0,client_id_issued_at:R??void 0,client_name:l??void 0,client_uri:u??void 0,logo_uri:d??void 0,contacts:f??void 0,tos_uri:p??void 0,policy_uri:m??void 0,jwks:O?JSON.parse(O):void 0,jwks_uri:k??void 0,software_id:h??void 0,software_version:g??void 0,software_statement:_??void 0,redirect_uris:v??[],post_logout_redirect_uris:y??void 0,backchannel_logout_uri:b??void 0,backchannel_logout_session_required:x??void 0,frontchannel_logout_uri:S??void 0,frontchannel_logout_session_required:C??void 0,token_endpoint_auth_method:w??void 0,grant_types:T??void 0,response_types:E??void 0,application_type:D??void 0,disabled:r??void 0,skip_consent:A??void 0,enable_end_session:j??void 0,require_pkce:M??void 0,dpop_bound_access_tokens:N??void 0,subject_type:P??void 0,reference_id:F??void 0}}async function Ty(e,t){let n=await Z(e);if(await yv(e,n,t,`read`,e.query.client_id),!n)throw new z(`UNAUTHORIZED`);let r=await Vl(e,t,e.query.client_id);if(!r)throw new z(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(r.userId){if(r.userId!==n.user.id)throw new z(`UNAUTHORIZED`)}else if(r.referenceId&&t.clientReference){if(r.referenceId!==await t.clientReference(n))throw new z(`UNAUTHORIZED`)}else throw new z(`UNAUTHORIZED`);let i=wy(r);return i.client_secret=void 0,i}async function Ey(e,t,n){let r=await Vl(e,t,n);if(!r||r.disabled)throw new z(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});return wy({clientId:r.clientId,name:r.name,uri:r.uri,contacts:r.contacts,icon:r.icon,tos:r.tos,policy:r.policy})}async function Dy(e,t){let n=await Z(e);if(await yv(e,n,t,`list`),!n)throw new z(`UNAUTHORIZED`);let r=await t.clientReference?.(n);if(r)return await e.context.adapter.findMany({model:`oauthClient`,where:[{field:`referenceId`,value:r}]}).then(e=>e?e.map(e=>{let t=wy(e);return t.client_secret=void 0,t}):null);if(n.user.id)return await e.context.adapter.findMany({model:`oauthClient`,where:[{field:`userId`,value:n.user.id}]}).then(e=>e?e.map(e=>{let t=wy(e);return t.client_secret=void 0,t}):null);throw new z(`BAD_REQUEST`,{message:`either user_id or reference_id must be provided`})}async function Oy(e,t){let n=await Z(e);if(await yv(e,n,t,`delete`,e.body.client_id),!n)throw new z(`UNAUTHORIZED`);let r=e.body.client_id;Bl(t,r);let i=await Vl(e,t,r);if(!i)throw new z(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(i.userId){if(i.userId!==n.user.id)throw new z(`UNAUTHORIZED`)}else if(i.referenceId&&t.clientReference){if(i.referenceId!==await t.clientReference(n))throw new z(`UNAUTHORIZED`)}else throw new z(`UNAUTHORIZED`);await e.context.adapter.delete({model:`oauthClient`,where:[{field:`clientId`,value:r}]})}async function ky(e,t,n){let r=await Z(e);if(await yv(e,r,t,`update`,e.body.client_id),!r)throw new z(`UNAUTHORIZED`);let i=e.body.client_id;Bl(t,i);let a=await Vl(e,t,i);if(!a)throw new z(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});let{client_credentials_scopes:o,backchannel_logout_uri:s,frontchannel_logout_uri:c,...l}=e.body.update,u=s===null,d=c===null,f={...l,...s==null?{}:{backchannel_logout_uri:s},...c==null?{}:{frontchannel_logout_uri:c}},p=Object.keys(f).length>0||u||d,m=a.userId?a.userId===r.user.id:a.referenceId&&t.clientReference?a.referenceId===await t.clientReference(r):!1,h=!m&&n?.admin&&o!==void 0&&!p;if(!m&&!h)throw new z(`UNAUTHORIZED`);if(h&&await yv(e,r,t,`configure-client-credentials-scopes`,i),!p&&o===void 0){let e=wy(a);return e.client_secret=void 0,n?.admin?{...e,client_credentials_scopes:[...a.clientCredentialsScopes??[]]}:e}let g=f.grant_types??a.grantTypes??[],_=f.token_endpoint_auth_method??a.tokenEndpointAuthMethod,v=o===void 0?void 0:Ah(o);v!==void 0&&(jh(v,g,_,t),v.length>0&&!h&&await yv(e,r,t,`configure-client-credentials-scopes`,i));let y={...wy({...a,metadata:void 0}),...f,metadata:f.metadata??du(a.metadata)};u&&(y.backchannel_logout_uri=void 0,y.backchannel_logout_session_required=void 0),d&&(y.frontchannel_logout_uri=void 0,y.frontchannel_logout_session_required=void 0),await uy(y,t,{ctx:e});let b={...Cy(f)};f.redirect_uris&&a.sectorIdentifier&&(b.sectorIdentifier=hu(a.clientId,f.redirect_uris)),u&&(b.backchannelLogoutUri=null,b.backchannelLogoutSessionRequired=null),d&&(b.frontchannelLogoutUri=null,b.frontchannelLogoutSessionRequired=null),f.metadata!==void 0&&b.metadata===void 0&&(b.metadata=null),!g.includes(`client_credentials`)||_===`none`?b.clientCredentialsScopes=[]:v!==void 0&&(b.clientCredentialsScopes=v),f.token_endpoint_auth_method&&(f.token_endpoint_auth_method===`private_key_jwt`?b.clientSecret=null:(b.jwks=null,b.jwksUri=null,b.clientSecret||=await Kl(e,t,t.generateClientSecret?.()||zi(32,`a-z`,`A-Z`))));let x=await e.context.adapter.update({model:`oauthClient`,where:[{field:`clientId`,value:i}],update:{...b,updatedAt:new Date(Math.floor(Date.now()/1e3)*1e3)}});if(!x)throw new z(`INTERNAL_SERVER_ERROR`,{error_description:`unable to update client`,error:`invalid_client`});let S=wy(x);return S.client_secret=void 0,n?.admin?{...S,client_credentials_scopes:[...x.clientCredentialsScopes??[]]}:S}async function Ay(e,t){let n=await Z(e);if(await yv(e,n,t,`rotate`,e.body.client_id),!n)throw new z(`UNAUTHORIZED`);let r=e.body.client_id;Bl(t,r);let i=await Vl(e,t,r);if(!i)throw new z(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});if(i.userId){if(i.userId!==n.user.id)throw new z(`UNAUTHORIZED`)}else if(i.referenceId&&t.clientReference){if(i.referenceId!==await t.clientReference(n))throw new z(`UNAUTHORIZED`)}else throw new z(`UNAUTHORIZED`);if(i.tokenEndpointAuthMethod===`none`||!i.clientSecret)throw new z(`BAD_REQUEST`,{error_description:`secret rotation is only available for clients using client_secret authentication`,error:`invalid_client`});let a=t.generateClientSecret?.()||zi(32,`a-z`,`A-Z`),o=a?await Kl(e,t,a):void 0,s=await e.context.adapter.update({model:`oauthClient`,where:[{field:`clientId`,value:r}],update:{clientSecret:o,updatedAt:new Date(Math.floor(Date.now()/1e3)*1e3)}});if(!s)throw new z(`INTERNAL_SERVER_ERROR`,{error_description:`unable to update client`,error:`invalid_client`});return wy({...s,clientSecret:(t.prefix?.clientSecret??``)+a})}async function jy(e,t){if(!t.allowClientKeyRotation)throw new z(`FORBIDDEN`,{error:`access_denied`,error_description:`Client key rotation is disabled`});let{body:n}=e;vv(n.jwks);let{client:r}=await Vv(e,t,n.client_assertion,n.client_assertion_type,void 0,Dh({context:e.context,request:void 0},`/oauth2/client/rotate-keys`),{endpointAudienceOnly:!0,assertClient:e=>My(t,e)});if(!await e.context.adapter.incrementOne({model:`oauthClient`,where:[{field:`clientId`,value:r.clientId},{field:`jwks`,value:r.jwks}],increment:{},set:{jwks:JSON.stringify(n.jwks),updatedAt:new Date}}))throw new z(`CONFLICT`,{error:`invalid_request`,error_description:`client keys changed while rotating; retry with a fresh client assertion`});return{client_id:r.clientId,jwks:n.jwks}}function My(e,t){if(Bl(e,t.clientId),t.clientDiscoveryId||t.jwksUri||!t.jwks)throw new z(`BAD_REQUEST`,{error:`invalid_client`,error_description:`client keys are not stored inline; rotate them where the client publishes them`})}var Ny=c().trim().min(1),Py=x(c().trim().min(1)).min(1),Fy=e=>X(`/admin/oauth2/create-client`,{method:`POST`,body:w({redirect_uris:x(Q).min(1).optional(),scope:c().optional(),client_name:c().optional(),client_uri:c().optional(),logo_uri:c().optional(),contacts:x(c().min(1)).min(1).optional(),tos_uri:c().optional(),policy_uri:c().optional(),software_id:c().optional(),software_version:c().optional(),software_statement:c().optional(),post_logout_redirect_uris:x(Q).min(1).optional(),backchannel_logout_uri:Q.optional(),backchannel_logout_session_required:v().optional(),frontchannel_logout_uri:Q.optional(),frontchannel_logout_session_required:v().optional(),token_endpoint_auth_method:Ny.optional(),application_type:u([`web`,`native`]).optional(),jwks:Gm.optional(),jwks_uri:c().optional(),grant_types:Py.optional(),client_credentials_scopes:x(c().trim().min(1)).optional(),resources:x(Hm).optional(),response_types:x(u([`code`])).optional(),client_secret_expires_at:a([c(),d()]).optional().default(0),skip_consent:v().optional(),enable_end_session:v().optional(),require_pkce:v().optional(),dpop_bound_access_tokens:v().optional(),subject_type:u([`public`,`pairwise`]).optional(),metadata:i(c(),o()).optional()}),metadata:{noStore:!0,SERVER_ONLY:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},client_credentials_scopes:{type:`array`,items:{type:`string`},description:`Server-authorized scope ceiling for client_credentials tokens`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`URI of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URI for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final server-owned resources linked to the client`},disabled:{type:`boolean`,description:`Whether the client is disabled`},require_pkce:{type:`boolean`,description:`Whether the client requires PKCE`,default:!0},metadata:{type:`object`,additionalProperties:!0,nullable:!0,description:`Additional metadata for the application`}},required:[`client_id`]}}}}}}}},async t=>Sy(t,e,{admin:!0})),Iy=e=>X(`/oauth2/create-client`,{method:`POST`,use:[xp],body:w({redirect_uris:x(Q).min(1).optional(),scope:c().optional(),client_name:c().optional(),client_uri:c().optional(),logo_uri:c().optional(),contacts:x(c().min(1)).min(1).optional(),tos_uri:c().optional(),policy_uri:c().optional(),software_id:c().optional(),software_version:c().optional(),software_statement:c().optional(),post_logout_redirect_uris:x(Q).min(1).optional(),backchannel_logout_uri:Q.optional(),backchannel_logout_session_required:v().optional(),frontchannel_logout_uri:Q.optional(),frontchannel_logout_session_required:v().optional(),token_endpoint_auth_method:Ny.optional(),application_type:u([`web`,`native`]).optional(),jwks:Gm.optional(),jwks_uri:c().optional(),grant_types:Py.optional(),response_types:x(u([`code`])).optional(),dpop_bound_access_tokens:v().optional()}),metadata:{noStore:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`URI of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URI for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final server-owned resources linked to the client`},disabled:{type:`boolean`,description:`Whether the client is disabled`},metadata:{type:`object`,additionalProperties:!0,nullable:!0,description:`Additional metadata for the application`}},required:[`client_id`]}}}}}}}},async t=>Sy(t,e)),Ly=e=>X(`/oauth2/get-client`,{method:`GET`,use:[xp],query:w({client_id:c()}),metadata:{openapi:{description:`Get OAuth2 formatted client details`}}},async t=>Ty(t,e)),Ry=e=>X(`/oauth2/public-client`,{method:`GET`,use:[xp],query:w({client_id:c()}),metadata:{openapi:{description:`Gets publicly available client fields`}}},async t=>{let n=t.query.client_id;return Ey(t,e,n)}),zy=e=>X(`/oauth2/public-client-prelogin`,{method:`POST`,use:[sv(e)],body:w({client_id:c(),oauth_query:c().optional()}),metadata:{openapi:{description:`Gets publicly available client fields (prior to login)`}}},async t=>{let n=t.body.client_id;return Ey(t,e,n)}),By=e=>X(`/oauth2/get-clients`,{method:`GET`,use:[xp],metadata:{openapi:{description:`Get OAuth2 formatted client details for a user or organization`}}},async t=>Dy(t,e)),Vy=e=>X(`/admin/oauth2/update-client`,{method:`PATCH`,body:w({client_id:c(),update:w({redirect_uris:x(Q).min(1).optional(),scope:c().optional(),client_name:c().optional(),client_uri:c().optional(),logo_uri:c().optional(),contacts:x(c().min(1)).min(1).optional(),tos_uri:c().optional(),policy_uri:c().optional(),software_id:c().optional(),software_version:c().optional(),software_statement:c().optional(),post_logout_redirect_uris:x(Q).min(1).optional(),backchannel_logout_uri:Q.nullable().optional(),backchannel_logout_session_required:v().optional(),frontchannel_logout_uri:Q.nullable().optional(),frontchannel_logout_session_required:v().optional(),application_type:u([`web`,`native`]).optional(),grant_types:Py.optional(),client_credentials_scopes:x(c().trim().min(1)).optional(),response_types:x(u([`code`])).optional(),client_secret_expires_at:a([c(),d()]).optional(),skip_consent:v().optional(),enable_end_session:v().optional(),disabled:v().optional(),dpop_bound_access_tokens:v().optional(),metadata:i(c(),o()).optional()})}),metadata:{SERVER_ONLY:!0,openapi:{description:`Updates OAuth2 formatted client details.`}}},async t=>ky(t,e,{admin:!0})),Hy=e=>X(`/oauth2/update-client`,{method:`POST`,use:[xp],body:w({client_id:c(),update:w({redirect_uris:x(Q).min(1).optional(),scope:c().optional(),client_name:c().optional(),client_uri:c().optional(),logo_uri:c().optional(),contacts:x(c().min(1)).min(1).optional(),tos_uri:c().optional(),policy_uri:c().optional(),software_id:c().optional(),software_version:c().optional(),software_statement:c().optional(),post_logout_redirect_uris:x(Q).min(1).optional(),backchannel_logout_uri:Q.nullable().optional(),backchannel_logout_session_required:v().optional(),frontchannel_logout_uri:Q.nullable().optional(),frontchannel_logout_session_required:v().optional(),application_type:u([`web`,`native`]).optional(),grant_types:Py.optional(),response_types:x(u([`code`])).optional()})}),metadata:{openapi:{description:`Updates OAuth2 formatted client details.`}}},async t=>ky(t,e)),Uy=e=>X(`/oauth2/client/rotate-secret`,{method:`POST`,use:[xp],body:w({client_id:c()}),metadata:{noStore:!0,openapi:{description:`Rotates a confidential client's secret`}}},async t=>Ay(t,e)),Wy=e=>tv(`/oauth2/client/rotate-keys`,{method:`POST`,body:w({client_assertion:c(),client_assertion_type:c(),jwks:Gm}),errorCodesByField:{client_assertion:`invalid_client`,client_assertion_type:`invalid_client`,jwks:`invalid_client_metadata`},metadata:{noStore:!0,openapi:{description:`Replaces the signing keys of a private_key_jwt client. The request is authenticated by a client assertion signed with one of the client's current keys and addressed to this endpoint. Keys left out of the new set stop verifying at once.`}}},async t=>jy(t,e)),Gy=e=>X(`/oauth2/delete-client`,{method:`POST`,use:[xp],body:w({client_id:c()}),metadata:{openapi:{description:`Deletes an oauth client`}}},async t=>Oy(t,e));async function Ky(e,t,n){return await e.context.adapter.findOne({model:`oauthConsent`,where:[{field:`id`,value:n}]})}async function qy(e,t){let n=await Z(e);if(!n)throw new z(`UNAUTHORIZED`);let{id:r}=e.query;if(!r)throw new z(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await Ky(e,t,r);if(!i)throw new z(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new z(`UNAUTHORIZED`);return i}async function Jy(e,t){let n=await Z(e);if(!n)throw new z(`UNAUTHORIZED`);return await e.context.adapter.findMany({model:`oauthConsent`,where:[{field:`userId`,value:n.user.id}]})}async function Yy(e,t){let n=await Z(e);if(!n)throw new z(`UNAUTHORIZED`);let{id:r}=e.body;if(!r)throw new z(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await Ky(e,t,r);if(!i)throw new z(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new z(`UNAUTHORIZED`);await e.context.adapter.delete({model:`oauthConsent`,where:[{field:`id`,value:r}]})}async function Xy(e,t){let n=await Z(e);if(!n)throw new z(`UNAUTHORIZED`);let{id:r}=e.body;if(!r)throw new z(`NOT_FOUND`,{error_description:`missing id parameter`,error:`not_found`});let i=await Ky(e,t,r);if(!i)throw new z(`NOT_FOUND`,{error_description:`no consent`,error:`not_found`});if(i.userId!==n.user.id)throw new z(`UNAUTHORIZED`);let a=await Vl(e,t,i.clientId);if(!a)throw new z(`NOT_FOUND`,{error_description:`client not found`,error:`not_found`});let o=a?.scopes??t.scopes??[],s=e.body.update,c=s.scopes;if(c&&!c.every(e=>o?.includes(e)))throw new z(`BAD_REQUEST`,{error_description:`unable to provide scopes to ${a?.referenceId??a?.userId}`,error:`invalid_request`});let l=Math.floor(Date.now()/1e3);return await e.context.adapter.update({model:`oauthConsent`,where:[{field:`id`,value:r}],update:{...s,updatedAt:new Date(l*1e3)}})}var Zy=e=>X(`/oauth2/get-consent`,{method:`GET`,query:w({id:c()}),use:[xp],metadata:{openapi:{description:`Gets details of a specific OAuth2 consent for a user`}}},async t=>qy(t,e)),Qy=e=>X(`/oauth2/get-consents`,{method:`GET`,use:[xp],metadata:{openapi:{description:`Gets all available OAuth2 consents for a user`}}},async t=>Jy(t,e)),$y=e=>X(`/oauth2/update-consent`,{method:`POST`,use:[xp],body:w({id:c(),update:w({scopes:x(c())})}),metadata:{openapi:{description:`Updates consent granted to a client.`}}},async t=>Xy(t,e)),eb=e=>X(`/oauth2/delete-consent`,{method:`POST`,use:[xp],body:w({id:c()}),metadata:{openapi:{description:`Deletes consent granted to a client`}}},async t=>Yy(t,e)),tb=e=>e.schema?.oauthResource?.modelName??`oauthResource`,nb=e=>e.schema?.oauthClientResource?.modelName??`oauthClientResource`,rb=e=>e.schema?.oauthClient?.modelName??`oauthClient`;function ib(e){try{return decodeURIComponent(e)}catch{return e}}function ab(e,t){return{identifier:e.identifier,name:e.name??e.identifier,accessTokenTtl:e.accessTokenTtl??null,refreshTokenTtl:e.refreshTokenTtl??null,signingAlgorithm:e.signingAlgorithm??null,signingKeyId:e.signingKeyId??null,allowedScopes:e.allowedScopes??null,customClaims:e.customClaims??null,dpopBoundAccessTokensRequired:e.dpopBoundAccessTokensRequired??!1,disabled:e.disabled??!1,policyVersion:1,metadata:e.metadata??null,createdAt:t,updatedAt:t}}async function ob(e,t){await bv(e,await Z(e),t,`create`);let n=e.body;if(!n?.identifier)throw new z(`BAD_REQUEST`,{error:`invalid_request`,error_description:`identifier is required`});await rh(t,n.identifier);let r=new Date,i;try{i=await e.context.adapter.create({model:tb(t),data:ab(n,r)})}catch(e){let t=e instanceof Error?e.message:String(e);throw/unique|duplicate|UNIQUE/i.test(t)?new z(`BAD_REQUEST`,{error:`invalid_request`,error_description:`resource ${n.identifier} already exists`}):e}if(!i)throw new z(`BAD_REQUEST`,{error:`invalid_request`,error_description:`resource ${n.identifier} could not be created`});return ph(i.identifier),e.json(i,{status:201})}async function sb(e,t){await bv(e,await Z(e),t,`list`);let n=await e.context.adapter.findMany({model:tb(t)});return e.json(n??[])}async function cb(e,t){let n=ib(e.params.identifier);await bv(e,await Z(e),t,`read`,n);let r=await e.context.adapter.findOne({model:tb(t),where:[{field:`identifier`,value:n}]});if(!r)throw new z(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return e.json(r)}async function lb(e,t){let n=ib(e.params.identifier);if(await bv(e,await Z(e),t,`update`,n),!await e.context.adapter.findOne({model:tb(t),where:[{field:`identifier`,value:n}]}))throw new z(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});let r={updatedAt:new Date};for(let t of[`name`,`accessTokenTtl`,`refreshTokenTtl`,`signingAlgorithm`,`signingKeyId`,`allowedScopes`,`customClaims`,`dpopBoundAccessTokensRequired`,`disabled`,`metadata`])Object.prototype.hasOwnProperty.call(e.body,t)&&(r[t]=e.body[t]);await e.context.adapter.update({model:tb(t),where:[{field:`identifier`,value:n}],update:r}),ph(n);let i=await e.context.adapter.findOne({model:tb(t),where:[{field:`identifier`,value:n}]});if(!i)throw new z(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return e.json(i)}async function ub(e,t){let n=ib(e.params.identifier);if(await bv(e,await Z(e),t,`delete`,n),!await e.context.adapter.findOne({model:tb(t),where:[{field:`identifier`,value:n}]}))throw new z(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${n} not found`});return await e.context.adapter.delete({model:tb(t),where:[{field:`identifier`,value:n}]}),ph(n),e.json({deleted:!0})}async function db(e,t){let n=await Z(e),r=ib(e.params.identifier),i=ib(e.params.client_id);if(await bv(e,n,t,`link`,r),!await e.context.adapter.findOne({model:tb(t),where:[{field:`identifier`,value:r}]}))throw new z(`NOT_FOUND`,{error:`not_found`,error_description:`resource ${r} not found`});if(!await e.context.adapter.findOne({model:rb(t),where:[{field:`clientId`,value:i}]}))throw new z(`NOT_FOUND`,{error:`not_found`,error_description:`client ${i} not found`});try{await e.context.adapter.create({model:nb(t),data:{clientId:i,resourceId:r,createdAt:new Date}})}catch(t){let n=t instanceof Error?t.message:String(t);if(/unique|duplicate|UNIQUE/i.test(n))return e.json({linked:!0,alreadyLinked:!0});throw t}return e.json({linked:!0})}async function fb(e,t){let n=await Z(e),r=ib(e.params.identifier),i=ib(e.params.client_id);return await bv(e,n,t,`unlink`,r),await e.context.adapter.deleteMany({model:nb(t),where:[{field:`clientId`,value:i},{field:`resourceId`,value:r}]}),e.json({unlinked:!0})}var pb=w({identifier:c().min(1).optional(),name:c().optional(),accessTokenTtl:d().int().positive().nullable().optional(),refreshTokenTtl:d().int().positive().nullable().optional(),signingAlgorithm:u($m).nullable().optional(),signingKeyId:c().nullable().optional(),allowedScopes:x(c()).nullable().optional(),customClaims:i(c(),o()).nullable().optional(),dpopBoundAccessTokensRequired:v().optional(),disabled:v().optional(),metadata:i(c(),o()).nullable().optional()}),mb=e=>X(`/admin/oauth2/resources`,{method:`POST`,body:pb.required({identifier:!0}),metadata:{SERVER_ONLY:!0}},async t=>ob(t,e)),hb=e=>X(`/admin/oauth2/resources`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async t=>sb(t,e)),gb=e=>X(`/admin/oauth2/resources/:identifier`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async t=>cb(t,e)),_b=e=>X(`/admin/oauth2/resources/:identifier`,{method:`PATCH`,body:pb,metadata:{SERVER_ONLY:!0}},async t=>lb(t,e)),vb=e=>X(`/admin/oauth2/resources/:identifier`,{method:`DELETE`,metadata:{SERVER_ONLY:!0}},async t=>ub(t,e)),yb=e=>X(`/admin/oauth2/resources/:identifier/clients/:client_id`,{method:`POST`,metadata:{SERVER_ONLY:!0}},async t=>db(t,e)),bb=e=>X(`/admin/oauth2/resources/:identifier/clients/:client_id`,{method:`DELETE`,metadata:{SERVER_ONLY:!0}},async t=>fb(t,e));async function xb(e,t,n){if(!await oh(e,t,n.aud,[ih(e.context.baseURL)]))return null;throw new L(`BAD_REQUEST`,{error_description:`JWT access tokens are self-contained and cannot be revoked server-side`,error:`unsupported_token_type`})}async function Sb(e,t){await e.context.adapter.delete({model:`oauthAccessToken`,where:t.id?[{field:`id`,value:t.id}]:[{field:`token`,value:t.token}]})}async function Cb(e,t,n){let{userId:r}=t;if(t.revoked){await eg(e,n,r);return}let i=Math.floor(Date.now()/1e3);await e.context.adapter.incrementOne({model:`oauthRefreshToken`,where:[{field:`id`,value:t.id},{field:`revoked`,operator:`eq`,value:null}],increment:{},set:{revoked:new Date(i*1e3)}})?await e.context.adapter.deleteMany({model:`oauthAccessToken`,where:[{field:`refreshId`,value:t.id}]}):await eg(e,n,r)}async function wb(e,t){let{token:n,token_type_hint:r}=e.body,{clientId:i,clientSecret:a,preVerified:o,authMethod:s}=fu(await pu(e,t,`${e.context.baseURL}/oauth2/revoke`));if(!i)throw new L(`UNAUTHORIZED`,{error_description:`missing required credentials`,error:`invalid_client`});if(typeof n==`string`&&(n=gc(n)),!n?.length)throw new L(`BAD_REQUEST`,{error_description:`missing a required token for introspection`,error:`invalid_request`});let c=await uu(e,t,i,a,void 0,o,void 0,s);try{let i=await zh(e,t,n,r);if(!i)return null;if((i.type===`jwt`?i.payload.azp:i.record.clientId)!==c.clientId){if(c.tokenEndpointAuthMethod===`none`)return null;throw new L(`BAD_REQUEST`,{error_description:`client is not authorized to revoke the presented token`,error:`invalid_request`})}return i.type===`jwt`?await xb(e,t,i.payload):(i.type===`opaque`?await Sb(e,i.record):await Cb(e,i.record,c.clientId),null)}catch(e){throw e instanceof L?e:(xe.error(`Revocation error:`,e),new L(`INTERNAL_SERVER_ERROR`))}}var Tb={oauthClient:{modelName:`oauthClient`,fields:{clientId:{type:`string`,unique:!0,required:!0},clientSecret:{type:`string`,required:!1},clientDiscoveryId:{type:`string`,required:!1},disabled:{type:`boolean`,defaultValue:!1,required:!1},skipConsent:{type:`boolean`,required:!1},enableEndSession:{type:`boolean`,required:!1},subjectType:{type:`string`,required:!1},sectorIdentifier:{type:`string`,required:!1},scopes:{type:`string[]`,required:!1},clientCredentialsScopes:{type:`string[]`,required:!1,defaultValue:[]},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},createdAt:{type:`date`,required:!1},updatedAt:{type:`date`,required:!1},name:{type:`string`,required:!1},uri:{type:`string`,required:!1},icon:{type:`string`,required:!1},contacts:{type:`string[]`,required:!1},tos:{type:`string`,required:!1},policy:{type:`string`,required:!1},softwareId:{type:`string`,required:!1},softwareVersion:{type:`string`,required:!1},softwareStatement:{type:`string`,required:!1},redirectUris:{type:`string[]`,required:!0},postLogoutRedirectUris:{type:`string[]`,required:!1},backchannelLogoutUri:{type:`string`,required:!1},backchannelLogoutSessionRequired:{type:`boolean`,required:!1},frontchannelLogoutUri:{type:`string`,required:!1},frontchannelLogoutSessionRequired:{type:`boolean`,required:!1},tokenEndpointAuthMethod:{type:`string`,required:!1},applicationType:{type:`string`,required:!1},jwks:{type:`string`,required:!1},jwksUri:{type:`string`,required:!1},grantTypes:{type:`string[]`,required:!1},responseTypes:{type:`string[]`,required:!1},requirePKCE:{type:`boolean`,required:!1},dpopBoundAccessTokens:{type:`boolean`,required:!1,defaultValue:!1},referenceId:{type:`string`,required:!1},metadata:{type:`json`,required:!1}}},oauthResource:{modelName:`oauthResource`,fields:{identifier:{type:`string`,required:!0,unique:!0},name:{type:`string`,required:!0},accessTokenTtl:{type:`number`,required:!1},refreshTokenTtl:{type:`number`,required:!1},signingAlgorithm:{type:`string`,required:!1},signingKeyId:{type:`string`,required:!1},allowedScopes:{type:`string[]`,required:!1},customClaims:{type:`json`,required:!1},dpopBoundAccessTokensRequired:{type:`boolean`,required:!1,defaultValue:!1},disabled:{type:`boolean`,required:!1,defaultValue:!1},createdAt:{type:`date`,required:!1},updatedAt:{type:`date`,required:!1},policyVersion:{type:`number`,required:!1,defaultValue:1},metadata:{type:`json`,required:!1}}},oauthClientResource:{modelName:`oauthClientResource`,fields:{clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`,onDelete:`cascade`},index:!0},resourceId:{type:`string`,required:!0,references:{model:`oauthResource`,field:`identifier`,onDelete:`cascade`},index:!0},metadata:{type:`json`,required:!1},createdAt:{type:`date`,required:!1}},indexes:[{fields:[`clientId`,`resourceId`],unique:!0}]},oauthRefreshToken:{fields:{token:{type:`string`,required:!0,unique:!0},clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},sessionId:{type:`string`,required:!1,references:{model:`session`,field:`id`,onDelete:`set null`},index:!0},userId:{type:`string`,required:!0,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},authorizationCodeId:{type:`string`,required:!1,index:!0},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},expiresAt:{type:`date`},createdAt:{type:`date`},revoked:{type:`date`,required:!1},rotatedAt:{type:`date`,required:!1},rotationReplayResponse:{type:`string`,required:!1},rotationReplayExpiresAt:{type:`date`,required:!1},authTime:{type:`date`,required:!1},acr:{type:`string`,required:!1},amr:{type:`string[]`,required:!1},confirmation:{type:`json`,required:!1},scopes:{type:`string[]`,required:!0}}},oauthAccessToken:{modelName:`oauthAccessToken`,fields:{token:{type:`string`,unique:!0},clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},sessionId:{type:`string`,required:!1,references:{model:`session`,field:`id`,onDelete:`set null`},index:!0},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},authorizationCodeId:{type:`string`,required:!1,index:!0},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},refreshId:{type:`string`,required:!1,references:{model:`oauthRefreshToken`,field:`id`},index:!0},expiresAt:{type:`date`},createdAt:{type:`date`},revoked:{type:`date`,required:!1},confirmation:{type:`json`,required:!1},scopes:{type:`string[]`,required:!0}}},oauthConsent:{modelName:`oauthConsent`,fields:{clientId:{type:`string`,required:!0,references:{model:`oauthClient`,field:`clientId`},index:!0},userId:{type:`string`,required:!1,references:{model:`user`,field:`id`},index:!0},referenceId:{type:`string`,required:!1},resources:{type:`string[]`,required:!1},requestedUserInfoClaims:{type:`string[]`,required:!1},scopes:{type:`string[]`,required:!0},createdAt:{type:`date`},updatedAt:{type:`date`}}},oauthClientAssertion:{modelName:`oauthClientAssertion`,fields:{expiresAt:{type:`date`,required:!0}}}},Eb=[`openid`,`profile`,`email`,`offline_access`],Db=w({id_token_hint:c().optional(),client_id:c().optional(),post_logout_redirect_uri:Q.optional(),state:c().optional()}),Ob=zd(()=>null),kb=Ob.get,Ab=new WeakMap,jb=`signedQueryIssuedAtMs`;function Mb(e){let t=typeof e==`number`?e:typeof e==`string`?Number(e):void 0;if(!(!t||!Number.isFinite(t)||t<=0))return new Date(t)}var Nb=e=>{let t=e.clientRegistrationAllowedScopes;if(e.clientRegistrationDefaultScopes){let n=t?new Set([...t,...e.clientRegistrationDefaultScopes]):new Set([...e.clientRegistrationDefaultScopes]);t=Array.from(n)}let n=new Set((e.scopes??Eb).filter(e=>e.length));if(t){for(let e of t)if(!n.has(e))throw new B(`clientRegistrationAllowedScope ${e} not found in scopes`)}let r=e.authenticationContext?.acrValuesSupported;if(r&&(r.length===0||r.includes(``)))throw new B(`authenticationContext.acrValuesSupported must list at least one non-empty acr value`);for(let t of e.advertisedMetadata?.scopes_supported??[])if(!n?.has(t))throw new B(`advertisedMetadata.scopes_supported ${t} not found in scopes`);let i=new Set((e.resources??[]).map(e=>typeof e==`string`?e:e.identifier));for(let[t,n]of[[`clientRegistrationDefaultResources`,e.clientRegistrationDefaultResources],[`clientRegistrationAllowedResources`,e.clientRegistrationAllowedResources]])for(let e of n??[])if(!i.has(e))throw new B(`${t} resource ${e} not found in resources`);let o=new Set([`sub`,`iss`,`aud`,`exp`,`iat`,`sid`,`scope`,`azp`,...Im.filter(e=>n.has(Fm[e].scope))]),s={codeExpiresIn:600,accessTokenExpiresIn:3600,m2mAccessTokenExpiresIn:3600,refreshTokenExpiresIn:2592e3,refreshTokenReuseInterval:0,allowUnauthenticatedClientRegistration:!1,allowDynamicClientRegistration:!1,disableJwtPlugin:!1,storeClientSecret:e.disableJwtPlugin?`encrypted`:`hashed`,storeTokens:`hashed`,grantTypes:[`authorization_code`,`client_credentials`,`refresh_token`],...e,scopes:Array.from(n),claims:Array.from(o),clientRegistrationAllowedScopes:t};if(cl(s.extensions),s.pairwiseSecret&&s.pairwiseSecret.length<32)throw new B(`pairwiseSecret must be at least 32 characters long for adequate HMAC-SHA256 security`);if(s.grantTypes&&s.grantTypes.includes(`refresh_token`)&&!s.grantTypes.includes(`authorization_code`))throw new B(`refresh_token grant requires authorization_code grant`);if(s.disableJwtPlugin&&(s.storeClientSecret===`hashed`||typeof s.storeClientSecret==`object`&&`hash`in s.storeClientSecret))throw new B(`unable to store hashed secrets because id tokens will be signed with secret`);if(!s.disableJwtPlugin&&(s.storeClientSecret===`encrypted`||typeof s.storeClientSecret==`object`&&(`encrypt`in s.storeClientSecret||`decrypt`in s.storeClientSecret)))throw new B(`encryption method not recommended, please use 'hashed' or the 'hash' function`);let u=async(e,t)=>{let n=new URL(e.url).pathname,r=t.options.advanced?.skipTrailingSlashes?n.replace(/\/+$/,``)||`/`:n,i=s.disableJwtPlugin?t.baseURL:Ml(t)?.options?.jwt?.issuer??t.baseURL,a=`/`;try{a=new URL(i).pathname.replace(/\/$/,``)||``}catch{a=new URL(t.baseURL).pathname.replace(/\/$/,``)||``}let o={context:t},c=new Set([`/.well-known/oauth-authorization-server${a}`,`${a}/.well-known/oauth-authorization-server`]),l=`${a}/.well-known/openid-configuration`,u=c.has(r),d=s.scopes?.includes(`openid`)&&r===l,f=t=>{let n=ev(t);return e.method===`HEAD`?new Response(null,{status:n.status,headers:n.headers}):n};if((u||d)&&e.method!==`GET`&&e.method!==`HEAD`)return{response:new Response(null,{status:405,headers:{Allow:`GET, HEAD`}})};if(u)return s.scopes?.includes(`openid`)?{response:f(Q_(o,s))}:{response:f(Z_(o,s))};if(d)return{response:f(Q_(o,s))}},d=tv(`/oauth2/authorize`,{method:[`GET`,`POST`],body:w({}).passthrough(),redirectOnError:Zb(s),metadata:{allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Authorize an OAuth 2.1 request from query parameters or an application/x-www-form-urlencoded POST body`,parameters:[{name:`response_type`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 response type (e.g., 'code')`},{name:`user_code`,in:`query`,required:!1,schema:{type:`string`},description:`Device user code to approve instead of an authorization request (requires oauthDeviceAuthorization())`},{name:`client_id`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 client ID, required for authorization requests (not for user_code)`},{name:`redirect_uri`,in:`query`,required:!1,schema:{type:`string`,format:`uri`},description:`OAuth 2.1 redirect URI`},{name:`scope`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 scopes (space-separated)`},{name:`state`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth 2.1 state parameter`},{name:`request_uri`,in:`query`,required:!1,schema:{type:`string`},description:`Pushed Authorization Request URI referencing stored parameters`},{name:`code_challenge`,in:`query`,required:!1,schema:{type:`string`},description:`PKCE code challenge`},{name:`code_challenge_method`,in:`query`,required:!1,schema:{type:`string`},description:`PKCE code challenge method`},{name:`nonce`,in:`query`,required:!1,schema:{type:`string`},description:`OpenID Connect nonce`},{name:`max_age`,in:`query`,required:!1,schema:{type:`integer`,minimum:0},description:`Maximum authentication age in seconds; forces re-authentication when exceeded`},{name:`resource`,in:`query`,required:!1,schema:{type:`array`,items:{type:`string`}},description:`Requested protected resource(s) for the access token. May be supplied multiple times as repeated 'resource' query parameters (RFC 8707) or as an array of strings.`},{name:`prompt`,in:`query`,required:!1,schema:{type:`string`},description:`OAuth2 prompt parameter`}],responses:{302:{description:`Redirect to client with code or error`,headers:{Location:{description:`Redirect URI with code or error`,schema:{type:`string`,format:`uri`}}}},400:{description:`Invalid request`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},state:{type:`string`}},required:[`error`]}}}}}}}},async e=>Qb(e,s,e.authorizeSettings??{isAuthorize:!0})),f=(e,t)=>tm(d,{...e,asResponse:!1,returnHeaders:!1,returnStatus:!1,authorizeSettings:t??{}});return{id:`oauth-provider`,version:Kg,options:s,onRequest:u,init:async e=>{if(e.options.secondaryStorage&&e.options.session?.storeSessionInDatabase!==!0)throw new B("OAuth Provider requires `session.storeSessionInDatabase: true` when using secondaryStorage");if(s.allowClientKeyRotation){let t=e.adapter.id===`memory`?`the memory adapter`:e.options.advanced?.database?.generateId===`serial`?'`advanced.database.generateId: "serial"`':void 0;if(t)throw new B(`\`allowClientKeyRotation\` requires single-use client assertions, which ${t} does not enforce`)}if(await wh(e,s).catch(t=>bh(e,t)),Th(s),!s.disableJwtPlugin){let t=Ml(e)?.options,n=t?.jwt?.issuer??e.baseURL,r=t?.jwt?.issuer==null&&typeof e.options.baseURL==`object`&&e.options.baseURL!==null&&`allowedHosts`in e.options.baseURL;try{new URL(n)}catch(e){if(!r||n!==``)throw e}}return{options:{databaseHooks:{session:{delete:{async before(e,t){if(!t)return;let n=await o_(t,s,{sessionId:e.id,userId:e.userId});if(!n)return;let r=Ab.get(t)??new Map;r.set(e.id,n),Ab.set(t,r)},async after(e,t){if(!t)return;let n=Ab.get(t);if(!n)return;let r=n.get(e.id);if(n.delete(e.id),n.size===0&&Ab.delete(t),!r)return;await u_(r.frontchannelLogoutUris);let i=s_(t,r).catch(e=>{t.context.logger.error(`Logout notification failed after session deletion`,e)});await t.context.runInBackgroundOrAwait(i)}}}}}}},hooks:{before:[{matcher(e){return e.body?.oauth_query},handler:zu(async e=>{let t=e.body.oauth_query;if(!await zl(t,e.context.secret))throw new z(`BAD_REQUEST`,{error:`invalid_signature`});let n=Pe(t);await Ob.set(n),e.path===`/sign-in/social`&&await Xd({query:n.query,...n.signedQueryIssuedAt?{[jb]:n.signedQueryIssuedAt.getTime()}:{}})})}],after:[{matcher(e){return Cf(e.context.responseHeaders?.get(`set-cookie`)||``).has(e.context.authCookies.sessionToken.name)},handler:zu(async e=>{let t=Cf(e.context.responseHeaders?.get(`set-cookie`)||``).get(e.context.authCookies.sessionToken.name)?.value.split(`.`)[0];if(!t)return;let n=await Ob.get(),r=(await qd())?.serverContext,i=n?.query??r?.query;if(!i)return;let a=new URLSearchParams(i),o=await e.context.internalAdapter.findSession(t);if(!o)return;e.context.session=o;let s=e.request?.headers?.get(`sec-fetch-mode`)?.toLowerCase(),c=e.request?.headers?.get(`accept`)?.toLowerCase()??``;s===`navigate`||!s&&(c.includes(`text/html`)||c.includes(`application/xhtml+xml`))||e.headers?.set(`accept`,`application/json`);let l=n?.signedQueryIssuedAt??Mb(r?.[jb]),u=Cu(a,`login`);return Su(o.session.createdAt,l)&&(u=wu(u)),e.query=xu(u),await f(e)})}]},endpoints:{getOAuthServerConfig:X(`/.well-known/oauth-authorization-server`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async e=>s.scopes&&s.scopes.includes(`openid`)?Q_(e,s):Z_(e,s)),getOpenIdConfig:X(`/.well-known/openid-configuration`,{method:`GET`,metadata:{SERVER_ONLY:!0}},async e=>{if(s.scopes&&!s.scopes.includes(`openid`))throw new z(`NOT_FOUND`);return Q_(e,s)}),oauth2Authorize:d,oauth2Consent:X(`/oauth2/consent`,{method:`POST`,body:w({accept:v().meta({description:`Accept or deny user consent for a set of scopes`}),scope:c().optional().meta({description:`List of accept of accepted space-separated scopes. If none is provided, then all originally requested scopes are accepted.`}),claims:Cm.optional().meta({description:`Accepted OIDC claims request object. If none is provided, then all originally requested claims are accepted.`}),reference_id:c().min(1).optional().meta({description:`The reference the user chose for this consent, such as an organization ID. postLogin.consentReferenceId receives it and decides whether to accept it.`}),oauth_query:c().optional().meta({description:`The redirected page's query parameters`})}),use:[xp],metadata:{openapi:{description:`Handle OAuth2 consent`,responses:{200:{description:`Consent processed successfully`,content:{"application/json":{schema:{type:`object`,properties:{redirect:{type:`boolean`,description:"Always true. Indicates the caller should redirect to `url`.",enum:[!0]},url:{type:`string`,format:`uri-reference`,description:`The absolute or relative URI to redirect to next.`}},required:[`redirect`,`url`]}}}}}}}},async e=>Yg(e,s,f)),oauth2Continue:X(`/oauth2/continue`,{method:`POST`,body:w({selected:v().optional().meta({description:`Confirms an account has been selected and authorization can proceed.`}),created:v().optional().meta({description:`Confirms an account was registered`}),postLogin:v().optional().meta({description:`Resumes after the post login page. postLogin.shouldRedirect runs again with isContinuation: true.`}),oauth_query:c().optional().meta({description:`The redirected page's query parameters`})}),use:[xp],metadata:{openapi:{description:`Continues OAuth2 authorization flow`,responses:{200:{description:`Authorization flow continued successfully`,content:{"application/json":{schema:{type:`object`,properties:{redirect:{type:`boolean`,description:"Always true. Indicates the caller should redirect to `url`.",enum:[!0]},url:{type:`string`,format:`uri-reference`,description:`The absolute or relative URI to redirect to next.`}},required:[`redirect`,`url`]}}}}}}}},async e=>Xg(e,f)),oauth2Token:tv(`/oauth2/token`,{method:`POST`,formParams:{repeatable:[`resource`,`audience`]},body:w({grant_type:c().trim().min(1),client_id:c().optional(),client_secret:c().optional(),client_assertion:c().optional(),client_assertion_type:c().optional(),code:c().optional(),code_verifier:c().optional(),redirect_uri:Q.optional(),refresh_token:c().optional(),resource:a([Hm,x(Hm).min(1)]).optional(),scope:c().optional()}).passthrough(),errorCodesByField:{grant_type:{missing:`invalid_request`,invalid:`unsupported_grant_type`},resource:{invalid:`invalid_target`}},metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Obtain an OAuth2.1 access token`,parameters:[{name:`DPoP`,in:`header`,required:!1,schema:{type:`string`},description:`RFC 9449 DPoP proof JWT for issuing DPoP-bound tokens`}],requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{grant_type:{type:`string`,description:`OAuth2 grant type`},client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},code:{type:`string`,description:`Authorization code (for authorization_code grant)`},code_verifier:{type:`string`,description:`PKCE code verifier (for authorization_code grant)`},redirect_uri:{type:`string`,format:`uri`,description:`Redirect URI (for authorization_code grant)`},refresh_token:{type:`string`,description:`Refresh token (for refresh_token grant)`},resource:{oneOf:[{type:`string`,description:`Single resource (URL)`},{type:`array`,items:{type:`string`},description:`Multiple resources (URLs)`}],description:`Requested protected resource(s) for the access token`},scope:{type:`string`,description:`Requested scopes (for client_credentials grant)`}},required:[`grant_type`]}}}},responses:{200:{description:`Access token response`,content:{"application/json":{schema:{type:`object`,properties:{access_token:{type:`string`,description:`The access token issued by the authorization server`},token_type:{type:`string`,description:`The type of the token issued`,enum:[`Bearer`,`DPoP`]},expires_in:{type:`number`,description:`Lifetime in seconds of the access token`},refresh_token:{type:`string`,description:`Refresh token, if issued`},scope:{type:`string`,description:`Scopes granted by the access token`},id_token:{type:`string`,description:`ID Token (if OpenID Connect)`}},required:[`access_token`,`token_type`,`expires_in`]}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>qh(e,s)),oauth2Introspect:tv(`/oauth2/introspect`,{method:`POST`,formParams:{},body:w({client_id:c().optional(),client_secret:c().optional(),client_assertion:c().optional(),client_assertion_type:c().optional(),token:c(),token_type_hint:c().optional()}),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Introspect an OAuth2 access or refresh token`,requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},token:{type:`string`,description:`The token to introspect (access or refresh token)`},token_type_hint:{type:`string`,description:"Hint about the token type. Recognized values: `access_token`, `refresh_token`."}},required:[`token`]}}}},responses:{200:{description:`Token introspection response`,content:{"application/json":{schema:{type:`object`,properties:{active:{type:`boolean`,description:`Whether the token is active`},scope:{type:`string`,description:`Scopes associated with the token`},client_id:{type:`string`,description:`Client ID associated with the token`},username:{type:`string`,description:`Username associated with the token`},token_type:{type:`string`,description:`Type of the token`},exp:{type:`number`,description:`Expiration time of the token (seconds since epoch)`},iat:{type:`number`,description:`Issued at time (seconds since epoch)`},nbf:{type:`number`,description:`Not before time (seconds since epoch)`},sub:{type:`string`,description:`Subject of the token`},aud:{type:`string`,description:`Audience of the token`},iss:{type:`string`,description:`Issuer of the token`},jti:{type:`string`,description:`JWT ID`}},required:[`active`]}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>Gg(e,s)),oauth2Revoke:tv(`/oauth2/revoke`,{method:`POST`,formParams:{},body:w({client_id:c().optional(),client_secret:c().optional(),client_assertion:c().optional(),client_assertion_type:c().optional(),token:c(),token_type_hint:c().optional()}),metadata:{allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Revoke an OAuth2 access or refresh token`,requestBody:{required:!0,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`OAuth2 client ID`},client_secret:{type:`string`,description:`OAuth2 client secret`},token:{type:`string`,description:`The token to revoke (access or refresh token)`},token_type_hint:{type:`string`,description:"Hint about the token type. Recognized values: `access_token`, `refresh_token`."}},required:[`token`]}}}},responses:{200:{description:`Token revoked successfully. The response body is empty.`,content:{"application/json":{schema:{type:`object`,description:`Empty object on success`}}}},400:{description:`Invalid request or error response`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`},error_uri:{type:`string`}},required:[`error`]}}}}}}}},async e=>wb(e,s)),oauth2UserInfo:X(`/oauth2/userinfo`,{method:[`GET`,`POST`],body:w({access_token:c().optional()}).passthrough().optional(),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],openapi:{description:`Get OpenID Connect user information (UserInfo endpoint)`,security:[{bearerAuth:[]},{OAuth2:[`openid`,`profile`,`email`]}],parameters:[{name:`Authorization`,in:`header`,required:!1,schema:{type:`string`},description:`Bearer or DPoP access token`},{name:`DPoP`,in:`header`,required:!1,schema:{type:`string`},description:`RFC 9449 DPoP proof JWT when using a DPoP-bound access token`}],responses:{200:{description:`User information retrieved successfully`,content:{"application/json":{schema:{type:`object`,properties:{sub:{type:`string`,description:`Subject identifier (user ID)`},email:{type:`string`,format:`email`,nullable:!0,description:`User's email address, included if 'email' scope is granted`},name:{type:`string`,nullable:!0,description:`User's full name, included if 'profile' scope is granted`},picture:{type:`string`,format:`uri`,nullable:!0,description:`User's profile picture URL, included if 'profile' scope is granted`},given_name:{type:`string`,nullable:!0,description:`User's given name, included if 'profile' scope is granted`},family_name:{type:`string`,nullable:!0,description:`User's family name, included if 'profile' scope is granted`},email_verified:{type:`boolean`,nullable:!0,description:`Whether the email is verified, included if 'email' scope is granted`}},required:[`sub`]}}}},401:{description:`Unauthorized - invalid or missing access token`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`}},required:[`error`]}}}},403:{description:`Forbidden - insufficient scope`,content:{"application/json":{schema:{type:`object`,properties:{error:{type:`string`},error_description:{type:`string`}},required:[`error`]}}}}}}}},async e=>Uh(e,s)),oauth2EndSession:tv(`/oauth2/end-session`,{method:[`GET`,`POST`],body:Db.optional(),query:Db.optional(),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`,`application/json`],$Infer:{body:{},query:{}},openapi:{description:`RP-Initiated Logout endpoint. Accepts standard logout parameters through GET or an application/x-www-form-urlencoded POST body, plus JSON for Better Auth generated-client calls. Requests without a usable id_token_hint may require explicit OP confirmation.`,responses:{200:{description:`Logout completed, or an HTML page was returned for browser navigation — a confirmation page, or the OIDC front-channel logout page when clients with a registered frontchannel_logout_uri hold tokens on the session. A redirect is used only for an exact registered post_logout_redirect_uri.`,content:{"application/json":{schema:{type:`object`,properties:{redirect_uri:{type:`string`,format:`uri`,description:`URI to redirect to after logout (if post_logout_redirect_uri was provided)`},message:{type:`string`,description:`Success message`}}}},"text/html":{schema:{type:`string`,description:`Logout confirmation page, or the OIDC Front-Channel Logout page with one hidden iframe per registered RP`}}}}}}}},async e=>q_(e,s)),oauth2EndSessionConfirmation:tv(`/oauth2/end-session/confirm`,{method:`POST`,body:w({action:l(`confirm`)}),metadata:{noStore:!0,allowedMediaTypes:[`application/x-www-form-urlencoded`],scope:`http`}},async e=>J_(e,s)),registerOAuthClient:tv(`/oauth2/register`,{method:`POST`,body:Zm.loose(),errorCodesByField:{redirect_uris:`invalid_redirect_uri`,post_logout_redirect_uris:`invalid_redirect_uri`,software_statement:`invalid_software_statement`,resources:`invalid_target`},defaultError:`invalid_client_metadata`,metadata:{noStore:!0,openapi:{description:`Register an OAuth2 application`,responses:{201:{description:`OAuth2 application registered successfully`,content:{"application/json":{schema:{type:`object`,properties:{client_id:{type:`string`,description:`Unique identifier for the client`},client_secret:{type:`string`,description:`Secret key for the client`},client_secret_expires_at:{type:`number`,description:`Time the client secret will expire. If 0, the client secret will never expire.`},scope:{type:`string`,description:`Space-separated scopes allowed by the client`},user_id:{type:`string`,description:`ID of the user who registered the client, null if registered anonymously`},client_id_issued_at:{type:`number`,description:`Creation timestamp of this client`},client_name:{type:`string`,description:`Name of the OAuth2 application`},client_uri:{type:`string`,description:`Name of the OAuth2 application`},logo_uri:{type:`string`,description:`Icon URL for the application`},contacts:{type:`array`,items:{type:`string`},description:`List representing ways to contact people responsible for this client, typically email addresses`},tos_uri:{type:`string`,description:`Client's terms of service uri`},policy_uri:{type:`string`,description:`Client's policy uri`},software_id:{type:`string`,description:`Unique identifier assigned by the developer to help in the dynamic registration process`},software_version:{type:`string`,description:`Version identifier for the software_id`},software_statement:{type:`string`,description:`JWT containing metadata values about the client software as claims`},redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed redirect uris`},post_logout_redirect_uris:{type:`array`,items:{type:`string`,format:`uri`},description:`List of allowed logout redirect uris`},backchannel_logout_uri:{type:`string`,format:`uri`,description:`RP URL to receive signed Logout Tokens when the end-user's OP session terminates`},backchannel_logout_session_required:{type:`boolean`,description:"Whether the RP requires a `sid` claim in every Logout Token"},frontchannel_logout_uri:{type:`string`,format:`uri`,description:`RP URL rendered in a hidden iframe on the OP's logout page when the end-user's OP session terminates`},frontchannel_logout_session_required:{type:`boolean`,description:"Whether the RP requires `iss` and `sid` query parameters on its front-channel logout URI. The OP always sends both."},token_endpoint_auth_method:{type:`string`,description:`Requested authentication method for the token endpoint`},grant_types:{type:`array`,items:{type:`string`},description:`Grant types the client may use at the token endpoint`},response_types:{type:`array`,items:{type:`string`,enum:[`code`]},description:`Response types the client may use at the authorization endpoint`},application_type:{type:`string`,description:`OIDC application type used to classify redirect URI policy`,enum:[`web`,`native`]},resources:{type:`array`,items:{type:`string`,format:`uri`},description:`Final resource identifiers linked to the registered client`},disabled:{type:`boolean`,description:`Whether the client is disabled`}},required:[`client_id`]}}}}}}}},async e=>ly(e,s)),adminCreateOAuthClient:Fy(s),createOAuthClient:Iy(s),getOAuthClient:Ly(s),getOAuthClientPublic:Ry(s),getOAuthClientPublicPrelogin:zy(s),getOAuthClients:By(s),adminUpdateOAuthClient:Vy(s),updateOAuthClient:Hy(s),rotateClientSecret:Uy(s),rotateClientKeys:Wy(s),deleteOAuthClient:Gy(s),getOAuthConsent:Zy(s),getOAuthConsents:Qy(s),updateOAuthConsent:$y(s),deleteOAuthConsent:eb(s),adminCreateOAuthResource:mb(s),adminListOAuthResources:hb(s),adminGetOAuthResource:gb(s),adminUpdateOAuthResource:_b(s),adminDeleteOAuthResource:vb(s),adminLinkClientResource:yb(s),adminUnlinkClientResource:bb(s)},schema:vf(structuredClone(Tb),s?.schema),rateLimit:[...s.rateLimit?.token===!1?[]:[{pathMatcher:e=>e===`/oauth2/token`,window:s.rateLimit?.token?.window??60,max:s.rateLimit?.token?.max??20}],...s.rateLimit?.authorize===!1?[]:[{pathMatcher:e=>e===`/oauth2/authorize`,window:s.rateLimit?.authorize?.window??60,max:s.rateLimit?.authorize?.max??30}],...s.rateLimit?.introspect===!1?[]:[{pathMatcher:e=>e===`/oauth2/introspect`,window:s.rateLimit?.introspect?.window??60,max:s.rateLimit?.introspect?.max??100}],...s.rateLimit?.revoke===!1?[]:[{pathMatcher:e=>e===`/oauth2/revoke`,window:s.rateLimit?.revoke?.window??60,max:s.rateLimit?.revoke?.max??30}],...s.rateLimit?.register===!1?[]:[{pathMatcher:e=>e===`/oauth2/register`,window:s.rateLimit?.register?.window??60,max:s.rateLimit?.register?.max??5}],...s.rateLimit?.rotateClientKeys===!1?[]:[{pathMatcher:e=>e===`/oauth2/client/rotate-keys`,window:s.rateLimit?.rotateClientKeys?.window??60,max:s.rateLimit?.rotateClientKeys?.max??5}],...s.rateLimit?.userinfo===!1?[]:[{pathMatcher:e=>e===`/oauth2/userinfo`,window:s.rateLimit?.userinfo?.window??60,max:s.rateLimit?.userinfo?.max??60}]]}};function Pb(e,t,n){return t!==0&&n.getTime()-e.getTime()<=t*1e3}function Fb(e){let{max_age:t,...n}=e;return n}function Ib(e,t,n,r,i,a=`query`){let o=new URLSearchParams({error:t,error_description:n});return r&&o.append(`state`,r),i&&o.append(`iss`,i),a===`fragment`?`${e}#${o.toString()}`:md(e,o)}function Lb(e){let t=typeof e.response_mode==`string`?e.response_mode:void 0;if(t===`fragment`)return`fragment`;if(t===`query`)return`query`;let n=typeof e.response_type==`string`?e.response_type:void 0;return n&&/\b(token|id_token)\b/.test(n)?`fragment`:`query`}var Rb={response_type:{invalid:`unsupported_response_type`},resource:{invalid:`invalid_target`}};function zb(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function Bb(e){return typeof e==`string`?e:void 0}function Vb(e,t){let n=e.method===`POST`&&t?.isAuthorize===!0?e.body:e.query;return{...zb(n)?n:{}}}var $=(e,t)=>{let n=qg(e.request?.headers),r=e.headers?.get(`accept`)?.includes(`application/json`);if(n||r)return{redirect:!0,url:t.toString()};throw e.redirect(t)};function Hb(e,t,n,r,i){return $(e,n.redirect_uri?Ib(n.redirect_uri,r,i,n.state,Gb(e,t)):Kb(e,r,i))}function Ub(e,t,n){if(!(t instanceof L))throw t;let r=t.body,i=r?.error??`invalid_request`,a=r?.error_description??`invalid request`;return n?Ib(n,i,a):Kb(e,i,a)}function Wb(e){try{let t=new URL(e);return t.protocol!==`https:`&&!Gp(t.host)&&(t.protocol=`https:`),t.search=``,t.hash=``,t.toString().replace(/\/$/,``)}catch{return e}}function Gb(e,t){let n;if(t.disableJwtPlugin)n=e.context.baseURL;else try{n=Ml(e.context).options?.jwt?.issuer??e.context.baseURL}catch{n=e.context.baseURL}return Wb(n)}function Kb(e,t,n){return Ib(e.context.options.onAPIError?.errorURL||`${e.context.baseURL}/error`,t,n)}function qb(e){let t;try{t=new URL(e)}catch{return}let n=Wp(t.hostname)||t.hostname===`localhost`;if(t.protocol!==`http:`||!n)return;let r=e.indexOf(`://`);if(r<0)return;let i=r+3,a=e.slice(i).search(/[/?#]/u),o=e.length;a>=0&&(o=i+a);let s=e.slice(i,o),c;if(s.startsWith(`[`)){let t=s.indexOf(`]`);if(t<0)return;if(s[t+1]!==`:`)return e;c=t+1}else if(c=s.lastIndexOf(`:`),c<0)return e;let l=s.slice(c+1);if(!/^\d*$/u.test(l))return;let u=i+c;return`${e.slice(0,u)}${e.slice(o)}`}function Jb(e,t){if(!e||!t)return;let n;try{n=new URL(t)}catch{return}let r=t.includes(`#`),i=n.username.length>0||n.password.length>0;if(r||i)return;let a=qb(t);return e.find(e=>e===t?!0:a?qb(e)===a:!1)}function Yb(e){if(!Q.safeParse(e).success)return!1;let t=new URL(e);return t.username.length===0&&t.password.length===0}async function Xb(e,t,n,r){if(!n||!r)return null;let i;try{i=await Vl(e,t,n)}catch{return null}if(!i||i.disabled)return null;let a=i.redirectUris??[],o=Jb(a,r);if(t.validateRedirectUri){if(!Yb(r))return null;try{return await t.validateRedirectUri(r,a,!!o)?r:null}catch{return null}}return o?r:null}function Zb(e){return async({error:t,error_description:n,ctx:r})=>{let i=r.query??{},a=await Xb(r,e,typeof i.client_id==`string`?i.client_id:void 0,typeof i.redirect_uri==`string`?i.redirect_uri:void 0);return a?$(r,Ib(a,t,n,typeof i.state==`string`?i.state:void 0,Gb(r,e),Lb(i))):$(r,Kb(r,t,n))}}async function Qb(e,t,n){if(!e.request)throw new L(`UNAUTHORIZED`,{error_description:`request not found`,error:`invalid_request`});let r=e.request,i=Vb(e,n),a=ml(t,i);if(a){if(n?.isAuthorize===!0&&!await Z(e))return e.query={[a.parameter]:a.value},nx(e,t,`login`);let o=a.handler.errorPage?.({ctx:e,value:a.value}),s=t=>Ub(e,t,o),c;try{if(c=await a.handler.load({ctx:e,opts:t,value:a.value,signedQuery:n?.isAuthorize===!0?void 0:i}),c.client.disabled)throw new L(`BAD_REQUEST`,{error:`client_disabled`,error_description:`client is disabled`})}catch(t){return $(e,s(t))}return $b(e,t,r.headers,n,{...c,approve:e=>c.approve(e).catch(s),errorURL:s})}if(t.grantTypes&&!t.grantTypes.includes(`authorization_code`))throw new L(`NOT_FOUND`);e.query=i;let o=Bb(i.request),s=Bb(i.request_uri);if(o!==void 0&&s!==void 0)return Zb(t)({error:`invalid_request`,error_description:`request and request_uri cannot be used together`,ctx:e});if(o!==void 0)return Zb(t)({error:`request_not_supported`,error_description:`request object not supported`,ctx:e});if(s!==void 0){let n=Bb(i.client_id);if(!n)return Zb(t)({error:`invalid_request`,error_description:`client_id is required`,ctx:e});if(!t.requestUriResolver)return Zb(t)({error:`request_uri_not_supported`,error_description:`request_uri not supported`,ctx:e});let r=await t.requestUriResolver({requestUri:s,clientId:n,ctx:e});if(!r)return Zb(t)({error:`invalid_request_uri`,error_description:`request_uri is invalid or expired`,ctx:e});let a=i.client_id;i=r,a&&(i.client_id=a)}e.query=i;let c=Jm.safeParse(i);if(!c.success){let n=nv(c.error.issues,Rb);return Zb(t)({...n,ctx:e})}if(i=c.data,e.query=i,await Ob.set({query:ex(i).toString()}),!i.response_type)return Zb(t)({error:`invalid_request`,error_description:`response_type is required`,ctx:e});if((e.query?.prompt?mu(e.query?.prompt):void 0)?.has(`select_account`)&&!t.selectAccount?.page)return $(e,Kb(e,`unsupported_prompt_select_account`,`unsupported prompt type`));if(i.response_type!==`code`)return $(e,Kb(e,`unsupported_response_type`,`unsupported response type`));let l=await Vl(e,t,i.client_id);if(!l)return $(e,Kb(e,`invalid_client`,`client not found`));if(l.disabled)return $(e,Kb(e,`client_disabled`,`client is disabled`));if(!iu(l,`authorization_code`))return $(e,Kb(e,`unauthorized_client`,`client is not authorized to use the authorization_code grant`));let u=l.redirectUris??[],d=!1;if(i.redirect_uri){let e=!!Jb(u,i.redirect_uri);if(t.validateRedirectUri&&Yb(i.redirect_uri))try{d=await t.validateRedirectUri(i.redirect_uri,u,e)}catch{d=!1}else t.validateRedirectUri||(d=e)}if(!d)return $(e,Kb(e,`invalid_redirect`,`invalid redirect uri`));let f=i.scope?.split(` `).filter(e=>e);if(f){let n=new Set(l.scopes??t.scopes),r=f.filter(e=>!n?.has(e));if(r.length)return $(e,Ib(i.redirect_uri,`invalid_scope`,`The following scopes are invalid: ${r.join(`, `)}`,i.state,Gb(e,t)))}f||(f=l.scopes??t.scopes??[],i.scope=f.join(` `));let p=f.includes(`openid`);if(i.claims!==void 0&&!p)return $(e,Ib(i.redirect_uri,`invalid_request`,`openid scope must be requested when using the claims parameter`,i.state,Gb(e,t)));if(p&&!wm(i.claims))return $(e,Ib(i.redirect_uri,`invalid_request`,`claims must be a valid Claims request object`,i.state,Gb(e,t)));if(p&&!km(t).some(e=>Em(i.claims,e)))return $(e,Ib(i.redirect_uri,`access_denied`,`essential acr requirement cannot be met`,i.state,Gb(e,t)));if(i.resource!==void 0)try{await sh(e,t,{resource:i.resource,clientId:l.clientId,requestedScopes:f})}catch(n){if(n instanceof L){let r=n.body?.error??`invalid_target`,a=n.body?.error_description??`requested resource invalid`;return $(e,Ib(i.redirect_uri,r,a,i.state,Gb(e,t)))}throw n}let m=Tu(l,{scopes:f,nonce:i.nonce});if(m&&(!i.code_challenge||!i.code_challenge_method))return $(e,Ib(i.redirect_uri,`invalid_request`,m.valueOf(),i.state,Gb(e,t)));if(i.code_challenge||i.code_challenge_method){if(!i.code_challenge||!i.code_challenge_method)return $(e,Ib(i.redirect_uri,`invalid_request`,`code_challenge and code_challenge_method must both be provided`,i.state,Gb(e,t)));if(![`S256`].includes(i.code_challenge_method))return $(e,Ib(i.redirect_uri,`invalid_request`,`invalid code_challenge method, only S256 is supported`,i.state,Gb(e,t)))}return $b(e,t,r.headers,n,{query:i,client:l,approve:n=>tx(e,t,{...n,query:n.query,clientId:l.clientId,resource:Fl(n.query.resource)??[]})})}async function $b(e,t,n,r,i){let{query:a}=i,{client:o}=i;e.query=a;let s=a.scope?.split(` `).filter(e=>e)??[],c=Tm(a.claims,Lm(t)),l=Fl(a.resource)??[],u=a.prompt?mu(a.prompt):void 0,d=u?.has(`none`)??!1,f=await Z(e),p=a.max_age,m=f!=null&&p!==void 0&&Pb(new Date(f.session.createdAt),p,new Date);if(!f||f!=null&&p!==void 0&&!m||u?.has(`login`)||u?.has(`create`))return d?Hb(e,t,a,`login_required`,`authentication required`):nx(e,t,u?.has(`create`)?`create`:`login`);m&&(a=Fb(a),e.query=a);let h=()=>({user:f.user,session:f.session,scopes:s,query:ex(a)});if(r?.isAuthorize&&u?.has(`select_account`))return nx(e,t,`select_account`);if(r?.isAuthorize&&t.selectAccount&&await t.selectAccount.shouldRedirect({headers:n,...h()}))return d?Hb(e,t,a,`account_selection_required`,`End-User account selection is required`):nx(e,t,`select_account`);if(t.signup?.shouldRedirect){let r=await t.signup.shouldRedirect({headers:n,...h()});if(r)return d?Hb(e,t,a,`interaction_required`,`End-User interaction is required`):nx(e,t,`create`,{page:typeof r==`string`?r:void 0})}if(!r?.postLogin&&t.postLogin&&await t.postLogin.shouldRedirect({headers:n,...h(),isContinuation:r?.isPostLoginContinuation??!1}))return d?Hb(e,t,a,`interaction_required`,`End-User interaction is required`):nx(e,t,`post_login`);if(u?.has(`consent`)||i.requireConsent&&!r?.acceptedConsent)return nx(e,t,`consent`,{sessionId:f.session.id});let g=r?.acceptedConsent?r.acceptedConsent.referenceId:await yu(t,h()),_=async()=>{let r;try{r=await jm(t,{user:f.user,session:f.session,client:o,scopes:s,headers:n,query:a})}catch(n){if(!(n instanceof L))throw n;if(i.errorURL)return $(e,i.errorURL(n));let r=n.body;return Hb(e,t,a,r?.error??`server_error`,r?.error_description??`authentication context unavailable`)}return Em(a.claims,r.acr??`0`)?$(e,await i.approve({query:a,userId:f.user.id,sessionId:f.session.id,authTime:new Date(f.session.createdAt).getTime(),...r,referenceId:g})):Hb(e,t,a,`access_denied`,`essential acr requirement cannot be met`)};if(o.skipConsent)return _();let v=await bu(e,o.clientId,f.user.id,g);return!v||!su(v,s,l)||!c.every(e=>(v.requestedUserInfoClaims??[]).includes(e))?d?Hb(e,t,a,`consent_required`,`End-User consent is required`):nx(e,t,`consent`,{sessionId:f.session.id}):_()}function ex(e){let t=new URLSearchParams;for(let[n,r]of Object.entries(e))if(r!=null){if(Array.isArray(r))for(let e of r)t.append(n,String(e));else n===`claims`&&typeof r==`object`?t.set(n,JSON.stringify(r)):t.set(n,String(r))}return t}async function tx(e,t,n){let r=zi(32,`a-z`,`A-Z`,`0-9`),i=Math.floor(Date.now()/1e3),a=i+(t.codeExpiresIn??600),o={identifier:await ql(t.storeTokens,r,`authorization_code`),updatedAt:new Date(i*1e3),expiresAt:new Date(a*1e3),value:JSON.stringify({type:`authorization_code`,query:n.query,userId:n.userId,sessionId:n?.sessionId,referenceId:n.referenceId,authTime:n.authTime,acr:n.acr,amr:n.amr,resource:n.resource})};await e.context.internalAdapter.createVerificationValue({...o,createdAt:new Date(i*1e3)});let s=new URL(n.query.redirect_uri);return s.searchParams.set(`code`,r),n.query.state&&s.searchParams.set(`state`,n.query.state),s.searchParams.set(`iss`,Gb(e,t)),s.toString()}async function nx(e,t,n,r){let i=await rx(e,t,{postLoginClearedForSession:n===`consent`&&t.postLogin?r?.sessionId:void 0}),a=t.loginPage;if(n===`select_account`)a=t.selectAccount?.page??t.loginPage;else if(n===`post_login`){if(!t.postLogin?.page)throw new L(`INTERNAL_SERVER_ERROR`,{error_description:`postLogin should have been defined`});a=t.postLogin?.page}else n===`consent`?a=t.consentPage:n===`create`&&(a=t.signup?.page??t.loginPage);return $(e,`${r?.page??a}?${i}`)}async function rx(e,t,n){let r=Date.now(),i=Math.floor(r/1e3)+(t.codeExpiresIn??600),a=ex(e.query);a.set(`exp`,String(i)),a.set(Oe,String(r)),a.delete(`sig`),a.delete(ke),n?.postLoginClearedForSession&&a.set(ke,n.postLoginClearedForSession),Me(a);let o=await Ya(je(a).toString(),e.context.secret);return a.set(`sig`,o),a.toString()}export{lf as $,cs as $t,Ep as A,Vl as At,$f as B,cu as Bt,Cp as C,Be as Cn,qu as Ct,wp as D,Nu as Dt,yp as E,Pu as Et,gp as F,Nl as Ft,uf as G,ys as Gt,Vf as H,sc as Ht,up as I,ou as It,ff as J,ds as Jt,_f as K,vs as Kt,dp as L,eu as Lt,xp as M,jl as Mt,lp as N,Jc as Nt,Dp as O,Eu as Ot,_p as P,nu as Pt,mf as Q,ls as Qt,pp as R,Fl as Rt,jp as S,Qe as Sn,dd as St,Z as T,zu as Tt,Bf as U,rc as Ut,Uf as V,zl as Vt,yf as W,Ss as Wt,gf as X,fs as Xt,hf as Y,ps as Yt,df as Z,us as Zt,im as _,yt as _n,id as _t,Hm as a,Ri as an,Vd as at,Gp as b,pt as bn,ad as bt,sh as c,Si as cn,Ud as ct,pm as d,yi as dn,Pd as dt,ss as en,$d as et,dm as f,Xr as fn,kd as ft,om as g,V as gn,td as gt,cm as h,Dt as hn,fd as ht,_v as i,zi as in,Kd as it,Sp as j,El as jt,Tp as k,dl as kt,mm as l,xi as ln,Id as lt,sm as m,wr as mn,md as mt,Nb as n,Ka as nn,Qd as nt,Jh as o,Ei as on,Wd as ot,lm as p,Gr as pn,Nd as pt,vf as q,ms as qt,by as r,Vi as rn,Jd as rt,Qm as s,Ci as sn,Hd as st,kb as t,qa as tn,tf as tt,fm as u,bi as un,Rd as ut,tm as v,xt as vn,nd as vt,vp as w,we as wn,X as wt,Kp as x,gt as xn,od as xt,Yp as y,ft as yn,rd as yt,rp as z,au as zt};
-//# sourceMappingURL=authorize-DXYo-K2n-08rIhXFT.js.map
+//# sourceMappingURL=authorize-DXYo-K2n-Bc8o9t1x.js.map