@atcute/oauth-types 0.1.0 → 1.0.0

package/dist/schemas/atcute-confidential-client-metadata.d.ts

@@ -1,4 +1,4 @@
-import * as v from '@badrap/valita';
+import * as v from 'valibot';
 /**
  * user-facing client metadata for configuring a confidential OAuth client.
  *
@@ -6,7 +6,25 @@ import * as v from '@badrap/valita';
  * the library will fill in atproto-required values like `dpop_bound_access_tokens`,
  * `token_endpoint_auth_method`, and default `grant_types` / `response_types`.
  */
-export declare const confidentialClientMetadataSchema: v.Type<{
+export declare const confidentialClientMetadataSchema: v.SchemaWithPipe<readonly [v.LooseObjectSchema<{
+    /** discoverable https client_id URL (where metadata is hosted) */
+    readonly client_id: v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.NonEmptyAction<string, "must not be empty">]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.RawCheckAction<string>]>;
+    /** redirect URIs for authorization responses (must be https) */
+    readonly redirect_uris: v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, undefined>, v.MinLengthAction<string[], 1, "must have at least one redirect URI">, v.CheckItemsAction<string[], "redirect URI must not contain credentials">]>;
+    readonly scope: v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "invalid atproto OAuth scope">]>, v.CheckAction<string, "duplicate scope">]>, v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, "invalid OAuth scope">]>, undefined>, v.TransformAction<string[], string[]>, v.CheckItemsAction<string[], "duplicate scope">]>], undefined>;
+    /** optional client homepage */
+    readonly client_uri: v.OptionalSchema<v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: or https: protocol">, undefined>;
+    /** optional display name */
+    readonly client_name: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** optional policy url */
+    readonly policy_uri: v.OptionalSchema<v.SchemaWithPipe<readonly [v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: or https: protocol">, v.CheckAction<string, "hostname is invalid">]>, undefined>;
+    /** optional terms of service url */
+    readonly tos_uri: v.OptionalSchema<v.SchemaWithPipe<readonly [v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: or https: protocol">, v.CheckAction<string, "hostname is invalid">]>, undefined>;
+    /** optional logo url */
+    readonly logo_uri: v.OptionalSchema<v.SchemaWithPipe<readonly [v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: or https: protocol">, v.CheckAction<string, "hostname is invalid">]>, undefined>;
+    /** optional JWKS URL; if omitted, the library will inline jwks from the keyset */
+    readonly jwks_uri: v.OptionalSchema<v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, undefined>;
+}, undefined>, v.BaseValidation<{
     client_id: string;
     redirect_uris: string[];
     scope: string | string[];
@@ -16,6 +34,212 @@ export declare const confidentialClientMetadataSchema: v.Type<{
     tos_uri?: string | undefined;
     logo_uri?: string | undefined;
     jwks_uri?: string | undefined;
-}>;
-export type ConfidentialClientMetadata = v.Infer<typeof confidentialClientMetadataSchema>;
+} & {
+    [key: string]: unknown;
+}, {
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}, v.CheckIssue<{
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}>>, v.BaseValidation<{
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}, {
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}, v.CheckIssue<{
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}>>, v.BaseValidation<{
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}, {
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}, v.CheckIssue<{
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}>>, v.BaseValidation<{
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}, {
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}, v.CheckIssue<{
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}>>, v.BaseValidation<{
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}, {
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}, v.CheckIssue<{
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}>>, v.BaseValidation<{
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}, {
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}, v.CheckIssue<{
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    jwks_uri?: string | undefined;
+} & {
+    [key: string]: unknown;
+}>>]>;
+export type ConfidentialClientMetadata = v.InferOutput<typeof confidentialClientMetadataSchema>;
 //# sourceMappingURL=atcute-confidential-client-metadata.d.ts.map

package/dist/schemas/atcute-confidential-client-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"atcute-confidential-client-metadata.d.ts","sourceRoot":"","sources":["../../lib/schemas/atcute-confidential-client-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAWpC;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;EAsH1C,CAAC;AAEJ,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
+{"version":3,"file":"atcute-confidential-client-metadata.d.ts","sourceRoot":"","sources":["../../lib/schemas/atcute-confidential-client-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAO7B;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC;IAE3C,kEAAkE;;IAGlE,gEAAgE;;;IAYhE,+BAA+B;;IAE/B,4BAA4B;;IAE5B,0BAA0B;;IAE1B,oCAAoC;;IAEpC,wBAAwB;;IAGxB,kFAAkF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAgEnF,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,gCAAgC,CAAC,CAAC"}

package/dist/schemas/atcute-confidential-client-metadata.js

@@ -1,10 +1,8 @@
-import * as v from '@badrap/valita';
-import { atprotoOAuthScopeSchema } from './atproto-oauth-scope.js';
+import * as v from 'valibot';
+import { scopeSchema } from './atcute-client-shared.js';
 import { oauthClientIdDiscoverableSchema } from './oauth-client-id-discoverable.js';
 import { httpsUriSchema, nonLocalWebUriSchema, webUriSchema } from './uri.js';
 import { isLocalHostname } from './utils.js';
-const SINGLE_SCOPE_RE = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
-const singleScopeSchema = v.string().assert((input) => SINGLE_SCOPE_RE.test(input), `invalid OAuth scope`);
 /**
  * user-facing client metadata for configuring a confidential OAuth client.
  *
@@ -12,101 +10,63 @@ const singleScopeSchema = v.string().assert((input) => SINGLE_SCOPE_RE.test(inpu
  * the library will fill in atproto-required values like `dpop_bound_access_tokens`,
  * `token_endpoint_auth_method`, and default `grant_types` / `response_types`.
  */
-export const confidentialClientMetadataSchema = v
-    .object({
+export const confidentialClientMetadataSchema = v.pipe(v.looseObject({
     /** discoverable https client_id URL (where metadata is hosted) */
     client_id: oauthClientIdDiscoverableSchema,
     /** redirect URIs for authorization responses (must be https) */
-    redirect_uris: v
-        .array(httpsUriSchema)
-        .assert((arr) => arr.length > 0, `must have at least one redirect URI`)
-        .assert((arr) => {
-        for (const uri of arr) {
-            const url = new URL(uri);
-            if (url.username || url.password) {
-                return false;
-            }
-        }
-        return true;
-    }, `redirect URIs must not contain credentials`),
-    /**
-     * OAuth scope - either:
-     * - a space-separated string (must include "atproto")
-     * - an array of scope strings ('atproto' is added automatically)
-     */
-    scope: v.union(atprotoOAuthScopeSchema.chain((input) => {
-        const scopes = input.split(/\s+/);
-        for (let i = 0, len = scopes.length; i < len; i++) {
-            const aka = scopes[i];
-            for (let j = 0; j < i; j++) {
-                if (aka === scopes[j]) {
-                    return v.err(`duplicate "${aka}" scope`);
-                }
-            }
-        }
-        return v.ok(input);
-    }), v.array(singleScopeSchema).chain((input) => {
-        if (!input.includes('atproto')) {
-            input = ['atproto', ...input];
-        }
-        for (let i = 0, len = input.length; i < len; i++) {
-            const aka = input[i];
-            for (let j = 0; j < i; j++) {
-                if (aka === input[j]) {
-                    return v.err(`duplicate "${aka}" scope`);
-                }
-            }
-        }
-        return v.ok(input);
-    })),
+    redirect_uris: v.pipe(v.array(httpsUriSchema), v.minLength(1, `must have at least one redirect URI`), v.checkItems((uri) => {
+        const url = new URL(uri);
+        return !url.username && !url.password;
+    }, `redirect URI must not contain credentials`)),
+    scope: scopeSchema,
     /** optional client homepage */
-    client_uri: webUriSchema.optional(),
+    client_uri: v.optional(webUriSchema),
     /** optional display name */
-    client_name: v.string().optional(),
+    client_name: v.optional(v.string()),
     /** optional policy url */
-    policy_uri: nonLocalWebUriSchema.optional(),
+    policy_uri: v.optional(nonLocalWebUriSchema),
     /** optional terms of service url */
-    tos_uri: nonLocalWebUriSchema.optional(),
+    tos_uri: v.optional(nonLocalWebUriSchema),
     /** optional logo url */
-    logo_uri: nonLocalWebUriSchema.optional(),
+    logo_uri: v.optional(nonLocalWebUriSchema),
     /** optional JWKS URL; if omitted, the library will inline jwks from the keyset */
-    jwks_uri: httpsUriSchema.optional(),
-})
-    .chain((input) => {
-    const clientIdUrl = new URL(input.client_id);
-    if (isLocalHostname(clientIdUrl.hostname)) {
-        return v.err({ message: `client_id hostname is invalid`, path: ['client_id'] });
+    jwks_uri: v.optional(httpsUriSchema),
+}), v.forward(v.check((input) => !isLocalHostname(new URL(input.client_id).hostname), `client_id hostname is invalid`), ['client_id']), v.forward(v.check((input) => {
+    if (!input.jwks_uri) {
+        return true;
     }
-    if (input.jwks_uri) {
-        const jwksUrl = new URL(input.jwks_uri);
-        if (jwksUrl.username || jwksUrl.password) {
-            return v.err({ message: `jwks_uri must not contain credentials`, path: ['jwks_uri'] });
-        }
-        if (isLocalHostname(jwksUrl.hostname)) {
-            return v.err({ message: `jwks_uri hostname is invalid`, path: ['jwks_uri'] });
-        }
+    const jwksUrl = new URL(input.jwks_uri);
+    return !(jwksUrl.username || jwksUrl.password);
+}, `jwks_uri must not contain credentials`), ['jwks_uri']), v.forward(v.check((input) => {
+    if (!input.jwks_uri) {
+        return true;
+    }
+    return !isLocalHostname(new URL(input.jwks_uri).hostname);
+}, `jwks_uri hostname is invalid`), ['jwks_uri']), v.forward(v.check((input) => {
+    if (!input.client_uri) {
+        return true;
+    }
+    return !isLocalHostname(new URL(input.client_uri).hostname);
+}, `client_uri hostname is invalid`), ['client_uri']), v.forward(v.check((input) => {
+    if (!input.client_uri) {
+        return true;
+    }
+    const clientUriUrl = new URL(input.client_uri);
+    const clientIdUrl = new URL(input.client_id);
+    return clientUriUrl.origin === clientIdUrl.origin;
+}, `client_uri must have the same origin as the client_id`), ['client_uri']), v.forward(v.check((input) => {
+    if (!input.client_uri) {
+        return true;
     }
     // for discoverable clients, client_uri (if provided) must be same-origin parent of client_id
-    if (input.client_uri) {
-        const clientUriUrl = new URL(input.client_uri);
-        if (isLocalHostname(clientUriUrl.hostname)) {
-            return v.err({ message: `client_uri hostname is invalid`, path: ['client_uri'] });
-        }
-        if (clientUriUrl.origin !== clientIdUrl.origin) {
-            return v.err({
-                message: `client_uri must have the same origin as the client_id`,
-                path: ['client_uri'],
-            });
-        }
-        if (clientIdUrl.pathname !== clientUriUrl.pathname) {
-            const prefix = clientUriUrl.pathname.endsWith('/')
-                ? clientUriUrl.pathname
-                : `${clientUriUrl.pathname}/`;
-            if (!clientIdUrl.pathname.startsWith(prefix)) {
-                return v.err({ message: `client_uri must be a parent URL of the client_id`, path: ['client_uri'] });
-            }
-        }
+    const clientUriUrl = new URL(input.client_uri);
+    const clientIdUrl = new URL(input.client_id);
+    if (clientIdUrl.pathname === clientUriUrl.pathname) {
+        return true;
     }
-    return v.ok(input);
-});
+    const prefix = clientUriUrl.pathname.endsWith('/')
+        ? clientUriUrl.pathname
+        : `${clientUriUrl.pathname}/`;
+    return clientIdUrl.pathname.startsWith(prefix);
+}, `client_uri must be a parent URL of the client_id`), ['client_uri']));
 //# sourceMappingURL=atcute-confidential-client-metadata.js.map

package/dist/schemas/atcute-confidential-client-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"atcute-confidential-client-metadata.js","sourceRoot":"","sources":["../../lib/schemas/atcute-confidential-client-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAEpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAEtD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAE3G;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACP,kEAAkE;IAClE,SAAS,EAAE,+BAA+B;IAE1C,gEAAgE;IAChE,aAAa,EAAE,CAAC;SACd,KAAK,CAAC,cAAc,CAAC;SACrB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,qCAAqC,CAAC;SACtE,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAClC,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC;IAAA,CACZ,EAAE,4CAA4C,CAAC;IAEjD;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CACb,uBAAuB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YAEtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,IAAI,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvB,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;gBAC1C,CAAC;YACF,CAAC;QACF,CAAC;QAED,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IAAA,CACnB,CAAC,EACF,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,KAAK,GAAG,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtB,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;gBAC1C,CAAC;YACF,CAAC;QACF,CAAC;QAED,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IAAA,CACnB,CAAC,CACF;IAED,+BAA+B;IAC/B,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE;IACnC,4BAA4B;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,0BAA0B;IAC1B,UAAU,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC3C,oCAAoC;IACpC,OAAO,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACxC,wBAAwB;IACxB,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAEzC,kFAAkF;IAClF,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACjB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,IAAI,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;IACF,CAAC;IAED,6FAA6F;IAC7F,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAE/C,IAAI,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC,GAAG,CAAC;gBACZ,OAAO,EAAE,uDAAuD;gBAChE,IAAI,EAAE,CAAC,YAAY,CAAC;aACpB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,WAAW,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACjD,CAAC,CAAC,YAAY,CAAC,QAAQ;gBACvB,CAAC,CAAC,GAAG,YAAY,CAAC,QAAQ,GAAG,CAAC;YAE/B,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9C,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACrG,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AAAA,CACnB,CAAC,CAAC"}
+{"version":3,"file":"atcute-confidential-client-metadata.js","sourceRoot":"","sources":["../../lib/schemas/atcute-confidential-client-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CACrD,CAAC,CAAC,WAAW,CAAC;IACb,kEAAkE;IAClE,SAAS,EAAE,+BAA+B;IAE1C,gEAAgE;IAChE,aAAa,EAAE,CAAC,CAAC,IAAI,CACpB,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,EACvB,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,qCAAqC,CAAC,EACrD,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,EAAE;QACpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IACvC,CAAC,EAAE,2CAA2C,CAAC,CAC/C;IAED,KAAK,EAAE,WAAW;IAElB,+BAA+B;IAC/B,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;IACpC,4BAA4B;IAC5B,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,0BAA0B;IAC1B,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAC5C,oCAAoC;IACpC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IACzC,wBAAwB;IACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAE1C,kFAAkF;IAClF,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;CACpC,CAAC,EACF,CAAC,CAAC,OAAO,CACR,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAE,+BAA+B,CAAC,EACxG,CAAC,WAAW,CAAC,CACb,EACD,CAAC,CAAC,OAAO,CACR,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACjB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC,EAAE,uCAAuC,CAAC,EAC3C,CAAC,UAAU,CAAC,CACZ,EACD,CAAC,CAAC,OAAO,CACR,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACjB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC,EAAE,8BAA8B,CAAC,EAClC,CAAC,UAAU,CAAC,CACZ,EACD,CAAC,CAAC,OAAO,CACR,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACjB,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC7D,CAAC,EAAE,gCAAgC,CAAC,EACpC,CAAC,YAAY,CAAC,CACd,EACD,CAAC,CAAC,OAAO,CACR,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACjB,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,OAAO,YAAY,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,CAAC;AACnD,CAAC,EAAE,uDAAuD,CAAC,EAC3D,CAAC,YAAY,CAAC,CACd,EACD,CAAC,CAAC,OAAO,CACR,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACjB,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,6FAA6F;IAC7F,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,WAAW,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACjD,CAAC,CAAC,YAAY,CAAC,QAAQ;QACvB,CAAC,CAAC,GAAG,YAAY,CAAC,QAAQ,GAAG,CAAC;IAC/B,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC,EAAE,kDAAkD,CAAC,EACtD,CAAC,YAAY,CAAC,CACd,CACD,CAAC"}

package/dist/schemas/atcute-public-client-metadata.d.ts

@@ -0,0 +1,95 @@
+import * as v from 'valibot';
+/**
+ * user-facing client metadata for configuring a loopback public OAuth client.
+ *
+ * loopback clients are for localhost development and CLI tools. they use
+ * `http://localhost` as the client_id origin, which is built automatically
+ * from the redirect_uris and scope.
+ */
+export declare const loopbackClientMetadataSchema: v.LooseObjectSchema<{
+    /** must not be provided for loopback clients */
+    readonly client_id: v.OptionalSchema<v.UndefinedSchema<undefined>, undefined>;
+    /**
+     * redirect URIs for authorization responses.
+     *
+     * must be loopback IP addresses (127.0.0.1 or [::1]).
+     * per RFC 8252, port numbers are ignored during redirect URI matching,
+     * allowing ephemeral ports.
+     */
+    readonly redirect_uris: v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.ArraySchema<v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.CheckAction<string, "use of \"localhost\" hostname is not allowed (RFC 8252), use a loopback IP such as \"127.0.0.1\" instead">]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: loopback, https:, or a private-use scheme">, undefined>, v.MinLengthAction<string[], 1, "must have at least one redirect URI">, v.CheckItemsAction<string[], "redirect URI must not contain credentials">]>, v.CheckItemsAction<string[], "loopback clients require loopback redirect URIs (127.0.0.1 or [::1])">]>;
+    /** OAuth scope (must include "atproto") */
+    readonly scope: v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "invalid atproto OAuth scope">]>, v.CheckAction<string, "duplicate scope">]>, v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, "invalid OAuth scope">]>, undefined>, v.TransformAction<string[], string[]>, v.CheckItemsAction<string[], "duplicate scope">]>], undefined>;
+}, undefined>;
+export type LoopbackClientMetadata = v.InferOutput<typeof loopbackClientMetadataSchema>;
+/**
+ * user-facing client metadata for configuring a discoverable public OAuth client.
+ *
+ * discoverable public clients have an HTTPS client_id URL where metadata is hosted,
+ * but don't use a keyset (token_endpoint_auth_method: 'none').
+ */
+export declare const discoverablePublicClientMetadataSchema: v.LooseObjectSchema<{
+    /** discoverable HTTPS client_id URL */
+    readonly client_id: v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.NonEmptyAction<string, "must not be empty">]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.RawCheckAction<string>]>;
+    /** redirect URIs for authorization responses */
+    readonly redirect_uris: v.SchemaWithPipe<readonly [v.ArraySchema<v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.CheckAction<string, "use of \"localhost\" hostname is not allowed (RFC 8252), use a loopback IP such as \"127.0.0.1\" instead">]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: loopback, https:, or a private-use scheme">, undefined>, v.MinLengthAction<string[], 1, "must have at least one redirect URI">, v.CheckItemsAction<string[], "redirect URI must not contain credentials">]>;
+    /** OAuth scope (must include "atproto") */
+    readonly scope: v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "invalid atproto OAuth scope">]>, v.CheckAction<string, "duplicate scope">]>, v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, "invalid OAuth scope">]>, undefined>, v.TransformAction<string[], string[]>, v.CheckItemsAction<string[], "duplicate scope">]>], undefined>;
+    /**
+     * application type - defaults to 'web'.
+     */
+    readonly application_type: v.OptionalSchema<v.PicklistSchema<["web", "native"], undefined>, undefined>;
+    /** optional client homepage */
+    readonly client_uri: v.OptionalSchema<v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: or https: protocol">, undefined>;
+    /** optional display name */
+    readonly client_name: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** optional policy url */
+    readonly policy_uri: v.OptionalSchema<v.SchemaWithPipe<readonly [v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: or https: protocol">, v.CheckAction<string, "hostname is invalid">]>, undefined>;
+    /** optional terms of service url */
+    readonly tos_uri: v.OptionalSchema<v.SchemaWithPipe<readonly [v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: or https: protocol">, v.CheckAction<string, "hostname is invalid">]>, undefined>;
+    /** optional logo url */
+    readonly logo_uri: v.OptionalSchema<v.SchemaWithPipe<readonly [v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: or https: protocol">, v.CheckAction<string, "hostname is invalid">]>, undefined>;
+}, undefined>;
+export type DiscoverablePublicClientMetadata = v.InferOutput<typeof discoverablePublicClientMetadataSchema>;
+/**
+ * user-facing client metadata for configuring a public OAuth client.
+ *
+ * - if `client_id` is omitted: loopback client (for localhost dev / CLI tools)
+ * - if `client_id` is provided: discoverable public client (HTTPS URL)
+ */
+export declare const publicClientMetadataSchema: v.UnionSchema<[v.LooseObjectSchema<{
+    /** must not be provided for loopback clients */
+    readonly client_id: v.OptionalSchema<v.UndefinedSchema<undefined>, undefined>;
+    /**
+     * redirect URIs for authorization responses.
+     *
+     * must be loopback IP addresses (127.0.0.1 or [::1]).
+     * per RFC 8252, port numbers are ignored during redirect URI matching,
+     * allowing ephemeral ports.
+     */
+    readonly redirect_uris: v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.ArraySchema<v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.CheckAction<string, "use of \"localhost\" hostname is not allowed (RFC 8252), use a loopback IP such as \"127.0.0.1\" instead">]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: loopback, https:, or a private-use scheme">, undefined>, v.MinLengthAction<string[], 1, "must have at least one redirect URI">, v.CheckItemsAction<string[], "redirect URI must not contain credentials">]>, v.CheckItemsAction<string[], "loopback clients require loopback redirect URIs (127.0.0.1 or [::1])">]>;
+    /** OAuth scope (must include "atproto") */
+    readonly scope: v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "invalid atproto OAuth scope">]>, v.CheckAction<string, "duplicate scope">]>, v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, "invalid OAuth scope">]>, undefined>, v.TransformAction<string[], string[]>, v.CheckItemsAction<string[], "duplicate scope">]>], undefined>;
+}, undefined>, v.LooseObjectSchema<{
+    /** discoverable HTTPS client_id URL */
+    readonly client_id: v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.NonEmptyAction<string, "must not be empty">]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.RawCheckAction<string>]>;
+    /** redirect URIs for authorization responses */
+    readonly redirect_uris: v.SchemaWithPipe<readonly [v.ArraySchema<v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.CheckAction<string, "use of \"localhost\" hostname is not allowed (RFC 8252), use a loopback IP such as \"127.0.0.1\" instead">]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: loopback, https:, or a private-use scheme">, undefined>, v.MinLengthAction<string[], 1, "must have at least one redirect URI">, v.CheckItemsAction<string[], "redirect URI must not contain credentials">]>;
+    /** OAuth scope (must include "atproto") */
+    readonly scope: v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "invalid atproto OAuth scope">]>, v.CheckAction<string, "duplicate scope">]>, v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, "invalid OAuth scope">]>, undefined>, v.TransformAction<string[], string[]>, v.CheckItemsAction<string[], "duplicate scope">]>], undefined>;
+    /**
+     * application type - defaults to 'web'.
+     */
+    readonly application_type: v.OptionalSchema<v.PicklistSchema<["web", "native"], undefined>, undefined>;
+    /** optional client homepage */
+    readonly client_uri: v.OptionalSchema<v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: or https: protocol">, undefined>;
+    /** optional display name */
+    readonly client_name: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** optional policy url */
+    readonly policy_uri: v.OptionalSchema<v.SchemaWithPipe<readonly [v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: or https: protocol">, v.CheckAction<string, "hostname is invalid">]>, undefined>;
+    /** optional terms of service url */
+    readonly tos_uri: v.OptionalSchema<v.SchemaWithPipe<readonly [v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: or https: protocol">, v.CheckAction<string, "hostname is invalid">]>, undefined>;
+    /** optional logo url */
+    readonly logo_uri: v.OptionalSchema<v.SchemaWithPipe<readonly [v.UnionSchema<[v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>, v.SchemaWithPipe<readonly [v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "must be a valid url">]>, v.RawCheckAction<string>]>], "url must use http: or https: protocol">, v.CheckAction<string, "hostname is invalid">]>, undefined>;
+}, undefined>], undefined>;
+export type PublicClientMetadata = v.InferOutput<typeof publicClientMetadataSchema>;
+//# sourceMappingURL=atcute-public-client-metadata.d.ts.map

package/dist/schemas/atcute-public-client-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atcute-public-client-metadata.d.ts","sourceRoot":"","sources":["../../lib/schemas/atcute-public-client-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AA4B7B;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;IACxC,gDAAgD;;IAGhD;;;;;;OAMG;;IAGH,2CAA2C;;aAE1C,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF;;;;;GAKG;AACH,eAAO,MAAM,sCAAsC;IAClD,uCAAuC;;IAGvC,gDAAgD;;IAGhD,2CAA2C;;IAG3C;;OAEG;;IAGH,+BAA+B;;IAE/B,4BAA4B;;IAE5B,0BAA0B;;IAE1B,oCAAoC;;IAEpC,wBAAwB;;aAEvB,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAE5G;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;IA3DtC,gDAAgD;;IAGhD;;;;;;OAMG;;IAGH,2CAA2C;;;IAa3C,uCAAuC;;IAGvC,gDAAgD;;IAGhD,2CAA2C;;IAG3C;;OAEG;;IAGH,+BAA+B;;IAE/B,4BAA4B;;IAE5B,0BAA0B;;IAE1B,oCAAoC;;IAEpC,wBAAwB;;0BAevB,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/schemas/atcute-public-client-metadata.js

@@ -0,0 +1,74 @@
+import * as v from 'valibot';
+import { scopeSchema } from './atcute-client-shared.js';
+import { oauthClientIdDiscoverableSchema } from './oauth-client-id-discoverable.js';
+import { loopbackRedirectUriSchema, oauthRedirectUriSchema } from './oauth-redirect-uri.js';
+import { nonLocalWebUriSchema, webUriSchema } from './uri.js';
+const redirectUrisSchema = v.pipe(v.array(oauthRedirectUriSchema), v.minLength(1, `must have at least one redirect URI`), v.checkItems((uri) => {
+    // private-use URIs don't have URL-style credentials
+    if (!uri.includes('://')) {
+        return true;
+    }
+    const url = new URL(uri);
+    return !url.username && !url.password;
+}, `redirect URI must not contain credentials`));
+const loopbackRedirectUrisSchema = v.pipe(redirectUrisSchema, v.checkItems((uri) => v.is(loopbackRedirectUriSchema, uri), `loopback clients require loopback redirect URIs (127.0.0.1 or [::1])`));
+/**
+ * user-facing client metadata for configuring a loopback public OAuth client.
+ *
+ * loopback clients are for localhost development and CLI tools. they use
+ * `http://localhost` as the client_id origin, which is built automatically
+ * from the redirect_uris and scope.
+ */
+export const loopbackClientMetadataSchema = v.looseObject({
+    /** must not be provided for loopback clients */
+    client_id: v.optional(v.undefined()),
+    /**
+     * redirect URIs for authorization responses.
+     *
+     * must be loopback IP addresses (127.0.0.1 or [::1]).
+     * per RFC 8252, port numbers are ignored during redirect URI matching,
+     * allowing ephemeral ports.
+     */
+    redirect_uris: loopbackRedirectUrisSchema,
+    /** OAuth scope (must include "atproto") */
+    scope: scopeSchema,
+});
+/**
+ * user-facing client metadata for configuring a discoverable public OAuth client.
+ *
+ * discoverable public clients have an HTTPS client_id URL where metadata is hosted,
+ * but don't use a keyset (token_endpoint_auth_method: 'none').
+ */
+export const discoverablePublicClientMetadataSchema = v.looseObject({
+    /** discoverable HTTPS client_id URL */
+    client_id: oauthClientIdDiscoverableSchema,
+    /** redirect URIs for authorization responses */
+    redirect_uris: redirectUrisSchema,
+    /** OAuth scope (must include "atproto") */
+    scope: scopeSchema,
+    /**
+     * application type - defaults to 'web'.
+     */
+    application_type: v.optional(v.picklist(['web', 'native'])),
+    /** optional client homepage */
+    client_uri: v.optional(webUriSchema),
+    /** optional display name */
+    client_name: v.optional(v.string()),
+    /** optional policy url */
+    policy_uri: v.optional(nonLocalWebUriSchema),
+    /** optional terms of service url */
+    tos_uri: v.optional(nonLocalWebUriSchema),
+    /** optional logo url */
+    logo_uri: v.optional(nonLocalWebUriSchema),
+});
+/**
+ * user-facing client metadata for configuring a public OAuth client.
+ *
+ * - if `client_id` is omitted: loopback client (for localhost dev / CLI tools)
+ * - if `client_id` is provided: discoverable public client (HTTPS URL)
+ */
+export const publicClientMetadataSchema = v.union([
+    loopbackClientMetadataSchema,
+    discoverablePublicClientMetadataSchema,
+]);
+//# sourceMappingURL=atcute-public-client-metadata.js.map

package/dist/schemas/atcute-public-client-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atcute-public-client-metadata.js","sourceRoot":"","sources":["../../lib/schemas/atcute-public-client-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE9D,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAChC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAC/B,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,qCAAqC,CAAC,EACrD,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,EAAE;IACpB,oDAAoD;IACpD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;AACvC,CAAC,EAAE,2CAA2C,CAAC,CAC/C,CAAC;AAEF,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CACxC,kBAAkB,EAClB,CAAC,CAAC,UAAU,CACX,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,yBAAyB,EAAE,GAAG,CAAC,EAC7C,sEAAsE,CACtE,CACD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,WAAW,CAAC;IACzD,gDAAgD;IAChD,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAEpC;;;;;;OAMG;IACH,aAAa,EAAE,0BAA0B;IAEzC,2CAA2C;IAC3C,KAAK,EAAE,WAAW;CAClB,CAAC,CAAC;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,WAAW,CAAC;IACnE,uCAAuC;IACvC,SAAS,EAAE,+BAA+B;IAE1C,gDAAgD;IAChD,aAAa,EAAE,kBAAkB;IAEjC,2CAA2C;IAC3C,KAAK,EAAE,WAAW;IAElB;;OAEG;IACH,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE3D,+BAA+B;IAC/B,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;IACpC,4BAA4B;IAC5B,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,0BAA0B;IAC1B,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAC5C,oCAAoC;IACpC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IACzC,wBAAwB;IACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;CAC1C,CAAC,CAAC;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC;IACjD,4BAA4B;IAC5B,sCAAsC;CACtC,CAAC,CAAC"}