@atcute/oauth-types 0.1.0

package/dist/schemas/oauth-redirect-uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-redirect-uri.js","sourceRoot":"","sources":["../../lib/schemas/oauth-redirect-uri.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAElF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3E,IAAI,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,CAAC,GAAG,CACX,sGAAsG,CACtG,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AAAA,CACnB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;IAC1E,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,OAAO,yBAAyB,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,mBAAmB,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAAA,CAC/C,CAAC,CAAC"}

package/dist/schemas/oauth-response-mode.d.ts

@@ -0,0 +1,4 @@
+import * as v from '@badrap/valita';
+export declare const oauthResponseModeSchema: v.UnionType<[v.Type<"query">, v.Type<"fragment">, v.Type<"form_post">]>;
+export type OAuthResponseMode = v.Infer<typeof oauthResponseModeSchema>;
+//# sourceMappingURL=oauth-response-mode.d.ts.map

package/dist/schemas/oauth-response-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-response-mode.d.ts","sourceRoot":"","sources":["../../lib/schemas/oauth-response-mode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAEpC,eAAO,MAAM,uBAAuB,yEAInC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/schemas/oauth-response-mode.js

@@ -0,0 +1,3 @@
+import * as v from '@badrap/valita';
+export const oauthResponseModeSchema = v.union(v.literal('query'), v.literal('fragment'), v.literal('form_post'));
+//# sourceMappingURL=oauth-response-mode.js.map

package/dist/schemas/oauth-response-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-response-mode.js","sourceRoot":"","sources":["../../lib/schemas/oauth-response-mode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAEpC,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC7C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAClB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EACrB,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CACtB,CAAC"}

package/dist/schemas/oauth-response-type.d.ts

@@ -0,0 +1,4 @@
+import * as v from '@badrap/valita';
+export declare const oauthResponseTypeSchema: v.UnionType<[v.Type<"code">, v.Type<"token">, v.Type<"none">, v.Type<"code id_token token">, v.Type<"code id_token">, v.Type<"code token">, v.Type<"id_token token">, v.Type<"id_token">]>;
+export type OAuthResponseType = v.Infer<typeof oauthResponseTypeSchema>;
+//# sourceMappingURL=oauth-response-type.d.ts.map

package/dist/schemas/oauth-response-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-response-type.d.ts","sourceRoot":"","sources":["../../lib/schemas/oauth-response-type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAEpC,eAAO,MAAM,uBAAuB,4LAYnC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/schemas/oauth-response-type.js

@@ -0,0 +1,8 @@
+import * as v from '@badrap/valita';
+export const oauthResponseTypeSchema = v.union(
+// OAuth2 (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-10#section-4.1.1)
+v.literal('code'), // Authorization Code Grant
+v.literal('token'), // Implicit Grant
+// OIDC (https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html)
+v.literal('none'), v.literal('code id_token token'), v.literal('code id_token'), v.literal('code token'), v.literal('id_token token'), v.literal('id_token'));
+//# sourceMappingURL=oauth-response-type.js.map

package/dist/schemas/oauth-response-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-response-type.js","sourceRoot":"","sources":["../../lib/schemas/oauth-response-type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAEpC,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK;AAC7C,wFAAwF;AACxF,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,2BAA2B;AAC9C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,iBAAiB;AAErC,4EAA4E;AAC5E,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EACjB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAChC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAC1B,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EACvB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC3B,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CACrB,CAAC"}

package/dist/schemas/oauth-scope.d.ts

@@ -0,0 +1,12 @@
+import * as v from '@badrap/valita';
+export declare const OAUTH_SCOPE_REGEXP: RegExp;
+export declare const isOAuthScope: (input: string) => boolean;
+/**
+ * a (single) space separated list of non empty printable ASCII char string
+ * (except backslash and double quote).
+ *
+ * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-1.4.1}
+ */
+export declare const oauthScopeSchema: v.Type<string>;
+export type OAuthScope = v.Infer<typeof oauthScopeSchema>;
+//# sourceMappingURL=oauth-scope.d.ts.map

package/dist/schemas/oauth-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-scope.d.ts","sourceRoot":"","sources":["../../lib/schemas/oauth-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAKpC,eAAO,MAAM,kBAAkB,QAA+D,CAAC;AAE/F,eAAO,MAAM,YAAY,4BAA6D,CAAC;AAEvF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,gBAAyD,CAAC;AAEvF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/schemas/oauth-scope.js

@@ -0,0 +1,14 @@
+import * as v from '@badrap/valita';
+// scope       = scope-token *( SP scope-token )
+// scope-token = 1*( %x21 / %x23-5B / %x5D-7E )
+// https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-1.4.1
+export const OAUTH_SCOPE_REGEXP = /^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$/;
+export const isOAuthScope = (input) => OAUTH_SCOPE_REGEXP.test(input);
+/**
+ * a (single) space separated list of non empty printable ASCII char string
+ * (except backslash and double quote).
+ *
+ * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-1.4.1}
+ */
+export const oauthScopeSchema = v.string().assert(isOAuthScope, `invalid OAuth scope`);
+//# sourceMappingURL=oauth-scope.js.map

package/dist/schemas/oauth-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-scope.js","sourceRoot":"","sources":["../../lib/schemas/oauth-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAEpC,gDAAgD;AAChD,+CAA+C;AAC/C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,4DAA4D,CAAC;AAE/F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC"}

package/dist/schemas/oauth-token-response.d.ts

@@ -0,0 +1,22 @@
+import * as v from '@badrap/valita';
+/**
+ * @see {@link https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1 | RFC 6749 (OAuth2), Section 5.1}
+ */
+export declare const oauthTokenResponseSchema: v.ObjectType<{
+    access_token: v.Type<string>;
+    token_type: v.Type<"Bearer" | "DPoP">;
+    scope: v.Optional<string>;
+    refresh_token: v.Optional<string>;
+    expires_in: v.Optional<number>;
+    id_token: v.Optional<string>;
+    authorization_details: v.Optional<{
+        type: string;
+        locations?: string[] | undefined;
+        actions?: string[] | undefined;
+        datatypes?: string[] | undefined;
+        identifier?: string | undefined;
+        privileges?: string[] | undefined;
+    }[]>;
+}, undefined>;
+export type OAuthTokenResponse = v.Infer<typeof oauthTokenResponseSchema>;
+//# sourceMappingURL=oauth-token-response.d.ts.map

package/dist/schemas/oauth-token-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token-response.d.ts","sourceRoot":"","sources":["../../lib/schemas/oauth-token-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAKpC;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;aAWnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/schemas/oauth-token-response.js

@@ -0,0 +1,19 @@
+import * as v from '@badrap/valita';
+import { oauthAuthorizationDetailsSchema } from './oauth-authorization-details.js';
+import { oauthTokenTypeSchema } from './oauth-token-type.js';
+/**
+ * @see {@link https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1 | RFC 6749 (OAuth2), Section 5.1}
+ */
+export const oauthTokenResponseSchema = v.object({
+    // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1
+    access_token: v.string(),
+    token_type: oauthTokenTypeSchema,
+    scope: v.string().optional(),
+    refresh_token: v.string().optional(),
+    expires_in: v.number().optional(),
+    // https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse
+    id_token: v.string().optional(),
+    // https://datatracker.ietf.org/doc/html/rfc9396#name-enriched-authorization-deta
+    authorization_details: oauthAuthorizationDetailsSchema.optional(),
+});
+//# sourceMappingURL=oauth-token-response.js.map

package/dist/schemas/oauth-token-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token-response.js","sourceRoot":"","sources":["../../lib/schemas/oauth-token-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAEpC,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,0DAA0D;IAC1D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,oBAAoB;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,sEAAsE;IACtE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,iFAAiF;IACjF,qBAAqB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC"}

package/dist/schemas/oauth-token-type.d.ts

@@ -0,0 +1,5 @@
+import * as v from '@badrap/valita';
+/** token type (case-insensitive input, normalized output) */
+export declare const oauthTokenTypeSchema: v.Type<"Bearer" | "DPoP">;
+export type OAuthTokenType = v.Infer<typeof oauthTokenTypeSchema>;
+//# sourceMappingURL=oauth-token-type.d.ts.map

package/dist/schemas/oauth-token-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token-type.d.ts","sourceRoot":"","sources":["../../lib/schemas/oauth-token-type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAEpC,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB,2BAS/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/schemas/oauth-token-type.js

@@ -0,0 +1,13 @@
+import * as v from '@badrap/valita';
+/** token type (case-insensitive input, normalized output) */
+export const oauthTokenTypeSchema = v.string().chain((input) => {
+    const lower = input.toLowerCase();
+    if (lower === 'dpop') {
+        return v.ok('DPoP');
+    }
+    if (lower === 'bearer') {
+        return v.ok('Bearer');
+    }
+    return v.err(`must be "DPoP" or "Bearer"`);
+});
+//# sourceMappingURL=oauth-token-type.js.map

package/dist/schemas/oauth-token-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token-type.js","sourceRoot":"","sources":["../../lib/schemas/oauth-token-type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAEpC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;AAAA,CAC3C,CAAC,CAAC"}

package/dist/schemas/uri.d.ts

@@ -0,0 +1,18 @@
+import * as v from '@badrap/valita';
+/**
+ * valid, but potentially dangerous URL (`data:`, `file:`, `javascript:`, etc.).
+ *
+ * any value that matches this schema is safe to parse using `new URL()`.
+ */
+export declare const urlSchema: v.Type<string>;
+/** loopback URL (http://localhost, http://127.0.0.1, http://[::1]) */
+export declare const loopbackUriSchema: v.Type<string>;
+/** HTTPS URL with additional restrictions */
+export declare const httpsUriSchema: v.Type<string>;
+/** web URL (either loopback http or https) */
+export declare const webUriSchema: v.Type<string>;
+/** web URL with a non-local hostname */
+export declare const nonLocalWebUriSchema: v.Type<string>;
+/** private-use URI scheme (e.g., com.example.app:/callback) */
+export declare const privateUseUriSchema: v.Type<string>;
+//# sourceMappingURL=uri.d.ts.map

package/dist/schemas/uri.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uri.d.ts","sourceRoot":"","sources":["../../lib/schemas/uri.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAIpC;;;;GAIG;AACH,eAAO,MAAM,SAAS,gBAKpB,CAAC;AAEH,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,gBAW5B,CAAC;AAEH,6CAA6C;AAC7C,eAAO,MAAM,cAAc,gBAqBzB,CAAC;AAEH,8CAA8C;AAC9C,eAAO,MAAM,YAAY,gBAUvB,CAAC;AAEH,wCAAwC;AACxC,eAAO,MAAM,oBAAoB,gBAM/B,CAAC;AAEH,+DAA+D;AAC/D,eAAO,MAAM,mBAAmB,gBAsB9B,CAAC"}

package/dist/schemas/uri.js

@@ -0,0 +1,81 @@
+import * as v from '@badrap/valita';
+import { isHostnameIP, isLocalHostname, isLoopbackHost } from './utils.js';
+/**
+ * valid, but potentially dangerous URL (`data:`, `file:`, `javascript:`, etc.).
+ *
+ * any value that matches this schema is safe to parse using `new URL()`.
+ */
+export const urlSchema = v.string().chain((input) => {
+    if (input.includes(':') && URL.canParse(input)) {
+        return v.ok(input);
+    }
+    return v.err(`must be a valid url`);
+});
+/** loopback URL (http://localhost, http://127.0.0.1, http://[::1]) */
+export const loopbackUriSchema = urlSchema.chain((input) => {
+    if (!input.startsWith('http://')) {
+        return v.err(`loopback url must use http: protocol`);
+    }
+    const url = new URL(input);
+    if (!isLoopbackHost(url.hostname)) {
+        return v.err(`loopback url must use localhost, 127.0.0.1, or [::1] as hostname`);
+    }
+    return v.ok(input);
+});
+/** HTTPS URL with additional restrictions */
+export const httpsUriSchema = urlSchema.chain((input) => {
+    if (!input.startsWith('https://')) {
+        return v.err(`url must use https: protocol`);
+    }
+    const url = new URL(input);
+    if (isLoopbackHost(url.hostname)) {
+        return v.err(`https url must not use a loopback host`);
+    }
+    if (!isHostnameIP(url.hostname)) {
+        if (!url.hostname.includes('.')) {
+            return v.err(`domain name must contain at least two segments`);
+        }
+        if (url.hostname.endsWith('.local')) {
+            return v.err(`domain name must not end with .local`);
+        }
+    }
+    return v.ok(input);
+});
+/** web URL (either loopback http or https) */
+export const webUriSchema = urlSchema.chain((input, options) => {
+    if (input.startsWith('http://')) {
+        return loopbackUriSchema.try(input, options);
+    }
+    if (input.startsWith('https://')) {
+        return httpsUriSchema.try(input, options);
+    }
+    return v.err(`url must use http: or https: protocol`);
+});
+/** web URL with a non-local hostname */
+export const nonLocalWebUriSchema = webUriSchema.chain((input) => {
+    const url = new URL(input);
+    if (isLocalHostname(url.hostname)) {
+        return v.err(`hostname is invalid`);
+    }
+    return v.ok(input);
+});
+/** private-use URI scheme (e.g., com.example.app:/callback) */
+export const privateUseUriSchema = urlSchema.chain((input) => {
+    const dotIdx = input.indexOf('.');
+    const colonIdx = input.indexOf(':');
+    if (dotIdx === -1 || colonIdx === -1 || dotIdx > colonIdx) {
+        return v.err(`private-use uri scheme must contain a dot in the protocol`);
+    }
+    const url = new URL(input);
+    const scheme = url.protocol.slice(0, -1);
+    const domain = scheme.split('.').reverse().join('.');
+    if (isLocalHostname(domain)) {
+        return v.err(`private-use uri scheme must not be a local hostname`);
+    }
+    // RFC 8252: private-use URIs must use single slash after scheme
+    if (url.href.startsWith(`${url.protocol}//`) || url.username || url.password || url.hostname || url.port) {
+        return v.err(`private-use uri must be in the form scheme:/<path>`);
+    }
+    return v.ok(input);
+});
+//# sourceMappingURL=uri.js.map

package/dist/schemas/uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uri.js","sourceRoot":"","sources":["../../lib/schemas/uri.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAEpC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AAAA,CACpC,CAAC,CAAC;AAEH,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AAAA,CACnB,CAAC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAE3B,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACtD,CAAC;IACF,CAAC;IAED,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AAAA,CACnB,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;IAC/D,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,OAAO,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,CAAC,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAAA,CACtD,CAAC,CAAC;AAEH,wCAAwC;AACxC,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AAAA,CACnB,CAAC,CAAC;AAEH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEpC,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3D,OAAO,CAAC,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAErD,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACrE,CAAC;IAED,gEAAgE;IAChE,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,QAAQ,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1G,OAAO,CAAC,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AAAA,CACnB,CAAC,CAAC"}

package/dist/schemas/utils.d.ts

@@ -0,0 +1,32 @@
+/**
+ * checks if a hostname is a loopback address
+ */
+export declare const isLoopbackHost: (hostname: string) => boolean;
+/**
+ * checks if a hostname is an IP address (IPv4 or IPv6)
+ */
+export declare const isHostnameIP: (hostname: string) => boolean;
+/**
+ * checks if a hostname is a local/reserved hostname
+ *
+ * returns true for single-segment hostnames and reserved TLDs
+ */
+export declare const isLocalHostname: (hostname: string) => boolean;
+/**
+ * extracts the path from a URL without relying on URL constructor normalization
+ *
+ * this is needed because the URL constructor normalizes paths (e.g., removes `.` and `..` segments),
+ * which can be used to bypass validation checks
+ */
+export declare const extractUrlPath: (url: string) => string;
+/**
+ * checks if an item is the last occurrence in an array (for duplicate detection)
+ */
+export declare const isLastOccurrence: <T>(item: T, index: number, array: readonly T[]) => boolean;
+/**
+ * checks if a space-separated string contains a specific value
+ *
+ * optimized version of `input.split(' ').includes(value)`
+ */
+export declare const isSpaceSeparatedValue: (value: string, input: string) => boolean;
+//# sourceMappingURL=utils.d.ts.map

package/dist/schemas/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../lib/schemas/utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,cAAc,+BAE1B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,YAAY,+BAUxB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,+BAQ3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,yBA4B1B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,yDAEjC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,2CA2BjC,CAAC"}

package/dist/schemas/utils.js

@@ -0,0 +1,94 @@
+/**
+ * checks if a hostname is a loopback address
+ */
+export const isLoopbackHost = (hostname) => {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
+};
+/**
+ * checks if a hostname is an IP address (IPv4 or IPv6)
+ */
+export const isHostnameIP = (hostname) => {
+    // IPv4
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(hostname)) {
+        return true;
+    }
+    // IPv6
+    if (hostname.startsWith('[') && hostname.endsWith(']')) {
+        return true;
+    }
+    return false;
+};
+/**
+ * checks if a hostname is a local/reserved hostname
+ *
+ * returns true for single-segment hostnames and reserved TLDs
+ */
+export const isLocalHostname = (hostname) => {
+    const parts = hostname.split('.');
+    if (parts.length < 2) {
+        return true;
+    }
+    const tld = parts.at(-1).toLowerCase();
+    return tld === 'test' || tld === 'local' || tld === 'localhost' || tld === 'invalid' || tld === 'example';
+};
+/**
+ * extracts the path from a URL without relying on URL constructor normalization
+ *
+ * this is needed because the URL constructor normalizes paths (e.g., removes `.` and `..` segments),
+ * which can be used to bypass validation checks
+ */
+export const extractUrlPath = (url) => {
+    const endOfProtocol = url.startsWith('https://') ? 8 : url.startsWith('http://') ? 7 : -1;
+    if (endOfProtocol === -1) {
+        throw new TypeError(`url must use https: or http: protocol`);
+    }
+    const hashIdx = url.indexOf('#', endOfProtocol);
+    const questionIdx = url.indexOf('?', endOfProtocol);
+    const queryStrIdx = questionIdx !== -1 && (hashIdx === -1 || questionIdx < hashIdx) ? questionIdx : -1;
+    const pathEnd = hashIdx === -1
+        ? queryStrIdx === -1
+            ? url.length
+            : queryStrIdx
+        : queryStrIdx === -1
+            ? hashIdx
+            : Math.min(hashIdx, queryStrIdx);
+    const slashIdx = url.indexOf('/', endOfProtocol);
+    const pathStart = slashIdx === -1 || slashIdx > pathEnd ? pathEnd : slashIdx;
+    if (endOfProtocol === pathStart) {
+        throw new TypeError(`url must contain a host`);
+    }
+    return url.substring(pathStart, pathEnd) || '/';
+};
+/**
+ * checks if an item is the last occurrence in an array (for duplicate detection)
+ */
+export const isLastOccurrence = (item, index, array) => {
+    return array.lastIndexOf(item) === index;
+};
+/**
+ * checks if a space-separated string contains a specific value
+ *
+ * optimized version of `input.split(' ').includes(value)`
+ */
+export const isSpaceSeparatedValue = (value, input) => {
+    const inputLength = input.length;
+    const valueLength = value.length;
+    if (inputLength < valueLength) {
+        return false;
+    }
+    let idx = input.indexOf(value);
+    let idxEnd;
+    while (idx !== -1) {
+        idxEnd = idx + valueLength;
+        if (
+        // at beginning or preceded by space
+        (idx === 0 || input.charCodeAt(idx - 1) === 32) &&
+            // at end or followed by space
+            (idxEnd === inputLength || input.charCodeAt(idxEnd) === 32)) {
+            return true;
+        }
+        idx = input.indexOf(value, idxEnd + 1);
+    }
+    return false;
+};
+//# sourceMappingURL=utils.js.map

package/dist/schemas/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../lib/schemas/utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAW,EAAE,CAAC;IAC5D,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,CAAC;AAAA,CACpF,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAW,EAAE,CAAC;IAC1D,OAAO;IACP,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO;IACP,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAW,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,CAAC;AAAA,CAC1G,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC;IACtD,MAAM,aAAa,GAAG,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAEpD,MAAM,WAAW,GAAG,WAAW,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvG,MAAM,OAAO,GACZ,OAAO,KAAK,CAAC,CAAC;QACb,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC;YACnB,CAAC,CAAC,GAAG,CAAC,MAAM;YACZ,CAAC,CAAC,WAAW;QACd,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC;YACnB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,QAAQ,KAAK,CAAC,CAAC,IAAI,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE7E,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,yBAAyB,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC;AAAA,CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAI,IAAO,EAAE,KAAa,EAAE,KAAmB,EAAW,EAAE,CAAC;IAC5F,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC;AAAA,CACzC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAa,EAAE,KAAa,EAAW,EAAE,CAAC;IAC/E,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;IACjC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;IAEjC,IAAI,WAAW,GAAG,WAAW,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAc,CAAC;IAEnB,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC;QAE3B;QACC,oCAAoC;QACpC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;YAC/C,8BAA8B;YAC9B,CAAC,MAAM,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,EAC1D,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;QAED,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,KAAK,CAAC;AAAA,CACb,CAAC"}

package/dist/scope.d.ts

@@ -0,0 +1,84 @@
+import type { AtprotoAudience, Nsid } from '@atcute/lexicons/syntax';
+/** repo record actions */
+export type RepoAction = 'create' | 'update' | 'delete';
+/** account attributes */
+export type AccountAttr = 'email' | 'repo' | 'status';
+/** account actions */
+export type AccountAction = 'read' | 'manage';
+/** identity attributes */
+export type IdentityAttr = 'handle' | '*';
+/** collection parameter - NSID or wildcard */
+export type CollectionParam = Nsid | '*';
+/** lexicon method parameter - NSID or wildcard */
+export type LxmParam = Nsid | '*';
+/** audience parameter - atproto audience or wildcard */
+export type AudParam = AtprotoAudience | '*';
+export interface RepoOptions {
+    /** collection NSID(s) or '*' for all */
+    collection: CollectionParam[];
+    /** allowed actions; if omitted, all operations are permitted */
+    action?: RepoAction[];
+}
+/**
+ * builds a repo permission scope
+ * @param options repo permission options
+ * @returns scope string like `repo?collection=app.bsky.feed.post&action=create&action=update`
+ */
+export declare const repo: (options: RepoOptions) => string;
+export interface RpcOptions {
+    /** lexicon method NSID(s) or '*' for all */
+    lxm: LxmParam[];
+    /** audience */
+    aud: AudParam;
+}
+/**
+ * builds an rpc permission scope
+ * @param options rpc permission options
+ * @returns scope string like `rpc?lxm=app.bsky.feed.getFeed&aud=*`
+ */
+export declare const rpc: (options: RpcOptions) => string;
+export interface AccountOptions {
+    /** account attribute (email, repo, status) */
+    attr: AccountAttr;
+    /** action (read or manage); defaults to read */
+    action?: AccountAction;
+}
+/**
+ * builds an account permission scope
+ * @param options account permission options
+ * @returns scope string like `account?attr=email` or `account?attr=email&action=manage`
+ */
+export declare const account: (options: AccountOptions) => string;
+export interface BlobOptions {
+    /** MIME type(s) to accept (e.g., 'image/*', '*\/*') */
+    accept: string[];
+}
+/**
+ * builds a blob permission scope
+ * @param options blob permission options
+ * @returns scope string like `blob?accept=image/*`
+ */
+export declare const blob: (options: BlobOptions) => string;
+export interface IdentityOptions {
+    /** identity attribute ('handle' or '*') */
+    attr: IdentityAttr;
+}
+/**
+ * builds an identity permission scope
+ * @param options identity permission options
+ * @returns scope string like `identity?attr=handle`
+ */
+export declare const identity: (options: IdentityOptions) => string;
+export interface IncludeOptions {
+    /** lexicon NSID */
+    nsid: Nsid;
+    /** optional audience override */
+    aud?: AtprotoAudience;
+}
+/**
+ * builds an include scope for lexicon-defined permission sets
+ * @param options include scope options
+ * @returns scope string like `include?nsid=app.bsky.permissions&aud=did:web:bsky.app%23appview`
+ */
+export declare const include: (options: IncludeOptions) => string;
+//# sourceMappingURL=scope.d.ts.map

package/dist/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../lib/scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAErE,0BAA0B;AAC1B,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD,yBAAyB;AACzB,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEtD,sBAAsB;AACtB,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE9C,0BAA0B;AAC1B,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,GAAG,CAAC;AAE1C,8CAA8C;AAC9C,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,GAAG,CAAC;AAEzC,kDAAkD;AAClD,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,GAAG,CAAC;AAElC,wDAAwD;AACxD,MAAM,MAAM,QAAQ,GAAG,eAAe,GAAG,GAAG,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC3B,wCAAwC;IACxC,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,gEAAgE;IAChE,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,IAAI,kCAahB,CAAC;AAEF,MAAM,WAAW,UAAU;IAC1B,4CAA4C;IAC5C,GAAG,EAAE,QAAQ,EAAE,CAAC;IAChB,eAAe;IACf,GAAG,EAAE,QAAQ,CAAC;CACd;AAED;;;;GAIG;AACH,eAAO,MAAM,GAAG,iCAWf,CAAC;AAEF,MAAM,WAAW,cAAc;IAC9B,8CAA8C;IAC9C,IAAI,EAAE,WAAW,CAAC;IAClB,gDAAgD;IAChD,MAAM,CAAC,EAAE,aAAa,CAAC;CACvB;AAED;;;;GAIG;AACH,eAAO,MAAM,OAAO,qCAWnB,CAAC;AAEF,MAAM,WAAW,WAAW;IAC3B,uDAAuD;IACvD,MAAM,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,eAAO,MAAM,IAAI,kCAUhB,CAAC;AAEF,MAAM,WAAW,eAAe;IAC/B,2CAA2C;IAC3C,IAAI,EAAE,YAAY,CAAC;CACnB;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,sCAKpB,CAAC;AAEF,MAAM,WAAW,cAAc;IAC9B,mBAAmB;IACnB,IAAI,EAAE,IAAI,CAAC;IACX,iCAAiC;IACjC,GAAG,CAAC,EAAE,eAAe,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,OAAO,qCAWnB,CAAC"}

package/dist/scope.js

@@ -0,0 +1,102 @@
+/**
+ * builds a repo permission scope
+ * @param options repo permission options
+ * @returns scope string like `repo?collection=app.bsky.feed.post&action=create&action=update`
+ */
+export const repo = (options) => {
+    const { collection, action = [] } = options;
+    const params = new URLSearchParams();
+    for (const c of collection) {
+        params.append('collection', c);
+    }
+    for (const a of action) {
+        params.append('action', a);
+    }
+    return formatScope('repo', params);
+};
+/**
+ * builds an rpc permission scope
+ * @param options rpc permission options
+ * @returns scope string like `rpc?lxm=app.bsky.feed.getFeed&aud=*`
+ */
+export const rpc = (options) => {
+    const { lxm, aud } = options;
+    const params = new URLSearchParams();
+    params.set('aud', aud);
+    for (const l of lxm) {
+        params.append('lxm', l);
+    }
+    return formatScope('rpc', params);
+};
+/**
+ * builds an account permission scope
+ * @param options account permission options
+ * @returns scope string like `account?attr=email` or `account?attr=email&action=manage`
+ */
+export const account = (options) => {
+    const { attr, action } = options;
+    const params = new URLSearchParams();
+    params.set('attr', attr);
+    if (action !== undefined) {
+        params.set('action', action);
+    }
+    return formatScope('account', params);
+};
+/**
+ * builds a blob permission scope
+ * @param options blob permission options
+ * @returns scope string like `blob?accept=image/*`
+ */
+export const blob = (options) => {
+    const { accept } = options;
+    const params = new URLSearchParams();
+    for (const a of accept) {
+        params.append('accept', a);
+    }
+    return formatScope('blob', params);
+};
+/**
+ * builds an identity permission scope
+ * @param options identity permission options
+ * @returns scope string like `identity?attr=handle`
+ */
+export const identity = (options) => {
+    const params = new URLSearchParams();
+    params.set('attr', options.attr);
+    return formatScope('identity', params);
+};
+/**
+ * builds an include scope for lexicon-defined permission sets
+ * @param options include scope options
+ * @returns scope string like `include?nsid=app.bsky.permissions&aud=did:web:bsky.app%23appview`
+ */
+export const include = (options) => {
+    const { nsid, aud } = options;
+    const params = new URLSearchParams();
+    params.set('nsid', nsid);
+    if (aud !== undefined) {
+        params.set('aud', aud);
+    }
+    return formatScope('include', params);
+};
+// characters that should remain unencoded in scope strings
+const ALLOWED_CHARS = new Set([':', '/', '+', ',', '@', '%']);
+// format a scope string matching atproto oauth-scopes format
+const formatScope = (prefix, params) => {
+    if (params.size === 0) {
+        return prefix;
+    }
+    return `${prefix}?${normalizeEncoding(params.toString())}`;
+};
+// normalize URL encoding to match atproto format
+// keeps : / + , @ unencoded, but # must stay as %23
+const normalizeEncoding = (value) => {
+    return value.replace(/%[0-9A-F]{2}/gi, (match) => {
+        const char = decodeURIComponent(match);
+        if (ALLOWED_CHARS.has(char)) {
+            return char;
+        }
+        return match.toUpperCase();
+    });
+};
+//# sourceMappingURL=scope.js.map

package/dist/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../lib/scope.ts"],"names":[],"mappings":"AA8BA;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAAoB,EAAU,EAAE,CAAC;IACrD,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;IAE5C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAAA,CACnC,CAAC;AASF;;;;GAIG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,OAAmB,EAAU,EAAE,CAAC;IACnD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAE7B,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAAA,CAClC,CAAC;AASF;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAuB,EAAU,EAAE,CAAC;IAC3D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAEjC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEzB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAAA,CACtC,CAAC;AAOF;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAAoB,EAAU,EAAE,CAAC;IACrD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAErC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAAA,CACnC,CAAC;AAOF;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAwB,EAAU,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjC,OAAO,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AAAA,CACvC,CAAC;AASF;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAuB,EAAU,EAAE,CAAC;IAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAE9B,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEzB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAAA,CACtC,CAAC;AAEF,2DAA2D;AAC3D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE9D,6DAA6D;AAC7D,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,MAAuB,EAAU,EAAE,CAAC;IACxE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC;IACf,CAAC;IAED,OAAO,GAAG,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;AAAA,CAC3D,CAAC;AAEF,iDAAiD;AACjD,oDAAoD;AACpD,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC;IACpD,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IAAA,CAC3B,CAAC,CAAC;AAAA,CACH,CAAC"}