@atproto/lex-server 0.0.2 → 0.0.4

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @atproto/lex-server
 
+## 0.0.4
+
+### Patch Changes
+
+- Updated dependencies [[`d78484f`](https://github.com/bluesky-social/atproto/commit/d78484f94d8ba1352ec66030115000d515c9dafe), [`d78484f`](https://github.com/bluesky-social/atproto/commit/d78484f94d8ba1352ec66030115000d515c9dafe), [`d78484f`](https://github.com/bluesky-social/atproto/commit/d78484f94d8ba1352ec66030115000d515c9dafe), [`d78484f`](https://github.com/bluesky-social/atproto/commit/d78484f94d8ba1352ec66030115000d515c9dafe), [`d78484f`](https://github.com/bluesky-social/atproto/commit/d78484f94d8ba1352ec66030115000d515c9dafe), [`d78484f`](https://github.com/bluesky-social/atproto/commit/d78484f94d8ba1352ec66030115000d515c9dafe), [`d78484f`](https://github.com/bluesky-social/atproto/commit/d78484f94d8ba1352ec66030115000d515c9dafe)]:
+  - @atproto/lex-data@0.0.7
+  - @atproto/lex-schema@0.0.8
+  - @atproto/lex-cbor@0.0.7
+  - @atproto/lex-json@0.0.7
+
+## 0.0.3
+
+### Patch Changes
+
+- [#4501](https://github.com/bluesky-social/atproto/pull/4501) [`2f78893`](https://github.com/bluesky-social/atproto/commit/2f78893ace3bbf14d4bac36837820ddb46658c98) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add service auth authentication method
+
+- Updated dependencies [[`2f78893`](https://github.com/bluesky-social/atproto/commit/2f78893ace3bbf14d4bac36837820ddb46658c98), [`2f78893`](https://github.com/bluesky-social/atproto/commit/2f78893ace3bbf14d4bac36837820ddb46658c98), [`2f78893`](https://github.com/bluesky-social/atproto/commit/2f78893ace3bbf14d4bac36837820ddb46658c98), [`2f78893`](https://github.com/bluesky-social/atproto/commit/2f78893ace3bbf14d4bac36837820ddb46658c98), [`2f78893`](https://github.com/bluesky-social/atproto/commit/2f78893ace3bbf14d4bac36837820ddb46658c98)]:
+  - @atproto/lex-data@0.0.6
+  - @atproto/did@0.2.4
+  - @atproto/lex-schema@0.0.7
+  - @atproto/lex-cbor@0.0.6
+  - @atproto/lex-json@0.0.6
+  - @atproto-labs/did-resolver@0.2.5
+
 ## 0.0.2
 
 ### Patch Changes

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { LexError, type LexErrorCode, type LexErrorData, } from '@atproto/lex-data';
 export * from './errors.js';
 export * from './lex-server.js';
+export * from './service-auth.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,mBAAmB,CAAA;AAE1B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,mBAAmB,CAAA;AAE1B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}

package/dist/index.js

@@ -6,4 +6,5 @@ var lex_data_1 = require("@atproto/lex-data");
 Object.defineProperty(exports, "LexError", { enumerable: true, get: function () { return lex_data_1.LexError; } });
 tslib_1.__exportStar(require("./errors.js"), exports);
 tslib_1.__exportStar(require("./lex-server.js"), exports);
+tslib_1.__exportStar(require("./service-auth.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;AAAA,8CAI0B;AAHxB,oGAAA,QAAQ,OAAA;AAKV,sDAA2B;AAC3B,0DAA+B","sourcesContent":["export {\n  LexError,\n  type LexErrorCode,\n  type LexErrorData,\n} from '@atproto/lex-data'\n\nexport * from './errors.js'\nexport * from './lex-server.js'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;AAAA,8CAI0B;AAHxB,oGAAA,QAAQ,OAAA;AAKV,sDAA2B;AAC3B,0DAA+B;AAC/B,4DAAiC","sourcesContent":["export {\n  LexError,\n  type LexErrorCode,\n  type LexErrorData,\n} from '@atproto/lex-data'\n\nexport * from './errors.js'\nexport * from './lex-server.js'\nexport * from './service-auth.js'\n"]}

package/dist/lex-server.d.ts

@@ -1,6 +1,6 @@
 import { InferMethodInput, InferMethodMessage, InferMethodOutput, InferMethodOutputBody, InferMethodOutputEncoding, InferMethodParams, Main, Procedure, Query, Subscription } from '@atproto/lex-schema';
 type Awaitable<T> = T | Promise<T>;
-type LexMethod = Query | Procedure | Subscription;
+export type LexMethod = Query | Procedure | Subscription;
 export type NetAddr = {
     hostname: string;
     port: number;
@@ -37,19 +37,20 @@ export type LexRouterHandlerOutput<Method extends Query | Procedure> = Response
 export type LexRouterMethodHandler<Method extends Query | Procedure = Query | Procedure, Credentials = unknown> = (ctx: LexRouterHandlerContext<Method, Credentials>) => Awaitable<LexRouterHandlerOutput<Method>>;
 export type LexRouterMethodConfig<Method extends Query | Procedure = Query | Procedure, Credentials = unknown> = {
     handler: LexRouterMethodHandler<Method, Credentials>;
-    auth: LexRouterAuth<Method, Credentials>;
+    auth: LexRouterAuth<Credentials, Method>;
 };
 export type LexRouterSubscriptionHandler<Method extends Subscription = Subscription, Credentials = unknown> = (ctx: LexRouterHandlerContext<Method, Credentials>) => AsyncIterable<InferMethodMessage<Method>>;
 export type LexRouterSubscriptionConfig<Method extends Subscription = Subscription, Credentials = unknown> = {
     handler: LexRouterSubscriptionHandler<Method, Credentials>;
-    auth: LexRouterAuth<Method, Credentials>;
+    auth: LexRouterAuth<Credentials, Method>;
 };
 export type LexRouterAuthContext<Method extends LexMethod = LexMethod> = {
+    method: Method;
     params: InferMethodParams<Method>;
     request: Request;
     connection?: ConnectionInfo;
 };
-export type LexRouterAuth<Method extends LexMethod = LexMethod, Credentials = unknown> = (ctx: LexRouterAuthContext<Method>) => Credentials | Promise<Credentials>;
+export type LexRouterAuth<Credentials = unknown, Method extends LexMethod = LexMethod> = (ctx: LexRouterAuthContext<Method>) => Credentials | Promise<Credentials>;
 export type LexErrorHandlerContext = {
     error: unknown;
     request: Request;
@@ -73,6 +74,7 @@ export declare class LexRouter {
     add<M extends Subscription, Credentials>(ns: Main<M>, config: LexRouterSubscriptionConfig<M, Credentials>): this;
     add<M extends Query | Procedure>(ns: Main<M>, handler: LexRouterMethodHandler<M, void>): this;
     add<M extends Query | Procedure, Credentials>(ns: Main<M>, config: LexRouterMethodConfig<M, Credentials>): this;
+    add<M extends LexMethod, Credentials = unknown>(ns: Main<M>, config: M extends Subscription ? LexRouterSubscriptionHandler<M, Credentials> | LexRouterSubscriptionConfig<M, Credentials> : M extends Query | Procedure ? LexRouterMethodHandler<M, Credentials> | LexRouterMethodConfig<M, Credentials> : never): this;
     private buildMethodHandler;
     private buildSubscriptionHandler;
     private handleError;

package/dist/lex-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lex-server.d.ts","sourceRoot":"","sources":["../src/lex-server.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,EACjB,IAAI,EAEJ,SAAS,EACT,KAAK,EACL,YAAY,EAGb,MAAM,qBAAqB,CAAA;AAG5B,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAClC,KAAK,SAAS,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAA;AAEjD,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,KAAK,GAAG,KAAK,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,GAAG,YAAY,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;AAEjD,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,IAAI;IAClD,UAAU,EAAE,CAAC,CAAA;IACb,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB,CAAA;AAED,KAAK,OAAO,GAAG,CACb,OAAO,EAAE,OAAO,EAChB,UAAU,CAAC,EAAE,cAAc,KACxB,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEtB,MAAM,MAAM,uBAAuB,CAAC,MAAM,SAAS,SAAS,EAAE,WAAW,IAAI;IAC3E,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACrC,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,WAAW,CAAA;IACnB,UAAU,CAAC,EAAE,cAAc,CAAA;CAC5B,CAAA;AAED,KAAK,wBAAwB,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,GAAG,IAAI,GACzD;IAAE,QAAQ,CAAC,EAAE,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE,GAC1C,CAAC,CAAA;AAEL,MAAM,MAAM,sBAAsB,CAAC,MAAM,SAAS,KAAK,GAAG,SAAS,IAC/D,QAAQ,GACR,CAAC;IACC,OAAO,CAAC,EAAE,WAAW,CAAA;CACtB,GAAG,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,kBAAkB,GAC7D;IAEE,QAAQ,CAAC,EAAE,kBAAkB,CAAA;IAC7B,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAA;CACpC,GACD,wBAAwB,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAEvE,MAAM,MAAM,sBAAsB,CAChC,MAAM,SAAS,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,EACpD,WAAW,GAAG,OAAO,IACnB,CACF,GAAG,EAAE,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,KAC9C,SAAS,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAA;AAE9C,MAAM,MAAM,qBAAqB,CAC/B,MAAM,SAAS,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,EACpD,WAAW,GAAG,OAAO,IACnB;IACF,OAAO,EAAE,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACpD,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,4BAA4B,CACtC,MAAM,SAAS,YAAY,GAAG,YAAY,EAC1C,WAAW,GAAG,OAAO,IACnB,CACF,GAAG,EAAE,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,KAC9C,aAAa,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAA;AAE9C,MAAM,MAAM,2BAA2B,CACrC,MAAM,SAAS,YAAY,GAAG,YAAY,EAC1C,WAAW,GAAG,OAAO,IACnB;IACF,OAAO,EAAE,4BAA4B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC1D,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,oBAAoB,CAAC,MAAM,SAAS,SAAS,GAAG,SAAS,IAAI;IACvE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,cAAc,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,aAAa,CACvB,MAAM,SAAS,SAAS,GAAG,SAAS,EACpC,WAAW,GAAG,OAAO,IACnB,CAAC,GAAG,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;AAE7E,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,OAAO,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,SAAS,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK;IACnD,MAAM,EAAE,SAAS,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,sBAAsB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,qBAAa,SAAS;IAGR,QAAQ,CAAC,OAAO,EAAE,gBAAgB;IAF9C,OAAO,CAAC,QAAQ,CAAsC;gBAEjC,OAAO,GAAE,gBAAqB;IAEnD,GAAG,CAAC,CAAC,SAAS,YAAY,EACxB,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EACX,OAAO,EAAE,4BAA4B,CAAC,CAAC,EAAE,IAAI,CAAC,GAC7C,IAAI;IACP,GAAG,CAAC,CAAC,SAAS,YAAY,EAAE,WAAW,EACrC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EACX,MAAM,EAAE,2BAA2B,CAAC,CAAC,EAAE,WAAW,CAAC,GAClD,IAAI;IACP,GAAG,CAAC,CAAC,SAAS,KAAK,GAAG,SAAS,EAC7B,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EACX,OAAO,EAAE,sBAAsB,CAAC,CAAC,EAAE,IAAI,CAAC,GACvC,IAAI;IACP,GAAG,CAAC,CAAC,SAAS,KAAK,GAAG,SAAS,EAAE,WAAW,EAC1C,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EACX,MAAM,EAAE,qBAAqB,CAAC,CAAC,EAAE,WAAW,CAAC,GAC5C,IAAI;IAoCP,OAAO,CAAC,kBAAkB;IAuE1B,OAAO,CAAC,wBAAwB;YA4JlB,WAAW;IAqBzB,MAAM,EAAE,OAAO,CA0Bd;CACF"}
+{"version":3,"file":"lex-server.d.ts","sourceRoot":"","sources":["../src/lex-server.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,EACjB,IAAI,EAEJ,SAAS,EACT,KAAK,EACL,YAAY,EAGb,MAAM,qBAAqB,CAAA;AAG5B,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAClC,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAA;AAExD,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,KAAK,GAAG,KAAK,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,GAAG,YAAY,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;AAEjD,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,IAAI;IAClD,UAAU,EAAE,CAAC,CAAA;IACb,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB,CAAA;AAED,KAAK,OAAO,GAAG,CACb,OAAO,EAAE,OAAO,EAChB,UAAU,CAAC,EAAE,cAAc,KACxB,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEtB,MAAM,MAAM,uBAAuB,CAAC,MAAM,SAAS,SAAS,EAAE,WAAW,IAAI;IAC3E,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACrC,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,WAAW,CAAA;IACnB,UAAU,CAAC,EAAE,cAAc,CAAA;CAC5B,CAAA;AAED,KAAK,wBAAwB,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,GAAG,IAAI,GACzD;IAAE,QAAQ,CAAC,EAAE,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE,GAC1C,CAAC,CAAA;AAEL,MAAM,MAAM,sBAAsB,CAAC,MAAM,SAAS,KAAK,GAAG,SAAS,IAC/D,QAAQ,GACR,CAAC;IACC,OAAO,CAAC,EAAE,WAAW,CAAA;CACtB,GAAG,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,kBAAkB,GAC7D;IAEE,QAAQ,CAAC,EAAE,kBAAkB,CAAA;IAC7B,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAA;CACpC,GACD,wBAAwB,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAEvE,MAAM,MAAM,sBAAsB,CAChC,MAAM,SAAS,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,EACpD,WAAW,GAAG,OAAO,IACnB,CACF,GAAG,EAAE,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,KAC9C,SAAS,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAA;AAE9C,MAAM,MAAM,qBAAqB,CAC/B,MAAM,SAAS,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,EACpD,WAAW,GAAG,OAAO,IACnB;IACF,OAAO,EAAE,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACpD,IAAI,EAAE,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,4BAA4B,CACtC,MAAM,SAAS,YAAY,GAAG,YAAY,EAC1C,WAAW,GAAG,OAAO,IACnB,CACF,GAAG,EAAE,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,KAC9C,aAAa,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAA;AAE9C,MAAM,MAAM,2BAA2B,CACrC,MAAM,SAAS,YAAY,GAAG,YAAY,EAC1C,WAAW,GAAG,OAAO,IACnB;IACF,OAAO,EAAE,4BAA4B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC1D,IAAI,EAAE,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,oBAAoB,CAAC,MAAM,SAAS,SAAS,GAAG,SAAS,IAAI;IACvE,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,cAAc,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,aAAa,CACvB,WAAW,GAAG,OAAO,EACrB,MAAM,SAAS,SAAS,GAAG,SAAS,IAClC,CAAC,GAAG,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;AAE7E,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,OAAO,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,SAAS,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK;IACnD,MAAM,EAAE,SAAS,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,sBAAsB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,qBAAa,SAAS;IAGR,QAAQ,CAAC,OAAO,EAAE,gBAAgB;IAF9C,OAAO,CAAC,QAAQ,CAAsC;gBAEjC,OAAO,GAAE,gBAAqB;IAEnD,GAAG,CAAC,CAAC,SAAS,YAAY,EACxB,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EACX,OAAO,EAAE,4BAA4B,CAAC,CAAC,EAAE,IAAI,CAAC,GAC7C,IAAI;IACP,GAAG,CAAC,CAAC,SAAS,YAAY,EAAE,WAAW,EACrC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EACX,MAAM,EAAE,2BAA2B,CAAC,CAAC,EAAE,WAAW,CAAC,GAClD,IAAI;IACP,GAAG,CAAC,CAAC,SAAS,KAAK,GAAG,SAAS,EAC7B,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EACX,OAAO,EAAE,sBAAsB,CAAC,CAAC,EAAE,IAAI,CAAC,GACvC,IAAI;IACP,GAAG,CAAC,CAAC,SAAS,KAAK,GAAG,SAAS,EAAE,WAAW,EAC1C,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EACX,MAAM,EAAE,qBAAqB,CAAC,CAAC,EAAE,WAAW,CAAC,GAC5C,IAAI;IACP,GAAG,CAAC,CAAC,SAAS,SAAS,EAAE,WAAW,GAAG,OAAO,EAC5C,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EACX,MAAM,EAAE,CAAC,SAAS,YAAY,GAEtB,4BAA4B,CAAC,CAAC,EAAE,WAAW,CAAC,GAC5C,2BAA2B,CAAC,CAAC,EAAE,WAAW,CAAC,GAC/C,CAAC,SAAS,KAAK,GAAG,SAAS,GAErB,sBAAsB,CAAC,CAAC,EAAE,WAAW,CAAC,GACtC,qBAAqB,CAAC,CAAC,EAAE,WAAW,CAAC,GACzC,KAAK,GACV,IAAI;IAoCP,OAAO,CAAC,kBAAkB;IAuE1B,OAAO,CAAC,wBAAwB;YA4JlB,WAAW;IAqBzB,MAAM,EAAE,OAAO,CA0Bd;CACF"}

package/dist/lex-server.js

@@ -43,7 +43,7 @@ class LexRouter {
                 const url = new URL(request.url);
                 const params = method.parameters.fromURLSearchParams(url.searchParams);
                 const credentials = auth
-                    ? await auth({ params, request, connection })
+                    ? await auth({ method, params, request, connection })
                     : undefined;
                 const input = await getInput(request);
                 const output = await methodHandler({
@@ -119,7 +119,7 @@ class LexRouter {
                         const url = new URL(request.url);
                         const params = method.parameters.fromURLSearchParams(url.searchParams);
                         const credentials = auth
-                            ? await auth({ params, request, connection })
+                            ? await auth({ method, params, request, connection })
                             : undefined;
                         signal.throwIfAborted();
                         const iterable = methodHandler({

package/dist/lex-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"lex-server.js","sourceRoot":"","sources":["../src/lex-server.ts"],"names":[],"mappings":";;;AAAA,gDAA0C;AAC1C,gDAAgF;AAChF,gDAAuD;AACvD,oDAc4B;AAC5B,iEAAyD;AAgHzD,MAAa,SAAS;IAGC;IAFb,QAAQ,GAA6B,IAAI,GAAG,EAAE,CAAA;IAEtD,YAAqB,UAA4B,EAAE;QAA9B,YAAO,GAAP,OAAO,CAAuB;IAAG,CAAC;IAkBvD,GAAG,CACD,EAAW,EACX,MAImC;QAEnC,MAAM,MAAM,GAAG,IAAA,oBAAO,EAAC,EAAE,CAAC,CAAA;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CAAC,UAAU,MAAM,CAAC,IAAI,qBAAqB,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,YAAY,GAChB,OAAO,MAAM,KAAK,UAAU;YAC1B,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;YACtC,CAAC,CAAC,MAAM,CAAA;QAEZ,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,KAAK,cAAc;YAC5B,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAC3B,MAAM,EACN,YAAY,CAAC,OAAiD,EAC9D,YAAY,CAAC,IAAI,CAClB;YACH,CAAC,CAAC,IAAI,CAAC,kBAAkB,CACrB,MAAM,EACN,YAAY,CAAC,OAA2C,EACxD,YAAY,CAAC,IAAI,CAClB,CAAA;QAEP,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAEvC,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,kBAAkB,CACxB,MAAc,EACd,aAA0D,EAC1D,IAAyC;QAEzC,MAAM,QAAQ,GAAG,CACf,MAAM,CAAC,IAAI,KAAK,WAAW;YACzB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;YAChC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CACkC,CAAA;QAElE,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;YACnC,wEAAwE;YACxE,cAAc;YACd,IACE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;gBAC1D,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;oBACtB,OAAO,CAAC,MAAM,KAAK,KAAK;oBACxB,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,EAC5B,CAAC;gBACD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAC1D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAChC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;gBAEtE,MAAM,WAAW,GAAG,IAAI;oBACtB,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;oBAC7C,CAAC,CAAE,SAAyB,CAAA;gBAE9B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAErC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;oBACjC,WAAW;oBACX,MAAM;oBACN,KAAK;oBACL,OAAO;oBACP,UAAU;oBACV,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAA;gBAEF,IAAI,MAAM,YAAY,QAAQ,EAAE,CAAC;oBAC/B,OAAO,MAAM,CAAA;gBACf,CAAC;gBAED,gEAAgE;gBAEhE,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;gBACrE,CAAC;gBAED,IAAI,MAAM,CAAC,MAAM,EAAE,QAAQ,KAAK,kBAAkB,EAAE,CAAC;oBACnD,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAA,oBAAS,EAAC,MAAM,CAAC,IAAgB,CAAC,EAAE;wBACvD,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,MAAM,CAAC,OAAO;qBACxB,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAC3C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,QAAS,CAAC,CAAA;gBAC7C,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;YACjD,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAEO,wBAAwB,CAC9B,MAAc,EACd,aAAgE,EAChE,IAAyC;QAEzC,MAAM,EACJ,cAAc,EACd,gBAAgB,GAAI,UAAkB,CAAC,IAAI,EAAE,gBAEhC,GACd,GAAG,IAAI,CAAC,OAAO,CAAA;QAChB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,SAAS,CACjB,6HAA6H,CAC9H,CAAA;QACH,CAAC;QAED,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;YACnC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7B,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAC1D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YAED,IACE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,KAAK,SAAS;gBAC9D,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,WAAW,EAC7D,CAAC;gBACD,OAAO,QAAQ,CAAC,IAAI,CAClB;oBACE,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,sDAAsD;iBAChE,EACD;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,UAAU,EAAE,SAAS;wBACrB,OAAO,EAAE,WAAW;qBACrB;iBACF,CACF,CAAA;YACH,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC3B,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAC/D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;gBAEtD,wEAAwE;gBACxE,qEAAqE;gBACrE,mBAAmB;gBACnB,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAA;gBAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAA;gBAClC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAA;gBAE3C,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE;oBACnC,MAAM,KAAK,GAAG,IAAI,mBAAQ,CACxB,gBAAgB,EAChB,2CAA2C,EAC3C,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAA;oBACD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAA;oBACpC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;gBACjC,CAAC,CAAA;gBAED,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;oBACxB,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;wBAChC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAClD,GAAG,CAAC,YAAY,CACjB,CAAA;wBAED,MAAM,WAAW,GAAgB,IAAI;4BACnC,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;4BAC7C,CAAC,CAAE,SAAyB,CAAA;wBAE9B,MAAM,CAAC,cAAc,EAAE,CAAA;wBAEvB,MAAM,QAAQ,GAAG,aAAa,CAAC;4BAC7B,WAAW;4BACX,MAAM;4BACN,KAAK,EAAE,SAA2C;4BAClD,OAAO;4BACP,UAAU;4BACV,MAAM;yBACP,CAAC,CAAA;wBAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAA;wBAEjD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;4BAC1C,uDAAuD;4BACvD,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAA;wBAC3B,CAAC,CAAC,CAAA;wBAEF,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;4BAClD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;4BACpC,IAAI,MAAM,CAAC,IAAI;gCAAE,MAAK;4BAEtB,gEAAgE;4BAEhE,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;4BAErD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;4BAEjB,+DAA+D;4BAC/D,qCAAqC;4BACrC,MAAM,IAAA,mCAAc,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;wBACpD,CAAC;wBAED,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;4BAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;wBACpB,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,kEAAkE;wBAClE,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;4BAC5B,MAAM,QAAQ,GACZ,KAAK,YAAY,mBAAQ;gCACvB,CAAC,CAAC,KAAK;gCACP,CAAC,CAAC,IAAI,mBAAQ,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAA;4BAEjE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAA;4BAEvC,MAAM,CAAC,KAAK;4BACV,uDAAuD;4BACvD,KAAK,YAAY,mBAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EACvC,QAAQ,CAAC,KAAK,CACf,CAAA;wBACH,CAAC;wBAED,2CAA2C;wBAC3C,IAAI,cAAc,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;4BAC5D,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;wBAClD,CAAC;oBACH,CAAC;4BAAS,CAAC;wBACT,eAAe,CAAC,KAAK,EAAE,CAAA;oBACzB,CAAC;gBACH,CAAC,CAAA;gBAED,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBACvC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBACvC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBACvC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;gBAE7C,OAAO,QAAQ,CAAA;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;YACjD,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,OAAgB,EAChB,MAAiB,EACjB,KAAc;QAEd,2CAA2C;QAC3C,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,CAAA;QACvC,IAAI,cAAc,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QAClD,CAAC;QAED,IAAI,KAAK,YAAY,mBAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,UAAU,EAAE,CAAA;QAC3B,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,4BAA4B,EAAE,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;IAED,MAAM,GAAY,KAAK,EACrB,OAAgB,EAChB,UAA2B,EACR,EAAE;QACrB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;QAEvC,MAAM,OAAO,GAAI,IAAI,CAAC,QAAwC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACxE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAEhD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAA,yBAAY,EAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC,IAAI,CAClB;gBACE,KAAK,EAAE,gBAAgB;gBACvB,OAAO,EAAE,0BAA0B;aACpC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAClB;YACE,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,gBAAgB,IAAI,kCAAkC;SAChE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC,CAAA;CACF;AA3UD,8BA2UC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,6EAA6E;IAC7E,uDAAuD;IACvD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC1B,CAAC;AAED,KAAK,UAAU,iBAAiB,CAE9B,OAAgB;IAEhB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO;SAChC,GAAG,CAAC,cAAc,CAAC;QACpB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACd,IAAI,EAAE;SACN,WAAW,EAAE,CAAA;IAEhB,MAAM,QAAQ,GACZ,WAAW;QACX,+DAA+D;QAC/D,kCAAkC;QAClC,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI;YAClD,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,SAAS,CAAC,CAAA;IAEhB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,mBAAQ,CAAC,gBAAgB,EAAE,yBAAyB,QAAQ,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC/C,oBAAoB;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;YAC5B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,mBAAQ,EAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACzD,CAAC,CAAC,IAAA,mBAAQ,EAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QAClC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAA+B,CAAA;IACxD,CAAC;SAAM,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAS,OAAO,CAAA;QAC1B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAA+B,CAAA;IACxD,CAAC;SAAM,CAAC;QACN,OAAO,SAAsC,CAAA;IAC/C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAE1B,OAAgB;IAEhB,IACE,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACnC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EACrC,CAAC;QACD,MAAM,IAAI,mBAAQ,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,SAAsC,CAAA;AAC/C,CAAC;AAED,4CAA4C;AAC5C,MAAM,kBAAkB,GAAG,aAAa,CAAC,IAAA,iBAAM,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;AAE3D,SAAS,gBAAgB,CAAC,KAAe;IACvC,OAAO,IAAA,oBAAS,EAAC,CAAC,kBAAkB,EAAE,IAAA,iBAAM,EAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,gEAAgE;AAChE,MAAM,4BAA4B,GAAG,aAAa,CAAC,IAAA,iBAAM,EAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;AAEpE,SAAS,kBAAkB,CAAC,MAAoB,EAAE,KAAe;IAC/D,IAAI,IAAA,wBAAa,EAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAA;QAChC,OAAO,IAAA,oBAAS,EAAC;YACf,IAAA,iBAAM,EAAC;gBACL,EAAE,EAAE,CAAC;gBACL,CAAC;gBACC,sDAAsD;gBACtD,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM;oBACtC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,MAAM;oBACvD,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;oBAC3B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;oBACjC,CAAC,CAAC,KAAK;aACZ,CAAC;YACF,IAAA,iBAAM,EAAC,IAAI,CAAC;SACb,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,IAAA,oBAAS,EAAC,CAAC,4BAA4B,EAAE,IAAA,iBAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB,EAAE,KAAc;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI;QAAE,OAAO,KAAK,CAAA;IAC1D,OAAO,CACL,KAAK,KAAK,MAAM,CAAC,MAAM;QACvB,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,CAC1D,CAAA;AACH,CAAC","sourcesContent":["import { encode } from '@atproto/lex-cbor'\nimport { LexError, LexValue, isPlainObject, ui8Concat } from '@atproto/lex-data'\nimport { lexParse, lexToJson } from '@atproto/lex-json'\nimport {\n  InferMethodInput,\n  InferMethodMessage,\n  InferMethodOutput,\n  InferMethodOutputBody,\n  InferMethodOutputEncoding,\n  InferMethodParams,\n  Main,\n  NsidString,\n  Procedure,\n  Query,\n  Subscription,\n  getMain,\n  isNsidString,\n} from '@atproto/lex-schema'\nimport { drainWebsocket } from './lib/drain-websocket.js'\n\ntype Awaitable<T> = T | Promise<T>\ntype LexMethod = Query | Procedure | Subscription\n\nexport type NetAddr = {\n  hostname: string\n  port: number\n  transport: 'tcp' | 'udp'\n}\n\nexport type UnixAddr = {\n  path: string\n  transport: 'unix' | 'unixpacket'\n}\n\nexport type Addr = NetAddr | UnixAddr | undefined\n\nexport type ConnectionInfo<A extends Addr = Addr> = {\n  remoteAddr: A\n  completed: Promise<void>\n}\n\ntype Handler = (\n  request: Request,\n  connection?: ConnectionInfo,\n) => Promise<Response>\n\nexport type LexRouterHandlerContext<Method extends LexMethod, Credentials> = {\n  credentials: Credentials\n  input: InferMethodInput<Method, Body>\n  params: InferMethodParams<Method>\n  request: Request\n  signal: AbortSignal\n  connection?: ConnectionInfo\n}\n\ntype AsOptionalPayloadOptions<T> = T extends undefined | void\n  ? { encoding?: undefined; body?: undefined }\n  : T\n\nexport type LexRouterHandlerOutput<Method extends Query | Procedure> =\n  | Response\n  | ({\n      headers?: HeadersInit\n    } & (InferMethodOutputEncoding<Method> extends 'application/json'\n      ? {\n          // Allow omitting body when output is JSON\n          encoding?: 'application/json'\n          body: InferMethodOutputBody<Method>\n        }\n      : AsOptionalPayloadOptions<InferMethodOutput<Method, BodyInit>>))\n\nexport type LexRouterMethodHandler<\n  Method extends Query | Procedure = Query | Procedure,\n  Credentials = unknown,\n> = (\n  ctx: LexRouterHandlerContext<Method, Credentials>,\n) => Awaitable<LexRouterHandlerOutput<Method>>\n\nexport type LexRouterMethodConfig<\n  Method extends Query | Procedure = Query | Procedure,\n  Credentials = unknown,\n> = {\n  handler: LexRouterMethodHandler<Method, Credentials>\n  auth: LexRouterAuth<Method, Credentials>\n}\n\nexport type LexRouterSubscriptionHandler<\n  Method extends Subscription = Subscription,\n  Credentials = unknown,\n> = (\n  ctx: LexRouterHandlerContext<Method, Credentials>,\n) => AsyncIterable<InferMethodMessage<Method>>\n\nexport type LexRouterSubscriptionConfig<\n  Method extends Subscription = Subscription,\n  Credentials = unknown,\n> = {\n  handler: LexRouterSubscriptionHandler<Method, Credentials>\n  auth: LexRouterAuth<Method, Credentials>\n}\n\nexport type LexRouterAuthContext<Method extends LexMethod = LexMethod> = {\n  params: InferMethodParams<Method>\n  request: Request\n  connection?: ConnectionInfo\n}\n\nexport type LexRouterAuth<\n  Method extends LexMethod = LexMethod,\n  Credentials = unknown,\n> = (ctx: LexRouterAuthContext<Method>) => Credentials | Promise<Credentials>\n\nexport type LexErrorHandlerContext = {\n  error: unknown\n  request: Request\n  method: LexMethod\n}\n\nexport type UpgradeWebSocket = (request: Request) => {\n  socket: WebSocket\n  response: Response\n}\n\nexport type LexRouterOptions = {\n  upgradeWebSocket?: UpgradeWebSocket\n  onHandlerError?: (ctx: LexErrorHandlerContext) => void | Promise<void>\n  highWaterMark?: number\n  lowWaterMark?: number\n}\n\nexport class LexRouter {\n  private handlers: Map<NsidString, Handler> = new Map()\n\n  constructor(readonly options: LexRouterOptions = {}) {}\n\n  add<M extends Subscription>(\n    ns: Main<M>,\n    handler: LexRouterSubscriptionHandler<M, void>,\n  ): this\n  add<M extends Subscription, Credentials>(\n    ns: Main<M>,\n    config: LexRouterSubscriptionConfig<M, Credentials>,\n  ): this\n  add<M extends Query | Procedure>(\n    ns: Main<M>,\n    handler: LexRouterMethodHandler<M, void>,\n  ): this\n  add<M extends Query | Procedure, Credentials>(\n    ns: Main<M>,\n    config: LexRouterMethodConfig<M, Credentials>,\n  ): this\n  add<M extends LexMethod>(\n    ns: Main<M>,\n    config:\n      | LexRouterSubscriptionHandler<any, any>\n      | LexRouterSubscriptionConfig<any, any>\n      | LexRouterMethodHandler<any, any>\n      | LexRouterMethodConfig<any, any>,\n  ) {\n    const method = getMain(ns)\n    if (this.handlers.has(method.nsid)) {\n      throw new TypeError(`Method ${method.nsid} already registered`)\n    }\n    const methodConfig =\n      typeof config === 'function'\n        ? { handler: config, auth: undefined }\n        : config\n\n    const handler: Handler =\n      method.type === 'subscription'\n        ? this.buildSubscriptionHandler(\n            method,\n            methodConfig.handler as LexRouterSubscriptionHandler<any, any>,\n            methodConfig.auth,\n          )\n        : this.buildMethodHandler(\n            method,\n            methodConfig.handler as LexRouterMethodHandler<any, any>,\n            methodConfig.auth,\n          )\n\n    this.handlers.set(method.nsid, handler)\n\n    return this\n  }\n\n  private buildMethodHandler<Method extends Query | Procedure, Credentials>(\n    method: Method,\n    methodHandler: LexRouterMethodHandler<Method, Credentials>,\n    auth?: LexRouterAuth<Method, Credentials>,\n  ): Handler {\n    const getInput = (\n      method.type === 'procedure'\n        ? getProcedureInput.bind(method)\n        : getQueryInput.bind(method)\n    ) as (request: Request) => Promise<InferMethodInput<Method, Body>>\n\n    return async (request, connection) => {\n      // @NOTE CORS requests should be handled by a middleware before reaching\n      // this point.\n      if (\n        (method.type === 'procedure' && request.method !== 'POST') ||\n        (method.type === 'query' &&\n          request.method !== 'GET' &&\n          request.method !== 'HEAD')\n      ) {\n        return Response.json(\n          { error: 'InvalidRequest', message: 'Method not allowed' },\n          { status: 405 },\n        )\n      }\n\n      try {\n        const url = new URL(request.url)\n        const params = method.parameters.fromURLSearchParams(url.searchParams)\n\n        const credentials = auth\n          ? await auth({ params, request, connection })\n          : (undefined as Credentials)\n\n        const input = await getInput(request)\n\n        const output = await methodHandler({\n          credentials,\n          params,\n          input,\n          request,\n          connection,\n          signal: request.signal,\n        })\n\n        if (output instanceof Response) {\n          return output\n        }\n\n        // @TODO add validation of output based on method.output.schema?\n\n        if (output.body === undefined && output.encoding === undefined) {\n          return new Response(null, { status: 200, headers: output.headers })\n        }\n\n        if (method.output?.encoding === 'application/json') {\n          return Response.json(lexToJson(output.body as LexValue), {\n            status: 200,\n            headers: output.headers,\n          })\n        }\n\n        const headers = new Headers(output.headers)\n        headers.set('content-type', output.encoding!)\n        return new Response(output.body, { status: 200, headers })\n      } catch (error) {\n        return this.handleError(request, method, error)\n      }\n    }\n  }\n\n  private buildSubscriptionHandler<Method extends Subscription, Credentials>(\n    method: Method,\n    methodHandler: LexRouterSubscriptionHandler<Method, Credentials>,\n    auth?: LexRouterAuth<Method, Credentials>,\n  ): Handler {\n    const {\n      onHandlerError,\n      upgradeWebSocket = (globalThis as any).Deno?.upgradeWebSocket as\n        | UpgradeWebSocket\n        | undefined,\n    } = this.options\n    if (!upgradeWebSocket) {\n      throw new TypeError(\n        'WebSocket upgrade not supported in this environment. Please provide an upgradeWebSocket option when creating the LexRouter.',\n      )\n    }\n\n    return async (request, connection) => {\n      if (request.method !== 'GET') {\n        return Response.json(\n          { error: 'InvalidRequest', message: 'Method not allowed' },\n          { status: 405 },\n        )\n      }\n\n      if (\n        request.headers.get('connection')?.toLowerCase() !== 'upgrade' ||\n        request.headers.get('upgrade')?.toLowerCase() !== 'websocket'\n      ) {\n        return Response.json(\n          {\n            error: 'InvalidRequest',\n            message: 'XRPC subscriptions are only available over WebSocket',\n          },\n          {\n            status: 426,\n            headers: {\n              Connection: 'Upgrade',\n              Upgrade: 'websocket',\n            },\n          },\n        )\n      }\n\n      if (request.signal.aborted) {\n        return Response.json(\n          { error: 'RequestAborted', message: 'The request was aborted' },\n          { status: 499 },\n        )\n      }\n\n      try {\n        const { response, socket } = upgradeWebSocket(request)\n\n        // @NOTE We are using a distinct signal than request.signal because that\n        // signal may get aborted before the WebSocket is closed (this is the\n        // case with Deno).\n        const abortController = new AbortController()\n        const { signal } = abortController\n        const abort = () => abortController.abort()\n\n        const onMessage = (event: unknown) => {\n          const error = new LexError(\n            'InvalidRequest',\n            'XRPC subscriptions do not accept messages',\n            { cause: event },\n          )\n          socket.send(encodeErrorFrame(error))\n          socket.close(1008, error.error)\n        }\n\n        const onOpen = async () => {\n          try {\n            const url = new URL(request.url)\n            const params = method.parameters.fromURLSearchParams(\n              url.searchParams,\n            )\n\n            const credentials: Credentials = auth\n              ? await auth({ params, request, connection })\n              : (undefined as Credentials)\n\n            signal.throwIfAborted()\n\n            const iterable = methodHandler({\n              credentials,\n              params,\n              input: undefined as InferMethodInput<Method, Body>,\n              request,\n              connection,\n              signal,\n            })\n\n            const iterator = iterable[Symbol.asyncIterator]()\n\n            signal.addEventListener('abort', async () => {\n              // @NOTE will cause the process to crash if this throws\n              await iterator.return?.()\n            })\n\n            while (!signal.aborted && socket.readyState === 1) {\n              const result = await iterator.next()\n              if (result.done) break\n\n              // @TODO add validation of output based on method.output.schema?\n\n              const data = encodeMessageFrame(method, result.value)\n\n              socket.send(data)\n\n              // Apply backpressure by waiting for the buffered data to drain\n              // before generating the next message\n              await drainWebsocket(socket, signal, this.options)\n            }\n\n            if (socket.readyState === 1) {\n              socket.close(1000)\n            }\n          } catch (error) {\n            // If the socket is still open, send an error frame before closing\n            if (socket.readyState === 1) {\n              const lexError =\n                error instanceof LexError\n                  ? error\n                  : new LexError('InternalError', 'An internal error occurred')\n\n              socket.send(encodeErrorFrame(lexError))\n\n              socket.close(\n                // https://www.rfc-editor.org/rfc/rfc6455#section-7.4.1\n                error instanceof LexError ? 1008 : 1011,\n                lexError.error,\n              )\n            }\n\n            // Only report unexpected processing errors\n            if (onHandlerError && !isAbortReason(request.signal, error)) {\n              await onHandlerError({ error, request, method })\n            }\n          } finally {\n            abortController.abort()\n          }\n        }\n\n        socket.addEventListener('error', abort)\n        socket.addEventListener('close', abort)\n        socket.addEventListener('open', onOpen)\n        socket.addEventListener('message', onMessage)\n\n        return response\n      } catch (error) {\n        return this.handleError(request, method, error)\n      }\n    }\n  }\n\n  private async handleError(\n    request: Request,\n    method: LexMethod,\n    error: unknown,\n  ) {\n    // Only report unexpected processing errors\n    const { onHandlerError } = this.options\n    if (onHandlerError && !isAbortReason(request.signal, error)) {\n      await onHandlerError({ error, request, method })\n    }\n\n    if (error instanceof LexError) {\n      return error.toResponse()\n    }\n\n    return Response.json(\n      { error: 'InternalError', message: 'An internal error occurred' },\n      { status: 500 },\n    )\n  }\n\n  handle: Handler = async (\n    request: Request,\n    connection?: ConnectionInfo,\n  ): Promise<Response> => {\n    const nsid = extractMethodNsid(request)\n\n    const handler = (this.handlers as Map<string | null, Handler>).get(nsid)\n    if (handler) return handler(request, connection)\n\n    if (!nsid || !isNsidString(nsid)) {\n      return Response.json(\n        {\n          error: 'InvalidRequest',\n          message: 'Invalid XRPC method path',\n        },\n        { status: 404 },\n      )\n    }\n\n    return Response.json(\n      {\n        error: 'MethodNotImplemented',\n        message: `XRPC method \"${nsid}\" not implemented on this server`,\n      },\n      { status: 501 },\n    )\n  }\n}\n\nfunction extractMethodNsid(request: Request): string | null {\n  const { pathname } = new URL(request.url)\n  if (!pathname.startsWith('/xrpc/')) return null\n  if (pathname.includes('/', 6)) return null\n  // We don't really need to validate the NSID here, the existence of the route\n  // (which is looked up based on an NSID) is sufficient.\n  return pathname.slice(6)\n}\n\nasync function getProcedureInput<M extends Procedure>(\n  this: M,\n  request: Request,\n): Promise<InferMethodInput<M, Body>> {\n  const encodingRaw = request.headers\n    .get('content-type')\n    ?.split(';')[0]\n    .trim()\n    .toLowerCase()\n\n  const encoding =\n    encodingRaw ||\n    // If the caller did not provide a content-type, but the method\n    // expects an input, assume binary\n    (request.body != null && this.input.encoding != null\n      ? 'application/octet-stream'\n      : undefined)\n\n  if (!this.input.matchesEncoding(encoding)) {\n    throw new LexError('InvalidRequest', `Invalid content-type: ${encoding}`)\n  }\n\n  if (this.input.encoding === 'application/json') {\n    // @TODO limit size?\n    const body = this.input.schema\n      ? this.input.schema.parse(lexParse(await request.text()))\n      : lexParse(await request.text())\n    return { encoding, body } as InferMethodInput<M, Body>\n  } else if (this.input.encoding) {\n    const body: Body = request\n    return { encoding, body } as InferMethodInput<M, Body>\n  } else {\n    return undefined as InferMethodInput<M, Body>\n  }\n}\n\nasync function getQueryInput<M extends Query>(\n  this: M,\n  request: Request,\n): Promise<InferMethodInput<M, Body>> {\n  if (\n    request.body ||\n    request.headers.has('content-type') ||\n    request.headers.has('content-length')\n  ) {\n    throw new LexError('InvalidRequest', 'GET requests must not have a body')\n  }\n\n  return undefined as InferMethodInput<M, Body>\n}\n\n// Pre-encoded frame header for error frames\nconst ERROR_FRAME_HEADER = /*#__PURE__*/ encode({ op: -1 })\n\nfunction encodeErrorFrame(error: LexError): Uint8Array {\n  return ui8Concat([ERROR_FRAME_HEADER, encode(error.toJSON())])\n}\n\n// Pre-encoded frame header for message frames with unknown type\nconst UNKNOWN_MESSAGE_FRAME_HEADER = /*#__PURE__*/ encode({ op: 1 })\n\nfunction encodeMessageFrame(method: Subscription, value: LexValue): Uint8Array {\n  if (isPlainObject(value) && typeof value.$type === 'string') {\n    const { $type, ...rest } = value\n    return ui8Concat([\n      encode({\n        op: 1,\n        t:\n          // If $type starts with `nsid#`, strip the NSID prefix\n          $type.charCodeAt(0) !== 0x23 && // '#'\n          $type.charCodeAt(method.nsid.length) === 0x23 && // '#'\n          $type.startsWith(method.nsid)\n            ? $type.slice(method.nsid.length)\n            : $type,\n      }),\n      encode(rest),\n    ])\n  }\n\n  return ui8Concat([UNKNOWN_MESSAGE_FRAME_HEADER, encode(value)])\n}\n\nfunction isAbortReason(signal: AbortSignal, error: unknown): boolean {\n  if (!signal.aborted || signal.reason == null) return false\n  return (\n    error === signal.reason ||\n    (error instanceof Error && error.cause === signal.reason)\n  )\n}\n"]}
+{"version":3,"file":"lex-server.js","sourceRoot":"","sources":["../src/lex-server.ts"],"names":[],"mappings":";;;AAAA,gDAA0C;AAC1C,gDAAgF;AAChF,gDAAuD;AACvD,oDAc4B;AAC5B,iEAAyD;AAiHzD,MAAa,SAAS;IAGC;IAFb,QAAQ,GAA6B,IAAI,GAAG,EAAE,CAAA;IAEtD,YAAqB,UAA4B,EAAE;QAA9B,YAAO,GAAP,OAAO,CAAuB;IAAG,CAAC;IA8BvD,GAAG,CACD,EAAW,EACX,MAImC;QAEnC,MAAM,MAAM,GAAG,IAAA,oBAAO,EAAC,EAAE,CAAC,CAAA;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CAAC,UAAU,MAAM,CAAC,IAAI,qBAAqB,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,YAAY,GAChB,OAAO,MAAM,KAAK,UAAU;YAC1B,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;YACtC,CAAC,CAAC,MAAM,CAAA;QAEZ,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,KAAK,cAAc;YAC5B,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAC3B,MAAM,EACN,YAAY,CAAC,OAAiD,EAC9D,YAAY,CAAC,IAAI,CAClB;YACH,CAAC,CAAC,IAAI,CAAC,kBAAkB,CACrB,MAAM,EACN,YAAY,CAAC,OAA2C,EACxD,YAAY,CAAC,IAAI,CAClB,CAAA;QAEP,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAEvC,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,kBAAkB,CACxB,MAAc,EACd,aAA0D,EAC1D,IAAyC;QAEzC,MAAM,QAAQ,GAAG,CACf,MAAM,CAAC,IAAI,KAAK,WAAW;YACzB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;YAChC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CACkC,CAAA;QAElE,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;YACnC,wEAAwE;YACxE,cAAc;YACd,IACE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;gBAC1D,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;oBACtB,OAAO,CAAC,MAAM,KAAK,KAAK;oBACxB,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,EAC5B,CAAC;gBACD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAC1D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAChC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;gBAEtE,MAAM,WAAW,GAAG,IAAI;oBACtB,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;oBACrD,CAAC,CAAE,SAAyB,CAAA;gBAE9B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAErC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;oBACjC,WAAW;oBACX,MAAM;oBACN,KAAK;oBACL,OAAO;oBACP,UAAU;oBACV,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAA;gBAEF,IAAI,MAAM,YAAY,QAAQ,EAAE,CAAC;oBAC/B,OAAO,MAAM,CAAA;gBACf,CAAC;gBAED,gEAAgE;gBAEhE,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;gBACrE,CAAC;gBAED,IAAI,MAAM,CAAC,MAAM,EAAE,QAAQ,KAAK,kBAAkB,EAAE,CAAC;oBACnD,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAA,oBAAS,EAAC,MAAM,CAAC,IAAgB,CAAC,EAAE;wBACvD,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,MAAM,CAAC,OAAO;qBACxB,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAC3C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,QAAS,CAAC,CAAA;gBAC7C,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;YACjD,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAEO,wBAAwB,CAC9B,MAAc,EACd,aAAgE,EAChE,IAAyC;QAEzC,MAAM,EACJ,cAAc,EACd,gBAAgB,GAAI,UAAkB,CAAC,IAAI,EAAE,gBAEhC,GACd,GAAG,IAAI,CAAC,OAAO,CAAA;QAChB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,SAAS,CACjB,6HAA6H,CAC9H,CAAA;QACH,CAAC;QAED,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;YACnC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7B,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAC1D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YAED,IACE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,KAAK,SAAS;gBAC9D,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,WAAW,EAC7D,CAAC;gBACD,OAAO,QAAQ,CAAC,IAAI,CAClB;oBACE,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,sDAAsD;iBAChE,EACD;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,UAAU,EAAE,SAAS;wBACrB,OAAO,EAAE,WAAW;qBACrB;iBACF,CACF,CAAA;YACH,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC3B,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAC/D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;gBAEtD,wEAAwE;gBACxE,qEAAqE;gBACrE,mBAAmB;gBACnB,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAA;gBAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAA;gBAClC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAA;gBAE3C,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE;oBACnC,MAAM,KAAK,GAAG,IAAI,mBAAQ,CACxB,gBAAgB,EAChB,2CAA2C,EAC3C,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAA;oBACD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAA;oBACpC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;gBACjC,CAAC,CAAA;gBAED,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;oBACxB,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;wBAChC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAClD,GAAG,CAAC,YAAY,CACjB,CAAA;wBAED,MAAM,WAAW,GAAgB,IAAI;4BACnC,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;4BACrD,CAAC,CAAE,SAAyB,CAAA;wBAE9B,MAAM,CAAC,cAAc,EAAE,CAAA;wBAEvB,MAAM,QAAQ,GAAG,aAAa,CAAC;4BAC7B,WAAW;4BACX,MAAM;4BACN,KAAK,EAAE,SAA2C;4BAClD,OAAO;4BACP,UAAU;4BACV,MAAM;yBACP,CAAC,CAAA;wBAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAA;wBAEjD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;4BAC1C,uDAAuD;4BACvD,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAA;wBAC3B,CAAC,CAAC,CAAA;wBAEF,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;4BAClD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;4BACpC,IAAI,MAAM,CAAC,IAAI;gCAAE,MAAK;4BAEtB,gEAAgE;4BAEhE,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;4BAErD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;4BAEjB,+DAA+D;4BAC/D,qCAAqC;4BACrC,MAAM,IAAA,mCAAc,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;wBACpD,CAAC;wBAED,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;4BAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;wBACpB,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,kEAAkE;wBAClE,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;4BAC5B,MAAM,QAAQ,GACZ,KAAK,YAAY,mBAAQ;gCACvB,CAAC,CAAC,KAAK;gCACP,CAAC,CAAC,IAAI,mBAAQ,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAA;4BAEjE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAA;4BAEvC,MAAM,CAAC,KAAK;4BACV,uDAAuD;4BACvD,KAAK,YAAY,mBAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EACvC,QAAQ,CAAC,KAAK,CACf,CAAA;wBACH,CAAC;wBAED,2CAA2C;wBAC3C,IAAI,cAAc,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;4BAC5D,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;wBAClD,CAAC;oBACH,CAAC;4BAAS,CAAC;wBACT,eAAe,CAAC,KAAK,EAAE,CAAA;oBACzB,CAAC;gBACH,CAAC,CAAA;gBAED,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBACvC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBACvC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBACvC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;gBAE7C,OAAO,QAAQ,CAAA;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;YACjD,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,OAAgB,EAChB,MAAiB,EACjB,KAAc;QAEd,2CAA2C;QAC3C,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,CAAA;QACvC,IAAI,cAAc,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QAClD,CAAC;QAED,IAAI,KAAK,YAAY,mBAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,UAAU,EAAE,CAAA;QAC3B,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,4BAA4B,EAAE,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;IAED,MAAM,GAAY,KAAK,EACrB,OAAgB,EAChB,UAA2B,EACR,EAAE;QACrB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;QAEvC,MAAM,OAAO,GAAI,IAAI,CAAC,QAAwC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACxE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAEhD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAA,yBAAY,EAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC,IAAI,CAClB;gBACE,KAAK,EAAE,gBAAgB;gBACvB,OAAO,EAAE,0BAA0B;aACpC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAClB;YACE,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,gBAAgB,IAAI,kCAAkC;SAChE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC,CAAA;CACF;AAvVD,8BAuVC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,6EAA6E;IAC7E,uDAAuD;IACvD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC1B,CAAC;AAED,KAAK,UAAU,iBAAiB,CAE9B,OAAgB;IAEhB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO;SAChC,GAAG,CAAC,cAAc,CAAC;QACpB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACd,IAAI,EAAE;SACN,WAAW,EAAE,CAAA;IAEhB,MAAM,QAAQ,GACZ,WAAW;QACX,+DAA+D;QAC/D,kCAAkC;QAClC,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI;YAClD,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,SAAS,CAAC,CAAA;IAEhB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,mBAAQ,CAAC,gBAAgB,EAAE,yBAAyB,QAAQ,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC/C,oBAAoB;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;YAC5B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,mBAAQ,EAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACzD,CAAC,CAAC,IAAA,mBAAQ,EAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QAClC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAA+B,CAAA;IACxD,CAAC;SAAM,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAS,OAAO,CAAA;QAC1B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAA+B,CAAA;IACxD,CAAC;SAAM,CAAC;QACN,OAAO,SAAsC,CAAA;IAC/C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAE1B,OAAgB;IAEhB,IACE,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACnC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EACrC,CAAC;QACD,MAAM,IAAI,mBAAQ,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,SAAsC,CAAA;AAC/C,CAAC;AAED,4CAA4C;AAC5C,MAAM,kBAAkB,GAAG,aAAa,CAAC,IAAA,iBAAM,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;AAE3D,SAAS,gBAAgB,CAAC,KAAe;IACvC,OAAO,IAAA,oBAAS,EAAC,CAAC,kBAAkB,EAAE,IAAA,iBAAM,EAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,gEAAgE;AAChE,MAAM,4BAA4B,GAAG,aAAa,CAAC,IAAA,iBAAM,EAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;AAEpE,SAAS,kBAAkB,CAAC,MAAoB,EAAE,KAAe;IAC/D,IAAI,IAAA,wBAAa,EAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAA;QAChC,OAAO,IAAA,oBAAS,EAAC;YACf,IAAA,iBAAM,EAAC;gBACL,EAAE,EAAE,CAAC;gBACL,CAAC;gBACC,sDAAsD;gBACtD,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM;oBACtC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,MAAM;oBACvD,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;oBAC3B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;oBACjC,CAAC,CAAC,KAAK;aACZ,CAAC;YACF,IAAA,iBAAM,EAAC,IAAI,CAAC;SACb,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,IAAA,oBAAS,EAAC,CAAC,4BAA4B,EAAE,IAAA,iBAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB,EAAE,KAAc;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI;QAAE,OAAO,KAAK,CAAA;IAC1D,OAAO,CACL,KAAK,KAAK,MAAM,CAAC,MAAM;QACvB,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,CAC1D,CAAA;AACH,CAAC","sourcesContent":["import { encode } from '@atproto/lex-cbor'\nimport { LexError, LexValue, isPlainObject, ui8Concat } from '@atproto/lex-data'\nimport { lexParse, lexToJson } from '@atproto/lex-json'\nimport {\n  InferMethodInput,\n  InferMethodMessage,\n  InferMethodOutput,\n  InferMethodOutputBody,\n  InferMethodOutputEncoding,\n  InferMethodParams,\n  Main,\n  NsidString,\n  Procedure,\n  Query,\n  Subscription,\n  getMain,\n  isNsidString,\n} from '@atproto/lex-schema'\nimport { drainWebsocket } from './lib/drain-websocket.js'\n\ntype Awaitable<T> = T | Promise<T>\nexport type LexMethod = Query | Procedure | Subscription\n\nexport type NetAddr = {\n  hostname: string\n  port: number\n  transport: 'tcp' | 'udp'\n}\n\nexport type UnixAddr = {\n  path: string\n  transport: 'unix' | 'unixpacket'\n}\n\nexport type Addr = NetAddr | UnixAddr | undefined\n\nexport type ConnectionInfo<A extends Addr = Addr> = {\n  remoteAddr: A\n  completed: Promise<void>\n}\n\ntype Handler = (\n  request: Request,\n  connection?: ConnectionInfo,\n) => Promise<Response>\n\nexport type LexRouterHandlerContext<Method extends LexMethod, Credentials> = {\n  credentials: Credentials\n  input: InferMethodInput<Method, Body>\n  params: InferMethodParams<Method>\n  request: Request\n  signal: AbortSignal\n  connection?: ConnectionInfo\n}\n\ntype AsOptionalPayloadOptions<T> = T extends undefined | void\n  ? { encoding?: undefined; body?: undefined }\n  : T\n\nexport type LexRouterHandlerOutput<Method extends Query | Procedure> =\n  | Response\n  | ({\n      headers?: HeadersInit\n    } & (InferMethodOutputEncoding<Method> extends 'application/json'\n      ? {\n          // Allow omitting body when output is JSON\n          encoding?: 'application/json'\n          body: InferMethodOutputBody<Method>\n        }\n      : AsOptionalPayloadOptions<InferMethodOutput<Method, BodyInit>>))\n\nexport type LexRouterMethodHandler<\n  Method extends Query | Procedure = Query | Procedure,\n  Credentials = unknown,\n> = (\n  ctx: LexRouterHandlerContext<Method, Credentials>,\n) => Awaitable<LexRouterHandlerOutput<Method>>\n\nexport type LexRouterMethodConfig<\n  Method extends Query | Procedure = Query | Procedure,\n  Credentials = unknown,\n> = {\n  handler: LexRouterMethodHandler<Method, Credentials>\n  auth: LexRouterAuth<Credentials, Method>\n}\n\nexport type LexRouterSubscriptionHandler<\n  Method extends Subscription = Subscription,\n  Credentials = unknown,\n> = (\n  ctx: LexRouterHandlerContext<Method, Credentials>,\n) => AsyncIterable<InferMethodMessage<Method>>\n\nexport type LexRouterSubscriptionConfig<\n  Method extends Subscription = Subscription,\n  Credentials = unknown,\n> = {\n  handler: LexRouterSubscriptionHandler<Method, Credentials>\n  auth: LexRouterAuth<Credentials, Method>\n}\n\nexport type LexRouterAuthContext<Method extends LexMethod = LexMethod> = {\n  method: Method\n  params: InferMethodParams<Method>\n  request: Request\n  connection?: ConnectionInfo\n}\n\nexport type LexRouterAuth<\n  Credentials = unknown,\n  Method extends LexMethod = LexMethod,\n> = (ctx: LexRouterAuthContext<Method>) => Credentials | Promise<Credentials>\n\nexport type LexErrorHandlerContext = {\n  error: unknown\n  request: Request\n  method: LexMethod\n}\n\nexport type UpgradeWebSocket = (request: Request) => {\n  socket: WebSocket\n  response: Response\n}\n\nexport type LexRouterOptions = {\n  upgradeWebSocket?: UpgradeWebSocket\n  onHandlerError?: (ctx: LexErrorHandlerContext) => void | Promise<void>\n  highWaterMark?: number\n  lowWaterMark?: number\n}\n\nexport class LexRouter {\n  private handlers: Map<NsidString, Handler> = new Map()\n\n  constructor(readonly options: LexRouterOptions = {}) {}\n\n  add<M extends Subscription>(\n    ns: Main<M>,\n    handler: LexRouterSubscriptionHandler<M, void>,\n  ): this\n  add<M extends Subscription, Credentials>(\n    ns: Main<M>,\n    config: LexRouterSubscriptionConfig<M, Credentials>,\n  ): this\n  add<M extends Query | Procedure>(\n    ns: Main<M>,\n    handler: LexRouterMethodHandler<M, void>,\n  ): this\n  add<M extends Query | Procedure, Credentials>(\n    ns: Main<M>,\n    config: LexRouterMethodConfig<M, Credentials>,\n  ): this\n  add<M extends LexMethod, Credentials = unknown>(\n    ns: Main<M>,\n    config: M extends Subscription\n      ?\n          | LexRouterSubscriptionHandler<M, Credentials>\n          | LexRouterSubscriptionConfig<M, Credentials>\n      : M extends Query | Procedure\n        ?\n            | LexRouterMethodHandler<M, Credentials>\n            | LexRouterMethodConfig<M, Credentials>\n        : never,\n  ): this\n  add<M extends LexMethod>(\n    ns: Main<M>,\n    config:\n      | LexRouterSubscriptionHandler<any, any>\n      | LexRouterSubscriptionConfig<any, any>\n      | LexRouterMethodHandler<any, any>\n      | LexRouterMethodConfig<any, any>,\n  ) {\n    const method = getMain(ns)\n    if (this.handlers.has(method.nsid)) {\n      throw new TypeError(`Method ${method.nsid} already registered`)\n    }\n    const methodConfig =\n      typeof config === 'function'\n        ? { handler: config, auth: undefined }\n        : config\n\n    const handler: Handler =\n      method.type === 'subscription'\n        ? this.buildSubscriptionHandler(\n            method,\n            methodConfig.handler as LexRouterSubscriptionHandler<any, any>,\n            methodConfig.auth,\n          )\n        : this.buildMethodHandler(\n            method,\n            methodConfig.handler as LexRouterMethodHandler<any, any>,\n            methodConfig.auth,\n          )\n\n    this.handlers.set(method.nsid, handler)\n\n    return this\n  }\n\n  private buildMethodHandler<Method extends Query | Procedure, Credentials>(\n    method: Method,\n    methodHandler: LexRouterMethodHandler<Method, Credentials>,\n    auth?: LexRouterAuth<Credentials, Method>,\n  ): Handler {\n    const getInput = (\n      method.type === 'procedure'\n        ? getProcedureInput.bind(method)\n        : getQueryInput.bind(method)\n    ) as (request: Request) => Promise<InferMethodInput<Method, Body>>\n\n    return async (request, connection) => {\n      // @NOTE CORS requests should be handled by a middleware before reaching\n      // this point.\n      if (\n        (method.type === 'procedure' && request.method !== 'POST') ||\n        (method.type === 'query' &&\n          request.method !== 'GET' &&\n          request.method !== 'HEAD')\n      ) {\n        return Response.json(\n          { error: 'InvalidRequest', message: 'Method not allowed' },\n          { status: 405 },\n        )\n      }\n\n      try {\n        const url = new URL(request.url)\n        const params = method.parameters.fromURLSearchParams(url.searchParams)\n\n        const credentials = auth\n          ? await auth({ method, params, request, connection })\n          : (undefined as Credentials)\n\n        const input = await getInput(request)\n\n        const output = await methodHandler({\n          credentials,\n          params,\n          input,\n          request,\n          connection,\n          signal: request.signal,\n        })\n\n        if (output instanceof Response) {\n          return output\n        }\n\n        // @TODO add validation of output based on method.output.schema?\n\n        if (output.body === undefined && output.encoding === undefined) {\n          return new Response(null, { status: 200, headers: output.headers })\n        }\n\n        if (method.output?.encoding === 'application/json') {\n          return Response.json(lexToJson(output.body as LexValue), {\n            status: 200,\n            headers: output.headers,\n          })\n        }\n\n        const headers = new Headers(output.headers)\n        headers.set('content-type', output.encoding!)\n        return new Response(output.body, { status: 200, headers })\n      } catch (error) {\n        return this.handleError(request, method, error)\n      }\n    }\n  }\n\n  private buildSubscriptionHandler<Method extends Subscription, Credentials>(\n    method: Method,\n    methodHandler: LexRouterSubscriptionHandler<Method, Credentials>,\n    auth?: LexRouterAuth<Credentials, Method>,\n  ): Handler {\n    const {\n      onHandlerError,\n      upgradeWebSocket = (globalThis as any).Deno?.upgradeWebSocket as\n        | UpgradeWebSocket\n        | undefined,\n    } = this.options\n    if (!upgradeWebSocket) {\n      throw new TypeError(\n        'WebSocket upgrade not supported in this environment. Please provide an upgradeWebSocket option when creating the LexRouter.',\n      )\n    }\n\n    return async (request, connection) => {\n      if (request.method !== 'GET') {\n        return Response.json(\n          { error: 'InvalidRequest', message: 'Method not allowed' },\n          { status: 405 },\n        )\n      }\n\n      if (\n        request.headers.get('connection')?.toLowerCase() !== 'upgrade' ||\n        request.headers.get('upgrade')?.toLowerCase() !== 'websocket'\n      ) {\n        return Response.json(\n          {\n            error: 'InvalidRequest',\n            message: 'XRPC subscriptions are only available over WebSocket',\n          },\n          {\n            status: 426,\n            headers: {\n              Connection: 'Upgrade',\n              Upgrade: 'websocket',\n            },\n          },\n        )\n      }\n\n      if (request.signal.aborted) {\n        return Response.json(\n          { error: 'RequestAborted', message: 'The request was aborted' },\n          { status: 499 },\n        )\n      }\n\n      try {\n        const { response, socket } = upgradeWebSocket(request)\n\n        // @NOTE We are using a distinct signal than request.signal because that\n        // signal may get aborted before the WebSocket is closed (this is the\n        // case with Deno).\n        const abortController = new AbortController()\n        const { signal } = abortController\n        const abort = () => abortController.abort()\n\n        const onMessage = (event: unknown) => {\n          const error = new LexError(\n            'InvalidRequest',\n            'XRPC subscriptions do not accept messages',\n            { cause: event },\n          )\n          socket.send(encodeErrorFrame(error))\n          socket.close(1008, error.error)\n        }\n\n        const onOpen = async () => {\n          try {\n            const url = new URL(request.url)\n            const params = method.parameters.fromURLSearchParams(\n              url.searchParams,\n            )\n\n            const credentials: Credentials = auth\n              ? await auth({ method, params, request, connection })\n              : (undefined as Credentials)\n\n            signal.throwIfAborted()\n\n            const iterable = methodHandler({\n              credentials,\n              params,\n              input: undefined as InferMethodInput<Method, Body>,\n              request,\n              connection,\n              signal,\n            })\n\n            const iterator = iterable[Symbol.asyncIterator]()\n\n            signal.addEventListener('abort', async () => {\n              // @NOTE will cause the process to crash if this throws\n              await iterator.return?.()\n            })\n\n            while (!signal.aborted && socket.readyState === 1) {\n              const result = await iterator.next()\n              if (result.done) break\n\n              // @TODO add validation of output based on method.output.schema?\n\n              const data = encodeMessageFrame(method, result.value)\n\n              socket.send(data)\n\n              // Apply backpressure by waiting for the buffered data to drain\n              // before generating the next message\n              await drainWebsocket(socket, signal, this.options)\n            }\n\n            if (socket.readyState === 1) {\n              socket.close(1000)\n            }\n          } catch (error) {\n            // If the socket is still open, send an error frame before closing\n            if (socket.readyState === 1) {\n              const lexError =\n                error instanceof LexError\n                  ? error\n                  : new LexError('InternalError', 'An internal error occurred')\n\n              socket.send(encodeErrorFrame(lexError))\n\n              socket.close(\n                // https://www.rfc-editor.org/rfc/rfc6455#section-7.4.1\n                error instanceof LexError ? 1008 : 1011,\n                lexError.error,\n              )\n            }\n\n            // Only report unexpected processing errors\n            if (onHandlerError && !isAbortReason(request.signal, error)) {\n              await onHandlerError({ error, request, method })\n            }\n          } finally {\n            abortController.abort()\n          }\n        }\n\n        socket.addEventListener('error', abort)\n        socket.addEventListener('close', abort)\n        socket.addEventListener('open', onOpen)\n        socket.addEventListener('message', onMessage)\n\n        return response\n      } catch (error) {\n        return this.handleError(request, method, error)\n      }\n    }\n  }\n\n  private async handleError(\n    request: Request,\n    method: LexMethod,\n    error: unknown,\n  ) {\n    // Only report unexpected processing errors\n    const { onHandlerError } = this.options\n    if (onHandlerError && !isAbortReason(request.signal, error)) {\n      await onHandlerError({ error, request, method })\n    }\n\n    if (error instanceof LexError) {\n      return error.toResponse()\n    }\n\n    return Response.json(\n      { error: 'InternalError', message: 'An internal error occurred' },\n      { status: 500 },\n    )\n  }\n\n  handle: Handler = async (\n    request: Request,\n    connection?: ConnectionInfo,\n  ): Promise<Response> => {\n    const nsid = extractMethodNsid(request)\n\n    const handler = (this.handlers as Map<string | null, Handler>).get(nsid)\n    if (handler) return handler(request, connection)\n\n    if (!nsid || !isNsidString(nsid)) {\n      return Response.json(\n        {\n          error: 'InvalidRequest',\n          message: 'Invalid XRPC method path',\n        },\n        { status: 404 },\n      )\n    }\n\n    return Response.json(\n      {\n        error: 'MethodNotImplemented',\n        message: `XRPC method \"${nsid}\" not implemented on this server`,\n      },\n      { status: 501 },\n    )\n  }\n}\n\nfunction extractMethodNsid(request: Request): string | null {\n  const { pathname } = new URL(request.url)\n  if (!pathname.startsWith('/xrpc/')) return null\n  if (pathname.includes('/', 6)) return null\n  // We don't really need to validate the NSID here, the existence of the route\n  // (which is looked up based on an NSID) is sufficient.\n  return pathname.slice(6)\n}\n\nasync function getProcedureInput<M extends Procedure>(\n  this: M,\n  request: Request,\n): Promise<InferMethodInput<M, Body>> {\n  const encodingRaw = request.headers\n    .get('content-type')\n    ?.split(';')[0]\n    .trim()\n    .toLowerCase()\n\n  const encoding =\n    encodingRaw ||\n    // If the caller did not provide a content-type, but the method\n    // expects an input, assume binary\n    (request.body != null && this.input.encoding != null\n      ? 'application/octet-stream'\n      : undefined)\n\n  if (!this.input.matchesEncoding(encoding)) {\n    throw new LexError('InvalidRequest', `Invalid content-type: ${encoding}`)\n  }\n\n  if (this.input.encoding === 'application/json') {\n    // @TODO limit size?\n    const body = this.input.schema\n      ? this.input.schema.parse(lexParse(await request.text()))\n      : lexParse(await request.text())\n    return { encoding, body } as InferMethodInput<M, Body>\n  } else if (this.input.encoding) {\n    const body: Body = request\n    return { encoding, body } as InferMethodInput<M, Body>\n  } else {\n    return undefined as InferMethodInput<M, Body>\n  }\n}\n\nasync function getQueryInput<M extends Query>(\n  this: M,\n  request: Request,\n): Promise<InferMethodInput<M, Body>> {\n  if (\n    request.body ||\n    request.headers.has('content-type') ||\n    request.headers.has('content-length')\n  ) {\n    throw new LexError('InvalidRequest', 'GET requests must not have a body')\n  }\n\n  return undefined as InferMethodInput<M, Body>\n}\n\n// Pre-encoded frame header for error frames\nconst ERROR_FRAME_HEADER = /*#__PURE__*/ encode({ op: -1 })\n\nfunction encodeErrorFrame(error: LexError): Uint8Array {\n  return ui8Concat([ERROR_FRAME_HEADER, encode(error.toJSON())])\n}\n\n// Pre-encoded frame header for message frames with unknown type\nconst UNKNOWN_MESSAGE_FRAME_HEADER = /*#__PURE__*/ encode({ op: 1 })\n\nfunction encodeMessageFrame(method: Subscription, value: LexValue): Uint8Array {\n  if (isPlainObject(value) && typeof value.$type === 'string') {\n    const { $type, ...rest } = value\n    return ui8Concat([\n      encode({\n        op: 1,\n        t:\n          // If $type starts with `nsid#`, strip the NSID prefix\n          $type.charCodeAt(0) !== 0x23 && // '#'\n          $type.charCodeAt(method.nsid.length) === 0x23 && // '#'\n          $type.startsWith(method.nsid)\n            ? $type.slice(method.nsid.length)\n            : $type,\n      }),\n      encode(rest),\n    ])\n  }\n\n  return ui8Concat([UNKNOWN_MESSAGE_FRAME_HEADER, encode(value)])\n}\n\nfunction isAbortReason(signal: AbortSignal, error: unknown): boolean {\n  if (!signal.aborted || signal.reason == null) return false\n  return (\n    error === signal.reason ||\n    (error instanceof Error && error.cause === signal.reason)\n  )\n}\n"]}

package/dist/service-auth.d.ts

@@ -0,0 +1,67 @@
+import { AtprotoDid, AtprotoDidDocument } from '@atproto/did';
+import { DidString } from '@atproto/lex-schema';
+import { CreateDidResolverOptions } from '@atproto-labs/did-resolver';
+import { LexRouterAuth } from './lex-server.js';
+/**
+ * A function to check and record nonce uniqueness.
+ */
+export type UniqueNonceChecker = (nonce: string) => Promise<boolean>;
+export type ServiceAuthOptions = CreateDidResolverOptions & {
+    /**
+     * Expected audience ("aud") claim in the JWT token. Set to `null` to skip
+     * audience verification (not recommended).
+     */
+    audience: null | DidString;
+    /**
+     * Function to check and record nonce uniqueness. The value checked here must
+     * be unique within {@link ServiceAuthOptions.maxAge} seconds before and after
+     * the current time.
+     *
+     * @param nonce - The nonce to check.
+     */
+    unique: UniqueNonceChecker;
+    /**
+     * Maximum age of the JWT token in seconds.
+     *
+     * @default 300 (5 minutes)
+     */
+    maxAge?: number;
+};
+export type ServiceAuthCredentials = {
+    did: AtprotoDid;
+    didDocument: AtprotoDidDocument;
+    jwt: ParsedJwt;
+};
+/**
+ * Creates an authentication handler for LexRouter that verifies AT protocol
+ * "service auth" JWT bearer tokens signed by decentralized identifiers (DIDs).
+ */
+export declare function serviceAuth({ audience, maxAge, unique, ...options }: ServiceAuthOptions): LexRouterAuth<ServiceAuthCredentials>;
+export type ParseJwtOptions = {
+    maxAge: number;
+    audience: null | DidString;
+    unique: UniqueNonceChecker;
+    lxm: string;
+};
+export type ParsedJwt = {
+    header: HeaderObject;
+    payload: PayloadObject;
+    message: Uint8Array;
+    signature: Uint8Array;
+};
+type HeaderObject = {
+    alg: string;
+    typ?: string;
+};
+type PayloadObject = {
+    iss: DidString;
+    aud: DidString;
+    exp: number;
+    iat?: number;
+    nbf?: number;
+    lxm?: string;
+    nonce?: string;
+};
+export declare function isPayloadObject(obj: unknown): obj is PayloadObject;
+export {};
+//# sourceMappingURL=service-auth.d.ts.map

package/dist/service-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-auth.d.ts","sourceRoot":"","sources":["../src/service-auth.ts"],"names":[],"mappings":"AACA,OAAO,EACL,UAAU,EACV,kBAAkB,EAGnB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,SAAS,EAAe,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EACL,wBAAwB,EAEzB,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAI/C;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAEpE,MAAM,MAAM,kBAAkB,GAAG,wBAAwB,GAAG;IAC1D;;;OAGG;IACH,QAAQ,EAAE,IAAI,GAAG,SAAS,CAAA;IAC1B;;;;;;OAMG;IACH,MAAM,EAAE,kBAAkB,CAAA;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,EAAE,UAAU,CAAA;IACf,WAAW,EAAE,kBAAkB,CAAA;IAC/B,GAAG,EAAE,SAAS,CAAA;CACf,CAAA;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,EAC1B,QAAQ,EACR,MAAe,EACf,MAAM,EACN,GAAG,OAAO,EACX,EAAE,kBAAkB,GAAG,aAAa,CAAC,sBAAsB,CAAC,CAyD5D;AA2ED,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,IAAI,GAAG,SAAS,CAAA;IAC1B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE,aAAa,CAAA;IACtB,OAAO,EAAE,UAAU,CAAA;IACnB,SAAS,EAAE,UAAU,CAAA;CACtB,CAAA;AA4HD,KAAK,YAAY,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AASjD,KAAK,aAAa,GAAG;IACnB,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AACD,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,aAAa,CAalE"}

package/dist/service-auth.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serviceAuth = serviceAuth;
+exports.isPayloadObject = isPayloadObject;
+const tslib_1 = require("tslib");
+const crypto = tslib_1.__importStar(require("@atproto/crypto"));
+const did_1 = require("@atproto/did");
+const lex_data_1 = require("@atproto/lex-data");
+const lex_schema_1 = require("@atproto/lex-schema");
+const did_resolver_1 = require("@atproto-labs/did-resolver");
+const errors_js_1 = require("./errors.js");
+const BEARER_PREFIX = 'Bearer ';
+/**
+ * Creates an authentication handler for LexRouter that verifies AT protocol
+ * "service auth" JWT bearer tokens signed by decentralized identifiers (DIDs).
+ */
+function serviceAuth({ audience, maxAge = 5 * 60, unique, ...options }) {
+    const didResolver = (0, did_resolver_1.createDidResolver)(options);
+    return async ({ request, method }) => {
+        const { signal } = request;
+        const jwt = await parseJwtBearer(request, {
+            lxm: method.nsid,
+            maxAge,
+            audience,
+            unique,
+        });
+        let didDocument = await didResolver
+            .resolve(jwt.payload.iss, { signal })
+            .catch((cause) => {
+            throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Could not resolve DID document', { Bearer: { error: 'DidResolutionFailed' } }, { cause });
+        });
+        const key = getAtprotoSigningKey(didDocument);
+        if (!key || !(await verifyJwt(jwt, key))) {
+            signal.throwIfAborted();
+            // Try refreshing the DID document in case it was updated
+            didDocument = await didResolver
+                .resolve(jwt.payload.iss, { signal, noCache: true })
+                .catch((cause) => {
+                throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Could not resolve DID document', { Bearer: { error: 'DidResolutionFailed' } }, { cause });
+            });
+            // Verify again with the fresh key (if it changed)
+            const keyFresh = getAtprotoSigningKey(didDocument);
+            if (!keyFresh || key === keyFresh || !(await verifyJwt(jwt, keyFresh))) {
+                throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Invalid JWT signature', { Bearer: { error: 'BadJwtSignature' } });
+            }
+        }
+        return {
+            did: didDocument.id,
+            didDocument,
+            jwt,
+        };
+    };
+}
+async function verifyJwt(jwt, key) {
+    try {
+        return await crypto.verifySignature(key, jwt.message, jwt.signature, {
+            jwtAlg: jwt.header.alg,
+            allowMalleableSig: true,
+        });
+    }
+    catch (cause) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Could not verify JWT signature', { Bearer: { error: 'BadJwtSignature' } }, { cause });
+    }
+}
+function getAtprotoSigningKey(didDocument) {
+    try {
+        const key = didDocument.verificationMethod?.find(isAtprotoVerificationMethod, didDocument);
+        if (key?.publicKeyMultibase) {
+            if (key.type === 'EcdsaSecp256r1VerificationKey2019') {
+                const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase);
+                return crypto.formatDidKey(crypto.P256_JWT_ALG, keyBytes);
+            }
+            else if (key.type === 'EcdsaSecp256k1VerificationKey2019') {
+                const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase);
+                return crypto.formatDidKey(crypto.SECP256K1_JWT_ALG, keyBytes);
+            }
+            else if (key.type === 'Multikey') {
+                const parsed = crypto.parseMultikey(key.publicKeyMultibase);
+                return crypto.formatDidKey(parsed.jwtAlg, parsed.keyBytes);
+            }
+        }
+    }
+    catch {
+        // Invalid key, ignore
+    }
+    return null;
+}
+function isAtprotoVerificationMethod(vm) {
+    return typeof vm === 'object' && (0, did_1.matchesIdentifier)(this.id, 'atproto', vm.id);
+}
+async function parseJwtBearer(request, options) {
+    const authorization = request.headers.get('authorization');
+    if (!authorization?.startsWith(BEARER_PREFIX)) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Bearer token required', { Bearer: { error: 'MissingBearer' } });
+    }
+    const token = authorization.slice(BEARER_PREFIX.length).trim();
+    return parseJwt(token, options);
+}
+async function parseJwt(token, options) {
+    const { length, 0: headerB64, 1: payloadB64, 2: signatureB64, } = token.split('.');
+    if (length !== 3) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Invalid JWT token', { Bearer: { error: 'BadJwt' } });
+    }
+    let header;
+    try {
+        header = jsonFromBase64(headerB64, isHeaderObject);
+    }
+    catch (cause) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Invalid JWT token', { Bearer: { error: 'BadJwt' } }, { cause });
+    }
+    if (header.alg === 'none' ||
+        // service tokens are not OAuth 2.0 access tokens
+        // https://datatracker.ietf.org/doc/html/rfc9068
+        header.typ === 'at+jwt' ||
+        // "refresh+jwt" is a non-standard type used by the @atproto packages
+        header.typ === 'refresh+jwt' ||
+        // "DPoP" proofs are not meant to be used as service tokens
+        // https://datatracker.ietf.org/doc/html/rfc9449
+        header.typ === 'dpop+jwt') {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Invalid JWT token', { Bearer: { error: 'BadJwt' } });
+    }
+    let payload;
+    try {
+        payload = jsonFromBase64(payloadB64, isPayloadObject);
+    }
+    catch (cause) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Invalid JWT token', { Bearer: { error: 'BadJwt' } }, { cause });
+    }
+    if (options.audience !== null && options.audience !== payload.aud) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Invalid audience', {
+            Bearer: { error: 'InvalidAudience' },
+        });
+    }
+    const now = Math.floor(Date.now() / 1000);
+    if (payload.nbf != null && now < payload.nbf) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'JWT token not yet valid', { Bearer: { error: 'JwtNotYetValid' } });
+    }
+    if (now > payload.exp) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'JWT token expired', { Bearer: { error: 'JwtExpired' } });
+    }
+    // Prevent issuer from generating very long-lived tokens
+    if (timeDiff(now, payload.exp) > options.maxAge ||
+        timeDiff(now, payload.iat) > options.maxAge) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'JWT token too old', { Bearer: { error: 'JwtTooOld' } });
+    }
+    if (payload.lxm != null && typeof payload.lxm !== options.lxm) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Invalid JWT lexicon method ("lxm")', { Bearer: { error: 'BadJwtLexiconMethod' } });
+    }
+    if (payload.nonce != null && !(await (0, options.unique)(payload.nonce))) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Replay attack detected: nonce is not unique', { Bearer: { error: 'NonceNotUnique' } });
+    }
+    return {
+        header,
+        payload,
+        message: textEncoder.encode(`${headerB64}.${payloadB64}`),
+        signature: (0, lex_data_1.fromBase64)(signatureB64, 'base64url'),
+    };
+}
+const textEncoder = /*#__PURE__*/ new TextEncoder();
+function isHeaderObject(obj) {
+    return ((0, lex_data_1.isPlainObject)(obj) &&
+        typeof obj.alg === 'string' &&
+        (obj.typ === undefined || typeof obj.typ === 'string'));
+}
+function isPayloadObject(obj) {
+    return ((0, lex_data_1.isPlainObject)(obj) &&
+        typeof obj.iss === 'string' &&
+        typeof obj.aud === 'string' &&
+        (obj.lxm === undefined || typeof obj.lxm === 'string') &&
+        (obj.nonce === undefined || typeof obj.nonce === 'string') &&
+        (obj.iat === undefined || isPositiveInt(obj.iat)) &&
+        (obj.nbf === undefined || isPositiveInt(obj.nbf)) &&
+        isPositiveInt(obj.exp) &&
+        (0, lex_schema_1.isDidString)(obj.iss) &&
+        (0, lex_schema_1.isDidString)(obj.aud));
+}
+function timeDiff(t1, t2) {
+    if (t2 === undefined)
+        return 0;
+    return Math.abs(t1 - t2);
+}
+function isPositiveInt(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0;
+}
+function jsonFromBase64(b64, isType) {
+    const obj = JSON.parse((0, lex_data_1.utf8FromBase64)(b64, 'base64url'));
+    if (isType(obj))
+        return obj;
+    throw new Error('Invalid type');
+}
+//# sourceMappingURL=service-auth.js.map

package/dist/service-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-auth.js","sourceRoot":"","sources":["../src/service-auth.ts"],"names":[],"mappings":";;AAuDA,kCA8DC;AAqOD,0CAaC;;AAvWD,gEAAyC;AACzC,sCAKqB;AACrB,gDAA6E;AAC7E,oDAA4D;AAC5D,6DAGmC;AACnC,2CAAgD;AAGhD,MAAM,aAAa,GAAG,SAAS,CAAA;AAmC/B;;;GAGG;AACH,SAAgB,WAAW,CAAC,EAC1B,QAAQ,EACR,MAAM,GAAG,CAAC,GAAG,EAAE,EACf,MAAM,EACN,GAAG,OAAO,EACS;IACnB,MAAM,WAAW,GAAG,IAAA,gCAAiB,EAAC,OAAO,CAAC,CAAA;IAE9C,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QACnC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC1B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE;YACxC,GAAG,EAAE,MAAM,CAAC,IAAI;YAChB,MAAM;YACN,QAAQ;YACR,MAAM;SACP,CAAC,CAAA;QAEF,IAAI,WAAW,GAAuB,MAAM,WAAW;aACpD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;aACpC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,gCAAgC,EAChC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAC5C,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC,CAAC,CAAA;QAEJ,MAAM,GAAG,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAA;QAE7C,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,cAAc,EAAE,CAAA;YAEvB,yDAAyD;YACzD,WAAW,GAAG,MAAM,WAAW;iBAC5B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;iBACnD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,gCAAgC,EAChC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAC5C,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC,CAAC,CAAA;YAEJ,kDAAkD;YAClD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAA;YAClD,IAAI,CAAC,QAAQ,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,uBAAuB,EACvB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CACzC,CAAA;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,GAAG,EAAE,WAAW,CAAC,EAAE;YACnB,WAAW;YACX,GAAG;SACJ,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAc,EAAE,GAAe;IACtD,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE;YACnE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG;YACtB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,gCAAgC,EAChC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EACxC,EAAE,KAAK,EAAE,CACV,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,WAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,CAAC,kBAAkB,EAAE,IAAI,CAC9C,2BAA2B,EAC3B,WAAW,CACZ,CAAA;QAED,IAAI,GAAG,EAAE,kBAAkB,EAAE,CAAC;YAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,mCAAmC,EAAE,CAAC;gBACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;gBAChE,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;YAC3D,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,mCAAmC,EAAE,CAAC;gBAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;gBAChE,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAA;YAChE,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;gBAC3D,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,2BAA2B,CAIlC,EAAK;IAIL,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,IAAA,uBAAiB,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;AAC/E,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAAgB,EAChB,OAAwB;IAExB,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC1D,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,uBAAuB,EACvB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,CACvC,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IAE9D,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;AACjC,CAAC;AAgBD,KAAK,UAAU,QAAQ,CACrB,KAAa,EACb,OAAwB;IAExB,MAAM,EACJ,MAAM,EACN,CAAC,EAAE,SAAS,EACZ,CAAC,EAAE,UAAU,EACb,CAAC,EAAE,YAAY,GAChB,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACpB,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,mBAAmB,EACnB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAChC,CAAA;IACH,CAAC;IAED,IAAI,MAAoB,CAAA;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,mBAAmB,EACnB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,CACV,CAAA;IACH,CAAC;IAED,IACE,MAAM,CAAC,GAAG,KAAK,MAAM;QACrB,iDAAiD;QACjD,gDAAgD;QAChD,MAAM,CAAC,GAAG,KAAK,QAAQ;QACvB,qEAAqE;QACrE,MAAM,CAAC,GAAG,KAAK,aAAa;QAC5B,2DAA2D;QAC3D,gDAAgD;QAChD,MAAM,CAAC,GAAG,KAAK,UAAU,EACzB,CAAC;QACD,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,mBAAmB,EACnB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAChC,CAAA;IACH,CAAC;IAED,IAAI,OAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,cAAc,CAAC,UAAU,EAAE,eAAe,CAAC,CAAA;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,mBAAmB,EACnB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,CACV,CAAA;IACH,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QAClE,MAAM,IAAI,8BAAkB,CAAC,wBAAwB,EAAE,kBAAkB,EAAE;YACzE,MAAM,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE;SACrC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7C,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,yBAAyB,EACzB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,CACxC,CAAA;IACH,CAAC;IAED,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,mBAAmB,EACnB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CACpC,CAAA;IACH,CAAC;IAED,wDAAwD;IACxD,IACE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM;QAC3C,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAC3C,CAAC;QACD,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,mBAAmB,EACnB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CACnC,CAAA;IACH,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9D,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,oCAAoC,EACpC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,CAC7C,CAAA;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,6CAA6C,EAC7C,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,CACxC,CAAA;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO;QACP,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QACzD,SAAS,EAAE,IAAA,qBAAU,EAAC,YAAY,EAAE,WAAW,CAAC;KACjD,CAAA;AACH,CAAC;AAED,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,WAAW,EAAE,CAAA;AAGnD,SAAS,cAAc,CAAC,GAAY;IAClC,OAAO,CACL,IAAA,wBAAa,EAAC,GAAG,CAAC;QAClB,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CACvD,CAAA;AACH,CAAC;AAWD,SAAgB,eAAe,CAAC,GAAY;IAC1C,OAAO,CACL,IAAA,wBAAa,EAAC,GAAG,CAAC;QAClB,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC;QACtD,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC;QAC1D,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjD,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;QACtB,IAAA,wBAAW,EAAC,GAAG,CAAC,GAAG,CAAC;QACpB,IAAA,wBAAW,EAAC,GAAG,CAAC,GAAG,CAAC,CACrB,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,EAAW;IACvC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,CAAC,CAAA;IAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAA;AAC1E,CAAC;AAED,SAAS,cAAc,CAAI,GAAW,EAAE,MAAkC;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,yBAAc,EAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAA;IACxD,IAAI,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAA;IAC3B,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;AACjC,CAAC","sourcesContent":["import * as crypto from '@atproto/crypto'\nimport {\n  AtprotoDid,\n  AtprotoDidDocument,\n  Did,\n  matchesIdentifier,\n} from '@atproto/did'\nimport { fromBase64, isPlainObject, utf8FromBase64 } from '@atproto/lex-data'\nimport { DidString, isDidString } from '@atproto/lex-schema'\nimport {\n  CreateDidResolverOptions,\n  createDidResolver,\n} from '@atproto-labs/did-resolver'\nimport { LexServerAuthError } from './errors.js'\nimport { LexRouterAuth } from './lex-server.js'\n\nconst BEARER_PREFIX = 'Bearer '\n\n/**\n * A function to check and record nonce uniqueness.\n */\nexport type UniqueNonceChecker = (nonce: string) => Promise<boolean>\n\nexport type ServiceAuthOptions = CreateDidResolverOptions & {\n  /**\n   * Expected audience (\"aud\") claim in the JWT token. Set to `null` to skip\n   * audience verification (not recommended).\n   */\n  audience: null | DidString\n  /**\n   * Function to check and record nonce uniqueness. The value checked here must\n   * be unique within {@link ServiceAuthOptions.maxAge} seconds before and after\n   * the current time.\n   *\n   * @param nonce - The nonce to check.\n   */\n  unique: UniqueNonceChecker\n  /**\n   * Maximum age of the JWT token in seconds.\n   *\n   * @default 300 (5 minutes)\n   */\n  maxAge?: number\n}\n\nexport type ServiceAuthCredentials = {\n  did: AtprotoDid\n  didDocument: AtprotoDidDocument\n  jwt: ParsedJwt\n}\n\n/**\n * Creates an authentication handler for LexRouter that verifies AT protocol\n * \"service auth\" JWT bearer tokens signed by decentralized identifiers (DIDs).\n */\nexport function serviceAuth({\n  audience,\n  maxAge = 5 * 60,\n  unique,\n  ...options\n}: ServiceAuthOptions): LexRouterAuth<ServiceAuthCredentials> {\n  const didResolver = createDidResolver(options)\n\n  return async ({ request, method }) => {\n    const { signal } = request\n    const jwt = await parseJwtBearer(request, {\n      lxm: method.nsid,\n      maxAge,\n      audience,\n      unique,\n    })\n\n    let didDocument: AtprotoDidDocument = await didResolver\n      .resolve(jwt.payload.iss, { signal })\n      .catch((cause) => {\n        throw new LexServerAuthError(\n          'AuthenticationRequired',\n          'Could not resolve DID document',\n          { Bearer: { error: 'DidResolutionFailed' } },\n          { cause },\n        )\n      })\n\n    const key = getAtprotoSigningKey(didDocument)\n\n    if (!key || !(await verifyJwt(jwt, key))) {\n      signal.throwIfAborted()\n\n      // Try refreshing the DID document in case it was updated\n      didDocument = await didResolver\n        .resolve(jwt.payload.iss, { signal, noCache: true })\n        .catch((cause) => {\n          throw new LexServerAuthError(\n            'AuthenticationRequired',\n            'Could not resolve DID document',\n            { Bearer: { error: 'DidResolutionFailed' } },\n            { cause },\n          )\n        })\n\n      // Verify again with the fresh key (if it changed)\n      const keyFresh = getAtprotoSigningKey(didDocument)\n      if (!keyFresh || key === keyFresh || !(await verifyJwt(jwt, keyFresh))) {\n        throw new LexServerAuthError(\n          'AuthenticationRequired',\n          'Invalid JWT signature',\n          { Bearer: { error: 'BadJwtSignature' } },\n        )\n      }\n    }\n\n    return {\n      did: didDocument.id,\n      didDocument,\n      jwt,\n    }\n  }\n}\n\nasync function verifyJwt(jwt: ParsedJwt, key: Did<'key'>) {\n  try {\n    return await crypto.verifySignature(key, jwt.message, jwt.signature, {\n      jwtAlg: jwt.header.alg,\n      allowMalleableSig: true,\n    })\n  } catch (cause) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Could not verify JWT signature',\n      { Bearer: { error: 'BadJwtSignature' } },\n      { cause },\n    )\n  }\n}\n\nfunction getAtprotoSigningKey(\n  didDocument: AtprotoDidDocument,\n): null | Did<'key'> {\n  try {\n    const key = didDocument.verificationMethod?.find(\n      isAtprotoVerificationMethod,\n      didDocument,\n    )\n\n    if (key?.publicKeyMultibase) {\n      if (key.type === 'EcdsaSecp256r1VerificationKey2019') {\n        const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase)\n        return crypto.formatDidKey(crypto.P256_JWT_ALG, keyBytes)\n      } else if (key.type === 'EcdsaSecp256k1VerificationKey2019') {\n        const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase)\n        return crypto.formatDidKey(crypto.SECP256K1_JWT_ALG, keyBytes)\n      } else if (key.type === 'Multikey') {\n        const parsed = crypto.parseMultikey(key.publicKeyMultibase)\n        return crypto.formatDidKey(parsed.jwtAlg, parsed.keyBytes)\n      }\n    }\n  } catch {\n    // Invalid key, ignore\n  }\n\n  return null\n}\n\nfunction isAtprotoVerificationMethod<\n  V extends string | { id: string; type: string; publicKeyMultibase?: string },\n>(\n  this: AtprotoDidDocument,\n  vm: V,\n): vm is Exclude<V, string> & {\n  id: `${string}#atproto`\n} {\n  return typeof vm === 'object' && matchesIdentifier(this.id, 'atproto', vm.id)\n}\n\nasync function parseJwtBearer(\n  request: Request,\n  options: ParseJwtOptions,\n): Promise<ParsedJwt> {\n  const authorization = request.headers.get('authorization')\n  if (!authorization?.startsWith(BEARER_PREFIX)) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Bearer token required',\n      { Bearer: { error: 'MissingBearer' } },\n    )\n  }\n\n  const token = authorization.slice(BEARER_PREFIX.length).trim()\n\n  return parseJwt(token, options)\n}\n\nexport type ParseJwtOptions = {\n  maxAge: number\n  audience: null | DidString\n  unique: UniqueNonceChecker\n  lxm: string\n}\n\nexport type ParsedJwt = {\n  header: HeaderObject\n  payload: PayloadObject\n  message: Uint8Array\n  signature: Uint8Array\n}\n\nasync function parseJwt(\n  token: string,\n  options: ParseJwtOptions,\n): Promise<ParsedJwt> {\n  const {\n    length,\n    0: headerB64,\n    1: payloadB64,\n    2: signatureB64,\n  } = token.split('.')\n  if (length !== 3) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Invalid JWT token',\n      { Bearer: { error: 'BadJwt' } },\n    )\n  }\n\n  let header: HeaderObject\n  try {\n    header = jsonFromBase64(headerB64, isHeaderObject)\n  } catch (cause) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Invalid JWT token',\n      { Bearer: { error: 'BadJwt' } },\n      { cause },\n    )\n  }\n\n  if (\n    header.alg === 'none' ||\n    // service tokens are not OAuth 2.0 access tokens\n    // https://datatracker.ietf.org/doc/html/rfc9068\n    header.typ === 'at+jwt' ||\n    // \"refresh+jwt\" is a non-standard type used by the @atproto packages\n    header.typ === 'refresh+jwt' ||\n    // \"DPoP\" proofs are not meant to be used as service tokens\n    // https://datatracker.ietf.org/doc/html/rfc9449\n    header.typ === 'dpop+jwt'\n  ) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Invalid JWT token',\n      { Bearer: { error: 'BadJwt' } },\n    )\n  }\n\n  let payload: PayloadObject\n  try {\n    payload = jsonFromBase64(payloadB64, isPayloadObject)\n  } catch (cause) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Invalid JWT token',\n      { Bearer: { error: 'BadJwt' } },\n      { cause },\n    )\n  }\n\n  if (options.audience !== null && options.audience !== payload.aud) {\n    throw new LexServerAuthError('AuthenticationRequired', 'Invalid audience', {\n      Bearer: { error: 'InvalidAudience' },\n    })\n  }\n\n  const now = Math.floor(Date.now() / 1000)\n\n  if (payload.nbf != null && now < payload.nbf) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'JWT token not yet valid',\n      { Bearer: { error: 'JwtNotYetValid' } },\n    )\n  }\n\n  if (now > payload.exp) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'JWT token expired',\n      { Bearer: { error: 'JwtExpired' } },\n    )\n  }\n\n  // Prevent issuer from generating very long-lived tokens\n  if (\n    timeDiff(now, payload.exp) > options.maxAge ||\n    timeDiff(now, payload.iat) > options.maxAge\n  ) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'JWT token too old',\n      { Bearer: { error: 'JwtTooOld' } },\n    )\n  }\n\n  if (payload.lxm != null && typeof payload.lxm !== options.lxm) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Invalid JWT lexicon method (\"lxm\")',\n      { Bearer: { error: 'BadJwtLexiconMethod' } },\n    )\n  }\n\n  if (payload.nonce != null && !(await (0, options.unique)(payload.nonce))) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Replay attack detected: nonce is not unique',\n      { Bearer: { error: 'NonceNotUnique' } },\n    )\n  }\n\n  return {\n    header,\n    payload,\n    message: textEncoder.encode(`${headerB64}.${payloadB64}`),\n    signature: fromBase64(signatureB64, 'base64url'),\n  }\n}\n\nconst textEncoder = /*#__PURE__*/ new TextEncoder()\n\ntype HeaderObject = { alg: string; typ?: string }\nfunction isHeaderObject(obj: unknown): obj is HeaderObject {\n  return (\n    isPlainObject(obj) &&\n    typeof obj.alg === 'string' &&\n    (obj.typ === undefined || typeof obj.typ === 'string')\n  )\n}\n\ntype PayloadObject = {\n  iss: DidString\n  aud: DidString\n  exp: number\n  iat?: number\n  nbf?: number\n  lxm?: string\n  nonce?: string\n}\nexport function isPayloadObject(obj: unknown): obj is PayloadObject {\n  return (\n    isPlainObject(obj) &&\n    typeof obj.iss === 'string' &&\n    typeof obj.aud === 'string' &&\n    (obj.lxm === undefined || typeof obj.lxm === 'string') &&\n    (obj.nonce === undefined || typeof obj.nonce === 'string') &&\n    (obj.iat === undefined || isPositiveInt(obj.iat)) &&\n    (obj.nbf === undefined || isPositiveInt(obj.nbf)) &&\n    isPositiveInt(obj.exp) &&\n    isDidString(obj.iss) &&\n    isDidString(obj.aud)\n  )\n}\n\nfunction timeDiff(t1: number, t2?: number): number {\n  if (t2 === undefined) return 0\n  return Math.abs(t1 - t2)\n}\n\nfunction isPositiveInt(value: unknown): value is number {\n  return typeof value === 'number' && Number.isInteger(value) && value > 0\n}\n\nfunction jsonFromBase64<T>(b64: string, isType: (obj: unknown) => obj is T): T {\n  const obj = JSON.parse(utf8FromBase64(b64, 'base64url'))\n  if (isType(obj)) return obj\n  throw new Error('Invalid type')\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/lex-server",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "license": "MIT",
   "description": "Request router for Atproto Lexicon protocols and schemas",
   "keywords": [
@@ -45,17 +45,20 @@
     "http-terminator": "^3.2.0",
     "tslib": "^2.8.1",
     "ws": "^8.18.3",
-    "@atproto/lex-cbor": "0.0.5",
-    "@atproto/lex-schema": "0.0.6",
-    "@atproto/lex-data": "0.0.5",
-    "@atproto/lex-json": "0.0.5"
+    "@atproto-labs/did-resolver": "0.2.5",
+    "@atproto/crypto": "0.4.5",
+    "@atproto/did": "0.2.4",
+    "@atproto/lex-data": "0.0.7",
+    "@atproto/lex-cbor": "0.0.7",
+    "@atproto/lex-json": "0.0.7",
+    "@atproto/lex-schema": "0.0.8"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",
     "@vitest/coverage-v8": "4.0.16",
     "vitest": "^4.0.16",
-    "@atproto/lex": "0.0.8",
-    "@atproto/lex-client": "0.0.6"
+    "@atproto/lex": "0.0.10",
+    "@atproto/lex-client": "0.0.8"
   },
   "scripts": {
     "build": "tsc --build tsconfig.build.json",

package/src/index.ts

@@ -6,3 +6,4 @@ export {
 
 export * from './errors.js'
 export * from './lex-server.js'
+export * from './service-auth.js'

package/src/lex-server.test.ts

@@ -287,7 +287,7 @@ describe('Authentication', () => {
   function createBasicAuth(allowed: {
     username: string
     password: string
-  }): LexRouterAuth<typeof io.example.authTest, BasicAuthCredentials> {
+  }): LexRouterAuth<BasicAuthCredentials> {
     return async ({ request }) => {
       const header = request.headers.get('authorization') ?? ''
       if (!header.startsWith('Basic ')) {

package/src/lex-server.ts

@@ -19,7 +19,7 @@ import {
 import { drainWebsocket } from './lib/drain-websocket.js'
 
 type Awaitable<T> = T | Promise<T>
-type LexMethod = Query | Procedure | Subscription
+export type LexMethod = Query | Procedure | Subscription
 
 export type NetAddr = {
   hostname: string
@@ -81,7 +81,7 @@ export type LexRouterMethodConfig<
   Credentials = unknown,
 > = {
   handler: LexRouterMethodHandler<Method, Credentials>
-  auth: LexRouterAuth<Method, Credentials>
+  auth: LexRouterAuth<Credentials, Method>
 }
 
 export type LexRouterSubscriptionHandler<
@@ -96,18 +96,19 @@ export type LexRouterSubscriptionConfig<
   Credentials = unknown,
 > = {
   handler: LexRouterSubscriptionHandler<Method, Credentials>
-  auth: LexRouterAuth<Method, Credentials>
+  auth: LexRouterAuth<Credentials, Method>
 }
 
 export type LexRouterAuthContext<Method extends LexMethod = LexMethod> = {
+  method: Method
   params: InferMethodParams<Method>
   request: Request
   connection?: ConnectionInfo
 }
 
 export type LexRouterAuth<
-  Method extends LexMethod = LexMethod,
   Credentials = unknown,
+  Method extends LexMethod = LexMethod,
 > = (ctx: LexRouterAuthContext<Method>) => Credentials | Promise<Credentials>
 
 export type LexErrorHandlerContext = {
@@ -149,6 +150,18 @@ export class LexRouter {
     ns: Main<M>,
     config: LexRouterMethodConfig<M, Credentials>,
   ): this
+  add<M extends LexMethod, Credentials = unknown>(
+    ns: Main<M>,
+    config: M extends Subscription
+      ?
+          | LexRouterSubscriptionHandler<M, Credentials>
+          | LexRouterSubscriptionConfig<M, Credentials>
+      : M extends Query | Procedure
+        ?
+            | LexRouterMethodHandler<M, Credentials>
+            | LexRouterMethodConfig<M, Credentials>
+        : never,
+  ): this
   add<M extends LexMethod>(
     ns: Main<M>,
     config:
@@ -187,7 +200,7 @@ export class LexRouter {
   private buildMethodHandler<Method extends Query | Procedure, Credentials>(
     method: Method,
     methodHandler: LexRouterMethodHandler<Method, Credentials>,
-    auth?: LexRouterAuth<Method, Credentials>,
+    auth?: LexRouterAuth<Credentials, Method>,
   ): Handler {
     const getInput = (
       method.type === 'procedure'
@@ -215,7 +228,7 @@ export class LexRouter {
         const params = method.parameters.fromURLSearchParams(url.searchParams)
 
         const credentials = auth
-          ? await auth({ params, request, connection })
+          ? await auth({ method, params, request, connection })
           : (undefined as Credentials)
 
         const input = await getInput(request)
@@ -258,7 +271,7 @@ export class LexRouter {
   private buildSubscriptionHandler<Method extends Subscription, Credentials>(
     method: Method,
     methodHandler: LexRouterSubscriptionHandler<Method, Credentials>,
-    auth?: LexRouterAuth<Method, Credentials>,
+    auth?: LexRouterAuth<Credentials, Method>,
   ): Handler {
     const {
       onHandlerError,
@@ -334,7 +347,7 @@ export class LexRouter {
             )
 
             const credentials: Credentials = auth
-              ? await auth({ params, request, connection })
+              ? await auth({ method, params, request, connection })
               : (undefined as Credentials)
 
             signal.throwIfAborted()

package/src/service-auth.ts

@@ -0,0 +1,375 @@
+import * as crypto from '@atproto/crypto'
+import {
+  AtprotoDid,
+  AtprotoDidDocument,
+  Did,
+  matchesIdentifier,
+} from '@atproto/did'
+import { fromBase64, isPlainObject, utf8FromBase64 } from '@atproto/lex-data'
+import { DidString, isDidString } from '@atproto/lex-schema'
+import {
+  CreateDidResolverOptions,
+  createDidResolver,
+} from '@atproto-labs/did-resolver'
+import { LexServerAuthError } from './errors.js'
+import { LexRouterAuth } from './lex-server.js'
+
+const BEARER_PREFIX = 'Bearer '
+
+/**
+ * A function to check and record nonce uniqueness.
+ */
+export type UniqueNonceChecker = (nonce: string) => Promise<boolean>
+
+export type ServiceAuthOptions = CreateDidResolverOptions & {
+  /**
+   * Expected audience ("aud") claim in the JWT token. Set to `null` to skip
+   * audience verification (not recommended).
+   */
+  audience: null | DidString
+  /**
+   * Function to check and record nonce uniqueness. The value checked here must
+   * be unique within {@link ServiceAuthOptions.maxAge} seconds before and after
+   * the current time.
+   *
+   * @param nonce - The nonce to check.
+   */
+  unique: UniqueNonceChecker
+  /**
+   * Maximum age of the JWT token in seconds.
+   *
+   * @default 300 (5 minutes)
+   */
+  maxAge?: number
+}
+
+export type ServiceAuthCredentials = {
+  did: AtprotoDid
+  didDocument: AtprotoDidDocument
+  jwt: ParsedJwt
+}
+
+/**
+ * Creates an authentication handler for LexRouter that verifies AT protocol
+ * "service auth" JWT bearer tokens signed by decentralized identifiers (DIDs).
+ */
+export function serviceAuth({
+  audience,
+  maxAge = 5 * 60,
+  unique,
+  ...options
+}: ServiceAuthOptions): LexRouterAuth<ServiceAuthCredentials> {
+  const didResolver = createDidResolver(options)
+
+  return async ({ request, method }) => {
+    const { signal } = request
+    const jwt = await parseJwtBearer(request, {
+      lxm: method.nsid,
+      maxAge,
+      audience,
+      unique,
+    })
+
+    let didDocument: AtprotoDidDocument = await didResolver
+      .resolve(jwt.payload.iss, { signal })
+      .catch((cause) => {
+        throw new LexServerAuthError(
+          'AuthenticationRequired',
+          'Could not resolve DID document',
+          { Bearer: { error: 'DidResolutionFailed' } },
+          { cause },
+        )
+      })
+
+    const key = getAtprotoSigningKey(didDocument)
+
+    if (!key || !(await verifyJwt(jwt, key))) {
+      signal.throwIfAborted()
+
+      // Try refreshing the DID document in case it was updated
+      didDocument = await didResolver
+        .resolve(jwt.payload.iss, { signal, noCache: true })
+        .catch((cause) => {
+          throw new LexServerAuthError(
+            'AuthenticationRequired',
+            'Could not resolve DID document',
+            { Bearer: { error: 'DidResolutionFailed' } },
+            { cause },
+          )
+        })
+
+      // Verify again with the fresh key (if it changed)
+      const keyFresh = getAtprotoSigningKey(didDocument)
+      if (!keyFresh || key === keyFresh || !(await verifyJwt(jwt, keyFresh))) {
+        throw new LexServerAuthError(
+          'AuthenticationRequired',
+          'Invalid JWT signature',
+          { Bearer: { error: 'BadJwtSignature' } },
+        )
+      }
+    }
+
+    return {
+      did: didDocument.id,
+      didDocument,
+      jwt,
+    }
+  }
+}
+
+async function verifyJwt(jwt: ParsedJwt, key: Did<'key'>) {
+  try {
+    return await crypto.verifySignature(key, jwt.message, jwt.signature, {
+      jwtAlg: jwt.header.alg,
+      allowMalleableSig: true,
+    })
+  } catch (cause) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Could not verify JWT signature',
+      { Bearer: { error: 'BadJwtSignature' } },
+      { cause },
+    )
+  }
+}
+
+function getAtprotoSigningKey(
+  didDocument: AtprotoDidDocument,
+): null | Did<'key'> {
+  try {
+    const key = didDocument.verificationMethod?.find(
+      isAtprotoVerificationMethod,
+      didDocument,
+    )
+
+    if (key?.publicKeyMultibase) {
+      if (key.type === 'EcdsaSecp256r1VerificationKey2019') {
+        const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase)
+        return crypto.formatDidKey(crypto.P256_JWT_ALG, keyBytes)
+      } else if (key.type === 'EcdsaSecp256k1VerificationKey2019') {
+        const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase)
+        return crypto.formatDidKey(crypto.SECP256K1_JWT_ALG, keyBytes)
+      } else if (key.type === 'Multikey') {
+        const parsed = crypto.parseMultikey(key.publicKeyMultibase)
+        return crypto.formatDidKey(parsed.jwtAlg, parsed.keyBytes)
+      }
+    }
+  } catch {
+    // Invalid key, ignore
+  }
+
+  return null
+}
+
+function isAtprotoVerificationMethod<
+  V extends string | { id: string; type: string; publicKeyMultibase?: string },
+>(
+  this: AtprotoDidDocument,
+  vm: V,
+): vm is Exclude<V, string> & {
+  id: `${string}#atproto`
+} {
+  return typeof vm === 'object' && matchesIdentifier(this.id, 'atproto', vm.id)
+}
+
+async function parseJwtBearer(
+  request: Request,
+  options: ParseJwtOptions,
+): Promise<ParsedJwt> {
+  const authorization = request.headers.get('authorization')
+  if (!authorization?.startsWith(BEARER_PREFIX)) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Bearer token required',
+      { Bearer: { error: 'MissingBearer' } },
+    )
+  }
+
+  const token = authorization.slice(BEARER_PREFIX.length).trim()
+
+  return parseJwt(token, options)
+}
+
+export type ParseJwtOptions = {
+  maxAge: number
+  audience: null | DidString
+  unique: UniqueNonceChecker
+  lxm: string
+}
+
+export type ParsedJwt = {
+  header: HeaderObject
+  payload: PayloadObject
+  message: Uint8Array
+  signature: Uint8Array
+}
+
+async function parseJwt(
+  token: string,
+  options: ParseJwtOptions,
+): Promise<ParsedJwt> {
+  const {
+    length,
+    0: headerB64,
+    1: payloadB64,
+    2: signatureB64,
+  } = token.split('.')
+  if (length !== 3) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Invalid JWT token',
+      { Bearer: { error: 'BadJwt' } },
+    )
+  }
+
+  let header: HeaderObject
+  try {
+    header = jsonFromBase64(headerB64, isHeaderObject)
+  } catch (cause) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Invalid JWT token',
+      { Bearer: { error: 'BadJwt' } },
+      { cause },
+    )
+  }
+
+  if (
+    header.alg === 'none' ||
+    // service tokens are not OAuth 2.0 access tokens
+    // https://datatracker.ietf.org/doc/html/rfc9068
+    header.typ === 'at+jwt' ||
+    // "refresh+jwt" is a non-standard type used by the @atproto packages
+    header.typ === 'refresh+jwt' ||
+    // "DPoP" proofs are not meant to be used as service tokens
+    // https://datatracker.ietf.org/doc/html/rfc9449
+    header.typ === 'dpop+jwt'
+  ) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Invalid JWT token',
+      { Bearer: { error: 'BadJwt' } },
+    )
+  }
+
+  let payload: PayloadObject
+  try {
+    payload = jsonFromBase64(payloadB64, isPayloadObject)
+  } catch (cause) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Invalid JWT token',
+      { Bearer: { error: 'BadJwt' } },
+      { cause },
+    )
+  }
+
+  if (options.audience !== null && options.audience !== payload.aud) {
+    throw new LexServerAuthError('AuthenticationRequired', 'Invalid audience', {
+      Bearer: { error: 'InvalidAudience' },
+    })
+  }
+
+  const now = Math.floor(Date.now() / 1000)
+
+  if (payload.nbf != null && now < payload.nbf) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'JWT token not yet valid',
+      { Bearer: { error: 'JwtNotYetValid' } },
+    )
+  }
+
+  if (now > payload.exp) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'JWT token expired',
+      { Bearer: { error: 'JwtExpired' } },
+    )
+  }
+
+  // Prevent issuer from generating very long-lived tokens
+  if (
+    timeDiff(now, payload.exp) > options.maxAge ||
+    timeDiff(now, payload.iat) > options.maxAge
+  ) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'JWT token too old',
+      { Bearer: { error: 'JwtTooOld' } },
+    )
+  }
+
+  if (payload.lxm != null && typeof payload.lxm !== options.lxm) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Invalid JWT lexicon method ("lxm")',
+      { Bearer: { error: 'BadJwtLexiconMethod' } },
+    )
+  }
+
+  if (payload.nonce != null && !(await (0, options.unique)(payload.nonce))) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Replay attack detected: nonce is not unique',
+      { Bearer: { error: 'NonceNotUnique' } },
+    )
+  }
+
+  return {
+    header,
+    payload,
+    message: textEncoder.encode(`${headerB64}.${payloadB64}`),
+    signature: fromBase64(signatureB64, 'base64url'),
+  }
+}
+
+const textEncoder = /*#__PURE__*/ new TextEncoder()
+
+type HeaderObject = { alg: string; typ?: string }
+function isHeaderObject(obj: unknown): obj is HeaderObject {
+  return (
+    isPlainObject(obj) &&
+    typeof obj.alg === 'string' &&
+    (obj.typ === undefined || typeof obj.typ === 'string')
+  )
+}
+
+type PayloadObject = {
+  iss: DidString
+  aud: DidString
+  exp: number
+  iat?: number
+  nbf?: number
+  lxm?: string
+  nonce?: string
+}
+export function isPayloadObject(obj: unknown): obj is PayloadObject {
+  return (
+    isPlainObject(obj) &&
+    typeof obj.iss === 'string' &&
+    typeof obj.aud === 'string' &&
+    (obj.lxm === undefined || typeof obj.lxm === 'string') &&
+    (obj.nonce === undefined || typeof obj.nonce === 'string') &&
+    (obj.iat === undefined || isPositiveInt(obj.iat)) &&
+    (obj.nbf === undefined || isPositiveInt(obj.nbf)) &&
+    isPositiveInt(obj.exp) &&
+    isDidString(obj.iss) &&
+    isDidString(obj.aud)
+  )
+}
+
+function timeDiff(t1: number, t2?: number): number {
+  if (t2 === undefined) return 0
+  return Math.abs(t1 - t2)
+}
+
+function isPositiveInt(value: unknown): value is number {
+  return typeof value === 'number' && Number.isInteger(value) && value > 0
+}
+
+function jsonFromBase64<T>(b64: string, isType: (obj: unknown) => obj is T): T {
+  const obj = JSON.parse(utf8FromBase64(b64, 'base64url'))
+  if (isType(obj)) return obj
+  throw new Error('Invalid type')
+}