@atproto/oauth-provider 0.1.0

package/dist/errors/account-selection-required-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-selection-required-error.d.ts","sourceRoot":"","sources":["../../src/errors/account-selection-required-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,qBAAa,6BAA8B,SAAQ,iBAAiB;gBAEhE,UAAU,EAAE,oCAAoC,EAChD,iBAAiB,SAA+B,EAChD,KAAK,CAAC,EAAE,OAAO;CAIlB"}

package/dist/errors/account-selection-required-error.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccountSelectionRequiredError = void 0;
+const access_denied_error_js_1 = require("./access-denied-error.js");
+class AccountSelectionRequiredError extends access_denied_error_js_1.AccessDeniedError {
+    constructor(parameters, error_description = 'Account selection required', cause) {
+        super(parameters, error_description, 'account_selection_required', cause);
+    }
+}
+exports.AccountSelectionRequiredError = AccountSelectionRequiredError;
+//# sourceMappingURL=account-selection-required-error.js.map

package/dist/errors/account-selection-required-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-selection-required-error.js","sourceRoot":"","sources":["../../src/errors/account-selection-required-error.ts"],"names":[],"mappings":";;;AACA,qEAA4D;AAE5D,MAAa,6BAA8B,SAAQ,0CAAiB;IAClE,YACE,UAAgD,EAChD,iBAAiB,GAAG,4BAA4B,EAChD,KAAe;QAEf,KAAK,CAAC,UAAU,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,KAAK,CAAC,CAAA;IAC3E,CAAC;CACF;AARD,sEAQC"}

package/dist/errors/consent-required-error.d.ts

@@ -0,0 +1,6 @@
+import { OAuthAuthenticationRequestParameters } from '@atproto/oauth-types';
+import { AccessDeniedError } from './access-denied-error.js';
+export declare class ConsentRequiredError extends AccessDeniedError {
+    constructor(parameters: OAuthAuthenticationRequestParameters, error_description?: string, cause?: unknown);
+}
+//# sourceMappingURL=consent-required-error.d.ts.map

package/dist/errors/consent-required-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-required-error.d.ts","sourceRoot":"","sources":["../../src/errors/consent-required-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,qBAAa,oBAAqB,SAAQ,iBAAiB;gBAEvD,UAAU,EAAE,oCAAoC,EAChD,iBAAiB,SAA0B,EAC3C,KAAK,CAAC,EAAE,OAAO;CAIlB"}

package/dist/errors/consent-required-error.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConsentRequiredError = void 0;
+const access_denied_error_js_1 = require("./access-denied-error.js");
+class ConsentRequiredError extends access_denied_error_js_1.AccessDeniedError {
+    constructor(parameters, error_description = 'User consent required', cause) {
+        super(parameters, error_description, 'consent_required', cause);
+    }
+}
+exports.ConsentRequiredError = ConsentRequiredError;
+//# sourceMappingURL=consent-required-error.js.map

package/dist/errors/consent-required-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-required-error.js","sourceRoot":"","sources":["../../src/errors/consent-required-error.ts"],"names":[],"mappings":";;;AACA,qEAA4D;AAE5D,MAAa,oBAAqB,SAAQ,0CAAiB;IACzD,YACE,UAAgD,EAChD,iBAAiB,GAAG,uBAAuB,EAC3C,KAAe;QAEf,KAAK,CAAC,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAA;IACjE,CAAC;CACF;AARD,oDAQC"}

package/dist/errors/invalid-authorization-details-error.d.ts

@@ -0,0 +1,20 @@
+import { OAuthError } from './oauth-error.js';
+/**
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc9396#section-14.6 | RFC 9396 - OAuth Dynamic Client Registration Metadata Registration Error}
+ *
+ * The AS MUST refuse to process any unknown authorization details type or
+ * authorization details not conforming to the respective type definition. The
+ * AS MUST abort processing and respond with an error
+ * invalid_authorization_details to the client if any of the following are true
+ * of the objects in the authorization_details structure:
+ *  - contains an unknown authorization details type value,
+ *  - is an object of known type but containing unknown fields,
+ *  - contains fields of the wrong type for the authorization details type,
+ *  - contains fields with invalid values for the authorization details type, or
+ *  - is missing required fields for the authorization details type.
+ */
+export declare class InvalidAuthorizationDetailsError extends OAuthError {
+    constructor(error_description: string, cause?: unknown);
+}
+//# sourceMappingURL=invalid-authorization-details-error.d.ts.map

package/dist/errors/invalid-authorization-details-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-authorization-details-error.d.ts","sourceRoot":"","sources":["../../src/errors/invalid-authorization-details-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gCAAiC,SAAQ,UAAU;gBAClD,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAGvD"}

package/dist/errors/invalid-authorization-details-error.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidAuthorizationDetailsError = void 0;
+const oauth_error_js_1 = require("./oauth-error.js");
+/**
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc9396#section-14.6 | RFC 9396 - OAuth Dynamic Client Registration Metadata Registration Error}
+ *
+ * The AS MUST refuse to process any unknown authorization details type or
+ * authorization details not conforming to the respective type definition. The
+ * AS MUST abort processing and respond with an error
+ * invalid_authorization_details to the client if any of the following are true
+ * of the objects in the authorization_details structure:
+ *  - contains an unknown authorization details type value,
+ *  - is an object of known type but containing unknown fields,
+ *  - contains fields of the wrong type for the authorization details type,
+ *  - contains fields with invalid values for the authorization details type, or
+ *  - is missing required fields for the authorization details type.
+ */
+class InvalidAuthorizationDetailsError extends oauth_error_js_1.OAuthError {
+    constructor(error_description, cause) {
+        super('invalid_authorization_details', error_description, 400, cause);
+    }
+}
+exports.InvalidAuthorizationDetailsError = InvalidAuthorizationDetailsError;
+//# sourceMappingURL=invalid-authorization-details-error.js.map

package/dist/errors/invalid-authorization-details-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-authorization-details-error.js","sourceRoot":"","sources":["../../src/errors/invalid-authorization-details-error.ts"],"names":[],"mappings":";;;AAAA,qDAA6C;AAE7C;;;;;;;;;;;;;;GAcG;AACH,MAAa,gCAAiC,SAAQ,2BAAU;IAC9D,YAAY,iBAAyB,EAAE,KAAe;QACpD,KAAK,CAAC,+BAA+B,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACvE,CAAC;CACF;AAJD,4EAIC"}

package/dist/errors/invalid-client-error.d.ts

@@ -0,0 +1,18 @@
+import { OAuthError } from './oauth-error.js';
+/**
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token }
+ *
+ * Client authentication failed (e.g., unknown client, no client authentication
+ * included, or unsupported authentication method). The authorization server MAY
+ * return an HTTP 401 (Unauthorized) status code to indicate which HTTP
+ * authentication schemes are supported.  If the client attempted to
+ * authenticate via the "Authorization" request header field, the authorization
+ * server MUST respond with an HTTP 401 (Unauthorized) status code and include
+ * the "WWW-Authenticate" response header field matching the authentication
+ * scheme used by the client.
+ */
+export declare class InvalidClientError extends OAuthError {
+    constructor(error_description: string, cause?: unknown);
+}
+//# sourceMappingURL=invalid-client-error.d.ts.map

package/dist/errors/invalid-client-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-client-error.d.ts","sourceRoot":"","sources":["../../src/errors/invalid-client-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;;;;;;;;;;;GAYG;AACH,qBAAa,kBAAmB,SAAQ,UAAU;gBACpC,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAGvD"}

package/dist/errors/invalid-client-error.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidClientError = void 0;
+const oauth_error_js_1 = require("./oauth-error.js");
+/**
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token }
+ *
+ * Client authentication failed (e.g., unknown client, no client authentication
+ * included, or unsupported authentication method). The authorization server MAY
+ * return an HTTP 401 (Unauthorized) status code to indicate which HTTP
+ * authentication schemes are supported.  If the client attempted to
+ * authenticate via the "Authorization" request header field, the authorization
+ * server MUST respond with an HTTP 401 (Unauthorized) status code and include
+ * the "WWW-Authenticate" response header field matching the authentication
+ * scheme used by the client.
+ */
+class InvalidClientError extends oauth_error_js_1.OAuthError {
+    constructor(error_description, cause) {
+        super('invalid_client', error_description, 400, cause);
+    }
+}
+exports.InvalidClientError = InvalidClientError;
+//# sourceMappingURL=invalid-client-error.js.map

package/dist/errors/invalid-client-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-client-error.js","sourceRoot":"","sources":["../../src/errors/invalid-client-error.ts"],"names":[],"mappings":";;;AAAA,qDAA6C;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAa,kBAAmB,SAAQ,2BAAU;IAChD,YAAY,iBAAyB,EAAE,KAAe;QACpD,KAAK,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACxD,CAAC;CACF;AAJD,gDAIC"}

package/dist/errors/invalid-client-id-error.d.ts

@@ -0,0 +1,13 @@
+import { OAuthError } from './oauth-error.js';
+/**
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591 - Client Registration Error Response}
+ *
+ * The value of one of the client metadata fields is invalid and the server has
+ * rejected this request.  Note that an authorization server MAY choose to
+ * substitute a valid value for any requested parameter of a client's metadata.
+ */
+export declare class InvalidClientIdError extends OAuthError {
+    constructor(error_description: string, cause?: unknown);
+    static from(err: unknown): InvalidClientIdError;
+}
+//# sourceMappingURL=invalid-client-id-error.d.ts.map

package/dist/errors/invalid-client-id-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-client-id-error.d.ts","sourceRoot":"","sources":["../../src/errors/invalid-client-id-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,UAAU;gBACtC,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;IAItD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB;CAKhD"}

package/dist/errors/invalid-client-id-error.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidClientIdError = void 0;
+const oauth_error_js_1 = require("./oauth-error.js");
+/**
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591 - Client Registration Error Response}
+ *
+ * The value of one of the client metadata fields is invalid and the server has
+ * rejected this request.  Note that an authorization server MAY choose to
+ * substitute a valid value for any requested parameter of a client's metadata.
+ */
+class InvalidClientIdError extends oauth_error_js_1.OAuthError {
+    constructor(error_description, cause) {
+        super('invalid_client_id', error_description, 400, cause);
+    }
+    static from(err) {
+        if (err instanceof InvalidClientIdError)
+            return err;
+        if (err instanceof TypeError)
+            return new InvalidClientIdError(err.message);
+        return new InvalidClientIdError('Invalid client identifier', err);
+    }
+}
+exports.InvalidClientIdError = InvalidClientIdError;
+//# sourceMappingURL=invalid-client-id-error.js.map

package/dist/errors/invalid-client-id-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-client-id-error.js","sourceRoot":"","sources":["../../src/errors/invalid-client-id-error.ts"],"names":[],"mappings":";;;AAAA,qDAA6C;AAE7C;;;;;;GAMG;AACH,MAAa,oBAAqB,SAAQ,2BAAU;IAClD,YAAY,iBAAyB,EAAE,KAAe;QACpD,KAAK,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAY;QACtB,IAAI,GAAG,YAAY,oBAAoB;YAAE,OAAO,GAAG,CAAA;QACnD,IAAI,GAAG,YAAY,SAAS;YAAE,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC1E,OAAO,IAAI,oBAAoB,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAA;IACnE,CAAC;CACF;AAVD,oDAUC"}

package/dist/errors/invalid-client-metadata-error.d.ts

@@ -0,0 +1,13 @@
+import { OAuthError } from './oauth-error.js';
+/**
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591 - Client Registration Error Response}
+ *
+ * The value of one of the client metadata fields is invalid and the server has
+ * rejected this request.  Note that an authorization server MAY choose to
+ * substitute a valid value for any requested parameter of a client's metadata.
+ */
+export declare class InvalidClientMetadataError extends OAuthError {
+    constructor(error_description: string, cause?: unknown);
+    static from(cause: unknown): InvalidClientMetadataError;
+}
+//# sourceMappingURL=invalid-client-metadata-error.d.ts.map

package/dist/errors/invalid-client-metadata-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-client-metadata-error.d.ts","sourceRoot":"","sources":["../../src/errors/invalid-client-metadata-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,UAAU;gBAC5C,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;IAItD,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B;CAIxD"}

package/dist/errors/invalid-client-metadata-error.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidClientMetadataError = void 0;
+const oauth_error_js_1 = require("./oauth-error.js");
+/**
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591 - Client Registration Error Response}
+ *
+ * The value of one of the client metadata fields is invalid and the server has
+ * rejected this request.  Note that an authorization server MAY choose to
+ * substitute a valid value for any requested parameter of a client's metadata.
+ */
+class InvalidClientMetadataError extends oauth_error_js_1.OAuthError {
+    constructor(error_description, cause) {
+        super('invalid_client_metadata', error_description, 400, cause);
+    }
+    static from(cause) {
+        if (cause instanceof InvalidClientMetadataError)
+            return cause;
+        return new InvalidClientMetadataError('Invalid client configuration', cause);
+    }
+}
+exports.InvalidClientMetadataError = InvalidClientMetadataError;
+//# sourceMappingURL=invalid-client-metadata-error.js.map

package/dist/errors/invalid-client-metadata-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-client-metadata-error.js","sourceRoot":"","sources":["../../src/errors/invalid-client-metadata-error.ts"],"names":[],"mappings":";;;AAAA,qDAA6C;AAE7C;;;;;;GAMG;AACH,MAAa,0BAA2B,SAAQ,2BAAU;IACxD,YAAY,iBAAyB,EAAE,KAAe;QACpD,KAAK,CAAC,yBAAyB,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACjE,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,KAAc;QACxB,IAAI,KAAK,YAAY,0BAA0B;YAAE,OAAO,KAAK,CAAA;QAC7D,OAAO,IAAI,0BAA0B,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAA;IAC9E,CAAC;CACF;AATD,gEASC"}

package/dist/errors/invalid-dpop-key-binding-error.d.ts

@@ -0,0 +1,12 @@
+import { WWWAuthenticateError } from './www-authenticate-error.js';
+/**
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 | RFC6750 - The WWW-Authenticate Response Header Field}
+ *
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc9449#name-the-dpop-authentication-sch | RFC9449 - The DPoP Authentication Scheme}
+ */
+export declare class InvalidDpopKeyBindingError extends WWWAuthenticateError {
+    constructor(cause?: unknown);
+}
+//# sourceMappingURL=invalid-dpop-key-binding-error.d.ts.map

package/dist/errors/invalid-dpop-key-binding-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-dpop-key-binding-error.d.ts","sourceRoot":"","sources":["../../src/errors/invalid-dpop-key-binding-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAElE;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,oBAAoB;gBACtD,KAAK,CAAC,EAAE,OAAO;CAU5B"}

package/dist/errors/invalid-dpop-key-binding-error.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidDpopKeyBindingError = void 0;
+const www_authenticate_error_js_1 = require("./www-authenticate-error.js");
+/**
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 | RFC6750 - The WWW-Authenticate Response Header Field}
+ *
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc9449#name-the-dpop-authentication-sch | RFC9449 - The DPoP Authentication Scheme}
+ */
+class InvalidDpopKeyBindingError extends www_authenticate_error_js_1.WWWAuthenticateError {
+    constructor(cause) {
+        const error = 'invalid_token';
+        const error_description = 'Invalid DPoP key binding';
+        super(error, error_description, { DPoP: { error, error_description } }, cause);
+    }
+}
+exports.InvalidDpopKeyBindingError = InvalidDpopKeyBindingError;
+//# sourceMappingURL=invalid-dpop-key-binding-error.js.map

package/dist/errors/invalid-dpop-key-binding-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-dpop-key-binding-error.js","sourceRoot":"","sources":["../../src/errors/invalid-dpop-key-binding-error.ts"],"names":[],"mappings":";;;AAAA,2EAAkE;AAElE;;;;;;GAMG;AACH,MAAa,0BAA2B,SAAQ,gDAAoB;IAClE,YAAY,KAAe;QACzB,MAAM,KAAK,GAAG,eAAe,CAAA;QAC7B,MAAM,iBAAiB,GAAG,0BAA0B,CAAA;QACpD,KAAK,CACH,KAAK,EACL,iBAAiB,EACjB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EACtC,KAAK,CACN,CAAA;IACH,CAAC;CACF;AAXD,gEAWC"}

package/dist/errors/invalid-dpop-proof-error.d.ts

@@ -0,0 +1,5 @@
+import { WWWAuthenticateError } from './www-authenticate-error.js';
+export declare class InvalidDpopProofError extends WWWAuthenticateError {
+    constructor(error_description: string, cause?: unknown);
+}
+//# sourceMappingURL=invalid-dpop-proof-error.d.ts.map

package/dist/errors/invalid-dpop-proof-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-dpop-proof-error.d.ts","sourceRoot":"","sources":["../../src/errors/invalid-dpop-proof-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAElE,qBAAa,qBAAsB,SAAQ,oBAAoB;gBACjD,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CASvD"}

package/dist/errors/invalid-dpop-proof-error.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidDpopProofError = void 0;
+const www_authenticate_error_js_1 = require("./www-authenticate-error.js");
+class InvalidDpopProofError extends www_authenticate_error_js_1.WWWAuthenticateError {
+    constructor(error_description, cause) {
+        const error = 'invalid_dpop_proof';
+        super(error, error_description, { DPoP: { error, error_description } }, cause);
+    }
+}
+exports.InvalidDpopProofError = InvalidDpopProofError;
+//# sourceMappingURL=invalid-dpop-proof-error.js.map

package/dist/errors/invalid-dpop-proof-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-dpop-proof-error.js","sourceRoot":"","sources":["../../src/errors/invalid-dpop-proof-error.ts"],"names":[],"mappings":";;;AAAA,2EAAkE;AAElE,MAAa,qBAAsB,SAAQ,gDAAoB;IAC7D,YAAY,iBAAyB,EAAE,KAAe;QACpD,MAAM,KAAK,GAAG,oBAAoB,CAAA;QAClC,KAAK,CACH,KAAK,EACL,iBAAiB,EACjB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EACtC,KAAK,CACN,CAAA;IACH,CAAC;CACF;AAVD,sDAUC"}

package/dist/errors/invalid-grant-error.d.ts

@@ -0,0 +1,14 @@
+import { OAuthError } from './oauth-error.js';
+/**
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token }
+ *
+ * The provided authorization grant (e.g., authorization code, resource owner
+ * credentials) or refresh token is invalid, expired, revoked, does not match
+ * the redirection URI used in the authorization request, or was issued to
+ * another client.
+ */
+export declare class InvalidGrantError extends OAuthError {
+    constructor(error_description: string, cause?: unknown);
+}
+//# sourceMappingURL=invalid-grant-error.d.ts.map

package/dist/errors/invalid-grant-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-grant-error.d.ts","sourceRoot":"","sources":["../../src/errors/invalid-grant-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;;;;;;;GAQG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAGvD"}

package/dist/errors/invalid-grant-error.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidGrantError = void 0;
+const oauth_error_js_1 = require("./oauth-error.js");
+/**
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token }
+ *
+ * The provided authorization grant (e.g., authorization code, resource owner
+ * credentials) or refresh token is invalid, expired, revoked, does not match
+ * the redirection URI used in the authorization request, or was issued to
+ * another client.
+ */
+class InvalidGrantError extends oauth_error_js_1.OAuthError {
+    constructor(error_description, cause) {
+        super('invalid_grant', error_description, 400, cause);
+    }
+}
+exports.InvalidGrantError = InvalidGrantError;
+//# sourceMappingURL=invalid-grant-error.js.map

package/dist/errors/invalid-grant-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-grant-error.js","sourceRoot":"","sources":["../../src/errors/invalid-grant-error.ts"],"names":[],"mappings":";;;AAAA,qDAA6C;AAE7C;;;;;;;;GAQG;AACH,MAAa,iBAAkB,SAAQ,2BAAU;IAC/C,YAAY,iBAAyB,EAAE,KAAe;QACpD,KAAK,CAAC,eAAe,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACvD,CAAC;CACF;AAJD,8CAIC"}

package/dist/errors/invalid-parameters-error.d.ts

@@ -0,0 +1,6 @@
+import { OAuthAuthenticationRequestParameters } from '@atproto/oauth-types';
+import { AccessDeniedError } from './access-denied-error.js';
+export declare class InvalidParametersError extends AccessDeniedError {
+    constructor(parameters: OAuthAuthenticationRequestParameters, error_description: string, cause?: unknown);
+}
+//# sourceMappingURL=invalid-parameters-error.d.ts.map

package/dist/errors/invalid-parameters-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-parameters-error.d.ts","sourceRoot":"","sources":["../../src/errors/invalid-parameters-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,qBAAa,sBAAuB,SAAQ,iBAAiB;gBAEzD,UAAU,EAAE,oCAAoC,EAChD,iBAAiB,EAAE,MAAM,EACzB,KAAK,CAAC,EAAE,OAAO;CAIlB"}

package/dist/errors/invalid-parameters-error.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidParametersError = void 0;
+const access_denied_error_js_1 = require("./access-denied-error.js");
+class InvalidParametersError extends access_denied_error_js_1.AccessDeniedError {
+    constructor(parameters, error_description, cause) {
+        super(parameters, error_description, 'invalid_request', cause);
+    }
+}
+exports.InvalidParametersError = InvalidParametersError;
+//# sourceMappingURL=invalid-parameters-error.js.map

package/dist/errors/invalid-parameters-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-parameters-error.js","sourceRoot":"","sources":["../../src/errors/invalid-parameters-error.ts"],"names":[],"mappings":";;;AACA,qEAA4D;AAE5D,MAAa,sBAAuB,SAAQ,0CAAiB;IAC3D,YACE,UAAgD,EAChD,iBAAyB,EACzB,KAAe;QAEf,KAAK,CAAC,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAA;IAChE,CAAC;CACF;AARD,wDAQC"}

package/dist/errors/invalid-redirect-uri-error.d.ts

@@ -0,0 +1,11 @@
+import { OAuthError } from './oauth-error.js';
+/**
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591}
+ *
+ * The value of one or more redirection URIs is invalid.
+ */
+export declare class InvalidRedirectUriError extends OAuthError {
+    constructor(error_description: string, cause?: unknown);
+    static from(cause?: unknown): InvalidRedirectUriError;
+}
+//# sourceMappingURL=invalid-redirect-uri-error.d.ts.map

package/dist/errors/invalid-redirect-uri-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-redirect-uri-error.d.ts","sourceRoot":"","sources":["../../src/errors/invalid-redirect-uri-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,UAAU;gBACzC,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;IAItD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,uBAAuB;CAItD"}

package/dist/errors/invalid-redirect-uri-error.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidRedirectUriError = void 0;
+const oauth_error_js_1 = require("./oauth-error.js");
+/**
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591}
+ *
+ * The value of one or more redirection URIs is invalid.
+ */
+class InvalidRedirectUriError extends oauth_error_js_1.OAuthError {
+    constructor(error_description, cause) {
+        super('invalid_redirect_uri', error_description, 400, cause);
+    }
+    static from(cause) {
+        if (cause instanceof InvalidRedirectUriError)
+            return cause;
+        return new InvalidRedirectUriError('Invalid redirect URI', cause);
+    }
+}
+exports.InvalidRedirectUriError = InvalidRedirectUriError;
+//# sourceMappingURL=invalid-redirect-uri-error.js.map

package/dist/errors/invalid-redirect-uri-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-redirect-uri-error.js","sourceRoot":"","sources":["../../src/errors/invalid-redirect-uri-error.ts"],"names":[],"mappings":";;;AAAA,qDAA6C;AAE7C;;;;GAIG;AACH,MAAa,uBAAwB,SAAQ,2BAAU;IACrD,YAAY,iBAAyB,EAAE,KAAe;QACpD,KAAK,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,KAAe;QACzB,IAAI,KAAK,YAAY,uBAAuB;YAAE,OAAO,KAAK,CAAA;QAC1D,OAAO,IAAI,uBAAuB,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAA;IACnE,CAAC;CACF;AATD,0DASC"}

package/dist/errors/invalid-request-error.d.ts

@@ -0,0 +1,28 @@
+import { OAuthError } from './oauth-error.js';
+/**
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token }
+ *
+ * The request is missing a required parameter, includes an unsupported
+ * parameter value (other than grant type), repeats a parameter, includes
+ * multiple credentials, utilizes more than one mechanism for authenticating the
+ * client, or is otherwise malformed.
+ *
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1 | RFC6749 - Authorization Code Grant, Authorization Request}
+ *
+ * The request is missing a required parameter, includes an invalid parameter
+ * value, includes a parameter more than once, or is otherwise malformed.
+ *
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 | RFC6750 - The WWW-Authenticate Response Header Field }
+ *
+ * The request is missing a required parameter, includes an unsupported
+ * parameter or parameter value, repeats the same parameter, uses more than one
+ * method for including an access token, or is otherwise malformed. The resource
+ * server SHOULD respond with the HTTP 400 (Bad Request) status code.
+ */
+export declare class InvalidRequestError extends OAuthError {
+    constructor(error_description: string, cause?: unknown);
+}
+//# sourceMappingURL=invalid-request-error.d.ts.map

package/dist/errors/invalid-request-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-request-error.d.ts","sourceRoot":"","sources":["../../src/errors/invalid-request-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;gBACrC,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAGvD"}

package/dist/errors/invalid-request-error.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidRequestError = void 0;
+const oauth_error_js_1 = require("./oauth-error.js");
+/**
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token }
+ *
+ * The request is missing a required parameter, includes an unsupported
+ * parameter value (other than grant type), repeats a parameter, includes
+ * multiple credentials, utilizes more than one mechanism for authenticating the
+ * client, or is otherwise malformed.
+ *
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1 | RFC6749 - Authorization Code Grant, Authorization Request}
+ *
+ * The request is missing a required parameter, includes an invalid parameter
+ * value, includes a parameter more than once, or is otherwise malformed.
+ *
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 | RFC6750 - The WWW-Authenticate Response Header Field }
+ *
+ * The request is missing a required parameter, includes an unsupported
+ * parameter or parameter value, repeats the same parameter, uses more than one
+ * method for including an access token, or is otherwise malformed. The resource
+ * server SHOULD respond with the HTTP 400 (Bad Request) status code.
+ */
+class InvalidRequestError extends oauth_error_js_1.OAuthError {
+    constructor(error_description, cause) {
+        super('invalid_request', error_description, 400, cause);
+    }
+}
+exports.InvalidRequestError = InvalidRequestError;
+//# sourceMappingURL=invalid-request-error.js.map

package/dist/errors/invalid-request-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-request-error.js","sourceRoot":"","sources":["../../src/errors/invalid-request-error.ts"],"names":[],"mappings":";;;AAAA,qDAA6C;AAE7C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAa,mBAAoB,SAAQ,2BAAU;IACjD,YAAY,iBAAyB,EAAE,KAAe;QACpD,KAAK,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACzD,CAAC;CACF;AAJD,kDAIC"}

package/dist/errors/invalid-token-error.d.ts

@@ -0,0 +1,16 @@
+import { WWWAuthenticateError } from './www-authenticate-error.js';
+/**
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 | RFC6750 - The WWW-Authenticate Response Header Field }
+ *
+ * The access token provided is expired, revoked, malformed, or invalid for
+ * other reasons.  The resource SHOULD respond with the HTTP 401 (Unauthorized)
+ * status code.  The client MAY request a new access token and retry the
+ * protected resource request.
+ */
+export declare class InvalidTokenError extends WWWAuthenticateError {
+    readonly tokenType: string;
+    static from(err: unknown, tokenType: string, fallbackMessage?: string): InvalidTokenError;
+    constructor(tokenType: string, error_description: string, cause?: unknown);
+}
+//# sourceMappingURL=invalid-token-error.d.ts.map

package/dist/errors/invalid-token-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-token-error.d.ts","sourceRoot":"","sources":["../../src/errors/invalid-token-error.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAElE;;;;;;;;GAQG;AACH,qBAAa,iBAAkB,SAAQ,oBAAoB;IA8BvD,QAAQ,CAAC,SAAS,EAAE,MAAM;IA7B5B,MAAM,CAAC,IAAI,CACT,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,eAAe,SAAkB,GAChC,iBAAiB;gBAyBT,SAAS,EAAE,MAAM,EAC1B,iBAAiB,EAAE,MAAM,EACzB,KAAK,CAAC,EAAE,OAAO;CAUlB"}

package/dist/errors/invalid-token-error.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidTokenError = void 0;
+const jwk_1 = require("@atproto/jwk");
+const errors_1 = require("jose/errors");
+const zod_1 = require("zod");
+const oauth_error_js_1 = require("./oauth-error.js");
+const www_authenticate_error_js_1 = require("./www-authenticate-error.js");
+/**
+ * @see
+ * {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 | RFC6750 - The WWW-Authenticate Response Header Field }
+ *
+ * The access token provided is expired, revoked, malformed, or invalid for
+ * other reasons.  The resource SHOULD respond with the HTTP 401 (Unauthorized)
+ * status code.  The client MAY request a new access token and retry the
+ * protected resource request.
+ */
+class InvalidTokenError extends www_authenticate_error_js_1.WWWAuthenticateError {
+    tokenType;
+    static from(err, tokenType, fallbackMessage = 'Invalid token') {
+        if (err instanceof InvalidTokenError) {
+            return err;
+        }
+        if (err instanceof oauth_error_js_1.OAuthError) {
+            return new InvalidTokenError(tokenType, err.error_description, err);
+        }
+        if (err instanceof errors_1.JOSEError) {
+            return new InvalidTokenError(tokenType, err.message, err);
+        }
+        if (err instanceof jwk_1.JwtVerifyError) {
+            return new InvalidTokenError(tokenType, err.message, err);
+        }
+        if (err instanceof zod_1.ZodError) {
+            return new InvalidTokenError(tokenType, err.message, err);
+        }
+        return new InvalidTokenError(tokenType, fallbackMessage, err);
+    }
+    constructor(tokenType, error_description, cause) {
+        const error = 'invalid_token';
+        super(error, error_description, { [tokenType]: { error, error_description } }, cause);
+        this.tokenType = tokenType;
+    }
+}
+exports.InvalidTokenError = InvalidTokenError;
+//# sourceMappingURL=invalid-token-error.js.map

package/dist/errors/invalid-token-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-token-error.js","sourceRoot":"","sources":["../../src/errors/invalid-token-error.ts"],"names":[],"mappings":";;;AAAA,sCAA6C;AAC7C,wCAAuC;AACvC,6BAA8B;AAE9B,qDAA6C;AAC7C,2EAAkE;AAElE;;;;;;;;GAQG;AACH,MAAa,iBAAkB,SAAQ,gDAAoB;IA8B9C;IA7BX,MAAM,CAAC,IAAI,CACT,GAAY,EACZ,SAAiB,EACjB,eAAe,GAAG,eAAe;QAEjC,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,IAAI,GAAG,YAAY,2BAAU,EAAE,CAAC;YAC9B,OAAO,IAAI,iBAAiB,CAAC,SAAS,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;QACrE,CAAC;QAED,IAAI,GAAG,YAAY,kBAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,iBAAiB,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,IAAI,GAAG,YAAY,oBAAc,EAAE,CAAC;YAClC,OAAO,IAAI,iBAAiB,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,IAAI,GAAG,YAAY,cAAQ,EAAE,CAAC;YAC5B,OAAO,IAAI,iBAAiB,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,OAAO,IAAI,iBAAiB,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC;IAED,YACW,SAAiB,EAC1B,iBAAyB,EACzB,KAAe;QAEf,MAAM,KAAK,GAAG,eAAe,CAAA;QAC7B,KAAK,CACH,KAAK,EACL,iBAAiB,EACjB,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAC7C,KAAK,CACN,CAAA;QAVQ,cAAS,GAAT,SAAS,CAAQ;IAW5B,CAAC;CACF;AA1CD,8CA0CC"}

package/dist/errors/login-required-error.d.ts

@@ -0,0 +1,6 @@
+import { OAuthAuthenticationRequestParameters } from '@atproto/oauth-types';
+import { AccessDeniedError } from './access-denied-error.js';
+export declare class LoginRequiredError extends AccessDeniedError {
+    constructor(parameters: OAuthAuthenticationRequestParameters, error_description?: string, cause?: unknown);
+}
+//# sourceMappingURL=login-required-error.d.ts.map

package/dist/errors/login-required-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-required-error.d.ts","sourceRoot":"","sources":["../../src/errors/login-required-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,qBAAa,kBAAmB,SAAQ,iBAAiB;gBAErD,UAAU,EAAE,oCAAoC,EAChD,iBAAiB,SAAsB,EACvC,KAAK,CAAC,EAAE,OAAO;CAIlB"}

package/dist/errors/login-required-error.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LoginRequiredError = void 0;
+const access_denied_error_js_1 = require("./access-denied-error.js");
+class LoginRequiredError extends access_denied_error_js_1.AccessDeniedError {
+    constructor(parameters, error_description = 'Login is required', cause) {
+        super(parameters, error_description, 'login_required', cause);
+    }
+}
+exports.LoginRequiredError = LoginRequiredError;
+//# sourceMappingURL=login-required-error.js.map

package/dist/errors/login-required-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-required-error.js","sourceRoot":"","sources":["../../src/errors/login-required-error.ts"],"names":[],"mappings":";;;AACA,qEAA4D;AAE5D,MAAa,kBAAmB,SAAQ,0CAAiB;IACvD,YACE,UAAgD,EAChD,iBAAiB,GAAG,mBAAmB,EACvC,KAAe;QAEf,KAAK,CAAC,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAA;IAC/D,CAAC;CACF;AARD,gDAQC"}