@atproto/oauth-provider 0.13.1 → 0.13.2

package/dist/metadata/build-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-metadata.js","sourceRoot":"","sources":["../../src/metadata/build-metadata.ts"],"names":[],"mappings":";;AAkBA,sCAgHC;AAjID,sDAI6B;AAC7B,mDAA4C;AAC5C,qDAAoD;AAOpD;;;GAGG;AACH,SAAgB,aAAa,CAC3B,MAA6B,EAC7B,MAAc,EACd,cAA+B;IAE/B,OAAO,uDAAyC,CAAC,KAAK,CAAC;QACrD,MAAM;QAEN,gBAAgB,EAAE;YAChB,SAAS;YAET,yEAAyE;YACzE,kCAAkC;YAClC,kBAAkB;YAClB,oBAAoB;YACpB,sBAAsB;YAEtB,gEAAgE;SACjE;QACD,uBAAuB,EAAE;YACvB,EAAE;YACF,QAAQ,EAAE,6CAA6C;YACvD,+DAA+D;SAChE;QACD,wBAAwB,EAAE;YACxB,QAAQ;YACR,MAAM;YACN,WAAW;YAEX,SAAS;YACT,UAAU;YACV,yBAAyB;YACzB,mBAAmB;YACnB,gBAAgB;YAChB,oBAAoB;YACpB,cAAc;SACf;QACD,wBAAwB,EAAE;YACxB,mFAAmF;YACnF,OAAO;YACP,UAAU;YACV,0FAA0F;YAC1F,WAAW;SACZ;QACD,qBAAqB,EAAE;YACrB,EAAE;YACF,oBAAoB;YACpB,eAAe;SAChB;QACD,gCAAgC,EAAE;YAChC,sGAAsG;YACtG,MAAM;YAEN,iCAAiC;YACjC,WAAW;SACZ;QACD,oBAAoB,EAAE;YACpB,EAAE;YACF,OAAO;SACR;QACD,wBAAwB,EAAE;YACxB,EAAE;YACF,MAAM;YACN,OAAO;YACP,OAAO;YACP,aAAa;SACd;QAED,gDAAgD;QAChD,8CAA8C,EAAE,IAAI;QAEpD,0DAA0D;QAC1D,2CAA2C,EAAE,CAAC,GAAG,wBAAY,EAAE,MAAM,CAAC;QACtE,8CAA8C,EAAE,EAAE,EAAE,OAAO;QAC3D,8CAA8C,EAAE,EAAE,EAAE,OAAO;QAE3D,2BAA2B,EAAE,IAAI;QACjC,+BAA+B,EAAE,IAAI;QACrC,gCAAgC,EAAE,IAAI;QAEtC,QAAQ,EAAE,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,IAAI;QAE7C,sBAAsB,EAAE,IAAI,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,IAAI;QAEhE,cAAc,EAAE,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,IAAI;QACpD,qCAAqC,EAAE,CAAC,GAAG,kBAAM,CAAC,sBAAsB,CAAC;QACzE,gDAAgD,EAAE,CAAC,GAAG,wBAAY,CAAC;QAEnE,mBAAmB,EAAE,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,IAAI;QAE1D,sBAAsB,EAAE,IAAI,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,IAAI;QAEjE,+DAA+D;QAE/D,0DAA0D;QAC1D,qCAAqC,EAAE,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,IAAI;QAEzE,qCAAqC,EAAE,IAAI;QAE3C,4DAA4D;QAC5D,iCAAiC,EAAE,CAAC,GAAG,wBAAY,CAAC;QAEpD,6DAA6D;QAC7D,qCAAqC,EACnC,cAAc,EAAE,qCAAqC;QAEvD,wFAAwF;QACxF,mBAAmB,EAAE,cAAc,EAAE,mBAAmB;QAExD,kIAAkI;QAClI,qCAAqC,EAAE,IAAI;KAC5C,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"build-metadata.js","sourceRoot":"","sources":["../../src/metadata/build-metadata.ts"],"names":[],"mappings":";;AAkBA,sCAgHC;AAjID,sDAI6B;AAC7B,mDAA4C;AAC5C,qDAAoD;AAOpD;;;GAGG;AACH,SAAgB,aAAa,CAC3B,MAA6B,EAC7B,MAAc,EACd,cAA+B;IAE/B,OAAO,uDAAyC,CAAC,KAAK,CAAC;QACrD,MAAM;QAEN,gBAAgB,EAAE;YAChB,SAAS;YAET,yEAAyE;YACzE,kCAAkC;YAClC,kBAAkB;YAClB,oBAAoB;YACpB,sBAAsB;YAEtB,gEAAgE;SACjE;QACD,uBAAuB,EAAE;YACvB,EAAE;YACF,QAAQ,EAAE,6CAA6C;YACvD,+DAA+D;SAChE;QACD,wBAAwB,EAAE;YACxB,QAAQ;YACR,MAAM;YACN,WAAW;YAEX,SAAS;YACT,UAAU;YACV,yBAAyB;YACzB,mBAAmB;YACnB,gBAAgB;YAChB,oBAAoB;YACpB,cAAc;SACf;QACD,wBAAwB,EAAE;YACxB,mFAAmF;YACnF,OAAO;YACP,UAAU;YACV,0FAA0F;YAC1F,WAAW;SACZ;QACD,qBAAqB,EAAE;YACrB,EAAE;YACF,oBAAoB;YACpB,eAAe;SAChB;QACD,gCAAgC,EAAE;YAChC,sGAAsG;YACtG,MAAM;YAEN,iCAAiC;YACjC,WAAW;SACZ;QACD,oBAAoB,EAAE;YACpB,EAAE;YACF,OAAO;SACR;QACD,wBAAwB,EAAE;YACxB,EAAE;YACF,MAAM;YACN,OAAO;YACP,OAAO;YACP,aAAa;SACd;QAED,gDAAgD;QAChD,8CAA8C,EAAE,IAAI;QAEpD,0DAA0D;QAC1D,2CAA2C,EAAE,CAAC,GAAG,wBAAY,EAAE,MAAM,CAAC;QACtE,8CAA8C,EAAE,EAAE,EAAE,OAAO;QAC3D,8CAA8C,EAAE,EAAE,EAAE,OAAO;QAE3D,2BAA2B,EAAE,IAAI;QACjC,+BAA+B,EAAE,IAAI;QACrC,gCAAgC,EAAE,IAAI;QAEtC,QAAQ,EAAE,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,IAAI;QAE7C,sBAAsB,EAAE,IAAI,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,IAAI;QAEhE,cAAc,EAAE,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,IAAI;QACpD,qCAAqC,EAAE,CAAC,GAAG,kBAAM,CAAC,sBAAsB,CAAC;QACzE,gDAAgD,EAAE,CAAC,GAAG,wBAAY,CAAC;QAEnE,mBAAmB,EAAE,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,IAAI;QAE1D,sBAAsB,EAAE,IAAI,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,IAAI;QAEjE,+DAA+D;QAE/D,0DAA0D;QAC1D,qCAAqC,EAAE,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,IAAI;QAEzE,qCAAqC,EAAE,IAAI;QAE3C,4DAA4D;QAC5D,iCAAiC,EAAE,CAAC,GAAG,wBAAY,CAAC;QAEpD,6DAA6D;QAC7D,qCAAqC,EACnC,cAAc,EAAE,qCAAqC;QAEvD,wFAAwF;QACxF,mBAAmB,EAAE,cAAc,EAAE,mBAAmB;QAExD,kIAAkI;QAClI,qCAAqC,EAAE,IAAI;KAC5C,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { Keyset } from '@atproto/jwk'\nimport {\n  OAuthAuthorizationServerMetadata,\n  OAuthIssuerIdentifier,\n  oauthAuthorizationServerMetadataValidator,\n} from '@atproto/oauth-types'\nimport { Client } from '../client/client.js'\nimport { VERIFY_ALGOS } from '../lib/util/crypto.js'\n\nexport type CustomMetadata = {\n  authorization_details_types_supported?: string[]\n  protected_resources?: string[]\n}\n\n/**\n * @see {@link https://datatracker.ietf.org/doc/html/rfc8414#section-2}\n * @see {@link https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata}\n */\nexport function buildMetadata(\n  issuer: OAuthIssuerIdentifier,\n  keyset: Keyset,\n  customMetadata?: CustomMetadata,\n): OAuthAuthorizationServerMetadata {\n  return oauthAuthorizationServerMetadataValidator.parse({\n    issuer,\n\n    scopes_supported: [\n      'atproto',\n\n      // These serve as hint that this server supports the transitional scopes.\n      // This is not a specced behavior.\n      'transition:email',\n      'transition:generic',\n      'transition:chat.bsky',\n\n      // Other atproto scopes can't be enumerated as they are dynamic.\n    ],\n    subject_types_supported: [\n      //\n      'public', // The same \"sub\" is returned for all clients\n      // 'pairwise', // A different \"sub\" is returned for each client\n    ],\n    response_types_supported: [\n      // OAuth\n      'code',\n      // 'token',\n\n      // OpenID\n      // 'none',\n      // 'code id_token token',\n      // 'code id_token',\n      // 'code token',\n      // 'id_token token',\n      // 'id_token',\n    ],\n    response_modes_supported: [\n      // https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#ResponseModes\n      'query',\n      'fragment',\n      // https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html#FormPostResponseMode\n      'form_post',\n    ],\n    grant_types_supported: [\n      //\n      'authorization_code',\n      'refresh_token',\n    ],\n    code_challenge_methods_supported: [\n      // https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#pkce-code-challenge-method\n      'S256',\n\n      // atproto does not allow \"plain\"\n      // 'plain',\n    ],\n    ui_locales_supported: [\n      //\n      'en-US',\n    ],\n    display_values_supported: [\n      //\n      'page',\n      'popup',\n      'touch',\n      // 'wap', LoL\n    ],\n\n    // https://datatracker.ietf.org/doc/html/rfc9207\n    authorization_response_iss_parameter_supported: true,\n\n    // https://datatracker.ietf.org/doc/html/rfc9101#section-4\n    request_object_signing_alg_values_supported: [...VERIFY_ALGOS, 'none'],\n    request_object_encryption_alg_values_supported: [], // None\n    request_object_encryption_enc_values_supported: [], // None\n\n    request_parameter_supported: true,\n    request_uri_parameter_supported: true,\n    require_request_uri_registration: true,\n\n    jwks_uri: new URL('/oauth/jwks', issuer).href,\n\n    authorization_endpoint: new URL('/oauth/authorize', issuer).href,\n\n    token_endpoint: new URL('/oauth/token', issuer).href,\n    token_endpoint_auth_methods_supported: [...Client.AUTH_METHODS_SUPPORTED],\n    token_endpoint_auth_signing_alg_values_supported: [...VERIFY_ALGOS],\n\n    revocation_endpoint: new URL('/oauth/revoke', issuer).href,\n\n    introspection_endpoint: new URL('/oauth/introspect', issuer).href,\n\n    // end_session_endpoint: new URL('/oauth/logout', issuer).href,\n\n    // https://datatracker.ietf.org/doc/html/rfc9126#section-5\n    pushed_authorization_request_endpoint: new URL('/oauth/par', issuer).href,\n\n    require_pushed_authorization_requests: true,\n\n    // https://datatracker.ietf.org/doc/html/rfc9449#section-5.1\n    dpop_signing_alg_values_supported: [...VERIFY_ALGOS],\n\n    // https://datatracker.ietf.org/doc/html/rfc9396#section-14.4\n    authorization_details_types_supported:\n      customMetadata?.authorization_details_types_supported,\n\n    // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-05#section-4\n    protected_resources: customMetadata?.protected_resources,\n\n    // https://drafts.aaronpk.com/draft-parecki-oauth-client-id-metadata-document/draft-parecki-oauth-client-id-metadata-document.html\n    client_id_metadata_document_supported: true,\n  })\n}\n"]}

package/dist/oauth-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client.js","sourceRoot":"","sources":["../src/oauth-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAoC;AAEpC,2DAAwC"}
+{"version":3,"file":"oauth-client.js","sourceRoot":"","sources":["../src/oauth-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAoC;AAEpC,2DAAwC","sourcesContent":["export * from '@atproto/oauth-types'\nexport type * from './client/client.js'\nexport * from './client/client-utils.js'\n"]}

package/dist/oauth-dpop.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-dpop.js","sourceRoot":"","sources":["../src/oauth-dpop.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAoC;AACpC,yDAAsC"}
+{"version":3,"file":"oauth-dpop.js","sourceRoot":"","sources":["../src/oauth-dpop.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAoC;AACpC,yDAAsC","sourcesContent":["export * from './dpop/dpop-nonce.js'\nexport * from './dpop/dpop-manager.js'\n"]}

package/dist/oauth-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-errors.js","sourceRoot":"","sources":["../src/oauth-errors.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,mBAAmB;AACnB,0DAAoD;AAA3C,4GAAA,UAAU,OAAA;AAEnB,kEAA+C;AAC/C,+EAA4D;AAC5D,kEAA+C;AAC/C,qEAAkD;AAClD,uEAAoD;AACpD,kFAA+D;AAC/D,mEAAgD;AAChD,sEAAmD;AACnD,4EAAyD;AACzD,6EAA0D;AAC1D,uEAAoD;AACpD,kEAA+C;AAC/C,wEAAqD;AACrD,yEAAsD;AACtD,oEAAiD;AACjD,kEAA+C;AAC/C,kEAA+C;AAC/C,mEAAgD;AAChD,0FAAuE;AACvE,wEAAqD;AACrD,mEAAgD;AAChD,qEAAkD"}
+{"version":3,"file":"oauth-errors.js","sourceRoot":"","sources":["../src/oauth-errors.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,mBAAmB;AACnB,0DAAoD;AAA3C,4GAAA,UAAU,OAAA;AAEnB,kEAA+C;AAC/C,+EAA4D;AAC5D,kEAA+C;AAC/C,qEAAkD;AAClD,uEAAoD;AACpD,kFAA+D;AAC/D,mEAAgD;AAChD,sEAAmD;AACnD,4EAAyD;AACzD,6EAA0D;AAC1D,uEAAoD;AACpD,kEAA+C;AAC/C,wEAAqD;AACrD,yEAAsD;AACtD,oEAAiD;AACjD,kEAA+C;AAC/C,kEAA+C;AAC/C,mEAAgD;AAChD,0FAAuE;AACvE,wEAAqD;AACrD,mEAAgD;AAChD,qEAAkD","sourcesContent":["// Root Error class\nexport { OAuthError } from './errors/oauth-error.js'\n\nexport * from './errors/access-denied-error.js'\nexport * from './errors/account-selection-required-error.js'\nexport * from './errors/authorization-error.js'\nexport * from './errors/consent-required-error.js'\nexport * from './errors/handle-unavailable-error.js'\nexport * from './errors/invalid-authorization-details-error.js'\nexport * from './errors/invalid-client-error.js'\nexport * from './errors/invalid-client-id-error.js'\nexport * from './errors/invalid-client-metadata-error.js'\nexport * from './errors/invalid-dpop-key-binding-error.js'\nexport * from './errors/invalid-dpop-proof-error.js'\nexport * from './errors/invalid-grant-error.js'\nexport * from './errors/invalid-invite-code-error.js'\nexport * from './errors/invalid-redirect-uri-error.js'\nexport * from './errors/invalid-request-error.js'\nexport * from './errors/invalid-scope-error.js'\nexport * from './errors/invalid-token-error.js'\nexport * from './errors/login-required-error.js'\nexport * from './errors/second-authentication-factor-required-error.js'\nexport * from './errors/unauthorized-client-error.js'\nexport * from './errors/use-dpop-nonce-error.js'\nexport * from './errors/www-authenticate-error.js'\n"]}

package/dist/oauth-hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-hooks.js","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":";;;AAoBA,kDAA2C;AAyBzC,uFAzBO,kBAAM,OAyBP;AAtBR,4EAAmE;AAiBjE,kGAjBO,0CAAiB,OAiBP;AAhBnB,4EAAoE;AAmBlE,mGAnBO,2CAAkB,OAmBP;AAlBpB,gFAAuE;AA6BrE,oGA7BO,8CAAmB,OA6BP;AA5BrB,4DAAoD;AAkClD,2FAlCO,2BAAU,OAkCP"}
+{"version":3,"file":"oauth-hooks.js","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":";;;AAoBA,kDAA2C;AAyBzC,uFAzBO,kBAAM,OAyBP;AAtBR,4EAAmE;AAiBjE,kGAjBO,0CAAiB,OAiBP;AAhBnB,4EAAoE;AAmBlE,mGAnBO,2CAAkB,OAmBP;AAlBpB,gFAAuE;AA6BrE,oGA7BO,8CAAmB,OA6BP;AA5BrB,4DAAoD;AAkClD,2FAlCO,2BAAU,OAkCP","sourcesContent":["import { Jwks } from '@atproto/jwk'\nimport type { Account } from '@atproto/oauth-provider-api'\nimport {\n  OAuthAccessToken,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientMetadata,\n  OAuthTokenResponse,\n  OAuthTokenType,\n} from '@atproto/oauth-types'\nimport {\n  ResetPasswordConfirmInput,\n  ResetPasswordRequestInput,\n  SignUpData,\n} from './account/account-store.js'\nimport { SignInData } from './account/sign-in-data.js'\nimport { SignUpInput } from './account/sign-up-input.js'\nimport { ClientAuth } from './client/client-auth.js'\nimport { ClientId } from './client/client-id.js'\nimport { ClientInfo } from './client/client-info.js'\nimport { Client } from './client/client.js'\nimport { DeviceId } from './device/device-id.js'\nimport { DpopProof } from './dpop/dpop-proof.js'\nimport { AccessDeniedError } from './errors/access-denied-error.js'\nimport { AuthorizationError } from './errors/authorization-error.js'\nimport { InvalidRequestError } from './errors/invalid-request-error.js'\nimport { OAuthError } from './errors/oauth-error.js'\nimport {\n  HcaptchaClientTokens,\n  HcaptchaConfig,\n  HcaptchaVerifyResult,\n} from './lib/hcaptcha.js'\nimport { RequestMetadata } from './lib/http/request.js'\nimport { Awaitable, OmitKey } from './lib/util/type.js'\nimport { RequestId } from './request/request-id.js'\nimport { AccessTokenPayload } from './signer/access-token-payload.js'\nimport { TokenClaims } from './token/token-claims.js'\n\n// Make sure all types needed to implement the OAuthHooks are exported\nexport {\n  AccessDeniedError,\n  type AccessTokenPayload,\n  type Account,\n  AuthorizationError,\n  type Awaitable,\n  Client,\n  type ClientAuth,\n  type ClientId,\n  type ClientInfo,\n  type DeviceId,\n  type DpopProof,\n  type HcaptchaClientTokens,\n  type HcaptchaConfig,\n  type HcaptchaVerifyResult,\n  InvalidRequestError,\n  type Jwks,\n  type OAuthAccessToken,\n  type OAuthAuthorizationDetails,\n  type OAuthAuthorizationRequestParameters,\n  type OAuthClientMetadata,\n  OAuthError,\n  type OAuthTokenResponse,\n  type OAuthTokenType,\n  type RequestMetadata,\n  type ResetPasswordConfirmInput,\n  type ResetPasswordRequestInput,\n  type SignInData,\n  type SignUpData,\n  type SignUpInput,\n  type TokenClaims,\n}\n\nexport type OAuthHooks = {\n  /**\n   * Use this to alter, override or validate the client metadata & jwks returned\n   * by the client store.\n   *\n   * @throws {InvalidClientMetadataError} if the metadata is invalid\n   * @see {@link InvalidClientMetadataError}\n   */\n  getClientInfo?: (\n    clientId: ClientId,\n    data: { metadata: OAuthClientMetadata; jwks?: Jwks },\n  ) => Awaitable<undefined | Partial<ClientInfo>>\n\n  /**\n   * This hook is called when a user attempts to sign up, after every validation\n   * has passed (including hcaptcha).\n   */\n  onSignUpAttempt?: (data: {\n    input: SignUpInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user attempts to sign up, after the hcaptcha\n   * `/siteverify` request has been made (and before the result is validated).\n   */\n  onHcaptchaResult?: (data: {\n    input: SignUpInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    tokens: HcaptchaClientTokens\n    result: HcaptchaVerifyResult\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a password reset, before the\n   * reset password request is triggered on the account store.\n   */\n  onResetPasswordRequest?: (data: {\n    input: ResetPasswordRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms a password reset, before the\n   * password is actually reset on the account store.\n   */\n  onResetPasswordConfirm?: (data: {\n    input: ResetPasswordConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user successfully signs up.\n   *\n   * @throws {AccessDeniedError} to deny the sign-up\n   */\n  onSignedUp?: (data: {\n    data: SignUpData\n    account: Account\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  onSignInAttempt?: (data: {\n    data: SignInData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user successfully signs in.\n   *\n   * @throws {InvalidRequestError} when the sing-in should be denied\n   */\n  onSignedIn?: (data: {\n    data: SignInData\n    account: Account\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * Allows validating an authorization request (typically the requested scopes)\n   * before it is created. Note that the validity against the client metadata is\n   * already enforced by the OAuth provider.\n   *\n   * @throws {AuthorizationError}\n   */\n  onAuthorizationRequest?: (data: {\n    client: Client\n    clientAuth: null | ClientAuth\n    parameters: Readonly<OAuthAuthorizationRequestParameters>\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a client is authorized.\n   *\n   * @throws {AuthorizationError} to deny the authorization request and redirect\n   * the user to the client with an OAuth error (other errors will result in an\n   * internal server error being displayed to the user)\n   *\n   * @note We use `deviceMetadata` instead of `clientMetadata` to make it clear\n   * that this metadata is from the user device, which might be different from\n   * the client metadata (because the OAuth client could live in a backend).\n   */\n  onAuthorized?: (data: {\n    client: Client\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    requestId: RequestId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called whenever a token is about to be created. You can use\n   * it to modify the token claims or perform additional validation.\n   *\n   * This hook should never throw an error.\n   */\n  onCreateToken?: (data: {\n    client: Client\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n    claims: TokenClaims\n  }) => Awaitable<void | OmitKey<AccessTokenPayload, 'iss'>>\n\n  /**\n   * This hook is called whenever a token was just decoded, and basic validation\n   * was performed (signature, expiration, not-before).\n   *\n   * It can be used to modify the payload (e.g., to add custom claims), or to\n   * perform additional validation.\n   *\n   * This hook is called when authenticating requests through the\n   * `authenticateRequest()` method in `OAuthVerifier` and `OAuthProvider`.\n   *\n   * Any error thrown here will be propagated.\n   */\n  onDecodeToken?: (data: {\n    tokenType: OAuthTokenType\n    token: OAuthAccessToken\n    payload: AccessTokenPayload\n    dpopProof: null | DpopProof\n  }) => Promise<AccessTokenPayload | void>\n\n  /**\n   * This hook is called when an authorized client exchanges an authorization\n   * code for an access token.\n   *\n   * @throws {OAuthError} to cancel the token creation and revoke the session\n   */\n  onTokenCreated?: (data: {\n    client: Client\n    clientAuth: ClientAuth\n    clientMetadata: RequestMetadata\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when an authorized client refreshes an access token.\n   *\n   * @throws {OAuthError} to cancel the token refresh and revoke the session\n   */\n  onTokenRefreshed?: (data: {\n    client: Client\n    clientAuth: ClientAuth\n    clientMetadata: RequestMetadata\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n  }) => Awaitable<void>\n}\n"]}

package/dist/oauth-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-middleware.js","sourceRoot":"","sources":["../src/oauth-middleware.ts"],"names":[],"mappings":";;AAyBA,0CA2BC;AAnDD,4DAAwE;AAGxE,yDAA4D;AAC5D,kGAAwF;AACxF,gFAAuE;AACvE,8GAAoG;AACpG,oFAA2E;AAa3E;;;GAGG;AACH,SAAgB,eAAe,CAI7B,MAAqB,EACrB,EAAE,GAAG,OAAO,KAAkC,EAAE;IAEhD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,sDAAsD;IACtD,OAAO,CAAC,OAAO;QACb,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,aAAa;YACvC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBACrB,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,IAAI,EAAE,GAAG,CAAC,CAAA;gBACnD,OAAO,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACtC,CAAC;YACH,CAAC,CAAC,OAAO,CAAA;IAEb,OAAO,IAAA,yBAAS,EACd,IAAA,kCAAkB,EAAC;QACjB,4BAAgB;QAChB,IAAA,kDAAqB,EAAC,MAAM,EAAE,OAAO,CAAC;QACtC,IAAA,8CAAmB,EAAC,MAAM,EAAE,OAAO,CAAC;QACpC,IAAA,2EAAiC,EAAC,MAAM,EAAE,OAAO,CAAC;QAClD,IAAA,+DAA2B,EAAC,MAAM,EAAE,OAAO,CAAC;KAC7C,CAAC,CACH,CAAA;AACH,CAAC"}
+{"version":3,"file":"oauth-middleware.js","sourceRoot":"","sources":["../src/oauth-middleware.ts"],"names":[],"mappings":";;AAyBA,0CA2BC;AAnDD,4DAAwE;AAGxE,yDAA4D;AAC5D,kGAAwF;AACxF,gFAAuE;AACvE,8GAAoG;AACpG,oFAA2E;AAa3E;;;GAGG;AACH,SAAgB,eAAe,CAI7B,MAAqB,EACrB,EAAE,GAAG,OAAO,KAAkC,EAAE;IAEhD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,sDAAsD;IACtD,OAAO,CAAC,OAAO;QACb,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,aAAa;YACvC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBACrB,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,IAAI,EAAE,GAAG,CAAC,CAAA;gBACnD,OAAO,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACtC,CAAC;YACH,CAAC,CAAC,OAAO,CAAA;IAEb,OAAO,IAAA,yBAAS,EACd,IAAA,kCAAkB,EAAC;QACjB,4BAAgB;QAChB,IAAA,kDAAqB,EAAC,MAAM,EAAE,OAAO,CAAC;QACtC,IAAA,8CAAmB,EAAC,MAAM,EAAE,OAAO,CAAC;QACpC,IAAA,2EAAiC,EAAC,MAAM,EAAE,OAAO,CAAC;QAClD,IAAA,+DAA2B,EAAC,MAAM,EAAE,OAAO,CAAC;KAC7C,CAAC,CACH,CAAA;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport { asHandler, combineMiddlewares } from './lib/http/middleware.js'\nimport { Handler } from './lib/http/types.js'\nimport { OAuthProvider } from './oauth-provider.js'\nimport { assetsMiddleware } from './router/assets/assets.js'\nimport { createAccountPageMiddleware } from './router/create-account-page-middleware.js'\nimport { createApiMiddleware } from './router/create-api-middleware.js'\nimport { createAuthorizationPageMiddleware } from './router/create-authorization-page-middleware.js'\nimport { createOAuthMiddleware } from './router/create-oauth-middleware.js'\nimport { ErrorHandler } from './router/error-handler.js'\nimport { MiddlewareOptions } from './router/middleware-options.js'\n\n// Export all the types exposed\nexport type {\n  ErrorHandler,\n  Handler,\n  IncomingMessage,\n  MiddlewareOptions,\n  ServerResponse,\n}\n\n/**\n * @returns An http request handler that can be used with node's http server\n * or as a middleware with express / connect.\n */\nexport function oauthMiddleware<\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { ...options }: MiddlewareOptions<Req, Res> = {},\n): Handler<void, Req, Res> {\n  const { onError } = options\n\n  // options is shallow cloned so it's fine to mutate it\n  options.onError =\n    process.env['NODE_ENV'] === 'development'\n      ? (req, res, err, msg) => {\n          console.error(`OAuthProvider error (${msg}):`, err)\n          return onError?.(req, res, err, msg)\n        }\n      : onError\n\n  return asHandler(\n    combineMiddlewares([\n      assetsMiddleware,\n      createOAuthMiddleware(server, options),\n      createApiMiddleware(server, options),\n      createAuthorizationPageMiddleware(server, options),\n      createAccountPageMiddleware(server, options),\n    ]),\n  )\n}\n"]}

package/dist/oauth-provider.d.ts

@@ -138,104 +138,134 @@ export declare class OAuthProvider extends OAuthVerifier {
     readonly tokenManager: TokenManager;
     constructor({ authenticationMaxAge, tokenMaxAge, accessTokenMode, metadata, lexiconResolver, safeFetch, store, // compound store implementation
     accountStore, deviceStore, lexiconStore, tokenStore, requestStore, clientStore, replayStore, clientJwksCache, clientMetadataCache, loopbackMetadata, ...rest }: OAuthProviderOptions);
-    get jwks(): {
-        readonly keys: readonly ({
-            readonly kty: "RSA";
-            readonly n: string;
-            readonly e: string;
-            readonly alg?: "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | undefined | undefined;
-            readonly kid?: string | undefined | undefined;
-            readonly ext?: boolean | undefined | undefined;
-            readonly use?: "sig" | "enc" | undefined | undefined;
-            readonly key_ops?: readonly ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
-            readonly x5c?: readonly string[] | undefined;
-            readonly x5t?: string | undefined | undefined;
-            readonly 'x5t#S256'?: string | undefined | undefined;
-            readonly x5u?: string | undefined | undefined;
-            readonly d?: string | undefined | undefined;
-            readonly p?: string | undefined | undefined;
-            readonly q?: string | undefined | undefined;
-            readonly dp?: string | undefined | undefined;
-            readonly dq?: string | undefined | undefined;
-            readonly qi?: string | undefined | undefined;
-            readonly oth?: readonly [{
-                readonly d?: string | undefined | undefined;
-                readonly r?: string | undefined | undefined;
-                readonly t?: string | undefined | undefined;
-            }, ...{
-                readonly d?: string | undefined | undefined;
-                readonly r?: string | undefined | undefined;
-                readonly t?: string | undefined | undefined;
-            }[]] | undefined;
-        } | {
-            readonly kty: "EC";
-            readonly crv: "P-256" | "P-384" | "P-521";
-            readonly x: string;
-            readonly y: string;
-            readonly alg?: "ES256" | "ES384" | "ES512" | undefined | undefined;
-            readonly kid?: string | undefined | undefined;
-            readonly ext?: boolean | undefined | undefined;
-            readonly use?: "sig" | "enc" | undefined | undefined;
-            readonly key_ops?: readonly ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
-            readonly x5c?: readonly string[] | undefined;
-            readonly x5t?: string | undefined | undefined;
-            readonly 'x5t#S256'?: string | undefined | undefined;
-            readonly x5u?: string | undefined | undefined;
-            readonly d?: string | undefined | undefined;
-        } | {
-            readonly kty: "EC";
-            readonly crv: "secp256k1";
-            readonly x: string;
-            readonly y: string;
-            readonly alg?: "ES256K" | undefined | undefined;
-            readonly kid?: string | undefined | undefined;
-            readonly ext?: boolean | undefined | undefined;
-            readonly use?: "sig" | "enc" | undefined | undefined;
-            readonly key_ops?: readonly ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
-            readonly x5c?: readonly string[] | undefined;
-            readonly x5t?: string | undefined | undefined;
-            readonly 'x5t#S256'?: string | undefined | undefined;
-            readonly x5u?: string | undefined | undefined;
-            readonly d?: string | undefined | undefined;
-        } | {
-            readonly kty: "OKP";
-            readonly crv: "Ed25519" | "Ed448";
-            readonly x: string;
-            readonly alg?: "EdDSA" | undefined | undefined;
-            readonly kid?: string | undefined | undefined;
-            readonly ext?: boolean | undefined | undefined;
-            readonly use?: "sig" | "enc" | undefined | undefined;
-            readonly key_ops?: readonly ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
-            readonly x5c?: readonly string[] | undefined;
-            readonly x5t?: string | undefined | undefined;
-            readonly 'x5t#S256'?: string | undefined | undefined;
-            readonly x5u?: string | undefined | undefined;
-            readonly d?: string | undefined | undefined;
-        } | {
-            readonly kty: "oct";
-            readonly k: string;
-            readonly alg?: "HS256" | "HS384" | "HS512" | undefined | undefined;
-            readonly kid?: string | undefined | undefined;
-            readonly ext?: boolean | undefined | undefined;
-            readonly use?: "sig" | "enc" | undefined | undefined;
-            readonly key_ops?: readonly ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
-            readonly x5c?: readonly string[] | undefined;
-            readonly x5t?: string | undefined | undefined;
-            readonly 'x5t#S256'?: string | undefined | undefined;
-            readonly x5u?: string | undefined | undefined;
-        } | {
-            readonly kty: string;
-            readonly alg?: string | undefined | undefined;
-            readonly kid?: string | undefined | undefined;
-            readonly ext?: boolean | undefined | undefined;
-            readonly use?: "sig" | "enc" | undefined | undefined;
-            readonly key_ops?: readonly ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
-            readonly x5c?: readonly string[] | undefined;
-            readonly x5t?: string | undefined | undefined;
-            readonly 'x5t#S256'?: string | undefined | undefined;
-            readonly x5u?: string | undefined | undefined;
-        })[];
-    };
+    get jwks(): Readonly<{
+        keys: readonly (Readonly<{
+            kty: "RSA";
+            n: string;
+            e: string;
+            alg?: "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | undefined;
+            kid?: string | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("verify" | "encrypt" | "wrapKey" | "sign" | "decrypt" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            d?: string | undefined;
+            p?: string | undefined;
+            q?: string | undefined;
+            dp?: string | undefined;
+            dq?: string | undefined;
+            qi?: string | undefined;
+            oth?: {
+                d?: string | undefined;
+                r?: string | undefined;
+                t?: string | undefined;
+            }[] | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        } & {
+            d?: never;
+        }> | Readonly<{
+            kty: "EC";
+            crv: "P-256" | "P-384" | "P-521";
+            x: string;
+            y: string;
+            alg?: "ES256" | "ES384" | "ES512" | undefined;
+            kid?: string | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("verify" | "encrypt" | "wrapKey" | "sign" | "decrypt" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            d?: string | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        } & {
+            d?: never;
+        }> | Readonly<{
+            kty: "EC";
+            crv: "secp256k1";
+            x: string;
+            y: string;
+            alg?: "ES256K" | undefined;
+            kid?: string | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("verify" | "encrypt" | "wrapKey" | "sign" | "decrypt" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            d?: string | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        } & {
+            d?: never;
+        }> | Readonly<{
+            kty: "OKP";
+            crv: "Ed25519" | "Ed448";
+            x: string;
+            alg?: "EdDSA" | undefined;
+            kid?: string | undefined;
+            use?: "sig" | "enc" | undefined;
+            key_ops?: ("verify" | "encrypt" | "wrapKey" | "sign" | "decrypt" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            "x5t#S256"?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat? /**
+             * If set to {@link AccessTokenMode.stateless}, the generated access tokens
+             * will contain all the necessary information to validate the token without
+             * needing to query the database. This is useful for cases where the Resource
+             * Server is on a different host/server than the Authorization Server.
+             *
+             * When set to {@link AccessTokenMode.light}, the access tokens will contain
+             * only the necessary information to validate the token, but the token id
+             * will need to be queried from the database to retrieve the full token
+             * information (scope, audience, etc.)
+             *
+             * @see {@link AccessTokenMode}
+             * @default {AccessTokenMode.stateless}
+             */: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            d?: string | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        } & {
+            d?: never;
+        }>)[];
+    }>;
     /**
      * @returns true if the user's consent is required for the requested scopes
      */

package/dist/oauth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAEL,gBAAgB,EAChB,uCAAuC,EACvC,4BAA4B,EAC5B,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,gBAAgB,EAChB,kCAAkC,EAClC,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EAGf,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,aAAa,EAEd,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EACL,aAAa,EACb,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAS3C,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EACL,aAAa,EACb,kBAAkB,EAEnB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EACL,aAAa,EACb,oBAAoB,EAErB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AASrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAGvD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAiB,MAAM,8BAA8B,CAAA;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EACL,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAErE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AAEzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAA;AAC/F,OAAO,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAA;AAClG,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAA;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EACL,UAAU,EAGX,MAAM,wBAAwB,CAAA;AAG/B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,+BAA+B,EAC/B,gCAAgC,IAAI,4BAA4B,EAChE,2BAA2B,EAC3B,QAAQ,EACR,aAAa,EACb,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,gCAAgC,EAChC,yBAAyB,GAC1B,CAAA;AAED,KAAK,mBAAmB,GAAG;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;OAEG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAEnC;;OAEG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,MAAM,CAAA;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CACb,YAAY,GACV,WAAW,GACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,UAAU,CACb,CAAA;IAED,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,UAAU,CAAC,EAAE,UAAU,CAAA;IAEvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAE3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,sBAAsB,CAAA;CACzD,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GACpD,oBAAoB,GACpB,UAAU,GACV,oBAAoB,GACpB,kBAAkB,CAAA;AAEpB,qBAAa,aAAc,SAAQ,aAAa;IAC9C,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACnD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAEpC,SAAgB,QAAQ,EAAE,gCAAgC,CAAA;IAC1D,SAAgB,aAAa,EAAE,aAAa,CAAA;IAE5C,SAAgB,oBAAoB,EAAE,MAAM,CAAA;IAE5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,YAAY,EAAE,YAAY,CAAA;gBAEvB,EAEjB,oBAA6C,EAC7C,WAA2B,EAC3B,eAA2C,EAE3C,QAAQ,EAER,eAAe,EACf,SAA2B,EAC3B,KAAK,EAAE,gCAAgC;IAGvC,YAAoC,EACpC,WAAkC,EAClC,YAAoC,EACpC,UAAgC,EAChC,YAAoC,EAGpC,WAAkC,EAClC,WAAkC,EAElC,eAGE,EACF,mBAGE,EAEF,gBAAgD,EAMhD,GAAG,IAAI,EACR,EAAE,oBAAoB;IAqDvB,IAAI,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAEP;IAED;;OAEG;IACI,oBAAoB,CACzB,UAAU,EAAE,mCAAmC,EAC/C,UAAU,CAAC,EAAE,oBAAoB;IAiB5B,kBAAkB,CAAC,aAAa,EAAE,aAAa;cAKtC,kBAAkB,CAChC,iBAAiB,EAAE,sBAAsB,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,CAAC,EAAE;QACR,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAChC,GACA,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;KACvB,CAAC;cAgDc,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,mCAAmC,CAAC;IA0B/C;;OAEG;IACU,0BAA0B,CACrC,WAAW,EAAE,sBAAsB,EACnC,oBAAoB,EAAE,4BAA4B,EAClD,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,gBAAgB,CAAC;YAgEd,2BAA2B;IAiDzC;;OAEG;IACU,SAAS,CACpB,iBAAiB,EAAE,0BAA0B,EAC7C,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,GAC9B,OAAO,CAAC,2BAA2B,GAAG,gCAAgC,CAAC;cA8G1D,WAAW,CACzB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,mCAAmC,GAC9C,OAAO,CACR;QACE,OAAO,EAAE,OAAO,CAAA;QAEhB,QAAQ,EAAE,OAAO,CAAA;QACjB,aAAa,EAAE,OAAO,CAAA;QACtB,eAAe,EAAE,OAAO,CAAA;QAExB,WAAW,EAAE,OAAO,CAAA;KACrB,EAAE,CACJ;IA4BY,KAAK,CAChB,iBAAiB,EAAE,sBAAsB,EACzC,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;cA2Cd,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,EAAE;QACP,UAAU,EAAE,mCAAmC,CAAA;QAC/C,QAAQ,EAAE,QAAQ,CAAA;QAClB,UAAU,EAAE,IAAI,GAAG,UAAU,GAAG,gBAAgB,CAAA;KACjD,GACA,OAAO,CAAC,IAAI,CAAC;cA+DA,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uCAAuC,EAC9C,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;cA+Dd,iBAAiB,CAC/B,UAAU,EAAE,mCAAmC,EAC/C,KAAK,EAAE,uCAAuC,GAC7C,OAAO,CAAC,IAAI,CAAC;cAmDA,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,kCAAkC,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;cA4Bd,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC;IAoBhB;;OAEG;IACU,MAAM,CACjB,iBAAiB,EAAE,sBAAsB,EACzC,EAAE,KAAK,EAAE,EAAE,wBAAwB,EACnC,SAAS,EAAE,IAAI,GAAG,SAAS;cAuBJ,WAAW,CAClC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;CAmB/B"}
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAEL,gBAAgB,EAChB,uCAAuC,EACvC,4BAA4B,EAC5B,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,gBAAgB,EAChB,kCAAkC,EAClC,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EAGf,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,aAAa,EAEd,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EACL,aAAa,EACb,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAS3C,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EACL,aAAa,EACb,kBAAkB,EAEnB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EACL,aAAa,EACb,oBAAoB,EAErB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AASrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAGvD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAiB,MAAM,8BAA8B,CAAA;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EACL,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAErE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AAEzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAA;AAC/F,OAAO,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAA;AAClG,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAA;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EACL,UAAU,EAGX,MAAM,wBAAwB,CAAA;AAG/B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,+BAA+B,EAC/B,gCAAgC,IAAI,4BAA4B,EAChE,2BAA2B,EAC3B,QAAQ,EACR,aAAa,EACb,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,gCAAgC,EAChC,yBAAyB,GAC1B,CAAA;AAED,KAAK,mBAAmB,GAAG;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;OAEG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAEnC;;OAEG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,MAAM,CAAA;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CACb,YAAY,GACV,WAAW,GACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,UAAU,CACb,CAAA;IAED,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,UAAU,CAAC,EAAE,UAAU,CAAA;IAEvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAE3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,sBAAsB,CAAA;CACzD,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GACpD,oBAAoB,GACpB,UAAU,GACV,oBAAoB,GACpB,kBAAkB,CAAA;AAEpB,qBAAa,aAAc,SAAQ,aAAa;IAC9C,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACnD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAEpC,SAAgB,QAAQ,EAAE,gCAAgC,CAAA;IAC1D,SAAgB,aAAa,EAAE,aAAa,CAAA;IAE5C,SAAgB,oBAAoB,EAAE,MAAM,CAAA;IAE5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,YAAY,EAAE,YAAY,CAAA;gBAEvB,EAEjB,oBAA6C,EAC7C,WAA2B,EAC3B,eAA2C,EAE3C,QAAQ,EAER,eAAe,EACf,SAA2B,EAC3B,KAAK,EAAE,gCAAgC;IAGvC,YAAoC,EACpC,WAAkC,EAClC,YAAoC,EACpC,UAAgC,EAChC,YAAoC,EAGpC,WAAkC,EAClC,WAAkC,EAElC,eAGE,EACF,mBAGE,EAEF,gBAAgD,EAMhD,GAAG,IAAI,EACR,EAAE,oBAAoB;IAqDvB,IAAI,IAAI;;;;;eAhTL,CAAC;eACoD,CAAC;eACjC,CAAC;mBAEL,CAAC;eAIT,CAAC;eAEZ,CAAC;sBACoB,CAAC;eAAqC,CAAC;eAG3D,CAAC;eACgB,CAAC;eACc,CAAC;eACL,CAAC;mBAG/B,CAAF;;sBAEQ,CAAC;;aAC2B,CAAA;aACnC,CAAC;aAAmC,CAAC;cAAoC,CAAC;cACzD,CAAC;cAAoC,CAAC;eAChC,CAAC;iBAAqB,CAAC;iBACnC,CAAC;iBAAuC,CAAC;;;;;aAElC,CAAC;;;;;;eAEuB,CAAC;eACZ,CAAC;eACxB,CAAA;mBAAgD,CAAC;eAGjD,CAAA;eAAuC,CAAC;sBACf,CAAC;eACb,CAAC;eAClB,CAAC;eAAsC,CAAC;eACxC,CAAC;eAAqC,CAAC;mBAI1C,CAAD;;sBAES,CAAC;;aACiC,CAAC;;;;aAEd,CAAA;;;;;;eAEW,CAAC;eACrB,CAAC;eAAqC,CAAC;mBAChD,CAAC;eACgC,CAAC;eAAuC,CAAC;sBAC5C,CAAC;eACpB,CAAC;eAAqC,CAAC;eAChC,CAAC;eACb,CAAC;eACnB,CAAC;mBAGE,CAAC;;sBAEQ,CAAC;;aAEL,CAAA;;;;aAIJ,CAAC;;;;;eAIK,CAAC;eAEG,CAAC;eAED,CAAC;mBAGR,CAAC;eAM4B,CAAC;eAC3B,CAAC;sBAEc,CAAC;eAGD,CAAA;eAAqC,CAAC;eAkB9D,CAdA,CAAA;;;;;;;;;;;;;eAaG;eAZ4B,CAAC;eAAqC,CAAC;mBACpC,CAAA;;sBAChB,CAAC;;aAClB,CAAC;;;;aAEwB,CAAC;;OA2M1B;IAED;;OAEG;IACI,oBAAoB,CACzB,UAAU,EAAE,mCAAmC,EAC/C,UAAU,CAAC,EAAE,oBAAoB;IAiB5B,kBAAkB,CAAC,aAAa,EAAE,aAAa;cAKtC,kBAAkB,CAChC,iBAAiB,EAAE,sBAAsB,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,CAAC,EAAE;QACR,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAChC,GACA,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;KACvB,CAAC;cAgDc,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,mCAAmC,CAAC;IA0B/C;;OAEG;IACU,0BAA0B,CACrC,WAAW,EAAE,sBAAsB,EACnC,oBAAoB,EAAE,4BAA4B,EAClD,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,gBAAgB,CAAC;YAgEd,2BAA2B;IAiDzC;;OAEG;IACU,SAAS,CACpB,iBAAiB,EAAE,0BAA0B,EAC7C,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,GAC9B,OAAO,CAAC,2BAA2B,GAAG,gCAAgC,CAAC;cA8G1D,WAAW,CACzB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,mCAAmC,GAC9C,OAAO,CACR;QACE,OAAO,EAAE,OAAO,CAAA;QAEhB,QAAQ,EAAE,OAAO,CAAA;QACjB,aAAa,EAAE,OAAO,CAAA;QACtB,eAAe,EAAE,OAAO,CAAA;QAExB,WAAW,EAAE,OAAO,CAAA;KACrB,EAAE,CACJ;IA4BY,KAAK,CAChB,iBAAiB,EAAE,sBAAsB,EACzC,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;cA2Cd,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,EAAE;QACP,UAAU,EAAE,mCAAmC,CAAA;QAC/C,QAAQ,EAAE,QAAQ,CAAA;QAClB,UAAU,EAAE,IAAI,GAAG,UAAU,GAAG,gBAAgB,CAAA;KACjD,GACA,OAAO,CAAC,IAAI,CAAC;cA+DA,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uCAAuC,EAC9C,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;cA+Dd,iBAAiB,CAC/B,UAAU,EAAE,mCAAmC,EAC/C,KAAK,EAAE,uCAAuC,GAC7C,OAAO,CAAC,IAAI,CAAC;cAmDA,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,kCAAkC,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;cA4Bd,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC;IAoBhB;;OAEG;IACU,MAAM,CACjB,iBAAiB,EAAE,sBAAsB,EACzC,EAAE,KAAK,EAAE,EAAE,wBAAwB,EACnC,SAAS,EAAE,IAAI,GAAG,SAAS;cAuBJ,WAAW,CAClC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;CAmB/B"}

package/dist/oauth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":";;;AAAA,6CAAwC;AAExC,sCAA2C;AA0GjB,uFA1GX,YAAM,OA0GW;AAvGhC,sDAoB6B;AAC7B,yDAAwD;AAExD,2EAAqE;AACrE,8EAAqE;AA+E5D,gGA/EA,sCAAe,OA+EA;AA9ExB,qEAA6D;AAC7D,iEAKmC;AAGnC,kEAGmC;AACnC,8DAAqE;AAErE,iDAOuB;AAEvB,uEAIyC;AAEzC,kEAImC;AACnC,8DAAqE;AACrE,sGAA4F;AAC5F,4EAAoE;AACpE,kFAAyE;AACzE,kGAAuF;AACvF,sFAA4E;AAC5E,4EAAmE;AACnE,gFAAuE;AACvE,8EAAqE;AACrE,qEAA6D;AAC7D,iEAAyE;AAGzE,gDAA0D;AAC1D,kDAAiD;AAEjD,oEAA4E;AAE5E,2DAK4B;AAC5B,8DAAqE;AACrE,+CAA8C;AAC9C,qEAA6D;AAC7D,iEAAyE;AACzE,6DAA2D;AAO3D,+DAAuD;AACvD,2DAI+B;AAC/B,yEAAkE;AAoIlE,MAAa,aAAc,SAAQ,iCAAa;IAC3B,eAAe,CAAiB;IAChC,KAAK,CAAY;IAEpB,QAAQ,CAAkC;IAC1C,aAAa,CAAe;IAE5B,oBAAoB,CAAQ;IAE5B,cAAc,CAAgB;IAC9B,aAAa,CAAe;IAC5B,aAAa,CAAe;IAC5B,cAAc,CAAgB;IAC9B,cAAc,CAAgB;IAC9B,YAAY,CAAc;IAE1C,YAAmB;IACjB,sBAAsB;IACtB,oBAAoB,GAAG,qCAAsB,EAC7C,WAAW,GAAG,4BAAa,EAC3B,eAAe,GAAG,sCAAe,CAAC,SAAS,EAE3C,QAAQ,EAER,eAAe,EACf,SAAS,GAAG,IAAA,0BAAa,GAAE,EAC3B,KAAK,EAAE,gCAAgC;IAEvC,kBAAkB;IAClB,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC,EACpC,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAClC,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC,EACpC,UAAU,GAAG,IAAA,6BAAY,EAAC,KAAK,CAAC,EAChC,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC;IAEpC,kBAAkB;IAClB,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAClC,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAElC,eAAe,GAAG,IAAI,uCAAiB,CAAC;QACtC,OAAO,EAAE,UAAU;QACnB,GAAG,EAAE,KAAK;KACX,CAAC,EACF,mBAAmB,GAAG,IAAI,uCAAiB,CAAC;QAC1C,OAAO,EAAE,UAAU;QACnB,GAAG,EAAE,KAAK;KACX,CAAC,EAEF,gBAAgB,GAAG,2CAA6B;IAEhD,eAAe;IACf,yBAAyB;IACzB,yBAAyB;IACzB,gBAAgB;IAChB,GAAG,IAAI,EACc;QACrB,MAAM,oBAAoB,GACxB,8CAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAExC,KAAK,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;QAE/B,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,qEAAqE;QACrE,sCAAsC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QAEjB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAA;QACtC,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAA;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAA,iCAAa,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACjE,IAAI,CAAC,aAAa,GAAG,sCAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAEpD,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAA;QACzE,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CACtC,IAAI,CAAC,MAAM,EACX,YAAY,EACZ,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,CACnB,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CACpC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,KAAK,EACV,WAAW,IAAI,IAAI,EACnB,gBAAgB,IAAI,IAAI,EACxB,SAAS,EACT,eAAe,EACf,mBAAmB,CACpB,CAAA;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;QACvE,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CACtC,YAAY,EACZ,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACX,CAAA;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,+BAAY,CAClC,UAAU,EACV,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,eAAe,EACpB,WAAW,CACZ,CAAA;IACH,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAA;IAC/B,CAAC;IAED;;OAEG;IACI,oBAAoB,CACzB,UAA+C,EAC/C,UAAiC;QAEjC,qCAAqC;QACrC,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QAE5B,sCAAsC;QACtC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAEhD,uEAAuE;QACvE,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;QACpD,IAAI,eAAe,IAAI,IAAI;YAAE,OAAO,KAAK,CAAA;QAEzC,0EAA0E;QAC1E,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAA;QACvC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5E,CAAC;IAEM,kBAAkB,CAAC,aAA4B;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QAC9D,OAAO,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAA;IAC5C,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,iBAAyC,EACzC,SAA2B,EAC3B,OAEC;QAKD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAC/C,iBAAiB,CAAC,SAAS,CAC5B,CAAA;QAED,IACE,MAAM,CAAC,QAAQ,CAAC,wBAAwB;YACxC,CAAC,SAAS;YACV,CAAC,OAAO,EAAE,qBAAqB,EAC/B,CAAC;YACD,MAAM,IAAI,mDAAqB,CAAC,qBAAqB,CAAC,CAAA;QACxD,CAAC;QAED,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;YAC3D,MAAM,IAAI,mDAAqB,CAAC,wCAAwC,CAAC,CAAA;QAC3E,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,iBAAiB,EAAE;YAC9D,6BAA6B,EAAE,IAAI,CAAC,MAAM;SAC3C,CAAC,CAAA;QAEF,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAC5C,sEAAsE;YACtE,IAAI,SAAS,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;gBAClD,MAAM,IAAI,8CAAmB,CAC3B,8EAA8E,CAC/E,CAAA;YACH,CAAC;YAED,wDAAwD;YACxD,oEAAoE;YACpE,qEAAqE;YACrE,yEAAyE;YACzE,yCAAyC;YAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAChD,UAAU,CAAC,GAAG,EACd,MAAM,CAAC,EAAE,EACT,UAAU,CAAC,GAAG,CACf,CAAA;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0CAAiB,CAAC,GAAG,UAAU,CAAC,MAAM,aAAa,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/B,CAAC;IAES,KAAK,CAAC,SAAS,CACvB,MAAc,EACd,KAAmC;QAEnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAClD,KAAK,CAAC,OAAO,EACb,IAAI,CAAC,MAAM,CACZ,CAAA;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,8CAAmB,CAC3B,mDAAmD,CACpD,CAAA;QACH,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,8CAAmB,CAAC,6BAA6B,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,uDAAyC;aAC/D,UAAU,CAAC,OAAO,CAAC;aACnB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,GAAG,GAAG,IAAA,sBAAW,EAAC,GAAG,EAAE,2BAA2B,CAAC,CAAA;YACzD,MAAM,IAAI,8CAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC,CAAC,CAAA;QAEJ,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,0BAA0B,CACrC,WAAmC,EACnC,oBAAkD,EAClD,SAA2B;QAE3B,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,WAAW,EACX,SAAS;YACT,kEAAkE;YAClE,mEAAmE;YACnE,iBAAiB;YACjB,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAChC,CAAA;YAED,MAAM,UAAU,GACd,SAAS,IAAI,oBAAoB,CAAC,aAAa;gBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,oBAAoB,CAAC;gBACpD,CAAC,CAAC,oBAAoB,CAAA;YAE1B,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACzB,IAAI,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;oBAC7C,IAAI,SAAS;wBAAE,UAAU,CAAC,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAA;yBAC7C,CAAC;wBACJ,oEAAoE;wBACpE,iEAAiE;wBACjE,sBAAsB;wBACtB,6DAA6D;oBAC/D,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;oBAC9C,MAAM,IAAI,8CAAmB,CAC3B,0DAA0D,CAC3D,CAAA;gBACH,CAAC;gBAED,wEAAwE;gBACxE,oCAAoC;gBACpC,IAAI,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;oBACvD,MAAM,IAAI,8DAA0B,EAAE,CAAA;gBACxC,CAAC;YACH,CAAC;YAED,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAC7B,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAClD,MAAM,EACN,UAAU,EACV,UAAU,EACV,IAAI,CACL,CAAA;YAEH,OAAO;gBACL,WAAW,EAAE,UAAU;gBACvB,UAAU,EAAE,IAAA,+BAAqB,EAAC,SAAS,CAAC;aAC7C,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,0EAA0E;YAC1E,oEAAoE;YACpE,8DAA8D;YAC9D,IAAI,GAAG,YAAY,2CAAkB,IAAI,CAAC,IAAA,0CAAkB,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,8CAAmB,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;YAC3D,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,MAAc,EACd,QAAkB,EAClB,KAAqC;QAErC,MAAM;QACN,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,iCAAgB;iBACtC,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;iBACjE,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,MAAM,GAAG,GAAG,IAAA,sBAAW,EAAC,GAAG,EAAE,uCAAuC,CAAC,CAAA;gBACrE,MAAM,IAAI,8CAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACzC,CAAC,CAAC,CAAA;YAEJ,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACjE,CAAC;QAED,MAAM;QACN,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;YACvB,0EAA0E;YAC1E,mEAAmE;YACnE,gEAAgE;YAChE,+DAA+D;YAC/D,kDAAkD;YAClD,qCAAqC;YACrC,4CAA4C;YAC5C,wEAAwE;YACxE,kEAAkE;YAClE,qEAAqE;YACrE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAEtD,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CACnD,MAAM,EACN,IAAI,EACJ,UAAU,EACV,QAAQ,CACT,CAAA;QACH,CAAC;QAED,4EAA4E;QAC5E,qEAAqE;QACrE,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CACnD,MAAM,EACN,IAAI,EACJ,KAAK,EACL,QAAQ,CACT,CAAA;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,SAAS,CACpB,iBAA6C,EAC7C,KAAqC,EACrC,QAAkB,EAClB,cAA+B;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;QAEvB,oEAAoE;QACpE,qDAAqD;QACrD,MAAM,uBAAuB,GAC3B,cAAc,IAAI,KAAK;YACrB,CAAC,CAAC,CAAC,GAAY,EAAS,EAAE;gBACtB,iFAAiF;gBACjF,MAAM,2CAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC3C,CAAC;YACH,CAAC,CAAC,IAAI,CAAA;QAEV,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa;aACpC,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC;aACtC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAEjC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,CACvE,MAAM,EACN,QAAQ,EACR,KAAK,CACN,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAEhC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;YAExE,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;gBACzD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,mEAA6B,CAAC,UAAU,CAAC,CAAA;gBACrD,CAAC;gBACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,4CAAkB,CAAC,UAAU,CAAC,CAAA;gBAC1C,CAAC;gBAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;gBAClC,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;oBAC7B,MAAM,IAAI,4CAAkB,CAAC,UAAU,CAAC,CAAA;gBAC1C,CAAC;gBACD,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;oBAC/B,MAAM,IAAI,gDAAoB,CAAC,UAAU,CAAC,CAAA;gBAC5C,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAClD,UAAU,EACV,MAAM,EACN,UAAU,CAAC,OAAO,EAClB,QAAQ,EACR,cAAc,CACf,CAAA;gBAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAA;YACnD,CAAC;YAED,wCAAwC;YACxC,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAC/D,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;gBACzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;oBAClC,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;wBAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAClD,UAAU,EACV,MAAM,EACN,UAAU,CAAC,OAAO,EAClB,QAAQ,EACR,cAAc,CACf,CAAA;wBAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAA;oBACnD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,MAAM;gBACN,MAAM;gBACN,UAAU;gBACV,UAAU;gBACV,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACnC,uEAAuE;oBACvE,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;oBACpC,eAAe,EAAE,OAAO,CAAC,eAAe;iBACzC,CAAC,CAAC;gBACH,cAAc,EAAE,MAAM,IAAI,CAAC,cAAc;qBACtC,0BAA0B,CAAC,UAAU,CAAC,KAAK,CAAC;qBAC5C,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACf,MAAM,IAAI,2CAAkB,CAC1B,UAAU,EACV,oCAAoC,EACpC,eAAe,EACf,KAAK,CACN,CAAA;gBACH,CAAC,CAAC;aACL,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,EAAE;gBACF,+DAA+D;gBAC/D,+BAA+B;YACjC,CAAC;YAED,MAAM,2CAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,WAAW,CACzB,QAAkB,EAClB,QAAkB,EAClB,UAA+C;QAY/C,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAExD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAA;QAClC,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAW,EAAE,CAChD,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;YACvC,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAA;QAEvE,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAC5C,OAAO,EAAE,aAAa,CAAC,OAAO;YAE9B,QAAQ,EACN,UAAU,CAAC,MAAM,KAAK,gBAAgB;gBACtC,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC;YACpC,mEAAmE;YACnE,iEAAiE;YACjE,aAAa,EACX,UAAU,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC;YACzE,eAAe,EAAE,IAAI,CAAC,oBAAoB,CACxC,UAAU,EACV,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC9C;YAED,WAAW,EAAE,IAAI,IAAI,IAAI,IAAI,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC;SAChE,CAAC,CAAC,CAAA;IACL,CAAC;IAEM,KAAK,CAAC,KAAK,CAChB,iBAAyC,EACzC,cAA+B,EAC/B,OAA0B,EAC1B,SAA2B;QAE3B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,iBAAiB,EACjB,SAAS,CACV,CAAA;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,0CAAiB,CACzB,eAAe,OAAO,CAAC,UAAU,kCAAkC,CACpE,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,0CAAiB,CACzB,IAAI,OAAO,CAAC,UAAU,6CAA6C,CACpE,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,sBAAsB,CAChC,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,SAAS,CACV,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,iBAAiB,CAC3B,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,SAAS,CACV,CAAA;QACH,CAAC;QAED,MAAM,IAAI,0CAAiB,CACzB,eAAe,OAAO,CAAC,UAAU,iBAAiB,CACnD,CAAA;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,MAAc,EACd,UAAsB,EACtB,SAA2B,EAC3B,OAIC;QAED,iFAAiF;QACjF,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,0BAA0B,EAAE,CAAC;YACrE,MAAM,IAAI,0CAAiB,CACzB,mDAAmD,MAAM,CAAC,QAAQ,CAAC,0BAA0B,SAAS,UAAU,CAAC,MAAM,GAAG,CAC3H,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,0CAAiB,CAAC,qCAAqC,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;QAC9B,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,0CAAiB,CAAC,yCAAyC,CAAC,CAAA;YACxE,CAAC;iBAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;gBACjD,MAAM,IAAI,0CAAiB,CACzB,4CAA4C,CAC7C,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,2EAA2E;YAC3E,yEAAyE;YACzE,4EAA4E;YAC5E,8DAA8D;YAC9D,wEAAwE;YACxE,eAAe;YACf,OAAM;QACR,CAAC;QAED,QAAQ,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAClC,KAAK,8CAAgC,CAAC,CAAC,SAAS;YAChD,KAAK,iBAAiB;gBACpB,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;oBAC5C,MAAM,IAAI,0CAAiB,CACzB,mDAAmD,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAChF,CAAA;gBACH,CAAC;gBACD,IACE,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG;oBACzC,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG;oBACzC,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG,EACzC,CAAC;oBACD,MAAM,IAAI,0CAAiB,CACzB,yFAAyF,CAC1F,CAAA;gBACH,CAAC;gBACD,MAAK;YACP,KAAK,MAAM;gBACT,qEAAqE;gBACrE,mEAAmE;gBACnE,MAAK;YACP;gBACE,MAAM,IAAI,0CAAiB;gBACzB,2DAA2D;gBAC3D,mBAAmB,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAChD,CAAA;QACL,CAAC;IACH,CAAC;IAES,KAAK,CAAC,sBAAsB,CACpC,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,KAA8C,EAC9C,SAA2B;QAE3B,MAAM,IAAI,GAAG,MAAM,oBAAU;aAC1B,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aAC1C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,GAAG,GAAG,IAAA,sBAAW,EAAC,GAAG,EAAE,cAAc,CAAC,CAAA;YAC5C,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACvC,CAAC,CAAC,CAAA;QAEJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc;aACnC,WAAW,CAAC,IAAI,CAAC;aACjB,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,uDAAuD;YACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;YAC1D,IAAI,SAAS,EAAE,CAAC;gBACd,wEAAwE;gBACxE,IAAI,CAAC;oBACH,+CAA+C;oBAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;gBACnD,CAAC;wBAAS,CAAC;oBACT,kEAAkE;oBAClE,kEAAkE;oBAClE,gCAAgC;oBAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,IAAI,CAAA;oBACxC,IAAI,QAAQ,EAAE,CAAC;wBACb,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;oBAC9D,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;QAEJ,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,WAAW;QAEX,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;QAEjE,0EAA0E;QAC1E,UAAU;QACV,MAAM,UAAU,GACd,SAAS;YACT,MAAM,CAAC,QAAQ,CAAC,wBAAwB;YACxC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ;YACvB,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE;YACjD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAA;QAErB,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAE/C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAElE,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAClC,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,UAAU,EACV,IAAI,CACL,CAAA;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,UAA+C,EAC/C,KAA8C;QAE9C,IAAI,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YACnD,MAAM,IAAI,0CAAiB,CACzB,iFAAiF,CAClF,CAAA;QACH,CAAC;QAED,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,0CAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACpC,MAAM,IAAI,0CAAiB,CAAC,yBAAyB,CAAC,CAAA;YACxD,CAAC;YACD,QAAQ,UAAU,CAAC,qBAAqB,EAAE,CAAC;gBACzC,KAAK,SAAS,CAAC,CAAC,qBAAqB;gBACrC,KAAK,OAAO;oBACV,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;wBACtD,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;oBACtD,CAAC;oBACD,MAAK;gBAEP,KAAK,MAAM,CAAC,CAAC,CAAC;oBACZ,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAChC,UAAU,CAAC,cAAc,EACzB,QAAQ,CACT,CAAA;oBACD,MAAM,iBAAiB,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;yBAC3C,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;yBAC3B,MAAM,EAAE,CAAA;oBACX,IAAI,cAAc,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;wBACpD,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;oBACtD,CAAC;oBACD,MAAK;gBACP,CAAC;gBAED;oBACE,qEAAqE;oBACrE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACxD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CACzD,UAAU,CAAC,cAAc,CAC1B,CAAA;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0CAAiB,CAAC,6BAA6B,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,8CAAmB,CAAC,0CAA0C,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,KAAyC,EACzC,SAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,mCAAkB;aAC1C,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;aAC5D,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,GAAG,GAAG,IAAA,sBAAW,EAAC,GAAG,EAAE,uBAAuB,CAAC,CAAA;YACrD,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACvC,CAAC,CAAC,CAAA;QAEJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;QAE3E,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;YAC1B,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YACjE,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;YAEzD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CACxC,MAAM,EACN,UAAU,EACV,cAAc,EACd,SAAS,CACV,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAEjD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAES,KAAK,CAAC,oBAAoB,CAClC,MAAc,EACd,UAAsB,EACtB,IAAe;QAEf,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY;YACtD,CAAC,CAAC;gBACE,mDAAoC;gBACpC,mDAAoC;aACrC;YACH,CAAC,CAAC,CAAC,6CAA8B,EAAE,6CAA8B,CAAC,CAAA;QAEtE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QACxD,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,IAAI,0CAAiB,CAAC,iBAAiB,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QACxD,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,MAAM,CACjB,iBAAyC,EACzC,EAAE,KAAK,EAA4B,EACnC,SAA2B;QAE3B,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,iBAAiB,EACjB,SAAS,CACV,CAAA;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,uEAAuE;YACvE,mCAAmC;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;YAC1B,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YAEjE,0EAA0E;YAC1E,uEAAuE;YACvE,gCAAgC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,WAAW,CAClC,SAAyB,EACzB,KAAuB,EACvB,SAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;QAEzE,IAAI,IAAI,CAAC,eAAe,KAAK,sCAAe,CAAC,SAAS,EAAE,CAAC;YACvD,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,WAAW;YAEX,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CACzD,SAAS,EACT,YAAY,CACb,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QAC1C,CAAC;QAED,OAAO,YAAY,CAAA;IACrB,CAAC;CACF;AA11BD,sCA01BC"}
+{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":";;;AAAA,6CAAwC;AAExC,sCAA2C;AA0GjB,uFA1GX,YAAM,OA0GW;AAvGhC,sDAoB6B;AAC7B,yDAAwD;AAExD,2EAAqE;AACrE,8EAAqE;AA+E5D,gGA/EA,sCAAe,OA+EA;AA9ExB,qEAA6D;AAC7D,iEAKmC;AAGnC,kEAGmC;AACnC,8DAAqE;AAErE,iDAOuB;AAEvB,uEAIyC;AAEzC,kEAImC;AACnC,8DAAqE;AACrE,sGAA4F;AAC5F,4EAAoE;AACpE,kFAAyE;AACzE,kGAAuF;AACvF,sFAA4E;AAC5E,4EAAmE;AACnE,gFAAuE;AACvE,8EAAqE;AACrE,qEAA6D;AAC7D,iEAAyE;AAGzE,gDAA0D;AAC1D,kDAAiD;AAEjD,oEAA4E;AAE5E,2DAK4B;AAC5B,8DAAqE;AACrE,+CAA8C;AAC9C,qEAA6D;AAC7D,iEAAyE;AACzE,6DAA2D;AAO3D,+DAAuD;AACvD,2DAI+B;AAC/B,yEAAkE;AAoIlE,MAAa,aAAc,SAAQ,iCAAa;IAC3B,eAAe,CAAiB;IAChC,KAAK,CAAY;IAEpB,QAAQ,CAAkC;IAC1C,aAAa,CAAe;IAE5B,oBAAoB,CAAQ;IAE5B,cAAc,CAAgB;IAC9B,aAAa,CAAe;IAC5B,aAAa,CAAe;IAC5B,cAAc,CAAgB;IAC9B,cAAc,CAAgB;IAC9B,YAAY,CAAc;IAE1C,YAAmB;IACjB,sBAAsB;IACtB,oBAAoB,GAAG,qCAAsB,EAC7C,WAAW,GAAG,4BAAa,EAC3B,eAAe,GAAG,sCAAe,CAAC,SAAS,EAE3C,QAAQ,EAER,eAAe,EACf,SAAS,GAAG,IAAA,0BAAa,GAAE,EAC3B,KAAK,EAAE,gCAAgC;IAEvC,kBAAkB;IAClB,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC,EACpC,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAClC,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC,EACpC,UAAU,GAAG,IAAA,6BAAY,EAAC,KAAK,CAAC,EAChC,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC;IAEpC,kBAAkB;IAClB,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAClC,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAElC,eAAe,GAAG,IAAI,uCAAiB,CAAC;QACtC,OAAO,EAAE,UAAU;QACnB,GAAG,EAAE,KAAK;KACX,CAAC,EACF,mBAAmB,GAAG,IAAI,uCAAiB,CAAC;QAC1C,OAAO,EAAE,UAAU;QACnB,GAAG,EAAE,KAAK;KACX,CAAC,EAEF,gBAAgB,GAAG,2CAA6B;IAEhD,eAAe;IACf,yBAAyB;IACzB,yBAAyB;IACzB,gBAAgB;IAChB,GAAG,IAAI,EACc;QACrB,MAAM,oBAAoB,GACxB,8CAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAExC,KAAK,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;QAE/B,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,qEAAqE;QACrE,sCAAsC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QAEjB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAA;QACtC,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAA;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAA,iCAAa,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACjE,IAAI,CAAC,aAAa,GAAG,sCAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAEpD,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAA;QACzE,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CACtC,IAAI,CAAC,MAAM,EACX,YAAY,EACZ,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,CACnB,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CACpC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,KAAK,EACV,WAAW,IAAI,IAAI,EACnB,gBAAgB,IAAI,IAAI,EACxB,SAAS,EACT,eAAe,EACf,mBAAmB,CACpB,CAAA;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;QACvE,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CACtC,YAAY,EACZ,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACX,CAAA;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,+BAAY,CAClC,UAAU,EACV,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,eAAe,EACpB,WAAW,CACZ,CAAA;IACH,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAA;IAC/B,CAAC;IAED;;OAEG;IACI,oBAAoB,CACzB,UAA+C,EAC/C,UAAiC;QAEjC,qCAAqC;QACrC,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QAE5B,sCAAsC;QACtC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAEhD,uEAAuE;QACvE,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;QACpD,IAAI,eAAe,IAAI,IAAI;YAAE,OAAO,KAAK,CAAA;QAEzC,0EAA0E;QAC1E,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAA;QACvC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5E,CAAC;IAEM,kBAAkB,CAAC,aAA4B;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QAC9D,OAAO,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAA;IAC5C,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,iBAAyC,EACzC,SAA2B,EAC3B,OAEC;QAKD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAC/C,iBAAiB,CAAC,SAAS,CAC5B,CAAA;QAED,IACE,MAAM,CAAC,QAAQ,CAAC,wBAAwB;YACxC,CAAC,SAAS;YACV,CAAC,OAAO,EAAE,qBAAqB,EAC/B,CAAC;YACD,MAAM,IAAI,mDAAqB,CAAC,qBAAqB,CAAC,CAAA;QACxD,CAAC;QAED,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;YAC3D,MAAM,IAAI,mDAAqB,CAAC,wCAAwC,CAAC,CAAA;QAC3E,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,iBAAiB,EAAE;YAC9D,6BAA6B,EAAE,IAAI,CAAC,MAAM;SAC3C,CAAC,CAAA;QAEF,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAC5C,sEAAsE;YACtE,IAAI,SAAS,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;gBAClD,MAAM,IAAI,8CAAmB,CAC3B,8EAA8E,CAC/E,CAAA;YACH,CAAC;YAED,wDAAwD;YACxD,oEAAoE;YACpE,qEAAqE;YACrE,yEAAyE;YACzE,yCAAyC;YAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAChD,UAAU,CAAC,GAAG,EACd,MAAM,CAAC,EAAE,EACT,UAAU,CAAC,GAAG,CACf,CAAA;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0CAAiB,CAAC,GAAG,UAAU,CAAC,MAAM,aAAa,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/B,CAAC;IAES,KAAK,CAAC,SAAS,CACvB,MAAc,EACd,KAAmC;QAEnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAClD,KAAK,CAAC,OAAO,EACb,IAAI,CAAC,MAAM,CACZ,CAAA;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,8CAAmB,CAC3B,mDAAmD,CACpD,CAAA;QACH,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,8CAAmB,CAAC,6BAA6B,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,uDAAyC;aAC/D,UAAU,CAAC,OAAO,CAAC;aACnB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,GAAG,GAAG,IAAA,sBAAW,EAAC,GAAG,EAAE,2BAA2B,CAAC,CAAA;YACzD,MAAM,IAAI,8CAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC,CAAC,CAAA;QAEJ,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,0BAA0B,CACrC,WAAmC,EACnC,oBAAkD,EAClD,SAA2B;QAE3B,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,WAAW,EACX,SAAS;YACT,kEAAkE;YAClE,mEAAmE;YACnE,iBAAiB;YACjB,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAChC,CAAA;YAED,MAAM,UAAU,GACd,SAAS,IAAI,oBAAoB,CAAC,aAAa;gBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,oBAAoB,CAAC;gBACpD,CAAC,CAAC,oBAAoB,CAAA;YAE1B,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACzB,IAAI,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;oBAC7C,IAAI,SAAS;wBAAE,UAAU,CAAC,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAA;yBAC7C,CAAC;wBACJ,oEAAoE;wBACpE,iEAAiE;wBACjE,sBAAsB;wBACtB,6DAA6D;oBAC/D,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;oBAC9C,MAAM,IAAI,8CAAmB,CAC3B,0DAA0D,CAC3D,CAAA;gBACH,CAAC;gBAED,wEAAwE;gBACxE,oCAAoC;gBACpC,IAAI,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;oBACvD,MAAM,IAAI,8DAA0B,EAAE,CAAA;gBACxC,CAAC;YACH,CAAC;YAED,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAC7B,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAClD,MAAM,EACN,UAAU,EACV,UAAU,EACV,IAAI,CACL,CAAA;YAEH,OAAO;gBACL,WAAW,EAAE,UAAU;gBACvB,UAAU,EAAE,IAAA,+BAAqB,EAAC,SAAS,CAAC;aAC7C,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,0EAA0E;YAC1E,oEAAoE;YACpE,8DAA8D;YAC9D,IAAI,GAAG,YAAY,2CAAkB,IAAI,CAAC,IAAA,0CAAkB,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,8CAAmB,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;YAC3D,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,MAAc,EACd,QAAkB,EAClB,KAAqC;QAErC,MAAM;QACN,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,iCAAgB;iBACtC,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;iBACjE,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,MAAM,GAAG,GAAG,IAAA,sBAAW,EAAC,GAAG,EAAE,uCAAuC,CAAC,CAAA;gBACrE,MAAM,IAAI,8CAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACzC,CAAC,CAAC,CAAA;YAEJ,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACjE,CAAC;QAED,MAAM;QACN,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;YACvB,0EAA0E;YAC1E,mEAAmE;YACnE,gEAAgE;YAChE,+DAA+D;YAC/D,kDAAkD;YAClD,qCAAqC;YACrC,4CAA4C;YAC5C,wEAAwE;YACxE,kEAAkE;YAClE,qEAAqE;YACrE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAEtD,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CACnD,MAAM,EACN,IAAI,EACJ,UAAU,EACV,QAAQ,CACT,CAAA;QACH,CAAC;QAED,4EAA4E;QAC5E,qEAAqE;QACrE,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CACnD,MAAM,EACN,IAAI,EACJ,KAAK,EACL,QAAQ,CACT,CAAA;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,SAAS,CACpB,iBAA6C,EAC7C,KAAqC,EACrC,QAAkB,EAClB,cAA+B;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;QAEvB,oEAAoE;QACpE,qDAAqD;QACrD,MAAM,uBAAuB,GAC3B,cAAc,IAAI,KAAK;YACrB,CAAC,CAAC,CAAC,GAAY,EAAS,EAAE;gBACtB,iFAAiF;gBACjF,MAAM,2CAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC3C,CAAC;YACH,CAAC,CAAC,IAAI,CAAA;QAEV,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa;aACpC,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC;aACtC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAEjC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,CACvE,MAAM,EACN,QAAQ,EACR,KAAK,CACN,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAEhC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;YAExE,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;gBACzD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,mEAA6B,CAAC,UAAU,CAAC,CAAA;gBACrD,CAAC;gBACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,4CAAkB,CAAC,UAAU,CAAC,CAAA;gBAC1C,CAAC;gBAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;gBAClC,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;oBAC7B,MAAM,IAAI,4CAAkB,CAAC,UAAU,CAAC,CAAA;gBAC1C,CAAC;gBACD,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;oBAC/B,MAAM,IAAI,gDAAoB,CAAC,UAAU,CAAC,CAAA;gBAC5C,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAClD,UAAU,EACV,MAAM,EACN,UAAU,CAAC,OAAO,EAClB,QAAQ,EACR,cAAc,CACf,CAAA;gBAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAA;YACnD,CAAC;YAED,wCAAwC;YACxC,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAC/D,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;gBACzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;oBAClC,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;wBAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAClD,UAAU,EACV,MAAM,EACN,UAAU,CAAC,OAAO,EAClB,QAAQ,EACR,cAAc,CACf,CAAA;wBAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAA;oBACnD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,MAAM;gBACN,MAAM;gBACN,UAAU;gBACV,UAAU;gBACV,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACnC,uEAAuE;oBACvE,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;oBACpC,eAAe,EAAE,OAAO,CAAC,eAAe;iBACzC,CAAC,CAAC;gBACH,cAAc,EAAE,MAAM,IAAI,CAAC,cAAc;qBACtC,0BAA0B,CAAC,UAAU,CAAC,KAAK,CAAC;qBAC5C,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACf,MAAM,IAAI,2CAAkB,CAC1B,UAAU,EACV,oCAAoC,EACpC,eAAe,EACf,KAAK,CACN,CAAA;gBACH,CAAC,CAAC;aACL,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,EAAE;gBACF,+DAA+D;gBAC/D,+BAA+B;YACjC,CAAC;YAED,MAAM,2CAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,WAAW,CACzB,QAAkB,EAClB,QAAkB,EAClB,UAA+C;QAY/C,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAExD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAA;QAClC,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAW,EAAE,CAChD,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;YACvC,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAA;QAEvE,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAC5C,OAAO,EAAE,aAAa,CAAC,OAAO;YAE9B,QAAQ,EACN,UAAU,CAAC,MAAM,KAAK,gBAAgB;gBACtC,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC;YACpC,mEAAmE;YACnE,iEAAiE;YACjE,aAAa,EACX,UAAU,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC;YACzE,eAAe,EAAE,IAAI,CAAC,oBAAoB,CACxC,UAAU,EACV,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC9C;YAED,WAAW,EAAE,IAAI,IAAI,IAAI,IAAI,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC;SAChE,CAAC,CAAC,CAAA;IACL,CAAC;IAEM,KAAK,CAAC,KAAK,CAChB,iBAAyC,EACzC,cAA+B,EAC/B,OAA0B,EAC1B,SAA2B;QAE3B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,iBAAiB,EACjB,SAAS,CACV,CAAA;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,0CAAiB,CACzB,eAAe,OAAO,CAAC,UAAU,kCAAkC,CACpE,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,0CAAiB,CACzB,IAAI,OAAO,CAAC,UAAU,6CAA6C,CACpE,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,sBAAsB,CAChC,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,SAAS,CACV,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,iBAAiB,CAC3B,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,SAAS,CACV,CAAA;QACH,CAAC;QAED,MAAM,IAAI,0CAAiB,CACzB,eAAe,OAAO,CAAC,UAAU,iBAAiB,CACnD,CAAA;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,MAAc,EACd,UAAsB,EACtB,SAA2B,EAC3B,OAIC;QAED,iFAAiF;QACjF,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,0BAA0B,EAAE,CAAC;YACrE,MAAM,IAAI,0CAAiB,CACzB,mDAAmD,MAAM,CAAC,QAAQ,CAAC,0BAA0B,SAAS,UAAU,CAAC,MAAM,GAAG,CAC3H,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,0CAAiB,CAAC,qCAAqC,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;QAC9B,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,0CAAiB,CAAC,yCAAyC,CAAC,CAAA;YACxE,CAAC;iBAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;gBACjD,MAAM,IAAI,0CAAiB,CACzB,4CAA4C,CAC7C,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,2EAA2E;YAC3E,yEAAyE;YACzE,4EAA4E;YAC5E,8DAA8D;YAC9D,wEAAwE;YACxE,eAAe;YACf,OAAM;QACR,CAAC;QAED,QAAQ,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAClC,KAAK,8CAAgC,CAAC,CAAC,SAAS;YAChD,KAAK,iBAAiB;gBACpB,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;oBAC5C,MAAM,IAAI,0CAAiB,CACzB,mDAAmD,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAChF,CAAA;gBACH,CAAC;gBACD,IACE,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG;oBACzC,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG;oBACzC,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG,EACzC,CAAC;oBACD,MAAM,IAAI,0CAAiB,CACzB,yFAAyF,CAC1F,CAAA;gBACH,CAAC;gBACD,MAAK;YACP,KAAK,MAAM;gBACT,qEAAqE;gBACrE,mEAAmE;gBACnE,MAAK;YACP;gBACE,MAAM,IAAI,0CAAiB;gBACzB,2DAA2D;gBAC3D,mBAAmB,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAChD,CAAA;QACL,CAAC;IACH,CAAC;IAES,KAAK,CAAC,sBAAsB,CACpC,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,KAA8C,EAC9C,SAA2B;QAE3B,MAAM,IAAI,GAAG,MAAM,oBAAU;aAC1B,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aAC1C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,GAAG,GAAG,IAAA,sBAAW,EAAC,GAAG,EAAE,cAAc,CAAC,CAAA;YAC5C,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACvC,CAAC,CAAC,CAAA;QAEJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc;aACnC,WAAW,CAAC,IAAI,CAAC;aACjB,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,uDAAuD;YACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;YAC1D,IAAI,SAAS,EAAE,CAAC;gBACd,wEAAwE;gBACxE,IAAI,CAAC;oBACH,+CAA+C;oBAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;gBACnD,CAAC;wBAAS,CAAC;oBACT,kEAAkE;oBAClE,kEAAkE;oBAClE,gCAAgC;oBAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,IAAI,CAAA;oBACxC,IAAI,QAAQ,EAAE,CAAC;wBACb,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;oBAC9D,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;QAEJ,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,WAAW;QAEX,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;QAEjE,0EAA0E;QAC1E,UAAU;QACV,MAAM,UAAU,GACd,SAAS;YACT,MAAM,CAAC,QAAQ,CAAC,wBAAwB;YACxC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ;YACvB,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE;YACjD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAA;QAErB,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAE/C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAElE,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAClC,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,UAAU,EACV,IAAI,CACL,CAAA;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,UAA+C,EAC/C,KAA8C;QAE9C,IAAI,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YACnD,MAAM,IAAI,0CAAiB,CACzB,iFAAiF,CAClF,CAAA;QACH,CAAC;QAED,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,0CAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACpC,MAAM,IAAI,0CAAiB,CAAC,yBAAyB,CAAC,CAAA;YACxD,CAAC;YACD,QAAQ,UAAU,CAAC,qBAAqB,EAAE,CAAC;gBACzC,KAAK,SAAS,CAAC,CAAC,qBAAqB;gBACrC,KAAK,OAAO;oBACV,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;wBACtD,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;oBACtD,CAAC;oBACD,MAAK;gBAEP,KAAK,MAAM,CAAC,CAAC,CAAC;oBACZ,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAChC,UAAU,CAAC,cAAc,EACzB,QAAQ,CACT,CAAA;oBACD,MAAM,iBAAiB,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;yBAC3C,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;yBAC3B,MAAM,EAAE,CAAA;oBACX,IAAI,cAAc,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;wBACpD,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;oBACtD,CAAC;oBACD,MAAK;gBACP,CAAC;gBAED;oBACE,qEAAqE;oBACrE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACxD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CACzD,UAAU,CAAC,cAAc,CAC1B,CAAA;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0CAAiB,CAAC,6BAA6B,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,8CAAmB,CAAC,0CAA0C,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,KAAyC,EACzC,SAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,mCAAkB;aAC1C,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;aAC5D,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,GAAG,GAAG,IAAA,sBAAW,EAAC,GAAG,EAAE,uBAAuB,CAAC,CAAA;YACrD,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACvC,CAAC,CAAC,CAAA;QAEJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;QAE3E,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;YAC1B,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YACjE,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;YAEzD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CACxC,MAAM,EACN,UAAU,EACV,cAAc,EACd,SAAS,CACV,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAEjD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAES,KAAK,CAAC,oBAAoB,CAClC,MAAc,EACd,UAAsB,EACtB,IAAe;QAEf,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY;YACtD,CAAC,CAAC;gBACE,mDAAoC;gBACpC,mDAAoC;aACrC;YACH,CAAC,CAAC,CAAC,6CAA8B,EAAE,6CAA8B,CAAC,CAAA;QAEtE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QACxD,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,IAAI,0CAAiB,CAAC,iBAAiB,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QACxD,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,MAAM,CACjB,iBAAyC,EACzC,EAAE,KAAK,EAA4B,EACnC,SAA2B;QAE3B,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,iBAAiB,EACjB,SAAS,CACV,CAAA;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,uEAAuE;YACvE,mCAAmC;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;YAC1B,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YAEjE,0EAA0E;YAC1E,uEAAuE;YACvE,gCAAgC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,WAAW,CAClC,SAAyB,EACzB,KAAuB,EACvB,SAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;QAEzE,IAAI,IAAI,CAAC,eAAe,KAAK,sCAAe,CAAC,SAAS,EAAE,CAAC;YACvD,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,WAAW;YAEX,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CACzD,SAAS,EACT,YAAY,CACb,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QAC1C,CAAC;QAED,OAAO,YAAY,CAAA;IACrB,CAAC;CACF;AA11BD,sCA01BC","sourcesContent":["import { createHash } from 'node:crypto'\nimport type { Redis, RedisOptions } from 'ioredis'\nimport { Jwks, Keyset } from '@atproto/jwk'\nimport { LexiconResolver } from '@atproto/lexicon-resolver'\nimport type { Account } from '@atproto/oauth-provider-api'\nimport {\n  CLIENT_ASSERTION_TYPE_JWT_BEARER,\n  OAuthAccessToken,\n  OAuthAuthorizationCodeGrantTokenRequest,\n  OAuthAuthorizationRequestJar,\n  OAuthAuthorizationRequestPar,\n  OAuthAuthorizationRequestParameters,\n  OAuthAuthorizationRequestQuery,\n  OAuthAuthorizationServerMetadata,\n  OAuthClientCredentials,\n  OAuthClientCredentialsNone,\n  OAuthClientMetadata,\n  OAuthParResponse,\n  OAuthRefreshTokenGrantTokenRequest,\n  OAuthTokenIdentification,\n  OAuthTokenRequest,\n  OAuthTokenResponse,\n  OAuthTokenType,\n  atprotoLoopbackClientMetadata,\n  oauthAuthorizationRequestParametersSchema,\n} from '@atproto/oauth-types'\nimport { safeFetchWrap } from '@atproto-labs/fetch-node'\nimport { SimpleStore } from '@atproto-labs/simple-store'\nimport { SimpleStoreMemory } from '@atproto-labs/simple-store-memory'\nimport { AccessTokenMode } from './access-token/access-token-mode.js'\nimport { AccountManager } from './account/account-manager.js'\nimport {\n  AccountStore,\n  AuthorizedClientData,\n  DeviceAccount,\n  asAccountStore,\n} from './account/account-store.js'\nimport { ClientAuth, ClientAuthLegacy } from './client/client-auth.js'\nimport { ClientId } from './client/client-id.js'\nimport {\n  ClientManager,\n  LoopbackMetadataGetter,\n} from './client/client-manager.js'\nimport { ClientStore, ifClientStore } from './client/client-store.js'\nimport { Client } from './client/client.js'\nimport {\n  AUTHENTICATION_MAX_AGE,\n  CONFIDENTIAL_CLIENT_REFRESH_LIFETIME,\n  CONFIDENTIAL_CLIENT_SESSION_LIFETIME,\n  PUBLIC_CLIENT_REFRESH_LIFETIME,\n  PUBLIC_CLIENT_SESSION_LIFETIME,\n  TOKEN_MAX_AGE,\n} from './constants.js'\nimport { Branding, BrandingInput } from './customization/branding.js'\nimport {\n  Customization,\n  CustomizationInput,\n  customizationSchema,\n} from './customization/customization.js'\nimport { DeviceId } from './device/device-id.js'\nimport {\n  DeviceManager,\n  DeviceManagerOptions,\n  deviceManagerOptionsSchema,\n} from './device/device-manager.js'\nimport { DeviceStore, asDeviceStore } from './device/device-store.js'\nimport { AccountSelectionRequiredError } from './errors/account-selection-required-error.js'\nimport { AuthorizationError } from './errors/authorization-error.js'\nimport { ConsentRequiredError } from './errors/consent-required-error.js'\nimport { InvalidDpopKeyBindingError } from './errors/invalid-dpop-key-binding-error.js'\nimport { InvalidDpopProofError } from './errors/invalid-dpop-proof-error.js'\nimport { InvalidGrantError } from './errors/invalid-grant-error.js'\nimport { InvalidRequestError } from './errors/invalid-request-error.js'\nimport { LoginRequiredError } from './errors/login-required-error.js'\nimport { LexiconManager } from './lexicon/lexicon-manager.js'\nimport { LexiconStore, asLexiconStore } from './lexicon/lexicon-store.js'\nimport { HcaptchaConfig } from './lib/hcaptcha.js'\nimport { RequestMetadata } from './lib/http/request.js'\nimport { dateToRelativeSeconds } from './lib/util/date.js'\nimport { formatError } from './lib/util/error.js'\nimport { MultiLangString } from './lib/util/locale.js'\nimport { CustomMetadata, buildMetadata } from './metadata/build-metadata.js'\nimport { OAuthHooks } from './oauth-hooks.js'\nimport {\n  DpopProof,\n  OAuthVerifier,\n  OAuthVerifierOptions,\n  VerifyTokenPayloadOptions,\n} from './oauth-verifier.js'\nimport { ReplayStore, ifReplayStore } from './replay/replay-store.js'\nimport { codeSchema } from './request/code.js'\nimport { RequestManager } from './request/request-manager.js'\nimport { RequestStore, asRequestStore } from './request/request-store.js'\nimport { requestUriSchema } from './request/request-uri.js'\nimport { AuthorizationRedirectParameters } from './result/authorization-redirect-parameters.js'\nimport { AuthorizationResultAuthorizePage } from './result/authorization-result-authorize-page.js'\nimport { AuthorizationResultRedirect } from './result/authorization-result-redirect.js'\nimport { ErrorHandler } from './router/error-handler.js'\nimport { AccessTokenPayload } from './signer/access-token-payload.js'\nimport { TokenData } from './token/token-data.js'\nimport { TokenManager } from './token/token-manager.js'\nimport {\n  TokenStore,\n  asTokenStore,\n  refreshTokenSchema,\n} from './token/token-store.js'\nimport { isPARResponseError } from './types/par-response-error.js'\n\nexport { AccessTokenMode, Keyset }\nexport type {\n  AccessTokenPayload,\n  AuthorizationRedirectParameters,\n  AuthorizationResultAuthorizePage as AuthorizationResultAuthorize,\n  AuthorizationResultRedirect,\n  Branding,\n  BrandingInput,\n  CustomMetadata,\n  Customization,\n  CustomizationInput,\n  ErrorHandler,\n  HcaptchaConfig,\n  LexiconResolver,\n  MultiLangString,\n  OAuthAuthorizationServerMetadata,\n  VerifyTokenPayloadOptions,\n}\n\ntype OAuthProviderConfig = {\n  /**\n   * Maximum age a device/account session can be before requiring\n   * re-authentication.\n   */\n  authenticationMaxAge?: number\n\n  /**\n   * Maximum age access & id tokens can be before requiring a refresh.\n   */\n  tokenMaxAge?: number\n\n  /**\n   * If set to {@link AccessTokenMode.stateless}, the generated access tokens\n   * will contain all the necessary information to validate the token without\n   * needing to query the database. This is useful for cases where the Resource\n   * Server is on a different host/server than the Authorization Server.\n   *\n   * When set to {@link AccessTokenMode.light}, the access tokens will contain\n   * only the necessary information to validate the token, but the token id\n   * will need to be queried from the database to retrieve the full token\n   * information (scope, audience, etc.)\n   *\n   * @see {@link AccessTokenMode}\n   * @default {AccessTokenMode.stateless}\n   */\n  accessTokenMode?: AccessTokenMode\n\n  /**\n   * Additional metadata to be included in the discovery document.\n   */\n  metadata?: CustomMetadata\n\n  /**\n   * A custom fetch function that can be used to fetch the client metadata from\n   * the internet. By default, the fetch function is a safeFetchWrap() function\n   * that protects against SSRF attacks, large responses & known bad domains. If\n   * you want to disable all protections, you can provide `globalThis.fetch` as\n   * fetch function.\n   */\n  safeFetch?: typeof globalThis.fetch\n\n  /**\n   * A custom ATProto lexicon resolver\n   */\n  lexiconResolver?: LexiconResolver\n\n  /**\n   * A redis instance to use for replay protection. If not provided, replay\n   * protection will use memory storage.\n   */\n  redis?: Redis | RedisOptions | string\n\n  /**\n   * This will be used as the default store for all the stores. If a store is\n   * not provided, this store will be used instead. If the `store` does not\n   * implement a specific store, a runtime error will be thrown. Make sure that\n   * this store implements all the interfaces not provided in the other\n   * `<name>Store` options.\n   */\n  store?: Partial<\n    AccountStore &\n      ClientStore &\n      DeviceStore &\n      LexiconStore &\n      ReplayStore &\n      RequestStore &\n      TokenStore\n  >\n\n  accountStore?: AccountStore\n  clientStore?: ClientStore\n  deviceStore?: DeviceStore\n  lexiconStore?: LexiconStore\n  replayStore?: ReplayStore\n  requestStore?: RequestStore\n  tokenStore?: TokenStore\n\n  /**\n   * In order to speed up the client fetching process, you can provide a cache\n   * to store HTTP responses.\n   *\n   * @note the cached entries should automatically expire after a certain time (typically 10 minutes)\n   */\n  clientJwksCache?: SimpleStore<string, Jwks>\n\n  /**\n   * In order to speed up the client fetching process, you can provide a cache\n   * to store HTTP responses.\n   *\n   * @note the cached entries should automatically expire after a certain time (typically 10 minutes)\n   */\n  clientMetadataCache?: SimpleStore<string, OAuthClientMetadata>\n\n  /**\n   * In order to enable loopback clients, you can provide a function that\n   * returns the client metadata for a given loopback URL. This is useful for\n   * development and testing purposes. This function is not called for internet\n   * clients.\n   *\n   * @default is as specified by ATPROTO\n   */\n  loopbackMetadata?: null | false | LoopbackMetadataGetter\n}\n\nexport type OAuthProviderOptions = OAuthProviderConfig &\n  OAuthVerifierOptions &\n  OAuthHooks &\n  DeviceManagerOptions &\n  CustomizationInput\n\nexport class OAuthProvider extends OAuthVerifier {\n  protected readonly accessTokenMode: AccessTokenMode\n  protected readonly hooks: OAuthHooks\n\n  public readonly metadata: OAuthAuthorizationServerMetadata\n  public readonly customization: Customization\n\n  public readonly authenticationMaxAge: number\n\n  public readonly accountManager: AccountManager\n  public readonly deviceManager: DeviceManager\n  public readonly clientManager: ClientManager\n  public readonly lexiconManager: LexiconManager\n  public readonly requestManager: RequestManager\n  public readonly tokenManager: TokenManager\n\n  public constructor({\n    // OAuthProviderConfig\n    authenticationMaxAge = AUTHENTICATION_MAX_AGE,\n    tokenMaxAge = TOKEN_MAX_AGE,\n    accessTokenMode = AccessTokenMode.stateless,\n\n    metadata,\n\n    lexiconResolver,\n    safeFetch = safeFetchWrap(),\n    store, // compound store implementation\n\n    // Required stores\n    accountStore = asAccountStore(store),\n    deviceStore = asDeviceStore(store),\n    lexiconStore = asLexiconStore(store),\n    tokenStore = asTokenStore(store),\n    requestStore = asRequestStore(store),\n\n    // Optional stores\n    clientStore = ifClientStore(store),\n    replayStore = ifReplayStore(store),\n\n    clientJwksCache = new SimpleStoreMemory({\n      maxSize: 50_000_000,\n      ttl: 600e3,\n    }),\n    clientMetadataCache = new SimpleStoreMemory({\n      maxSize: 50_000_000,\n      ttl: 600e3,\n    }),\n\n    loopbackMetadata = atprotoLoopbackClientMetadata,\n\n    // OAuthHooks &\n    // OAuthVerifierOptions &\n    // DeviceManagerOptions &\n    // Customization\n    ...rest\n  }: OAuthProviderOptions) {\n    const deviceManagerOptions: DeviceManagerOptions =\n      deviceManagerOptionsSchema.parse(rest)\n\n    super({ replayStore, ...rest })\n\n    // @NOTE: hooks don't really need a type parser, as all zod can actually\n    // check at runtime is the fact that the values are functions. The only way\n    // we would benefit from zod here would be to wrap the functions with a\n    // validator for the provided function's return types, which we don't\n    // really need if types are respected.\n    this.hooks = rest\n\n    this.accessTokenMode = accessTokenMode\n    this.authenticationMaxAge = authenticationMaxAge\n    this.metadata = buildMetadata(this.issuer, this.keyset, metadata)\n    this.customization = customizationSchema.parse(rest)\n\n    this.deviceManager = new DeviceManager(deviceStore, deviceManagerOptions)\n    this.accountManager = new AccountManager(\n      this.issuer,\n      accountStore,\n      this.hooks,\n      this.customization,\n    )\n    this.clientManager = new ClientManager(\n      this.metadata,\n      this.keyset,\n      this.hooks,\n      clientStore || null,\n      loopbackMetadata || null,\n      safeFetch,\n      clientJwksCache,\n      clientMetadataCache,\n    )\n    this.lexiconManager = new LexiconManager(lexiconStore, lexiconResolver)\n    this.requestManager = new RequestManager(\n      requestStore,\n      this.lexiconManager,\n      this.signer,\n      this.metadata,\n      this.hooks,\n    )\n    this.tokenManager = new TokenManager(\n      tokenStore,\n      this.lexiconManager,\n      this.signer,\n      this.hooks,\n      this.accessTokenMode,\n      tokenMaxAge,\n    )\n  }\n\n  get jwks() {\n    return this.keyset.publicJwks\n  }\n\n  /**\n   * @returns true if the user's consent is required for the requested scopes\n   */\n  public checkConsentRequired(\n    parameters: OAuthAuthorizationRequestParameters,\n    clientData?: AuthorizedClientData,\n  ) {\n    // Client was never authorized before\n    if (!clientData) return true\n\n    // Client explicitly asked for consent\n    if (parameters.prompt === 'consent') return true\n\n    // No scope requested, and client is known by user, no consent required\n    const requestedScopes = parameters.scope?.split(' ')\n    if (requestedScopes == null) return false\n\n    // Ensure that all requested scopes were previously authorized by the user\n    const { authorizedScopes } = clientData\n    return !requestedScopes.every((scope) => authorizedScopes.includes(scope))\n  }\n\n  public checkLoginRequired(deviceAccount: DeviceAccount) {\n    const authAge = Date.now() - deviceAccount.updatedAt.getTime()\n    return authAge > this.authenticationMaxAge\n  }\n\n  protected async authenticateClient(\n    clientCredentials: OAuthClientCredentials,\n    dpopProof: null | DpopProof,\n    options?: {\n      allowMissingDpopProof?: boolean\n    },\n  ): Promise<{\n    client: Client\n    clientAuth: ClientAuth\n  }> {\n    const client = await this.clientManager.getClient(\n      clientCredentials.client_id,\n    )\n\n    if (\n      client.metadata.dpop_bound_access_tokens &&\n      !dpopProof &&\n      !options?.allowMissingDpopProof\n    ) {\n      throw new InvalidDpopProofError('DPoP proof required')\n    }\n\n    if (dpopProof && !client.metadata.dpop_bound_access_tokens) {\n      throw new InvalidDpopProofError('DPoP proof not allowed for this client')\n    }\n\n    const clientAuth = await client.authenticate(clientCredentials, {\n      authorizationServerIdentifier: this.issuer,\n    })\n\n    if (clientAuth.method === 'private_key_jwt') {\n      // Clients MUST NOT use their client assertion key to sign DPoP proofs\n      if (dpopProof && clientAuth.jkt === dpopProof.jkt) {\n        throw new InvalidRequestError(\n          'The DPoP proof must be signed with a different key than the client assertion',\n        )\n      }\n\n      // https://www.rfc-editor.org/rfc/rfc7523.html#section-3\n      // > 7.  [...] The authorization server MAY ensure that JWTs are not\n      // >     replayed by maintaining the set of used \"jti\" values for the\n      // >     length of time for which the JWT would be considered valid based\n      // >     on the applicable \"exp\" instant.\n\n      const unique = await this.replayManager.uniqueAuth(\n        clientAuth.jti,\n        client.id,\n        clientAuth.exp,\n      )\n      if (!unique) {\n        throw new InvalidGrantError(`${clientAuth.method} jti reused`)\n      }\n    }\n\n    return { client, clientAuth }\n  }\n\n  protected async decodeJAR(\n    client: Client,\n    input: OAuthAuthorizationRequestJar,\n  ): Promise<OAuthAuthorizationRequestParameters> {\n    const { payload } = await client.decodeRequestObject(\n      input.request,\n      this.issuer,\n    )\n\n    const { jti } = payload\n    if (!jti) {\n      throw new InvalidRequestError(\n        'Request object payload must contain a \"jti\" claim',\n      )\n    }\n    if (!(await this.replayManager.uniqueJar(jti, client.id))) {\n      throw new InvalidRequestError('Request object was replayed')\n    }\n\n    const parameters = await oauthAuthorizationRequestParametersSchema\n      .parseAsync(payload)\n      .catch((err) => {\n        const msg = formatError(err, 'Invalid parameters in JAR')\n        throw new InvalidRequestError(msg, err)\n      })\n\n    return parameters\n  }\n\n  /**\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc9126}\n   */\n  public async pushedAuthorizationRequest(\n    credentials: OAuthClientCredentials,\n    authorizationRequest: OAuthAuthorizationRequestPar,\n    dpopProof: null | DpopProof,\n  ): Promise<OAuthParResponse> {\n    try {\n      const { client, clientAuth } = await this.authenticateClient(\n        credentials,\n        dpopProof,\n        // Allow missing DPoP header for PAR requests as rfc9449 allows it\n        // (though the dpop_jkt parameter must be present in that case, see\n        // check bellow).\n        { allowMissingDpopProof: true },\n      )\n\n      const parameters =\n        'request' in authorizationRequest // Handle JAR\n          ? await this.decodeJAR(client, authorizationRequest)\n          : authorizationRequest\n\n      if (!parameters.dpop_jkt) {\n        if (client.metadata.dpop_bound_access_tokens) {\n          if (dpopProof) parameters.dpop_jkt = dpopProof.jkt\n          else {\n            // @NOTE When both PAR and DPoP are used, either the DPoP header, or\n            // the dpop_jkt parameter must be present. We do not enforce this\n            // for legacy reasons.\n            // https://datatracker.ietf.org/doc/html/rfc9449#section-10.1\n          }\n        }\n      } else {\n        if (!client.metadata.dpop_bound_access_tokens) {\n          throw new InvalidRequestError(\n            'DPoP bound access tokens are not enabled for this client',\n          )\n        }\n\n        // Proof is optional if the dpop_jkt is provided, but if it is provided,\n        // it must match the DPoP proof JKT.\n        if (dpopProof && dpopProof.jkt !== parameters.dpop_jkt) {\n          throw new InvalidDpopKeyBindingError()\n        }\n      }\n\n      const { requestUri, expiresAt } =\n        await this.requestManager.createAuthorizationRequest(\n          client,\n          clientAuth,\n          parameters,\n          null,\n        )\n\n      return {\n        request_uri: requestUri,\n        expires_in: dateToRelativeSeconds(expiresAt),\n      }\n    } catch (err) {\n      // https://datatracker.ietf.org/doc/html/rfc9126#section-2.3-1\n      // > Since initial processing of the pushed authorization request does not\n      // > involve resource owner interaction, error codes related to user\n      // > interaction, such as \"access_denied\", are never returned.\n      if (err instanceof AuthorizationError && !isPARResponseError(err.error)) {\n        throw new InvalidRequestError(err.error_description, err)\n      }\n      throw err\n    }\n  }\n\n  private async processAuthorizationRequest(\n    client: Client,\n    deviceId: DeviceId,\n    query: OAuthAuthorizationRequestQuery,\n  ) {\n    // PAR\n    if ('request_uri' in query) {\n      const requestUri = await requestUriSchema\n        .parseAsync(query.request_uri, { path: ['query', 'request_uri'] })\n        .catch((err) => {\n          const msg = formatError(err, 'Invalid \"request_uri\" query parameter')\n          throw new InvalidRequestError(msg, err)\n        })\n\n      return this.requestManager.get(requestUri, deviceId, client.id)\n    }\n\n    // JAR\n    if ('request' in query) {\n      // @NOTE Since JAR are signed with the client's private key, a JAR *could*\n      // technically be used to authenticate the client when requests are\n      // created without PAR (i.e. created on the fly by the authorize\n      // endpoint). This implementation actually used to support this\n      // (un-spec'd) behavior. That support was removed:\n      // - Because it was not actually used\n      // - Because it was not part of any standard\n      // - Because it makes extending the client authentication mechanism more\n      //   complex since any extension would not only need to affect the\n      //   \"private_key_jwt\" auth method but also the JAR \"request\" object.\n      const parameters = await this.decodeJAR(client, query)\n\n      return this.requestManager.createAuthorizationRequest(\n        client,\n        null,\n        parameters,\n        deviceId,\n      )\n    }\n\n    // \"Regular\" authorization request (created on the fly by directing the user\n    // to the authorization endpoint with all the parameters in the url).\n    return this.requestManager.createAuthorizationRequest(\n      client,\n      null,\n      query,\n      deviceId,\n    )\n  }\n\n  /**\n   * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-4.1.1}\n   */\n  public async authorize(\n    clientCredentials: OAuthClientCredentialsNone,\n    query: OAuthAuthorizationRequestQuery,\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n  ): Promise<AuthorizationResultRedirect | AuthorizationResultAuthorizePage> {\n    const { issuer } = this\n\n    // If there is a chance to redirect the user to the client, let's do\n    // it by wrapping the error in an AuthorizationError.\n    const throwAuthorizationError =\n      'redirect_uri' in query\n        ? (err: unknown): never => {\n            // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-4.1.2.1\n            throw AuthorizationError.from(query, err)\n          }\n        : null\n\n    const client = await this.clientManager\n      .getClient(clientCredentials.client_id)\n      .catch(throwAuthorizationError)\n\n    const { parameters, requestUri } = await this.processAuthorizationRequest(\n      client,\n      deviceId,\n      query,\n    ).catch(throwAuthorizationError)\n\n    try {\n      const sessions = await this.getSessions(client.id, deviceId, parameters)\n\n      if (parameters.prompt === 'none') {\n        const ssoSessions = sessions.filter((s) => s.matchesHint)\n        if (ssoSessions.length > 1) {\n          throw new AccountSelectionRequiredError(parameters)\n        }\n        if (ssoSessions.length < 1) {\n          throw new LoginRequiredError(parameters)\n        }\n\n        const ssoSession = ssoSessions[0]!\n        if (ssoSession.loginRequired) {\n          throw new LoginRequiredError(parameters)\n        }\n        if (ssoSession.consentRequired) {\n          throw new ConsentRequiredError(parameters)\n        }\n\n        const code = await this.requestManager.setAuthorized(\n          requestUri,\n          client,\n          ssoSession.account,\n          deviceId,\n          deviceMetadata,\n        )\n\n        return { issuer, parameters, redirect: { code } }\n      }\n\n      // Automatic SSO when a did was provided\n      if (parameters.prompt == null && parameters.login_hint != null) {\n        const ssoSessions = sessions.filter((s) => s.matchesHint)\n        if (ssoSessions.length === 1) {\n          const ssoSession = ssoSessions[0]!\n          if (!ssoSession.loginRequired && !ssoSession.consentRequired) {\n            const code = await this.requestManager.setAuthorized(\n              requestUri,\n              client,\n              ssoSession.account,\n              deviceId,\n              deviceMetadata,\n            )\n\n            return { issuer, parameters, redirect: { code } }\n          }\n        }\n      }\n\n      return {\n        issuer,\n        client,\n        parameters,\n        requestUri,\n        sessions: sessions.map((session) => ({\n          // Map to avoid leaking other data that might be present in the session\n          account: session.account,\n          selected: session.selected,\n          loginRequired: session.loginRequired,\n          consentRequired: session.consentRequired,\n        })),\n        permissionSets: await this.lexiconManager\n          .getPermissionSetsFromScope(parameters.scope)\n          .catch((cause) => {\n            throw new AuthorizationError(\n              parameters,\n              'Unable to retrieve permission sets',\n              'invalid_scope',\n              cause,\n            )\n          }),\n      }\n    } catch (err) {\n      try {\n        await this.requestManager.delete(requestUri)\n      } catch {\n        // There are two error here. Better keep the outer one.\n        //\n        // @TODO Maybe move this entire code to the /authorize endpoint\n        // (allowing to log this error)\n      }\n\n      throw AuthorizationError.from(parameters, err)\n    }\n  }\n\n  protected async getSessions(\n    clientId: ClientId,\n    deviceId: DeviceId,\n    parameters: OAuthAuthorizationRequestParameters,\n  ): Promise<\n    {\n      account: Account\n\n      selected: boolean\n      loginRequired: boolean\n      consentRequired: boolean\n\n      matchesHint: boolean\n    }[]\n  > {\n    const deviceAccounts =\n      await this.accountManager.listDeviceAccounts(deviceId)\n\n    const hint = parameters.login_hint\n    const matchesHint = (account: Account): boolean =>\n      (!!account.sub && account.sub === hint) ||\n      (!!account.preferred_username && account.preferred_username === hint)\n\n    return deviceAccounts.map((deviceAccount) => ({\n      account: deviceAccount.account,\n\n      selected:\n        parameters.prompt !== 'select_account' &&\n        matchesHint(deviceAccount.account),\n      // @TODO Return the session expiration date instead of a boolean to\n      // avoid having to rely on a leeway when \"accepting\" the request.\n      loginRequired:\n        parameters.prompt === 'login' || this.checkLoginRequired(deviceAccount),\n      consentRequired: this.checkConsentRequired(\n        parameters,\n        deviceAccount.authorizedClients.get(clientId),\n      ),\n\n      matchesHint: hint == null || matchesHint(deviceAccount.account),\n    }))\n  }\n\n  public async token(\n    clientCredentials: OAuthClientCredentials,\n    clientMetadata: RequestMetadata,\n    request: OAuthTokenRequest,\n    dpopProof: null | DpopProof,\n  ): Promise<OAuthTokenResponse> {\n    const { client, clientAuth } = await this.authenticateClient(\n      clientCredentials,\n      dpopProof,\n    )\n\n    if (!this.metadata.grant_types_supported?.includes(request.grant_type)) {\n      throw new InvalidGrantError(\n        `Grant type \"${request.grant_type}\" is not supported by the server`,\n      )\n    }\n\n    if (!client.metadata.grant_types.includes(request.grant_type)) {\n      throw new InvalidGrantError(\n        `\"${request.grant_type}\" grant type is not allowed for this client`,\n      )\n    }\n\n    if (request.grant_type === 'authorization_code') {\n      return this.authorizationCodeGrant(\n        client,\n        clientAuth,\n        clientMetadata,\n        request,\n        dpopProof,\n      )\n    }\n\n    if (request.grant_type === 'refresh_token') {\n      return this.refreshTokenGrant(\n        client,\n        clientAuth,\n        clientMetadata,\n        request,\n        dpopProof,\n      )\n    }\n\n    throw new InvalidGrantError(\n      `Grant type \"${request.grant_type}\" not supported`,\n    )\n  }\n\n  protected async compareClientAuth(\n    client: Client,\n    clientAuth: ClientAuth,\n    dpopProof: null | DpopProof,\n    initial: {\n      parameters: OAuthAuthorizationRequestParameters\n      clientId: ClientId\n      clientAuth: null | ClientAuth | ClientAuthLegacy\n    },\n  ): Promise<void> {\n    // Fool proofing, ensure that the client is authenticating using the right method\n    if (clientAuth.method !== client.metadata.token_endpoint_auth_method) {\n      throw new InvalidGrantError(\n        `Client authentication method mismatch (expected ${client.metadata.token_endpoint_auth_method}, got ${clientAuth.method})`,\n      )\n    }\n\n    if (initial.clientId !== client.id) {\n      throw new InvalidGrantError(`Token was not issued to this client`)\n    }\n\n    const { parameters } = initial\n    if (parameters.dpop_jkt) {\n      if (!dpopProof) {\n        throw new InvalidGrantError(`DPoP proof is required for this request`)\n      } else if (parameters.dpop_jkt !== dpopProof.jkt) {\n        throw new InvalidGrantError(\n          `DPoP proof does not match the expected JKT`,\n        )\n      }\n    }\n\n    if (!initial.clientAuth) {\n      // If the client did not use PAR, it was not authenticated when the request\n      // was initially created (see authorize() method in OAuthProvider). Since\n      // PAR is not mandatory, and since the token exchange currently taking place\n      // *is* authenticated (`clientAuth`), we allow \"upgrading\" the\n      // authentication method (the token created will be bound to the current\n      // clientAuth).\n      return\n    }\n\n    switch (initial.clientAuth.method) {\n      case CLIENT_ASSERTION_TYPE_JWT_BEARER: // LEGACY\n      case 'private_key_jwt':\n        if (clientAuth.method !== 'private_key_jwt') {\n          throw new InvalidGrantError(\n            `Client authentication method mismatch (expected ${initial.clientAuth.method})`,\n          )\n        }\n        if (\n          clientAuth.kid !== initial.clientAuth.kid ||\n          clientAuth.alg !== initial.clientAuth.alg ||\n          clientAuth.jkt !== initial.clientAuth.jkt\n        ) {\n          throw new InvalidGrantError(\n            `The session was initiated with a different key than the client assertion currently used`,\n          )\n        }\n        break\n      case 'none':\n        // @NOTE We allow the client to \"upgrade\" to a confidential client if\n        // the session was initially created without client authentication.\n        break\n      default:\n        throw new InvalidGrantError(\n          // @ts-expect-error (future proof, backwards compatibility)\n          `Invalid method \"${initial.clientAuth.method}\"`,\n        )\n    }\n  }\n\n  protected async authorizationCodeGrant(\n    client: Client,\n    clientAuth: ClientAuth,\n    clientMetadata: RequestMetadata,\n    input: OAuthAuthorizationCodeGrantTokenRequest,\n    dpopProof: null | DpopProof,\n  ): Promise<OAuthTokenResponse> {\n    const code = await codeSchema\n      .parseAsync(input.code, { path: ['code'] })\n      .catch((err) => {\n        const msg = formatError(err, 'Invalid code')\n        throw new InvalidGrantError(msg, err)\n      })\n\n    const data = await this.requestManager\n      .consumeCode(code)\n      .catch(async (err) => {\n        // Code not found in request manager: check for replays\n        const tokenInfo = await this.tokenManager.findByCode(code)\n        if (tokenInfo) {\n          // try/finally to ensure that both code path get executed (sequentially)\n          try {\n            // \"code\" was replayed, delete existing session\n            await this.tokenManager.deleteToken(tokenInfo.id)\n          } finally {\n            // As an additional security measure, we also sign the device out,\n            // so that the device cannot be used to access the account anymore\n            // without a new authentication.\n            const { deviceId, sub } = tokenInfo.data\n            if (deviceId) {\n              await this.accountManager.removeDeviceAccount(deviceId, sub)\n            }\n          }\n        }\n\n        throw InvalidGrantError.from(err, `Invalid code`)\n      })\n\n    // @NOTE at this point, the request data was removed from the store and only\n    // exists in memory here (in the \"data\" variable). Because of this, any\n    // error thrown after this point will permanently cause the request data to\n    // be lost.\n\n    await this.compareClientAuth(client, clientAuth, dpopProof, data)\n\n    // If the DPoP proof was not provided earlier (PAR / authorize), let's add\n    // it now.\n    const parameters =\n      dpopProof &&\n      client.metadata.dpop_bound_access_tokens &&\n      !data.parameters.dpop_jkt\n        ? { ...data.parameters, dpop_jkt: dpopProof.jkt }\n        : data.parameters\n\n    await this.validateCodeGrant(parameters, input)\n\n    const { account } = await this.accountManager.getAccount(data.sub)\n\n    return this.tokenManager.createToken(\n      client,\n      clientAuth,\n      clientMetadata,\n      account,\n      data.deviceId,\n      parameters,\n      code,\n    )\n  }\n\n  protected async validateCodeGrant(\n    parameters: OAuthAuthorizationRequestParameters,\n    input: OAuthAuthorizationCodeGrantTokenRequest,\n  ): Promise<void> {\n    if (parameters.redirect_uri !== input.redirect_uri) {\n      throw new InvalidGrantError(\n        'The redirect_uri parameter must match the one used in the authorization request',\n      )\n    }\n\n    if (parameters.code_challenge) {\n      if (!input.code_verifier) {\n        throw new InvalidGrantError('code_verifier is required')\n      }\n      if (input.code_verifier.length < 43) {\n        throw new InvalidGrantError('code_verifier too short')\n      }\n      switch (parameters.code_challenge_method) {\n        case undefined: // default is \"plain\"\n        case 'plain':\n          if (parameters.code_challenge !== input.code_verifier) {\n            throw new InvalidGrantError('Invalid code_verifier')\n          }\n          break\n\n        case 'S256': {\n          const inputChallenge = Buffer.from(\n            parameters.code_challenge,\n            'base64',\n          )\n          const computedChallenge = createHash('sha256')\n            .update(input.code_verifier)\n            .digest()\n          if (inputChallenge.compare(computedChallenge) !== 0) {\n            throw new InvalidGrantError('Invalid code_verifier')\n          }\n          break\n        }\n\n        default:\n          // Should never happen (because request validation should catch this)\n          throw new Error(`Unsupported code_challenge_method`)\n      }\n      const unique = await this.replayManager.uniqueCodeChallenge(\n        parameters.code_challenge,\n      )\n      if (!unique) {\n        throw new InvalidGrantError('Code challenge already used')\n      }\n    } else if (input.code_verifier !== undefined) {\n      throw new InvalidRequestError(\"code_challenge parameter wasn't provided\")\n    }\n  }\n\n  protected async refreshTokenGrant(\n    client: Client,\n    clientAuth: ClientAuth,\n    clientMetadata: RequestMetadata,\n    input: OAuthRefreshTokenGrantTokenRequest,\n    dpopProof: null | DpopProof,\n  ): Promise<OAuthTokenResponse> {\n    const refreshToken = await refreshTokenSchema\n      .parseAsync(input.refresh_token, { path: ['refresh_token'] })\n      .catch((err) => {\n        const msg = formatError(err, 'Invalid refresh token')\n        throw new InvalidGrantError(msg, err)\n      })\n\n    const tokenInfo = await this.tokenManager.consumeRefreshToken(refreshToken)\n\n    try {\n      const { data } = tokenInfo\n      await this.compareClientAuth(client, clientAuth, dpopProof, data)\n      await this.validateRefreshGrant(client, clientAuth, data)\n\n      return await this.tokenManager.rotateToken(\n        client,\n        clientAuth,\n        clientMetadata,\n        tokenInfo,\n      )\n    } catch (err) {\n      await this.tokenManager.deleteToken(tokenInfo.id)\n\n      throw err\n    }\n  }\n\n  protected async validateRefreshGrant(\n    client: Client,\n    clientAuth: ClientAuth,\n    data: TokenData,\n  ): Promise<void> {\n    const [sessionLifetime, refreshLifetime] =\n      clientAuth.method !== 'none' || client.info.isFirstParty\n        ? [\n            CONFIDENTIAL_CLIENT_SESSION_LIFETIME,\n            CONFIDENTIAL_CLIENT_REFRESH_LIFETIME,\n          ]\n        : [PUBLIC_CLIENT_SESSION_LIFETIME, PUBLIC_CLIENT_REFRESH_LIFETIME]\n\n    const sessionAge = Date.now() - data.createdAt.getTime()\n    if (sessionAge > sessionLifetime) {\n      throw new InvalidGrantError(`Session expired`)\n    }\n\n    const refreshAge = Date.now() - data.updatedAt.getTime()\n    if (refreshAge > refreshLifetime) {\n      throw new InvalidGrantError(`Refresh token expired`)\n    }\n  }\n\n  /**\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7009#section-2.1 rfc7009}\n   */\n  public async revoke(\n    clientCredentials: OAuthClientCredentials,\n    { token }: OAuthTokenIdentification,\n    dpopProof: null | DpopProof,\n  ) {\n    // > The authorization server first validates the client credentials (in\n    // > case of a confidential client)\n    const { client, clientAuth } = await this.authenticateClient(\n      clientCredentials,\n      dpopProof,\n    )\n\n    const tokenInfo = await this.tokenManager.findToken(token)\n    if (tokenInfo) {\n      // > [...] and then verifies whether the token was issued to the client\n      // > making the revocation request.\n      const { data } = tokenInfo\n      await this.compareClientAuth(client, clientAuth, dpopProof, data)\n\n      // > In the next step, the authorization server invalidates the token. The\n      // > invalidation takes place immediately, and the token cannot be used\n      // > again after the revocation.\n      await this.tokenManager.deleteToken(tokenInfo.id)\n    }\n  }\n\n  protected override async decodeToken(\n    tokenType: OAuthTokenType,\n    token: OAuthAccessToken,\n    dpopProof: null | DpopProof,\n  ): Promise<AccessTokenPayload> {\n    const tokenPayload = await super.decodeToken(tokenType, token, dpopProof)\n\n    if (this.accessTokenMode !== AccessTokenMode.stateless) {\n      // @NOTE in non stateless mode, some claims can be omitted (most notably\n      // \"scope\"). We load the token claims here (allowing to ensure that the\n      // token is still valid, and to retrieve a (potentially updated) set of\n      // claims).\n\n      const tokenClaims = await this.tokenManager.loadTokenClaims(\n        tokenType,\n        tokenPayload,\n      )\n\n      Object.assign(tokenPayload, tokenClaims)\n    }\n\n    return tokenPayload\n  }\n}\n"]}

package/dist/oauth-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-store.js","sourceRoot":"","sources":["../src/oauth-store.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;AAEH,6DAA0C;AAC1C,2DAAwC;AACxC,2DAAwC;AACxC,6DAA0C;AAC1C,2DAAwC;AACxC,6DAA0C;AAC1C,yDAAsC"}
+{"version":3,"file":"oauth-store.js","sourceRoot":"","sources":["../src/oauth-store.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;AAEH,6DAA0C;AAC1C,2DAAwC;AACxC,2DAAwC;AACxC,6DAA0C;AAC1C,2DAAwC;AACxC,6DAA0C;AAC1C,yDAAsC","sourcesContent":["/**\n * Every store file exports all the types needed to implement that store. This\n * files re-exports all the types from the x-store files.\n */\n\nexport * from './account/account-store.js'\nexport * from './client/client-store.js'\nexport * from './device/device-store.js'\nexport * from './lexicon/lexicon-store.js'\nexport * from './replay/replay-store.js'\nexport * from './request/request-store.js'\nexport * from './token/token-store.js'\n"]}

package/dist/oauth-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-verifier.js","sourceRoot":"","sources":["../src/oauth-verifier.ts"],"names":[],"mappings":";;;AACA,sCAAuD;AAyDnC,oFAzDX,SAAG,OAyDW;AAAE,uFAzDX,YAAM,OAyDW;AAxD/B,sDAK6B;AAC7B,4DAAwE;AACxE,wDAAgD;AAiDvC,0FAjDA,yBAAS,OAiDA;AA/ClB,kGAAuF;AACvF,sFAA4E;AAC5E,4EAAmE;AACnE,8EAAoE;AACpE,kFAAyE;AACzE,gFAA6E;AAC7E,wDAAmD;AAEnD,kEAA0D;AAC1D,4EAAmE;AACnE,0EAAiE;AAGjE,kDAA2C;AA2C3C,MAAa,aAAa;IACP,aAAa,CAAkB;IAEhC,MAAM,CAAuB;IAC7B,MAAM,CAAQ;IAEd,WAAW,CAAa;IACxB,aAAa,CAAe;IAC5B,MAAM,CAAQ;IAE9B,YAAY,EACV,KAAK,EACL,MAAM,EACN,MAAM,EACN,WAAW,GAAG,KAAK,IAAI,IAAI;QACzB,CAAC,CAAC,IAAI,wCAAgB,CAAC,EAAE,KAAK,EAAE,CAAC;QACjC,CAAC,CAAC,IAAI,0CAAiB,EAAE,EAC3B,aAAa,EAEb,GAAG,IAAI,EACc;QACrB,MAAM,cAAc,GAAuB,IAAI,CAAA;QAE/C,MAAM,YAAY,GAAG,yCAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC9D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAA;QAEvC,qCAAqC;QACrC,IAAI,SAAS,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YAC/B,MAAM,IAAI,SAAS,CACjB,yDAAyD,SAAS,GAAG,CACtE,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,YAAY,CAAA;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,YAAY,YAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,YAAM,CAAC,MAAM,CAAC,CAAA;QAEpE,IAAI,CAAC,WAAW,GAAG,IAAI,6BAAW,CAAC,cAAc,CAAC,CAAA;QAClD,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CAAC,WAAW,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,kBAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAElD,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;IAEM,aAAa;QAClB,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAA;IACrC,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,UAAkB,EAClB,OAAsB,EACtB,WAA0D,EAC1D,WAAoB;QAEpB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CACjD,UAAU,EACV,OAAO,EACP,WAAW,EACX,WAAW,CACZ,CAAA;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;YACjE,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,mDAAqB,CAAC,qBAAqB,CAAC,CAAA;QACrE,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAES,KAAK,CAAC,WAAW,CACzB,SAAyB,EACzB,KAAuB,EACvB,SAA2B;QAE3B,IAAI,CAAC,IAAA,iBAAW,EAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,0CAAiB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM;aAClC,iBAAiB,CAAC,KAAK,CAAC;aACxB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC9C,CAAC,CAAC,CAAA;QAEJ,IAAI,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;YACrB,4DAA4D;YAC5D,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACzB,MAAM,IAAI,0CAAiB,CACzB,MAAM,EACN,4DAA4D,SAAS,EAAE,CACxE,CAAA;YACH,CAAC;YAED,iDAAiD;YACjD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,mDAAqB,CAAC,qBAAqB,CAAC,CAAA;YACxD,CAAC;YAED,sEAAsE;YACtE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;gBACtC,MAAM,IAAI,8DAA0B,EAAE,CAAA;YACxC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iEAAiE;YACjE,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,0CAAiB,CACzB,QAAQ,EACR,qDAAqD,CACtD,CAAA;YACH,CAAC;YAED,4DAA4D;QAC9D,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE;YAC3D,SAAS;YACT,KAAK;YACL,OAAO;YACP,SAAS;SACV,CAAC,CAAA;QAEF,OAAO,eAAe,IAAI,OAAO,CAAA;IACnC,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,mBAAmB,CAC9B,UAAkB,EAClB,OAAsB,EACtB,WAA0D,EAC1D,aAAyC;QAEzC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,IAAA,kDAAwB,EACjD,WAAW,CAAC,eAAe,CAAC,CAC7B,CAAA;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CACzC,UAAU,EACV,OAAO,EACP,WAAW,EACX,KAAK,CACN,CAAA;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;YAExE,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,YAAY,EAAE,aAAa,CAAC,CAAA;YAE/D,OAAO,YAAY,CAAA;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,2CAAiB;gBAAE,MAAM,GAAG,CAAC,sBAAsB,EAAE,CAAA;YACxE,IAAI,GAAG,YAAY,gDAAoB;gBAAE,MAAM,GAAG,CAAA;YAElD,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAES,kBAAkB,CAC1B,SAAyB,EACzB,YAAgC,EAChC,OAAmC;QAEnC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,EAAE,GAAG,YAAY,CAAA;YAC5B,MAAM,QAAQ,GACZ,GAAG,IAAI,IAAI;gBACX,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;oBACjB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAU,EAAE,GAAG,CAAC;oBACxC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;YACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,OAAO,GAAG,SAAS,GAAG,sBAAsB,OAAO,CAAC,QAAQ,GAAG,CAAA;gBACrE,MAAM,IAAI,0CAAiB,CAAC,SAAS,EAAE,oBAAoB,OAAO,EAAE,CAAC,CAAA;YACvE,CAAC;QACH,CAAC;QAED,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAAA;YAC9B,MAAM,MAAM,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;YAChC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAU,EAAE,MAAM,CAAC,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG,SAAS,KAAK,sBAAsB,OAAO,CAAC,KAAK,GAAG,CAAA;gBACpE,MAAM,IAAI,0CAAiB,CAAC,SAAS,EAAE,iBAAiB,OAAO,EAAE,CAAC,CAAA;YACpE,CAAC;QACH,CAAC;QAED,IAAI,YAAY,CAAC,GAAG,IAAI,IAAI,IAAI,YAAY,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtE,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;YACtE,MAAM,IAAI,0CAAiB,CACzB,SAAS,EACT,oBAAoB,cAAc,EAAE,CACrC,CAAA;QACH,CAAC;IACH,CAAC;CACF;AAhMD,sCAgMC"}
+{"version":3,"file":"oauth-verifier.js","sourceRoot":"","sources":["../src/oauth-verifier.ts"],"names":[],"mappings":";;;AACA,sCAAuD;AAyDnC,oFAzDX,SAAG,OAyDW;AAAE,uFAzDX,YAAM,OAyDW;AAxD/B,sDAK6B;AAC7B,4DAAwE;AACxE,wDAAgD;AAiDvC,0FAjDA,yBAAS,OAiDA;AA/ClB,kGAAuF;AACvF,sFAA4E;AAC5E,4EAAmE;AACnE,8EAAoE;AACpE,kFAAyE;AACzE,gFAA6E;AAC7E,wDAAmD;AAEnD,kEAA0D;AAC1D,4EAAmE;AACnE,0EAAiE;AAGjE,kDAA2C;AA2C3C,MAAa,aAAa;IACP,aAAa,CAAkB;IAEhC,MAAM,CAAuB;IAC7B,MAAM,CAAQ;IAEd,WAAW,CAAa;IACxB,aAAa,CAAe;IAC5B,MAAM,CAAQ;IAE9B,YAAY,EACV,KAAK,EACL,MAAM,EACN,MAAM,EACN,WAAW,GAAG,KAAK,IAAI,IAAI;QACzB,CAAC,CAAC,IAAI,wCAAgB,CAAC,EAAE,KAAK,EAAE,CAAC;QACjC,CAAC,CAAC,IAAI,0CAAiB,EAAE,EAC3B,aAAa,EAEb,GAAG,IAAI,EACc;QACrB,MAAM,cAAc,GAAuB,IAAI,CAAA;QAE/C,MAAM,YAAY,GAAG,yCAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC9D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAA;QAEvC,qCAAqC;QACrC,IAAI,SAAS,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YAC/B,MAAM,IAAI,SAAS,CACjB,yDAAyD,SAAS,GAAG,CACtE,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,YAAY,CAAA;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,YAAY,YAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,YAAM,CAAC,MAAM,CAAC,CAAA;QAEpE,IAAI,CAAC,WAAW,GAAG,IAAI,6BAAW,CAAC,cAAc,CAAC,CAAA;QAClD,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CAAC,WAAW,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,kBAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAElD,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;IAEM,aAAa;QAClB,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAA;IACrC,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,UAAkB,EAClB,OAAsB,EACtB,WAA0D,EAC1D,WAAoB;QAEpB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CACjD,UAAU,EACV,OAAO,EACP,WAAW,EACX,WAAW,CACZ,CAAA;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;YACjE,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,mDAAqB,CAAC,qBAAqB,CAAC,CAAA;QACrE,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAES,KAAK,CAAC,WAAW,CACzB,SAAyB,EACzB,KAAuB,EACvB,SAA2B;QAE3B,IAAI,CAAC,IAAA,iBAAW,EAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,0CAAiB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM;aAClC,iBAAiB,CAAC,KAAK,CAAC;aACxB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC9C,CAAC,CAAC,CAAA;QAEJ,IAAI,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;YACrB,4DAA4D;YAC5D,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACzB,MAAM,IAAI,0CAAiB,CACzB,MAAM,EACN,4DAA4D,SAAS,EAAE,CACxE,CAAA;YACH,CAAC;YAED,iDAAiD;YACjD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,mDAAqB,CAAC,qBAAqB,CAAC,CAAA;YACxD,CAAC;YAED,sEAAsE;YACtE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;gBACtC,MAAM,IAAI,8DAA0B,EAAE,CAAA;YACxC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iEAAiE;YACjE,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,0CAAiB,CACzB,QAAQ,EACR,qDAAqD,CACtD,CAAA;YACH,CAAC;YAED,4DAA4D;QAC9D,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE;YAC3D,SAAS;YACT,KAAK;YACL,OAAO;YACP,SAAS;SACV,CAAC,CAAA;QAEF,OAAO,eAAe,IAAI,OAAO,CAAA;IACnC,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,mBAAmB,CAC9B,UAAkB,EAClB,OAAsB,EACtB,WAA0D,EAC1D,aAAyC;QAEzC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,IAAA,kDAAwB,EACjD,WAAW,CAAC,eAAe,CAAC,CAC7B,CAAA;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CACzC,UAAU,EACV,OAAO,EACP,WAAW,EACX,KAAK,CACN,CAAA;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;YAExE,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,YAAY,EAAE,aAAa,CAAC,CAAA;YAE/D,OAAO,YAAY,CAAA;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,2CAAiB;gBAAE,MAAM,GAAG,CAAC,sBAAsB,EAAE,CAAA;YACxE,IAAI,GAAG,YAAY,gDAAoB;gBAAE,MAAM,GAAG,CAAA;YAElD,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAES,kBAAkB,CAC1B,SAAyB,EACzB,YAAgC,EAChC,OAAmC;QAEnC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,EAAE,GAAG,YAAY,CAAA;YAC5B,MAAM,QAAQ,GACZ,GAAG,IAAI,IAAI;gBACX,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;oBACjB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAU,EAAE,GAAG,CAAC;oBACxC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;YACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,OAAO,GAAG,SAAS,GAAG,sBAAsB,OAAO,CAAC,QAAQ,GAAG,CAAA;gBACrE,MAAM,IAAI,0CAAiB,CAAC,SAAS,EAAE,oBAAoB,OAAO,EAAE,CAAC,CAAA;YACvE,CAAC;QACH,CAAC;QAED,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAAA;YAC9B,MAAM,MAAM,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;YAChC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAU,EAAE,MAAM,CAAC,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG,SAAS,KAAK,sBAAsB,OAAO,CAAC,KAAK,GAAG,CAAA;gBACpE,MAAM,IAAI,0CAAiB,CAAC,SAAS,EAAE,iBAAiB,OAAO,EAAE,CAAC,CAAA;YACpE,CAAC;QACH,CAAC;QAED,IAAI,YAAY,CAAC,GAAG,IAAI,IAAI,IAAI,YAAY,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtE,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;YACtE,MAAM,IAAI,0CAAiB,CACzB,SAAS,EACT,oBAAoB,cAAc,EAAE,CACrC,CAAA;QACH,CAAC;IACH,CAAC;CACF;AAhMD,sCAgMC","sourcesContent":["import type { Redis, RedisOptions } from 'ioredis'\nimport { Key, Keyset, isSignedJwt } from '@atproto/jwk'\nimport {\n  OAuthAccessToken,\n  OAuthIssuerIdentifier,\n  OAuthTokenType,\n  oauthIssuerIdentifierSchema,\n} from '@atproto/oauth-types'\nimport { DpopManager, DpopManagerOptions } from './dpop/dpop-manager.js'\nimport { DpopNonce } from './dpop/dpop-nonce.js'\nimport { DpopProof } from './dpop/dpop-proof.js'\nimport { InvalidDpopKeyBindingError } from './errors/invalid-dpop-key-binding-error.js'\nimport { InvalidDpopProofError } from './errors/invalid-dpop-proof-error.js'\nimport { InvalidTokenError } from './errors/invalid-token-error.js'\nimport { UseDpopNonceError } from './errors/use-dpop-nonce-error.js'\nimport { WWWAuthenticateError } from './errors/www-authenticate-error.js'\nimport { parseAuthorizationHeader } from './lib/util/authorization-header.js'\nimport { includedIn } from './lib/util/function.js'\nimport { OAuthHooks } from './oauth-hooks.js'\nimport { ReplayManager } from './replay/replay-manager.js'\nimport { ReplayStoreMemory } from './replay/replay-store-memory.js'\nimport { ReplayStoreRedis } from './replay/replay-store-redis.js'\nimport { ReplayStore } from './replay/replay-store.js'\nimport { AccessTokenPayload } from './signer/access-token-payload.js'\nimport { Signer } from './signer/signer.js'\n\nexport type DecodeTokenHook = OAuthHooks['onDecodeToken']\n\nexport type OAuthVerifierOptions = DpopManagerOptions & {\n  /**\n   * The \"issuer\" identifier of the OAuth provider, this is the base URL of the\n   * OAuth provider.\n   */\n  issuer: URL | string\n\n  /**\n   * The keyset used to sign access tokens.\n   */\n  keyset: Keyset | Iterable<Key | undefined | null | false>\n\n  /**\n   * A redis instance to use for replay protection. If not provided, replay\n   * protection will use memory storage.\n   */\n  redis?: Redis | RedisOptions | string\n\n  replayStore?: ReplayStore\n\n  onDecodeToken?: DecodeTokenHook\n}\n\nexport type VerifyTokenPayloadOptions = {\n  /** One of these audience must be included in the token audience(s) */\n  audience?: [string, ...string[]]\n  /** One of these scope must be included in the token scope(s) */\n  scope?: [string, ...string[]]\n}\n\nexport { DpopNonce, Key, Keyset }\nexport type {\n  AccessTokenPayload,\n  DpopProof,\n  OAuthTokenType,\n  RedisOptions,\n  ReplayStore,\n}\n\nexport class OAuthVerifier {\n  private readonly onDecodeToken?: DecodeTokenHook\n\n  public readonly issuer: OAuthIssuerIdentifier\n  public readonly keyset: Keyset\n\n  public readonly dpopManager: DpopManager\n  public readonly replayManager: ReplayManager\n  public readonly signer: Signer\n\n  constructor({\n    redis,\n    issuer,\n    keyset,\n    replayStore = redis != null\n      ? new ReplayStoreRedis({ redis })\n      : new ReplayStoreMemory(),\n    onDecodeToken,\n\n    ...rest\n  }: OAuthVerifierOptions) {\n    const dpopMgrOptions: DpopManagerOptions = rest\n\n    const issuerParsed = oauthIssuerIdentifierSchema.parse(issuer)\n    const issuerUrl = new URL(issuerParsed)\n\n    // @TODO (?) support issuer with path\n    if (issuerUrl.pathname !== '/') {\n      throw new TypeError(\n        `\"issuer\" must be an URL with no path, search or hash (${issuerUrl})`,\n      )\n    }\n\n    this.issuer = issuerParsed\n    this.keyset = keyset instanceof Keyset ? keyset : new Keyset(keyset)\n\n    this.dpopManager = new DpopManager(dpopMgrOptions)\n    this.replayManager = new ReplayManager(replayStore)\n    this.signer = new Signer(this.issuer, this.keyset)\n\n    this.onDecodeToken = onDecodeToken\n  }\n\n  public nextDpopNonce() {\n    return this.dpopManager.nextNonce()\n  }\n\n  public async checkDpopProof(\n    httpMethod: string,\n    httpUrl: Readonly<URL>,\n    httpHeaders: Record<string, undefined | string | string[]>,\n    accessToken?: string,\n  ): Promise<null | DpopProof> {\n    const dpopProof = await this.dpopManager.checkProof(\n      httpMethod,\n      httpUrl,\n      httpHeaders,\n      accessToken,\n    )\n\n    if (dpopProof) {\n      const unique = await this.replayManager.uniqueDpop(dpopProof.jti)\n      if (!unique) throw new InvalidDpopProofError('DPoP proof replayed')\n    }\n\n    return dpopProof\n  }\n\n  protected async decodeToken(\n    tokenType: OAuthTokenType,\n    token: OAuthAccessToken,\n    dpopProof: null | DpopProof,\n  ): Promise<AccessTokenPayload> {\n    if (!isSignedJwt(token)) {\n      throw new InvalidTokenError(tokenType, `Malformed token`)\n    }\n\n    const { payload } = await this.signer\n      .verifyAccessToken(token)\n      .catch((err) => {\n        throw InvalidTokenError.from(err, tokenType)\n      })\n\n    if (payload.cnf?.jkt) {\n      // An access token with a cnf.jkt claim must be a DPoP token\n      if (tokenType !== 'DPoP') {\n        throw new InvalidTokenError(\n          'DPoP',\n          `Access token is bound to a DPoP proof, but token type is ${tokenType}`,\n        )\n      }\n\n      // DPoP token type must be used with a DPoP proof\n      if (!dpopProof) {\n        throw new InvalidDpopProofError(`DPoP proof required`)\n      }\n\n      // DPoP proof must be signed with the key that matches the \"cnf\" claim\n      if (payload.cnf.jkt !== dpopProof.jkt) {\n        throw new InvalidDpopKeyBindingError()\n      }\n    } else {\n      // An access token without a cnf.jkt claim must be a Bearer token\n      if (tokenType !== 'Bearer') {\n        throw new InvalidTokenError(\n          'Bearer',\n          `Bearer token type must be used without a DPoP proof`,\n        )\n      }\n\n      // @NOTE We ignore (but allow) DPoP proofs for Bearer tokens\n    }\n\n    const payloadOverride = await this.onDecodeToken?.call(null, {\n      tokenType,\n      token,\n      payload,\n      dpopProof,\n    })\n\n    return payloadOverride ?? payload\n  }\n\n  /**\n   * @throws {WWWAuthenticateError}\n   * @throws {InvalidTokenError}\n   */\n  public async authenticateRequest(\n    httpMethod: string,\n    httpUrl: Readonly<URL>,\n    httpHeaders: Record<string, undefined | string | string[]>,\n    verifyOptions?: VerifyTokenPayloadOptions,\n  ): Promise<AccessTokenPayload> {\n    const [tokenType, token] = parseAuthorizationHeader(\n      httpHeaders['authorization'],\n    )\n    try {\n      const dpopProof = await this.checkDpopProof(\n        httpMethod,\n        httpUrl,\n        httpHeaders,\n        token,\n      )\n\n      const tokenPayload = await this.decodeToken(tokenType, token, dpopProof)\n\n      this.verifyTokenPayload(tokenType, tokenPayload, verifyOptions)\n\n      return tokenPayload\n    } catch (err) {\n      if (err instanceof UseDpopNonceError) throw err.toWwwAuthenticateError()\n      if (err instanceof WWWAuthenticateError) throw err\n\n      throw InvalidTokenError.from(err, tokenType)\n    }\n  }\n\n  protected verifyTokenPayload(\n    tokenType: OAuthTokenType,\n    tokenPayload: AccessTokenPayload,\n    options?: VerifyTokenPayloadOptions,\n  ): void {\n    if (options?.audience) {\n      const { aud } = tokenPayload\n      const hasMatch =\n        aud != null &&\n        (Array.isArray(aud)\n          ? options.audience.some(includedIn, aud)\n          : options.audience.includes(aud))\n      if (!hasMatch) {\n        const details = `(got: ${aud}, expected one of: ${options.audience})`\n        throw new InvalidTokenError(tokenType, `Invalid audience ${details}`)\n      }\n    }\n\n    if (options?.scope) {\n      const { scope } = tokenPayload\n      const scopes = scope?.split(' ')\n      if (!scopes || !options.scope.some(includedIn, scopes)) {\n        const details = `(got: ${scope}, expected one of: ${options.scope})`\n        throw new InvalidTokenError(tokenType, `Invalid scope ${details}`)\n      }\n    }\n\n    if (tokenPayload.exp != null && tokenPayload.exp * 1000 <= Date.now()) {\n      const expirationDate = new Date(tokenPayload.exp * 1000).toISOString()\n      throw new InvalidTokenError(\n        tokenType,\n        `Token expired at ${expirationDate}`,\n      )\n    }\n  }\n}\n"]}

package/dist/oidc/sub.js.map

@@ -1 +1 @@
-{"version":3,"file":"sub.js","sourceRoot":"","sources":["../../src/oidc/sub.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AAEV,QAAA,SAAS,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"sub.js","sourceRoot":"","sources":["../../src/oidc/sub.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AAEV,QAAA,SAAS,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\n\nexport const subSchema = z.string().min(1)\nexport type Sub = z.infer<typeof subSchema>\n"]}