@atproto/oauth-provider 0.15.15 → 0.16.0

package/dist/lib/util/color.js

@@ -5,6 +5,7 @@ exports.parseHexColor = parseHexColor;
 exports.parseRgbColor = parseRgbColor;
 exports.parseRgbaColor = parseRgbaColor;
 exports.pickContrastColor = pickContrastColor;
+exports.hslToRgb = hslToRgb;
 exports.extractHue = extractHue;
 const ui8_js_1 = require("./ui8.js");
 function parseColor(color) {
@@ -66,10 +67,41 @@ function parseRgbaColor(v) {
 function pickContrastColor(ref, a, b) {
     return computeContrastRatio(ref, a) > computeContrastRatio(ref, b) ? a : b;
 }
+function hslToRgb(input) {
+    const { h, s, l } = input;
+    // Achromatic (gray)
+    if (s === 0) {
+        const gray = Math.round(l * 255);
+        return 'a' in input
+            ? { r: gray, g: gray, b: gray, a: input.a }
+            : { r: gray, g: gray, b: gray };
+    }
+    const hueToRgb = (p, q, t) => {
+        if (t < 0)
+            t += 1;
+        if (t > 1)
+            t -= 1;
+        if (t < 1 / 6)
+            return p + (q - p) * 6 * t;
+        if (t < 1 / 2)
+            return q;
+        if (t < 2 / 3)
+            return p + (q - p) * (2 / 3 - t) * 6;
+        return p;
+    };
+    const q = l < 0.5 ? l * (1 + s) : l + s - l * s;
+    const p = 2 * l - q;
+    const hNorm = h / 360;
+    const r = Math.round(hueToRgb(p, q, hNorm + 1 / 3) * 255);
+    const g = Math.round(hueToRgb(p, q, hNorm) * 255);
+    const b = Math.round(hueToRgb(p, q, hNorm - 1 / 3) * 255);
+    return 'a' in input ? { r, g, b, a: input.a } : { r, g, b };
+}
 /**
  * @see {@link https://www.w3.org/TR/2008/REC-WCAG20-20081211/#relativeluminancedef}
  */
-function relativeLuminance({ r, g, b }) {
+function relativeLuminance(color) {
+    const { r, g, b } = 'h' in color ? hslToRgb(color) : color;
     return rgbLum(r) * 0.2126 + rgbLum(g) * 0.7152 + rgbLum(b) * 0.0722;
 }
 function rgbLum(value) {

package/dist/lib/util/color.js.map

@@ -1 +1 @@
-{"version":3,"file":"color.js","sourceRoot":"","sources":["../../../src/lib/util/color.ts"],"names":[],"mappings":";;AAOA,gCAeC;AAED,sCAuBC;AAED,sCAQC;AAED,wCAWC;AAKD,8CAEC;AAwBD,gCA8BC;AAnID,qCAAmD;AAOnD,SAAgB,UAAU,CAAC,KAAa;IACtC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IAED,qEAAqE;IACrE,MAAM,IAAI,SAAS,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,SAAgB,aAAa,CAAC,CAAS;IACrC,wEAAwE;IACxE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAChE,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAA;IACjD,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAA;IACjD,CAAC;IAED,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,SAAgB,aAAa,CAAC,CAAS;IACrC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAA;IAC7E,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAA;IAElE,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAA;AACpB,CAAC;AAED,SAAgB,cAAc,CAAC,CAAS;IACtC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CACrB,iEAAiE,CAClE,CAAA;IACD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAA;IAEnE,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAA;AACvB,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,GAAa,EAAE,CAAW,EAAE,CAAW;IACvE,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5E,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAY;IAC9C,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;AACrE,CAAC;AAED,SAAS,MAAM,CAAC,KAAK;IACnB,MAAM,GAAG,GAAG,KAAK,GAAG,GAAG,CAAA;IACvB,OAAO,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,CAAA;AAC3E,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,CAAW,EAAE,CAAW;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACnE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;AAC3C,CAAC;AAED,SAAgB,UAAU,CAAC,KAAe;IACxC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,GAAG,CAAA;IACvB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,GAAG,CAAA;IACvB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,GAAG,CAAA;IAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAE7B,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAA;IAExB,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,GAAG;YACN,OAAO,CAAC,CAAA,CAAC,aAAa;QACxB,KAAK,CAAC,CAAC,CAAC,CAAC;YACP,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAA;YAChC,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;YAC7C,OAAO,EAAE,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,CAAC,CAAC,CAAC,CAAC;YACP,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAA;YAChC,MAAM,KAAK,GAAG,GAAG,GAAG,EAAE,CAAA;YACtB,OAAO,EAAE,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,CAAA;QAC/B,CAAC;QACD,6EAA6E;QAC7E,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAA;YAChC,MAAM,KAAK,GAAG,GAAG,GAAG,EAAE,CAAA;YACtB,OAAO,EAAE,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { parseUi8Dec, parseUi8Hex } from './ui8.js'\n\nexport type RgbColor = { r: number; g: number; b: number }\nexport type HslColor = { h: number; s: number; l: number }\nexport type RgbaColor = { r: number; g: number; b: number; a: number }\nexport type HslaColor = { h: number; s: number; l: number; a: number }\n\nexport function parseColor(color: string): RgbColor | RgbaColor {\n  if (color.startsWith('#')) {\n    return parseHexColor(color)\n  }\n\n  if (color.startsWith('rgba(')) {\n    return parseRgbaColor(color)\n  }\n\n  if (color.startsWith('rgb(')) {\n    return parseRgbColor(color)\n  }\n\n  // Should never happen (as long as the input is a validated WebColor)\n  throw new TypeError(`Invalid color value: ${color}`)\n}\n\nexport function parseHexColor(v: string): RgbColor | RgbaColor {\n  // parseInt('az', 16) does not return NaN so we need to check the format\n  if (!/^#[0-9a-f]+$/i.test(v)) {\n    throw new TypeError(`Invalid hex color value: ${v}`)\n  }\n\n  if (v.length === 4 || v.length === 5) {\n    const r = parseUi8Hex(v[1].repeat(2))\n    const g = parseUi8Hex(v[2].repeat(2))\n    const b = parseUi8Hex(v[3].repeat(2))\n    const a = v.length > 4 ? parseUi8Hex(v[4].repeat(2)) : undefined\n    return a == null ? { r, g, b } : { r, g, b, a }\n  }\n\n  if (v.length === 7 || v.length === 9) {\n    const r = parseUi8Hex(v.slice(1, 3))\n    const g = parseUi8Hex(v.slice(3, 5))\n    const b = parseUi8Hex(v.slice(5, 7))\n    const a = v.length > 8 ? parseUi8Hex(v.slice(7, 9)) : undefined\n    return a == null ? { r, g, b } : { r, g, b, a }\n  }\n\n  throw new TypeError(`Invalid hex color value: ${v}`)\n}\n\nexport function parseRgbColor(v: string): RgbColor {\n  const matches = v.match(/^\\s*rgb\\(\\s*(\\d+)\\s*,\\s*(\\d+)\\s*,\\s*(\\d+)\\s*\\)\\s*$/)\n  if (!matches) throw new TypeError(`Invalid rgb color value: ${v}`)\n\n  const r = parseUi8Dec(matches[1])\n  const g = parseUi8Dec(matches[2])\n  const b = parseUi8Dec(matches[3])\n  return { r, g, b }\n}\n\nexport function parseRgbaColor(v: string): RgbaColor {\n  const matches = v.match(\n    /^\\s*rgba\\(\\s*(\\d+)\\s*,\\s*(\\d+)\\s*,\\s*(\\d+)\\s*,\\s*(\\d+)\\s*\\)\\s*$/,\n  )\n  if (!matches) throw new TypeError(`Invalid rgba color value: ${v}`)\n\n  const r = parseUi8Dec(matches[1])\n  const g = parseUi8Dec(matches[2])\n  const b = parseUi8Dec(matches[3])\n  const a = parseUi8Dec(matches[4])\n  return { r, g, b, a }\n}\n\n/**\n * Return the color that has the best contrast with the reference color.\n */\nexport function pickContrastColor(ref: RgbColor, a: RgbColor, b: RgbColor) {\n  return computeContrastRatio(ref, a) > computeContrastRatio(ref, b) ? a : b\n}\n\n/**\n * @see {@link https://www.w3.org/TR/2008/REC-WCAG20-20081211/#relativeluminancedef}\n */\nfunction relativeLuminance({ r, g, b }: RgbColor) {\n  return rgbLum(r) * 0.2126 + rgbLum(g) * 0.7152 + rgbLum(b) * 0.0722\n}\n\nfunction rgbLum(value) {\n  const rgb = value / 255\n  return rgb < 0.03928 ? rgb / 12.92 : Math.pow((rgb + 0.055) / 1.055, 2.4)\n}\n\n/**\n * @see {@link https://www.w3.org/TR/2008/REC-WCAG20-20081211/#contrast-ratiodef}\n */\nfunction computeContrastRatio(a: RgbColor, b: RgbColor) {\n  const aLum = relativeLuminance(a)\n  const bLum = relativeLuminance(b)\n  const [lighter, darker] = aLum > bLum ? [aLum, bLum] : [bLum, aLum]\n  return (lighter + 0.05) / (darker + 0.05)\n}\n\nexport function extractHue(input: RgbColor): number {\n  const r = input.r / 255\n  const g = input.g / 255\n  const b = input.b / 255\n\n  const max = Math.max(r, g, b)\n  const min = Math.min(r, g, b)\n\n  const chroma = max - min\n\n  switch (max) {\n    case min:\n      return 0 // Achromatic\n    case r: {\n      const segment = (g - b) / chroma\n      const shift = segment < 0 ? 360 / 60 : 0 / 60\n      return 60 * (segment + shift)\n    }\n    case g: {\n      const segment = (b - r) / chroma\n      const shift = 120 / 60\n      return 60 * (segment + shift)\n    }\n    // \"default\" needed for type safety. In practice, should be same as \"case b:\"\n    default: {\n      const segment = (r - g) / chroma\n      const shift = 240 / 60\n      return 60 * (segment + shift)\n    }\n  }\n}\n"]}
+{"version":3,"file":"color.js","sourceRoot":"","sources":["../../../src/lib/util/color.ts"],"names":[],"mappings":";;AASA,gCAeC;AAED,sCAuBC;AAED,sCAQC;AAED,wCAWC;AAKD,8CAEC;AAID,4BA6BC;AAyBD,gCA8BC;AAvKD,qCAAmD;AASnD,SAAgB,UAAU,CAAC,KAAa;IACtC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IAED,qEAAqE;IACrE,MAAM,IAAI,SAAS,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,SAAgB,aAAa,CAAC,CAAS;IACrC,wEAAwE;IACxE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAChE,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAA;IACjD,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAA;IACjD,CAAC;IAED,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,SAAgB,aAAa,CAAC,CAAS;IACrC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAA;IAC7E,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAA;IAElE,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAA;AACpB,CAAC;AAED,SAAgB,cAAc,CAAC,CAAS;IACtC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CACrB,iEAAiE,CAClE,CAAA;IACD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAA;IAEnE,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAA;AACvB,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,GAAa,EAAE,CAAW,EAAE,CAAW;IACvE,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5E,CAAC;AAID,SAAgB,QAAQ,CAAC,KAA2B;IAClD,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,CAAA;IAEzB,oBAAoB;IACpB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;QAChC,OAAO,GAAG,IAAI,KAAK;YACjB,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAU,EAAE;QAC3D,IAAI,CAAC,GAAG,CAAC;YAAE,CAAC,IAAI,CAAC,CAAA;QACjB,IAAI,CAAC,GAAG,CAAC;YAAE,CAAC,IAAI,CAAC,CAAA;QACjB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;QACnD,OAAO,CAAC,CAAA;IACV,CAAC,CAAA;IAED,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACnB,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAA;IAErB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;IACzD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,CAAA;IACjD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;IAEzD,OAAO,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAA;AAC7D,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,KAA0B;IACnD,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC1D,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;AACrE,CAAC;AAED,SAAS,MAAM,CAAC,KAAK;IACnB,MAAM,GAAG,GAAG,KAAK,GAAG,GAAG,CAAA;IACvB,OAAO,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,CAAA;AAC3E,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,CAAW,EAAE,CAAW;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACnE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;AAC3C,CAAC;AAED,SAAgB,UAAU,CAAC,KAAe;IACxC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,GAAG,CAAA;IACvB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,GAAG,CAAA;IACvB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,GAAG,CAAA;IAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAE7B,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAA;IAExB,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,GAAG;YACN,OAAO,CAAC,CAAA,CAAC,aAAa;QACxB,KAAK,CAAC,CAAC,CAAC,CAAC;YACP,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAA;YAChC,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;YAC7C,OAAO,EAAE,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,CAAC,CAAC,CAAC,CAAC;YACP,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAA;YAChC,MAAM,KAAK,GAAG,GAAG,GAAG,EAAE,CAAA;YACtB,OAAO,EAAE,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,CAAA;QAC/B,CAAC;QACD,6EAA6E;QAC7E,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAA;YAChC,MAAM,KAAK,GAAG,GAAG,GAAG,EAAE,CAAA;YACtB,OAAO,EAAE,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { parseUi8Dec, parseUi8Hex } from './ui8.js'\n\nexport type RgbColor = { r: number; g: number; b: number }\nexport type HslColor = { h: number; s: number; l: number }\nexport type RgbaColor = { r: number; g: number; b: number; a: number }\nexport type HslaColor = { h: number; s: number; l: number; a: number }\n\nexport type Color = RgbColor | HslColor | RgbaColor | HslaColor\n\nexport function parseColor(color: string): RgbColor | RgbaColor {\n  if (color.startsWith('#')) {\n    return parseHexColor(color)\n  }\n\n  if (color.startsWith('rgba(')) {\n    return parseRgbaColor(color)\n  }\n\n  if (color.startsWith('rgb(')) {\n    return parseRgbColor(color)\n  }\n\n  // Should never happen (as long as the input is a validated WebColor)\n  throw new TypeError(`Invalid color value: ${color}`)\n}\n\nexport function parseHexColor(v: string): RgbColor | RgbaColor {\n  // parseInt('az', 16) does not return NaN so we need to check the format\n  if (!/^#[0-9a-f]+$/i.test(v)) {\n    throw new TypeError(`Invalid hex color value: ${v}`)\n  }\n\n  if (v.length === 4 || v.length === 5) {\n    const r = parseUi8Hex(v[1].repeat(2))\n    const g = parseUi8Hex(v[2].repeat(2))\n    const b = parseUi8Hex(v[3].repeat(2))\n    const a = v.length > 4 ? parseUi8Hex(v[4].repeat(2)) : undefined\n    return a == null ? { r, g, b } : { r, g, b, a }\n  }\n\n  if (v.length === 7 || v.length === 9) {\n    const r = parseUi8Hex(v.slice(1, 3))\n    const g = parseUi8Hex(v.slice(3, 5))\n    const b = parseUi8Hex(v.slice(5, 7))\n    const a = v.length > 8 ? parseUi8Hex(v.slice(7, 9)) : undefined\n    return a == null ? { r, g, b } : { r, g, b, a }\n  }\n\n  throw new TypeError(`Invalid hex color value: ${v}`)\n}\n\nexport function parseRgbColor(v: string): RgbColor {\n  const matches = v.match(/^\\s*rgb\\(\\s*(\\d+)\\s*,\\s*(\\d+)\\s*,\\s*(\\d+)\\s*\\)\\s*$/)\n  if (!matches) throw new TypeError(`Invalid rgb color value: ${v}`)\n\n  const r = parseUi8Dec(matches[1])\n  const g = parseUi8Dec(matches[2])\n  const b = parseUi8Dec(matches[3])\n  return { r, g, b }\n}\n\nexport function parseRgbaColor(v: string): RgbaColor {\n  const matches = v.match(\n    /^\\s*rgba\\(\\s*(\\d+)\\s*,\\s*(\\d+)\\s*,\\s*(\\d+)\\s*,\\s*(\\d+)\\s*\\)\\s*$/,\n  )\n  if (!matches) throw new TypeError(`Invalid rgba color value: ${v}`)\n\n  const r = parseUi8Dec(matches[1])\n  const g = parseUi8Dec(matches[2])\n  const b = parseUi8Dec(matches[3])\n  const a = parseUi8Dec(matches[4])\n  return { r, g, b, a }\n}\n\n/**\n * Return the color that has the best contrast with the reference color.\n */\nexport function pickContrastColor(ref: RgbColor, a: RgbColor, b: RgbColor) {\n  return computeContrastRatio(ref, a) > computeContrastRatio(ref, b) ? a : b\n}\n\nexport function hslToRgb({ h, s, l }: HslColor): RgbColor\nexport function hslToRgb({ h, s, l, a }: HslaColor): RgbaColor\nexport function hslToRgb(input: HslaColor | HslColor): RgbColor | RgbaColor {\n  const { h, s, l } = input\n\n  // Achromatic (gray)\n  if (s === 0) {\n    const gray = Math.round(l * 255)\n    return 'a' in input\n      ? { r: gray, g: gray, b: gray, a: input.a }\n      : { r: gray, g: gray, b: gray }\n  }\n\n  const hueToRgb = (p: number, q: number, t: number): number => {\n    if (t < 0) t += 1\n    if (t > 1) t -= 1\n    if (t < 1 / 6) return p + (q - p) * 6 * t\n    if (t < 1 / 2) return q\n    if (t < 2 / 3) return p + (q - p) * (2 / 3 - t) * 6\n    return p\n  }\n\n  const q = l < 0.5 ? l * (1 + s) : l + s - l * s\n  const p = 2 * l - q\n  const hNorm = h / 360\n\n  const r = Math.round(hueToRgb(p, q, hNorm + 1 / 3) * 255)\n  const g = Math.round(hueToRgb(p, q, hNorm) * 255)\n  const b = Math.round(hueToRgb(p, q, hNorm - 1 / 3) * 255)\n\n  return 'a' in input ? { r, g, b, a: input.a } : { r, g, b }\n}\n\n/**\n * @see {@link https://www.w3.org/TR/2008/REC-WCAG20-20081211/#relativeluminancedef}\n */\nfunction relativeLuminance(color: HslColor | RgbColor) {\n  const { r, g, b } = 'h' in color ? hslToRgb(color) : color\n  return rgbLum(r) * 0.2126 + rgbLum(g) * 0.7152 + rgbLum(b) * 0.0722\n}\n\nfunction rgbLum(value) {\n  const rgb = value / 255\n  return rgb < 0.03928 ? rgb / 12.92 : Math.pow((rgb + 0.055) / 1.055, 2.4)\n}\n\n/**\n * @see {@link https://www.w3.org/TR/2008/REC-WCAG20-20081211/#contrast-ratiodef}\n */\nfunction computeContrastRatio(a: RgbColor, b: RgbColor) {\n  const aLum = relativeLuminance(a)\n  const bLum = relativeLuminance(b)\n  const [lighter, darker] = aLum > bLum ? [aLum, bLum] : [bLum, aLum]\n  return (lighter + 0.05) / (darker + 0.05)\n}\n\nexport function extractHue(input: RgbColor): number {\n  const r = input.r / 255\n  const g = input.g / 255\n  const b = input.b / 255\n\n  const max = Math.max(r, g, b)\n  const min = Math.min(r, g, b)\n\n  const chroma = max - min\n\n  switch (max) {\n    case min:\n      return 0 // Achromatic\n    case r: {\n      const segment = (g - b) / chroma\n      const shift = segment < 0 ? 360 / 60 : 0 / 60\n      return 60 * (segment + shift)\n    }\n    case g: {\n      const segment = (b - r) / chroma\n      const shift = 120 / 60\n      return 60 * (segment + shift)\n    }\n    // \"default\" needed for type safety. In practice, should be same as \"case b:\"\n    default: {\n      const segment = (r - g) / chroma\n      const shift = 240 / 60\n      return 60 * (segment + shift)\n    }\n  }\n}\n"]}

package/dist/oauth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,OAAO,EAEL,gBAAgB,EAChB,uCAAuC,EACvC,4BAA4B,EAC5B,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,kCAAkC,EAClC,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EAGf,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,aAAa,EAEd,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EACL,aAAa,EACb,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAS3C,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EACL,aAAa,EACb,kBAAkB,EAEnB,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EACL,UAAU,EACV,aAAa,EACb,oBAAoB,EACrB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AASrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAGvD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAiB,MAAM,8BAA8B,CAAA;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EACL,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAErE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AAEzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAA;AAC/F,OAAO,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAA;AAClG,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAA;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EACL,UAAU,EAGX,MAAM,wBAAwB,CAAA;AAG/B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAC/C,YAAY,EACV,kBAAkB,EAClB,+BAA+B,EAC/B,gCAAgC,IAAI,4BAA4B,EAChE,2BAA2B,EAC3B,QAAQ,EACR,aAAa,EACb,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,gCAAgC,EAChC,yBAAyB,GAC1B,CAAA;AAED,KAAK,mBAAmB,GAAG;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;OAEG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAEnC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,MAAM,CAAA;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CACb,YAAY,GACV,WAAW,GACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,UAAU,CACb,CAAA;IAED,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,UAAU,CAAC,EAAE,UAAU,CAAA;IAEvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAE3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,sBAAsB,CAAA;CACzD,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GACpD,oBAAoB,GACpB,UAAU,GACV,oBAAoB,GACpB,kBAAkB,CAAA;AAEpB,qBAAa,aAAc,SAAQ,aAAa;IAC9C,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACnD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAEpC,SAAgB,QAAQ,EAAE,gCAAgC,CAAA;IAC1D,SAAgB,aAAa,EAAE,aAAa,CAAA;IAE5C,SAAgB,oBAAoB,EAAE,MAAM,CAAA;IAE5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,YAAY,EAAE,YAAY,CAAA;gBAEvB,EAEjB,oBAA6C,EAC7C,WAA2B,EAC3B,eAA2C,EAE3C,QAAQ,EAER,SAA2B,EAC3B,KAAK,EAAE,gCAAgC;IACvC,WAAmD,EAGnD,YAAoC,EACpC,WAAkC,EAClC,YAAoC,EACpC,UAAgC,EAChC,YAAoC,EAGpC,WAAkC,EAClC,WAAkC,EAElC,eAGE,EACF,mBAGE,EAEF,gBAAgD,EAMhD,GAAG,IAAI,EACR,EAAE,oBAAoB;IA4DvB,IAAI,IAAI;;;;;eArTH,CAAC;eACkB,CAAC;eAEhB,CAAC;mBACsB,CAAC;eAKjC,CAAA;eACe,CAAC;sBAA4C,CAAC;eAG3D,CAAC;eACe,CAAC;eACe,CAAC;eACL,CAAC;eAErB,CAAC;mBAGb,CAAA;;sBAC0B,CAAC;;aACR,CAAC;aAAmC,CAAC;aAAmC,CAAC;cACzD,CAAC;cACjC,CAAC;cAAoC,CAAC;eACrC,CAAC;iBAAqB,CAAC;iBAAuC,CAAC;iBACjD,CAAC;;;;;aAEd,CAAC;;;;;;eAEqB,CAAC;eACJ,CAAC;eAAqC,CAAC;mBAC1B,CAAC;eAGnC,CAAC;eAAuC,CAAC;sBACN,CAAC;eAClB,CAAC;eAAqC,CAAC;eACtC,CAAA;eAElB,CAAC;eAEO,CAAC;mBAEX,CAAA;;sBACkC,CAAA;;aACR,CAAC;;;;aAEN,CAAA;;;;;;eAEc,CAAC;eAAuC,CAAC;eAC3D,CAAC;mBAAgD,CAAC;eAExD,CAAC;eAAuC,CAAC;sBACb,CAAC;eACjC,CAAC;eAAqC,CAAC;eACZ,CAAC;eAE5B,CAAC;eAEO,CAAC;mBAEb,CAAC;;sBAEN,CAAC;;aAEC,CAAA;;;;aAE6C,CAAC;;;;;eAM9B,CAAC;eAGjB,CAAA;eACkB,CAAC;mBAIpB,CAAC;eAKA,CAAC;eAGA,CAAC;sBAA4C,CAAC;eAExC,CAAC;eAGO,CAAC;eAAsC,CAAC;eACzC,CAAC;eAAqC,CAAC;mBACrC,CAAC;;sBAChB,CAAD;;aAA+D,CAAA;;;;aAGvD,CAAC;;OAiNR;IAED;;OAEG;IACI,oBAAoB,CACzB,UAAU,EAAE,mCAAmC,EAC/C,UAAU,CAAC,EAAE,oBAAoB;IAiB5B,kBAAkB,CAAC,aAAa,EAAE,aAAa;cAKtC,kBAAkB,CAChC,iBAAiB,EAAE,sBAAsB,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,CAAC,EAAE;QACR,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAChC,GACA,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;KACvB,CAAC;IAgDI,SAAS,CACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,mCAAmC,CAAC;IA0B/C;;OAEG;IACU,0BAA0B,CACrC,WAAW,EAAE,sBAAsB,EACnC,oBAAoB,EAAE,4BAA4B,EAClD,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,gBAAgB,CAAC;YAgEd,2BAA2B;IA6CzC;;OAEG;IACU,SAAS,CACpB,KAAK,EAAE,8BAA8B,EACrC,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,UAAU,GACvC,OAAO,CAAC,2BAA2B,GAAG,gCAAgC,CAAC;IA0J7D,KAAK,CAChB,iBAAiB,EAAE,sBAAsB,EACzC,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;cA2Cd,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,EAAE;QACP,UAAU,EAAE,mCAAmC,CAAA;QAC/C,QAAQ,EAAE,QAAQ,CAAA;QAClB,UAAU,EAAE,IAAI,GAAG,UAAU,GAAG,gBAAgB,CAAA;KACjD,GACA,OAAO,CAAC,IAAI,CAAC;cA+DA,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uCAAuC,EAC9C,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;cA+Dd,iBAAiB,CAC/B,UAAU,EAAE,mCAAmC,EAC/C,KAAK,EAAE,uCAAuC,GAC7C,OAAO,CAAC,IAAI,CAAC;cAmDA,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,kCAAkC,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;cA4Bd,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC;IAoBhB;;OAEG;IACU,MAAM,CACjB,iBAAiB,EAAE,sBAAsB,EACzC,EAAE,KAAK,EAAE,EAAE,wBAAwB,EACnC,SAAS,EAAE,IAAI,GAAG,SAAS;cAuBJ,WAAW,CAClC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;CAmB/B"}
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,OAAO,EAEL,gBAAgB,EAChB,uCAAuC,EACvC,4BAA4B,EAC5B,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,kCAAkC,EAClC,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EAGf,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,aAAa,EAEd,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EACL,aAAa,EACb,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAS3C,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EACL,aAAa,EACb,kBAAkB,EAEnB,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EACL,UAAU,EACV,aAAa,EACb,oBAAoB,EACrB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AASrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAGvD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAiB,MAAM,8BAA8B,CAAA;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EACL,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAErE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AAEzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAA;AAC/F,OAAO,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAA;AAClG,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAA;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EACL,UAAU,EAGX,MAAM,wBAAwB,CAAA;AAG/B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAC/C,YAAY,EACV,kBAAkB,EAClB,+BAA+B,EAC/B,gCAAgC,IAAI,4BAA4B,EAChE,2BAA2B,EAC3B,QAAQ,EACR,aAAa,EACb,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,gCAAgC,EAChC,yBAAyB,GAC1B,CAAA;AAED,KAAK,mBAAmB,GAAG;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;OAEG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAEnC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,MAAM,CAAA;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CACb,YAAY,GACV,WAAW,GACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,UAAU,CACb,CAAA;IAED,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,UAAU,CAAC,EAAE,UAAU,CAAA;IAEvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAE3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,sBAAsB,CAAA;CACzD,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GACpD,oBAAoB,GACpB,UAAU,GACV,oBAAoB,GACpB,kBAAkB,CAAA;AAEpB,qBAAa,aAAc,SAAQ,aAAa;IAC9C,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACnD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAEpC,SAAgB,QAAQ,EAAE,gCAAgC,CAAA;IAC1D,SAAgB,aAAa,EAAE,aAAa,CAAA;IAE5C,SAAgB,oBAAoB,EAAE,MAAM,CAAA;IAE5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,YAAY,EAAE,YAAY,CAAA;gBAEvB,EAEjB,oBAA6C,EAC7C,WAA2B,EAC3B,eAA2C,EAE3C,QAAQ,EAER,SAA2B,EAC3B,KAAK,EAAE,gCAAgC;IACvC,WAAmD,EAGnD,YAAoC,EACpC,WAAkC,EAClC,YAAoC,EACpC,UAAgC,EAChC,YAAoC,EAGpC,WAAkC,EAClC,WAAkC,EAElC,eAGE,EACF,mBAGE,EAEF,gBAAgD,EAMhD,GAAG,IAAI,EACR,EAAE,oBAAoB;IA4DvB,IAAI,IAAI;;;;;eArTH,CAAC;eACkB,CAAC;eAEhB,CAAC;mBACsB,CAAC;eAKjC,CAAA;eACe,CAAC;sBAA4C,CAAC;eAG3D,CAAC;eACe,CAAC;eACe,CAAC;eACL,CAAC;eAErB,CAAC;mBAGb,CAAA;;sBAC0B,CAAC;;aACR,CAAC;aAAmC,CAAC;aAAmC,CAAC;cACzD,CAAC;cACjC,CAAC;cAAoC,CAAC;eACrC,CAAC;iBAAqB,CAAC;iBAAuC,CAAC;iBACjD,CAAC;;;;;aAEd,CAAC;;;;;;eAEqB,CAAC;eACJ,CAAC;eAAqC,CAAC;mBAC1B,CAAC;eAGnC,CAAC;eAAuC,CAAC;sBACN,CAAC;eAClB,CAAC;eAAqC,CAAC;eACtC,CAAA;eAElB,CAAC;eAEO,CAAC;mBAEX,CAAA;;sBACkC,CAAA;;aACR,CAAC;;;;aAEN,CAAA;;;;;;eAEc,CAAC;eAAuC,CAAC;eAC3D,CAAC;mBAAgD,CAAC;eAExD,CAAC;eAAuC,CAAC;sBACb,CAAC;eACjC,CAAC;eAAqC,CAAC;eACZ,CAAC;eAE5B,CAAC;eAEO,CAAC;mBAEb,CAAC;;sBAEN,CAAC;;aAEC,CAAA;;;;aAE6C,CAAC;;;;;eAM9B,CAAC;eAGjB,CAAA;eACkB,CAAC;mBAIpB,CAAC;eAKA,CAAC;eAGA,CAAC;sBAA4C,CAAC;eAExC,CAAC;eAGO,CAAC;eAAsC,CAAC;eACzC,CAAC;eAAqC,CAAC;mBACrC,CAAC;;sBAChB,CAAD;;aAA+D,CAAA;;;;aAGvD,CAAC;;OAiNR;IAED;;OAEG;IACI,oBAAoB,CACzB,UAAU,EAAE,mCAAmC,EAC/C,UAAU,CAAC,EAAE,oBAAoB;IAiB5B,kBAAkB,CAAC,aAAa,EAAE,aAAa;cAKtC,kBAAkB,CAChC,iBAAiB,EAAE,sBAAsB,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,CAAC,EAAE;QACR,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAChC,GACA,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;KACvB,CAAC;IAgDI,SAAS,CACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,mCAAmC,CAAC;IA0B/C;;OAEG;IACU,0BAA0B,CACrC,WAAW,EAAE,sBAAsB,EACnC,oBAAoB,EAAE,4BAA4B,EAClD,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,gBAAgB,CAAC;YAgEd,2BAA2B;IA6CzC;;OAEG;IACU,SAAS,CACpB,KAAK,EAAE,8BAA8B,EACrC,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,UAAU,GACvC,OAAO,CAAC,2BAA2B,GAAG,gCAAgC,CAAC;IAoJ7D,KAAK,CAChB,iBAAiB,EAAE,sBAAsB,EACzC,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;cA2Cd,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,EAAE;QACP,UAAU,EAAE,mCAAmC,CAAA;QAC/C,QAAQ,EAAE,QAAQ,CAAA;QAClB,UAAU,EAAE,IAAI,GAAG,UAAU,GAAG,gBAAgB,CAAA;KACjD,GACA,OAAO,CAAC,IAAI,CAAC;cA+DA,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uCAAuC,EAC9C,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;cA+Dd,iBAAiB,CAC/B,UAAU,EAAE,mCAAmC,EAC/C,KAAK,EAAE,uCAAuC,GAC7C,OAAO,CAAC,IAAI,CAAC;cAmDA,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,kCAAkC,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;cA4Bd,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC;IAoBhB;;OAEG;IACU,MAAM,CACjB,iBAAiB,EAAE,sBAAsB,EACzC,EAAE,KAAK,EAAE,EAAE,wBAAwB,EACnC,SAAS,EAAE,IAAI,GAAG,SAAS;cAuBJ,WAAW,CAClC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;CAmB/B"}

package/dist/oauth-provider.js

@@ -333,17 +333,12 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                 client,
                 parameters,
                 requestUri,
-                sessions: sessions.map((session) => ({
-                    // Map to avoid leaking other data that might be present in the session
-                    account: session.account,
-                    loginRequired: session.loginRequired,
-                    consentRequired: session.consentRequired,
-                    selected: parameters.prompt == null ||
-                        parameters.prompt === 'login' ||
-                        parameters.prompt === 'consent'
-                        ? matchesHint.call(parameters, session)
-                        : false,
-                })),
+                sessions,
+                selectedSub: parameters.prompt == null ||
+                    parameters.prompt === 'login' ||
+                    parameters.prompt === 'consent'
+                    ? sessions.find(matchesHint, parameters)?.account.sub
+                    : undefined,
                 permissionSets: await this.lexiconManager
                     .getPermissionSetsFromScope(parameters.scope)
                     .catch((cause) => {

package/dist/oauth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":";;;AAAA,6CAAwC;AAExC,sCAA2C;AAyGjB,uFAzGX,YAAM,OAyGW;AAxGhC,wDAAmD;AAwGjB,4FAxGzB,0BAAW,OAwGyB;AAtG7C,sDAmB6B;AAC7B,yDAAwD;AAExD,2EAAqE;AACrE,8EAAqE;AA+E5D,gGA/EA,sCAAe,OA+EA;AA9ExB,qEAA6D;AAC7D,iEAKmC;AAGnC,kEAGmC;AACnC,8DAAqE;AAErE,iDAOuB;AAEvB,uEAIyC;AAEzC,kEAImC;AACnC,8DAAqE;AACrE,sGAA4F;AAC5F,4EAAoE;AACpE,kFAAyE;AACzE,kGAAuF;AACvF,sFAA4E;AAC5E,4EAAmE;AACnE,gFAAuE;AACvE,8EAAqE;AACrE,qEAA6D;AAC7D,iEAAyE;AAGzE,gDAA0D;AAC1D,kDAAiD;AAEjD,oEAA4E;AAE5E,2DAK4B;AAC5B,8DAAqE;AACrE,+CAA8C;AAC9C,qEAA6D;AAC7D,iEAAyE;AACzE,6DAA0D;AAO1D,+DAAuD;AACvD,2DAI+B;AAC/B,yEAAkE;AAmIlE,MAAa,aAAc,SAAQ,iCAAa;IAC3B,eAAe,CAAiB;IAChC,KAAK,CAAY;IAEpB,QAAQ,CAAkC;IAC1C,aAAa,CAAe;IAE5B,oBAAoB,CAAQ;IAE5B,cAAc,CAAgB;IAC9B,aAAa,CAAe;IAC5B,aAAa,CAAe;IAC5B,cAAc,CAAgB;IAC9B,cAAc,CAAgB;IAC9B,YAAY,CAAc;IAE1C,YAAmB;IACjB,sBAAsB;IACtB,oBAAoB,GAAG,qCAAsB,EAC7C,WAAW,GAAG,4BAAa,EAC3B,eAAe,GAAG,sCAAe,CAAC,SAAS,EAE3C,QAAQ,EAER,SAAS,GAAG,IAAA,0BAAa,GAAE,EAC3B,KAAK,EAAE,gCAAgC;IACvC,WAAW,GAAG,IAAI,0BAAW,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAEnD,kBAAkB;IAClB,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC,EACpC,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAClC,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC,EACpC,UAAU,GAAG,IAAA,6BAAY,EAAC,KAAK,CAAC,EAChC,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC;IAEpC,kBAAkB;IAClB,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAClC,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAElC,eAAe,GAAG,IAAI,uCAAiB,CAAC;QACtC,OAAO,EAAE,UAAU;QACnB,GAAG,EAAE,KAAK;KACX,CAAC,EACF,mBAAmB,GAAG,IAAI,uCAAiB,CAAC;QAC1C,OAAO,EAAE,UAAU;QACnB,GAAG,EAAE,KAAK;KACX,CAAC,EAEF,gBAAgB,GAAG,2CAA6B;IAEhD,eAAe;IACf,yBAAyB;IACzB,yBAAyB;IACzB,gBAAgB;IAChB,GAAG,IAAI,EACc;QACrB,KAAK,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;QAE/B,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,qEAAqE;QACrE,sCAAsC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QAEjB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAA;QACtC,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAA;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAA,iCAAa,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACjE,IAAI,CAAC,aAAa,GAAG,sCAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAEpD,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CAAC,WAAW,EAAE;YAClD,GAAG,IAAI;YACP,MAAM,EAAE;gBACN,GAAG,IAAI,CAAC,MAAM;gBACd,wEAAwE;gBACxE,qEAAqE;gBACrE,qEAAqE;gBACrE,gDAAgD;gBAChD,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;aACzC;SACF,CAAC,CAAA;QACF,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CACtC,IAAI,CAAC,MAAM,EACX,YAAY,EACZ,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,CACnB,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CACpC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,KAAK,EACV,WAAW,IAAI,IAAI,EACnB,gBAAgB,IAAI,IAAI,EACxB,SAAS,EACT,eAAe,EACf,mBAAmB,CACpB,CAAA;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QACnE,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CACtC,YAAY,EACZ,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACX,CAAA;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,+BAAY,CAClC,UAAU,EACV,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,eAAe,EACpB,WAAW,CACZ,CAAA;IACH,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAA;IAC/B,CAAC;IAED;;OAEG;IACI,oBAAoB,CACzB,UAA+C,EAC/C,UAAiC;QAEjC,qCAAqC;QACrC,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QAE5B,sCAAsC;QACtC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAEhD,uEAAuE;QACvE,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;QACpD,IAAI,eAAe,IAAI,IAAI;YAAE,OAAO,KAAK,CAAA;QAEzC,0EAA0E;QAC1E,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAA;QACvC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5E,CAAC;IAEM,kBAAkB,CAAC,aAA4B;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QAC9D,OAAO,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAA;IAC5C,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,iBAAyC,EACzC,SAA2B,EAC3B,OAEC;QAKD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAC/C,iBAAiB,CAAC,SAAS,CAC5B,CAAA;QAED,IACE,MAAM,CAAC,QAAQ,CAAC,wBAAwB;YACxC,CAAC,SAAS;YACV,CAAC,OAAO,EAAE,qBAAqB,EAC/B,CAAC;YACD,MAAM,IAAI,mDAAqB,CAAC,qBAAqB,CAAC,CAAA;QACxD,CAAC;QAED,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;YAC3D,MAAM,IAAI,mDAAqB,CAAC,wCAAwC,CAAC,CAAA;QAC3E,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,iBAAiB,EAAE;YAC9D,6BAA6B,EAAE,IAAI,CAAC,MAAM;SAC3C,CAAC,CAAA;QAEF,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAC5C,sEAAsE;YACtE,IAAI,SAAS,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;gBAClD,MAAM,IAAI,8CAAmB,CAC3B,8EAA8E,CAC/E,CAAA;YACH,CAAC;YAED,wDAAwD;YACxD,oEAAoE;YACpE,qEAAqE;YACrE,yEAAyE;YACzE,yCAAyC;YAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAChD,UAAU,CAAC,GAAG,EACd,MAAM,CAAC,EAAE,EACT,UAAU,CAAC,GAAG,CACf,CAAA;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0CAAiB,CAAC,GAAG,UAAU,CAAC,MAAM,aAAa,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,SAAS,CACb,MAAc,EACd,KAAmC;QAEnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAClD,KAAK,CAAC,OAAO,EACb,IAAI,CAAC,MAAM,CACZ,CAAA;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,8CAAmB,CAC3B,mDAAmD,CACpD,CAAA;QACH,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,8CAAmB,CAAC,6BAA6B,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,uDAAyC;aAC/D,UAAU,CAAC,OAAO,CAAC;aACnB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,GAAG,GAAG,IAAA,sBAAW,EAAC,GAAG,EAAE,2BAA2B,CAAC,CAAA;YACzD,MAAM,IAAI,8CAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC,CAAC,CAAA;QAEJ,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,0BAA0B,CACrC,WAAmC,EACnC,oBAAkD,EAClD,SAA2B;QAE3B,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,WAAW,EACX,SAAS;YACT,kEAAkE;YAClE,mEAAmE;YACnE,iBAAiB;YACjB,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAChC,CAAA;YAED,MAAM,UAAU,GACd,SAAS,IAAI,oBAAoB,CAAC,aAAa;gBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,oBAAoB,CAAC;gBACpD,CAAC,CAAC,oBAAoB,CAAA;YAE1B,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACzB,IAAI,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;oBAC7C,IAAI,SAAS;wBAAE,UAAU,CAAC,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAA;yBAC7C,CAAC;wBACJ,oEAAoE;wBACpE,iEAAiE;wBACjE,sBAAsB;wBACtB,6DAA6D;oBAC/D,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;oBAC9C,MAAM,IAAI,8CAAmB,CAC3B,0DAA0D,CAC3D,CAAA;gBACH,CAAC;gBAED,wEAAwE;gBACxE,oCAAoC;gBACpC,IAAI,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;oBACvD,MAAM,IAAI,8DAA0B,EAAE,CAAA;gBACxC,CAAC;YACH,CAAC;YAED,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAC7B,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAClD,MAAM,EACN,UAAU,EACV,UAAU,EACV,IAAI,CACL,CAAA;YAEH,OAAO;gBACL,WAAW,EAAE,UAAU;gBACvB,UAAU,EAAE,IAAA,+BAAqB,EAAC,SAAS,CAAC;aAC7C,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,0EAA0E;YAC1E,oEAAoE;YACpE,8DAA8D;YAC9D,IAAI,GAAG,YAAY,2CAAkB,IAAI,CAAC,IAAA,0CAAkB,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,8CAAmB,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;YAC3D,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,MAAc,EACd,QAAkB,EAClB,KAAqC;QAErC,MAAM;QACN,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,IAAA,gCAAe,EAAC,KAAK,CAAC,WAAW,EAAE;gBACpD,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;aAC/B,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACjE,CAAC;QAED,MAAM;QACN,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;YACvB,0EAA0E;YAC1E,mEAAmE;YACnE,gEAAgE;YAChE,+DAA+D;YAC/D,kDAAkD;YAClD,qCAAqC;YACrC,4CAA4C;YAC5C,wEAAwE;YACxE,kEAAkE;YAClE,qEAAqE;YACrE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAEtD,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CACnD,MAAM,EACN,IAAI,EACJ,UAAU,EACV,QAAQ,CACT,CAAA;QACH,CAAC;QAED,4EAA4E;QAC5E,qEAAqE;QACrE,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CACnD,MAAM,EACN,IAAI,EACJ,KAAK,EACL,QAAQ,CACT,CAAA;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,SAAS,CACpB,KAAqC,EACrC,EAAE,QAAQ,EAAE,cAAc,EAAc;QAExC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;QAEvB,oEAAoE;QACpE,qDAAqD;QACrD,MAAM,uBAAuB,GAC3B,cAAc,IAAI,KAAK;YACrB,CAAC,CAAC,CAAC,GAAY,EAAS,EAAE;gBACtB,iFAAiF;gBACjF,MAAM,2CAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC3C,CAAC;YACH,CAAC,CAAC,IAAI,CAAA;QAEV,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa;aACpC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;aAC1B,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAEjC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,CACvE,MAAM,EACN,QAAQ,EACR,KAAK,CACN,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAEhC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,CACf,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CACvD,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;gBACxB,OAAO,EAAE,aAAa,CAAC,OAAO;gBAE9B,mEAAmE;gBACnE,iEAAiE;gBACjE,aAAa,EACX,UAAU,CAAC,MAAM,KAAK,OAAO;oBAC7B,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC;gBACxC,eAAe,EAAE,IAAI,CAAC,oBAAoB,CACxC,UAAU,EACV,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAC/C;aACF,CAAC,CAAC,CAAA;YAEH,oEAAoE;YAEpE,wBAAwB;YACxB,EAAE;YACF,yEAAyE;YACzE,uEAAuE;YACvE,sEAAsE;YACtE,yEAAyE;YACzE,oEAAoE;YACpE,0CAA0C;YAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,gBAAgB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC/D,MAAM,IAAI,mEAA6B,CAAC,UAAU,CAAC,CAAA;YACrD,CAAC;YAED,cAAc;YACd,EAAE;YACF,oEAAoE;YACpE,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,iEAAiE;YACjE,qEAAqE;YACrE,wEAAwE;YACxE,mCAAmC;YACnC,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;gBAC5D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,mEAA6B,CAAC,UAAU,CAAC,CAAA;gBACrD,CAAC;gBACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,4CAAkB,CAAC,UAAU,CAAC,CAAA;gBAC1C,CAAC;gBAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;gBAClC,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;oBAC7B,MAAM,IAAI,4CAAkB,CAAC,UAAU,CAAC,CAAA;gBAC1C,CAAC;gBACD,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;oBAC/B,MAAM,IAAI,gDAAoB,CAAC,UAAU,CAAC,CAAA;gBAC5C,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAClD,UAAU,EACV,MAAM,EACN,UAAU,CAAC,OAAO,EAClB,QAAQ,EACR,cAAc,CACf,CAAA;gBAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAA;YACnD,CAAC;YAED,uEAAuE;YACvE,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAC/D,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;gBAC5D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;oBAClC,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;wBAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAClD,UAAU,EACV,MAAM,EACN,UAAU,CAAC,OAAO,EAClB,QAAQ,EACR,cAAc,CACf,CAAA;wBAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAA;oBACnD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,MAAM;gBACN,MAAM;gBACN,UAAU;gBACV,UAAU;gBACV,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACnC,uEAAuE;oBACvE,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;oBACpC,eAAe,EAAE,OAAO,CAAC,eAAe;oBAExC,QAAQ,EACN,UAAU,CAAC,MAAM,IAAI,IAAI;wBACzB,UAAU,CAAC,MAAM,KAAK,OAAO;wBAC7B,UAAU,CAAC,MAAM,KAAK,SAAS;wBAC7B,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;wBACvC,CAAC,CAAC,KAAK;iBACZ,CAAC,CAAC;gBACH,cAAc,EAAE,MAAM,IAAI,CAAC,cAAc;qBACtC,0BAA0B,CAAC,UAAU,CAAC,KAAK,CAAC;qBAC5C,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACf,MAAM,IAAI,2CAAkB,CAC1B,UAAU,EACV,oCAAoC,EACpC,eAAe,EACf,KAAK,CACN,CAAA;gBACH,CAAC,CAAC;aACL,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,EAAE;gBACF,+DAA+D;gBAC/D,+BAA+B;YACjC,CAAC;YAED,MAAM,2CAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,KAAK,CAChB,iBAAyC,EACzC,cAA+B,EAC/B,OAA0B,EAC1B,SAA2B;QAE3B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,iBAAiB,EACjB,SAAS,CACV,CAAA;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,0CAAiB,CACzB,eAAe,OAAO,CAAC,UAAU,kCAAkC,CACpE,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,0CAAiB,CACzB,IAAI,OAAO,CAAC,UAAU,6CAA6C,CACpE,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,sBAAsB,CAChC,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,SAAS,CACV,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,iBAAiB,CAC3B,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,SAAS,CACV,CAAA;QACH,CAAC;QAED,MAAM,IAAI,0CAAiB,CACzB,eAAe,OAAO,CAAC,UAAU,iBAAiB,CACnD,CAAA;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,MAAc,EACd,UAAsB,EACtB,SAA2B,EAC3B,OAIC;QAED,iFAAiF;QACjF,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,0BAA0B,EAAE,CAAC;YACrE,MAAM,IAAI,0CAAiB,CACzB,mDAAmD,MAAM,CAAC,QAAQ,CAAC,0BAA0B,SAAS,UAAU,CAAC,MAAM,GAAG,CAC3H,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,0CAAiB,CAAC,qCAAqC,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;QAC9B,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,0CAAiB,CAAC,yCAAyC,CAAC,CAAA;YACxE,CAAC;iBAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;gBACjD,MAAM,IAAI,0CAAiB,CACzB,4CAA4C,CAC7C,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,2EAA2E;YAC3E,yEAAyE;YACzE,4EAA4E;YAC5E,8DAA8D;YAC9D,wEAAwE;YACxE,eAAe;YACf,OAAM;QACR,CAAC;QAED,QAAQ,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAClC,KAAK,8CAAgC,CAAC,CAAC,SAAS;YAChD,KAAK,iBAAiB;gBACpB,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;oBAC5C,MAAM,IAAI,0CAAiB,CACzB,mDAAmD,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAChF,CAAA;gBACH,CAAC;gBACD,IACE,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG;oBACzC,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG;oBACzC,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG,EACzC,CAAC;oBACD,MAAM,IAAI,0CAAiB,CACzB,yFAAyF,CAC1F,CAAA;gBACH,CAAC;gBACD,MAAK;YACP,KAAK,MAAM;gBACT,qEAAqE;gBACrE,mEAAmE;gBACnE,MAAK;YACP;gBACE,MAAM,IAAI,0CAAiB;gBACzB,2DAA2D;gBAC3D,mBAAmB,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAChD,CAAA;QACL,CAAC;IACH,CAAC;IAES,KAAK,CAAC,sBAAsB,CACpC,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,KAA8C,EAC9C,SAA2B;QAE3B,MAAM,IAAI,GAAG,MAAM,oBAAU;aAC1B,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aAC1C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,GAAG,GAAG,IAAA,sBAAW,EAAC,GAAG,EAAE,cAAc,CAAC,CAAA;YAC5C,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACvC,CAAC,CAAC,CAAA;QAEJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc;aACnC,WAAW,CAAC,IAAI,CAAC;aACjB,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,uDAAuD;YACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;YAC1D,IAAI,SAAS,EAAE,CAAC;gBACd,wEAAwE;gBACxE,IAAI,CAAC;oBACH,+CAA+C;oBAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;gBACnD,CAAC;wBAAS,CAAC;oBACT,kEAAkE;oBAClE,kEAAkE;oBAClE,gCAAgC;oBAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,IAAI,CAAA;oBACxC,IAAI,QAAQ,EAAE,CAAC;wBACb,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;oBAC9D,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;QAEJ,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,WAAW;QAEX,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;QAEjE,0EAA0E;QAC1E,UAAU;QACV,MAAM,UAAU,GACd,SAAS;YACT,MAAM,CAAC,QAAQ,CAAC,wBAAwB;YACxC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ;YACvB,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE;YACjD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAA;QAErB,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAE/C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAElE,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAClC,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,UAAU,EACV,IAAI,CACL,CAAA;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,UAA+C,EAC/C,KAA8C;QAE9C,IAAI,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YACnD,MAAM,IAAI,0CAAiB,CACzB,iFAAiF,CAClF,CAAA;QACH,CAAC;QAED,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,0CAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACpC,MAAM,IAAI,0CAAiB,CAAC,yBAAyB,CAAC,CAAA;YACxD,CAAC;YACD,QAAQ,UAAU,CAAC,qBAAqB,EAAE,CAAC;gBACzC,KAAK,SAAS,CAAC,CAAC,qBAAqB;gBACrC,KAAK,OAAO;oBACV,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;wBACtD,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;oBACtD,CAAC;oBACD,MAAK;gBAEP,KAAK,MAAM,CAAC,CAAC,CAAC;oBACZ,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAChC,UAAU,CAAC,cAAc,EACzB,QAAQ,CACT,CAAA;oBACD,MAAM,iBAAiB,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;yBAC3C,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;yBAC3B,MAAM,EAAE,CAAA;oBACX,IAAI,cAAc,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;wBACpD,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;oBACtD,CAAC;oBACD,MAAK;gBACP,CAAC;gBAED;oBACE,qEAAqE;oBACrE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACxD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CACzD,UAAU,CAAC,cAAc,CAC1B,CAAA;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0CAAiB,CAAC,6BAA6B,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,8CAAmB,CAAC,0CAA0C,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,KAAyC,EACzC,SAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,mCAAkB;aAC1C,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;aAC5D,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,GAAG,GAAG,IAAA,sBAAW,EAAC,GAAG,EAAE,uBAAuB,CAAC,CAAA;YACrD,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACvC,CAAC,CAAC,CAAA;QAEJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;QAE3E,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;YAC1B,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YACjE,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;YAEzD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CACxC,MAAM,EACN,UAAU,EACV,cAAc,EACd,SAAS,CACV,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAEjD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAES,KAAK,CAAC,oBAAoB,CAClC,MAAc,EACd,UAAsB,EACtB,IAAe;QAEf,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY;YACtD,CAAC,CAAC;gBACE,mDAAoC;gBACpC,mDAAoC;aACrC;YACH,CAAC,CAAC,CAAC,6CAA8B,EAAE,6CAA8B,CAAC,CAAA;QAEtE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QACxD,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,IAAI,0CAAiB,CAAC,iBAAiB,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QACxD,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,MAAM,CACjB,iBAAyC,EACzC,EAAE,KAAK,EAA4B,EACnC,SAA2B;QAE3B,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,iBAAiB,EACjB,SAAS,CACV,CAAA;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,uEAAuE;YACvE,mCAAmC;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;YAC1B,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YAEjE,0EAA0E;YAC1E,uEAAuE;YACvE,gCAAgC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,WAAW,CAClC,SAAyB,EACzB,KAAuB,EACvB,SAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;QAEzE,IAAI,IAAI,CAAC,eAAe,KAAK,sCAAe,CAAC,SAAS,EAAE,CAAC;YACvD,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,WAAW;YAEX,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CACzD,SAAS,EACT,YAAY,CACb,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QAC1C,CAAC;QAED,OAAO,YAAY,CAAA;IACrB,CAAC;CACF;AA71BD,sCA61BC;AAED,SAAS,WAAW,CAElB,EAAE,OAAO,EAAwB;IAEjC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAA;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,OAAO,OAAO,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,kBAAkB,KAAK,IAAI,CAAA;AACpE,CAAC","sourcesContent":["import { createHash } from 'node:crypto'\nimport type { Redis, RedisOptions } from 'ioredis'\nimport { Jwks, Keyset } from '@atproto/jwk'\nimport { LexResolver } from '@atproto/lex-resolver'\nimport type { Account } from '@atproto/oauth-provider-api'\nimport {\n  CLIENT_ASSERTION_TYPE_JWT_BEARER,\n  OAuthAccessToken,\n  OAuthAuthorizationCodeGrantTokenRequest,\n  OAuthAuthorizationRequestJar,\n  OAuthAuthorizationRequestPar,\n  OAuthAuthorizationRequestParameters,\n  OAuthAuthorizationRequestQuery,\n  OAuthAuthorizationServerMetadata,\n  OAuthClientCredentials,\n  OAuthClientMetadata,\n  OAuthParResponse,\n  OAuthRefreshTokenGrantTokenRequest,\n  OAuthTokenIdentification,\n  OAuthTokenRequest,\n  OAuthTokenResponse,\n  OAuthTokenType,\n  atprotoLoopbackClientMetadata,\n  oauthAuthorizationRequestParametersSchema,\n} from '@atproto/oauth-types'\nimport { safeFetchWrap } from '@atproto-labs/fetch-node'\nimport { SimpleStore } from '@atproto-labs/simple-store'\nimport { SimpleStoreMemory } from '@atproto-labs/simple-store-memory'\nimport { AccessTokenMode } from './access-token/access-token-mode.js'\nimport { AccountManager } from './account/account-manager.js'\nimport {\n  AccountStore,\n  AuthorizedClientData,\n  DeviceAccount,\n  asAccountStore,\n} from './account/account-store.js'\nimport { ClientAuth, ClientAuthLegacy } from './client/client-auth.js'\nimport { ClientId } from './client/client-id.js'\nimport {\n  ClientManager,\n  LoopbackMetadataGetter,\n} from './client/client-manager.js'\nimport { ClientStore, ifClientStore } from './client/client-store.js'\nimport { Client } from './client/client.js'\nimport {\n  AUTHENTICATION_MAX_AGE,\n  CONFIDENTIAL_CLIENT_REFRESH_LIFETIME,\n  CONFIDENTIAL_CLIENT_SESSION_LIFETIME,\n  PUBLIC_CLIENT_REFRESH_LIFETIME,\n  PUBLIC_CLIENT_SESSION_LIFETIME,\n  TOKEN_MAX_AGE,\n} from './constants.js'\nimport { Branding, BrandingInput } from './customization/branding.js'\nimport {\n  Customization,\n  CustomizationInput,\n  customizationSchema,\n} from './customization/customization.js'\nimport { DeviceId } from './device/device-id.js'\nimport {\n  DeviceInfo,\n  DeviceManager,\n  DeviceManagerOptions,\n} from './device/device-manager.js'\nimport { DeviceStore, asDeviceStore } from './device/device-store.js'\nimport { AccountSelectionRequiredError } from './errors/account-selection-required-error.js'\nimport { AuthorizationError } from './errors/authorization-error.js'\nimport { ConsentRequiredError } from './errors/consent-required-error.js'\nimport { InvalidDpopKeyBindingError } from './errors/invalid-dpop-key-binding-error.js'\nimport { InvalidDpopProofError } from './errors/invalid-dpop-proof-error.js'\nimport { InvalidGrantError } from './errors/invalid-grant-error.js'\nimport { InvalidRequestError } from './errors/invalid-request-error.js'\nimport { LoginRequiredError } from './errors/login-required-error.js'\nimport { LexiconManager } from './lexicon/lexicon-manager.js'\nimport { LexiconStore, asLexiconStore } from './lexicon/lexicon-store.js'\nimport { HcaptchaConfig } from './lib/hcaptcha.js'\nimport { RequestMetadata } from './lib/http/request.js'\nimport { dateToRelativeSeconds } from './lib/util/date.js'\nimport { formatError } from './lib/util/error.js'\nimport { MultiLangString } from './lib/util/locale.js'\nimport { CustomMetadata, buildMetadata } from './metadata/build-metadata.js'\nimport { OAuthHooks } from './oauth-hooks.js'\nimport {\n  DpopProof,\n  OAuthVerifier,\n  OAuthVerifierOptions,\n  VerifyTokenPayloadOptions,\n} from './oauth-verifier.js'\nimport { ReplayStore, ifReplayStore } from './replay/replay-store.js'\nimport { codeSchema } from './request/code.js'\nimport { RequestManager } from './request/request-manager.js'\nimport { RequestStore, asRequestStore } from './request/request-store.js'\nimport { parseRequestUri } from './request/request-uri.js'\nimport { AuthorizationRedirectParameters } from './result/authorization-redirect-parameters.js'\nimport { AuthorizationResultAuthorizePage } from './result/authorization-result-authorize-page.js'\nimport { AuthorizationResultRedirect } from './result/authorization-result-redirect.js'\nimport { ErrorHandler } from './router/error-handler.js'\nimport { AccessTokenPayload } from './signer/access-token-payload.js'\nimport { TokenData } from './token/token-data.js'\nimport { TokenManager } from './token/token-manager.js'\nimport {\n  TokenStore,\n  asTokenStore,\n  refreshTokenSchema,\n} from './token/token-store.js'\nimport { isPARResponseError } from './types/par-response-error.js'\n\nexport { AccessTokenMode, Keyset, LexResolver }\nexport type {\n  AccessTokenPayload,\n  AuthorizationRedirectParameters,\n  AuthorizationResultAuthorizePage as AuthorizationResultAuthorize,\n  AuthorizationResultRedirect,\n  Branding,\n  BrandingInput,\n  CustomMetadata,\n  Customization,\n  CustomizationInput,\n  ErrorHandler,\n  HcaptchaConfig,\n  MultiLangString,\n  OAuthAuthorizationServerMetadata,\n  VerifyTokenPayloadOptions,\n}\n\ntype OAuthProviderConfig = {\n  /**\n   * Maximum age a device/account session can be before requiring\n   * re-authentication.\n   */\n  authenticationMaxAge?: number\n\n  /**\n   * Maximum age access & id tokens can be before requiring a refresh.\n   */\n  tokenMaxAge?: number\n\n  /**\n   * If set to {@link AccessTokenMode.stateless}, the generated access tokens\n   * will contain all the necessary information to validate the token without\n   * needing to query the database. This is useful for cases where the Resource\n   * Server is on a different host/server than the Authorization Server.\n   *\n   * When set to {@link AccessTokenMode.light}, the access tokens will contain\n   * only the necessary information to validate the token, but the token id\n   * will need to be queried from the database to retrieve the full token\n   * information (scope, audience, etc.)\n   *\n   * @see {@link AccessTokenMode}\n   * @default {AccessTokenMode.stateless}\n   */\n  accessTokenMode?: AccessTokenMode\n\n  /**\n   * Additional metadata to be included in the discovery document.\n   */\n  metadata?: CustomMetadata\n\n  /**\n   * A Lexicon resolver instance to use for fetching lexicon schemas.\n   */\n  lexResolver?: LexResolver\n\n  /**\n   * A custom fetch function that can be used to fetch the client metadata from\n   * the internet. By default, the fetch function is a safeFetchWrap() function\n   * that protects against SSRF attacks, large responses & known bad domains. If\n   * you want to disable all protections, you can provide `globalThis.fetch` as\n   * fetch function.\n   */\n  safeFetch?: typeof globalThis.fetch\n\n  /**\n   * A redis instance to use for replay protection. If not provided, replay\n   * protection will use memory storage.\n   */\n  redis?: Redis | RedisOptions | string\n\n  /**\n   * This will be used as the default store for all the stores. If a store is\n   * not provided, this store will be used instead. If the `store` does not\n   * implement a specific store, a runtime error will be thrown. Make sure that\n   * this store implements all the interfaces not provided in the other\n   * `<name>Store` options.\n   */\n  store?: Partial<\n    AccountStore &\n      ClientStore &\n      DeviceStore &\n      LexiconStore &\n      ReplayStore &\n      RequestStore &\n      TokenStore\n  >\n\n  accountStore?: AccountStore\n  clientStore?: ClientStore\n  deviceStore?: DeviceStore\n  lexiconStore?: LexiconStore\n  replayStore?: ReplayStore\n  requestStore?: RequestStore\n  tokenStore?: TokenStore\n\n  /**\n   * In order to speed up the client fetching process, you can provide a cache\n   * to store HTTP responses.\n   *\n   * @note the cached entries should automatically expire after a certain time (typically 10 minutes)\n   */\n  clientJwksCache?: SimpleStore<string, Jwks>\n\n  /**\n   * In order to speed up the client fetching process, you can provide a cache\n   * to store HTTP responses.\n   *\n   * @note the cached entries should automatically expire after a certain time (typically 10 minutes)\n   */\n  clientMetadataCache?: SimpleStore<string, OAuthClientMetadata>\n\n  /**\n   * In order to enable loopback clients, you can provide a function that\n   * returns the client metadata for a given loopback URL. This is useful for\n   * development and testing purposes. This function is not called for internet\n   * clients.\n   *\n   * @default is as specified by ATPROTO\n   */\n  loopbackMetadata?: null | false | LoopbackMetadataGetter\n}\n\nexport type OAuthProviderOptions = OAuthProviderConfig &\n  OAuthVerifierOptions &\n  OAuthHooks &\n  DeviceManagerOptions &\n  CustomizationInput\n\nexport class OAuthProvider extends OAuthVerifier {\n  protected readonly accessTokenMode: AccessTokenMode\n  protected readonly hooks: OAuthHooks\n\n  public readonly metadata: OAuthAuthorizationServerMetadata\n  public readonly customization: Customization\n\n  public readonly authenticationMaxAge: number\n\n  public readonly accountManager: AccountManager\n  public readonly deviceManager: DeviceManager\n  public readonly clientManager: ClientManager\n  public readonly lexiconManager: LexiconManager\n  public readonly requestManager: RequestManager\n  public readonly tokenManager: TokenManager\n\n  public constructor({\n    // OAuthProviderConfig\n    authenticationMaxAge = AUTHENTICATION_MAX_AGE,\n    tokenMaxAge = TOKEN_MAX_AGE,\n    accessTokenMode = AccessTokenMode.stateless,\n\n    metadata,\n\n    safeFetch = safeFetchWrap(),\n    store, // compound store implementation\n    lexResolver = new LexResolver({ fetch: safeFetch }),\n\n    // Required stores\n    accountStore = asAccountStore(store),\n    deviceStore = asDeviceStore(store),\n    lexiconStore = asLexiconStore(store),\n    tokenStore = asTokenStore(store),\n    requestStore = asRequestStore(store),\n\n    // Optional stores\n    clientStore = ifClientStore(store),\n    replayStore = ifReplayStore(store),\n\n    clientJwksCache = new SimpleStoreMemory({\n      maxSize: 50_000_000,\n      ttl: 600e3,\n    }),\n    clientMetadataCache = new SimpleStoreMemory({\n      maxSize: 50_000_000,\n      ttl: 600e3,\n    }),\n\n    loopbackMetadata = atprotoLoopbackClientMetadata,\n\n    // OAuthHooks &\n    // OAuthVerifierOptions &\n    // DeviceManagerOptions &\n    // Customization\n    ...rest\n  }: OAuthProviderOptions) {\n    super({ replayStore, ...rest })\n\n    // @NOTE: hooks don't really need a type parser, as all zod can actually\n    // check at runtime is the fact that the values are functions. The only way\n    // we would benefit from zod here would be to wrap the functions with a\n    // validator for the provided function's return types, which we don't\n    // really need if types are respected.\n    this.hooks = rest\n\n    this.accessTokenMode = accessTokenMode\n    this.authenticationMaxAge = authenticationMaxAge\n    this.metadata = buildMetadata(this.issuer, this.keyset, metadata)\n    this.customization = customizationSchema.parse(rest)\n\n    this.deviceManager = new DeviceManager(deviceStore, {\n      ...rest,\n      cookie: {\n        ...rest.cookie,\n        // \"secure\" defaults to \"true\" in DeviceManager. For the oauth routes to\n        // work from localhost on Safari, we need to explicitly set secure to\n        // false for localhost usage. This is not really an issue with Chrome\n        // and Firefox, but Safari enforces it strictly.\n        secure: !this.issuer.startsWith('http:'),\n      },\n    })\n    this.accountManager = new AccountManager(\n      this.issuer,\n      accountStore,\n      this.hooks,\n      this.customization,\n    )\n    this.clientManager = new ClientManager(\n      this.metadata,\n      this.keyset,\n      this.hooks,\n      clientStore || null,\n      loopbackMetadata || null,\n      safeFetch,\n      clientJwksCache,\n      clientMetadataCache,\n    )\n    this.lexiconManager = new LexiconManager(lexiconStore, lexResolver)\n    this.requestManager = new RequestManager(\n      requestStore,\n      this.lexiconManager,\n      this.signer,\n      this.metadata,\n      this.hooks,\n    )\n    this.tokenManager = new TokenManager(\n      tokenStore,\n      this.lexiconManager,\n      this.signer,\n      this.hooks,\n      this.accessTokenMode,\n      tokenMaxAge,\n    )\n  }\n\n  get jwks() {\n    return this.keyset.publicJwks\n  }\n\n  /**\n   * @returns true if the user's consent is required for the requested scopes\n   */\n  public checkConsentRequired(\n    parameters: OAuthAuthorizationRequestParameters,\n    clientData?: AuthorizedClientData,\n  ) {\n    // Client was never authorized before\n    if (!clientData) return true\n\n    // Client explicitly asked for consent\n    if (parameters.prompt === 'consent') return true\n\n    // No scope requested, and client is known by user, no consent required\n    const requestedScopes = parameters.scope?.split(' ')\n    if (requestedScopes == null) return false\n\n    // Ensure that all requested scopes were previously authorized by the user\n    const { authorizedScopes } = clientData\n    return !requestedScopes.every((scope) => authorizedScopes.includes(scope))\n  }\n\n  public checkLoginRequired(deviceAccount: DeviceAccount) {\n    const authAge = Date.now() - deviceAccount.updatedAt.getTime()\n    return authAge > this.authenticationMaxAge\n  }\n\n  protected async authenticateClient(\n    clientCredentials: OAuthClientCredentials,\n    dpopProof: null | DpopProof,\n    options?: {\n      allowMissingDpopProof?: boolean\n    },\n  ): Promise<{\n    client: Client\n    clientAuth: ClientAuth\n  }> {\n    const client = await this.clientManager.getClient(\n      clientCredentials.client_id,\n    )\n\n    if (\n      client.metadata.dpop_bound_access_tokens &&\n      !dpopProof &&\n      !options?.allowMissingDpopProof\n    ) {\n      throw new InvalidDpopProofError('DPoP proof required')\n    }\n\n    if (dpopProof && !client.metadata.dpop_bound_access_tokens) {\n      throw new InvalidDpopProofError('DPoP proof not allowed for this client')\n    }\n\n    const clientAuth = await client.authenticate(clientCredentials, {\n      authorizationServerIdentifier: this.issuer,\n    })\n\n    if (clientAuth.method === 'private_key_jwt') {\n      // Clients MUST NOT use their client assertion key to sign DPoP proofs\n      if (dpopProof && clientAuth.jkt === dpopProof.jkt) {\n        throw new InvalidRequestError(\n          'The DPoP proof must be signed with a different key than the client assertion',\n        )\n      }\n\n      // https://www.rfc-editor.org/rfc/rfc7523.html#section-3\n      // > 7.  [...] The authorization server MAY ensure that JWTs are not\n      // >     replayed by maintaining the set of used \"jti\" values for the\n      // >     length of time for which the JWT would be considered valid based\n      // >     on the applicable \"exp\" instant.\n\n      const unique = await this.replayManager.uniqueAuth(\n        clientAuth.jti,\n        client.id,\n        clientAuth.exp,\n      )\n      if (!unique) {\n        throw new InvalidGrantError(`${clientAuth.method} jti reused`)\n      }\n    }\n\n    return { client, clientAuth }\n  }\n\n  async decodeJAR(\n    client: Client,\n    input: OAuthAuthorizationRequestJar,\n  ): Promise<OAuthAuthorizationRequestParameters> {\n    const { payload } = await client.decodeRequestObject(\n      input.request,\n      this.issuer,\n    )\n\n    const { jti } = payload\n    if (!jti) {\n      throw new InvalidRequestError(\n        'Request object payload must contain a \"jti\" claim',\n      )\n    }\n    if (!(await this.replayManager.uniqueJar(jti, client.id))) {\n      throw new InvalidRequestError('Request object was replayed')\n    }\n\n    const parameters = await oauthAuthorizationRequestParametersSchema\n      .parseAsync(payload)\n      .catch((err) => {\n        const msg = formatError(err, 'Invalid parameters in JAR')\n        throw new InvalidRequestError(msg, err)\n      })\n\n    return parameters\n  }\n\n  /**\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc9126}\n   */\n  public async pushedAuthorizationRequest(\n    credentials: OAuthClientCredentials,\n    authorizationRequest: OAuthAuthorizationRequestPar,\n    dpopProof: null | DpopProof,\n  ): Promise<OAuthParResponse> {\n    try {\n      const { client, clientAuth } = await this.authenticateClient(\n        credentials,\n        dpopProof,\n        // Allow missing DPoP header for PAR requests as rfc9449 allows it\n        // (though the dpop_jkt parameter must be present in that case, see\n        // check bellow).\n        { allowMissingDpopProof: true },\n      )\n\n      const parameters =\n        'request' in authorizationRequest // Handle JAR\n          ? await this.decodeJAR(client, authorizationRequest)\n          : authorizationRequest\n\n      if (!parameters.dpop_jkt) {\n        if (client.metadata.dpop_bound_access_tokens) {\n          if (dpopProof) parameters.dpop_jkt = dpopProof.jkt\n          else {\n            // @NOTE When both PAR and DPoP are used, either the DPoP header, or\n            // the dpop_jkt parameter must be present. We do not enforce this\n            // for legacy reasons.\n            // https://datatracker.ietf.org/doc/html/rfc9449#section-10.1\n          }\n        }\n      } else {\n        if (!client.metadata.dpop_bound_access_tokens) {\n          throw new InvalidRequestError(\n            'DPoP bound access tokens are not enabled for this client',\n          )\n        }\n\n        // Proof is optional if the dpop_jkt is provided, but if it is provided,\n        // it must match the DPoP proof JKT.\n        if (dpopProof && dpopProof.jkt !== parameters.dpop_jkt) {\n          throw new InvalidDpopKeyBindingError()\n        }\n      }\n\n      const { requestUri, expiresAt } =\n        await this.requestManager.createAuthorizationRequest(\n          client,\n          clientAuth,\n          parameters,\n          null,\n        )\n\n      return {\n        request_uri: requestUri,\n        expires_in: dateToRelativeSeconds(expiresAt),\n      }\n    } catch (err) {\n      // https://datatracker.ietf.org/doc/html/rfc9126#section-2.3-1\n      // > Since initial processing of the pushed authorization request does not\n      // > involve resource owner interaction, error codes related to user\n      // > interaction, such as \"access_denied\", are never returned.\n      if (err instanceof AuthorizationError && !isPARResponseError(err.error)) {\n        throw new InvalidRequestError(err.error_description, err)\n      }\n      throw err\n    }\n  }\n\n  private async processAuthorizationRequest(\n    client: Client,\n    deviceId: DeviceId,\n    query: OAuthAuthorizationRequestQuery,\n  ) {\n    // PAR\n    if ('request_uri' in query) {\n      const requestUri = parseRequestUri(query.request_uri, {\n        path: ['query', 'request_uri'],\n      })\n      return this.requestManager.get(requestUri, deviceId, client.id)\n    }\n\n    // JAR\n    if ('request' in query) {\n      // @NOTE Since JAR are signed with the client's private key, a JAR *could*\n      // technically be used to authenticate the client when requests are\n      // created without PAR (i.e. created on the fly by the authorize\n      // endpoint). This implementation actually used to support this\n      // (un-spec'd) behavior. That support was removed:\n      // - Because it was not actually used\n      // - Because it was not part of any standard\n      // - Because it makes extending the client authentication mechanism more\n      //   complex since any extension would not only need to affect the\n      //   \"private_key_jwt\" auth method but also the JAR \"request\" object.\n      const parameters = await this.decodeJAR(client, query)\n\n      return this.requestManager.createAuthorizationRequest(\n        client,\n        null,\n        parameters,\n        deviceId,\n      )\n    }\n\n    // \"Regular\" authorization request (created on the fly by directing the user\n    // to the authorization endpoint with all the parameters in the url).\n    return this.requestManager.createAuthorizationRequest(\n      client,\n      null,\n      query,\n      deviceId,\n    )\n  }\n\n  /**\n   * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-4.1.1}\n   */\n  public async authorize(\n    query: OAuthAuthorizationRequestQuery,\n    { deviceId, deviceMetadata }: DeviceInfo,\n  ): Promise<AuthorizationResultRedirect | AuthorizationResultAuthorizePage> {\n    const { issuer } = this\n\n    // If there is a chance to redirect the user to the client, let's do\n    // it by wrapping the error in an AuthorizationError.\n    const throwAuthorizationError =\n      'redirect_uri' in query\n        ? (err: unknown): never => {\n            // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-4.1.2.1\n            throw AuthorizationError.from(query, err)\n          }\n        : null\n\n    const client = await this.clientManager\n      .getClient(query.client_id)\n      .catch(throwAuthorizationError)\n\n    const { parameters, requestUri } = await this.processAuthorizationRequest(\n      client,\n      deviceId,\n      query,\n    ).catch(throwAuthorizationError)\n\n    try {\n      const sessions = (\n        await this.accountManager.listDeviceAccounts(deviceId)\n      ).map((deviceAccount) => ({\n        account: deviceAccount.account,\n\n        // @TODO Return the session expiration date instead of a boolean to\n        // avoid having to rely on a leeway when \"accepting\" the request.\n        loginRequired:\n          parameters.prompt === 'login' ||\n          this.checkLoginRequired(deviceAccount),\n        consentRequired: this.checkConsentRequired(\n          parameters,\n          deviceAccount.authorizedClients.get(client.id),\n        ),\n      }))\n\n      // https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest\n\n      // prompt=select_account\n      //\n      // > The Authorization Server SHOULD prompt the End-User to select a user\n      // > account. This enables an End-User who has multiple accounts at the\n      // > Authorization Server to select amongst the multiple accounts that\n      // > they might have current sessions for. If it cannot obtain an account\n      // > selection choice made by the End-User, it MUST return an error,\n      // > typically account_selection_required.\n      if (parameters.prompt === 'select_account' && !sessions.length) {\n        throw new AccountSelectionRequiredError(parameters)\n      }\n\n      // prompt=none\n      //\n      // > The Authorization Server MUST NOT display any authentication or\n      // > consent user interface pages. An error is returned if an End-User is\n      // > not already authenticated or the Client does not have pre-configured\n      // > consent for the requested Claims or does not fulfill other conditions\n      // > for processing the request. The error code will typically be\n      // > login_required, interaction_required, or another code defined in\n      // > Section 3.1.2.6. This can be used as a method to check for existing\n      // > authentication and/or consent.\n      if (parameters.prompt === 'none') {\n        const ssoSessions = sessions.filter(matchesHint, parameters)\n        if (ssoSessions.length > 1) {\n          throw new AccountSelectionRequiredError(parameters)\n        }\n        if (ssoSessions.length < 1) {\n          throw new LoginRequiredError(parameters)\n        }\n\n        const ssoSession = ssoSessions[0]!\n        if (ssoSession.loginRequired) {\n          throw new LoginRequiredError(parameters)\n        }\n        if (ssoSession.consentRequired) {\n          throw new ConsentRequiredError(parameters)\n        }\n\n        const code = await this.requestManager.setAuthorized(\n          requestUri,\n          client,\n          ssoSession.account,\n          deviceId,\n          deviceMetadata,\n        )\n\n        return { issuer, parameters, redirect: { code } }\n      }\n\n      // Automatic SSO when a hint was provided that matches a single session\n      if (parameters.prompt == null && parameters.login_hint != null) {\n        const ssoSessions = sessions.filter(matchesHint, parameters)\n        if (ssoSessions.length === 1) {\n          const ssoSession = ssoSessions[0]!\n          if (!ssoSession.loginRequired && !ssoSession.consentRequired) {\n            const code = await this.requestManager.setAuthorized(\n              requestUri,\n              client,\n              ssoSession.account,\n              deviceId,\n              deviceMetadata,\n            )\n\n            return { issuer, parameters, redirect: { code } }\n          }\n        }\n      }\n\n      return {\n        issuer,\n        client,\n        parameters,\n        requestUri,\n        sessions: sessions.map((session) => ({\n          // Map to avoid leaking other data that might be present in the session\n          account: session.account,\n          loginRequired: session.loginRequired,\n          consentRequired: session.consentRequired,\n\n          selected:\n            parameters.prompt == null ||\n            parameters.prompt === 'login' ||\n            parameters.prompt === 'consent'\n              ? matchesHint.call(parameters, session)\n              : false,\n        })),\n        permissionSets: await this.lexiconManager\n          .getPermissionSetsFromScope(parameters.scope)\n          .catch((cause) => {\n            throw new AuthorizationError(\n              parameters,\n              'Unable to retrieve permission sets',\n              'invalid_scope',\n              cause,\n            )\n          }),\n      }\n    } catch (err) {\n      try {\n        await this.requestManager.delete(requestUri)\n      } catch {\n        // There are two error here. Better keep the outer one.\n        //\n        // @TODO Maybe move this entire code to the /authorize endpoint\n        // (allowing to log this error)\n      }\n\n      throw AuthorizationError.from(parameters, err)\n    }\n  }\n\n  public async token(\n    clientCredentials: OAuthClientCredentials,\n    clientMetadata: RequestMetadata,\n    request: OAuthTokenRequest,\n    dpopProof: null | DpopProof,\n  ): Promise<OAuthTokenResponse> {\n    const { client, clientAuth } = await this.authenticateClient(\n      clientCredentials,\n      dpopProof,\n    )\n\n    if (!this.metadata.grant_types_supported?.includes(request.grant_type)) {\n      throw new InvalidGrantError(\n        `Grant type \"${request.grant_type}\" is not supported by the server`,\n      )\n    }\n\n    if (!client.metadata.grant_types.includes(request.grant_type)) {\n      throw new InvalidGrantError(\n        `\"${request.grant_type}\" grant type is not allowed for this client`,\n      )\n    }\n\n    if (request.grant_type === 'authorization_code') {\n      return this.authorizationCodeGrant(\n        client,\n        clientAuth,\n        clientMetadata,\n        request,\n        dpopProof,\n      )\n    }\n\n    if (request.grant_type === 'refresh_token') {\n      return this.refreshTokenGrant(\n        client,\n        clientAuth,\n        clientMetadata,\n        request,\n        dpopProof,\n      )\n    }\n\n    throw new InvalidGrantError(\n      `Grant type \"${request.grant_type}\" not supported`,\n    )\n  }\n\n  protected async compareClientAuth(\n    client: Client,\n    clientAuth: ClientAuth,\n    dpopProof: null | DpopProof,\n    initial: {\n      parameters: OAuthAuthorizationRequestParameters\n      clientId: ClientId\n      clientAuth: null | ClientAuth | ClientAuthLegacy\n    },\n  ): Promise<void> {\n    // Fool proofing, ensure that the client is authenticating using the right method\n    if (clientAuth.method !== client.metadata.token_endpoint_auth_method) {\n      throw new InvalidGrantError(\n        `Client authentication method mismatch (expected ${client.metadata.token_endpoint_auth_method}, got ${clientAuth.method})`,\n      )\n    }\n\n    if (initial.clientId !== client.id) {\n      throw new InvalidGrantError(`Token was not issued to this client`)\n    }\n\n    const { parameters } = initial\n    if (parameters.dpop_jkt) {\n      if (!dpopProof) {\n        throw new InvalidGrantError(`DPoP proof is required for this request`)\n      } else if (parameters.dpop_jkt !== dpopProof.jkt) {\n        throw new InvalidGrantError(\n          `DPoP proof does not match the expected JKT`,\n        )\n      }\n    }\n\n    if (!initial.clientAuth) {\n      // If the client did not use PAR, it was not authenticated when the request\n      // was initially created (see authorize() method in OAuthProvider). Since\n      // PAR is not mandatory, and since the token exchange currently taking place\n      // *is* authenticated (`clientAuth`), we allow \"upgrading\" the\n      // authentication method (the token created will be bound to the current\n      // clientAuth).\n      return\n    }\n\n    switch (initial.clientAuth.method) {\n      case CLIENT_ASSERTION_TYPE_JWT_BEARER: // LEGACY\n      case 'private_key_jwt':\n        if (clientAuth.method !== 'private_key_jwt') {\n          throw new InvalidGrantError(\n            `Client authentication method mismatch (expected ${initial.clientAuth.method})`,\n          )\n        }\n        if (\n          clientAuth.kid !== initial.clientAuth.kid ||\n          clientAuth.alg !== initial.clientAuth.alg ||\n          clientAuth.jkt !== initial.clientAuth.jkt\n        ) {\n          throw new InvalidGrantError(\n            `The session was initiated with a different key than the client assertion currently used`,\n          )\n        }\n        break\n      case 'none':\n        // @NOTE We allow the client to \"upgrade\" to a confidential client if\n        // the session was initially created without client authentication.\n        break\n      default:\n        throw new InvalidGrantError(\n          // @ts-expect-error (future proof, backwards compatibility)\n          `Invalid method \"${initial.clientAuth.method}\"`,\n        )\n    }\n  }\n\n  protected async authorizationCodeGrant(\n    client: Client,\n    clientAuth: ClientAuth,\n    clientMetadata: RequestMetadata,\n    input: OAuthAuthorizationCodeGrantTokenRequest,\n    dpopProof: null | DpopProof,\n  ): Promise<OAuthTokenResponse> {\n    const code = await codeSchema\n      .parseAsync(input.code, { path: ['code'] })\n      .catch((err) => {\n        const msg = formatError(err, 'Invalid code')\n        throw new InvalidGrantError(msg, err)\n      })\n\n    const data = await this.requestManager\n      .consumeCode(code)\n      .catch(async (err) => {\n        // Code not found in request manager: check for replays\n        const tokenInfo = await this.tokenManager.findByCode(code)\n        if (tokenInfo) {\n          // try/finally to ensure that both code path get executed (sequentially)\n          try {\n            // \"code\" was replayed, delete existing session\n            await this.tokenManager.deleteToken(tokenInfo.id)\n          } finally {\n            // As an additional security measure, we also sign the device out,\n            // so that the device cannot be used to access the account anymore\n            // without a new authentication.\n            const { deviceId, sub } = tokenInfo.data\n            if (deviceId) {\n              await this.accountManager.removeDeviceAccount(deviceId, sub)\n            }\n          }\n        }\n\n        throw InvalidGrantError.from(err, `Invalid code`)\n      })\n\n    // @NOTE at this point, the request data was removed from the store and only\n    // exists in memory here (in the \"data\" variable). Because of this, any\n    // error thrown after this point will permanently cause the request data to\n    // be lost.\n\n    await this.compareClientAuth(client, clientAuth, dpopProof, data)\n\n    // If the DPoP proof was not provided earlier (PAR / authorize), let's add\n    // it now.\n    const parameters =\n      dpopProof &&\n      client.metadata.dpop_bound_access_tokens &&\n      !data.parameters.dpop_jkt\n        ? { ...data.parameters, dpop_jkt: dpopProof.jkt }\n        : data.parameters\n\n    await this.validateCodeGrant(parameters, input)\n\n    const { account } = await this.accountManager.getAccount(data.sub)\n\n    return this.tokenManager.createToken(\n      client,\n      clientAuth,\n      clientMetadata,\n      account,\n      data.deviceId,\n      parameters,\n      code,\n    )\n  }\n\n  protected async validateCodeGrant(\n    parameters: OAuthAuthorizationRequestParameters,\n    input: OAuthAuthorizationCodeGrantTokenRequest,\n  ): Promise<void> {\n    if (parameters.redirect_uri !== input.redirect_uri) {\n      throw new InvalidGrantError(\n        'The redirect_uri parameter must match the one used in the authorization request',\n      )\n    }\n\n    if (parameters.code_challenge) {\n      if (!input.code_verifier) {\n        throw new InvalidGrantError('code_verifier is required')\n      }\n      if (input.code_verifier.length < 43) {\n        throw new InvalidGrantError('code_verifier too short')\n      }\n      switch (parameters.code_challenge_method) {\n        case undefined: // default is \"plain\"\n        case 'plain':\n          if (parameters.code_challenge !== input.code_verifier) {\n            throw new InvalidGrantError('Invalid code_verifier')\n          }\n          break\n\n        case 'S256': {\n          const inputChallenge = Buffer.from(\n            parameters.code_challenge,\n            'base64',\n          )\n          const computedChallenge = createHash('sha256')\n            .update(input.code_verifier)\n            .digest()\n          if (inputChallenge.compare(computedChallenge) !== 0) {\n            throw new InvalidGrantError('Invalid code_verifier')\n          }\n          break\n        }\n\n        default:\n          // Should never happen (because request validation should catch this)\n          throw new Error(`Unsupported code_challenge_method`)\n      }\n      const unique = await this.replayManager.uniqueCodeChallenge(\n        parameters.code_challenge,\n      )\n      if (!unique) {\n        throw new InvalidGrantError('Code challenge already used')\n      }\n    } else if (input.code_verifier !== undefined) {\n      throw new InvalidRequestError(\"code_challenge parameter wasn't provided\")\n    }\n  }\n\n  protected async refreshTokenGrant(\n    client: Client,\n    clientAuth: ClientAuth,\n    clientMetadata: RequestMetadata,\n    input: OAuthRefreshTokenGrantTokenRequest,\n    dpopProof: null | DpopProof,\n  ): Promise<OAuthTokenResponse> {\n    const refreshToken = await refreshTokenSchema\n      .parseAsync(input.refresh_token, { path: ['refresh_token'] })\n      .catch((err) => {\n        const msg = formatError(err, 'Invalid refresh token')\n        throw new InvalidGrantError(msg, err)\n      })\n\n    const tokenInfo = await this.tokenManager.consumeRefreshToken(refreshToken)\n\n    try {\n      const { data } = tokenInfo\n      await this.compareClientAuth(client, clientAuth, dpopProof, data)\n      await this.validateRefreshGrant(client, clientAuth, data)\n\n      return await this.tokenManager.rotateToken(\n        client,\n        clientAuth,\n        clientMetadata,\n        tokenInfo,\n      )\n    } catch (err) {\n      await this.tokenManager.deleteToken(tokenInfo.id)\n\n      throw err\n    }\n  }\n\n  protected async validateRefreshGrant(\n    client: Client,\n    clientAuth: ClientAuth,\n    data: TokenData,\n  ): Promise<void> {\n    const [sessionLifetime, refreshLifetime] =\n      clientAuth.method !== 'none' || client.info.isFirstParty\n        ? [\n            CONFIDENTIAL_CLIENT_SESSION_LIFETIME,\n            CONFIDENTIAL_CLIENT_REFRESH_LIFETIME,\n          ]\n        : [PUBLIC_CLIENT_SESSION_LIFETIME, PUBLIC_CLIENT_REFRESH_LIFETIME]\n\n    const sessionAge = Date.now() - data.createdAt.getTime()\n    if (sessionAge > sessionLifetime) {\n      throw new InvalidGrantError(`Session expired`)\n    }\n\n    const refreshAge = Date.now() - data.updatedAt.getTime()\n    if (refreshAge > refreshLifetime) {\n      throw new InvalidGrantError(`Refresh token expired`)\n    }\n  }\n\n  /**\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7009#section-2.1 rfc7009}\n   */\n  public async revoke(\n    clientCredentials: OAuthClientCredentials,\n    { token }: OAuthTokenIdentification,\n    dpopProof: null | DpopProof,\n  ) {\n    // > The authorization server first validates the client credentials (in\n    // > case of a confidential client)\n    const { client, clientAuth } = await this.authenticateClient(\n      clientCredentials,\n      dpopProof,\n    )\n\n    const tokenInfo = await this.tokenManager.findToken(token)\n    if (tokenInfo) {\n      // > [...] and then verifies whether the token was issued to the client\n      // > making the revocation request.\n      const { data } = tokenInfo\n      await this.compareClientAuth(client, clientAuth, dpopProof, data)\n\n      // > In the next step, the authorization server invalidates the token. The\n      // > invalidation takes place immediately, and the token cannot be used\n      // > again after the revocation.\n      await this.tokenManager.deleteToken(tokenInfo.id)\n    }\n  }\n\n  protected override async decodeToken(\n    tokenType: OAuthTokenType,\n    token: OAuthAccessToken,\n    dpopProof: null | DpopProof,\n  ): Promise<AccessTokenPayload> {\n    const tokenPayload = await super.decodeToken(tokenType, token, dpopProof)\n\n    if (this.accessTokenMode !== AccessTokenMode.stateless) {\n      // @NOTE in non stateless mode, some claims can be omitted (most notably\n      // \"scope\"). We load the token claims here (allowing to ensure that the\n      // token is still valid, and to retrieve a (potentially updated) set of\n      // claims).\n\n      const tokenClaims = await this.tokenManager.loadTokenClaims(\n        tokenType,\n        tokenPayload,\n      )\n\n      Object.assign(tokenPayload, tokenClaims)\n    }\n\n    return tokenPayload\n  }\n}\n\nfunction matchesHint(\n  this: OAuthAuthorizationRequestParameters,\n  { account }: { account: Account },\n): boolean {\n  const hint = this.login_hint\n  if (!hint) return false\n\n  return account.sub === hint || account.preferred_username === hint\n}\n"]}
+{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":";;;AAAA,6CAAwC;AAExC,sCAA2C;AAyGjB,uFAzGX,YAAM,OAyGW;AAxGhC,wDAAmD;AAwGjB,4FAxGzB,0BAAW,OAwGyB;AAtG7C,sDAmB6B;AAC7B,yDAAwD;AAExD,2EAAqE;AACrE,8EAAqE;AA+E5D,gGA/EA,sCAAe,OA+EA;AA9ExB,qEAA6D;AAC7D,iEAKmC;AAGnC,kEAGmC;AACnC,8DAAqE;AAErE,iDAOuB;AAEvB,uEAIyC;AAEzC,kEAImC;AACnC,8DAAqE;AACrE,sGAA4F;AAC5F,4EAAoE;AACpE,kFAAyE;AACzE,kGAAuF;AACvF,sFAA4E;AAC5E,4EAAmE;AACnE,gFAAuE;AACvE,8EAAqE;AACrE,qEAA6D;AAC7D,iEAAyE;AAGzE,gDAA0D;AAC1D,kDAAiD;AAEjD,oEAA4E;AAE5E,2DAK4B;AAC5B,8DAAqE;AACrE,+CAA8C;AAC9C,qEAA6D;AAC7D,iEAAyE;AACzE,6DAA0D;AAO1D,+DAAuD;AACvD,2DAI+B;AAC/B,yEAAkE;AAmIlE,MAAa,aAAc,SAAQ,iCAAa;IAC3B,eAAe,CAAiB;IAChC,KAAK,CAAY;IAEpB,QAAQ,CAAkC;IAC1C,aAAa,CAAe;IAE5B,oBAAoB,CAAQ;IAE5B,cAAc,CAAgB;IAC9B,aAAa,CAAe;IAC5B,aAAa,CAAe;IAC5B,cAAc,CAAgB;IAC9B,cAAc,CAAgB;IAC9B,YAAY,CAAc;IAE1C,YAAmB;IACjB,sBAAsB;IACtB,oBAAoB,GAAG,qCAAsB,EAC7C,WAAW,GAAG,4BAAa,EAC3B,eAAe,GAAG,sCAAe,CAAC,SAAS,EAE3C,QAAQ,EAER,SAAS,GAAG,IAAA,0BAAa,GAAE,EAC3B,KAAK,EAAE,gCAAgC;IACvC,WAAW,GAAG,IAAI,0BAAW,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAEnD,kBAAkB;IAClB,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC,EACpC,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAClC,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC,EACpC,UAAU,GAAG,IAAA,6BAAY,EAAC,KAAK,CAAC,EAChC,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC;IAEpC,kBAAkB;IAClB,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAClC,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAElC,eAAe,GAAG,IAAI,uCAAiB,CAAC;QACtC,OAAO,EAAE,UAAU;QACnB,GAAG,EAAE,KAAK;KACX,CAAC,EACF,mBAAmB,GAAG,IAAI,uCAAiB,CAAC;QAC1C,OAAO,EAAE,UAAU;QACnB,GAAG,EAAE,KAAK;KACX,CAAC,EAEF,gBAAgB,GAAG,2CAA6B;IAEhD,eAAe;IACf,yBAAyB;IACzB,yBAAyB;IACzB,gBAAgB;IAChB,GAAG,IAAI,EACc;QACrB,KAAK,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;QAE/B,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,qEAAqE;QACrE,sCAAsC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QAEjB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAA;QACtC,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAA;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAA,iCAAa,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACjE,IAAI,CAAC,aAAa,GAAG,sCAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAEpD,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CAAC,WAAW,EAAE;YAClD,GAAG,IAAI;YACP,MAAM,EAAE;gBACN,GAAG,IAAI,CAAC,MAAM;gBACd,wEAAwE;gBACxE,qEAAqE;gBACrE,qEAAqE;gBACrE,gDAAgD;gBAChD,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;aACzC;SACF,CAAC,CAAA;QACF,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CACtC,IAAI,CAAC,MAAM,EACX,YAAY,EACZ,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,CACnB,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CACpC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,KAAK,EACV,WAAW,IAAI,IAAI,EACnB,gBAAgB,IAAI,IAAI,EACxB,SAAS,EACT,eAAe,EACf,mBAAmB,CACpB,CAAA;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QACnE,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CACtC,YAAY,EACZ,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CACX,CAAA;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,+BAAY,CAClC,UAAU,EACV,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,eAAe,EACpB,WAAW,CACZ,CAAA;IACH,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAA;IAC/B,CAAC;IAED;;OAEG;IACI,oBAAoB,CACzB,UAA+C,EAC/C,UAAiC;QAEjC,qCAAqC;QACrC,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QAE5B,sCAAsC;QACtC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAEhD,uEAAuE;QACvE,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;QACpD,IAAI,eAAe,IAAI,IAAI;YAAE,OAAO,KAAK,CAAA;QAEzC,0EAA0E;QAC1E,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAA;QACvC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5E,CAAC;IAEM,kBAAkB,CAAC,aAA4B;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QAC9D,OAAO,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAA;IAC5C,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,iBAAyC,EACzC,SAA2B,EAC3B,OAEC;QAKD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAC/C,iBAAiB,CAAC,SAAS,CAC5B,CAAA;QAED,IACE,MAAM,CAAC,QAAQ,CAAC,wBAAwB;YACxC,CAAC,SAAS;YACV,CAAC,OAAO,EAAE,qBAAqB,EAC/B,CAAC;YACD,MAAM,IAAI,mDAAqB,CAAC,qBAAqB,CAAC,CAAA;QACxD,CAAC;QAED,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;YAC3D,MAAM,IAAI,mDAAqB,CAAC,wCAAwC,CAAC,CAAA;QAC3E,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,iBAAiB,EAAE;YAC9D,6BAA6B,EAAE,IAAI,CAAC,MAAM;SAC3C,CAAC,CAAA;QAEF,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAC5C,sEAAsE;YACtE,IAAI,SAAS,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;gBAClD,MAAM,IAAI,8CAAmB,CAC3B,8EAA8E,CAC/E,CAAA;YACH,CAAC;YAED,wDAAwD;YACxD,oEAAoE;YACpE,qEAAqE;YACrE,yEAAyE;YACzE,yCAAyC;YAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAChD,UAAU,CAAC,GAAG,EACd,MAAM,CAAC,EAAE,EACT,UAAU,CAAC,GAAG,CACf,CAAA;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0CAAiB,CAAC,GAAG,UAAU,CAAC,MAAM,aAAa,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,SAAS,CACb,MAAc,EACd,KAAmC;QAEnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAClD,KAAK,CAAC,OAAO,EACb,IAAI,CAAC,MAAM,CACZ,CAAA;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,8CAAmB,CAC3B,mDAAmD,CACpD,CAAA;QACH,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,8CAAmB,CAAC,6BAA6B,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,uDAAyC;aAC/D,UAAU,CAAC,OAAO,CAAC;aACnB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,GAAG,GAAG,IAAA,sBAAW,EAAC,GAAG,EAAE,2BAA2B,CAAC,CAAA;YACzD,MAAM,IAAI,8CAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC,CAAC,CAAA;QAEJ,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,0BAA0B,CACrC,WAAmC,EACnC,oBAAkD,EAClD,SAA2B;QAE3B,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,WAAW,EACX,SAAS;YACT,kEAAkE;YAClE,mEAAmE;YACnE,iBAAiB;YACjB,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAChC,CAAA;YAED,MAAM,UAAU,GACd,SAAS,IAAI,oBAAoB,CAAC,aAAa;gBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,oBAAoB,CAAC;gBACpD,CAAC,CAAC,oBAAoB,CAAA;YAE1B,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACzB,IAAI,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;oBAC7C,IAAI,SAAS;wBAAE,UAAU,CAAC,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAA;yBAC7C,CAAC;wBACJ,oEAAoE;wBACpE,iEAAiE;wBACjE,sBAAsB;wBACtB,6DAA6D;oBAC/D,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;oBAC9C,MAAM,IAAI,8CAAmB,CAC3B,0DAA0D,CAC3D,CAAA;gBACH,CAAC;gBAED,wEAAwE;gBACxE,oCAAoC;gBACpC,IAAI,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;oBACvD,MAAM,IAAI,8DAA0B,EAAE,CAAA;gBACxC,CAAC;YACH,CAAC;YAED,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAC7B,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAClD,MAAM,EACN,UAAU,EACV,UAAU,EACV,IAAI,CACL,CAAA;YAEH,OAAO;gBACL,WAAW,EAAE,UAAU;gBACvB,UAAU,EAAE,IAAA,+BAAqB,EAAC,SAAS,CAAC;aAC7C,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,0EAA0E;YAC1E,oEAAoE;YACpE,8DAA8D;YAC9D,IAAI,GAAG,YAAY,2CAAkB,IAAI,CAAC,IAAA,0CAAkB,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,8CAAmB,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;YAC3D,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,MAAc,EACd,QAAkB,EAClB,KAAqC;QAErC,MAAM;QACN,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,IAAA,gCAAe,EAAC,KAAK,CAAC,WAAW,EAAE;gBACpD,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;aAC/B,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACjE,CAAC;QAED,MAAM;QACN,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;YACvB,0EAA0E;YAC1E,mEAAmE;YACnE,gEAAgE;YAChE,+DAA+D;YAC/D,kDAAkD;YAClD,qCAAqC;YACrC,4CAA4C;YAC5C,wEAAwE;YACxE,kEAAkE;YAClE,qEAAqE;YACrE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAEtD,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CACnD,MAAM,EACN,IAAI,EACJ,UAAU,EACV,QAAQ,CACT,CAAA;QACH,CAAC;QAED,4EAA4E;QAC5E,qEAAqE;QACrE,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CACnD,MAAM,EACN,IAAI,EACJ,KAAK,EACL,QAAQ,CACT,CAAA;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,SAAS,CACpB,KAAqC,EACrC,EAAE,QAAQ,EAAE,cAAc,EAAc;QAExC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;QAEvB,oEAAoE;QACpE,qDAAqD;QACrD,MAAM,uBAAuB,GAC3B,cAAc,IAAI,KAAK;YACrB,CAAC,CAAC,CAAC,GAAY,EAAS,EAAE;gBACtB,iFAAiF;gBACjF,MAAM,2CAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC3C,CAAC;YACH,CAAC,CAAC,IAAI,CAAA;QAEV,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa;aACpC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;aAC1B,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAEjC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,CACvE,MAAM,EACN,QAAQ,EACR,KAAK,CACN,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAEhC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,CACf,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CACvD,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;gBACxB,OAAO,EAAE,aAAa,CAAC,OAAO;gBAE9B,mEAAmE;gBACnE,iEAAiE;gBACjE,aAAa,EACX,UAAU,CAAC,MAAM,KAAK,OAAO;oBAC7B,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC;gBACxC,eAAe,EAAE,IAAI,CAAC,oBAAoB,CACxC,UAAU,EACV,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAC/C;aACF,CAAC,CAAC,CAAA;YAEH,oEAAoE;YAEpE,wBAAwB;YACxB,EAAE;YACF,yEAAyE;YACzE,uEAAuE;YACvE,sEAAsE;YACtE,yEAAyE;YACzE,oEAAoE;YACpE,0CAA0C;YAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,gBAAgB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC/D,MAAM,IAAI,mEAA6B,CAAC,UAAU,CAAC,CAAA;YACrD,CAAC;YAED,cAAc;YACd,EAAE;YACF,oEAAoE;YACpE,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,iEAAiE;YACjE,qEAAqE;YACrE,wEAAwE;YACxE,mCAAmC;YACnC,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;gBAC5D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,mEAA6B,CAAC,UAAU,CAAC,CAAA;gBACrD,CAAC;gBACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,4CAAkB,CAAC,UAAU,CAAC,CAAA;gBAC1C,CAAC;gBAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;gBAClC,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;oBAC7B,MAAM,IAAI,4CAAkB,CAAC,UAAU,CAAC,CAAA;gBAC1C,CAAC;gBACD,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;oBAC/B,MAAM,IAAI,gDAAoB,CAAC,UAAU,CAAC,CAAA;gBAC5C,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAClD,UAAU,EACV,MAAM,EACN,UAAU,CAAC,OAAO,EAClB,QAAQ,EACR,cAAc,CACf,CAAA;gBAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAA;YACnD,CAAC;YAED,uEAAuE;YACvE,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAC/D,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;gBAC5D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;oBAClC,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;wBAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAClD,UAAU,EACV,MAAM,EACN,UAAU,CAAC,OAAO,EAClB,QAAQ,EACR,cAAc,CACf,CAAA;wBAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAA;oBACnD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,MAAM;gBACN,MAAM;gBACN,UAAU;gBACV,UAAU;gBACV,QAAQ;gBACR,WAAW,EACT,UAAU,CAAC,MAAM,IAAI,IAAI;oBACzB,UAAU,CAAC,MAAM,KAAK,OAAO;oBAC7B,UAAU,CAAC,MAAM,KAAK,SAAS;oBAC7B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,GAAG;oBACrD,CAAC,CAAC,SAAS;gBACf,cAAc,EAAE,MAAM,IAAI,CAAC,cAAc;qBACtC,0BAA0B,CAAC,UAAU,CAAC,KAAK,CAAC;qBAC5C,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACf,MAAM,IAAI,2CAAkB,CAC1B,UAAU,EACV,oCAAoC,EACpC,eAAe,EACf,KAAK,CACN,CAAA;gBACH,CAAC,CAAC;aACL,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,EAAE;gBACF,+DAA+D;gBAC/D,+BAA+B;YACjC,CAAC;YAED,MAAM,2CAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,KAAK,CAChB,iBAAyC,EACzC,cAA+B,EAC/B,OAA0B,EAC1B,SAA2B;QAE3B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,iBAAiB,EACjB,SAAS,CACV,CAAA;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,0CAAiB,CACzB,eAAe,OAAO,CAAC,UAAU,kCAAkC,CACpE,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,0CAAiB,CACzB,IAAI,OAAO,CAAC,UAAU,6CAA6C,CACpE,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,sBAAsB,CAChC,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,SAAS,CACV,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,iBAAiB,CAC3B,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,SAAS,CACV,CAAA;QACH,CAAC;QAED,MAAM,IAAI,0CAAiB,CACzB,eAAe,OAAO,CAAC,UAAU,iBAAiB,CACnD,CAAA;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,MAAc,EACd,UAAsB,EACtB,SAA2B,EAC3B,OAIC;QAED,iFAAiF;QACjF,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,0BAA0B,EAAE,CAAC;YACrE,MAAM,IAAI,0CAAiB,CACzB,mDAAmD,MAAM,CAAC,QAAQ,CAAC,0BAA0B,SAAS,UAAU,CAAC,MAAM,GAAG,CAC3H,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,0CAAiB,CAAC,qCAAqC,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;QAC9B,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,0CAAiB,CAAC,yCAAyC,CAAC,CAAA;YACxE,CAAC;iBAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;gBACjD,MAAM,IAAI,0CAAiB,CACzB,4CAA4C,CAC7C,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,2EAA2E;YAC3E,yEAAyE;YACzE,4EAA4E;YAC5E,8DAA8D;YAC9D,wEAAwE;YACxE,eAAe;YACf,OAAM;QACR,CAAC;QAED,QAAQ,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAClC,KAAK,8CAAgC,CAAC,CAAC,SAAS;YAChD,KAAK,iBAAiB;gBACpB,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;oBAC5C,MAAM,IAAI,0CAAiB,CACzB,mDAAmD,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAChF,CAAA;gBACH,CAAC;gBACD,IACE,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG;oBACzC,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG;oBACzC,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG,EACzC,CAAC;oBACD,MAAM,IAAI,0CAAiB,CACzB,yFAAyF,CAC1F,CAAA;gBACH,CAAC;gBACD,MAAK;YACP,KAAK,MAAM;gBACT,qEAAqE;gBACrE,mEAAmE;gBACnE,MAAK;YACP;gBACE,MAAM,IAAI,0CAAiB;gBACzB,2DAA2D;gBAC3D,mBAAmB,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAChD,CAAA;QACL,CAAC;IACH,CAAC;IAES,KAAK,CAAC,sBAAsB,CACpC,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,KAA8C,EAC9C,SAA2B;QAE3B,MAAM,IAAI,GAAG,MAAM,oBAAU;aAC1B,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aAC1C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,GAAG,GAAG,IAAA,sBAAW,EAAC,GAAG,EAAE,cAAc,CAAC,CAAA;YAC5C,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACvC,CAAC,CAAC,CAAA;QAEJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc;aACnC,WAAW,CAAC,IAAI,CAAC;aACjB,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,uDAAuD;YACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;YAC1D,IAAI,SAAS,EAAE,CAAC;gBACd,wEAAwE;gBACxE,IAAI,CAAC;oBACH,+CAA+C;oBAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;gBACnD,CAAC;wBAAS,CAAC;oBACT,kEAAkE;oBAClE,kEAAkE;oBAClE,gCAAgC;oBAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,IAAI,CAAA;oBACxC,IAAI,QAAQ,EAAE,CAAC;wBACb,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;oBAC9D,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;QAEJ,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,WAAW;QAEX,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;QAEjE,0EAA0E;QAC1E,UAAU;QACV,MAAM,UAAU,GACd,SAAS;YACT,MAAM,CAAC,QAAQ,CAAC,wBAAwB;YACxC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ;YACvB,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE;YACjD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAA;QAErB,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAE/C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAElE,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAClC,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,UAAU,EACV,IAAI,CACL,CAAA;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,UAA+C,EAC/C,KAA8C;QAE9C,IAAI,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YACnD,MAAM,IAAI,0CAAiB,CACzB,iFAAiF,CAClF,CAAA;QACH,CAAC;QAED,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,0CAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACpC,MAAM,IAAI,0CAAiB,CAAC,yBAAyB,CAAC,CAAA;YACxD,CAAC;YACD,QAAQ,UAAU,CAAC,qBAAqB,EAAE,CAAC;gBACzC,KAAK,SAAS,CAAC,CAAC,qBAAqB;gBACrC,KAAK,OAAO;oBACV,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;wBACtD,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;oBACtD,CAAC;oBACD,MAAK;gBAEP,KAAK,MAAM,CAAC,CAAC,CAAC;oBACZ,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAChC,UAAU,CAAC,cAAc,EACzB,QAAQ,CACT,CAAA;oBACD,MAAM,iBAAiB,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;yBAC3C,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;yBAC3B,MAAM,EAAE,CAAA;oBACX,IAAI,cAAc,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;wBACpD,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;oBACtD,CAAC;oBACD,MAAK;gBACP,CAAC;gBAED;oBACE,qEAAqE;oBACrE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACxD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CACzD,UAAU,CAAC,cAAc,CAC1B,CAAA;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0CAAiB,CAAC,6BAA6B,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,8CAAmB,CAAC,0CAA0C,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,KAAyC,EACzC,SAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,mCAAkB;aAC1C,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;aAC5D,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,GAAG,GAAG,IAAA,sBAAW,EAAC,GAAG,EAAE,uBAAuB,CAAC,CAAA;YACrD,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACvC,CAAC,CAAC,CAAA;QAEJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;QAE3E,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;YAC1B,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YACjE,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;YAEzD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CACxC,MAAM,EACN,UAAU,EACV,cAAc,EACd,SAAS,CACV,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAEjD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAES,KAAK,CAAC,oBAAoB,CAClC,MAAc,EACd,UAAsB,EACtB,IAAe;QAEf,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY;YACtD,CAAC,CAAC;gBACE,mDAAoC;gBACpC,mDAAoC;aACrC;YACH,CAAC,CAAC,CAAC,6CAA8B,EAAE,6CAA8B,CAAC,CAAA;QAEtE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QACxD,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,IAAI,0CAAiB,CAAC,iBAAiB,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QACxD,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,MAAM,CACjB,iBAAyC,EACzC,EAAE,KAAK,EAA4B,EACnC,SAA2B;QAE3B,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,iBAAiB,EACjB,SAAS,CACV,CAAA;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,uEAAuE;YACvE,mCAAmC;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;YAC1B,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YAEjE,0EAA0E;YAC1E,uEAAuE;YACvE,gCAAgC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,WAAW,CAClC,SAAyB,EACzB,KAAuB,EACvB,SAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;QAEzE,IAAI,IAAI,CAAC,eAAe,KAAK,sCAAe,CAAC,SAAS,EAAE,CAAC;YACvD,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,WAAW;YAEX,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CACzD,SAAS,EACT,YAAY,CACb,CAAA;YAED,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QAC1C,CAAC;QAED,OAAO,YAAY,CAAA;IACrB,CAAC;CACF;AAv1BD,sCAu1BC;AAED,SAAS,WAAW,CAElB,EAAE,OAAO,EAAwB;IAEjC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAA;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,OAAO,OAAO,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,kBAAkB,KAAK,IAAI,CAAA;AACpE,CAAC","sourcesContent":["import { createHash } from 'node:crypto'\nimport type { Redis, RedisOptions } from 'ioredis'\nimport { Jwks, Keyset } from '@atproto/jwk'\nimport { LexResolver } from '@atproto/lex-resolver'\nimport type { Account } from '@atproto/oauth-provider-api'\nimport {\n  CLIENT_ASSERTION_TYPE_JWT_BEARER,\n  OAuthAccessToken,\n  OAuthAuthorizationCodeGrantTokenRequest,\n  OAuthAuthorizationRequestJar,\n  OAuthAuthorizationRequestPar,\n  OAuthAuthorizationRequestParameters,\n  OAuthAuthorizationRequestQuery,\n  OAuthAuthorizationServerMetadata,\n  OAuthClientCredentials,\n  OAuthClientMetadata,\n  OAuthParResponse,\n  OAuthRefreshTokenGrantTokenRequest,\n  OAuthTokenIdentification,\n  OAuthTokenRequest,\n  OAuthTokenResponse,\n  OAuthTokenType,\n  atprotoLoopbackClientMetadata,\n  oauthAuthorizationRequestParametersSchema,\n} from '@atproto/oauth-types'\nimport { safeFetchWrap } from '@atproto-labs/fetch-node'\nimport { SimpleStore } from '@atproto-labs/simple-store'\nimport { SimpleStoreMemory } from '@atproto-labs/simple-store-memory'\nimport { AccessTokenMode } from './access-token/access-token-mode.js'\nimport { AccountManager } from './account/account-manager.js'\nimport {\n  AccountStore,\n  AuthorizedClientData,\n  DeviceAccount,\n  asAccountStore,\n} from './account/account-store.js'\nimport { ClientAuth, ClientAuthLegacy } from './client/client-auth.js'\nimport { ClientId } from './client/client-id.js'\nimport {\n  ClientManager,\n  LoopbackMetadataGetter,\n} from './client/client-manager.js'\nimport { ClientStore, ifClientStore } from './client/client-store.js'\nimport { Client } from './client/client.js'\nimport {\n  AUTHENTICATION_MAX_AGE,\n  CONFIDENTIAL_CLIENT_REFRESH_LIFETIME,\n  CONFIDENTIAL_CLIENT_SESSION_LIFETIME,\n  PUBLIC_CLIENT_REFRESH_LIFETIME,\n  PUBLIC_CLIENT_SESSION_LIFETIME,\n  TOKEN_MAX_AGE,\n} from './constants.js'\nimport { Branding, BrandingInput } from './customization/branding.js'\nimport {\n  Customization,\n  CustomizationInput,\n  customizationSchema,\n} from './customization/customization.js'\nimport { DeviceId } from './device/device-id.js'\nimport {\n  DeviceInfo,\n  DeviceManager,\n  DeviceManagerOptions,\n} from './device/device-manager.js'\nimport { DeviceStore, asDeviceStore } from './device/device-store.js'\nimport { AccountSelectionRequiredError } from './errors/account-selection-required-error.js'\nimport { AuthorizationError } from './errors/authorization-error.js'\nimport { ConsentRequiredError } from './errors/consent-required-error.js'\nimport { InvalidDpopKeyBindingError } from './errors/invalid-dpop-key-binding-error.js'\nimport { InvalidDpopProofError } from './errors/invalid-dpop-proof-error.js'\nimport { InvalidGrantError } from './errors/invalid-grant-error.js'\nimport { InvalidRequestError } from './errors/invalid-request-error.js'\nimport { LoginRequiredError } from './errors/login-required-error.js'\nimport { LexiconManager } from './lexicon/lexicon-manager.js'\nimport { LexiconStore, asLexiconStore } from './lexicon/lexicon-store.js'\nimport { HcaptchaConfig } from './lib/hcaptcha.js'\nimport { RequestMetadata } from './lib/http/request.js'\nimport { dateToRelativeSeconds } from './lib/util/date.js'\nimport { formatError } from './lib/util/error.js'\nimport { MultiLangString } from './lib/util/locale.js'\nimport { CustomMetadata, buildMetadata } from './metadata/build-metadata.js'\nimport { OAuthHooks } from './oauth-hooks.js'\nimport {\n  DpopProof,\n  OAuthVerifier,\n  OAuthVerifierOptions,\n  VerifyTokenPayloadOptions,\n} from './oauth-verifier.js'\nimport { ReplayStore, ifReplayStore } from './replay/replay-store.js'\nimport { codeSchema } from './request/code.js'\nimport { RequestManager } from './request/request-manager.js'\nimport { RequestStore, asRequestStore } from './request/request-store.js'\nimport { parseRequestUri } from './request/request-uri.js'\nimport { AuthorizationRedirectParameters } from './result/authorization-redirect-parameters.js'\nimport { AuthorizationResultAuthorizePage } from './result/authorization-result-authorize-page.js'\nimport { AuthorizationResultRedirect } from './result/authorization-result-redirect.js'\nimport { ErrorHandler } from './router/error-handler.js'\nimport { AccessTokenPayload } from './signer/access-token-payload.js'\nimport { TokenData } from './token/token-data.js'\nimport { TokenManager } from './token/token-manager.js'\nimport {\n  TokenStore,\n  asTokenStore,\n  refreshTokenSchema,\n} from './token/token-store.js'\nimport { isPARResponseError } from './types/par-response-error.js'\n\nexport { AccessTokenMode, Keyset, LexResolver }\nexport type {\n  AccessTokenPayload,\n  AuthorizationRedirectParameters,\n  AuthorizationResultAuthorizePage as AuthorizationResultAuthorize,\n  AuthorizationResultRedirect,\n  Branding,\n  BrandingInput,\n  CustomMetadata,\n  Customization,\n  CustomizationInput,\n  ErrorHandler,\n  HcaptchaConfig,\n  MultiLangString,\n  OAuthAuthorizationServerMetadata,\n  VerifyTokenPayloadOptions,\n}\n\ntype OAuthProviderConfig = {\n  /**\n   * Maximum age a device/account session can be before requiring\n   * re-authentication.\n   */\n  authenticationMaxAge?: number\n\n  /**\n   * Maximum age access & id tokens can be before requiring a refresh.\n   */\n  tokenMaxAge?: number\n\n  /**\n   * If set to {@link AccessTokenMode.stateless}, the generated access tokens\n   * will contain all the necessary information to validate the token without\n   * needing to query the database. This is useful for cases where the Resource\n   * Server is on a different host/server than the Authorization Server.\n   *\n   * When set to {@link AccessTokenMode.light}, the access tokens will contain\n   * only the necessary information to validate the token, but the token id\n   * will need to be queried from the database to retrieve the full token\n   * information (scope, audience, etc.)\n   *\n   * @see {@link AccessTokenMode}\n   * @default {AccessTokenMode.stateless}\n   */\n  accessTokenMode?: AccessTokenMode\n\n  /**\n   * Additional metadata to be included in the discovery document.\n   */\n  metadata?: CustomMetadata\n\n  /**\n   * A Lexicon resolver instance to use for fetching lexicon schemas.\n   */\n  lexResolver?: LexResolver\n\n  /**\n   * A custom fetch function that can be used to fetch the client metadata from\n   * the internet. By default, the fetch function is a safeFetchWrap() function\n   * that protects against SSRF attacks, large responses & known bad domains. If\n   * you want to disable all protections, you can provide `globalThis.fetch` as\n   * fetch function.\n   */\n  safeFetch?: typeof globalThis.fetch\n\n  /**\n   * A redis instance to use for replay protection. If not provided, replay\n   * protection will use memory storage.\n   */\n  redis?: Redis | RedisOptions | string\n\n  /**\n   * This will be used as the default store for all the stores. If a store is\n   * not provided, this store will be used instead. If the `store` does not\n   * implement a specific store, a runtime error will be thrown. Make sure that\n   * this store implements all the interfaces not provided in the other\n   * `<name>Store` options.\n   */\n  store?: Partial<\n    AccountStore &\n      ClientStore &\n      DeviceStore &\n      LexiconStore &\n      ReplayStore &\n      RequestStore &\n      TokenStore\n  >\n\n  accountStore?: AccountStore\n  clientStore?: ClientStore\n  deviceStore?: DeviceStore\n  lexiconStore?: LexiconStore\n  replayStore?: ReplayStore\n  requestStore?: RequestStore\n  tokenStore?: TokenStore\n\n  /**\n   * In order to speed up the client fetching process, you can provide a cache\n   * to store HTTP responses.\n   *\n   * @note the cached entries should automatically expire after a certain time (typically 10 minutes)\n   */\n  clientJwksCache?: SimpleStore<string, Jwks>\n\n  /**\n   * In order to speed up the client fetching process, you can provide a cache\n   * to store HTTP responses.\n   *\n   * @note the cached entries should automatically expire after a certain time (typically 10 minutes)\n   */\n  clientMetadataCache?: SimpleStore<string, OAuthClientMetadata>\n\n  /**\n   * In order to enable loopback clients, you can provide a function that\n   * returns the client metadata for a given loopback URL. This is useful for\n   * development and testing purposes. This function is not called for internet\n   * clients.\n   *\n   * @default is as specified by ATPROTO\n   */\n  loopbackMetadata?: null | false | LoopbackMetadataGetter\n}\n\nexport type OAuthProviderOptions = OAuthProviderConfig &\n  OAuthVerifierOptions &\n  OAuthHooks &\n  DeviceManagerOptions &\n  CustomizationInput\n\nexport class OAuthProvider extends OAuthVerifier {\n  protected readonly accessTokenMode: AccessTokenMode\n  protected readonly hooks: OAuthHooks\n\n  public readonly metadata: OAuthAuthorizationServerMetadata\n  public readonly customization: Customization\n\n  public readonly authenticationMaxAge: number\n\n  public readonly accountManager: AccountManager\n  public readonly deviceManager: DeviceManager\n  public readonly clientManager: ClientManager\n  public readonly lexiconManager: LexiconManager\n  public readonly requestManager: RequestManager\n  public readonly tokenManager: TokenManager\n\n  public constructor({\n    // OAuthProviderConfig\n    authenticationMaxAge = AUTHENTICATION_MAX_AGE,\n    tokenMaxAge = TOKEN_MAX_AGE,\n    accessTokenMode = AccessTokenMode.stateless,\n\n    metadata,\n\n    safeFetch = safeFetchWrap(),\n    store, // compound store implementation\n    lexResolver = new LexResolver({ fetch: safeFetch }),\n\n    // Required stores\n    accountStore = asAccountStore(store),\n    deviceStore = asDeviceStore(store),\n    lexiconStore = asLexiconStore(store),\n    tokenStore = asTokenStore(store),\n    requestStore = asRequestStore(store),\n\n    // Optional stores\n    clientStore = ifClientStore(store),\n    replayStore = ifReplayStore(store),\n\n    clientJwksCache = new SimpleStoreMemory({\n      maxSize: 50_000_000,\n      ttl: 600e3,\n    }),\n    clientMetadataCache = new SimpleStoreMemory({\n      maxSize: 50_000_000,\n      ttl: 600e3,\n    }),\n\n    loopbackMetadata = atprotoLoopbackClientMetadata,\n\n    // OAuthHooks &\n    // OAuthVerifierOptions &\n    // DeviceManagerOptions &\n    // Customization\n    ...rest\n  }: OAuthProviderOptions) {\n    super({ replayStore, ...rest })\n\n    // @NOTE: hooks don't really need a type parser, as all zod can actually\n    // check at runtime is the fact that the values are functions. The only way\n    // we would benefit from zod here would be to wrap the functions with a\n    // validator for the provided function's return types, which we don't\n    // really need if types are respected.\n    this.hooks = rest\n\n    this.accessTokenMode = accessTokenMode\n    this.authenticationMaxAge = authenticationMaxAge\n    this.metadata = buildMetadata(this.issuer, this.keyset, metadata)\n    this.customization = customizationSchema.parse(rest)\n\n    this.deviceManager = new DeviceManager(deviceStore, {\n      ...rest,\n      cookie: {\n        ...rest.cookie,\n        // \"secure\" defaults to \"true\" in DeviceManager. For the oauth routes to\n        // work from localhost on Safari, we need to explicitly set secure to\n        // false for localhost usage. This is not really an issue with Chrome\n        // and Firefox, but Safari enforces it strictly.\n        secure: !this.issuer.startsWith('http:'),\n      },\n    })\n    this.accountManager = new AccountManager(\n      this.issuer,\n      accountStore,\n      this.hooks,\n      this.customization,\n    )\n    this.clientManager = new ClientManager(\n      this.metadata,\n      this.keyset,\n      this.hooks,\n      clientStore || null,\n      loopbackMetadata || null,\n      safeFetch,\n      clientJwksCache,\n      clientMetadataCache,\n    )\n    this.lexiconManager = new LexiconManager(lexiconStore, lexResolver)\n    this.requestManager = new RequestManager(\n      requestStore,\n      this.lexiconManager,\n      this.signer,\n      this.metadata,\n      this.hooks,\n    )\n    this.tokenManager = new TokenManager(\n      tokenStore,\n      this.lexiconManager,\n      this.signer,\n      this.hooks,\n      this.accessTokenMode,\n      tokenMaxAge,\n    )\n  }\n\n  get jwks() {\n    return this.keyset.publicJwks\n  }\n\n  /**\n   * @returns true if the user's consent is required for the requested scopes\n   */\n  public checkConsentRequired(\n    parameters: OAuthAuthorizationRequestParameters,\n    clientData?: AuthorizedClientData,\n  ) {\n    // Client was never authorized before\n    if (!clientData) return true\n\n    // Client explicitly asked for consent\n    if (parameters.prompt === 'consent') return true\n\n    // No scope requested, and client is known by user, no consent required\n    const requestedScopes = parameters.scope?.split(' ')\n    if (requestedScopes == null) return false\n\n    // Ensure that all requested scopes were previously authorized by the user\n    const { authorizedScopes } = clientData\n    return !requestedScopes.every((scope) => authorizedScopes.includes(scope))\n  }\n\n  public checkLoginRequired(deviceAccount: DeviceAccount) {\n    const authAge = Date.now() - deviceAccount.updatedAt.getTime()\n    return authAge > this.authenticationMaxAge\n  }\n\n  protected async authenticateClient(\n    clientCredentials: OAuthClientCredentials,\n    dpopProof: null | DpopProof,\n    options?: {\n      allowMissingDpopProof?: boolean\n    },\n  ): Promise<{\n    client: Client\n    clientAuth: ClientAuth\n  }> {\n    const client = await this.clientManager.getClient(\n      clientCredentials.client_id,\n    )\n\n    if (\n      client.metadata.dpop_bound_access_tokens &&\n      !dpopProof &&\n      !options?.allowMissingDpopProof\n    ) {\n      throw new InvalidDpopProofError('DPoP proof required')\n    }\n\n    if (dpopProof && !client.metadata.dpop_bound_access_tokens) {\n      throw new InvalidDpopProofError('DPoP proof not allowed for this client')\n    }\n\n    const clientAuth = await client.authenticate(clientCredentials, {\n      authorizationServerIdentifier: this.issuer,\n    })\n\n    if (clientAuth.method === 'private_key_jwt') {\n      // Clients MUST NOT use their client assertion key to sign DPoP proofs\n      if (dpopProof && clientAuth.jkt === dpopProof.jkt) {\n        throw new InvalidRequestError(\n          'The DPoP proof must be signed with a different key than the client assertion',\n        )\n      }\n\n      // https://www.rfc-editor.org/rfc/rfc7523.html#section-3\n      // > 7.  [...] The authorization server MAY ensure that JWTs are not\n      // >     replayed by maintaining the set of used \"jti\" values for the\n      // >     length of time for which the JWT would be considered valid based\n      // >     on the applicable \"exp\" instant.\n\n      const unique = await this.replayManager.uniqueAuth(\n        clientAuth.jti,\n        client.id,\n        clientAuth.exp,\n      )\n      if (!unique) {\n        throw new InvalidGrantError(`${clientAuth.method} jti reused`)\n      }\n    }\n\n    return { client, clientAuth }\n  }\n\n  async decodeJAR(\n    client: Client,\n    input: OAuthAuthorizationRequestJar,\n  ): Promise<OAuthAuthorizationRequestParameters> {\n    const { payload } = await client.decodeRequestObject(\n      input.request,\n      this.issuer,\n    )\n\n    const { jti } = payload\n    if (!jti) {\n      throw new InvalidRequestError(\n        'Request object payload must contain a \"jti\" claim',\n      )\n    }\n    if (!(await this.replayManager.uniqueJar(jti, client.id))) {\n      throw new InvalidRequestError('Request object was replayed')\n    }\n\n    const parameters = await oauthAuthorizationRequestParametersSchema\n      .parseAsync(payload)\n      .catch((err) => {\n        const msg = formatError(err, 'Invalid parameters in JAR')\n        throw new InvalidRequestError(msg, err)\n      })\n\n    return parameters\n  }\n\n  /**\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc9126}\n   */\n  public async pushedAuthorizationRequest(\n    credentials: OAuthClientCredentials,\n    authorizationRequest: OAuthAuthorizationRequestPar,\n    dpopProof: null | DpopProof,\n  ): Promise<OAuthParResponse> {\n    try {\n      const { client, clientAuth } = await this.authenticateClient(\n        credentials,\n        dpopProof,\n        // Allow missing DPoP header for PAR requests as rfc9449 allows it\n        // (though the dpop_jkt parameter must be present in that case, see\n        // check bellow).\n        { allowMissingDpopProof: true },\n      )\n\n      const parameters =\n        'request' in authorizationRequest // Handle JAR\n          ? await this.decodeJAR(client, authorizationRequest)\n          : authorizationRequest\n\n      if (!parameters.dpop_jkt) {\n        if (client.metadata.dpop_bound_access_tokens) {\n          if (dpopProof) parameters.dpop_jkt = dpopProof.jkt\n          else {\n            // @NOTE When both PAR and DPoP are used, either the DPoP header, or\n            // the dpop_jkt parameter must be present. We do not enforce this\n            // for legacy reasons.\n            // https://datatracker.ietf.org/doc/html/rfc9449#section-10.1\n          }\n        }\n      } else {\n        if (!client.metadata.dpop_bound_access_tokens) {\n          throw new InvalidRequestError(\n            'DPoP bound access tokens are not enabled for this client',\n          )\n        }\n\n        // Proof is optional if the dpop_jkt is provided, but if it is provided,\n        // it must match the DPoP proof JKT.\n        if (dpopProof && dpopProof.jkt !== parameters.dpop_jkt) {\n          throw new InvalidDpopKeyBindingError()\n        }\n      }\n\n      const { requestUri, expiresAt } =\n        await this.requestManager.createAuthorizationRequest(\n          client,\n          clientAuth,\n          parameters,\n          null,\n        )\n\n      return {\n        request_uri: requestUri,\n        expires_in: dateToRelativeSeconds(expiresAt),\n      }\n    } catch (err) {\n      // https://datatracker.ietf.org/doc/html/rfc9126#section-2.3-1\n      // > Since initial processing of the pushed authorization request does not\n      // > involve resource owner interaction, error codes related to user\n      // > interaction, such as \"access_denied\", are never returned.\n      if (err instanceof AuthorizationError && !isPARResponseError(err.error)) {\n        throw new InvalidRequestError(err.error_description, err)\n      }\n      throw err\n    }\n  }\n\n  private async processAuthorizationRequest(\n    client: Client,\n    deviceId: DeviceId,\n    query: OAuthAuthorizationRequestQuery,\n  ) {\n    // PAR\n    if ('request_uri' in query) {\n      const requestUri = parseRequestUri(query.request_uri, {\n        path: ['query', 'request_uri'],\n      })\n      return this.requestManager.get(requestUri, deviceId, client.id)\n    }\n\n    // JAR\n    if ('request' in query) {\n      // @NOTE Since JAR are signed with the client's private key, a JAR *could*\n      // technically be used to authenticate the client when requests are\n      // created without PAR (i.e. created on the fly by the authorize\n      // endpoint). This implementation actually used to support this\n      // (un-spec'd) behavior. That support was removed:\n      // - Because it was not actually used\n      // - Because it was not part of any standard\n      // - Because it makes extending the client authentication mechanism more\n      //   complex since any extension would not only need to affect the\n      //   \"private_key_jwt\" auth method but also the JAR \"request\" object.\n      const parameters = await this.decodeJAR(client, query)\n\n      return this.requestManager.createAuthorizationRequest(\n        client,\n        null,\n        parameters,\n        deviceId,\n      )\n    }\n\n    // \"Regular\" authorization request (created on the fly by directing the user\n    // to the authorization endpoint with all the parameters in the url).\n    return this.requestManager.createAuthorizationRequest(\n      client,\n      null,\n      query,\n      deviceId,\n    )\n  }\n\n  /**\n   * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-4.1.1}\n   */\n  public async authorize(\n    query: OAuthAuthorizationRequestQuery,\n    { deviceId, deviceMetadata }: DeviceInfo,\n  ): Promise<AuthorizationResultRedirect | AuthorizationResultAuthorizePage> {\n    const { issuer } = this\n\n    // If there is a chance to redirect the user to the client, let's do\n    // it by wrapping the error in an AuthorizationError.\n    const throwAuthorizationError =\n      'redirect_uri' in query\n        ? (err: unknown): never => {\n            // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-4.1.2.1\n            throw AuthorizationError.from(query, err)\n          }\n        : null\n\n    const client = await this.clientManager\n      .getClient(query.client_id)\n      .catch(throwAuthorizationError)\n\n    const { parameters, requestUri } = await this.processAuthorizationRequest(\n      client,\n      deviceId,\n      query,\n    ).catch(throwAuthorizationError)\n\n    try {\n      const sessions = (\n        await this.accountManager.listDeviceAccounts(deviceId)\n      ).map((deviceAccount) => ({\n        account: deviceAccount.account,\n\n        // @TODO Return the session expiration date instead of a boolean to\n        // avoid having to rely on a leeway when \"accepting\" the request.\n        loginRequired:\n          parameters.prompt === 'login' ||\n          this.checkLoginRequired(deviceAccount),\n        consentRequired: this.checkConsentRequired(\n          parameters,\n          deviceAccount.authorizedClients.get(client.id),\n        ),\n      }))\n\n      // https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest\n\n      // prompt=select_account\n      //\n      // > The Authorization Server SHOULD prompt the End-User to select a user\n      // > account. This enables an End-User who has multiple accounts at the\n      // > Authorization Server to select amongst the multiple accounts that\n      // > they might have current sessions for. If it cannot obtain an account\n      // > selection choice made by the End-User, it MUST return an error,\n      // > typically account_selection_required.\n      if (parameters.prompt === 'select_account' && !sessions.length) {\n        throw new AccountSelectionRequiredError(parameters)\n      }\n\n      // prompt=none\n      //\n      // > The Authorization Server MUST NOT display any authentication or\n      // > consent user interface pages. An error is returned if an End-User is\n      // > not already authenticated or the Client does not have pre-configured\n      // > consent for the requested Claims or does not fulfill other conditions\n      // > for processing the request. The error code will typically be\n      // > login_required, interaction_required, or another code defined in\n      // > Section 3.1.2.6. This can be used as a method to check for existing\n      // > authentication and/or consent.\n      if (parameters.prompt === 'none') {\n        const ssoSessions = sessions.filter(matchesHint, parameters)\n        if (ssoSessions.length > 1) {\n          throw new AccountSelectionRequiredError(parameters)\n        }\n        if (ssoSessions.length < 1) {\n          throw new LoginRequiredError(parameters)\n        }\n\n        const ssoSession = ssoSessions[0]!\n        if (ssoSession.loginRequired) {\n          throw new LoginRequiredError(parameters)\n        }\n        if (ssoSession.consentRequired) {\n          throw new ConsentRequiredError(parameters)\n        }\n\n        const code = await this.requestManager.setAuthorized(\n          requestUri,\n          client,\n          ssoSession.account,\n          deviceId,\n          deviceMetadata,\n        )\n\n        return { issuer, parameters, redirect: { code } }\n      }\n\n      // Automatic SSO when a hint was provided that matches a single session\n      if (parameters.prompt == null && parameters.login_hint != null) {\n        const ssoSessions = sessions.filter(matchesHint, parameters)\n        if (ssoSessions.length === 1) {\n          const ssoSession = ssoSessions[0]!\n          if (!ssoSession.loginRequired && !ssoSession.consentRequired) {\n            const code = await this.requestManager.setAuthorized(\n              requestUri,\n              client,\n              ssoSession.account,\n              deviceId,\n              deviceMetadata,\n            )\n\n            return { issuer, parameters, redirect: { code } }\n          }\n        }\n      }\n\n      return {\n        issuer,\n        client,\n        parameters,\n        requestUri,\n        sessions,\n        selectedSub:\n          parameters.prompt == null ||\n          parameters.prompt === 'login' ||\n          parameters.prompt === 'consent'\n            ? sessions.find(matchesHint, parameters)?.account.sub\n            : undefined,\n        permissionSets: await this.lexiconManager\n          .getPermissionSetsFromScope(parameters.scope)\n          .catch((cause) => {\n            throw new AuthorizationError(\n              parameters,\n              'Unable to retrieve permission sets',\n              'invalid_scope',\n              cause,\n            )\n          }),\n      }\n    } catch (err) {\n      try {\n        await this.requestManager.delete(requestUri)\n      } catch {\n        // There are two error here. Better keep the outer one.\n        //\n        // @TODO Maybe move this entire code to the /authorize endpoint\n        // (allowing to log this error)\n      }\n\n      throw AuthorizationError.from(parameters, err)\n    }\n  }\n\n  public async token(\n    clientCredentials: OAuthClientCredentials,\n    clientMetadata: RequestMetadata,\n    request: OAuthTokenRequest,\n    dpopProof: null | DpopProof,\n  ): Promise<OAuthTokenResponse> {\n    const { client, clientAuth } = await this.authenticateClient(\n      clientCredentials,\n      dpopProof,\n    )\n\n    if (!this.metadata.grant_types_supported?.includes(request.grant_type)) {\n      throw new InvalidGrantError(\n        `Grant type \"${request.grant_type}\" is not supported by the server`,\n      )\n    }\n\n    if (!client.metadata.grant_types.includes(request.grant_type)) {\n      throw new InvalidGrantError(\n        `\"${request.grant_type}\" grant type is not allowed for this client`,\n      )\n    }\n\n    if (request.grant_type === 'authorization_code') {\n      return this.authorizationCodeGrant(\n        client,\n        clientAuth,\n        clientMetadata,\n        request,\n        dpopProof,\n      )\n    }\n\n    if (request.grant_type === 'refresh_token') {\n      return this.refreshTokenGrant(\n        client,\n        clientAuth,\n        clientMetadata,\n        request,\n        dpopProof,\n      )\n    }\n\n    throw new InvalidGrantError(\n      `Grant type \"${request.grant_type}\" not supported`,\n    )\n  }\n\n  protected async compareClientAuth(\n    client: Client,\n    clientAuth: ClientAuth,\n    dpopProof: null | DpopProof,\n    initial: {\n      parameters: OAuthAuthorizationRequestParameters\n      clientId: ClientId\n      clientAuth: null | ClientAuth | ClientAuthLegacy\n    },\n  ): Promise<void> {\n    // Fool proofing, ensure that the client is authenticating using the right method\n    if (clientAuth.method !== client.metadata.token_endpoint_auth_method) {\n      throw new InvalidGrantError(\n        `Client authentication method mismatch (expected ${client.metadata.token_endpoint_auth_method}, got ${clientAuth.method})`,\n      )\n    }\n\n    if (initial.clientId !== client.id) {\n      throw new InvalidGrantError(`Token was not issued to this client`)\n    }\n\n    const { parameters } = initial\n    if (parameters.dpop_jkt) {\n      if (!dpopProof) {\n        throw new InvalidGrantError(`DPoP proof is required for this request`)\n      } else if (parameters.dpop_jkt !== dpopProof.jkt) {\n        throw new InvalidGrantError(\n          `DPoP proof does not match the expected JKT`,\n        )\n      }\n    }\n\n    if (!initial.clientAuth) {\n      // If the client did not use PAR, it was not authenticated when the request\n      // was initially created (see authorize() method in OAuthProvider). Since\n      // PAR is not mandatory, and since the token exchange currently taking place\n      // *is* authenticated (`clientAuth`), we allow \"upgrading\" the\n      // authentication method (the token created will be bound to the current\n      // clientAuth).\n      return\n    }\n\n    switch (initial.clientAuth.method) {\n      case CLIENT_ASSERTION_TYPE_JWT_BEARER: // LEGACY\n      case 'private_key_jwt':\n        if (clientAuth.method !== 'private_key_jwt') {\n          throw new InvalidGrantError(\n            `Client authentication method mismatch (expected ${initial.clientAuth.method})`,\n          )\n        }\n        if (\n          clientAuth.kid !== initial.clientAuth.kid ||\n          clientAuth.alg !== initial.clientAuth.alg ||\n          clientAuth.jkt !== initial.clientAuth.jkt\n        ) {\n          throw new InvalidGrantError(\n            `The session was initiated with a different key than the client assertion currently used`,\n          )\n        }\n        break\n      case 'none':\n        // @NOTE We allow the client to \"upgrade\" to a confidential client if\n        // the session was initially created without client authentication.\n        break\n      default:\n        throw new InvalidGrantError(\n          // @ts-expect-error (future proof, backwards compatibility)\n          `Invalid method \"${initial.clientAuth.method}\"`,\n        )\n    }\n  }\n\n  protected async authorizationCodeGrant(\n    client: Client,\n    clientAuth: ClientAuth,\n    clientMetadata: RequestMetadata,\n    input: OAuthAuthorizationCodeGrantTokenRequest,\n    dpopProof: null | DpopProof,\n  ): Promise<OAuthTokenResponse> {\n    const code = await codeSchema\n      .parseAsync(input.code, { path: ['code'] })\n      .catch((err) => {\n        const msg = formatError(err, 'Invalid code')\n        throw new InvalidGrantError(msg, err)\n      })\n\n    const data = await this.requestManager\n      .consumeCode(code)\n      .catch(async (err) => {\n        // Code not found in request manager: check for replays\n        const tokenInfo = await this.tokenManager.findByCode(code)\n        if (tokenInfo) {\n          // try/finally to ensure that both code path get executed (sequentially)\n          try {\n            // \"code\" was replayed, delete existing session\n            await this.tokenManager.deleteToken(tokenInfo.id)\n          } finally {\n            // As an additional security measure, we also sign the device out,\n            // so that the device cannot be used to access the account anymore\n            // without a new authentication.\n            const { deviceId, sub } = tokenInfo.data\n            if (deviceId) {\n              await this.accountManager.removeDeviceAccount(deviceId, sub)\n            }\n          }\n        }\n\n        throw InvalidGrantError.from(err, `Invalid code`)\n      })\n\n    // @NOTE at this point, the request data was removed from the store and only\n    // exists in memory here (in the \"data\" variable). Because of this, any\n    // error thrown after this point will permanently cause the request data to\n    // be lost.\n\n    await this.compareClientAuth(client, clientAuth, dpopProof, data)\n\n    // If the DPoP proof was not provided earlier (PAR / authorize), let's add\n    // it now.\n    const parameters =\n      dpopProof &&\n      client.metadata.dpop_bound_access_tokens &&\n      !data.parameters.dpop_jkt\n        ? { ...data.parameters, dpop_jkt: dpopProof.jkt }\n        : data.parameters\n\n    await this.validateCodeGrant(parameters, input)\n\n    const { account } = await this.accountManager.getAccount(data.sub)\n\n    return this.tokenManager.createToken(\n      client,\n      clientAuth,\n      clientMetadata,\n      account,\n      data.deviceId,\n      parameters,\n      code,\n    )\n  }\n\n  protected async validateCodeGrant(\n    parameters: OAuthAuthorizationRequestParameters,\n    input: OAuthAuthorizationCodeGrantTokenRequest,\n  ): Promise<void> {\n    if (parameters.redirect_uri !== input.redirect_uri) {\n      throw new InvalidGrantError(\n        'The redirect_uri parameter must match the one used in the authorization request',\n      )\n    }\n\n    if (parameters.code_challenge) {\n      if (!input.code_verifier) {\n        throw new InvalidGrantError('code_verifier is required')\n      }\n      if (input.code_verifier.length < 43) {\n        throw new InvalidGrantError('code_verifier too short')\n      }\n      switch (parameters.code_challenge_method) {\n        case undefined: // default is \"plain\"\n        case 'plain':\n          if (parameters.code_challenge !== input.code_verifier) {\n            throw new InvalidGrantError('Invalid code_verifier')\n          }\n          break\n\n        case 'S256': {\n          const inputChallenge = Buffer.from(\n            parameters.code_challenge,\n            'base64',\n          )\n          const computedChallenge = createHash('sha256')\n            .update(input.code_verifier)\n            .digest()\n          if (inputChallenge.compare(computedChallenge) !== 0) {\n            throw new InvalidGrantError('Invalid code_verifier')\n          }\n          break\n        }\n\n        default:\n          // Should never happen (because request validation should catch this)\n          throw new Error(`Unsupported code_challenge_method`)\n      }\n      const unique = await this.replayManager.uniqueCodeChallenge(\n        parameters.code_challenge,\n      )\n      if (!unique) {\n        throw new InvalidGrantError('Code challenge already used')\n      }\n    } else if (input.code_verifier !== undefined) {\n      throw new InvalidRequestError(\"code_challenge parameter wasn't provided\")\n    }\n  }\n\n  protected async refreshTokenGrant(\n    client: Client,\n    clientAuth: ClientAuth,\n    clientMetadata: RequestMetadata,\n    input: OAuthRefreshTokenGrantTokenRequest,\n    dpopProof: null | DpopProof,\n  ): Promise<OAuthTokenResponse> {\n    const refreshToken = await refreshTokenSchema\n      .parseAsync(input.refresh_token, { path: ['refresh_token'] })\n      .catch((err) => {\n        const msg = formatError(err, 'Invalid refresh token')\n        throw new InvalidGrantError(msg, err)\n      })\n\n    const tokenInfo = await this.tokenManager.consumeRefreshToken(refreshToken)\n\n    try {\n      const { data } = tokenInfo\n      await this.compareClientAuth(client, clientAuth, dpopProof, data)\n      await this.validateRefreshGrant(client, clientAuth, data)\n\n      return await this.tokenManager.rotateToken(\n        client,\n        clientAuth,\n        clientMetadata,\n        tokenInfo,\n      )\n    } catch (err) {\n      await this.tokenManager.deleteToken(tokenInfo.id)\n\n      throw err\n    }\n  }\n\n  protected async validateRefreshGrant(\n    client: Client,\n    clientAuth: ClientAuth,\n    data: TokenData,\n  ): Promise<void> {\n    const [sessionLifetime, refreshLifetime] =\n      clientAuth.method !== 'none' || client.info.isFirstParty\n        ? [\n            CONFIDENTIAL_CLIENT_SESSION_LIFETIME,\n            CONFIDENTIAL_CLIENT_REFRESH_LIFETIME,\n          ]\n        : [PUBLIC_CLIENT_SESSION_LIFETIME, PUBLIC_CLIENT_REFRESH_LIFETIME]\n\n    const sessionAge = Date.now() - data.createdAt.getTime()\n    if (sessionAge > sessionLifetime) {\n      throw new InvalidGrantError(`Session expired`)\n    }\n\n    const refreshAge = Date.now() - data.updatedAt.getTime()\n    if (refreshAge > refreshLifetime) {\n      throw new InvalidGrantError(`Refresh token expired`)\n    }\n  }\n\n  /**\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7009#section-2.1 rfc7009}\n   */\n  public async revoke(\n    clientCredentials: OAuthClientCredentials,\n    { token }: OAuthTokenIdentification,\n    dpopProof: null | DpopProof,\n  ) {\n    // > The authorization server first validates the client credentials (in\n    // > case of a confidential client)\n    const { client, clientAuth } = await this.authenticateClient(\n      clientCredentials,\n      dpopProof,\n    )\n\n    const tokenInfo = await this.tokenManager.findToken(token)\n    if (tokenInfo) {\n      // > [...] and then verifies whether the token was issued to the client\n      // > making the revocation request.\n      const { data } = tokenInfo\n      await this.compareClientAuth(client, clientAuth, dpopProof, data)\n\n      // > In the next step, the authorization server invalidates the token. The\n      // > invalidation takes place immediately, and the token cannot be used\n      // > again after the revocation.\n      await this.tokenManager.deleteToken(tokenInfo.id)\n    }\n  }\n\n  protected override async decodeToken(\n    tokenType: OAuthTokenType,\n    token: OAuthAccessToken,\n    dpopProof: null | DpopProof,\n  ): Promise<AccessTokenPayload> {\n    const tokenPayload = await super.decodeToken(tokenType, token, dpopProof)\n\n    if (this.accessTokenMode !== AccessTokenMode.stateless) {\n      // @NOTE in non stateless mode, some claims can be omitted (most notably\n      // \"scope\"). We load the token claims here (allowing to ensure that the\n      // token is still valid, and to retrieve a (potentially updated) set of\n      // claims).\n\n      const tokenClaims = await this.tokenManager.loadTokenClaims(\n        tokenType,\n        tokenPayload,\n      )\n\n      Object.assign(tokenPayload, tokenClaims)\n    }\n\n    return tokenPayload\n  }\n}\n\nfunction matchesHint(\n  this: OAuthAuthorizationRequestParameters,\n  { account }: { account: Account },\n): boolean {\n  const hint = this.login_hint\n  if (!hint) return false\n\n  return account.sub === hint || account.preferred_username === hint\n}\n"]}

package/dist/result/authorization-result-authorize-page.d.ts

@@ -1,5 +1,5 @@
 import type { LexiconPermissionSet } from '@atproto/lex-document';
-import type { Session } from '@atproto/oauth-provider-api';
+import type { Account, Session } from '@atproto/oauth-provider-api';
 import type { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types';
 import type { Client } from '../client/client.js';
 import type { RequestUri } from '../request/request-uri.js';
@@ -10,5 +10,6 @@ export type AuthorizationResultAuthorizePage = {
     permissionSets: Map<string, LexiconPermissionSet>;
     requestUri: RequestUri;
     sessions: readonly Session[];
+    selectedSub?: Account['sub'];
 };
 //# sourceMappingURL=authorization-result-authorize-page.d.ts.map

package/dist/result/authorization-result-authorize-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-result-authorize-page.d.ts","sourceRoot":"","sources":["../../src/result/authorization-result-authorize-page.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAE3D,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,mCAAmC,CAAA;IAC/C,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAEjD,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAA;CAC7B,CAAA"}
+{"version":3,"file":"authorization-result-authorize-page.d.ts","sourceRoot":"","sources":["../../src/result/authorization-result-authorize-page.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAE3D,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,mCAAmC,CAAA;IAC/C,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAEjD,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;CAC7B,CAAA"}

package/dist/result/authorization-result-authorize-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-result-authorize-page.js","sourceRoot":"","sources":["../../src/result/authorization-result-authorize-page.ts"],"names":[],"mappings":"","sourcesContent":["import type { LexiconPermissionSet } from '@atproto/lex-document'\nimport type { Session } from '@atproto/oauth-provider-api'\nimport type { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'\nimport type { Client } from '../client/client.js'\nimport type { RequestUri } from '../request/request-uri.js'\n\nexport type AuthorizationResultAuthorizePage = {\n  issuer: string\n  client: Client\n  parameters: OAuthAuthorizationRequestParameters\n  permissionSets: Map<string, LexiconPermissionSet>\n\n  requestUri: RequestUri\n  sessions: readonly Session[]\n}\n"]}
+{"version":3,"file":"authorization-result-authorize-page.js","sourceRoot":"","sources":["../../src/result/authorization-result-authorize-page.ts"],"names":[],"mappings":"","sourcesContent":["import type { LexiconPermissionSet } from '@atproto/lex-document'\nimport type { Account, Session } from '@atproto/oauth-provider-api'\nimport type { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'\nimport type { Client } from '../client/client.js'\nimport type { RequestUri } from '../request/request-uri.js'\n\nexport type AuthorizationResultAuthorizePage = {\n  issuer: string\n  client: Client\n  parameters: OAuthAuthorizationRequestParameters\n  permissionSets: Map<string, LexiconPermissionSet>\n\n  requestUri: RequestUri\n  sessions: readonly Session[]\n  selectedSub?: Account['sub']\n}\n"]}

package/dist/router/assets/assets.d.ts

@@ -1,11 +1,10 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { HydrationData as FeHydrationData } from '@atproto/oauth-provider-frontend/hydration-data';
 import type { HydrationData as UiHydrationData } from '@atproto/oauth-provider-ui/hydration-data';
 import { Customization } from '../../customization/customization.js';
 import { WriteResponseOptions } from '../../lib/http/response.js';
 import { SecurityHeadersOptions } from '../../lib/http/security-headers.js';
 import { Simplify } from '../../lib/util/type.js';
-type HydrationData = Simplify<UiHydrationData & FeHydrationData>;
+type HydrationData = Simplify<UiHydrationData>;
 export declare const assetsMiddleware: import("../../lib/http/types.js").Middleware;
 export type SendWebAppOptions = SecurityHeadersOptions & WriteResponseOptions;
 export declare function sendWebAppFactory<P extends keyof HydrationData>(page: P, customization: Customization, defaults?: SendWebAppOptions): (req: IncomingMessage, res: ServerResponse, options: SendWebAppOptions & {

package/dist/router/assets/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../src/router/assets/assets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,aAAa,IAAI,eAAe,EAAE,MAAM,iDAAiD,CAAA;AACvG,OAAO,KAAK,EAAE,aAAa,IAAI,eAAe,EAAE,MAAM,2CAA2C,CAAA;AAGjG,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AAKpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAEL,sBAAsB,EACvB,MAAM,oCAAoC,CAAA;AAE3C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAmBjD,KAAK,aAAa,GAAG,QAAQ,CAAC,eAAe,GAAG,eAAe,CAAC,CAAA;AAUhE,eAAO,MAAM,gBAAgB,8CAG3B,CAAA;AAqBF,MAAM,MAAM,iBAAiB,GAAG,sBAAsB,GAAG,oBAAoB,CAAA;AAE7E,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,aAAa,EAC7D,IAAI,EAAE,CAAC,EACP,aAAa,EAAE,aAAa,EAC5B,QAAQ,GAAE,iBAAsB,IAa9B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,SAAS,iBAAiB,GAAG;IAC3B,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAA;CACpD,KACA,OAAO,CAAC,IAAI,CAAC,CAwBjB"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../src/router/assets/assets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,aAAa,IAAI,eAAe,EAAE,MAAM,2CAA2C,CAAA;AAGjG,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AAIpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAEL,sBAAsB,EACvB,MAAM,oCAAoC,CAAA;AAE3C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAgBjD,KAAK,aAAa,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAA;AAU9C,eAAO,MAAM,gBAAgB,8CAAsB,CAAA;AAqBnD,MAAM,MAAM,iBAAiB,GAAG,sBAAsB,GAAG,oBAAoB,CAAA;AAE7E,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,aAAa,EAC7D,IAAI,EAAE,CAAC,EACP,aAAa,EAAE,aAAa,EAC5B,QAAQ,GAAE,iBAAsB,IA6B9B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,SAAS,iBAAiB,GAAG;IAC3B,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAA;CACpD,KACA,OAAO,CAAC,IAAI,CAAC,CAqBjB"}

package/dist/router/assets/assets.js

@@ -7,7 +7,6 @@ const build_customization_data_js_1 = require("../../customization/build-customi
 const index_js_1 = require("../../lib/csp/index.js");
 const hydration_data_js_1 = require("../../lib/html/hydration-data.js");
 const index_js_2 = require("../../lib/html/index.js");
-const middleware_js_1 = require("../../lib/http/middleware.js");
 const security_headers_js_1 = require("../../lib/http/security-headers.js");
 const object_js_1 = require("../../lib/util/object.js");
 const write_html_js_1 = require("../../lib/write-html.js");
@@ -20,18 +19,14 @@ const csrf_js_1 = require("./csrf.js");
 //   require.resolve('@atproto/oauth-provider-ui/bundle-manifest.json'),
 // )
 const ui = (0, assets_manifest_js_1.parseAssetsManifest)(require.resolve('@atproto/oauth-provider-ui/bundle-manifest.json'));
-const fe = (0, assets_manifest_js_1.parseAssetsManifest)(require.resolve('@atproto/oauth-provider-frontend/bundle-manifest.json'));
 function getAssets(entryName) {
-    const assetRef = ui.getAssets(entryName) || fe.getAssets(entryName);
+    const assetRef = ui.getAssets(entryName);
     if (assetRef)
         return assetRef;
     // Fool-proof. Should never happen.
     throw new Error(`Entry "${entryName}" not found in assets`);
 }
-exports.assetsMiddleware = (0, middleware_js_1.combineMiddlewares)([
-    ui.assetsMiddleware,
-    fe.assetsMiddleware,
-]);
+exports.assetsMiddleware = ui.assetsMiddleware;
 const SPA_CSP = {
     // API calls are made to the same origin
     'connect-src': ["'self'"],
@@ -54,7 +49,22 @@ function sendWebAppFactory(page, customization, defaults = {}) {
     const customizationData = (0, build_customization_data_js_1.buildCustomizationData)(customization);
     const customizationCss = (0, index_js_2.cssCode)((0, build_customization_css_js_1.buildCustomizationCss)(customization));
     const { scripts, styles } = getAssets(page);
-    const csp = (0, index_js_1.mergeCsp)(SPA_CSP, customization?.hcaptcha ? HCAPTCHA_CSP : undefined);
+    const csp = (0, index_js_1.mergeCsp)(SPA_CSP, customization.hcaptcha ? HCAPTCHA_CSP : undefined);
+    const coep = customization.hcaptcha
+        ? // hCaptcha's implementation of COEP is currently broken. Let's disable it
+            // to avoid breaking the entire page.
+            //
+            // https://github.com/hCaptcha/react-hcaptcha/issues/259
+            // https://github.com/hCaptcha/react-hcaptcha/issues/380
+            security_headers_js_1.CrossOriginEmbedderPolicy.unsafeNone
+        : // Since we are loading avatars form other origins, which might not have
+            // CORP headers, we need to use the "credentialless" value, which allows
+            // loading cross-origin resources without credentials (cookies, client
+            // certificates, etc.). This is a more secure alternative to
+            // "unsafe-none". Ideally, we would want to set COEP to "require-corp" and
+            // ensure that all cross-origin resources have the appropriate CORP
+            // headers.
+            security_headers_js_1.CrossOriginEmbedderPolicy.credentialless;
     return async function sendWebApp(req, res, options) {
         await (0, csrf_js_1.setupCsrfToken)(req, res);
         const script = (0, hydration_data_js_1.declareHydrationData)({
@@ -62,11 +72,9 @@ function sendWebAppFactory(page, customization, defaults = {}) {
             __customizationData: customizationData,
         });
         return (0, write_html_js_1.writeHtml)(res, (0, object_js_1.mergeDefaults)(defaults, options, {
-            bodyAttrs: {
-                class: 'bg-white text-slate-900 dark:bg-slate-900 dark:text-slate-100',
-            },
+            bodyAttrs: { class: 'text-text-default bg-contrast-0' },
             csp: options?.csp ? (0, index_js_1.mergeCsp)(csp, options.csp) : csp,
-            coep: options?.coep ?? security_headers_js_1.CrossOriginEmbedderPolicy.credentialless,
+            coep: options?.coep ?? coep,
             meta: [{ name: 'robots', content: 'noindex' }],
             body: (0, index_js_2.html) `<div id="root"></div>`,
             scripts: [script, ...scripts],