@atproto/oauth-provider 0.16.4 → 0.17.0-next.0

package/dist/client/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client/client.ts"],"names":[],"mappings":";;;AAiYA,8CAQC;AAzYD,+BAgBa;AAEb,sDAM6B;AAC7B,kDAAuE;AACvE,6EAAqE;AACrE,6GAAmG;AACnG,+EAAsE;AACtE,iGAAuF;AACvF,iFAAwE;AACxE,6EAAoE;AACpE,iDAA6C;AAC7C,iEAAgE;AAMhE,MAAM,EAAE,SAAS,EAAE,GAAG,aAAM,CAAA;AAE5B,MAAa,MAAM;IAWC;IACA;IACA;IACA;IAblB;;OAEG;IACH,MAAM,CAAU,sBAAsB,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAU,CAAA;IAE5D,SAAS,CAEU;IAEpC,YACkB,EAAY,EACZ,QAA6B,EAC7B,OAAyB,QAAQ,CAAC,IAAI,EACtC,IAAgB;QAHhB,OAAE,GAAF,EAAE,CAAU;QACZ,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,SAAI,GAAJ,IAAI,CAAkC;QACtC,SAAI,GAAJ,IAAI,CAAY;QAEhC,2EAA2E;QAC3E,IAAI,CAAC,SAAS;YACZ,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBACxB,CAAC,CAAC,IAAA,wBAAiB,EAAC,IAAI,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBACzC,CAAC,CAAC,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,mBAAmB,CAC9B,GAA4B,EAC5B,QAAgB;QAEhB,oEAAoE;QACpE,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,CAAC;YACH,yEAAyE;YACzE,6CAA6C;YAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,0BAA0B,KAAK,MAAM,EAAE,CAAC;gBACxD,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;oBACxC,QAAQ;oBACR,WAAW,EAAE,0BAAW,GAAG,GAAG;oBAC9B,oBAAoB,EAAE,IAAI;oBAC1B,kBAAkB,EAAE,IAAI;iBACzB,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBAC/B,QAAQ;gBACR,WAAW,EAAE,0BAAW,GAAG,GAAG;gBAC9B,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,0BAA0B;oBAClD,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC;oBAC5C,CAAC,CAAC,8EAA8E;wBAC9E,EAAE;wBACF,uEAAuE;wBACvE,4BAA4B;wBAC5B,SAAS;aACd,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,SAAS;gBACtB,CAAC,CAAC,6BAA6B,GAAG,CAAC,OAAO,EAAE;gBAC5C,CAAC,CAAC,0BAA0B,CAAA;YAEhC,MAAM,IAAI,8CAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,KAAa,EACb,EACE,QAAQ,EACR,oBAAoB,GAAG,KAAK,EAC5B,kBAAkB,GAAG,KAAK,EAC1B,GAAG,OAAO,KAIR,EAAE;QAEN,wEAAwE;QACxE,yEAAyE;QACzE,WAAW;QAEX,MAAM,MAAM,GAAG,mBAAY,CAAC,MAAM,CAAc,KAAK,EAAE,OAAO,CAAC,CAAA;QAE/D,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,IAAI,SAAS,CAAC,wBAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;YACpE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,oBAAoB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACxD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,IAAA,iBAAO,EAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAC9C,IAAI,CAAC,IAAA,iBAAO,EAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC/D,MAAM,IAAI,SAAS,CAAC,wBAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;gBACpE,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAES,KAAK,CAAC,SAAS,CACvB,KAAa,EACb,OAA0C;QAE1C,OAAO,IAAA,gBAAS,EAAc,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YACnD,GAAG,OAAO;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;SAChB,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,YAAY,CACvB,KAA6B,EAC7B,MAEC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAA;QAEvD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC3B,CAAC;QAED,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,kBAAkB,IAAI,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,8CAAmB,CAC3B,iCAAiC,MAAM,iCAAiC,CACzE,CAAA;YACH,CAAC;YAED,IAAI,KAAK,CAAC,qBAAqB,KAAK,8CAAgC,EAAE,CAAC;gBACrE,wDAAwD;gBAExD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAGhC,KAAK,CAAC,gBAAgB,EAAE;oBACzB,oEAAoE;oBACpE,6DAA6D;oBAC7D,EAAE;oBACF,iDAAiD;oBAEjD,oEAAoE;oBACpE,sEAAsE;oBACtE,oEAAoE;oBACpE,oDAAoD;oBACpD,OAAO,EAAE,IAAI,CAAC,EAAE;oBAEhB,mEAAmE;oBACnE,qEAAqE;oBACrE,oEAAoE;oBACpE,mEAAmE;oBACnE,gEAAgE;oBAChE,QAAQ,EAAE,MAAM,CAAC,6BAA6B;oBAE9C,cAAc,EAAE;wBACd,kEAAkE;wBAClE,gEAAgE;wBAChE,EAAE;wBACF,gEAAgE;wBAChE,mEAAmE;wBACnE,wDAAwD;wBACxD,mEAAmE;wBACnE,+CAA+C;wBAE/C,SAAS;wBAET,kEAAkE;wBAClE,iEAAiE;wBACjE,oEAAoE;wBACpE,iEAAiE;wBACjE,mEAAmE;wBACnE,gBAAgB;wBAChB,KAAK;qBACN;oBAED,4DAA4D;oBAC5D,8DAA8D;oBAC9D,gCAAgC;oBAChC,EAAE;oBACF,mCAAmC;oBAEnC,sEAAsE;oBACtE,4DAA4D;oBAC5D,sEAAsE;oBACtE,6CAA6C;oBAC7C,WAAW,EAAE,uCAAwB,GAAG,IAAI;iBAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACf,MAAM,GAAG,GACP,GAAG,YAAY,SAAS;wBACtB,CAAC,CAAC,4CAA4C,GAAG,CAAC,OAAO,EAAE;wBAC3D,CAAC,CAAC,yCAAyC,CAAA;oBAE/C,MAAM,IAAI,4CAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBACxC,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC;oBAChC,MAAM,IAAI,4CAAkB,CAAC,oCAAoC,CAAC,CAAA;gBACpE,CAAC;gBAED,OAAO;oBACL,MAAM,EAAE,iBAAiB;oBACzB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;oBACvB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;oBACvB,GAAG,EAAE,MAAM,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC;oBACxC,GAAG,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG;oBAC/B,GAAG,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG;iBAChC,CAAA;YACH,CAAC;YAED,MAAM,IAAI,4CAAkB,CAC1B,sCAAsC,KAAK,CAAC,qBAAqB,GAAG,CACrE,CAAA;QACH,CAAC;QAED,wEAAwE;QACxE,4CAA4C;QAC5C,IAAI,MAAM,CAAC,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,+CAA+C;gBAC7C,MAAM,CAAC,sBAAsB;aAC9B,EAAE,CACJ,CAAA;QACH,CAAC;QAED,MAAM,IAAI,6DAA0B,CAClC,2CAA2C,MAAM,GAAG,CACrD,CAAA;IACH,CAAC;IAED;;OAEG;IACI,eAAe,CACpB,UAAyD;QAEzD,IAAI,UAAU,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,2CAAkB,CAC1B,UAAU,EACV,0FAA0F,CAC3F,CAAA;QACH,CAAC;QAED,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,qEAAqE;YACrE,YAAY;YACZ,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;YAEtD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,0CAAiB,CACzB,UAAU,EACV,+CAA+C,CAChD,CAAA;YACH,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpC,MAAM,IAAI,0CAAiB,CACzB,UAAU,EACV,UAAU,KAAK,0CAA0C,CAC1D,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,2CAAkB,CAC1B,UAAU,EACV,0BAA0B,UAAU,CAAC,aAAa,2BAA2B,CAC9E,CAAA;QACH,CAAC;QAED,IAAI,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,2CAAkB,CAC1B,UAAU,EACV,uEAAuE,CACxE,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,GAAG,UAAU,CAAA;QACnC,IAAI,YAAY,EAAE,CAAC;YACjB,IACE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,IAAA,oCAAkB,EAAC,GAAG,EAAE,YAAY,CAAC,CACtC,EACD,CAAC;gBACD,MAAM,IAAI,2CAAkB,CAC1B,UAAU,EACV,wBAAwB,YAAY,EAAE,CACvC,CAAA;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAA;YACnC,IAAI,kBAAkB,EAAE,CAAC;gBACvB,UAAU,GAAG,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAA;YAClE,CAAC;iBAAM,CAAC;gBACN,uFAAuF;gBACvF,EAAE;gBACF,wEAAwE;gBACxE,4EAA4E;gBAC5E,YAAY;gBACZ,MAAM,IAAI,2CAAkB,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAA;YACtE,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,qBAAqB,EAAE,CAAC;YACrC,MAAM,EAAE,2BAA2B,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAA;YACrD,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBACjC,MAAM,IAAI,yEAAgC,CACxC,UAAU,EACV,8DAA8D,CAC/D,CAAA;YACH,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,CAAC;gBACtD,IAAI,CAAC,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxD,MAAM,IAAI,yEAAgC,CACxC,UAAU,EACV,yEAAyE,MAAM,CAAC,IAAI,GAAG,CACxF,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAA;QACvC,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClE,CAAC;;AArVH,wBAsVC;AAEM,KAAK,UAAU,iBAAiB,CACrC,GAAyB;IAEzB,IAAI,CAAC;QACH,OAAO,MAAM,IAAA,6BAAsB,EAAC,MAAM,IAAA,gBAAS,EAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAA;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,4CAAkB,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACvE,CAAC;AACH,CAAC","sourcesContent":["import {\n  JWTClaimVerificationOptions,\n  type JWTHeaderParameters,\n  type JWTPayload,\n  type JWTVerifyOptions,\n  type JWTVerifyResult,\n  type KeyLike,\n  type ResolvedKey,\n  UnsecuredJWT,\n  type UnsecuredResult,\n  calculateJwkThumbprint,\n  createLocalJWKSet,\n  createRemoteJWKSet,\n  errors,\n  exportJWK,\n  jwtVerify,\n} from 'jose'\nimport { Jwks, SignedJwt, UnsignedJwt } from '@atproto/jwk'\nimport {\n  CLIENT_ASSERTION_TYPE_JWT_BEARER,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientCredentials,\n  OAuthClientMetadata,\n  OAuthRedirectUri,\n} from '@atproto/oauth-types'\nimport { CLIENT_ASSERTION_MAX_AGE, JAR_MAX_AGE } from '../constants.js'\nimport { AuthorizationError } from '../errors/authorization-error.js'\nimport { InvalidAuthorizationDetailsError } from '../errors/invalid-authorization-details-error.js'\nimport { InvalidClientError } from '../errors/invalid-client-error.js'\nimport { InvalidClientMetadataError } from '../errors/invalid-client-metadata-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport { InvalidScopeError } from '../errors/invalid-scope-error.js'\nimport { asArray } from '../lib/util/cast.js'\nimport { compareRedirectUri } from '../lib/util/redirect-uri.js'\nimport { Awaitable } from '../lib/util/type.js'\nimport { ClientAuth } from './client-auth.js'\nimport { ClientId } from './client-id.js'\nimport { ClientInfo } from './client-info.js'\n\nconst { JOSEError } = errors\n\nexport class Client {\n  /**\n   * @see {@link https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#token-endpoint-auth-method}\n   */\n  static readonly AUTH_METHODS_SUPPORTED = ['none', 'private_key_jwt'] as const\n\n  private readonly keyGetter: (\n    protectedHeader: JWTHeaderParameters,\n  ) => Awaitable<KeyLike | Uint8Array>\n\n  constructor(\n    public readonly id: ClientId,\n    public readonly metadata: OAuthClientMetadata,\n    public readonly jwks: undefined | Jwks = metadata.jwks,\n    public readonly info: ClientInfo,\n  ) {\n    // If the remote JWKS content is provided, we don't need to fetch it again.\n    this.keyGetter =\n      jwks || !metadata.jwks_uri\n        ? createLocalJWKSet(jwks || { keys: [] })\n        : createRemoteJWKSet(new URL(metadata.jwks_uri), {})\n  }\n\n  /**\n   * @see {@link https://www.rfc-editor.org/rfc/rfc9101.html#name-request-object-2}\n   */\n  public async decodeRequestObject(\n    jar: SignedJwt | UnsignedJwt,\n    audience: string,\n  ) {\n    // https://www.rfc-editor.org/rfc/rfc9101.html#name-request-object-2\n    // > If signed, the Authorization Request Object SHOULD contain the Claims\n    // > iss (issuer) and aud (audience) as members with their semantics being\n    // > the same as defined in the JWT [RFC7519] specification. The value of\n    // > aud should be the value of the authorization server (AS) issuer, as\n    // > defined in RFC 8414 [RFC8414].\n    try {\n      // We need to special case the \"none\" algorithm, as the validation method\n      // is different for signed and unsigned JWTs.\n      if (this.metadata.request_object_signing_alg === 'none') {\n        return await this.jwtVerifyUnsecured(jar, {\n          audience,\n          maxTokenAge: JAR_MAX_AGE / 1e3,\n          allowMissingAudience: true,\n          allowMissingIssuer: true,\n        })\n      }\n\n      return await this.jwtVerify(jar, {\n        audience,\n        maxTokenAge: JAR_MAX_AGE / 1e3,\n        algorithms: this.metadata.request_object_signing_alg\n          ? [this.metadata.request_object_signing_alg]\n          : // https://openid.net/specs/openid-connect-registration-1_0.html#rfc.section.2\n            //\n            // > The default, if omitted, is that any algorithm supported by the OP\n            // > and the RP MAY be used.\n            undefined,\n      })\n    } catch (err) {\n      const message =\n        err instanceof JOSEError\n          ? `Invalid \"request\" object: ${err.message}`\n          : `Invalid \"request\" object`\n\n      throw new InvalidRequestError(message, err)\n    }\n  }\n\n  protected async jwtVerifyUnsecured<PayloadType = JWTPayload>(\n    token: string,\n    {\n      audience,\n      allowMissingAudience = false,\n      allowMissingIssuer = false,\n      ...options\n    }: Omit<JWTClaimVerificationOptions, 'issuer'> & {\n      allowMissingIssuer?: boolean\n      allowMissingAudience?: boolean\n    } = {},\n  ): Promise<UnsecuredResult<PayloadType>> {\n    // jose does not support `allowMissingAudience` and `allowMissingIssuer`\n    // options, so we need to handle audience and issuer checks manually (see\n    // bellow).\n\n    const result = UnsecuredJWT.decode<PayloadType>(token, options)\n\n    if (!allowMissingIssuer || result.payload.iss != null) {\n      if (result.payload.iss !== this.id) {\n        throw new JOSEError(`Invalid \"iss\" claim \"${result.payload.iss}\"`)\n      }\n    }\n\n    if (!allowMissingAudience || result.payload.aud != null) {\n      if (audience != null) {\n        const payloadAud = asArray(result.payload.aud)\n        if (!asArray(audience).some((aud) => payloadAud.includes(aud))) {\n          throw new JOSEError(`Invalid \"aud\" claim \"${result.payload.aud}\"`)\n        }\n      }\n    }\n\n    return result\n  }\n\n  protected async jwtVerify<PayloadType = JWTPayload>(\n    token: string,\n    options?: Omit<JWTVerifyOptions, 'issuer'>,\n  ): Promise<JWTVerifyResult<PayloadType> & ResolvedKey<KeyLike>> {\n    return jwtVerify<PayloadType>(token, this.keyGetter, {\n      ...options,\n      issuer: this.id,\n    })\n  }\n\n  /**\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1}\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7523#section-3}\n   * @see {@link https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#token-endpoint-auth-method}\n   */\n  public async authenticate(\n    input: OAuthClientCredentials,\n    checks: {\n      authorizationServerIdentifier: string\n    },\n  ): Promise<ClientAuth> {\n    const method = this.metadata.token_endpoint_auth_method\n\n    if (method === 'none') {\n      return { method: 'none' }\n    }\n\n    if (method === 'private_key_jwt') {\n      if (!('client_assertion' in input)) {\n        throw new InvalidRequestError(\n          `client authentication method \"${method}\" required a \"client_assertion\"`,\n        )\n      }\n\n      if (input.client_assertion_type === CLIENT_ASSERTION_TYPE_JWT_BEARER) {\n        // https://www.rfc-editor.org/rfc/rfc7523.html#section-3\n\n        const result = await this.jwtVerify<{\n          jti: string\n          exp?: number\n        }>(input.client_assertion, {\n          // > 1. The JWT MUST contain an \"iss\" (issuer) claim that contains a\n          // >    unique identifier for the entity that issued the JWT.\n          //\n          // The \"issuer\" is already checked by jwtVerify()\n\n          // > 2. The JWT MUST contain a \"sub\" (subject) claim identifying the\n          // >    principal that is the subject of the JWT. Two cases need to be\n          // >    differentiated: [...] For client authentication, the subject\n          // >    MUST be the \"client_id\" of the OAuth client.\n          subject: this.id,\n\n          // > 3. The JWT MUST contain an \"aud\" (audience) claim containing a\n          // >    value that identifies the authorization server as an intended\n          // >    audience. The token endpoint URL of the authorization server\n          // >    MAY be used as a value for an \"aud\" element to identify the\n          // >    authorization server as an intended audience of the JWT.\n          audience: checks.authorizationServerIdentifier,\n\n          requiredClaims: [\n            // > 4. The JWT MUST contain an \"exp\" (expiration time) claim that\n            // >    limits the time window during which the JWT can be used.\n            //\n            // @TODO The presence of \"exp\" didn't use to be enforced by this\n            // implementation (or provided by the oauth-client). This is mostly\n            // fine because \"iat\" *is* required, but this makes this\n            // implementation non compliant with RFC7523. We can't just make it\n            // required as it might break existing clients.\n\n            // 'exp',\n\n            // > 7. The JWT MAY contain a \"jti\" (JWT ID) claim that provides a\n            // >    unique identifier for the token. The authorization server\n            // >    MAY ensure that JWTs are not replayed by maintaining the set\n            // >    of used \"jti\" values for the length of time for which the\n            // >    JWT would be considered valid based on the applicable \"exp\"\n            // >    instant.\n            'jti',\n          ],\n\n          // > 5. The JWT MAY contain an \"nbf\" (not before) claim that\n          // >    identifies the time before which the token MUST NOT be\n          // >    accepted for processing.\n          //\n          // This is already enforced by jose\n\n          // > 6. The JWT MAY contain an \"iat\" (issued at) claim that identifies\n          // >    the time at which the JWT was issued.  Note that the\n          // >    authorization server may reject JWTs with an \"iat\" claim value\n          // >    that is unreasonably far in the past.\n          maxTokenAge: CLIENT_ASSERTION_MAX_AGE / 1000,\n        }).catch((err) => {\n          const msg =\n            err instanceof JOSEError\n              ? `Validation of \"client_assertion\" failed: ${err.message}`\n              : `Unable to verify \"client_assertion\" JWT`\n\n          throw new InvalidClientError(msg, err)\n        })\n\n        if (!result.protectedHeader.kid) {\n          throw new InvalidClientError(`\"kid\" required in client_assertion`)\n        }\n\n        return {\n          method: 'private_key_jwt',\n          jti: result.payload.jti,\n          exp: result.payload.exp,\n          jkt: await authJwkThumbprint(result.key),\n          alg: result.protectedHeader.alg,\n          kid: result.protectedHeader.kid,\n        }\n      }\n\n      throw new InvalidClientError(\n        `Unsupported client_assertion_type \"${input.client_assertion_type}\"`,\n      )\n    }\n\n    // @ts-expect-error Ensure to keep Client.AUTH_METHODS_SUPPORTED in sync\n    // with the implementation of this function.\n    if (Client.AUTH_METHODS_SUPPORTED.includes(method)) {\n      throw new Error(\n        `verifyCredentials() should implement all of ${[\n          Client.AUTH_METHODS_SUPPORTED,\n        ]}`,\n      )\n    }\n\n    throw new InvalidClientMetadataError(\n      `Unsupported token_endpoint_auth_method \"${method}\"`,\n    )\n  }\n\n  /**\n   * Validates the request parameters against the client metadata.\n   */\n  public validateRequest(\n    parameters: Readonly<OAuthAuthorizationRequestParameters>,\n  ): Readonly<OAuthAuthorizationRequestParameters> {\n    if (parameters.client_id !== this.id) {\n      throw new AuthorizationError(\n        parameters,\n        'The \"client_id\" parameter field does not match the value used to authenticate the client',\n      )\n    }\n\n    if (parameters.scope !== undefined) {\n      // Any scope requested by the client must be registered in the client\n      // metadata.\n      const declaredScopes = this.metadata.scope?.split(' ')\n\n      if (!declaredScopes) {\n        throw new InvalidScopeError(\n          parameters,\n          'Client has no declared scopes in its metadata',\n        )\n      }\n\n      for (const scope of parameters.scope.split(' ')) {\n        if (!declaredScopes.includes(scope)) {\n          throw new InvalidScopeError(\n            parameters,\n            `Scope \"${scope}\" is not declared in the client metadata`,\n          )\n        }\n      }\n    }\n\n    if (!this.metadata.response_types.includes(parameters.response_type)) {\n      throw new AuthorizationError(\n        parameters,\n        `Invalid response_type \"${parameters.response_type}\" requested by the client`,\n      )\n    }\n\n    if (parameters.response_type.includes('code')) {\n      if (!this.metadata.grant_types.includes('authorization_code')) {\n        throw new AuthorizationError(\n          parameters,\n          `This client is not allowed to use the \"authorization_code\" grant type`,\n        )\n      }\n    }\n\n    const { redirect_uri } = parameters\n    if (redirect_uri) {\n      if (\n        !this.metadata.redirect_uris.some((uri) =>\n          compareRedirectUri(uri, redirect_uri),\n        )\n      ) {\n        throw new AuthorizationError(\n          parameters,\n          `Invalid redirect_uri ${redirect_uri}`,\n        )\n      }\n    } else {\n      const { defaultRedirectUri } = this\n      if (defaultRedirectUri) {\n        parameters = { ...parameters, redirect_uri: defaultRedirectUri }\n      } else {\n        // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-10#authorization-request\n        //\n        // > \"redirect_uri\": OPTIONAL if only one redirect URI is registered for\n        // > this client. REQUIRED if multiple redirect URIs are registered for this\n        // > client.\n        throw new AuthorizationError(parameters, 'redirect_uri is required')\n      }\n    }\n\n    if (parameters.authorization_details) {\n      const { authorization_details_types } = this.metadata\n      if (!authorization_details_types) {\n        throw new InvalidAuthorizationDetailsError(\n          parameters,\n          'Client Metadata does not declare any \"authorization_details\"',\n        )\n      }\n\n      for (const detail of parameters.authorization_details) {\n        if (!authorization_details_types?.includes(detail.type)) {\n          throw new InvalidAuthorizationDetailsError(\n            parameters,\n            `Client Metadata does not declare any \"authorization_details\" of type \"${detail.type}\"`,\n          )\n        }\n      }\n    }\n\n    return parameters\n  }\n\n  get defaultRedirectUri(): OAuthRedirectUri | undefined {\n    const { redirect_uris } = this.metadata\n    return redirect_uris.length === 1 ? redirect_uris[0] : undefined\n  }\n}\n\nexport async function authJwkThumbprint(\n  key: Uint8Array | KeyLike,\n): Promise<string> {\n  try {\n    return await calculateJwkThumbprint(await exportJWK(key), 'sha512')\n  } catch (err) {\n    throw new InvalidClientError('Unable to compute JWK thumbprint', err)\n  }\n}\n"]}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,YAAY,EAEZ,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,MAAM,CAAA;AAEb,OAAO,EACL,gCAAgC,GAKjC,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAA;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAA;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAA;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAMhE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAA;AAE5B,MAAM,OAAO,MAAM;IACjB;;OAEG;aACa,2BAAsB,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAU,CAAA;IAM7E,YACkB,EAAY,EACZ,QAA6B,EAC7B,OAAyB,QAAQ,CAAC,IAAI,EACtC,IAAgB;QAHhB,OAAE,GAAF,EAAE,CAAU;QACZ,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,SAAI,GAAJ,IAAI,CAAkC;QACtC,SAAI,GAAJ,IAAI,CAAY;QAEhC,2EAA2E;QAC3E,IAAI,CAAC,SAAS;YACZ,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBACxB,CAAC,CAAC,iBAAiB,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBACzC,CAAC,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,mBAAmB,CAC9B,GAA4B,EAC5B,QAAgB;QAEhB,oEAAoE;QACpE,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,CAAC;YACH,yEAAyE;YACzE,6CAA6C;YAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,0BAA0B,KAAK,MAAM,EAAE,CAAC;gBACxD,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;oBACxC,QAAQ;oBACR,WAAW,EAAE,WAAW,GAAG,GAAG;oBAC9B,oBAAoB,EAAE,IAAI;oBAC1B,kBAAkB,EAAE,IAAI;iBACzB,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBAC/B,QAAQ;gBACR,WAAW,EAAE,WAAW,GAAG,GAAG;gBAC9B,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,0BAA0B;oBAClD,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC;oBAC5C,CAAC,CAAC,8EAA8E;wBAC9E,EAAE;wBACF,uEAAuE;wBACvE,4BAA4B;wBAC5B,SAAS;aACd,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,SAAS;gBACtB,CAAC,CAAC,6BAA6B,GAAG,CAAC,OAAO,EAAE;gBAC5C,CAAC,CAAC,0BAA0B,CAAA;YAEhC,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,KAAa,EACb,EACE,QAAQ,EACR,oBAAoB,GAAG,KAAK,EAC5B,kBAAkB,GAAG,KAAK,EAC1B,GAAG,OAAO,KAIR,EAAE;QAEN,wEAAwE;QACxE,yEAAyE;QACzE,WAAW;QAEX,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAc,KAAK,EAAE,OAAO,CAAC,CAAA;QAE/D,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,IAAI,SAAS,CAAC,wBAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;YACpE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,oBAAoB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACxD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC/D,MAAM,IAAI,SAAS,CAAC,wBAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;gBACpE,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAES,KAAK,CAAC,SAAS,CACvB,KAAa,EACb,OAA0C;QAE1C,OAAO,SAAS,CAAc,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YACnD,GAAG,OAAO;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;SAChB,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,YAAY,CACvB,KAA6B,EAC7B,MAEC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAA;QAEvD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC3B,CAAC;QAED,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,kBAAkB,IAAI,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,mBAAmB,CAC3B,iCAAiC,MAAM,iCAAiC,CACzE,CAAA;YACH,CAAC;YAED,IAAI,KAAK,CAAC,qBAAqB,KAAK,gCAAgC,EAAE,CAAC;gBACrE,wDAAwD;gBAExD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAGhC,KAAK,CAAC,gBAAgB,EAAE;oBACzB,oEAAoE;oBACpE,6DAA6D;oBAC7D,EAAE;oBACF,iDAAiD;oBAEjD,oEAAoE;oBACpE,sEAAsE;oBACtE,oEAAoE;oBACpE,oDAAoD;oBACpD,OAAO,EAAE,IAAI,CAAC,EAAE;oBAEhB,mEAAmE;oBACnE,qEAAqE;oBACrE,oEAAoE;oBACpE,mEAAmE;oBACnE,gEAAgE;oBAChE,QAAQ,EAAE,MAAM,CAAC,6BAA6B;oBAE9C,cAAc,EAAE;wBACd,kEAAkE;wBAClE,gEAAgE;wBAChE,EAAE;wBACF,gEAAgE;wBAChE,mEAAmE;wBACnE,wDAAwD;wBACxD,mEAAmE;wBACnE,+CAA+C;wBAE/C,SAAS;wBAET,kEAAkE;wBAClE,iEAAiE;wBACjE,oEAAoE;wBACpE,iEAAiE;wBACjE,mEAAmE;wBACnE,gBAAgB;wBAChB,KAAK;qBACN;oBAED,4DAA4D;oBAC5D,8DAA8D;oBAC9D,gCAAgC;oBAChC,EAAE;oBACF,mCAAmC;oBAEnC,sEAAsE;oBACtE,4DAA4D;oBAC5D,sEAAsE;oBACtE,6CAA6C;oBAC7C,WAAW,EAAE,wBAAwB,GAAG,IAAI;iBAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACf,MAAM,GAAG,GACP,GAAG,YAAY,SAAS;wBACtB,CAAC,CAAC,4CAA4C,GAAG,CAAC,OAAO,EAAE;wBAC3D,CAAC,CAAC,yCAAyC,CAAA;oBAE/C,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBACxC,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC;oBAChC,MAAM,IAAI,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;gBACpE,CAAC;gBAED,OAAO;oBACL,MAAM,EAAE,iBAAiB;oBACzB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;oBACvB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;oBACvB,GAAG,EAAE,MAAM,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC;oBACxC,GAAG,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG;oBAC/B,GAAG,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG;iBAChC,CAAA;YACH,CAAC;YAED,MAAM,IAAI,kBAAkB,CAC1B,sCAAsC,KAAK,CAAC,qBAAqB,GAAG,CACrE,CAAA;QACH,CAAC;QAED,wEAAwE;QACxE,4CAA4C;QAC5C,IAAI,MAAM,CAAC,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,+CAA+C;gBAC7C,MAAM,CAAC,sBAAsB;aAC9B,EAAE,CACJ,CAAA;QACH,CAAC;QAED,MAAM,IAAI,0BAA0B,CAClC,2CAA2C,MAAM,GAAG,CACrD,CAAA;IACH,CAAC;IAED;;OAEG;IACI,eAAe,CACpB,UAAyD;QAEzD,IAAI,UAAU,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,kBAAkB,CAC1B,UAAU,EACV,0FAA0F,CAC3F,CAAA;QACH,CAAC;QAED,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,qEAAqE;YACrE,YAAY;YACZ,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;YAEtD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,+CAA+C,CAChD,CAAA;YACH,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpC,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,UAAU,KAAK,0CAA0C,CAC1D,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,kBAAkB,CAC1B,UAAU,EACV,0BAA0B,UAAU,CAAC,aAAa,2BAA2B,CAC9E,CAAA;QACH,CAAC;QAED,IAAI,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,kBAAkB,CAC1B,UAAU,EACV,uEAAuE,CACxE,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,GAAG,UAAU,CAAA;QACnC,IAAI,YAAY,EAAE,CAAC;YACjB,IACE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CACtC,EACD,CAAC;gBACD,MAAM,IAAI,kBAAkB,CAC1B,UAAU,EACV,wBAAwB,YAAY,EAAE,CACvC,CAAA;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAA;YACnC,IAAI,kBAAkB,EAAE,CAAC;gBACvB,UAAU,GAAG,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAA;YAClE,CAAC;iBAAM,CAAC;gBACN,uFAAuF;gBACvF,EAAE;gBACF,wEAAwE;gBACxE,4EAA4E;gBAC5E,YAAY;gBACZ,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAA;YACtE,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,qBAAqB,EAAE,CAAC;YACrC,MAAM,EAAE,2BAA2B,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAA;YACrD,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBACjC,MAAM,IAAI,gCAAgC,CACxC,UAAU,EACV,8DAA8D,CAC/D,CAAA;YACH,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,CAAC;gBACtD,IAAI,CAAC,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxD,MAAM,IAAI,gCAAgC,CACxC,UAAU,EACV,yEAAyE,MAAM,CAAC,IAAI,GAAG,CACxF,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAA;QACvC,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClE,CAAC;;AAGH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAyB;IAEzB,IAAI,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAA;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACvE,CAAC;AACH,CAAC","sourcesContent":["import {\n  JWTClaimVerificationOptions,\n  type JWTHeaderParameters,\n  type JWTPayload,\n  type JWTVerifyOptions,\n  type JWTVerifyResult,\n  type KeyLike,\n  type ResolvedKey,\n  UnsecuredJWT,\n  type UnsecuredResult,\n  calculateJwkThumbprint,\n  createLocalJWKSet,\n  createRemoteJWKSet,\n  errors,\n  exportJWK,\n  jwtVerify,\n} from 'jose'\nimport { Jwks, SignedJwt, UnsignedJwt } from '@atproto/jwk'\nimport {\n  CLIENT_ASSERTION_TYPE_JWT_BEARER,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientCredentials,\n  OAuthClientMetadata,\n  OAuthRedirectUri,\n} from '@atproto/oauth-types'\nimport { CLIENT_ASSERTION_MAX_AGE, JAR_MAX_AGE } from '../constants.js'\nimport { AuthorizationError } from '../errors/authorization-error.js'\nimport { InvalidAuthorizationDetailsError } from '../errors/invalid-authorization-details-error.js'\nimport { InvalidClientError } from '../errors/invalid-client-error.js'\nimport { InvalidClientMetadataError } from '../errors/invalid-client-metadata-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport { InvalidScopeError } from '../errors/invalid-scope-error.js'\nimport { asArray } from '../lib/util/cast.js'\nimport { compareRedirectUri } from '../lib/util/redirect-uri.js'\nimport { Awaitable } from '../lib/util/type.js'\nimport { ClientAuth } from './client-auth.js'\nimport { ClientId } from './client-id.js'\nimport { ClientInfo } from './client-info.js'\n\nconst { JOSEError } = errors\n\nexport class Client {\n  /**\n   * @see {@link https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#token-endpoint-auth-method}\n   */\n  static readonly AUTH_METHODS_SUPPORTED = ['none', 'private_key_jwt'] as const\n\n  private readonly keyGetter: (\n    protectedHeader: JWTHeaderParameters,\n  ) => Awaitable<KeyLike | Uint8Array>\n\n  constructor(\n    public readonly id: ClientId,\n    public readonly metadata: OAuthClientMetadata,\n    public readonly jwks: undefined | Jwks = metadata.jwks,\n    public readonly info: ClientInfo,\n  ) {\n    // If the remote JWKS content is provided, we don't need to fetch it again.\n    this.keyGetter =\n      jwks || !metadata.jwks_uri\n        ? createLocalJWKSet(jwks || { keys: [] })\n        : createRemoteJWKSet(new URL(metadata.jwks_uri), {})\n  }\n\n  /**\n   * @see {@link https://www.rfc-editor.org/rfc/rfc9101.html#name-request-object-2}\n   */\n  public async decodeRequestObject(\n    jar: SignedJwt | UnsignedJwt,\n    audience: string,\n  ) {\n    // https://www.rfc-editor.org/rfc/rfc9101.html#name-request-object-2\n    // > If signed, the Authorization Request Object SHOULD contain the Claims\n    // > iss (issuer) and aud (audience) as members with their semantics being\n    // > the same as defined in the JWT [RFC7519] specification. The value of\n    // > aud should be the value of the authorization server (AS) issuer, as\n    // > defined in RFC 8414 [RFC8414].\n    try {\n      // We need to special case the \"none\" algorithm, as the validation method\n      // is different for signed and unsigned JWTs.\n      if (this.metadata.request_object_signing_alg === 'none') {\n        return await this.jwtVerifyUnsecured(jar, {\n          audience,\n          maxTokenAge: JAR_MAX_AGE / 1e3,\n          allowMissingAudience: true,\n          allowMissingIssuer: true,\n        })\n      }\n\n      return await this.jwtVerify(jar, {\n        audience,\n        maxTokenAge: JAR_MAX_AGE / 1e3,\n        algorithms: this.metadata.request_object_signing_alg\n          ? [this.metadata.request_object_signing_alg]\n          : // https://openid.net/specs/openid-connect-registration-1_0.html#rfc.section.2\n            //\n            // > The default, if omitted, is that any algorithm supported by the OP\n            // > and the RP MAY be used.\n            undefined,\n      })\n    } catch (err) {\n      const message =\n        err instanceof JOSEError\n          ? `Invalid \"request\" object: ${err.message}`\n          : `Invalid \"request\" object`\n\n      throw new InvalidRequestError(message, err)\n    }\n  }\n\n  protected async jwtVerifyUnsecured<PayloadType = JWTPayload>(\n    token: string,\n    {\n      audience,\n      allowMissingAudience = false,\n      allowMissingIssuer = false,\n      ...options\n    }: Omit<JWTClaimVerificationOptions, 'issuer'> & {\n      allowMissingIssuer?: boolean\n      allowMissingAudience?: boolean\n    } = {},\n  ): Promise<UnsecuredResult<PayloadType>> {\n    // jose does not support `allowMissingAudience` and `allowMissingIssuer`\n    // options, so we need to handle audience and issuer checks manually (see\n    // bellow).\n\n    const result = UnsecuredJWT.decode<PayloadType>(token, options)\n\n    if (!allowMissingIssuer || result.payload.iss != null) {\n      if (result.payload.iss !== this.id) {\n        throw new JOSEError(`Invalid \"iss\" claim \"${result.payload.iss}\"`)\n      }\n    }\n\n    if (!allowMissingAudience || result.payload.aud != null) {\n      if (audience != null) {\n        const payloadAud = asArray(result.payload.aud)\n        if (!asArray(audience).some((aud) => payloadAud.includes(aud))) {\n          throw new JOSEError(`Invalid \"aud\" claim \"${result.payload.aud}\"`)\n        }\n      }\n    }\n\n    return result\n  }\n\n  protected async jwtVerify<PayloadType = JWTPayload>(\n    token: string,\n    options?: Omit<JWTVerifyOptions, 'issuer'>,\n  ): Promise<JWTVerifyResult<PayloadType> & ResolvedKey<KeyLike>> {\n    return jwtVerify<PayloadType>(token, this.keyGetter, {\n      ...options,\n      issuer: this.id,\n    })\n  }\n\n  /**\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1}\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7523#section-3}\n   * @see {@link https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#token-endpoint-auth-method}\n   */\n  public async authenticate(\n    input: OAuthClientCredentials,\n    checks: {\n      authorizationServerIdentifier: string\n    },\n  ): Promise<ClientAuth> {\n    const method = this.metadata.token_endpoint_auth_method\n\n    if (method === 'none') {\n      return { method: 'none' }\n    }\n\n    if (method === 'private_key_jwt') {\n      if (!('client_assertion' in input)) {\n        throw new InvalidRequestError(\n          `client authentication method \"${method}\" required a \"client_assertion\"`,\n        )\n      }\n\n      if (input.client_assertion_type === CLIENT_ASSERTION_TYPE_JWT_BEARER) {\n        // https://www.rfc-editor.org/rfc/rfc7523.html#section-3\n\n        const result = await this.jwtVerify<{\n          jti: string\n          exp?: number\n        }>(input.client_assertion, {\n          // > 1. The JWT MUST contain an \"iss\" (issuer) claim that contains a\n          // >    unique identifier for the entity that issued the JWT.\n          //\n          // The \"issuer\" is already checked by jwtVerify()\n\n          // > 2. The JWT MUST contain a \"sub\" (subject) claim identifying the\n          // >    principal that is the subject of the JWT. Two cases need to be\n          // >    differentiated: [...] For client authentication, the subject\n          // >    MUST be the \"client_id\" of the OAuth client.\n          subject: this.id,\n\n          // > 3. The JWT MUST contain an \"aud\" (audience) claim containing a\n          // >    value that identifies the authorization server as an intended\n          // >    audience. The token endpoint URL of the authorization server\n          // >    MAY be used as a value for an \"aud\" element to identify the\n          // >    authorization server as an intended audience of the JWT.\n          audience: checks.authorizationServerIdentifier,\n\n          requiredClaims: [\n            // > 4. The JWT MUST contain an \"exp\" (expiration time) claim that\n            // >    limits the time window during which the JWT can be used.\n            //\n            // @TODO The presence of \"exp\" didn't use to be enforced by this\n            // implementation (or provided by the oauth-client). This is mostly\n            // fine because \"iat\" *is* required, but this makes this\n            // implementation non compliant with RFC7523. We can't just make it\n            // required as it might break existing clients.\n\n            // 'exp',\n\n            // > 7. The JWT MAY contain a \"jti\" (JWT ID) claim that provides a\n            // >    unique identifier for the token. The authorization server\n            // >    MAY ensure that JWTs are not replayed by maintaining the set\n            // >    of used \"jti\" values for the length of time for which the\n            // >    JWT would be considered valid based on the applicable \"exp\"\n            // >    instant.\n            'jti',\n          ],\n\n          // > 5. The JWT MAY contain an \"nbf\" (not before) claim that\n          // >    identifies the time before which the token MUST NOT be\n          // >    accepted for processing.\n          //\n          // This is already enforced by jose\n\n          // > 6. The JWT MAY contain an \"iat\" (issued at) claim that identifies\n          // >    the time at which the JWT was issued.  Note that the\n          // >    authorization server may reject JWTs with an \"iat\" claim value\n          // >    that is unreasonably far in the past.\n          maxTokenAge: CLIENT_ASSERTION_MAX_AGE / 1000,\n        }).catch((err) => {\n          const msg =\n            err instanceof JOSEError\n              ? `Validation of \"client_assertion\" failed: ${err.message}`\n              : `Unable to verify \"client_assertion\" JWT`\n\n          throw new InvalidClientError(msg, err)\n        })\n\n        if (!result.protectedHeader.kid) {\n          throw new InvalidClientError(`\"kid\" required in client_assertion`)\n        }\n\n        return {\n          method: 'private_key_jwt',\n          jti: result.payload.jti,\n          exp: result.payload.exp,\n          jkt: await authJwkThumbprint(result.key),\n          alg: result.protectedHeader.alg,\n          kid: result.protectedHeader.kid,\n        }\n      }\n\n      throw new InvalidClientError(\n        `Unsupported client_assertion_type \"${input.client_assertion_type}\"`,\n      )\n    }\n\n    // @ts-expect-error Ensure to keep Client.AUTH_METHODS_SUPPORTED in sync\n    // with the implementation of this function.\n    if (Client.AUTH_METHODS_SUPPORTED.includes(method)) {\n      throw new Error(\n        `verifyCredentials() should implement all of ${[\n          Client.AUTH_METHODS_SUPPORTED,\n        ]}`,\n      )\n    }\n\n    throw new InvalidClientMetadataError(\n      `Unsupported token_endpoint_auth_method \"${method}\"`,\n    )\n  }\n\n  /**\n   * Validates the request parameters against the client metadata.\n   */\n  public validateRequest(\n    parameters: Readonly<OAuthAuthorizationRequestParameters>,\n  ): Readonly<OAuthAuthorizationRequestParameters> {\n    if (parameters.client_id !== this.id) {\n      throw new AuthorizationError(\n        parameters,\n        'The \"client_id\" parameter field does not match the value used to authenticate the client',\n      )\n    }\n\n    if (parameters.scope !== undefined) {\n      // Any scope requested by the client must be registered in the client\n      // metadata.\n      const declaredScopes = this.metadata.scope?.split(' ')\n\n      if (!declaredScopes) {\n        throw new InvalidScopeError(\n          parameters,\n          'Client has no declared scopes in its metadata',\n        )\n      }\n\n      for (const scope of parameters.scope.split(' ')) {\n        if (!declaredScopes.includes(scope)) {\n          throw new InvalidScopeError(\n            parameters,\n            `Scope \"${scope}\" is not declared in the client metadata`,\n          )\n        }\n      }\n    }\n\n    if (!this.metadata.response_types.includes(parameters.response_type)) {\n      throw new AuthorizationError(\n        parameters,\n        `Invalid response_type \"${parameters.response_type}\" requested by the client`,\n      )\n    }\n\n    if (parameters.response_type.includes('code')) {\n      if (!this.metadata.grant_types.includes('authorization_code')) {\n        throw new AuthorizationError(\n          parameters,\n          `This client is not allowed to use the \"authorization_code\" grant type`,\n        )\n      }\n    }\n\n    const { redirect_uri } = parameters\n    if (redirect_uri) {\n      if (\n        !this.metadata.redirect_uris.some((uri) =>\n          compareRedirectUri(uri, redirect_uri),\n        )\n      ) {\n        throw new AuthorizationError(\n          parameters,\n          `Invalid redirect_uri ${redirect_uri}`,\n        )\n      }\n    } else {\n      const { defaultRedirectUri } = this\n      if (defaultRedirectUri) {\n        parameters = { ...parameters, redirect_uri: defaultRedirectUri }\n      } else {\n        // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-10#authorization-request\n        //\n        // > \"redirect_uri\": OPTIONAL if only one redirect URI is registered for\n        // > this client. REQUIRED if multiple redirect URIs are registered for this\n        // > client.\n        throw new AuthorizationError(parameters, 'redirect_uri is required')\n      }\n    }\n\n    if (parameters.authorization_details) {\n      const { authorization_details_types } = this.metadata\n      if (!authorization_details_types) {\n        throw new InvalidAuthorizationDetailsError(\n          parameters,\n          'Client Metadata does not declare any \"authorization_details\"',\n        )\n      }\n\n      for (const detail of parameters.authorization_details) {\n        if (!authorization_details_types?.includes(detail.type)) {\n          throw new InvalidAuthorizationDetailsError(\n            parameters,\n            `Client Metadata does not declare any \"authorization_details\" of type \"${detail.type}\"`,\n          )\n        }\n      }\n    }\n\n    return parameters\n  }\n\n  get defaultRedirectUri(): OAuthRedirectUri | undefined {\n    const { redirect_uris } = this.metadata\n    return redirect_uris.length === 1 ? redirect_uris[0] : undefined\n  }\n}\n\nexport async function authJwkThumbprint(\n  key: Uint8Array | KeyLike,\n): Promise<string> {\n  try {\n    return await calculateJwkThumbprint(await exportJWK(key), 'sha512')\n  } catch (err) {\n    throw new InvalidClientError('Unable to compute JWK thumbprint', err)\n  }\n}\n"]}

package/dist/constants.js

@@ -1,19 +1,16 @@
-"use strict";
 // The purpose of the prefix is to provide type safety
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NODE_ENV = exports.LEXICON_REFRESH_FREQUENCY = exports.CODE_CHALLENGE_REPLAY_TIMEFRAME = exports.SESSION_FIXATION_MAX_AGE = exports.DPOP_NONCE_MAX_AGE = exports.CLIENT_ASSERTION_MAX_AGE = exports.JAR_MAX_AGE = exports.PAR_EXPIRES_IN = exports.CONFIDENTIAL_CLIENT_REFRESH_LIFETIME = exports.CONFIDENTIAL_CLIENT_SESSION_LIFETIME = exports.PUBLIC_CLIENT_REFRESH_LIFETIME = exports.PUBLIC_CLIENT_SESSION_LIFETIME = exports.AUTHORIZATION_INACTIVITY_TIMEOUT = exports.TOKEN_MAX_AGE = exports.EPHEMERAL_SESSION_MAX_AGE = exports.AUTHENTICATION_MAX_AGE = exports.CODE_BYTES_LENGTH = exports.CODE_PREFIX = exports.REQUEST_ID_BYTES_LENGTH = exports.REQUEST_ID_PREFIX = exports.TOKEN_ID_BYTES_LENGTH = exports.TOKEN_ID_PREFIX = exports.REFRESH_TOKEN_BYTES_LENGTH = exports.REFRESH_TOKEN_PREFIX = exports.SESSION_ID_BYTES_LENGTH = exports.SESSION_ID_PREFIX = exports.DEVICE_ID_BYTES_LENGTH = exports.DEVICE_ID_PREFIX = void 0;
-exports.DEVICE_ID_PREFIX = 'dev-';
-exports.DEVICE_ID_BYTES_LENGTH = 16; // 128 bits
-exports.SESSION_ID_PREFIX = 'ses-';
-exports.SESSION_ID_BYTES_LENGTH = 16; // 128 bits - only valid if device id is valid
-exports.REFRESH_TOKEN_PREFIX = 'ref-';
-exports.REFRESH_TOKEN_BYTES_LENGTH = 32; // 256 bits
-exports.TOKEN_ID_PREFIX = 'tok-';
-exports.TOKEN_ID_BYTES_LENGTH = 16; // 128 bits - used as `jti` in JWTs (cannot be forged)
-exports.REQUEST_ID_PREFIX = 'req-';
-exports.REQUEST_ID_BYTES_LENGTH = 16; // 128 bits
-exports.CODE_PREFIX = 'cod-';
-exports.CODE_BYTES_LENGTH = 32;
+export const DEVICE_ID_PREFIX = 'dev-';
+export const DEVICE_ID_BYTES_LENGTH = 16; // 128 bits
+export const SESSION_ID_PREFIX = 'ses-';
+export const SESSION_ID_BYTES_LENGTH = 16; // 128 bits - only valid if device id is valid
+export const REFRESH_TOKEN_PREFIX = 'ref-';
+export const REFRESH_TOKEN_BYTES_LENGTH = 32; // 256 bits
+export const TOKEN_ID_PREFIX = 'tok-';
+export const TOKEN_ID_BYTES_LENGTH = 16; // 128 bits - used as `jti` in JWTs (cannot be forged)
+export const REQUEST_ID_PREFIX = 'req-';
+export const REQUEST_ID_BYTES_LENGTH = 16; // 128 bits
+export const CODE_PREFIX = 'cod-';
+export const CODE_BYTES_LENGTH = 32;
 const SECOND = 1e3;
 const MINUTE = 60 * SECOND;
 const HOUR = 60 * MINUTE;
@@ -22,23 +19,23 @@ const WEEK = 7 * DAY;
 const YEAR = 365.25 * DAY;
 const MONTH = YEAR / 12;
 /** 7 days */
-exports.AUTHENTICATION_MAX_AGE = 7 * DAY;
+export const AUTHENTICATION_MAX_AGE = 7 * DAY;
 /** 15 minutes */
-exports.EPHEMERAL_SESSION_MAX_AGE = 15 * MINUTE;
+export const EPHEMERAL_SESSION_MAX_AGE = 15 * MINUTE;
 /** 60 minutes */
-exports.TOKEN_MAX_AGE = 60 * MINUTE;
+export const TOKEN_MAX_AGE = 60 * MINUTE;
 /** 5 minutes */
-exports.AUTHORIZATION_INACTIVITY_TIMEOUT = 5 * MINUTE;
+export const AUTHORIZATION_INACTIVITY_TIMEOUT = 5 * MINUTE;
 /** 2 week */
-exports.PUBLIC_CLIENT_SESSION_LIFETIME = 2 * WEEK;
+export const PUBLIC_CLIENT_SESSION_LIFETIME = 2 * WEEK;
 /** @see {@link PUBLIC_CLIENT_SESSION_LIFETIME} */
-exports.PUBLIC_CLIENT_REFRESH_LIFETIME = exports.PUBLIC_CLIENT_SESSION_LIFETIME;
+export const PUBLIC_CLIENT_REFRESH_LIFETIME = PUBLIC_CLIENT_SESSION_LIFETIME;
 /** 2 years */
-exports.CONFIDENTIAL_CLIENT_SESSION_LIFETIME = 2 * YEAR;
+export const CONFIDENTIAL_CLIENT_SESSION_LIFETIME = 2 * YEAR;
 /** 3 months */
-exports.CONFIDENTIAL_CLIENT_REFRESH_LIFETIME = 3 * MONTH;
+export const CONFIDENTIAL_CLIENT_REFRESH_LIFETIME = 3 * MONTH;
 /** 5 minutes */
-exports.PAR_EXPIRES_IN = 5 * MINUTE;
+export const PAR_EXPIRES_IN = 5 * MINUTE;
 /**
  * 59 seconds (should be less than a minute)
  *
@@ -46,16 +43,16 @@ exports.PAR_EXPIRES_IN = 5 * MINUTE;
  *
  * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.2 | JWT-Secured Authorization Request (JAR) - Section 10.2 (d)}
  */
-exports.JAR_MAX_AGE = 59 * SECOND;
+export const JAR_MAX_AGE = 59 * SECOND;
 /** 1 minute */
-exports.CLIENT_ASSERTION_MAX_AGE = 1 * MINUTE;
+export const CLIENT_ASSERTION_MAX_AGE = 1 * MINUTE;
 /** 3 minutes */
-exports.DPOP_NONCE_MAX_AGE = 3 * MINUTE;
+export const DPOP_NONCE_MAX_AGE = 3 * MINUTE;
 /** 5 seconds */
-exports.SESSION_FIXATION_MAX_AGE = 5 * SECOND;
+export const SESSION_FIXATION_MAX_AGE = 5 * SECOND;
 /** 1 day */
-exports.CODE_CHALLENGE_REPLAY_TIMEFRAME = 1 * DAY;
+export const CODE_CHALLENGE_REPLAY_TIMEFRAME = 1 * DAY;
 /** 5 minutes */
-exports.LEXICON_REFRESH_FREQUENCY = 5 * MINUTE;
-exports.NODE_ENV = process.env.NODE_ENV || 'production';
+export const LEXICON_REFRESH_FREQUENCY = 5 * MINUTE;
+export const NODE_ENV = process.env.NODE_ENV || 'production';
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":";AAAA,sDAAsD;;;AAEzC,QAAA,gBAAgB,GAAG,MAAM,CAAA;AACzB,QAAA,sBAAsB,GAAG,EAAE,CAAA,CAAC,WAAW;AAEvC,QAAA,iBAAiB,GAAG,MAAM,CAAA;AAC1B,QAAA,uBAAuB,GAAG,EAAE,CAAA,CAAC,8CAA8C;AAE3E,QAAA,oBAAoB,GAAG,MAAM,CAAA;AAC7B,QAAA,0BAA0B,GAAG,EAAE,CAAA,CAAC,WAAW;AAE3C,QAAA,eAAe,GAAG,MAAM,CAAA;AACxB,QAAA,qBAAqB,GAAG,EAAE,CAAA,CAAC,sDAAsD;AAEjF,QAAA,iBAAiB,GAAG,MAAM,CAAA;AAC1B,QAAA,uBAAuB,GAAG,EAAE,CAAA,CAAC,WAAW;AAExC,QAAA,WAAW,GAAG,MAAM,CAAA;AACpB,QAAA,iBAAiB,GAAG,EAAE,CAAA;AAEnC,MAAM,MAAM,GAAG,GAAG,CAAA;AAClB,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,CAAA;AAC1B,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAA;AACxB,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,CAAA;AACrB,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAA;AACpB,MAAM,IAAI,GAAG,MAAM,GAAG,GAAG,CAAA;AACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,CAAA;AAEvB,aAAa;AACA,QAAA,sBAAsB,GAAG,CAAC,GAAG,GAAG,CAAA;AAE7C,iBAAiB;AACJ,QAAA,yBAAyB,GAAG,EAAE,GAAG,MAAM,CAAA;AAEpD,iBAAiB;AACJ,QAAA,aAAa,GAAG,EAAE,GAAG,MAAM,CAAA;AAExC,gBAAgB;AACH,QAAA,gCAAgC,GAAG,CAAC,GAAG,MAAM,CAAA;AAE1D,aAAa;AACA,QAAA,8BAA8B,GAAG,CAAC,GAAG,IAAI,CAAA;AAEtD,kDAAkD;AACrC,QAAA,8BAA8B,GAAG,sCAA8B,CAAA;AAE5E,cAAc;AACD,QAAA,oCAAoC,GAAG,CAAC,GAAG,IAAI,CAAA;AAE5D,eAAe;AACF,QAAA,oCAAoC,GAAG,CAAC,GAAG,KAAK,CAAA;AAE7D,gBAAgB;AACH,QAAA,cAAc,GAAG,CAAC,GAAG,MAAM,CAAA;AAExC;;;;;;GAMG;AACU,QAAA,WAAW,GAAG,EAAE,GAAG,MAAM,CAAA;AAEtC,eAAe;AACF,QAAA,wBAAwB,GAAG,CAAC,GAAG,MAAM,CAAA;AAElD,gBAAgB;AACH,QAAA,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAA;AAE5C,gBAAgB;AACH,QAAA,wBAAwB,GAAG,CAAC,GAAG,MAAM,CAAA;AAElD,YAAY;AACC,QAAA,+BAA+B,GAAG,CAAC,GAAG,GAAG,CAAA;AAEtD,gBAAgB;AACH,QAAA,yBAAyB,GAAG,CAAC,GAAG,MAAM,CAAA;AAEtC,QAAA,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAA","sourcesContent":["// The purpose of the prefix is to provide type safety\n\nexport const DEVICE_ID_PREFIX = 'dev-'\nexport const DEVICE_ID_BYTES_LENGTH = 16 // 128 bits\n\nexport const SESSION_ID_PREFIX = 'ses-'\nexport const SESSION_ID_BYTES_LENGTH = 16 // 128 bits - only valid if device id is valid\n\nexport const REFRESH_TOKEN_PREFIX = 'ref-'\nexport const REFRESH_TOKEN_BYTES_LENGTH = 32 // 256 bits\n\nexport const TOKEN_ID_PREFIX = 'tok-'\nexport const TOKEN_ID_BYTES_LENGTH = 16 // 128 bits - used as `jti` in JWTs (cannot be forged)\n\nexport const REQUEST_ID_PREFIX = 'req-'\nexport const REQUEST_ID_BYTES_LENGTH = 16 // 128 bits\n\nexport const CODE_PREFIX = 'cod-'\nexport const CODE_BYTES_LENGTH = 32\n\nconst SECOND = 1e3\nconst MINUTE = 60 * SECOND\nconst HOUR = 60 * MINUTE\nconst DAY = 24 * HOUR\nconst WEEK = 7 * DAY\nconst YEAR = 365.25 * DAY\nconst MONTH = YEAR / 12\n\n/** 7 days */\nexport const AUTHENTICATION_MAX_AGE = 7 * DAY\n\n/** 15 minutes */\nexport const EPHEMERAL_SESSION_MAX_AGE = 15 * MINUTE\n\n/** 60 minutes */\nexport const TOKEN_MAX_AGE = 60 * MINUTE\n\n/** 5 minutes */\nexport const AUTHORIZATION_INACTIVITY_TIMEOUT = 5 * MINUTE\n\n/** 2 week */\nexport const PUBLIC_CLIENT_SESSION_LIFETIME = 2 * WEEK\n\n/** @see {@link PUBLIC_CLIENT_SESSION_LIFETIME} */\nexport const PUBLIC_CLIENT_REFRESH_LIFETIME = PUBLIC_CLIENT_SESSION_LIFETIME\n\n/** 2 years */\nexport const CONFIDENTIAL_CLIENT_SESSION_LIFETIME = 2 * YEAR\n\n/** 3 months */\nexport const CONFIDENTIAL_CLIENT_REFRESH_LIFETIME = 3 * MONTH\n\n/** 5 minutes */\nexport const PAR_EXPIRES_IN = 5 * MINUTE\n\n/**\n * 59 seconds (should be less than a minute)\n *\n * > \"A general guidance for the validity time would be less than a minute.\"\n *\n * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.2 | JWT-Secured Authorization Request (JAR) - Section 10.2 (d)}\n */\nexport const JAR_MAX_AGE = 59 * SECOND\n\n/** 1 minute */\nexport const CLIENT_ASSERTION_MAX_AGE = 1 * MINUTE\n\n/** 3 minutes */\nexport const DPOP_NONCE_MAX_AGE = 3 * MINUTE\n\n/** 5 seconds */\nexport const SESSION_FIXATION_MAX_AGE = 5 * SECOND\n\n/** 1 day */\nexport const CODE_CHALLENGE_REPLAY_TIMEFRAME = 1 * DAY\n\n/** 5 minutes */\nexport const LEXICON_REFRESH_FREQUENCY = 5 * MINUTE\n\nexport const NODE_ENV = process.env.NODE_ENV || 'production'\n"]}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,sDAAsD;AAEtD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AACtC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAA,CAAC,WAAW;AAEpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAA;AACvC,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAA,CAAC,8CAA8C;AAExF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAA;AAC1C,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAA,CAAC,WAAW;AAExD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAA;AACrC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA,CAAC,sDAAsD;AAE9F,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAA;AACvC,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAA,CAAC,WAAW;AAErD,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAA;AACjC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAEnC,MAAM,MAAM,GAAG,GAAG,CAAA;AAClB,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,CAAA;AAC1B,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAA;AACxB,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,CAAA;AACrB,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAA;AACpB,MAAM,IAAI,GAAG,MAAM,GAAG,GAAG,CAAA;AACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,CAAA;AAEvB,aAAa;AACb,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,GAAG,CAAA;AAE7C,iBAAiB;AACjB,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,MAAM,CAAA;AAEpD,iBAAiB;AACjB,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,GAAG,MAAM,CAAA;AAExC,gBAAgB;AAChB,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,MAAM,CAAA;AAE1D,aAAa;AACb,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,GAAG,IAAI,CAAA;AAEtD,kDAAkD;AAClD,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAA;AAE5E,cAAc;AACd,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,GAAG,IAAI,CAAA;AAE5D,eAAe;AACf,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,GAAG,KAAK,CAAA;AAE7D,gBAAgB;AAChB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAA;AAExC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAA;AAEtC,eAAe;AACf,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,MAAM,CAAA;AAElD,gBAAgB;AAChB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAA;AAE5C,gBAAgB;AAChB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,MAAM,CAAA;AAElD,YAAY;AACZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,GAAG,GAAG,CAAA;AAEtD,gBAAgB;AAChB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,MAAM,CAAA;AAEnD,MAAM,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAA","sourcesContent":["// The purpose of the prefix is to provide type safety\n\nexport const DEVICE_ID_PREFIX = 'dev-'\nexport const DEVICE_ID_BYTES_LENGTH = 16 // 128 bits\n\nexport const SESSION_ID_PREFIX = 'ses-'\nexport const SESSION_ID_BYTES_LENGTH = 16 // 128 bits - only valid if device id is valid\n\nexport const REFRESH_TOKEN_PREFIX = 'ref-'\nexport const REFRESH_TOKEN_BYTES_LENGTH = 32 // 256 bits\n\nexport const TOKEN_ID_PREFIX = 'tok-'\nexport const TOKEN_ID_BYTES_LENGTH = 16 // 128 bits - used as `jti` in JWTs (cannot be forged)\n\nexport const REQUEST_ID_PREFIX = 'req-'\nexport const REQUEST_ID_BYTES_LENGTH = 16 // 128 bits\n\nexport const CODE_PREFIX = 'cod-'\nexport const CODE_BYTES_LENGTH = 32\n\nconst SECOND = 1e3\nconst MINUTE = 60 * SECOND\nconst HOUR = 60 * MINUTE\nconst DAY = 24 * HOUR\nconst WEEK = 7 * DAY\nconst YEAR = 365.25 * DAY\nconst MONTH = YEAR / 12\n\n/** 7 days */\nexport const AUTHENTICATION_MAX_AGE = 7 * DAY\n\n/** 15 minutes */\nexport const EPHEMERAL_SESSION_MAX_AGE = 15 * MINUTE\n\n/** 60 minutes */\nexport const TOKEN_MAX_AGE = 60 * MINUTE\n\n/** 5 minutes */\nexport const AUTHORIZATION_INACTIVITY_TIMEOUT = 5 * MINUTE\n\n/** 2 week */\nexport const PUBLIC_CLIENT_SESSION_LIFETIME = 2 * WEEK\n\n/** @see {@link PUBLIC_CLIENT_SESSION_LIFETIME} */\nexport const PUBLIC_CLIENT_REFRESH_LIFETIME = PUBLIC_CLIENT_SESSION_LIFETIME\n\n/** 2 years */\nexport const CONFIDENTIAL_CLIENT_SESSION_LIFETIME = 2 * YEAR\n\n/** 3 months */\nexport const CONFIDENTIAL_CLIENT_REFRESH_LIFETIME = 3 * MONTH\n\n/** 5 minutes */\nexport const PAR_EXPIRES_IN = 5 * MINUTE\n\n/**\n * 59 seconds (should be less than a minute)\n *\n * > \"A general guidance for the validity time would be less than a minute.\"\n *\n * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.2 | JWT-Secured Authorization Request (JAR) - Section 10.2 (d)}\n */\nexport const JAR_MAX_AGE = 59 * SECOND\n\n/** 1 minute */\nexport const CLIENT_ASSERTION_MAX_AGE = 1 * MINUTE\n\n/** 3 minutes */\nexport const DPOP_NONCE_MAX_AGE = 3 * MINUTE\n\n/** 5 seconds */\nexport const SESSION_FIXATION_MAX_AGE = 5 * SECOND\n\n/** 1 day */\nexport const CODE_CHALLENGE_REPLAY_TIMEFRAME = 1 * DAY\n\n/** 5 minutes */\nexport const LEXICON_REFRESH_FREQUENCY = 5 * MINUTE\n\nexport const NODE_ENV = process.env.NODE_ENV || 'production'\n"]}

package/dist/customization/branding.js

@@ -1,13 +1,10 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.brandingSchema = void 0;
-const zod_1 = require("zod");
-const colors_js_1 = require("./colors.js");
-const links_js_1 = require("./links.js");
-exports.brandingSchema = zod_1.z.object({
-    name: zod_1.z.string().optional(),
-    logo: zod_1.z.string().url().optional(),
-    colors: colors_js_1.colorsSchema.optional(),
-    links: zod_1.z.array(links_js_1.linksSchema).optional(),
+import { z } from 'zod';
+import { colorsSchema } from './colors.js';
+import { linksSchema } from './links.js';
+export const brandingSchema = z.object({
+    name: z.string().optional(),
+    logo: z.string().url().optional(),
+    colors: colorsSchema.optional(),
+    links: z.array(linksSchema).optional(),
 });
 //# sourceMappingURL=branding.js.map

package/dist/customization/branding.js.map

@@ -1 +1 @@
-{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/customization/branding.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,2CAA0C;AAC1C,yCAAwC;AAE3B,QAAA,cAAc,GAAG,OAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,MAAM,EAAE,wBAAY,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,sBAAW,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { colorsSchema } from './colors.js'\nimport { linksSchema } from './links.js'\n\nexport const brandingSchema = z.object({\n  name: z.string().optional(),\n  logo: z.string().url().optional(),\n  colors: colorsSchema.optional(),\n  links: z.array(linksSchema).optional(),\n})\nexport type BrandingInput = z.input<typeof brandingSchema>\nexport type Branding = z.infer<typeof brandingSchema>\n"]}
+{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/customization/branding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { colorsSchema } from './colors.js'\nimport { linksSchema } from './links.js'\n\nexport const brandingSchema = z.object({\n  name: z.string().optional(),\n  logo: z.string().url().optional(),\n  colors: colorsSchema.optional(),\n  links: z.array(linksSchema).optional(),\n})\nexport type BrandingInput = z.input<typeof brandingSchema>\nexport type Branding = z.infer<typeof brandingSchema>\n"]}

package/dist/customization/build-customization-css.js

@@ -1,9 +1,6 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildCustomizationCss = buildCustomizationCss;
-const color_js_1 = require("../lib/util/color.js");
-const colors_js_1 = require("./colors.js");
-function buildCustomizationCss({ branding, }) {
+import { extractHue, hslToRgb, pickContrastColor, } from '../lib/util/color.js';
+import { COLOR_NAMES } from './colors.js';
+export function buildCustomizationCss({ branding, }) {
     const vars = Array.from(buildCustomizationVars(branding));
     if (vars.length)
         return `:root { ${vars.join(' ')} }`;
@@ -14,25 +11,25 @@ function* buildCustomizationVars(branding) {
         yield `--contrast-sat: ${contrastSaturation.toFixed(2)}%;`;
         const contrastLight = branding.colors.light ??
             // Corresponds to color-contrast-975
-            (0, color_js_1.hslToRgb)({
+            hslToRgb({
                 h: branding.colors.primaryHue ?? 0,
                 s: contrastSaturation / 100,
                 l: 0.07,
             });
         const contrastDark = branding.colors.dark ??
             // Corresponds to color-contrast-25
-            (0, color_js_1.hslToRgb)({
+            hslToRgb({
                 h: branding.colors.primaryHue ?? 0,
                 s: contrastSaturation / 100,
                 l: 0.953,
             });
-        for (const name of colors_js_1.COLOR_NAMES) {
+        for (const name of COLOR_NAMES) {
             const value = branding.colors[name];
             if (!value)
                 continue; // Skip missing colors
             const contrast = branding.colors[`${name}Contrast`] ??
-                (0, color_js_1.pickContrastColor)(value, contrastLight, contrastDark);
-            const hue = branding.colors[`${name}Hue`] ?? (0, color_js_1.extractHue)(value);
+                pickContrastColor(value, contrastLight, contrastDark);
+            const hue = branding.colors[`${name}Hue`] ?? extractHue(value);
             yield `--branding-color-${name}: ${value.r} ${value.g} ${value.b};`;
             yield `--branding-color-${name}-contrast: ${contrast.r} ${contrast.g} ${contrast.b};`;
             yield `--branding-color-${name}-hue: ${hue};`;

package/dist/customization/build-customization-css.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-customization-css.js","sourceRoot":"","sources":["../../src/customization/build-customization-css.ts"],"names":[],"mappings":";;AAUA,sDAKC;AAfD,mDAK6B;AAE7B,2CAAyC;AAGzC,SAAgB,qBAAqB,CAAC,EACpC,QAAQ,GACM;IACd,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAA;IACzD,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAA;AACvD,CAAC;AAED,QAAQ,CAAC,CAAC,sBAAsB,CAAC,QAAmB;IAClD,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrB,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAA;QACnE,MAAM,mBAAmB,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QAE1D,MAAM,aAAa,GACjB,QAAQ,CAAC,MAAM,CAAC,KAAK;YACrB,oCAAoC;YACpC,IAAA,mBAAQ,EAAC;gBACP,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC;gBAClC,CAAC,EAAE,kBAAkB,GAAG,GAAG;gBAC3B,CAAC,EAAE,IAAI;aACR,CAAC,CAAA;QACJ,MAAM,YAAY,GAChB,QAAQ,CAAC,MAAM,CAAC,IAAI;YACpB,mCAAmC;YACnC,IAAA,mBAAQ,EAAC;gBACP,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC;gBAClC,CAAC,EAAE,kBAAkB,GAAG,GAAG;gBAC3B,CAAC,EAAE,KAAK;aACT,CAAC,CAAA;QAEJ,KAAK,MAAM,IAAI,IAAI,uBAAW,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACnC,IAAI,CAAC,KAAK;gBAAE,SAAQ,CAAC,sBAAsB;YAE3C,MAAM,QAAQ,GACZ,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC;gBAClC,IAAA,4BAAiB,EAAC,KAAK,EAAE,aAAa,EAAE,YAAY,CAAC,CAAA;YAEvD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,IAAA,qBAAU,EAAC,KAAK,CAAC,CAAA;YAE9D,MAAM,oBAAoB,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,CAAA;YACnE,MAAM,oBAAoB,IAAI,cAAc,QAAQ,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAA;YACrF,MAAM,oBAAoB,IAAI,SAAS,GAAG,GAAG,CAAA;QAC/C,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import {\n  RgbColor,\n  extractHue,\n  hslToRgb,\n  pickContrastColor,\n} from '../lib/util/color.js'\nimport { Branding } from './branding.js'\nimport { COLOR_NAMES } from './colors.js'\nimport { Customization } from './customization.js'\n\nexport function buildCustomizationCss({\n  branding,\n}: Customization): undefined | string {\n  const vars = Array.from(buildCustomizationVars(branding))\n  if (vars.length) return `:root { ${vars.join(' ')} }`\n}\n\nfunction* buildCustomizationVars(branding?: Branding): Generator<string> {\n  if (branding?.colors) {\n    const contrastSaturation = branding.colors.contrastSaturation ?? 30\n    yield `--contrast-sat: ${contrastSaturation.toFixed(2)}%;`\n\n    const contrastLight: RgbColor =\n      branding.colors.light ??\n      // Corresponds to color-contrast-975\n      hslToRgb({\n        h: branding.colors.primaryHue ?? 0,\n        s: contrastSaturation / 100,\n        l: 0.07,\n      })\n    const contrastDark: RgbColor =\n      branding.colors.dark ??\n      // Corresponds to color-contrast-25\n      hslToRgb({\n        h: branding.colors.primaryHue ?? 0,\n        s: contrastSaturation / 100,\n        l: 0.953,\n      })\n\n    for (const name of COLOR_NAMES) {\n      const value = branding.colors[name]\n      if (!value) continue // Skip missing colors\n\n      const contrast =\n        branding.colors[`${name}Contrast`] ??\n        pickContrastColor(value, contrastLight, contrastDark)\n\n      const hue = branding.colors[`${name}Hue`] ?? extractHue(value)\n\n      yield `--branding-color-${name}: ${value.r} ${value.g} ${value.b};`\n      yield `--branding-color-${name}-contrast: ${contrast.r} ${contrast.g} ${contrast.b};`\n      yield `--branding-color-${name}-hue: ${hue};`\n    }\n  }\n}\n"]}
+{"version":3,"file":"build-customization-css.js","sourceRoot":"","sources":["../../src/customization/build-customization-css.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,UAAU,EACV,QAAQ,EACR,iBAAiB,GAClB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAGzC,MAAM,UAAU,qBAAqB,CAAC,EACpC,QAAQ,GACM;IACd,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAA;IACzD,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAA;AACvD,CAAC;AAED,QAAQ,CAAC,CAAC,sBAAsB,CAAC,QAAmB;IAClD,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrB,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAA;QACnE,MAAM,mBAAmB,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QAE1D,MAAM,aAAa,GACjB,QAAQ,CAAC,MAAM,CAAC,KAAK;YACrB,oCAAoC;YACpC,QAAQ,CAAC;gBACP,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC;gBAClC,CAAC,EAAE,kBAAkB,GAAG,GAAG;gBAC3B,CAAC,EAAE,IAAI;aACR,CAAC,CAAA;QACJ,MAAM,YAAY,GAChB,QAAQ,CAAC,MAAM,CAAC,IAAI;YACpB,mCAAmC;YACnC,QAAQ,CAAC;gBACP,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC;gBAClC,CAAC,EAAE,kBAAkB,GAAG,GAAG;gBAC3B,CAAC,EAAE,KAAK;aACT,CAAC,CAAA;QAEJ,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACnC,IAAI,CAAC,KAAK;gBAAE,SAAQ,CAAC,sBAAsB;YAE3C,MAAM,QAAQ,GACZ,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC;gBAClC,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,YAAY,CAAC,CAAA;YAEvD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;YAE9D,MAAM,oBAAoB,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,CAAA;YACnE,MAAM,oBAAoB,IAAI,cAAc,QAAQ,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAA;YACrF,MAAM,oBAAoB,IAAI,SAAS,GAAG,GAAG,CAAA;QAC/C,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import {\n  RgbColor,\n  extractHue,\n  hslToRgb,\n  pickContrastColor,\n} from '../lib/util/color.js'\nimport { Branding } from './branding.js'\nimport { COLOR_NAMES } from './colors.js'\nimport { Customization } from './customization.js'\n\nexport function buildCustomizationCss({\n  branding,\n}: Customization): undefined | string {\n  const vars = Array.from(buildCustomizationVars(branding))\n  if (vars.length) return `:root { ${vars.join(' ')} }`\n}\n\nfunction* buildCustomizationVars(branding?: Branding): Generator<string> {\n  if (branding?.colors) {\n    const contrastSaturation = branding.colors.contrastSaturation ?? 30\n    yield `--contrast-sat: ${contrastSaturation.toFixed(2)}%;`\n\n    const contrastLight: RgbColor =\n      branding.colors.light ??\n      // Corresponds to color-contrast-975\n      hslToRgb({\n        h: branding.colors.primaryHue ?? 0,\n        s: contrastSaturation / 100,\n        l: 0.07,\n      })\n    const contrastDark: RgbColor =\n      branding.colors.dark ??\n      // Corresponds to color-contrast-25\n      hslToRgb({\n        h: branding.colors.primaryHue ?? 0,\n        s: contrastSaturation / 100,\n        l: 0.953,\n      })\n\n    for (const name of COLOR_NAMES) {\n      const value = branding.colors[name]\n      if (!value) continue // Skip missing colors\n\n      const contrast =\n        branding.colors[`${name}Contrast`] ??\n        pickContrastColor(value, contrastLight, contrastDark)\n\n      const hue = branding.colors[`${name}Hue`] ?? extractHue(value)\n\n      yield `--branding-color-${name}: ${value.r} ${value.g} ${value.b};`\n      yield `--branding-color-${name}-contrast: ${contrast.r} ${contrast.g} ${contrast.b};`\n      yield `--branding-color-${name}-hue: ${hue};`\n    }\n  }\n}\n"]}

package/dist/customization/build-customization-data.js

@@ -1,7 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildCustomizationData = buildCustomizationData;
-function buildCustomizationData({ branding, availableUserDomains, inviteCodeRequired, hcaptcha, }) {
+export function buildCustomizationData({ branding, availableUserDomains, inviteCodeRequired, hcaptcha, }) {
     // @NOTE the front end does not need colors here as they will be injected as
     // CSS variables.
     // @NOTE We only copy the values explicitly needed to avoid leaking sensitive

package/dist/customization/build-customization-data.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-customization-data.js","sourceRoot":"","sources":["../../src/customization/build-customization-data.ts"],"names":[],"mappings":";;AAGA,wDAkBC;AAlBD,SAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,oBAAoB,EACpB,kBAAkB,EAClB,QAAQ,GACM;IACd,4EAA4E;IAC5E,iBAAiB;IACjB,6EAA6E;IAC7E,6DAA6D;IAC7D,OAAO;QACL,oBAAoB;QACpB,kBAAkB;QAClB,eAAe,EAAE,QAAQ,EAAE,OAAO;QAClC,IAAI,EAAE,QAAQ,EAAE,IAAI;QACpB,IAAI,EAAE,QAAQ,EAAE,IAAI;QACpB,KAAK,EAAE,QAAQ,EAAE,KAAK;KACvB,CAAA;AACH,CAAC","sourcesContent":["import type { CustomizationData } from '@atproto/oauth-provider-api'\nimport type { Customization } from './customization.js'\n\nexport function buildCustomizationData({\n  branding,\n  availableUserDomains,\n  inviteCodeRequired,\n  hcaptcha,\n}: Customization): CustomizationData {\n  // @NOTE the front end does not need colors here as they will be injected as\n  // CSS variables.\n  // @NOTE We only copy the values explicitly needed to avoid leaking sensitive\n  // data (in case the caller passed more than what we expect).\n  return {\n    availableUserDomains,\n    inviteCodeRequired,\n    hcaptchaSiteKey: hcaptcha?.siteKey,\n    name: branding?.name,\n    logo: branding?.logo,\n    links: branding?.links,\n  }\n}\n"]}
+{"version":3,"file":"build-customization-data.js","sourceRoot":"","sources":["../../src/customization/build-customization-data.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,sBAAsB,CAAC,EACrC,QAAQ,EACR,oBAAoB,EACpB,kBAAkB,EAClB,QAAQ,GACM;IACd,4EAA4E;IAC5E,iBAAiB;IACjB,6EAA6E;IAC7E,6DAA6D;IAC7D,OAAO;QACL,oBAAoB;QACpB,kBAAkB;QAClB,eAAe,EAAE,QAAQ,EAAE,OAAO;QAClC,IAAI,EAAE,QAAQ,EAAE,IAAI;QACpB,IAAI,EAAE,QAAQ,EAAE,IAAI;QACpB,KAAK,EAAE,QAAQ,EAAE,KAAK;KACvB,CAAA;AACH,CAAC","sourcesContent":["import type { CustomizationData } from '@atproto/oauth-provider-api'\nimport type { Customization } from './customization.js'\n\nexport function buildCustomizationData({\n  branding,\n  availableUserDomains,\n  inviteCodeRequired,\n  hcaptcha,\n}: Customization): CustomizationData {\n  // @NOTE the front end does not need colors here as they will be injected as\n  // CSS variables.\n  // @NOTE We only copy the values explicitly needed to avoid leaking sensitive\n  // data (in case the caller passed more than what we expect).\n  return {\n    availableUserDomains,\n    inviteCodeRequired,\n    hcaptchaSiteKey: hcaptcha?.siteKey,\n    name: branding?.name,\n    logo: branding?.logo,\n    links: branding?.links,\n  }\n}\n"]}

package/dist/customization/colors.js

@@ -1,17 +1,14 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.colorsSchema = exports.COLOR_NAMES = void 0;
-const zod_1 = require("zod");
-const color_hue_js_1 = require("../types/color-hue.js");
-const rgb_color_js_1 = require("../types/rgb-color.js");
-exports.COLOR_NAMES = [
+import { z } from 'zod';
+import { colorHueSchema } from '../types/color-hue.js';
+import { rgbColorSchema } from '../types/rgb-color.js';
+export const COLOR_NAMES = [
     'primary',
     'error',
     'warning',
     'info',
     'success',
 ];
-exports.colorsSchema = zod_1.z
+export const colorsSchema = z
     .object({
     // The "light" and "dark" colors are used as default for unspecified
     // contrast colors. The color that has the highest contrast ratio with the
@@ -19,16 +16,16 @@ exports.colorsSchema = zod_1.z
     // "primaryContrast" is not, then the contrast color will be either "light"
     // or "dark" depending on which one has the highest contrast ratio with
     // "primary".
-    light: rgb_color_js_1.rgbColorSchema.optional(),
-    dark: rgb_color_js_1.rgbColorSchema.optional(),
+    light: rgbColorSchema.optional(),
+    dark: rgbColorSchema.optional(),
     // The "contrastSaturation" is used to compute the saturation of the
     // "contrast" color. The "contrast" color is a (dynamic) color derived from
     // the "primaryHue" color with the specified saturation and a variable
     // lightness. "color-contrast-900" is used for default text, while
     // "color-contrast-0" is used for the page background.
-    contrastSaturation: zod_1.z.number().min(0).max(100).optional(),
+    contrastSaturation: z.number().min(0).max(100).optional(),
 })
-    .extend(Object.fromEntries(exports.COLOR_NAMES.map((name) => [name, rgb_color_js_1.rgbColorSchema.optional()])))
-    .extend(Object.fromEntries(exports.COLOR_NAMES.map((name) => [`${name}Contrast`, rgb_color_js_1.rgbColorSchema.optional()])))
-    .extend(Object.fromEntries(exports.COLOR_NAMES.map((name) => [`${name}Hue`, color_hue_js_1.colorHueSchema.optional()])));
+    .extend(Object.fromEntries(COLOR_NAMES.map((name) => [name, rgbColorSchema.optional()])))
+    .extend(Object.fromEntries(COLOR_NAMES.map((name) => [`${name}Contrast`, rgbColorSchema.optional()])))
+    .extend(Object.fromEntries(COLOR_NAMES.map((name) => [`${name}Hue`, colorHueSchema.optional()])));
 //# sourceMappingURL=colors.js.map

package/dist/customization/colors.js.map

@@ -1 +1 @@
-{"version":3,"file":"colors.js","sourceRoot":"","sources":["../../src/customization/colors.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,wDAAsD;AACtD,wDAAsD;AAEzC,QAAA,WAAW,GAAG;IACzB,SAAS;IACT,OAAO;IACP,SAAS;IACT,MAAM;IACN,SAAS;CACD,CAAA;AAGG,QAAA,YAAY,GAAG,OAAC;KAC1B,MAAM,CAAC;IACN,oEAAoE;IACpE,0EAA0E;IAC1E,8DAA8D;IAC9D,2EAA2E;IAC3E,uEAAuE;IACvE,aAAa;IACb,KAAK,EAAE,6BAAc,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,6BAAc,CAAC,QAAQ,EAAE;IAE/B,oEAAoE;IACpE,2EAA2E;IAC3E,sEAAsE;IACtE,kEAAkE;IAClE,sDAAsD;IACtD,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,CACL,MAAM,CAAC,WAAW,CAChB,mBAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,6BAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CACF,CAC7D;KACA,MAAM,CACL,MAAM,CAAC,WAAW,CAChB,mBAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,UAAU,EAAE,6BAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CACF,CAC1E;KACA,MAAM,CACL,MAAM,CAAC,WAAW,CAChB,mBAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,KAAK,EAAE,6BAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CACF,CACrE,CAAA","sourcesContent":["import { z } from 'zod'\nimport { colorHueSchema } from '../types/color-hue.js'\nimport { rgbColorSchema } from '../types/rgb-color.js'\n\nexport const COLOR_NAMES = [\n  'primary',\n  'error',\n  'warning',\n  'info',\n  'success',\n] as const\nexport type ColorName = (typeof COLOR_NAMES)[number]\n\nexport const colorsSchema = z\n  .object({\n    // The \"light\" and \"dark\" colors are used as default for unspecified\n    // contrast colors. The color that has the highest contrast ratio with the\n    // color base will be used. e.G. If \"primary\" is specified but\n    // \"primaryContrast\" is not, then the contrast color will be either \"light\"\n    // or \"dark\" depending on which one has the highest contrast ratio with\n    // \"primary\".\n    light: rgbColorSchema.optional(),\n    dark: rgbColorSchema.optional(),\n\n    // The \"contrastSaturation\" is used to compute the saturation of the\n    // \"contrast\" color. The \"contrast\" color is a (dynamic) color derived from\n    // the \"primaryHue\" color with the specified saturation and a variable\n    // lightness. \"color-contrast-900\" is used for default text, while\n    // \"color-contrast-0\" is used for the page background.\n    contrastSaturation: z.number().min(0).max(100).optional(),\n  })\n  .extend(\n    Object.fromEntries(\n      COLOR_NAMES.map((name) => [name, rgbColorSchema.optional()]),\n    ) as Record<ColorName, z.ZodOptional<typeof rgbColorSchema>>,\n  )\n  .extend(\n    Object.fromEntries(\n      COLOR_NAMES.map((name) => [`${name}Contrast`, rgbColorSchema.optional()]),\n    ) as Record<`${ColorName}Contrast`, z.ZodOptional<typeof rgbColorSchema>>,\n  )\n  .extend(\n    Object.fromEntries(\n      COLOR_NAMES.map((name) => [`${name}Hue`, colorHueSchema.optional()]),\n    ) as Record<`${ColorName}Hue`, z.ZodOptional<typeof colorHueSchema>>,\n  )\n\nexport type Colors = z.infer<typeof colorsSchema>\n"]}
+{"version":3,"file":"colors.js","sourceRoot":"","sources":["../../src/customization/colors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,SAAS;IACT,OAAO;IACP,SAAS;IACT,MAAM;IACN,SAAS;CACD,CAAA;AAGV,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,oEAAoE;IACpE,0EAA0E;IAC1E,8DAA8D;IAC9D,2EAA2E;IAC3E,uEAAuE;IACvE,aAAa;IACb,KAAK,EAAE,cAAc,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;IAE/B,oEAAoE;IACpE,2EAA2E;IAC3E,sEAAsE;IACtE,kEAAkE;IAClE,sDAAsD;IACtD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,CACL,MAAM,CAAC,WAAW,CAChB,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CACF,CAC7D;KACA,MAAM,CACL,MAAM,CAAC,WAAW,CAChB,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,UAAU,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CACF,CAC1E;KACA,MAAM,CACL,MAAM,CAAC,WAAW,CAChB,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,KAAK,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CACF,CACrE,CAAA","sourcesContent":["import { z } from 'zod'\nimport { colorHueSchema } from '../types/color-hue.js'\nimport { rgbColorSchema } from '../types/rgb-color.js'\n\nexport const COLOR_NAMES = [\n  'primary',\n  'error',\n  'warning',\n  'info',\n  'success',\n] as const\nexport type ColorName = (typeof COLOR_NAMES)[number]\n\nexport const colorsSchema = z\n  .object({\n    // The \"light\" and \"dark\" colors are used as default for unspecified\n    // contrast colors. The color that has the highest contrast ratio with the\n    // color base will be used. e.G. If \"primary\" is specified but\n    // \"primaryContrast\" is not, then the contrast color will be either \"light\"\n    // or \"dark\" depending on which one has the highest contrast ratio with\n    // \"primary\".\n    light: rgbColorSchema.optional(),\n    dark: rgbColorSchema.optional(),\n\n    // The \"contrastSaturation\" is used to compute the saturation of the\n    // \"contrast\" color. The \"contrast\" color is a (dynamic) color derived from\n    // the \"primaryHue\" color with the specified saturation and a variable\n    // lightness. \"color-contrast-900\" is used for default text, while\n    // \"color-contrast-0\" is used for the page background.\n    contrastSaturation: z.number().min(0).max(100).optional(),\n  })\n  .extend(\n    Object.fromEntries(\n      COLOR_NAMES.map((name) => [name, rgbColorSchema.optional()]),\n    ) as Record<ColorName, z.ZodOptional<typeof rgbColorSchema>>,\n  )\n  .extend(\n    Object.fromEntries(\n      COLOR_NAMES.map((name) => [`${name}Contrast`, rgbColorSchema.optional()]),\n    ) as Record<`${ColorName}Contrast`, z.ZodOptional<typeof rgbColorSchema>>,\n  )\n  .extend(\n    Object.fromEntries(\n      COLOR_NAMES.map((name) => [`${name}Hue`, colorHueSchema.optional()]),\n    ) as Record<`${ColorName}Hue`, z.ZodOptional<typeof colorHueSchema>>,\n  )\n\nexport type Colors = z.infer<typeof colorsSchema>\n"]}

package/dist/customization/customization.js

@@ -1,26 +1,23 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.customizationSchema = void 0;
-const zod_1 = require("zod");
-const hcaptcha_js_1 = require("../lib/hcaptcha.js");
-const branding_js_1 = require("./branding.js");
-exports.customizationSchema = zod_1.z.object({
+import { z } from 'zod';
+import { hcaptchaConfigSchema } from '../lib/hcaptcha.js';
+import { brandingSchema } from './branding.js';
+export const customizationSchema = z.object({
     /**
      * Available user domains that can be used to sign up. A non-empty array
      * is required to enable the sign-up feature.
      */
-    availableUserDomains: zod_1.z.array(zod_1.z.string()).optional(),
+    availableUserDomains: z.array(z.string()).optional(),
     /**
      * UI customizations
      */
-    branding: branding_js_1.brandingSchema.optional(),
+    branding: brandingSchema.optional(),
     /**
      * Is an invite code required to sign up?
      */
-    inviteCodeRequired: zod_1.z.boolean().optional(),
+    inviteCodeRequired: z.boolean().optional(),
     /**
      * Enables hCaptcha during sign-up.
      */
-    hcaptcha: hcaptcha_js_1.hcaptchaConfigSchema.optional(),
+    hcaptcha: hcaptchaConfigSchema.optional(),
 });
 //# sourceMappingURL=customization.js.map

package/dist/customization/customization.js.map

@@ -1 +1 @@
-{"version":3,"file":"customization.js","sourceRoot":"","sources":["../../src/customization/customization.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,oDAAyD;AACzD,+CAA8C;AAEjC,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C;;;OAGG;IACH,oBAAoB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD;;OAEG;IACH,QAAQ,EAAE,4BAAc,CAAC,QAAQ,EAAE;IACnC;;OAEG;IACH,kBAAkB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC1C;;OAEG;IACH,QAAQ,EAAE,kCAAoB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { hcaptchaConfigSchema } from '../lib/hcaptcha.js'\nimport { brandingSchema } from './branding.js'\n\nexport const customizationSchema = z.object({\n  /**\n   * Available user domains that can be used to sign up. A non-empty array\n   * is required to enable the sign-up feature.\n   */\n  availableUserDomains: z.array(z.string()).optional(),\n  /**\n   * UI customizations\n   */\n  branding: brandingSchema.optional(),\n  /**\n   * Is an invite code required to sign up?\n   */\n  inviteCodeRequired: z.boolean().optional(),\n  /**\n   * Enables hCaptcha during sign-up.\n   */\n  hcaptcha: hcaptchaConfigSchema.optional(),\n})\nexport type CustomizationInput = z.input<typeof customizationSchema>\nexport type Customization = z.infer<typeof customizationSchema>\n"]}
+{"version":3,"file":"customization.js","sourceRoot":"","sources":["../../src/customization/customization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C;;;OAGG;IACH,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD;;OAEG;IACH,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC;;OAEG;IACH,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC1C;;OAEG;IACH,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { hcaptchaConfigSchema } from '../lib/hcaptcha.js'\nimport { brandingSchema } from './branding.js'\n\nexport const customizationSchema = z.object({\n  /**\n   * Available user domains that can be used to sign up. A non-empty array\n   * is required to enable the sign-up feature.\n   */\n  availableUserDomains: z.array(z.string()).optional(),\n  /**\n   * UI customizations\n   */\n  branding: brandingSchema.optional(),\n  /**\n   * Is an invite code required to sign up?\n   */\n  inviteCodeRequired: z.boolean().optional(),\n  /**\n   * Enables hCaptcha during sign-up.\n   */\n  hcaptcha: hcaptchaConfigSchema.optional(),\n})\nexport type CustomizationInput = z.input<typeof customizationSchema>\nexport type Customization = z.infer<typeof customizationSchema>\n"]}

package/dist/customization/links.js

@@ -1,12 +1,9 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.linksSchema = void 0;
-const zod_1 = require("zod");
-const build_document_js_1 = require("../lib/html/build-document.js");
-const locale_js_1 = require("../lib/util/locale.js");
-exports.linksSchema = zod_1.z.object({
-    title: zod_1.z.union([zod_1.z.string(), locale_js_1.multiLangStringSchema]),
-    href: zod_1.z.string().url(),
-    rel: zod_1.z.string().refine(build_document_js_1.isLinkRel, 'Invalid link rel').optional(),
+import { z } from 'zod';
+import { isLinkRel } from '../lib/html/build-document.js';
+import { multiLangStringSchema } from '../lib/util/locale.js';
+export const linksSchema = z.object({
+    title: z.union([z.string(), multiLangStringSchema]),
+    href: z.string().url(),
+    rel: z.string().refine(isLinkRel, 'Invalid link rel').optional(),
 });
 //# sourceMappingURL=links.js.map

package/dist/customization/links.js.map

@@ -1 +1 @@
-{"version":3,"file":"links.js","sourceRoot":"","sources":["../../src/customization/links.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,qEAAyD;AACzD,qDAA6D;AAEhD,QAAA,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,iCAAqB,CAAC,CAAC;IACnD,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACtB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,6BAAS,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { isLinkRel } from '../lib/html/build-document.js'\nimport { multiLangStringSchema } from '../lib/util/locale.js'\n\nexport const linksSchema = z.object({\n  title: z.union([z.string(), multiLangStringSchema]),\n  href: z.string().url(),\n  rel: z.string().refine(isLinkRel, 'Invalid link rel').optional(),\n})\nexport type Links = z.infer<typeof linksSchema>\n"]}
+{"version":3,"file":"links.js","sourceRoot":"","sources":["../../src/customization/links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAA;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAE7D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { isLinkRel } from '../lib/html/build-document.js'\nimport { multiLangStringSchema } from '../lib/util/locale.js'\n\nexport const linksSchema = z.object({\n  title: z.union([z.string(), multiLangStringSchema]),\n  href: z.string().url(),\n  rel: z.string().refine(isLinkRel, 'Invalid link rel').optional(),\n})\nexport type Links = z.infer<typeof linksSchema>\n"]}

package/dist/device/device-data.js

@@ -1,12 +1,9 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.deviceDataSchema = void 0;
-const zod_1 = require("zod");
-const session_id_js_1 = require("./session-id.js");
-exports.deviceDataSchema = zod_1.z.object({
-    sessionId: session_id_js_1.sessionIdSchema,
-    lastSeenAt: zod_1.z.date(),
-    userAgent: zod_1.z.string().nullable(),
-    ipAddress: zod_1.z.string(),
+import { z } from 'zod';
+import { sessionIdSchema } from './session-id.js';
+export const deviceDataSchema = z.object({
+    sessionId: sessionIdSchema,
+    lastSeenAt: z.date(),
+    userAgent: z.string().nullable(),
+    ipAddress: z.string(),
 });
 //# sourceMappingURL=device-data.js.map

package/dist/device/device-data.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-data.js","sourceRoot":"","sources":["../../src/device/device-data.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,mDAAiD;AAEpC,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,+BAAe;IAC1B,UAAU,EAAE,OAAC,CAAC,IAAI,EAAE;IACpB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { sessionIdSchema } from './session-id.js'\n\nexport const deviceDataSchema = z.object({\n  sessionId: sessionIdSchema,\n  lastSeenAt: z.date(),\n  userAgent: z.string().nullable(),\n  ipAddress: z.string(),\n})\n\nexport type DeviceData = z.infer<typeof deviceDataSchema>\n"]}
+{"version":3,"file":"device-data.js","sourceRoot":"","sources":["../../src/device/device-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,eAAe;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { sessionIdSchema } from './session-id.js'\n\nexport const deviceDataSchema = z.object({\n  sessionId: sessionIdSchema,\n  lastSeenAt: z.date(),\n  userAgent: z.string().nullable(),\n  ipAddress: z.string(),\n})\n\nexport type DeviceData = z.infer<typeof deviceDataSchema>\n"]}

package/dist/device/device-id.js

@@ -1,22 +1,17 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateDeviceId = exports.deviceIdSchema = exports.DEVICE_ID_LENGTH = void 0;
-exports.isDeviceId = isDeviceId;
-const zod_1 = require("zod");
-const constants_js_1 = require("../constants.js");
-const crypto_js_1 = require("../lib/util/crypto.js");
-exports.DEVICE_ID_LENGTH = constants_js_1.DEVICE_ID_PREFIX.length + constants_js_1.DEVICE_ID_BYTES_LENGTH * 2; // hex encoding
-exports.deviceIdSchema = zod_1.z
+import { z } from 'zod';
+import { DEVICE_ID_BYTES_LENGTH, DEVICE_ID_PREFIX } from '../constants.js';
+import { randomHexId } from '../lib/util/crypto.js';
+export const DEVICE_ID_LENGTH = DEVICE_ID_PREFIX.length + DEVICE_ID_BYTES_LENGTH * 2; // hex encoding
+export const deviceIdSchema = z
     .string()
-    .length(exports.DEVICE_ID_LENGTH)
-    .refine((v) => v.startsWith(constants_js_1.DEVICE_ID_PREFIX), {
+    .length(DEVICE_ID_LENGTH)
+    .refine((v) => v.startsWith(DEVICE_ID_PREFIX), {
     message: `Invalid device ID format`,
 });
-function isDeviceId(value) {
-    return exports.deviceIdSchema.safeParse(value).success;
+export function isDeviceId(value) {
+    return deviceIdSchema.safeParse(value).success;
 }
-const generateDeviceId = async () => {
-    return `${constants_js_1.DEVICE_ID_PREFIX}${await (0, crypto_js_1.randomHexId)(constants_js_1.DEVICE_ID_BYTES_LENGTH)}`;
+export const generateDeviceId = async () => {
+    return `${DEVICE_ID_PREFIX}${await randomHexId(DEVICE_ID_BYTES_LENGTH)}`;
 };
-exports.generateDeviceId = generateDeviceId;
 //# sourceMappingURL=device-id.js.map

package/dist/device/device-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-id.js","sourceRoot":"","sources":["../../src/device/device-id.ts"],"names":[],"mappings":";;;AAoBA,gCAEC;AAtBD,6BAAuB;AACvB,kDAA0E;AAC1E,qDAAmD;AAEtC,QAAA,gBAAgB,GAC3B,+BAAgB,CAAC,MAAM,GAAG,qCAAsB,GAAG,CAAC,CAAA,CAAC,eAAe;AAEzD,QAAA,cAAc,GAAG,OAAC;KAC5B,MAAM,EAAE;KACR,MAAM,CAAC,wBAAgB,CAAC;KACxB,MAAM,CACL,CAAC,CAAC,EAA8C,EAAE,CAChD,CAAC,CAAC,UAAU,CAAC,+BAAgB,CAAC,EAChC;IACE,OAAO,EAAE,0BAA0B;CACpC,CACF,CAAA;AAIH,SAAgB,UAAU,CAAC,KAAc;IACvC,OAAO,sBAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAA;AAChD,CAAC;AAEM,MAAM,gBAAgB,GAAG,KAAK,IAAuB,EAAE;IAC5D,OAAO,GAAG,+BAAgB,GAAG,MAAM,IAAA,uBAAW,EAAC,qCAAsB,CAAC,EAAE,CAAA;AAC1E,CAAC,CAAA;AAFY,QAAA,gBAAgB,oBAE5B","sourcesContent":["import { z } from 'zod'\nimport { DEVICE_ID_BYTES_LENGTH, DEVICE_ID_PREFIX } from '../constants.js'\nimport { randomHexId } from '../lib/util/crypto.js'\n\nexport const DEVICE_ID_LENGTH =\n  DEVICE_ID_PREFIX.length + DEVICE_ID_BYTES_LENGTH * 2 // hex encoding\n\nexport const deviceIdSchema = z\n  .string()\n  .length(DEVICE_ID_LENGTH)\n  .refine(\n    (v): v is `${typeof DEVICE_ID_PREFIX}${string}` =>\n      v.startsWith(DEVICE_ID_PREFIX),\n    {\n      message: `Invalid device ID format`,\n    },\n  )\n\nexport type DeviceId = z.infer<typeof deviceIdSchema>\n\nexport function isDeviceId(value: unknown): value is DeviceId {\n  return deviceIdSchema.safeParse(value).success\n}\n\nexport const generateDeviceId = async (): Promise<DeviceId> => {\n  return `${DEVICE_ID_PREFIX}${await randomHexId(DEVICE_ID_BYTES_LENGTH)}`\n}\n"]}
+{"version":3,"file":"device-id.js","sourceRoot":"","sources":["../../src/device/device-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,MAAM,CAAC,MAAM,gBAAgB,GAC3B,gBAAgB,CAAC,MAAM,GAAG,sBAAsB,GAAG,CAAC,CAAA,CAAC,eAAe;AAEtE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,MAAM,CAAC,gBAAgB,CAAC;KACxB,MAAM,CACL,CAAC,CAAC,EAA8C,EAAE,CAChD,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAChC;IACE,OAAO,EAAE,0BAA0B;CACpC,CACF,CAAA;AAIH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,IAAuB,EAAE;IAC5D,OAAO,GAAG,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAAC,EAAE,CAAA;AAC1E,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { DEVICE_ID_BYTES_LENGTH, DEVICE_ID_PREFIX } from '../constants.js'\nimport { randomHexId } from '../lib/util/crypto.js'\n\nexport const DEVICE_ID_LENGTH =\n  DEVICE_ID_PREFIX.length + DEVICE_ID_BYTES_LENGTH * 2 // hex encoding\n\nexport const deviceIdSchema = z\n  .string()\n  .length(DEVICE_ID_LENGTH)\n  .refine(\n    (v): v is `${typeof DEVICE_ID_PREFIX}${string}` =>\n      v.startsWith(DEVICE_ID_PREFIX),\n    {\n      message: `Invalid device ID format`,\n    },\n  )\n\nexport type DeviceId = z.infer<typeof deviceIdSchema>\n\nexport function isDeviceId(value: unknown): value is DeviceId {\n  return deviceIdSchema.safeParse(value).success\n}\n\nexport const generateDeviceId = async (): Promise<DeviceId> => {\n  return `${DEVICE_ID_PREFIX}${await randomHexId(DEVICE_ID_BYTES_LENGTH)}`\n}\n"]}