@atproto/oauth-provider 0.16.5 → 0.17.0

package/dist/oauth-provider.js

@@ -1,72 +1,56 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAuthProvider = exports.LexResolver = exports.Keyset = exports.AccessTokenMode = void 0;
-const node_crypto_1 = require("node:crypto");
-const jwk_1 = require("@atproto/jwk");
-Object.defineProperty(exports, "Keyset", { enumerable: true, get: function () { return jwk_1.Keyset; } });
-const lex_resolver_1 = require("@atproto/lex-resolver");
-Object.defineProperty(exports, "LexResolver", { enumerable: true, get: function () { return lex_resolver_1.LexResolver; } });
-const oauth_types_1 = require("@atproto/oauth-types");
-const fetch_node_1 = require("@atproto-labs/fetch-node");
-const simple_store_memory_1 = require("@atproto-labs/simple-store-memory");
-const access_token_mode_js_1 = require("./access-token/access-token-mode.js");
-Object.defineProperty(exports, "AccessTokenMode", { enumerable: true, get: function () { return access_token_mode_js_1.AccessTokenMode; } });
-const account_manager_js_1 = require("./account/account-manager.js");
-const account_store_js_1 = require("./account/account-store.js");
-const client_manager_js_1 = require("./client/client-manager.js");
-const client_store_js_1 = require("./client/client-store.js");
-const constants_js_1 = require("./constants.js");
-const customization_js_1 = require("./customization/customization.js");
-const device_manager_js_1 = require("./device/device-manager.js");
-const device_store_js_1 = require("./device/device-store.js");
-const account_selection_required_error_js_1 = require("./errors/account-selection-required-error.js");
-const authorization_error_js_1 = require("./errors/authorization-error.js");
-const consent_required_error_js_1 = require("./errors/consent-required-error.js");
-const invalid_dpop_key_binding_error_js_1 = require("./errors/invalid-dpop-key-binding-error.js");
-const invalid_dpop_proof_error_js_1 = require("./errors/invalid-dpop-proof-error.js");
-const invalid_grant_error_js_1 = require("./errors/invalid-grant-error.js");
-const invalid_request_error_js_1 = require("./errors/invalid-request-error.js");
-const login_required_error_js_1 = require("./errors/login-required-error.js");
-const lexicon_manager_js_1 = require("./lexicon/lexicon-manager.js");
-const lexicon_store_js_1 = require("./lexicon/lexicon-store.js");
-const date_js_1 = require("./lib/util/date.js");
-const error_js_1 = require("./lib/util/error.js");
-const build_metadata_js_1 = require("./metadata/build-metadata.js");
-const oauth_verifier_js_1 = require("./oauth-verifier.js");
-const replay_store_js_1 = require("./replay/replay-store.js");
-const code_js_1 = require("./request/code.js");
-const request_manager_js_1 = require("./request/request-manager.js");
-const request_store_js_1 = require("./request/request-store.js");
-const request_uri_js_1 = require("./request/request-uri.js");
-const token_manager_js_1 = require("./token/token-manager.js");
-const token_store_js_1 = require("./token/token-store.js");
-const par_response_error_js_1 = require("./types/par-response-error.js");
-class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
-    accessTokenMode;
-    hooks;
-    metadata;
-    customization;
-    authenticationMaxAge;
-    accountManager;
-    deviceManager;
-    clientManager;
-    lexiconManager;
-    requestManager;
-    tokenManager;
+import { createHash } from 'node:crypto';
+import { Keyset } from '@atproto/jwk';
+import { LexResolver } from '@atproto/lex-resolver';
+import { CLIENT_ASSERTION_TYPE_JWT_BEARER, atprotoLoopbackClientMetadata, oauthAuthorizationRequestParametersSchema, } from '@atproto/oauth-types';
+import { safeFetchWrap } from '@atproto-labs/fetch-node';
+import { SimpleStoreMemory } from '@atproto-labs/simple-store-memory';
+import { AccessTokenMode } from './access-token/access-token-mode.js';
+import { AccountManager } from './account/account-manager.js';
+import { asAccountStore, } from './account/account-store.js';
+import { ClientManager, } from './client/client-manager.js';
+import { ifClientStore } from './client/client-store.js';
+import { AUTHENTICATION_MAX_AGE, CONFIDENTIAL_CLIENT_REFRESH_LIFETIME, CONFIDENTIAL_CLIENT_SESSION_LIFETIME, PUBLIC_CLIENT_REFRESH_LIFETIME, PUBLIC_CLIENT_SESSION_LIFETIME, TOKEN_MAX_AGE, } from './constants.js';
+import { customizationSchema, } from './customization/customization.js';
+import { DeviceManager, } from './device/device-manager.js';
+import { asDeviceStore } from './device/device-store.js';
+import { AccountSelectionRequiredError } from './errors/account-selection-required-error.js';
+import { AuthorizationError } from './errors/authorization-error.js';
+import { ConsentRequiredError } from './errors/consent-required-error.js';
+import { InvalidDpopKeyBindingError } from './errors/invalid-dpop-key-binding-error.js';
+import { InvalidDpopProofError } from './errors/invalid-dpop-proof-error.js';
+import { InvalidGrantError } from './errors/invalid-grant-error.js';
+import { InvalidRequestError } from './errors/invalid-request-error.js';
+import { LoginRequiredError } from './errors/login-required-error.js';
+import { LexiconManager } from './lexicon/lexicon-manager.js';
+import { asLexiconStore } from './lexicon/lexicon-store.js';
+import { dateToRelativeSeconds } from './lib/util/date.js';
+import { formatError } from './lib/util/error.js';
+import { buildMetadata } from './metadata/build-metadata.js';
+import { OAuthVerifier, } from './oauth-verifier.js';
+import { ifReplayStore } from './replay/replay-store.js';
+import { codeSchema } from './request/code.js';
+import { RequestManager } from './request/request-manager.js';
+import { asRequestStore } from './request/request-store.js';
+import { parseRequestUri } from './request/request-uri.js';
+import { TokenManager } from './token/token-manager.js';
+import { asTokenStore, refreshTokenSchema, } from './token/token-store.js';
+import { isPARResponseError } from './types/par-response-error.js';
+export { AccessTokenMode, Keyset, LexResolver };
+export class OAuthProvider extends OAuthVerifier {
     constructor({ 
     // OAuthProviderConfig
-    authenticationMaxAge = constants_js_1.AUTHENTICATION_MAX_AGE, tokenMaxAge = constants_js_1.TOKEN_MAX_AGE, accessTokenMode = access_token_mode_js_1.AccessTokenMode.stateless, metadata, safeFetch = (0, fetch_node_1.safeFetchWrap)(), store, // compound store implementation
-    lexResolver = new lex_resolver_1.LexResolver({ fetch: safeFetch }), 
+    authenticationMaxAge = AUTHENTICATION_MAX_AGE, tokenMaxAge = TOKEN_MAX_AGE, accessTokenMode = AccessTokenMode.stateless, metadata, safeFetch = safeFetchWrap(), store, // compound store implementation
+    lexResolver = new LexResolver({ fetch: safeFetch }), 
     // Required stores
-    accountStore = (0, account_store_js_1.asAccountStore)(store), deviceStore = (0, device_store_js_1.asDeviceStore)(store), lexiconStore = (0, lexicon_store_js_1.asLexiconStore)(store), tokenStore = (0, token_store_js_1.asTokenStore)(store), requestStore = (0, request_store_js_1.asRequestStore)(store), 
+    accountStore = asAccountStore(store), deviceStore = asDeviceStore(store), lexiconStore = asLexiconStore(store), tokenStore = asTokenStore(store), requestStore = asRequestStore(store), 
     // Optional stores
-    clientStore = (0, client_store_js_1.ifClientStore)(store), replayStore = (0, replay_store_js_1.ifReplayStore)(store), clientJwksCache = new simple_store_memory_1.SimpleStoreMemory({
+    clientStore = ifClientStore(store), replayStore = ifReplayStore(store), clientJwksCache = new SimpleStoreMemory({
         maxSize: 50_000_000,
         ttl: 600e3,
-    }), clientMetadataCache = new simple_store_memory_1.SimpleStoreMemory({
+    }), clientMetadataCache = new SimpleStoreMemory({
         maxSize: 50_000_000,
         ttl: 600e3,
-    }), loopbackMetadata = oauth_types_1.atprotoLoopbackClientMetadata, 
+    }), loopbackMetadata = atprotoLoopbackClientMetadata, 
     // OAuthHooks &
     // OAuthVerifierOptions &
     // DeviceManagerOptions &
@@ -81,9 +65,9 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         this.hooks = rest;
         this.accessTokenMode = accessTokenMode;
         this.authenticationMaxAge = authenticationMaxAge;
-        this.metadata = (0, build_metadata_js_1.buildMetadata)(this.issuer, this.keyset, metadata);
-        this.customization = customization_js_1.customizationSchema.parse(rest);
-        this.deviceManager = new device_manager_js_1.DeviceManager(deviceStore, {
+        this.metadata = buildMetadata(this.issuer, this.keyset, metadata);
+        this.customization = customizationSchema.parse(rest);
+        this.deviceManager = new DeviceManager(deviceStore, {
             ...rest,
             cookie: {
                 ...rest.cookie,
@@ -94,11 +78,11 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                 secure: !this.issuer.startsWith('http:'),
             },
         });
-        this.accountManager = new account_manager_js_1.AccountManager(this.issuer, accountStore, this.hooks, this.customization);
-        this.clientManager = new client_manager_js_1.ClientManager(this.metadata, this.keyset, this.hooks, clientStore || null, loopbackMetadata || null, safeFetch, clientJwksCache, clientMetadataCache);
-        this.lexiconManager = new lexicon_manager_js_1.LexiconManager(lexiconStore, lexResolver);
-        this.requestManager = new request_manager_js_1.RequestManager(requestStore, this.lexiconManager, this.signer, this.metadata, this.hooks);
-        this.tokenManager = new token_manager_js_1.TokenManager(tokenStore, this.lexiconManager, this.signer, this.hooks, this.accessTokenMode, tokenMaxAge);
+        this.accountManager = new AccountManager(this.issuer, accountStore, this.hooks, this.customization);
+        this.clientManager = new ClientManager(this.metadata, this.keyset, this.hooks, clientStore || null, loopbackMetadata || null, safeFetch, clientJwksCache, clientMetadataCache);
+        this.lexiconManager = new LexiconManager(lexiconStore, lexResolver);
+        this.requestManager = new RequestManager(requestStore, this.lexiconManager, this.signer, this.metadata, this.hooks);
+        this.tokenManager = new TokenManager(tokenStore, this.lexiconManager, this.signer, this.hooks, this.accessTokenMode, tokenMaxAge);
     }
     get jwks() {
         return this.keyset.publicJwks;
@@ -130,10 +114,10 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         if (client.metadata.dpop_bound_access_tokens &&
             !dpopProof &&
             !options?.allowMissingDpopProof) {
-            throw new invalid_dpop_proof_error_js_1.InvalidDpopProofError('DPoP proof required');
+            throw new InvalidDpopProofError('DPoP proof required');
         }
         if (dpopProof && !client.metadata.dpop_bound_access_tokens) {
-            throw new invalid_dpop_proof_error_js_1.InvalidDpopProofError('DPoP proof not allowed for this client');
+            throw new InvalidDpopProofError('DPoP proof not allowed for this client');
         }
         const clientAuth = await client.authenticate(clientCredentials, {
             authorizationServerIdentifier: this.issuer,
@@ -141,7 +125,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         if (clientAuth.method === 'private_key_jwt') {
             // Clients MUST NOT use their client assertion key to sign DPoP proofs
             if (dpopProof && clientAuth.jkt === dpopProof.jkt) {
-                throw new invalid_request_error_js_1.InvalidRequestError('The DPoP proof must be signed with a different key than the client assertion');
+                throw new InvalidRequestError('The DPoP proof must be signed with a different key than the client assertion');
             }
             // https://www.rfc-editor.org/rfc/rfc7523.html#section-3
             // > 7.  [...] The authorization server MAY ensure that JWTs are not
@@ -150,7 +134,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             // >     on the applicable "exp" instant.
             const unique = await this.replayManager.uniqueAuth(clientAuth.jti, client.id, clientAuth.exp);
             if (!unique) {
-                throw new invalid_grant_error_js_1.InvalidGrantError(`${clientAuth.method} jti reused`);
+                throw new InvalidGrantError(`${clientAuth.method} jti reused`);
             }
         }
         return { client, clientAuth };
@@ -159,16 +143,16 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         const { payload } = await client.decodeRequestObject(input.request, this.issuer);
         const { jti } = payload;
         if (!jti) {
-            throw new invalid_request_error_js_1.InvalidRequestError('Request object payload must contain a "jti" claim');
+            throw new InvalidRequestError('Request object payload must contain a "jti" claim');
         }
         if (!(await this.replayManager.uniqueJar(jti, client.id))) {
-            throw new invalid_request_error_js_1.InvalidRequestError('Request object was replayed');
+            throw new InvalidRequestError('Request object was replayed');
         }
-        const parameters = await oauth_types_1.oauthAuthorizationRequestParametersSchema
+        const parameters = await oauthAuthorizationRequestParametersSchema
             .parseAsync(payload)
             .catch((err) => {
-            const msg = (0, error_js_1.formatError)(err, 'Invalid parameters in JAR');
-            throw new invalid_request_error_js_1.InvalidRequestError(msg, err);
+            const msg = formatError(err, 'Invalid parameters in JAR');
+            throw new InvalidRequestError(msg, err);
         });
         return parameters;
     }
@@ -199,18 +183,18 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             }
             else {
                 if (!client.metadata.dpop_bound_access_tokens) {
-                    throw new invalid_request_error_js_1.InvalidRequestError('DPoP bound access tokens are not enabled for this client');
+                    throw new InvalidRequestError('DPoP bound access tokens are not enabled for this client');
                 }
                 // Proof is optional if the dpop_jkt is provided, but if it is provided,
                 // it must match the DPoP proof JKT.
                 if (dpopProof && dpopProof.jkt !== parameters.dpop_jkt) {
-                    throw new invalid_dpop_key_binding_error_js_1.InvalidDpopKeyBindingError();
+                    throw new InvalidDpopKeyBindingError();
                 }
             }
             const { requestUri, expiresAt } = await this.requestManager.createAuthorizationRequest(client, clientAuth, parameters, null);
             return {
                 request_uri: requestUri,
-                expires_in: (0, date_js_1.dateToRelativeSeconds)(expiresAt),
+                expires_in: dateToRelativeSeconds(expiresAt),
             };
         }
         catch (err) {
@@ -218,8 +202,8 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             // > Since initial processing of the pushed authorization request does not
             // > involve resource owner interaction, error codes related to user
             // > interaction, such as "access_denied", are never returned.
-            if (err instanceof authorization_error_js_1.AuthorizationError && !(0, par_response_error_js_1.isPARResponseError)(err.error)) {
-                throw new invalid_request_error_js_1.InvalidRequestError(err.error_description, err);
+            if (err instanceof AuthorizationError && !isPARResponseError(err.error)) {
+                throw new InvalidRequestError(err.error_description, err);
             }
             throw err;
         }
@@ -227,7 +211,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
     async processAuthorizationRequest(client, deviceId, query) {
         // PAR
         if ('request_uri' in query) {
-            const requestUri = (0, request_uri_js_1.parseRequestUri)(query.request_uri, {
+            const requestUri = parseRequestUri(query.request_uri, {
                 path: ['query', 'request_uri'],
             });
             return this.requestManager.get(requestUri, deviceId, client.id);
@@ -261,7 +245,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         const throwAuthorizationError = 'redirect_uri' in query
             ? (err) => {
                 // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-4.1.2.1
-                throw authorization_error_js_1.AuthorizationError.from(query, err);
+                throw AuthorizationError.from(query, err);
             }
             : null;
         const client = await this.clientManager
@@ -287,7 +271,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             // > selection choice made by the End-User, it MUST return an error,
             // > typically account_selection_required.
             if (parameters.prompt === 'select_account' && !sessions.length) {
-                throw new account_selection_required_error_js_1.AccountSelectionRequiredError(parameters);
+                throw new AccountSelectionRequiredError(parameters);
             }
             // prompt=none
             //
@@ -302,17 +286,17 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             if (parameters.prompt === 'none') {
                 const ssoSessions = sessions.filter(matchesHint, parameters);
                 if (ssoSessions.length > 1) {
-                    throw new account_selection_required_error_js_1.AccountSelectionRequiredError(parameters);
+                    throw new AccountSelectionRequiredError(parameters);
                 }
                 if (ssoSessions.length < 1) {
-                    throw new login_required_error_js_1.LoginRequiredError(parameters);
+                    throw new LoginRequiredError(parameters);
                 }
                 const ssoSession = ssoSessions[0];
                 if (ssoSession.loginRequired) {
-                    throw new login_required_error_js_1.LoginRequiredError(parameters);
+                    throw new LoginRequiredError(parameters);
                 }
                 if (ssoSession.consentRequired) {
-                    throw new consent_required_error_js_1.ConsentRequiredError(parameters);
+                    throw new ConsentRequiredError(parameters);
                 }
                 const code = await this.requestManager.setAuthorized(requestUri, client, ssoSession.account, deviceId, deviceMetadata);
                 return { issuer, parameters, redirect: { code } };
@@ -342,7 +326,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                 permissionSets: await this.lexiconManager
                     .getPermissionSetsFromScope(parameters.scope)
                     .catch((cause) => {
-                    throw new authorization_error_js_1.AuthorizationError(parameters, 'Unable to retrieve permission sets', 'invalid_scope', cause);
+                    throw new AuthorizationError(parameters, 'Unable to retrieve permission sets', 'invalid_scope', cause);
                 }),
             };
         }
@@ -356,16 +340,16 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                 // @TODO Maybe move this entire code to the /authorize endpoint
                 // (allowing to log this error)
             }
-            throw authorization_error_js_1.AuthorizationError.from(parameters, err);
+            throw AuthorizationError.from(parameters, err);
         }
     }
     async token(clientCredentials, clientMetadata, request, dpopProof) {
         const { client, clientAuth } = await this.authenticateClient(clientCredentials, dpopProof);
         if (!this.metadata.grant_types_supported?.includes(request.grant_type)) {
-            throw new invalid_grant_error_js_1.InvalidGrantError(`Grant type "${request.grant_type}" is not supported by the server`);
+            throw new InvalidGrantError(`Grant type "${request.grant_type}" is not supported by the server`);
         }
         if (!client.metadata.grant_types.includes(request.grant_type)) {
-            throw new invalid_grant_error_js_1.InvalidGrantError(`"${request.grant_type}" grant type is not allowed for this client`);
+            throw new InvalidGrantError(`"${request.grant_type}" grant type is not allowed for this client`);
         }
         if (request.grant_type === 'authorization_code') {
             return this.authorizationCodeGrant(client, clientAuth, clientMetadata, request, dpopProof);
@@ -373,23 +357,23 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         if (request.grant_type === 'refresh_token') {
             return this.refreshTokenGrant(client, clientAuth, clientMetadata, request, dpopProof);
         }
-        throw new invalid_grant_error_js_1.InvalidGrantError(`Grant type "${request.grant_type}" not supported`);
+        throw new InvalidGrantError(`Grant type "${request.grant_type}" not supported`);
     }
     async compareClientAuth(client, clientAuth, dpopProof, initial) {
         // Fool proofing, ensure that the client is authenticating using the right method
         if (clientAuth.method !== client.metadata.token_endpoint_auth_method) {
-            throw new invalid_grant_error_js_1.InvalidGrantError(`Client authentication method mismatch (expected ${client.metadata.token_endpoint_auth_method}, got ${clientAuth.method})`);
+            throw new InvalidGrantError(`Client authentication method mismatch (expected ${client.metadata.token_endpoint_auth_method}, got ${clientAuth.method})`);
         }
         if (initial.clientId !== client.id) {
-            throw new invalid_grant_error_js_1.InvalidGrantError(`Token was not issued to this client`);
+            throw new InvalidGrantError(`Token was not issued to this client`);
         }
         const { parameters } = initial;
         if (parameters.dpop_jkt) {
             if (!dpopProof) {
-                throw new invalid_grant_error_js_1.InvalidGrantError(`DPoP proof is required for this request`);
+                throw new InvalidGrantError(`DPoP proof is required for this request`);
             }
             else if (parameters.dpop_jkt !== dpopProof.jkt) {
-                throw new invalid_grant_error_js_1.InvalidGrantError(`DPoP proof does not match the expected JKT`);
+                throw new InvalidGrantError(`DPoP proof does not match the expected JKT`);
             }
         }
         if (!initial.clientAuth) {
@@ -402,15 +386,15 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             return;
         }
         switch (initial.clientAuth.method) {
-            case oauth_types_1.CLIENT_ASSERTION_TYPE_JWT_BEARER: // LEGACY
+            case CLIENT_ASSERTION_TYPE_JWT_BEARER: // LEGACY
             case 'private_key_jwt':
                 if (clientAuth.method !== 'private_key_jwt') {
-                    throw new invalid_grant_error_js_1.InvalidGrantError(`Client authentication method mismatch (expected ${initial.clientAuth.method})`);
+                    throw new InvalidGrantError(`Client authentication method mismatch (expected ${initial.clientAuth.method})`);
                 }
                 if (clientAuth.kid !== initial.clientAuth.kid ||
                     clientAuth.alg !== initial.clientAuth.alg ||
                     clientAuth.jkt !== initial.clientAuth.jkt) {
-                    throw new invalid_grant_error_js_1.InvalidGrantError(`The session was initiated with a different key than the client assertion currently used`);
+                    throw new InvalidGrantError(`The session was initiated with a different key than the client assertion currently used`);
                 }
                 break;
             case 'none':
@@ -418,17 +402,17 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                 // the session was initially created without client authentication.
                 break;
             default:
-                throw new invalid_grant_error_js_1.InvalidGrantError(
+                throw new InvalidGrantError(
                 // @ts-expect-error (future proof, backwards compatibility)
                 `Invalid method "${initial.clientAuth.method}"`);
         }
     }
     async authorizationCodeGrant(client, clientAuth, clientMetadata, input, dpopProof) {
-        const code = await code_js_1.codeSchema
+        const code = await codeSchema
             .parseAsync(input.code, { path: ['code'] })
             .catch((err) => {
-            const msg = (0, error_js_1.formatError)(err, 'Invalid code');
-            throw new invalid_grant_error_js_1.InvalidGrantError(msg, err);
+            const msg = formatError(err, 'Invalid code');
+            throw new InvalidGrantError(msg, err);
         });
         const data = await this.requestManager
             .consumeCode(code)
@@ -451,7 +435,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                     }
                 }
             }
-            throw invalid_grant_error_js_1.InvalidGrantError.from(err, `Invalid code`);
+            throw InvalidGrantError.from(err, `Invalid code`);
         });
         // @NOTE at this point, the request data was removed from the store and only
         // exists in memory here (in the "data" variable). Because of this, any
@@ -471,29 +455,29 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
     }
     async validateCodeGrant(parameters, input) {
         if (parameters.redirect_uri !== input.redirect_uri) {
-            throw new invalid_grant_error_js_1.InvalidGrantError('The redirect_uri parameter must match the one used in the authorization request');
+            throw new InvalidGrantError('The redirect_uri parameter must match the one used in the authorization request');
         }
         if (parameters.code_challenge) {
             if (!input.code_verifier) {
-                throw new invalid_grant_error_js_1.InvalidGrantError('code_verifier is required');
+                throw new InvalidGrantError('code_verifier is required');
             }
             if (input.code_verifier.length < 43) {
-                throw new invalid_grant_error_js_1.InvalidGrantError('code_verifier too short');
+                throw new InvalidGrantError('code_verifier too short');
             }
             switch (parameters.code_challenge_method) {
                 case undefined: // default is "plain"
                 case 'plain':
                     if (parameters.code_challenge !== input.code_verifier) {
-                        throw new invalid_grant_error_js_1.InvalidGrantError('Invalid code_verifier');
+                        throw new InvalidGrantError('Invalid code_verifier');
                     }
                     break;
                 case 'S256': {
                     const inputChallenge = Buffer.from(parameters.code_challenge, 'base64');
-                    const computedChallenge = (0, node_crypto_1.createHash)('sha256')
+                    const computedChallenge = createHash('sha256')
                         .update(input.code_verifier)
                         .digest();
                     if (inputChallenge.compare(computedChallenge) !== 0) {
-                        throw new invalid_grant_error_js_1.InvalidGrantError('Invalid code_verifier');
+                        throw new InvalidGrantError('Invalid code_verifier');
                     }
                     break;
                 }
@@ -503,19 +487,19 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             }
             const unique = await this.replayManager.uniqueCodeChallenge(parameters.code_challenge);
             if (!unique) {
-                throw new invalid_grant_error_js_1.InvalidGrantError('Code challenge already used');
+                throw new InvalidGrantError('Code challenge already used');
             }
         }
         else if (input.code_verifier !== undefined) {
-            throw new invalid_request_error_js_1.InvalidRequestError("code_challenge parameter wasn't provided");
+            throw new InvalidRequestError("code_challenge parameter wasn't provided");
         }
     }
     async refreshTokenGrant(client, clientAuth, clientMetadata, input, dpopProof) {
-        const refreshToken = await token_store_js_1.refreshTokenSchema
+        const refreshToken = await refreshTokenSchema
             .parseAsync(input.refresh_token, { path: ['refresh_token'] })
             .catch((err) => {
-            const msg = (0, error_js_1.formatError)(err, 'Invalid refresh token');
-            throw new invalid_grant_error_js_1.InvalidGrantError(msg, err);
+            const msg = formatError(err, 'Invalid refresh token');
+            throw new InvalidGrantError(msg, err);
         });
         const tokenInfo = await this.tokenManager.consumeRefreshToken(refreshToken);
         try {
@@ -532,17 +516,17 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
     async validateRefreshGrant(client, clientAuth, data) {
         const [sessionLifetime, refreshLifetime] = clientAuth.method !== 'none' || client.info.isFirstParty
             ? [
-                constants_js_1.CONFIDENTIAL_CLIENT_SESSION_LIFETIME,
-                constants_js_1.CONFIDENTIAL_CLIENT_REFRESH_LIFETIME,
+                CONFIDENTIAL_CLIENT_SESSION_LIFETIME,
+                CONFIDENTIAL_CLIENT_REFRESH_LIFETIME,
             ]
-            : [constants_js_1.PUBLIC_CLIENT_SESSION_LIFETIME, constants_js_1.PUBLIC_CLIENT_REFRESH_LIFETIME];
+            : [PUBLIC_CLIENT_SESSION_LIFETIME, PUBLIC_CLIENT_REFRESH_LIFETIME];
         const sessionAge = Date.now() - data.createdAt.getTime();
         if (sessionAge > sessionLifetime) {
-            throw new invalid_grant_error_js_1.InvalidGrantError(`Session expired`);
+            throw new InvalidGrantError(`Session expired`);
         }
         const refreshAge = Date.now() - data.updatedAt.getTime();
         if (refreshAge > refreshLifetime) {
-            throw new invalid_grant_error_js_1.InvalidGrantError(`Refresh token expired`);
+            throw new InvalidGrantError(`Refresh token expired`);
         }
     }
     /**
@@ -566,7 +550,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
     }
     async decodeToken(tokenType, token, dpopProof) {
         const tokenPayload = await super.decodeToken(tokenType, token, dpopProof);
-        if (this.accessTokenMode !== access_token_mode_js_1.AccessTokenMode.stateless) {
+        if (this.accessTokenMode !== AccessTokenMode.stateless) {
             // @NOTE in non stateless mode, some claims can be omitted (most notably
             // "scope"). We load the token claims here (allowing to ensure that the
             // token is still valid, and to retrieve a (potentially updated) set of
@@ -577,7 +561,6 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         return tokenPayload;
     }
 }
-exports.OAuthProvider = OAuthProvider;
 function matchesHint({ account }) {
     const hint = this.login_hint;
     if (!hint)