@atproto/oauth-provider 0.16.5 → 0.17.0

package/dist/dpop/dpop-nonce.js

@@ -1,29 +1,26 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DpopNonce = exports.dpopSecretSchema = exports.secretHexSchema = exports.secretBytesSchema = exports.rotationIntervalSchema = void 0;
-const node_crypto_1 = require("node:crypto");
-const zod_1 = require("zod");
-const constants_js_1 = require("../constants.js");
-const MAX_ROTATION_INTERVAL = constants_js_1.DPOP_NONCE_MAX_AGE / 3;
+import { createHmac, randomBytes } from 'node:crypto';
+import { z } from 'zod';
+import { DPOP_NONCE_MAX_AGE } from '../constants.js';
+const MAX_ROTATION_INTERVAL = DPOP_NONCE_MAX_AGE / 3;
 const MIN_ROTATION_INTERVAL = Math.min(1000, MAX_ROTATION_INTERVAL);
-exports.rotationIntervalSchema = zod_1.z
+export const rotationIntervalSchema = z
     .number()
     .int()
     .min(MIN_ROTATION_INTERVAL)
     .max(MAX_ROTATION_INTERVAL);
 const SECRET_BYTE_LENGTH = 32;
-exports.secretBytesSchema = zod_1.z
-    .instanceof(Uint8Array)
+export const secretBytesSchema = z
+    .instanceof((Uint8Array))
     .refine((secret) => secret.length === SECRET_BYTE_LENGTH, {
     message: `Secret must be exactly ${SECRET_BYTE_LENGTH} bytes long`,
 });
-exports.secretHexSchema = zod_1.z
+export const secretHexSchema = z
     .string()
     .regex(/^[0-9a-f]+$/i, `Secret must be a ${SECRET_BYTE_LENGTH * 2} chars hex string`)
     .length(SECRET_BYTE_LENGTH * 2)
     .transform((hex) => Buffer.from(hex, 'hex'));
-exports.dpopSecretSchema = zod_1.z.union([exports.secretBytesSchema, exports.secretHexSchema]);
-class DpopNonce {
+export const dpopSecretSchema = z.union([secretBytesSchema, secretHexSchema]);
+export class DpopNonce {
     #rotationInterval;
     #secret;
     // Nonce state
@@ -31,9 +28,9 @@ class DpopNonce {
     #prev;
     #now;
     #next;
-    constructor(secret = (0, node_crypto_1.randomBytes)(SECRET_BYTE_LENGTH), rotationInterval = MAX_ROTATION_INTERVAL) {
-        this.#rotationInterval = exports.rotationIntervalSchema.parse(rotationInterval);
-        this.#secret = Uint8Array.from(exports.dpopSecretSchema.parse(secret));
+    constructor(secret = randomBytes(SECRET_BYTE_LENGTH), rotationInterval = MAX_ROTATION_INTERVAL) {
+        this.#rotationInterval = rotationIntervalSchema.parse(rotationInterval);
+        this.#secret = Uint8Array.from(dpopSecretSchema.parse(secret));
         this.#counter = this.currentCounter;
         this.#prev = this.compute(this.#counter - 1);
         this.#now = this.compute(this.#counter);
@@ -73,7 +70,7 @@ class DpopNonce {
         this.#counter = counter;
     }
     compute(counter) {
-        return (0, node_crypto_1.createHmac)('sha256', this.#secret)
+        return createHmac('sha256', this.#secret)
             .update(numTo64bits(counter))
             .digest()
             .toString('base64url');
@@ -86,7 +83,6 @@ class DpopNonce {
         return this.#next === nonce || this.#now === nonce || this.#prev === nonce;
     }
 }
-exports.DpopNonce = DpopNonce;
 function numTo64bits(num) {
     const arr = new Uint8Array(8);
     // @NOTE Assigning to an uint8 will only keep the last 8 int bits

package/dist/dpop/dpop-nonce.js.map

@@ -1 +1 @@
-{"version":3,"file":"dpop-nonce.js","sourceRoot":"","sources":["../../src/dpop/dpop-nonce.ts"],"names":[],"mappings":";;;AAAA,6CAAqD;AACrD,6BAAuB;AACvB,kDAAoD;AAEpD,MAAM,qBAAqB,GAAG,iCAAkB,GAAG,CAAC,CAAA;AACpD,MAAM,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;AAEtD,QAAA,sBAAsB,GAAG,OAAC;KACpC,MAAM,EAAE;KACR,GAAG,EAAE;KACL,GAAG,CAAC,qBAAqB,CAAC;KAC1B,GAAG,CAAC,qBAAqB,CAAC,CAAA;AAE7B,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAEhB,QAAA,iBAAiB,GAAG,OAAC;KAC/B,UAAU,CAAC,UAAU,CAAC;KACtB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,kBAAkB,EAAE;IACxD,OAAO,EAAE,0BAA0B,kBAAkB,aAAa;CACnE,CAAC,CAAA;AAES,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,EAAE;KACR,KAAK,CACJ,cAAc,EACd,oBAAoB,kBAAkB,GAAG,CAAC,mBAAmB,CAC9D;KACA,MAAM,CAAC,kBAAkB,GAAG,CAAC,CAAC;KAC9B,SAAS,CAAC,CAAC,GAAG,EAAc,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;AAE7C,QAAA,gBAAgB,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,yBAAiB,EAAE,uBAAe,CAAC,CAAC,CAAA;AAG7E,MAAa,SAAS;IACX,iBAAiB,CAAQ;IACzB,OAAO,CAAY;IAE5B,cAAc;IACd,QAAQ,CAAQ;IAChB,KAAK,CAAQ;IACb,IAAI,CAAQ;IACZ,KAAK,CAAQ;IAEb,YACE,SAAqB,IAAA,yBAAW,EAAC,kBAAkB,CAAC,EACpD,gBAAgB,GAAG,qBAAqB;QAExC,IAAI,CAAC,iBAAiB,GAAG,8BAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QACvE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,wBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QAE9D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAA;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;IAC9C,CAAC;IAED;;OAEG;IACH,IAAc,cAAc;QAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAClD,CAAC;IAES,MAAM;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAA;QACnC,QAAQ,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChC,KAAK,CAAC;gBACJ,6CAA6C;gBAC7C,OAAM;YACR,KAAK,CAAC;gBACJ,+CAA+C;gBAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAA;gBACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAA;gBACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;gBACtC,MAAK;YACP,KAAK,CAAC;gBACJ,wCAAwC;gBACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;gBACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;gBACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;gBACtC,MAAK;YACP;gBACE,uDAAuD;gBACvD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;gBACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;gBACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;gBACtC,MAAK;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;IACzB,CAAC;IAES,OAAO,CAAC,OAAe;QAC/B,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;aACtC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;aAC5B,MAAM,EAAE;aACR,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC1B,CAAC;IAEM,IAAI;QACT,IAAI,CAAC,MAAM,EAAE,CAAA;QACb,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAEM,KAAK,CAAC,KAAa;QACxB,OAAO,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAA;IAC5E,CAAC;CACF;AAzED,8BAyEC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,iEAAiE;IACjE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;IACjB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;IAClB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;IAClB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;IAClB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;IAClB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;IAClB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;IAClB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;IAClB,OAAO,GAAG,CAAA;AACZ,CAAC","sourcesContent":["import { createHmac, randomBytes } from 'node:crypto'\nimport { z } from 'zod'\nimport { DPOP_NONCE_MAX_AGE } from '../constants.js'\n\nconst MAX_ROTATION_INTERVAL = DPOP_NONCE_MAX_AGE / 3\nconst MIN_ROTATION_INTERVAL = Math.min(1000, MAX_ROTATION_INTERVAL)\n\nexport const rotationIntervalSchema = z\n  .number()\n  .int()\n  .min(MIN_ROTATION_INTERVAL)\n  .max(MAX_ROTATION_INTERVAL)\n\nconst SECRET_BYTE_LENGTH = 32\n\nexport const secretBytesSchema = z\n  .instanceof(Uint8Array)\n  .refine((secret) => secret.length === SECRET_BYTE_LENGTH, {\n    message: `Secret must be exactly ${SECRET_BYTE_LENGTH} bytes long`,\n  })\n\nexport const secretHexSchema = z\n  .string()\n  .regex(\n    /^[0-9a-f]+$/i,\n    `Secret must be a ${SECRET_BYTE_LENGTH * 2} chars hex string`,\n  )\n  .length(SECRET_BYTE_LENGTH * 2)\n  .transform((hex): Uint8Array => Buffer.from(hex, 'hex'))\n\nexport const dpopSecretSchema = z.union([secretBytesSchema, secretHexSchema])\nexport type DpopSecret = z.input<typeof dpopSecretSchema>\n\nexport class DpopNonce {\n  readonly #rotationInterval: number\n  readonly #secret: Uint8Array\n\n  // Nonce state\n  #counter: number\n  #prev: string\n  #now: string\n  #next: string\n\n  constructor(\n    secret: DpopSecret = randomBytes(SECRET_BYTE_LENGTH),\n    rotationInterval = MAX_ROTATION_INTERVAL,\n  ) {\n    this.#rotationInterval = rotationIntervalSchema.parse(rotationInterval)\n    this.#secret = Uint8Array.from(dpopSecretSchema.parse(secret))\n\n    this.#counter = this.currentCounter\n    this.#prev = this.compute(this.#counter - 1)\n    this.#now = this.compute(this.#counter)\n    this.#next = this.compute(this.#counter + 1)\n  }\n\n  /**\n   * Returns the number of full rotations since the epoch\n   */\n  protected get currentCounter() {\n    return (Date.now() / this.#rotationInterval) | 0\n  }\n\n  protected rotate() {\n    const counter = this.currentCounter\n    switch (counter - this.#counter) {\n      case 0:\n        // counter === this.#counter => nothing to do\n        return\n      case 1:\n        // Optimization: avoid recomputing #prev & #now\n        this.#prev = this.#now\n        this.#now = this.#next\n        this.#next = this.compute(counter + 1)\n        break\n      case 2:\n        // Optimization: avoid recomputing #prev\n        this.#prev = this.#next\n        this.#now = this.compute(counter)\n        this.#next = this.compute(counter + 1)\n        break\n      default:\n        // All nonces are outdated, so we recompute all of them\n        this.#prev = this.compute(counter - 1)\n        this.#now = this.compute(counter)\n        this.#next = this.compute(counter + 1)\n        break\n    }\n    this.#counter = counter\n  }\n\n  protected compute(counter: number) {\n    return createHmac('sha256', this.#secret)\n      .update(numTo64bits(counter))\n      .digest()\n      .toString('base64url')\n  }\n\n  public next() {\n    this.rotate()\n    return this.#next\n  }\n\n  public check(nonce: string) {\n    return this.#next === nonce || this.#now === nonce || this.#prev === nonce\n  }\n}\n\nfunction numTo64bits(num: number) {\n  const arr = new Uint8Array(8)\n  // @NOTE Assigning to an uint8 will only keep the last 8 int bits\n  arr[7] = num |= 0\n  arr[6] = num >>= 8\n  arr[5] = num >>= 8\n  arr[4] = num >>= 8\n  arr[3] = num >>= 8\n  arr[2] = num >>= 8\n  arr[1] = num >>= 8\n  arr[0] = num >>= 8\n  return arr\n}\n"]}
+{"version":3,"file":"dpop-nonce.js","sourceRoot":"","sources":["../../src/dpop/dpop-nonce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAEpD,MAAM,qBAAqB,GAAG,kBAAkB,GAAG,CAAC,CAAA;AACpD,MAAM,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;AAEnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,GAAG,EAAE;KACL,GAAG,CAAC,qBAAqB,CAAC;KAC1B,GAAG,CAAC,qBAAqB,CAAC,CAAA;AAE7B,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAE7B,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,UAAU,CAAC,CAAA,UAA2B,CAAA,CAAC;KACvC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,kBAAkB,EAAE;IACxD,OAAO,EAAE,0BAA0B,kBAAkB,aAAa;CACnE,CAAC,CAAA;AAEJ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,KAAK,CACJ,cAAc,EACd,oBAAoB,kBAAkB,GAAG,CAAC,mBAAmB,CAC9D;KACA,MAAM,CAAC,kBAAkB,GAAG,CAAC,CAAC;KAC9B,SAAS,CAAC,CAAC,GAAG,EAAc,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;AAE1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC,CAAA;AAG7E,MAAM,OAAO,SAAS;IACX,iBAAiB,CAAQ;IACzB,OAAO,CAAY;IAE5B,cAAc;IACd,QAAQ,CAAQ;IAChB,KAAK,CAAQ;IACb,IAAI,CAAQ;IACZ,KAAK,CAAQ;IAEb,YACE,SAAqB,WAAW,CAAC,kBAAkB,CAAC,EACpD,gBAAgB,GAAG,qBAAqB;QAExC,IAAI,CAAC,iBAAiB,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QACvE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QAE9D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAA;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;IAC9C,CAAC;IAED;;OAEG;IACH,IAAc,cAAc;QAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAClD,CAAC;IAES,MAAM;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAA;QACnC,QAAQ,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChC,KAAK,CAAC;gBACJ,6CAA6C;gBAC7C,OAAM;YACR,KAAK,CAAC;gBACJ,+CAA+C;gBAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAA;gBACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAA;gBACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;gBACtC,MAAK;YACP,KAAK,CAAC;gBACJ,wCAAwC;gBACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;gBACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;gBACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;gBACtC,MAAK;YACP;gBACE,uDAAuD;gBACvD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;gBACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;gBACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;gBACtC,MAAK;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;IACzB,CAAC;IAES,OAAO,CAAC,OAAe;QAC/B,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;aACtC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;aAC5B,MAAM,EAAE;aACR,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC1B,CAAC;IAEM,IAAI;QACT,IAAI,CAAC,MAAM,EAAE,CAAA;QACb,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAEM,KAAK,CAAC,KAAa;QACxB,OAAO,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAA;IAC5E,CAAC;CACF;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,iEAAiE;IACjE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;IACjB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;IAClB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;IAClB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;IAClB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;IAClB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;IAClB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;IAClB,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAA;IAClB,OAAO,GAAG,CAAA;AACZ,CAAC","sourcesContent":["import { createHmac, randomBytes } from 'node:crypto'\nimport { z } from 'zod'\nimport { DPOP_NONCE_MAX_AGE } from '../constants.js'\n\nconst MAX_ROTATION_INTERVAL = DPOP_NONCE_MAX_AGE / 3\nconst MIN_ROTATION_INTERVAL = Math.min(1000, MAX_ROTATION_INTERVAL)\n\nexport const rotationIntervalSchema = z\n  .number()\n  .int()\n  .min(MIN_ROTATION_INTERVAL)\n  .max(MAX_ROTATION_INTERVAL)\n\nconst SECRET_BYTE_LENGTH = 32\n\nexport const secretBytesSchema = z\n  .instanceof(Uint8Array<ArrayBufferLike>)\n  .refine((secret) => secret.length === SECRET_BYTE_LENGTH, {\n    message: `Secret must be exactly ${SECRET_BYTE_LENGTH} bytes long`,\n  })\n\nexport const secretHexSchema = z\n  .string()\n  .regex(\n    /^[0-9a-f]+$/i,\n    `Secret must be a ${SECRET_BYTE_LENGTH * 2} chars hex string`,\n  )\n  .length(SECRET_BYTE_LENGTH * 2)\n  .transform((hex): Uint8Array => Buffer.from(hex, 'hex'))\n\nexport const dpopSecretSchema = z.union([secretBytesSchema, secretHexSchema])\nexport type DpopSecret = z.input<typeof dpopSecretSchema>\n\nexport class DpopNonce {\n  readonly #rotationInterval: number\n  readonly #secret: Uint8Array\n\n  // Nonce state\n  #counter: number\n  #prev: string\n  #now: string\n  #next: string\n\n  constructor(\n    secret: DpopSecret = randomBytes(SECRET_BYTE_LENGTH),\n    rotationInterval = MAX_ROTATION_INTERVAL,\n  ) {\n    this.#rotationInterval = rotationIntervalSchema.parse(rotationInterval)\n    this.#secret = Uint8Array.from(dpopSecretSchema.parse(secret))\n\n    this.#counter = this.currentCounter\n    this.#prev = this.compute(this.#counter - 1)\n    this.#now = this.compute(this.#counter)\n    this.#next = this.compute(this.#counter + 1)\n  }\n\n  /**\n   * Returns the number of full rotations since the epoch\n   */\n  protected get currentCounter() {\n    return (Date.now() / this.#rotationInterval) | 0\n  }\n\n  protected rotate() {\n    const counter = this.currentCounter\n    switch (counter - this.#counter) {\n      case 0:\n        // counter === this.#counter => nothing to do\n        return\n      case 1:\n        // Optimization: avoid recomputing #prev & #now\n        this.#prev = this.#now\n        this.#now = this.#next\n        this.#next = this.compute(counter + 1)\n        break\n      case 2:\n        // Optimization: avoid recomputing #prev\n        this.#prev = this.#next\n        this.#now = this.compute(counter)\n        this.#next = this.compute(counter + 1)\n        break\n      default:\n        // All nonces are outdated, so we recompute all of them\n        this.#prev = this.compute(counter - 1)\n        this.#now = this.compute(counter)\n        this.#next = this.compute(counter + 1)\n        break\n    }\n    this.#counter = counter\n  }\n\n  protected compute(counter: number) {\n    return createHmac('sha256', this.#secret)\n      .update(numTo64bits(counter))\n      .digest()\n      .toString('base64url')\n  }\n\n  public next() {\n    this.rotate()\n    return this.#next\n  }\n\n  public check(nonce: string) {\n    return this.#next === nonce || this.#now === nonce || this.#prev === nonce\n  }\n}\n\nfunction numTo64bits(num: number) {\n  const arr = new Uint8Array(8)\n  // @NOTE Assigning to an uint8 will only keep the last 8 int bits\n  arr[7] = num |= 0\n  arr[6] = num >>= 8\n  arr[5] = num >>= 8\n  arr[4] = num >>= 8\n  arr[3] = num >>= 8\n  arr[2] = num >>= 8\n  arr[1] = num >>= 8\n  arr[0] = num >>= 8\n  return arr\n}\n"]}

package/dist/dpop/dpop-proof.js

@@ -1,3 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
+export {};
 //# sourceMappingURL=dpop-proof.js.map

package/dist/errors/access-denied-error.js

@@ -1,11 +1,7 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AccessDeniedError = void 0;
-const authorization_error_js_1 = require("./authorization-error.js");
-class AccessDeniedError extends authorization_error_js_1.AuthorizationError {
+import { AuthorizationError } from './authorization-error.js';
+export class AccessDeniedError extends AuthorizationError {
     constructor(parameters, error_description = 'Access denied', cause) {
         super(parameters, error_description, 'access_denied', cause);
     }
 }
-exports.AccessDeniedError = AccessDeniedError;
 //# sourceMappingURL=access-denied-error.js.map

package/dist/errors/access-denied-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-denied-error.js","sourceRoot":"","sources":["../../src/errors/access-denied-error.ts"],"names":[],"mappings":";;;AACA,qEAA6D;AAE7D,MAAa,iBAAkB,SAAQ,2CAAkB;IACvD,YACE,UAA+C,EAC/C,iBAAiB,GAAG,eAAe,EACnC,KAAe;QAEf,KAAK,CAAC,UAAU,EAAE,iBAAiB,EAAE,eAAe,EAAE,KAAK,CAAC,CAAA;IAC9D,CAAC;CACF;AARD,8CAQC","sourcesContent":["import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'\nimport { AuthorizationError } from './authorization-error.js'\n\nexport class AccessDeniedError extends AuthorizationError {\n  constructor(\n    parameters: OAuthAuthorizationRequestParameters,\n    error_description = 'Access denied',\n    cause?: unknown,\n  ) {\n    super(parameters, error_description, 'access_denied', cause)\n  }\n}\n"]}
+{"version":3,"file":"access-denied-error.js","sourceRoot":"","sources":["../../src/errors/access-denied-error.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAE7D,MAAM,OAAO,iBAAkB,SAAQ,kBAAkB;IACvD,YACE,UAA+C,EAC/C,iBAAiB,GAAG,eAAe,EACnC,KAAe;QAEf,KAAK,CAAC,UAAU,EAAE,iBAAiB,EAAE,eAAe,EAAE,KAAK,CAAC,CAAA;IAC9D,CAAC;CACF","sourcesContent":["import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'\nimport { AuthorizationError } from './authorization-error.js'\n\nexport class AccessDeniedError extends AuthorizationError {\n  constructor(\n    parameters: OAuthAuthorizationRequestParameters,\n    error_description = 'Access denied',\n    cause?: unknown,\n  ) {\n    super(parameters, error_description, 'access_denied', cause)\n  }\n}\n"]}

package/dist/errors/account-selection-required-error.js

@@ -1,11 +1,7 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AccountSelectionRequiredError = void 0;
-const authorization_error_js_1 = require("./authorization-error.js");
-class AccountSelectionRequiredError extends authorization_error_js_1.AuthorizationError {
+import { AuthorizationError } from './authorization-error.js';
+export class AccountSelectionRequiredError extends AuthorizationError {
     constructor(parameters, error_description = 'Account selection required', cause) {
         super(parameters, error_description, 'account_selection_required', cause);
     }
 }
-exports.AccountSelectionRequiredError = AccountSelectionRequiredError;
 //# sourceMappingURL=account-selection-required-error.js.map

package/dist/errors/account-selection-required-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-selection-required-error.js","sourceRoot":"","sources":["../../src/errors/account-selection-required-error.ts"],"names":[],"mappings":";;;AACA,qEAA6D;AAE7D,MAAa,6BAA8B,SAAQ,2CAAkB;IACnE,YACE,UAA+C,EAC/C,iBAAiB,GAAG,4BAA4B,EAChD,KAAe;QAEf,KAAK,CAAC,UAAU,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,KAAK,CAAC,CAAA;IAC3E,CAAC;CACF;AARD,sEAQC","sourcesContent":["import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'\nimport { AuthorizationError } from './authorization-error.js'\n\nexport class AccountSelectionRequiredError extends AuthorizationError {\n  constructor(\n    parameters: OAuthAuthorizationRequestParameters,\n    error_description = 'Account selection required',\n    cause?: unknown,\n  ) {\n    super(parameters, error_description, 'account_selection_required', cause)\n  }\n}\n"]}
+{"version":3,"file":"account-selection-required-error.js","sourceRoot":"","sources":["../../src/errors/account-selection-required-error.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAE7D,MAAM,OAAO,6BAA8B,SAAQ,kBAAkB;IACnE,YACE,UAA+C,EAC/C,iBAAiB,GAAG,4BAA4B,EAChD,KAAe;QAEf,KAAK,CAAC,UAAU,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,KAAK,CAAC,CAAA;IAC3E,CAAC;CACF","sourcesContent":["import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'\nimport { AuthorizationError } from './authorization-error.js'\n\nexport class AccountSelectionRequiredError extends AuthorizationError {\n  constructor(\n    parameters: OAuthAuthorizationRequestParameters,\n    error_description = 'Account selection required',\n    cause?: unknown,\n  ) {\n    super(parameters, error_description, 'account_selection_required', cause)\n  }\n}\n"]}

package/dist/errors/authorization-error.js

@@ -1,11 +1,7 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationError = void 0;
-const authorization_response_error_js_1 = require("../types/authorization-response-error.js");
-const error_parser_js_1 = require("./error-parser.js");
-const oauth_error_js_1 = require("./oauth-error.js");
-class AuthorizationError extends oauth_error_js_1.OAuthError {
-    parameters;
+import { isAuthorizationResponseError, } from '../types/authorization-response-error.js';
+import { buildErrorPayload } from './error-parser.js';
+import { OAuthError } from './oauth-error.js';
+export class AuthorizationError extends OAuthError {
     constructor(parameters, error_description, error = 'invalid_request', cause) {
         super(error, error_description, 400, cause);
         this.parameters = parameters;
@@ -13,15 +9,14 @@ class AuthorizationError extends oauth_error_js_1.OAuthError {
     static from(parameters, cause) {
         if (cause instanceof AuthorizationError)
             return cause;
-        const payload = (0, error_parser_js_1.buildErrorPayload)(cause);
-        return new AuthorizationError(parameters, payload.error_description, (0, authorization_response_error_js_1.isAuthorizationResponseError)(payload.error)
+        const payload = buildErrorPayload(cause);
+        return new AuthorizationError(parameters, payload.error_description, isAuthorizationResponseError(payload.error)
             ? payload.error // Propagate "error" derived from the cause
-            : rootCause(cause) instanceof oauth_error_js_1.OAuthError
+            : rootCause(cause) instanceof OAuthError
                 ? 'invalid_request'
                 : 'server_error', cause);
     }
 }
-exports.AuthorizationError = AuthorizationError;
 function rootCause(err) {
     while (err instanceof Error && err.cause != null) {
         err = err.cause;

package/dist/errors/authorization-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-error.js","sourceRoot":"","sources":["../../src/errors/authorization-error.ts"],"names":[],"mappings":";;;AACA,8FAGiD;AACjD,uDAAqD;AACrD,qDAA6C;AAI7C,MAAa,kBAAmB,SAAQ,2BAAU;IAE9B;IADlB,YACkB,UAA+C,EAC/D,iBAAyB,EACzB,QAAoC,iBAAiB,EACrD,KAAe;QAEf,KAAK,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAL3B,eAAU,GAAV,UAAU,CAAqC;IAMjE,CAAC;IAED,MAAM,CAAC,IAAI,CACT,UAA+C,EAC/C,KAAc;QAEd,IAAI,KAAK,YAAY,kBAAkB;YAAE,OAAO,KAAK,CAAA;QACrD,MAAM,OAAO,GAAG,IAAA,mCAAiB,EAAC,KAAK,CAAC,CAAA;QACxC,OAAO,IAAI,kBAAkB,CAC3B,UAAU,EACV,OAAO,CAAC,iBAAiB,EACzB,IAAA,8DAA4B,EAAC,OAAO,CAAC,KAAK,CAAC;YACzC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,2CAA2C;YAC3D,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,2BAAU;gBACtC,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,cAAc,EACpB,KAAK,CACN,CAAA;IACH,CAAC;CACF;AA3BD,gDA2BC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QACjD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAA;IACjB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC","sourcesContent":["import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'\nimport {\n  AuthorizationResponseError,\n  isAuthorizationResponseError,\n} from '../types/authorization-response-error.js'\nimport { buildErrorPayload } from './error-parser.js'\nimport { OAuthError } from './oauth-error.js'\n\nexport type { AuthorizationResponseError, OAuthAuthorizationRequestParameters }\n\nexport class AuthorizationError extends OAuthError {\n  constructor(\n    public readonly parameters: OAuthAuthorizationRequestParameters,\n    error_description: string,\n    error: AuthorizationResponseError = 'invalid_request',\n    cause?: unknown,\n  ) {\n    super(error, error_description, 400, cause)\n  }\n\n  static from(\n    parameters: OAuthAuthorizationRequestParameters,\n    cause: unknown,\n  ): AuthorizationError {\n    if (cause instanceof AuthorizationError) return cause\n    const payload = buildErrorPayload(cause)\n    return new AuthorizationError(\n      parameters,\n      payload.error_description,\n      isAuthorizationResponseError(payload.error)\n        ? payload.error // Propagate \"error\" derived from the cause\n        : rootCause(cause) instanceof OAuthError\n          ? 'invalid_request'\n          : 'server_error',\n      cause,\n    )\n  }\n}\n\nfunction rootCause(err: unknown): unknown {\n  while (err instanceof Error && err.cause != null) {\n    err = err.cause\n  }\n  return err\n}\n"]}
+{"version":3,"file":"authorization-error.js","sourceRoot":"","sources":["../../src/errors/authorization-error.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,4BAA4B,GAC7B,MAAM,0CAA0C,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAI7C,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,YACkB,UAA+C,EAC/D,iBAAyB,EACzB,QAAoC,iBAAiB,EACrD,KAAe;QAEf,KAAK,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAL3B,eAAU,GAAV,UAAU,CAAqC;IAMjE,CAAC;IAED,MAAM,CAAC,IAAI,CACT,UAA+C,EAC/C,KAAc;QAEd,IAAI,KAAK,YAAY,kBAAkB;YAAE,OAAO,KAAK,CAAA;QACrD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;QACxC,OAAO,IAAI,kBAAkB,CAC3B,UAAU,EACV,OAAO,CAAC,iBAAiB,EACzB,4BAA4B,CAAC,OAAO,CAAC,KAAK,CAAC;YACzC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,2CAA2C;YAC3D,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,UAAU;gBACtC,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,cAAc,EACpB,KAAK,CACN,CAAA;IACH,CAAC;CACF;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QACjD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAA;IACjB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC","sourcesContent":["import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'\nimport {\n  AuthorizationResponseError,\n  isAuthorizationResponseError,\n} from '../types/authorization-response-error.js'\nimport { buildErrorPayload } from './error-parser.js'\nimport { OAuthError } from './oauth-error.js'\n\nexport type { AuthorizationResponseError, OAuthAuthorizationRequestParameters }\n\nexport class AuthorizationError extends OAuthError {\n  constructor(\n    public readonly parameters: OAuthAuthorizationRequestParameters,\n    error_description: string,\n    error: AuthorizationResponseError = 'invalid_request',\n    cause?: unknown,\n  ) {\n    super(error, error_description, 400, cause)\n  }\n\n  static from(\n    parameters: OAuthAuthorizationRequestParameters,\n    cause: unknown,\n  ): AuthorizationError {\n    if (cause instanceof AuthorizationError) return cause\n    const payload = buildErrorPayload(cause)\n    return new AuthorizationError(\n      parameters,\n      payload.error_description,\n      isAuthorizationResponseError(payload.error)\n        ? payload.error // Propagate \"error\" derived from the cause\n        : rootCause(cause) instanceof OAuthError\n          ? 'invalid_request'\n          : 'server_error',\n      cause,\n    )\n  }\n}\n\nfunction rootCause(err: unknown): unknown {\n  while (err instanceof Error && err.cause != null) {\n    err = err.cause\n  }\n  return err\n}\n"]}

package/dist/errors/consent-required-error.js

@@ -1,11 +1,7 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConsentRequiredError = void 0;
-const authorization_error_js_1 = require("./authorization-error.js");
-class ConsentRequiredError extends authorization_error_js_1.AuthorizationError {
+import { AuthorizationError } from './authorization-error.js';
+export class ConsentRequiredError extends AuthorizationError {
     constructor(parameters, error_description = 'User consent required', cause) {
         super(parameters, error_description, 'consent_required', cause);
     }
 }
-exports.ConsentRequiredError = ConsentRequiredError;
 //# sourceMappingURL=consent-required-error.js.map

package/dist/errors/consent-required-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"consent-required-error.js","sourceRoot":"","sources":["../../src/errors/consent-required-error.ts"],"names":[],"mappings":";;;AACA,qEAA6D;AAE7D,MAAa,oBAAqB,SAAQ,2CAAkB;IAC1D,YACE,UAA+C,EAC/C,iBAAiB,GAAG,uBAAuB,EAC3C,KAAe;QAEf,KAAK,CAAC,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAA;IACjE,CAAC;CACF;AARD,oDAQC","sourcesContent":["import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'\nimport { AuthorizationError } from './authorization-error.js'\n\nexport class ConsentRequiredError extends AuthorizationError {\n  constructor(\n    parameters: OAuthAuthorizationRequestParameters,\n    error_description = 'User consent required',\n    cause?: unknown,\n  ) {\n    super(parameters, error_description, 'consent_required', cause)\n  }\n}\n"]}
+{"version":3,"file":"consent-required-error.js","sourceRoot":"","sources":["../../src/errors/consent-required-error.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAE7D,MAAM,OAAO,oBAAqB,SAAQ,kBAAkB;IAC1D,YACE,UAA+C,EAC/C,iBAAiB,GAAG,uBAAuB,EAC3C,KAAe;QAEf,KAAK,CAAC,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAA;IACjE,CAAC;CACF","sourcesContent":["import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'\nimport { AuthorizationError } from './authorization-error.js'\n\nexport class ConsentRequiredError extends AuthorizationError {\n  constructor(\n    parameters: OAuthAuthorizationRequestParameters,\n    error_description = 'User consent required',\n    cause?: unknown,\n  ) {\n    super(parameters, error_description, 'consent_required', cause)\n  }\n}\n"]}

package/dist/errors/error-parser.js

@@ -1,23 +1,19 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildErrorStatus = buildErrorStatus;
-exports.buildErrorPayload = buildErrorPayload;
-const jose_1 = require("jose");
-const zod_1 = require("zod");
-const jwk_1 = require("@atproto/jwk");
-const zod_error_js_1 = require("../lib/util/zod-error.js");
-const oauth_error_js_1 = require("./oauth-error.js");
-const { JOSEError } = jose_1.errors;
+import { errors } from 'jose';
+import { ZodError } from 'zod';
+import { JwtVerifyError } from '@atproto/jwk';
+import { formatZodError } from '../lib/util/zod-error.js';
+import { OAuthError } from './oauth-error.js';
+const { JOSEError } = errors;
 const INVALID_REQUEST = 'invalid_request';
 const SERVER_ERROR = 'server_error';
-function buildErrorStatus(error) {
-    if (error instanceof oauth_error_js_1.OAuthError) {
+export function buildErrorStatus(error) {
+    if (error instanceof OAuthError) {
         return error.statusCode;
     }
-    if (error instanceof jwk_1.JwtVerifyError) {
+    if (error instanceof JwtVerifyError) {
         return 400;
     }
-    if (error instanceof zod_1.ZodError) {
+    if (error instanceof ZodError) {
         return 400;
     }
     if (error instanceof JOSEError) {
@@ -41,14 +37,14 @@ function buildErrorStatus(error) {
     }
     return 500;
 }
-function buildErrorPayload(error) {
-    if (error instanceof oauth_error_js_1.OAuthError) {
+export function buildErrorPayload(error) {
+    if (error instanceof OAuthError) {
         return error.toJSON();
     }
-    if (error instanceof zod_1.ZodError) {
+    if (error instanceof ZodError) {
         return {
             error: INVALID_REQUEST,
-            error_description: (0, zod_error_js_1.formatZodError)(error, 'Validation error'),
+            error_description: formatZodError(error, 'Validation error'),
         };
     }
     if (error instanceof JOSEError) {

package/dist/errors/error-parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-parser.js","sourceRoot":"","sources":["../../src/errors/error-parser.ts"],"names":[],"mappings":";;AAWA,4CAwCC;AAOD,8CAqDC;AA/GD,+BAA6B;AAC7B,6BAA8B;AAC9B,sCAA6C;AAC7C,2DAAyD;AACzD,qDAA6C;AAE7C,MAAM,EAAE,SAAS,EAAE,GAAG,aAAM,CAAA;AAE5B,MAAM,eAAe,GAAG,iBAAiB,CAAA;AACzC,MAAM,YAAY,GAAG,cAAc,CAAA;AAEnC,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,YAAY,2BAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,UAAU,CAAA;IACzB,CAAC;IAED,IAAI,KAAK,YAAY,oBAAc,EAAE,CAAC;QACpC,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,IAAI,KAAK,YAAY,cAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAA;IAChC,CAAC;IAED,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,IAAI,CAAA;IACnB,CAAC;IAED,MAAM,MAAM,GAAI,KAAa,EAAE,MAAM,CAAA;IACrC,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG;QACb,MAAM,GAAG,GAAG,EACZ,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAOD,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,YAAY,2BAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,MAAM,EAAE,CAAA;IACvB,CAAC;IAED,IAAI,KAAK,YAAY,cAAQ,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,iBAAiB,EAAE,IAAA,6BAAc,EAAC,KAAK,EAAE,kBAAkB,CAAC;SAC7D,CAAA;IACH,CAAC;IAED,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,iBAAiB,EAAE,KAAK,CAAC,OAAO;SACjC,CAAA;IACH,CAAC;IAED,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,iBAAiB,EAAE,KAAK,CAAC,OAAO;SACjC,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY;YACtE,iBAAiB,EACf,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG;gBAC5B,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC;oBACpC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;oBAC9B,CAAC,CAAC,KAAK,CAAC,OAAO;gBACjB,CAAC,CAAC,cAAc;SACrB,CAAA;IACH,CAAC;IAED,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY;YACzD,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;SACzC,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACtC,OAAO;QACL,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY;QACpD,iBAAiB,EACf,KAAK,YAAY,KAAK,IAAK,KAAa,EAAE,MAAM,KAAK,IAAI;YACvD,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,cAAc;KACrB,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IAIxB,OAAO,CACL,CAAC,YAAY,KAAK;QACjB,CAAS,CAAC,MAAM,KAAK,IAAI;QAC1B,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAC7C,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAI7B,OAAO,CACL,CAAC,YAAY,KAAK;QAClB,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1B,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAC5B,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,CACL,CAAC,IAAI,IAAI;QACT,OAAO,CAAC,KAAK,QAAQ;QACrB,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CACjC,CAAA;AACH,CAAC","sourcesContent":["import { errors } from 'jose'\nimport { ZodError } from 'zod'\nimport { JwtVerifyError } from '@atproto/jwk'\nimport { formatZodError } from '../lib/util/zod-error.js'\nimport { OAuthError } from './oauth-error.js'\n\nconst { JOSEError } = errors\n\nconst INVALID_REQUEST = 'invalid_request'\nconst SERVER_ERROR = 'server_error'\n\nexport function buildErrorStatus(error: unknown): number {\n  if (error instanceof OAuthError) {\n    return error.statusCode\n  }\n\n  if (error instanceof JwtVerifyError) {\n    return 400\n  }\n\n  if (error instanceof ZodError) {\n    return 400\n  }\n\n  if (error instanceof JOSEError) {\n    return 400\n  }\n\n  if (error instanceof TypeError) {\n    return 400\n  }\n\n  if (isBoom(error)) {\n    return error.output.statusCode\n  }\n\n  if (isXrpcError(error)) {\n    return error.type\n  }\n\n  const status = (error as any)?.status\n  if (\n    typeof status === 'number' &&\n    status === (status | 0) &&\n    status >= 400 &&\n    status < 600\n  ) {\n    return status\n  }\n\n  return 500\n}\n\nexport type ErrorPayload = {\n  error: string\n  error_description: string\n}\n\nexport function buildErrorPayload(error: unknown): ErrorPayload {\n  if (error instanceof OAuthError) {\n    return error.toJSON()\n  }\n\n  if (error instanceof ZodError) {\n    return {\n      error: INVALID_REQUEST,\n      error_description: formatZodError(error, 'Validation error'),\n    }\n  }\n\n  if (error instanceof JOSEError) {\n    return {\n      error: INVALID_REQUEST,\n      error_description: error.message,\n    }\n  }\n\n  if (error instanceof TypeError) {\n    return {\n      error: INVALID_REQUEST,\n      error_description: error.message,\n    }\n  }\n\n  if (isBoom(error)) {\n    return {\n      error: error.output.statusCode <= 500 ? INVALID_REQUEST : SERVER_ERROR,\n      error_description:\n        error.output.statusCode <= 500\n          ? isPayloadLike(error.output?.payload)\n            ? error.output.payload.message\n            : error.message\n          : 'Server error',\n    }\n  }\n\n  if (isXrpcError(error)) {\n    return {\n      error: error.type <= 500 ? INVALID_REQUEST : SERVER_ERROR,\n      error_description: error.payload.message,\n    }\n  }\n\n  const status = buildErrorStatus(error)\n  return {\n    error: status < 500 ? INVALID_REQUEST : SERVER_ERROR,\n    error_description:\n      error instanceof Error && (error as any)?.expose === true\n        ? error.message\n        : 'Server error',\n  }\n}\n\nfunction isBoom(v: unknown): v is Error & {\n  isBoom: true\n  output: { statusCode: number; payload: unknown }\n} {\n  return (\n    v instanceof Error &&\n    (v as any).isBoom === true &&\n    isHttpErrorCode(v['output']?.['statusCode'])\n  )\n}\n\nfunction isXrpcError(v: unknown): v is Error & {\n  type: number\n  payload: { error: string; message: string }\n} {\n  return (\n    v instanceof Error &&\n    isHttpErrorCode(v['type']) &&\n    isPayloadLike(v['payload'])\n  )\n}\n\nfunction isHttpErrorCode(v: unknown): v is number {\n  return typeof v === 'number' && v >= 400 && v < 600 && v === (v | 0)\n}\n\nfunction isPayloadLike(v: unknown): v is { error: string; message: string } {\n  return (\n    v != null &&\n    typeof v === 'object' &&\n    typeof v['error'] === 'string' &&\n    typeof v['message'] === 'string'\n  )\n}\n"]}
+{"version":3,"file":"error-parser.js","sourceRoot":"","sources":["../../src/errors/error-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAA;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAA;AAE5B,MAAM,eAAe,GAAG,iBAAiB,CAAA;AACzC,MAAM,YAAY,GAAG,cAAc,CAAA;AAEnC,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,UAAU,CAAA;IACzB,CAAC;IAED,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;QACpC,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAA;IAChC,CAAC;IAED,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,IAAI,CAAA;IACnB,CAAC;IAED,MAAM,MAAM,GAAI,KAAa,EAAE,MAAM,CAAA;IACrC,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG;QACb,MAAM,GAAG,GAAG,EACZ,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAOD,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,MAAM,EAAE,CAAA;IACvB,CAAC;IAED,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,iBAAiB,EAAE,cAAc,CAAC,KAAK,EAAE,kBAAkB,CAAC;SAC7D,CAAA;IACH,CAAC;IAED,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,iBAAiB,EAAE,KAAK,CAAC,OAAO;SACjC,CAAA;IACH,CAAC;IAED,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,iBAAiB,EAAE,KAAK,CAAC,OAAO;SACjC,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY;YACtE,iBAAiB,EACf,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG;gBAC5B,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC;oBACpC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;oBAC9B,CAAC,CAAC,KAAK,CAAC,OAAO;gBACjB,CAAC,CAAC,cAAc;SACrB,CAAA;IACH,CAAC;IAED,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY;YACzD,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;SACzC,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACtC,OAAO;QACL,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY;QACpD,iBAAiB,EACf,KAAK,YAAY,KAAK,IAAK,KAAa,EAAE,MAAM,KAAK,IAAI;YACvD,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,cAAc;KACrB,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IAIxB,OAAO,CACL,CAAC,YAAY,KAAK;QACjB,CAAS,CAAC,MAAM,KAAK,IAAI;QAC1B,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAC7C,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAI7B,OAAO,CACL,CAAC,YAAY,KAAK;QAClB,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1B,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAC5B,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,CACL,CAAC,IAAI,IAAI;QACT,OAAO,CAAC,KAAK,QAAQ;QACrB,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CACjC,CAAA;AACH,CAAC","sourcesContent":["import { errors } from 'jose'\nimport { ZodError } from 'zod'\nimport { JwtVerifyError } from '@atproto/jwk'\nimport { formatZodError } from '../lib/util/zod-error.js'\nimport { OAuthError } from './oauth-error.js'\n\nconst { JOSEError } = errors\n\nconst INVALID_REQUEST = 'invalid_request'\nconst SERVER_ERROR = 'server_error'\n\nexport function buildErrorStatus(error: unknown): number {\n  if (error instanceof OAuthError) {\n    return error.statusCode\n  }\n\n  if (error instanceof JwtVerifyError) {\n    return 400\n  }\n\n  if (error instanceof ZodError) {\n    return 400\n  }\n\n  if (error instanceof JOSEError) {\n    return 400\n  }\n\n  if (error instanceof TypeError) {\n    return 400\n  }\n\n  if (isBoom(error)) {\n    return error.output.statusCode\n  }\n\n  if (isXrpcError(error)) {\n    return error.type\n  }\n\n  const status = (error as any)?.status\n  if (\n    typeof status === 'number' &&\n    status === (status | 0) &&\n    status >= 400 &&\n    status < 600\n  ) {\n    return status\n  }\n\n  return 500\n}\n\nexport type ErrorPayload = {\n  error: string\n  error_description: string\n}\n\nexport function buildErrorPayload(error: unknown): ErrorPayload {\n  if (error instanceof OAuthError) {\n    return error.toJSON()\n  }\n\n  if (error instanceof ZodError) {\n    return {\n      error: INVALID_REQUEST,\n      error_description: formatZodError(error, 'Validation error'),\n    }\n  }\n\n  if (error instanceof JOSEError) {\n    return {\n      error: INVALID_REQUEST,\n      error_description: error.message,\n    }\n  }\n\n  if (error instanceof TypeError) {\n    return {\n      error: INVALID_REQUEST,\n      error_description: error.message,\n    }\n  }\n\n  if (isBoom(error)) {\n    return {\n      error: error.output.statusCode <= 500 ? INVALID_REQUEST : SERVER_ERROR,\n      error_description:\n        error.output.statusCode <= 500\n          ? isPayloadLike(error.output?.payload)\n            ? error.output.payload.message\n            : error.message\n          : 'Server error',\n    }\n  }\n\n  if (isXrpcError(error)) {\n    return {\n      error: error.type <= 500 ? INVALID_REQUEST : SERVER_ERROR,\n      error_description: error.payload.message,\n    }\n  }\n\n  const status = buildErrorStatus(error)\n  return {\n    error: status < 500 ? INVALID_REQUEST : SERVER_ERROR,\n    error_description:\n      error instanceof Error && (error as any)?.expose === true\n        ? error.message\n        : 'Server error',\n  }\n}\n\nfunction isBoom(v: unknown): v is Error & {\n  isBoom: true\n  output: { statusCode: number; payload: unknown }\n} {\n  return (\n    v instanceof Error &&\n    (v as any).isBoom === true &&\n    isHttpErrorCode(v['output']?.['statusCode'])\n  )\n}\n\nfunction isXrpcError(v: unknown): v is Error & {\n  type: number\n  payload: { error: string; message: string }\n} {\n  return (\n    v instanceof Error &&\n    isHttpErrorCode(v['type']) &&\n    isPayloadLike(v['payload'])\n  )\n}\n\nfunction isHttpErrorCode(v: unknown): v is number {\n  return typeof v === 'number' && v >= 400 && v < 600 && v === (v | 0)\n}\n\nfunction isPayloadLike(v: unknown): v is { error: string; message: string } {\n  return (\n    v != null &&\n    typeof v === 'object' &&\n    typeof v['error'] === 'string' &&\n    typeof v['message'] === 'string'\n  )\n}\n"]}

package/dist/errors/handle-unavailable-error.js

@@ -1,9 +1,5 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.HandleUnavailableError = void 0;
-const oauth_error_js_1 = require("./oauth-error.js");
-class HandleUnavailableError extends oauth_error_js_1.OAuthError {
-    reason;
+import { OAuthError } from './oauth-error.js';
+export class HandleUnavailableError extends OAuthError {
     constructor(reason, details = 'That handle is not available', cause) {
         super('handle_unavailable', details, 400, cause);
         this.reason = reason;
@@ -15,5 +11,4 @@ class HandleUnavailableError extends oauth_error_js_1.OAuthError {
         };
     }
 }
-exports.HandleUnavailableError = HandleUnavailableError;
 //# sourceMappingURL=handle-unavailable-error.js.map

package/dist/errors/handle-unavailable-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"handle-unavailable-error.js","sourceRoot":"","sources":["../../src/errors/handle-unavailable-error.ts"],"names":[],"mappings":";;;AAAA,qDAA6C;AAE7C,MAAa,sBAAuB,SAAQ,2BAAU;IAEzC;IADX,YACW,MAA8C,EACvD,UAAkB,8BAA8B,EAChD,KAAe;QAEf,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAJvC,WAAM,GAAN,MAAM,CAAwC;IAKzD,CAAC;IAED,MAAM;QACJ,OAAO;YACL,GAAG,KAAK,CAAC,MAAM,EAAE;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACX,CAAA;IACZ,CAAC;CACF;AAfD,wDAeC","sourcesContent":["import { OAuthError } from './oauth-error.js'\n\nexport class HandleUnavailableError extends OAuthError {\n  constructor(\n    readonly reason: 'syntax' | 'domain' | 'slur' | 'taken',\n    details: string = 'That handle is not available',\n    cause?: unknown,\n  ) {\n    super('handle_unavailable', details, 400, cause)\n  }\n\n  toJSON() {\n    return {\n      ...super.toJSON(),\n      reason: this.reason,\n    } as const\n  }\n}\n"]}
+{"version":3,"file":"handle-unavailable-error.js","sourceRoot":"","sources":["../../src/errors/handle-unavailable-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,MAAM,OAAO,sBAAuB,SAAQ,UAAU;IACpD,YACW,MAA8C,EACvD,UAAkB,8BAA8B,EAChD,KAAe;QAEf,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAJvC,WAAM,GAAN,MAAM,CAAwC;IAKzD,CAAC;IAED,MAAM;QACJ,OAAO;YACL,GAAG,KAAK,CAAC,MAAM,EAAE;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACX,CAAA;IACZ,CAAC;CACF","sourcesContent":["import { OAuthError } from './oauth-error.js'\n\nexport class HandleUnavailableError extends OAuthError {\n  constructor(\n    readonly reason: 'syntax' | 'domain' | 'slur' | 'taken',\n    details: string = 'That handle is not available',\n    cause?: unknown,\n  ) {\n    super('handle_unavailable', details, 400, cause)\n  }\n\n  toJSON() {\n    return {\n      ...super.toJSON(),\n      reason: this.reason,\n    } as const\n  }\n}\n"]}

package/dist/errors/invalid-authorization-details-error.js

@@ -1,7 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InvalidAuthorizationDetailsError = void 0;
-const authorization_error_js_1 = require("./authorization-error.js");
+import { AuthorizationError } from './authorization-error.js';
 /**
  * @see
  * {@link https://datatracker.ietf.org/doc/html/rfc9396#section-14.6 | RFC 9396 - OAuth Dynamic Client Registration Metadata Registration Error}
@@ -17,10 +14,9 @@ const authorization_error_js_1 = require("./authorization-error.js");
  *  - contains fields with invalid values for the authorization details type, or
  *  - is missing required fields for the authorization details type.
  */
-class InvalidAuthorizationDetailsError extends authorization_error_js_1.AuthorizationError {
+export class InvalidAuthorizationDetailsError extends AuthorizationError {
     constructor(parameters, error_description, cause) {
         super(parameters, error_description, 'invalid_authorization_details', cause);
     }
 }
-exports.InvalidAuthorizationDetailsError = InvalidAuthorizationDetailsError;
 //# sourceMappingURL=invalid-authorization-details-error.js.map

package/dist/errors/invalid-authorization-details-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"invalid-authorization-details-error.js","sourceRoot":"","sources":["../../src/errors/invalid-authorization-details-error.ts"],"names":[],"mappings":";;;AACA,qEAA6D;AAE7D;;;;;;;;;;;;;;GAcG;AACH,MAAa,gCAAiC,SAAQ,2CAAkB;IACtE,YACE,UAA+C,EAC/C,iBAAyB,EACzB,KAAe;QAEf,KAAK,CAAC,UAAU,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,KAAK,CAAC,CAAA;IAC9E,CAAC;CACF;AARD,4EAQC","sourcesContent":["import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'\nimport { AuthorizationError } from './authorization-error.js'\n\n/**\n * @see\n * {@link https://datatracker.ietf.org/doc/html/rfc9396#section-14.6 | RFC 9396 - OAuth Dynamic Client Registration Metadata Registration Error}\n *\n * The AS MUST refuse to process any unknown authorization details type or\n * authorization details not conforming to the respective type definition. The\n * AS MUST abort processing and respond with an error\n * invalid_authorization_details to the client if any of the following are true\n * of the objects in the authorization_details structure:\n *  - contains an unknown authorization details type value,\n *  - is an object of known type but containing unknown fields,\n *  - contains fields of the wrong type for the authorization details type,\n *  - contains fields with invalid values for the authorization details type, or\n *  - is missing required fields for the authorization details type.\n */\nexport class InvalidAuthorizationDetailsError extends AuthorizationError {\n  constructor(\n    parameters: OAuthAuthorizationRequestParameters,\n    error_description: string,\n    cause?: unknown,\n  ) {\n    super(parameters, error_description, 'invalid_authorization_details', cause)\n  }\n}\n"]}
+{"version":3,"file":"invalid-authorization-details-error.js","sourceRoot":"","sources":["../../src/errors/invalid-authorization-details-error.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAE7D;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gCAAiC,SAAQ,kBAAkB;IACtE,YACE,UAA+C,EAC/C,iBAAyB,EACzB,KAAe;QAEf,KAAK,CAAC,UAAU,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,KAAK,CAAC,CAAA;IAC9E,CAAC;CACF","sourcesContent":["import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'\nimport { AuthorizationError } from './authorization-error.js'\n\n/**\n * @see\n * {@link https://datatracker.ietf.org/doc/html/rfc9396#section-14.6 | RFC 9396 - OAuth Dynamic Client Registration Metadata Registration Error}\n *\n * The AS MUST refuse to process any unknown authorization details type or\n * authorization details not conforming to the respective type definition. The\n * AS MUST abort processing and respond with an error\n * invalid_authorization_details to the client if any of the following are true\n * of the objects in the authorization_details structure:\n *  - contains an unknown authorization details type value,\n *  - is an object of known type but containing unknown fields,\n *  - contains fields of the wrong type for the authorization details type,\n *  - contains fields with invalid values for the authorization details type, or\n *  - is missing required fields for the authorization details type.\n */\nexport class InvalidAuthorizationDetailsError extends AuthorizationError {\n  constructor(\n    parameters: OAuthAuthorizationRequestParameters,\n    error_description: string,\n    cause?: unknown,\n  ) {\n    super(parameters, error_description, 'invalid_authorization_details', cause)\n  }\n}\n"]}

package/dist/errors/invalid-client-error.js

@@ -1,7 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InvalidClientError = void 0;
-const oauth_error_js_1 = require("./oauth-error.js");
+import { OAuthError } from './oauth-error.js';
 /**
  * @see
  * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token }
@@ -15,10 +12,9 @@ const oauth_error_js_1 = require("./oauth-error.js");
  * the "WWW-Authenticate" response header field matching the authentication
  * scheme used by the client.
  */
-class InvalidClientError extends oauth_error_js_1.OAuthError {
+export class InvalidClientError extends OAuthError {
     constructor(error_description, cause) {
         super('invalid_client', error_description, 400, cause);
     }
 }
-exports.InvalidClientError = InvalidClientError;
 //# sourceMappingURL=invalid-client-error.js.map

package/dist/errors/invalid-client-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"invalid-client-error.js","sourceRoot":"","sources":["../../src/errors/invalid-client-error.ts"],"names":[],"mappings":";;;AAAA,qDAA6C;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAa,kBAAmB,SAAQ,2BAAU;IAChD,YAAY,iBAAyB,EAAE,KAAe;QACpD,KAAK,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACxD,CAAC;CACF;AAJD,gDAIC","sourcesContent":["import { OAuthError } from './oauth-error.js'\n\n/**\n * @see\n * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token }\n *\n * Client authentication failed (e.g., unknown client, no client authentication\n * included, or unsupported authentication method). The authorization server MAY\n * return an HTTP 401 (Unauthorized) status code to indicate which HTTP\n * authentication schemes are supported.  If the client attempted to\n * authenticate via the \"Authorization\" request header field, the authorization\n * server MUST respond with an HTTP 401 (Unauthorized) status code and include\n * the \"WWW-Authenticate\" response header field matching the authentication\n * scheme used by the client.\n */\nexport class InvalidClientError extends OAuthError {\n  constructor(error_description: string, cause?: unknown) {\n    super('invalid_client', error_description, 400, cause)\n  }\n}\n"]}
+{"version":3,"file":"invalid-client-error.js","sourceRoot":"","sources":["../../src/errors/invalid-client-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,YAAY,iBAAyB,EAAE,KAAe;QACpD,KAAK,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACxD,CAAC;CACF","sourcesContent":["import { OAuthError } from './oauth-error.js'\n\n/**\n * @see\n * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token }\n *\n * Client authentication failed (e.g., unknown client, no client authentication\n * included, or unsupported authentication method). The authorization server MAY\n * return an HTTP 401 (Unauthorized) status code to indicate which HTTP\n * authentication schemes are supported.  If the client attempted to\n * authenticate via the \"Authorization\" request header field, the authorization\n * server MUST respond with an HTTP 401 (Unauthorized) status code and include\n * the \"WWW-Authenticate\" response header field matching the authentication\n * scheme used by the client.\n */\nexport class InvalidClientError extends OAuthError {\n  constructor(error_description: string, cause?: unknown) {\n    super('invalid_client', error_description, 400, cause)\n  }\n}\n"]}

package/dist/errors/invalid-client-id-error.js

@@ -1,7 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InvalidClientIdError = void 0;
-const oauth_error_js_1 = require("./oauth-error.js");
+import { OAuthError } from './oauth-error.js';
 /**
  * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591 - Client Registration Error Response}
  *
@@ -9,7 +6,7 @@ const oauth_error_js_1 = require("./oauth-error.js");
  * rejected this request.  Note that an authorization server MAY choose to
  * substitute a valid value for any requested parameter of a client's metadata.
  */
-class InvalidClientIdError extends oauth_error_js_1.OAuthError {
+export class InvalidClientIdError extends OAuthError {
     constructor(error_description, cause) {
         super('invalid_client_id', error_description, 400, cause);
     }
@@ -27,5 +24,4 @@ class InvalidClientIdError extends oauth_error_js_1.OAuthError {
         return new InvalidClientIdError(fallbackMessage, cause);
     }
 }
-exports.InvalidClientIdError = InvalidClientIdError;
 //# sourceMappingURL=invalid-client-id-error.js.map

package/dist/errors/invalid-client-id-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"invalid-client-id-error.js","sourceRoot":"","sources":["../../src/errors/invalid-client-id-error.ts"],"names":[],"mappings":";;;AAAA,qDAA6C;AAE7C;;;;;;GAMG;AACH,MAAa,oBAAqB,SAAQ,2BAAU;IAClD,YAAY,iBAAyB,EAAE,KAAe;QACpD,KAAK,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,CAAC,IAAI,CACT,KAAc,EACd,eAAe,GAAG,2BAA2B;QAE7C,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,oCAAoC;YACpC,OAAO,IAAI,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACvD,CAAC;QACD,OAAO,IAAI,oBAAoB,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;IACzD,CAAC;CACF;AArBD,oDAqBC","sourcesContent":["import { OAuthError } from './oauth-error.js'\n\n/**\n * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591 - Client Registration Error Response}\n *\n * The value of one of the client metadata fields is invalid and the server has\n * rejected this request.  Note that an authorization server MAY choose to\n * substitute a valid value for any requested parameter of a client's metadata.\n */\nexport class InvalidClientIdError extends OAuthError {\n  constructor(error_description: string, cause?: unknown) {\n    super('invalid_client_id', error_description, 400, cause)\n  }\n\n  static from(\n    cause: unknown,\n    fallbackMessage = 'Invalid client identifier',\n  ): InvalidClientIdError {\n    if (cause instanceof InvalidClientIdError) {\n      return cause\n    }\n    if (cause instanceof TypeError) {\n      // This method is meant to be used in the context of parsing & validating\n      // a client client metadata. In that context, a TypeError would more\n      // likely represent a problem with the data (e.g. invalid URL constructor\n      // arg) and not a programming error.\n      return new InvalidClientIdError(cause.message, cause)\n    }\n    return new InvalidClientIdError(fallbackMessage, cause)\n  }\n}\n"]}
+{"version":3,"file":"invalid-client-id-error.js","sourceRoot":"","sources":["../../src/errors/invalid-client-id-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAClD,YAAY,iBAAyB,EAAE,KAAe;QACpD,KAAK,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,CAAC,IAAI,CACT,KAAc,EACd,eAAe,GAAG,2BAA2B;QAE7C,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,oCAAoC;YACpC,OAAO,IAAI,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACvD,CAAC;QACD,OAAO,IAAI,oBAAoB,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;IACzD,CAAC;CACF","sourcesContent":["import { OAuthError } from './oauth-error.js'\n\n/**\n * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591 - Client Registration Error Response}\n *\n * The value of one of the client metadata fields is invalid and the server has\n * rejected this request.  Note that an authorization server MAY choose to\n * substitute a valid value for any requested parameter of a client's metadata.\n */\nexport class InvalidClientIdError extends OAuthError {\n  constructor(error_description: string, cause?: unknown) {\n    super('invalid_client_id', error_description, 400, cause)\n  }\n\n  static from(\n    cause: unknown,\n    fallbackMessage = 'Invalid client identifier',\n  ): InvalidClientIdError {\n    if (cause instanceof InvalidClientIdError) {\n      return cause\n    }\n    if (cause instanceof TypeError) {\n      // This method is meant to be used in the context of parsing & validating\n      // a client client metadata. In that context, a TypeError would more\n      // likely represent a problem with the data (e.g. invalid URL constructor\n      // arg) and not a programming error.\n      return new InvalidClientIdError(cause.message, cause)\n    }\n    return new InvalidClientIdError(fallbackMessage, cause)\n  }\n}\n"]}

package/dist/errors/invalid-client-metadata-error.js

@@ -1,9 +1,6 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InvalidClientMetadataError = void 0;
-const zod_1 = require("zod");
-const fetch_1 = require("@atproto-labs/fetch");
-const oauth_error_js_1 = require("./oauth-error.js");
+import { ZodError } from 'zod';
+import { FetchError } from '@atproto-labs/fetch';
+import { OAuthError } from './oauth-error.js';
 /**
  * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591 - Client Registration Error Response}
  *
@@ -11,18 +8,18 @@ const oauth_error_js_1 = require("./oauth-error.js");
  * rejected this request.  Note that an authorization server MAY choose to
  * substitute a valid value for any requested parameter of a client's metadata.
  */
-class InvalidClientMetadataError extends oauth_error_js_1.OAuthError {
+export class InvalidClientMetadataError extends OAuthError {
     constructor(error_description, cause) {
         super('invalid_client_metadata', error_description, 400, cause);
     }
     static from(cause, message = 'Invalid client metadata') {
-        if (cause instanceof oauth_error_js_1.OAuthError) {
+        if (cause instanceof OAuthError) {
             return cause;
         }
-        if (cause instanceof fetch_1.FetchError) {
+        if (cause instanceof FetchError) {
             throw new InvalidClientMetadataError(cause.expose ? `${message}: ${cause.message}` : message, cause);
         }
-        if (cause instanceof zod_1.ZodError) {
+        if (cause instanceof ZodError) {
             const causeMessage = cause.issues
                 .map(({ path, message }) => `Validation${path.length ? ` of "${path.join('.')}"` : ''} failed with error: ${message}`)
                 .join(' ') || cause.message;
@@ -43,5 +40,4 @@ class InvalidClientMetadataError extends oauth_error_js_1.OAuthError {
         return new InvalidClientMetadataError(message, cause);
     }
 }
-exports.InvalidClientMetadataError = InvalidClientMetadataError;
 //# sourceMappingURL=invalid-client-metadata-error.js.map

package/dist/errors/invalid-client-metadata-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"invalid-client-metadata-error.js","sourceRoot":"","sources":["../../src/errors/invalid-client-metadata-error.ts"],"names":[],"mappings":";;;AAAA,6BAA8B;AAC9B,+CAAgD;AAChD,qDAA6C;AAE7C;;;;;;GAMG;AACH,MAAa,0BAA2B,SAAQ,2BAAU;IACxD,YAAY,iBAAyB,EAAE,KAAe;QACpD,KAAK,CAAC,yBAAyB,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACjE,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,KAAc,EAAE,OAAO,GAAG,yBAAyB;QAC7D,IAAI,KAAK,YAAY,2BAAU,EAAE,CAAC;YAChC,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,KAAK,YAAY,kBAAU,EAAE,CAAC;YAChC,MAAM,IAAI,0BAA0B,CAClC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,EACvD,KAAK,CACN,CAAA;QACH,CAAC;QAED,IAAI,KAAK,YAAY,cAAQ,EAAE,CAAC;YAC9B,MAAM,YAAY,GAChB,KAAK,CAAC,MAAM;iBACT,GAAG,CACF,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CACpB,aAAa,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,uBAAuB,OAAO,EAAE,CAC5F;iBACA,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAA;YAE/B,MAAM,IAAI,0BAA0B,CAClC,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,EACtD,KAAK,CACN,CAAA;QACH,CAAC;QAED,IACE,KAAK,YAAY,KAAK;YACtB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,6BAA6B,EAC5C,CAAC;YACD,MAAM,IAAI,0BAA0B,CAClC,GAAG,OAAO,2BAA2B,EACrC,KAAK,CACN,CAAA;QACH,CAAC;QAED,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,oCAAoC;YACpC,OAAO,IAAI,0BAA0B,CACnC,GAAG,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,EAC9B,KAAK,CACN,CAAA;QACH,CAAC;QAED,OAAO,IAAI,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACvD,CAAC;CACF;AAxDD,gEAwDC","sourcesContent":["import { ZodError } from 'zod'\nimport { FetchError } from '@atproto-labs/fetch'\nimport { OAuthError } from './oauth-error.js'\n\n/**\n * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591 - Client Registration Error Response}\n *\n * The value of one of the client metadata fields is invalid and the server has\n * rejected this request.  Note that an authorization server MAY choose to\n * substitute a valid value for any requested parameter of a client's metadata.\n */\nexport class InvalidClientMetadataError extends OAuthError {\n  constructor(error_description: string, cause?: unknown) {\n    super('invalid_client_metadata', error_description, 400, cause)\n  }\n\n  static from(cause: unknown, message = 'Invalid client metadata'): OAuthError {\n    if (cause instanceof OAuthError) {\n      return cause\n    }\n\n    if (cause instanceof FetchError) {\n      throw new InvalidClientMetadataError(\n        cause.expose ? `${message}: ${cause.message}` : message,\n        cause,\n      )\n    }\n\n    if (cause instanceof ZodError) {\n      const causeMessage =\n        cause.issues\n          .map(\n            ({ path, message }) =>\n              `Validation${path.length ? ` of \"${path.join('.')}\"` : ''} failed with error: ${message}`,\n          )\n          .join(' ') || cause.message\n\n      throw new InvalidClientMetadataError(\n        causeMessage ? `${message}: ${causeMessage}` : message,\n        cause,\n      )\n    }\n\n    if (\n      cause instanceof Error &&\n      'code' in cause &&\n      cause.code === 'DEPTH_ZERO_SELF_SIGNED_CERT'\n    ) {\n      throw new InvalidClientMetadataError(\n        `${message}: Self-signed certificate`,\n        cause,\n      )\n    }\n\n    if (cause instanceof TypeError) {\n      // This method is meant to be used in the context of parsing & validating\n      // a client client metadata. In that context, a TypeError would more\n      // likely represent a problem with the data (e.g. invalid URL constructor\n      // arg) and not a programming error.\n      return new InvalidClientMetadataError(\n        `${message}: ${cause.message}`,\n        cause,\n      )\n    }\n\n    return new InvalidClientMetadataError(message, cause)\n  }\n}\n"]}
+{"version":3,"file":"invalid-client-metadata-error.js","sourceRoot":"","sources":["../../src/errors/invalid-client-metadata-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAA;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;;;;;GAMG;AACH,MAAM,OAAO,0BAA2B,SAAQ,UAAU;IACxD,YAAY,iBAAyB,EAAE,KAAe;QACpD,KAAK,CAAC,yBAAyB,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACjE,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,KAAc,EAAE,OAAO,GAAG,yBAAyB;QAC7D,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;YAChC,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;YAChC,MAAM,IAAI,0BAA0B,CAClC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,EACvD,KAAK,CACN,CAAA;QACH,CAAC;QAED,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,YAAY,GAChB,KAAK,CAAC,MAAM;iBACT,GAAG,CACF,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CACpB,aAAa,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,uBAAuB,OAAO,EAAE,CAC5F;iBACA,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAA;YAE/B,MAAM,IAAI,0BAA0B,CAClC,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,EACtD,KAAK,CACN,CAAA;QACH,CAAC;QAED,IACE,KAAK,YAAY,KAAK;YACtB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,6BAA6B,EAC5C,CAAC;YACD,MAAM,IAAI,0BAA0B,CAClC,GAAG,OAAO,2BAA2B,EACrC,KAAK,CACN,CAAA;QACH,CAAC;QAED,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,oCAAoC;YACpC,OAAO,IAAI,0BAA0B,CACnC,GAAG,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,EAC9B,KAAK,CACN,CAAA;QACH,CAAC;QAED,OAAO,IAAI,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACvD,CAAC;CACF","sourcesContent":["import { ZodError } from 'zod'\nimport { FetchError } from '@atproto-labs/fetch'\nimport { OAuthError } from './oauth-error.js'\n\n/**\n * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591 - Client Registration Error Response}\n *\n * The value of one of the client metadata fields is invalid and the server has\n * rejected this request.  Note that an authorization server MAY choose to\n * substitute a valid value for any requested parameter of a client's metadata.\n */\nexport class InvalidClientMetadataError extends OAuthError {\n  constructor(error_description: string, cause?: unknown) {\n    super('invalid_client_metadata', error_description, 400, cause)\n  }\n\n  static from(cause: unknown, message = 'Invalid client metadata'): OAuthError {\n    if (cause instanceof OAuthError) {\n      return cause\n    }\n\n    if (cause instanceof FetchError) {\n      throw new InvalidClientMetadataError(\n        cause.expose ? `${message}: ${cause.message}` : message,\n        cause,\n      )\n    }\n\n    if (cause instanceof ZodError) {\n      const causeMessage =\n        cause.issues\n          .map(\n            ({ path, message }) =>\n              `Validation${path.length ? ` of \"${path.join('.')}\"` : ''} failed with error: ${message}`,\n          )\n          .join(' ') || cause.message\n\n      throw new InvalidClientMetadataError(\n        causeMessage ? `${message}: ${causeMessage}` : message,\n        cause,\n      )\n    }\n\n    if (\n      cause instanceof Error &&\n      'code' in cause &&\n      cause.code === 'DEPTH_ZERO_SELF_SIGNED_CERT'\n    ) {\n      throw new InvalidClientMetadataError(\n        `${message}: Self-signed certificate`,\n        cause,\n      )\n    }\n\n    if (cause instanceof TypeError) {\n      // This method is meant to be used in the context of parsing & validating\n      // a client client metadata. In that context, a TypeError would more\n      // likely represent a problem with the data (e.g. invalid URL constructor\n      // arg) and not a programming error.\n      return new InvalidClientMetadataError(\n        `${message}: ${cause.message}`,\n        cause,\n      )\n    }\n\n    return new InvalidClientMetadataError(message, cause)\n  }\n}\n"]}

package/dist/errors/invalid-credentials-error.js

@@ -1,7 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InvalidCredentialsError = void 0;
-const invalid_request_error_js_1 = require("./invalid-request-error.js");
+import { InvalidRequestError } from './invalid-request-error.js';
 /**
  * Thrown by {@link AccountStore.authenticateAccount} implementations to signal
  * that a sign-in attempt was rejected because the provided credentials did not
@@ -19,12 +16,10 @@ const invalid_request_error_js_1 = require("./invalid-request-error.js");
  * that need richer profile info can resolve it from their own account store
  * using `sub`.
  */
-class InvalidCredentialsError extends invalid_request_error_js_1.InvalidRequestError {
-    sub;
+export class InvalidCredentialsError extends InvalidRequestError {
     constructor(message = 'Invalid identifier or password', sub, cause) {
         super(message, cause);
         this.sub = sub;
     }
 }
-exports.InvalidCredentialsError = InvalidCredentialsError;
 //# sourceMappingURL=invalid-credentials-error.js.map

package/dist/errors/invalid-credentials-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"invalid-credentials-error.js","sourceRoot":"","sources":["../../src/errors/invalid-credentials-error.ts"],"names":[],"mappings":";;;AACA,yEAAgE;AAEhE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,uBAAwB,SAAQ,8CAAmB;IAG5C;IAFlB,YACE,OAAO,GAAG,gCAAgC,EAC1B,GAAS,EACzB,KAAe;QAEf,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAHL,QAAG,GAAH,GAAG,CAAM;IAI3B,CAAC;CACF;AARD,0DAQC","sourcesContent":["import { Sub } from '../oidc/sub.js'\nimport { InvalidRequestError } from './invalid-request-error.js'\n\n/**\n * Thrown by {@link AccountStore.authenticateAccount} implementations to signal\n * that a sign-in attempt was rejected because the provided credentials did not\n * match a known account.\n *\n * Stores should populate {@link InvalidCredentialsError.sub} when the\n * identifier resolved to an existing account but e.g. the password or OTP was\n * incorrect. The identifier-unknown case should leave `sub` unset. This\n * information is surfaced to the `onSignInFailed` hook and never sent back to\n * the client, so populating it does not affect the client-visible response.\n *\n * Only the subject identifier (DID) is carried — not a full `Account` — to\n * avoid embedding PII (email, name, etc.) in an error that may be serialized\n * by loggers or monitoring tools walking the `.cause` chain. Hook consumers\n * that need richer profile info can resolve it from their own account store\n * using `sub`.\n */\nexport class InvalidCredentialsError extends InvalidRequestError {\n  constructor(\n    message = 'Invalid identifier or password',\n    public readonly sub?: Sub,\n    cause?: unknown,\n  ) {\n    super(message, cause)\n  }\n}\n"]}
+{"version":3,"file":"invalid-credentials-error.js","sourceRoot":"","sources":["../../src/errors/invalid-credentials-error.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,uBAAwB,SAAQ,mBAAmB;IAC9D,YACE,OAAO,GAAG,gCAAgC,EAC1B,GAAS,EACzB,KAAe;QAEf,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAHL,QAAG,GAAH,GAAG,CAAM;IAI3B,CAAC;CACF","sourcesContent":["import { Sub } from '../oidc/sub.js'\nimport { InvalidRequestError } from './invalid-request-error.js'\n\n/**\n * Thrown by {@link AccountStore.authenticateAccount} implementations to signal\n * that a sign-in attempt was rejected because the provided credentials did not\n * match a known account.\n *\n * Stores should populate {@link InvalidCredentialsError.sub} when the\n * identifier resolved to an existing account but e.g. the password or OTP was\n * incorrect. The identifier-unknown case should leave `sub` unset. This\n * information is surfaced to the `onSignInFailed` hook and never sent back to\n * the client, so populating it does not affect the client-visible response.\n *\n * Only the subject identifier (DID) is carried — not a full `Account` — to\n * avoid embedding PII (email, name, etc.) in an error that may be serialized\n * by loggers or monitoring tools walking the `.cause` chain. Hook consumers\n * that need richer profile info can resolve it from their own account store\n * using `sub`.\n */\nexport class InvalidCredentialsError extends InvalidRequestError {\n  constructor(\n    message = 'Invalid identifier or password',\n    public readonly sub?: Sub,\n    cause?: unknown,\n  ) {\n    super(message, cause)\n  }\n}\n"]}

package/dist/errors/invalid-dpop-key-binding-error.js

@@ -1,7 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InvalidDpopKeyBindingError = void 0;
-const www_authenticate_error_js_1 = require("./www-authenticate-error.js");
+import { WWWAuthenticateError } from './www-authenticate-error.js';
 /**
  * @see
  * {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 | RFC6750 - The WWW-Authenticate Response Header Field}
@@ -9,12 +6,11 @@ const www_authenticate_error_js_1 = require("./www-authenticate-error.js");
  * @see
  * {@link https://datatracker.ietf.org/doc/html/rfc9449#name-the-dpop-authentication-sch | RFC9449 - The DPoP Authentication Scheme}
  */
-class InvalidDpopKeyBindingError extends www_authenticate_error_js_1.WWWAuthenticateError {
+export class InvalidDpopKeyBindingError extends WWWAuthenticateError {
     constructor(cause) {
         const error = 'invalid_token';
         const error_description = 'Invalid DPoP key binding';
         super(error, error_description, { DPoP: { error, error_description } }, cause);
     }
 }
-exports.InvalidDpopKeyBindingError = InvalidDpopKeyBindingError;
 //# sourceMappingURL=invalid-dpop-key-binding-error.js.map

package/dist/errors/invalid-dpop-key-binding-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"invalid-dpop-key-binding-error.js","sourceRoot":"","sources":["../../src/errors/invalid-dpop-key-binding-error.ts"],"names":[],"mappings":";;;AAAA,2EAAkE;AAElE;;;;;;GAMG;AACH,MAAa,0BAA2B,SAAQ,gDAAoB;IAClE,YAAY,KAAe;QACzB,MAAM,KAAK,GAAG,eAAe,CAAA;QAC7B,MAAM,iBAAiB,GAAG,0BAA0B,CAAA;QACpD,KAAK,CACH,KAAK,EACL,iBAAiB,EACjB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EACtC,KAAK,CACN,CAAA;IACH,CAAC;CACF;AAXD,gEAWC","sourcesContent":["import { WWWAuthenticateError } from './www-authenticate-error.js'\n\n/**\n * @see\n * {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 | RFC6750 - The WWW-Authenticate Response Header Field}\n *\n * @see\n * {@link https://datatracker.ietf.org/doc/html/rfc9449#name-the-dpop-authentication-sch | RFC9449 - The DPoP Authentication Scheme}\n */\nexport class InvalidDpopKeyBindingError extends WWWAuthenticateError {\n  constructor(cause?: unknown) {\n    const error = 'invalid_token'\n    const error_description = 'Invalid DPoP key binding'\n    super(\n      error,\n      error_description,\n      { DPoP: { error, error_description } },\n      cause,\n    )\n  }\n}\n"]}
+{"version":3,"file":"invalid-dpop-key-binding-error.js","sourceRoot":"","sources":["../../src/errors/invalid-dpop-key-binding-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAElE;;;;;;GAMG;AACH,MAAM,OAAO,0BAA2B,SAAQ,oBAAoB;IAClE,YAAY,KAAe;QACzB,MAAM,KAAK,GAAG,eAAe,CAAA;QAC7B,MAAM,iBAAiB,GAAG,0BAA0B,CAAA;QACpD,KAAK,CACH,KAAK,EACL,iBAAiB,EACjB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EACtC,KAAK,CACN,CAAA;IACH,CAAC;CACF","sourcesContent":["import { WWWAuthenticateError } from './www-authenticate-error.js'\n\n/**\n * @see\n * {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 | RFC6750 - The WWW-Authenticate Response Header Field}\n *\n * @see\n * {@link https://datatracker.ietf.org/doc/html/rfc9449#name-the-dpop-authentication-sch | RFC9449 - The DPoP Authentication Scheme}\n */\nexport class InvalidDpopKeyBindingError extends WWWAuthenticateError {\n  constructor(cause?: unknown) {\n    const error = 'invalid_token'\n    const error_description = 'Invalid DPoP key binding'\n    super(\n      error,\n      error_description,\n      { DPoP: { error, error_description } },\n      cause,\n    )\n  }\n}\n"]}

package/dist/errors/invalid-dpop-proof-error.js

@@ -1,12 +1,8 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InvalidDpopProofError = void 0;
-const www_authenticate_error_js_1 = require("./www-authenticate-error.js");
-class InvalidDpopProofError extends www_authenticate_error_js_1.WWWAuthenticateError {
+import { WWWAuthenticateError } from './www-authenticate-error.js';
+export class InvalidDpopProofError extends WWWAuthenticateError {
     constructor(error_description, cause) {
         const error = 'invalid_dpop_proof';
         super(error, error_description, { DPoP: { error, error_description } }, cause);
     }
 }
-exports.InvalidDpopProofError = InvalidDpopProofError;
 //# sourceMappingURL=invalid-dpop-proof-error.js.map