@atproto/oauth-provider 0.18.3 → 0.18.4

package/dist/client/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,YAAY,EAEZ,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,MAAM,CAAA;AAEb,OAAO,EACL,gCAAgC,GAKjC,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAA;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAA;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAA;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAMhE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAA;AAE5B,MAAM,OAAO,MAAM;IACjB;;OAEG;aACa,2BAAsB,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAU,CAAA;IAM7E,YACkB,EAAY,EACZ,QAA6B,EAC7B,OAAyB,QAAQ,CAAC,IAAI,EACtC,IAAgB;QAHhB,OAAE,GAAF,EAAE,CAAU;QACZ,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,SAAI,GAAJ,IAAI,CAAkC;QACtC,SAAI,GAAJ,IAAI,CAAY;QAEhC,2EAA2E;QAC3E,IAAI,CAAC,SAAS;YACZ,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBACxB,CAAC,CAAC,iBAAiB,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBACzC,CAAC,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,mBAAmB,CAC9B,GAA4B,EAC5B,QAAgB;QAEhB,oEAAoE;QACpE,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,CAAC;YACH,yEAAyE;YACzE,6CAA6C;YAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,0BAA0B,KAAK,MAAM,EAAE,CAAC;gBACxD,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;oBACxC,QAAQ;oBACR,WAAW,EAAE,WAAW,GAAG,GAAG;oBAC9B,oBAAoB,EAAE,IAAI;oBAC1B,kBAAkB,EAAE,IAAI;iBACzB,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBAC/B,QAAQ;gBACR,WAAW,EAAE,WAAW,GAAG,GAAG;gBAC9B,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,0BAA0B;oBAClD,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC;oBAC5C,CAAC,CAAC,8EAA8E;wBAC9E,EAAE;wBACF,uEAAuE;wBACvE,4BAA4B;wBAC5B,SAAS;aACd,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,SAAS;gBACtB,CAAC,CAAC,6BAA6B,GAAG,CAAC,OAAO,EAAE;gBAC5C,CAAC,CAAC,0BAA0B,CAAA;YAEhC,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,KAAa,EACb,EACE,QAAQ,EACR,oBAAoB,GAAG,KAAK,EAC5B,kBAAkB,GAAG,KAAK,EAC1B,GAAG,OAAO,KAIR,EAAE;QAEN,wEAAwE;QACxE,yEAAyE;QACzE,WAAW;QAEX,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAc,KAAK,EAAE,OAAO,CAAC,CAAA;QAE/D,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,IAAI,SAAS,CAAC,wBAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;YACpE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,oBAAoB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACxD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC/D,MAAM,IAAI,SAAS,CAAC,wBAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;gBACpE,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAES,KAAK,CAAC,SAAS,CACvB,KAAa,EACb,OAA0C;QAE1C,OAAO,SAAS,CAAc,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YACnD,GAAG,OAAO;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;SAChB,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,YAAY,CACvB,KAA6B,EAC7B,MAEC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAA;QAEvD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC3B,CAAC;QAED,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,kBAAkB,IAAI,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,mBAAmB,CAC3B,iCAAiC,MAAM,iCAAiC,CACzE,CAAA;YACH,CAAC;YAED,IAAI,KAAK,CAAC,qBAAqB,KAAK,gCAAgC,EAAE,CAAC;gBACrE,wDAAwD;gBAExD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAGhC,KAAK,CAAC,gBAAgB,EAAE;oBACzB,oEAAoE;oBACpE,6DAA6D;oBAC7D,EAAE;oBACF,iDAAiD;oBAEjD,oEAAoE;oBACpE,sEAAsE;oBACtE,oEAAoE;oBACpE,oDAAoD;oBACpD,OAAO,EAAE,IAAI,CAAC,EAAE;oBAEhB,mEAAmE;oBACnE,qEAAqE;oBACrE,oEAAoE;oBACpE,mEAAmE;oBACnE,gEAAgE;oBAChE,QAAQ,EAAE,MAAM,CAAC,6BAA6B;oBAE9C,cAAc,EAAE;wBACd,kEAAkE;wBAClE,gEAAgE;wBAChE,EAAE;wBACF,gEAAgE;wBAChE,mEAAmE;wBACnE,wDAAwD;wBACxD,mEAAmE;wBACnE,+CAA+C;wBAE/C,SAAS;wBAET,kEAAkE;wBAClE,iEAAiE;wBACjE,oEAAoE;wBACpE,iEAAiE;wBACjE,mEAAmE;wBACnE,gBAAgB;wBAChB,KAAK;qBACN;oBAED,4DAA4D;oBAC5D,8DAA8D;oBAC9D,gCAAgC;oBAChC,EAAE;oBACF,mCAAmC;oBAEnC,sEAAsE;oBACtE,4DAA4D;oBAC5D,sEAAsE;oBACtE,6CAA6C;oBAC7C,WAAW,EAAE,wBAAwB,GAAG,IAAI;iBAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACf,MAAM,GAAG,GACP,GAAG,YAAY,SAAS;wBACtB,CAAC,CAAC,4CAA4C,GAAG,CAAC,OAAO,EAAE;wBAC3D,CAAC,CAAC,yCAAyC,CAAA;oBAE/C,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBACxC,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC;oBAChC,MAAM,IAAI,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;gBACpE,CAAC;gBAED,OAAO;oBACL,MAAM,EAAE,iBAAiB;oBACzB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;oBACvB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;oBACvB,GAAG,EAAE,MAAM,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC;oBACxC,GAAG,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG;oBAC/B,GAAG,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG;iBAChC,CAAA;YACH,CAAC;YAED,MAAM,IAAI,kBAAkB,CAC1B,sCAAsC,KAAK,CAAC,qBAAqB,GAAG,CACrE,CAAA;QACH,CAAC;QAED,wEAAwE;QACxE,4CAA4C;QAC5C,IAAI,MAAM,CAAC,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,+CAA+C;gBAC7C,MAAM,CAAC,sBAAsB;aAC9B,EAAE,CACJ,CAAA;QACH,CAAC;QAED,MAAM,IAAI,0BAA0B,CAClC,2CAA2C,MAAM,GAAG,CACrD,CAAA;IACH,CAAC;IAED;;OAEG;IACI,eAAe,CACpB,UAAyD;QAEzD,IAAI,UAAU,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,kBAAkB,CAC1B,UAAU,EACV,0FAA0F,CAC3F,CAAA;QACH,CAAC;QAED,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,qEAAqE;YACrE,YAAY;YACZ,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;YAEtD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,+CAA+C,CAChD,CAAA;YACH,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpC,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,UAAU,KAAK,0CAA0C,CAC1D,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,kBAAkB,CAC1B,UAAU,EACV,0BAA0B,UAAU,CAAC,aAAa,2BAA2B,CAC9E,CAAA;QACH,CAAC;QAED,IAAI,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,kBAAkB,CAC1B,UAAU,EACV,uEAAuE,CACxE,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,GAAG,UAAU,CAAA;QACnC,IAAI,YAAY,EAAE,CAAC;YACjB,IACE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CACtC,EACD,CAAC;gBACD,MAAM,IAAI,kBAAkB,CAC1B,UAAU,EACV,wBAAwB,YAAY,EAAE,CACvC,CAAA;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAA;YACnC,IAAI,kBAAkB,EAAE,CAAC;gBACvB,UAAU,GAAG,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAA;YAClE,CAAC;iBAAM,CAAC;gBACN,uFAAuF;gBACvF,EAAE;gBACF,wEAAwE;gBACxE,4EAA4E;gBAC5E,YAAY;gBACZ,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAA;YACtE,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,qBAAqB,EAAE,CAAC;YACrC,MAAM,EAAE,2BAA2B,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAA;YACrD,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBACjC,MAAM,IAAI,gCAAgC,CACxC,UAAU,EACV,8DAA8D,CAC/D,CAAA;YACH,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,CAAC;gBACtD,IAAI,CAAC,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxD,MAAM,IAAI,gCAAgC,CACxC,UAAU,EACV,yEAAyE,MAAM,CAAC,IAAI,GAAG,CACxF,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAA;QACvC,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClE,CAAC;;AAGH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAyB;IAEzB,IAAI,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAA;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACvE,CAAC;AACH,CAAC","sourcesContent":["import {\n  JWTClaimVerificationOptions,\n  type JWTHeaderParameters,\n  type JWTPayload,\n  type JWTVerifyOptions,\n  type JWTVerifyResult,\n  type KeyLike,\n  type ResolvedKey,\n  UnsecuredJWT,\n  type UnsecuredResult,\n  calculateJwkThumbprint,\n  createLocalJWKSet,\n  createRemoteJWKSet,\n  errors,\n  exportJWK,\n  jwtVerify,\n} from 'jose'\nimport { Jwks, SignedJwt, UnsignedJwt } from '@atproto/jwk'\nimport {\n  CLIENT_ASSERTION_TYPE_JWT_BEARER,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientCredentials,\n  OAuthClientMetadata,\n  OAuthRedirectUri,\n} from '@atproto/oauth-types'\nimport { CLIENT_ASSERTION_MAX_AGE, JAR_MAX_AGE } from '../constants.js'\nimport { AuthorizationError } from '../errors/authorization-error.js'\nimport { InvalidAuthorizationDetailsError } from '../errors/invalid-authorization-details-error.js'\nimport { InvalidClientError } from '../errors/invalid-client-error.js'\nimport { InvalidClientMetadataError } from '../errors/invalid-client-metadata-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport { InvalidScopeError } from '../errors/invalid-scope-error.js'\nimport { asArray } from '../lib/util/cast.js'\nimport { compareRedirectUri } from '../lib/util/redirect-uri.js'\nimport { Awaitable } from '../lib/util/type.js'\nimport { ClientAuth } from './client-auth.js'\nimport { ClientId } from './client-id.js'\nimport { ClientInfo } from './client-info.js'\n\nconst { JOSEError } = errors\n\nexport class Client {\n  /**\n   * @see {@link https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#token-endpoint-auth-method}\n   */\n  static readonly AUTH_METHODS_SUPPORTED = ['none', 'private_key_jwt'] as const\n\n  private readonly keyGetter: (\n    protectedHeader: JWTHeaderParameters,\n  ) => Awaitable<KeyLike | Uint8Array>\n\n  constructor(\n    public readonly id: ClientId,\n    public readonly metadata: OAuthClientMetadata,\n    public readonly jwks: undefined | Jwks = metadata.jwks,\n    public readonly info: ClientInfo,\n  ) {\n    // If the remote JWKS content is provided, we don't need to fetch it again.\n    this.keyGetter =\n      jwks || !metadata.jwks_uri\n        ? createLocalJWKSet(jwks || { keys: [] })\n        : createRemoteJWKSet(new URL(metadata.jwks_uri), {})\n  }\n\n  /**\n   * @see {@link https://www.rfc-editor.org/rfc/rfc9101.html#name-request-object-2}\n   */\n  public async decodeRequestObject(\n    jar: SignedJwt | UnsignedJwt,\n    audience: string,\n  ) {\n    // https://www.rfc-editor.org/rfc/rfc9101.html#name-request-object-2\n    // > If signed, the Authorization Request Object SHOULD contain the Claims\n    // > iss (issuer) and aud (audience) as members with their semantics being\n    // > the same as defined in the JWT [RFC7519] specification. The value of\n    // > aud should be the value of the authorization server (AS) issuer, as\n    // > defined in RFC 8414 [RFC8414].\n    try {\n      // We need to special case the \"none\" algorithm, as the validation method\n      // is different for signed and unsigned JWTs.\n      if (this.metadata.request_object_signing_alg === 'none') {\n        return await this.jwtVerifyUnsecured(jar, {\n          audience,\n          maxTokenAge: JAR_MAX_AGE / 1e3,\n          allowMissingAudience: true,\n          allowMissingIssuer: true,\n        })\n      }\n\n      return await this.jwtVerify(jar, {\n        audience,\n        maxTokenAge: JAR_MAX_AGE / 1e3,\n        algorithms: this.metadata.request_object_signing_alg\n          ? [this.metadata.request_object_signing_alg]\n          : // https://openid.net/specs/openid-connect-registration-1_0.html#rfc.section.2\n            //\n            // > The default, if omitted, is that any algorithm supported by the OP\n            // > and the RP MAY be used.\n            undefined,\n      })\n    } catch (err) {\n      const message =\n        err instanceof JOSEError\n          ? `Invalid \"request\" object: ${err.message}`\n          : `Invalid \"request\" object`\n\n      throw new InvalidRequestError(message, err)\n    }\n  }\n\n  protected async jwtVerifyUnsecured<PayloadType = JWTPayload>(\n    token: string,\n    {\n      audience,\n      allowMissingAudience = false,\n      allowMissingIssuer = false,\n      ...options\n    }: Omit<JWTClaimVerificationOptions, 'issuer'> & {\n      allowMissingIssuer?: boolean\n      allowMissingAudience?: boolean\n    } = {},\n  ): Promise<UnsecuredResult<PayloadType>> {\n    // jose does not support `allowMissingAudience` and `allowMissingIssuer`\n    // options, so we need to handle audience and issuer checks manually (see\n    // bellow).\n\n    const result = UnsecuredJWT.decode<PayloadType>(token, options)\n\n    if (!allowMissingIssuer || result.payload.iss != null) {\n      if (result.payload.iss !== this.id) {\n        throw new JOSEError(`Invalid \"iss\" claim \"${result.payload.iss}\"`)\n      }\n    }\n\n    if (!allowMissingAudience || result.payload.aud != null) {\n      if (audience != null) {\n        const payloadAud = asArray(result.payload.aud)\n        if (!asArray(audience).some((aud) => payloadAud.includes(aud))) {\n          throw new JOSEError(`Invalid \"aud\" claim \"${result.payload.aud}\"`)\n        }\n      }\n    }\n\n    return result\n  }\n\n  protected async jwtVerify<PayloadType = JWTPayload>(\n    token: string,\n    options?: Omit<JWTVerifyOptions, 'issuer'>,\n  ): Promise<JWTVerifyResult<PayloadType> & ResolvedKey<KeyLike>> {\n    return jwtVerify<PayloadType>(token, this.keyGetter, {\n      ...options,\n      issuer: this.id,\n    })\n  }\n\n  /**\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1}\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7523#section-3}\n   * @see {@link https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#token-endpoint-auth-method}\n   */\n  public async authenticate(\n    input: OAuthClientCredentials,\n    checks: {\n      authorizationServerIdentifier: string\n    },\n  ): Promise<ClientAuth> {\n    const method = this.metadata.token_endpoint_auth_method\n\n    if (method === 'none') {\n      return { method: 'none' }\n    }\n\n    if (method === 'private_key_jwt') {\n      if (!('client_assertion' in input)) {\n        throw new InvalidRequestError(\n          `client authentication method \"${method}\" required a \"client_assertion\"`,\n        )\n      }\n\n      if (input.client_assertion_type === CLIENT_ASSERTION_TYPE_JWT_BEARER) {\n        // https://www.rfc-editor.org/rfc/rfc7523.html#section-3\n\n        const result = await this.jwtVerify<{\n          jti: string\n          exp?: number\n        }>(input.client_assertion, {\n          // > 1. The JWT MUST contain an \"iss\" (issuer) claim that contains a\n          // >    unique identifier for the entity that issued the JWT.\n          //\n          // The \"issuer\" is already checked by jwtVerify()\n\n          // > 2. The JWT MUST contain a \"sub\" (subject) claim identifying the\n          // >    principal that is the subject of the JWT. Two cases need to be\n          // >    differentiated: [...] For client authentication, the subject\n          // >    MUST be the \"client_id\" of the OAuth client.\n          subject: this.id,\n\n          // > 3. The JWT MUST contain an \"aud\" (audience) claim containing a\n          // >    value that identifies the authorization server as an intended\n          // >    audience. The token endpoint URL of the authorization server\n          // >    MAY be used as a value for an \"aud\" element to identify the\n          // >    authorization server as an intended audience of the JWT.\n          audience: checks.authorizationServerIdentifier,\n\n          requiredClaims: [\n            // > 4. The JWT MUST contain an \"exp\" (expiration time) claim that\n            // >    limits the time window during which the JWT can be used.\n            //\n            // @TODO The presence of \"exp\" didn't use to be enforced by this\n            // implementation (or provided by the oauth-client). This is mostly\n            // fine because \"iat\" *is* required, but this makes this\n            // implementation non compliant with RFC7523. We can't just make it\n            // required as it might break existing clients.\n\n            // 'exp',\n\n            // > 7. The JWT MAY contain a \"jti\" (JWT ID) claim that provides a\n            // >    unique identifier for the token. The authorization server\n            // >    MAY ensure that JWTs are not replayed by maintaining the set\n            // >    of used \"jti\" values for the length of time for which the\n            // >    JWT would be considered valid based on the applicable \"exp\"\n            // >    instant.\n            'jti',\n          ],\n\n          // > 5. The JWT MAY contain an \"nbf\" (not before) claim that\n          // >    identifies the time before which the token MUST NOT be\n          // >    accepted for processing.\n          //\n          // This is already enforced by jose\n\n          // > 6. The JWT MAY contain an \"iat\" (issued at) claim that identifies\n          // >    the time at which the JWT was issued.  Note that the\n          // >    authorization server may reject JWTs with an \"iat\" claim value\n          // >    that is unreasonably far in the past.\n          maxTokenAge: CLIENT_ASSERTION_MAX_AGE / 1000,\n        }).catch((err) => {\n          const msg =\n            err instanceof JOSEError\n              ? `Validation of \"client_assertion\" failed: ${err.message}`\n              : `Unable to verify \"client_assertion\" JWT`\n\n          throw new InvalidClientError(msg, err)\n        })\n\n        if (!result.protectedHeader.kid) {\n          throw new InvalidClientError(`\"kid\" required in client_assertion`)\n        }\n\n        return {\n          method: 'private_key_jwt',\n          jti: result.payload.jti,\n          exp: result.payload.exp,\n          jkt: await authJwkThumbprint(result.key),\n          alg: result.protectedHeader.alg,\n          kid: result.protectedHeader.kid,\n        }\n      }\n\n      throw new InvalidClientError(\n        `Unsupported client_assertion_type \"${input.client_assertion_type}\"`,\n      )\n    }\n\n    // @ts-expect-error Ensure to keep Client.AUTH_METHODS_SUPPORTED in sync\n    // with the implementation of this function.\n    if (Client.AUTH_METHODS_SUPPORTED.includes(method)) {\n      throw new Error(\n        `verifyCredentials() should implement all of ${[\n          Client.AUTH_METHODS_SUPPORTED,\n        ]}`,\n      )\n    }\n\n    throw new InvalidClientMetadataError(\n      `Unsupported token_endpoint_auth_method \"${method}\"`,\n    )\n  }\n\n  /**\n   * Validates the request parameters against the client metadata.\n   */\n  public validateRequest(\n    parameters: Readonly<OAuthAuthorizationRequestParameters>,\n  ): Readonly<OAuthAuthorizationRequestParameters> {\n    if (parameters.client_id !== this.id) {\n      throw new AuthorizationError(\n        parameters,\n        'The \"client_id\" parameter field does not match the value used to authenticate the client',\n      )\n    }\n\n    if (parameters.scope !== undefined) {\n      // Any scope requested by the client must be registered in the client\n      // metadata.\n      const declaredScopes = this.metadata.scope?.split(' ')\n\n      if (!declaredScopes) {\n        throw new InvalidScopeError(\n          parameters,\n          'Client has no declared scopes in its metadata',\n        )\n      }\n\n      for (const scope of parameters.scope.split(' ')) {\n        if (!declaredScopes.includes(scope)) {\n          throw new InvalidScopeError(\n            parameters,\n            `Scope \"${scope}\" is not declared in the client metadata`,\n          )\n        }\n      }\n    }\n\n    if (!this.metadata.response_types.includes(parameters.response_type)) {\n      throw new AuthorizationError(\n        parameters,\n        `Invalid response_type \"${parameters.response_type}\" requested by the client`,\n      )\n    }\n\n    if (parameters.response_type.includes('code')) {\n      if (!this.metadata.grant_types.includes('authorization_code')) {\n        throw new AuthorizationError(\n          parameters,\n          `This client is not allowed to use the \"authorization_code\" grant type`,\n        )\n      }\n    }\n\n    const { redirect_uri } = parameters\n    if (redirect_uri) {\n      if (\n        !this.metadata.redirect_uris.some((uri) =>\n          compareRedirectUri(uri, redirect_uri),\n        )\n      ) {\n        throw new AuthorizationError(\n          parameters,\n          `Invalid redirect_uri ${redirect_uri}`,\n        )\n      }\n    } else {\n      const { defaultRedirectUri } = this\n      if (defaultRedirectUri) {\n        parameters = { ...parameters, redirect_uri: defaultRedirectUri }\n      } else {\n        // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-10#authorization-request\n        //\n        // > \"redirect_uri\": OPTIONAL if only one redirect URI is registered for\n        // > this client. REQUIRED if multiple redirect URIs are registered for this\n        // > client.\n        throw new AuthorizationError(parameters, 'redirect_uri is required')\n      }\n    }\n\n    if (parameters.authorization_details) {\n      const { authorization_details_types } = this.metadata\n      if (!authorization_details_types) {\n        throw new InvalidAuthorizationDetailsError(\n          parameters,\n          'Client Metadata does not declare any \"authorization_details\"',\n        )\n      }\n\n      for (const detail of parameters.authorization_details) {\n        if (!authorization_details_types?.includes(detail.type)) {\n          throw new InvalidAuthorizationDetailsError(\n            parameters,\n            `Client Metadata does not declare any \"authorization_details\" of type \"${detail.type}\"`,\n          )\n        }\n      }\n    }\n\n    return parameters\n  }\n\n  get defaultRedirectUri(): OAuthRedirectUri | undefined {\n    const { redirect_uris } = this.metadata\n    return redirect_uris.length === 1 ? redirect_uris[0] : undefined\n  }\n}\n\nexport async function authJwkThumbprint(\n  key: Uint8Array | KeyLike,\n): Promise<string> {\n  try {\n    return await calculateJwkThumbprint(await exportJWK(key), 'sha512')\n  } catch (err) {\n    throw new InvalidClientError('Unable to compute JWK thumbprint', err)\n  }\n}\n"]}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,YAAY,EAEZ,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,MAAM,CAAA;AAEb,OAAO,EACL,gCAAgC,GAKjC,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAA;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAA;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAA;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAMhE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAA;AAE5B,MAAM,OAAO,MAAM;IACjB;;OAEG;aACa,2BAAsB,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAU,CAAA;IAM7E,YACkB,EAAY,EACZ,QAA6B,EAC7B,IAAI,GAAqB,QAAQ,CAAC,IAAI,EACtC,IAAgB;kBAHhB,EAAE;wBACF,QAAQ;oBACR,IAAI;oBACJ,IAAI;QAEpB,2EAA2E;QAC3E,IAAI,CAAC,SAAS;YACZ,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBACxB,CAAC,CAAC,iBAAiB,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBACzC,CAAC,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,mBAAmB,CAC9B,GAA4B,EAC5B,QAAgB;QAEhB,oEAAoE;QACpE,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,CAAC;YACH,yEAAyE;YACzE,6CAA6C;YAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,0BAA0B,KAAK,MAAM,EAAE,CAAC;gBACxD,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE;oBACxC,QAAQ;oBACR,WAAW,EAAE,WAAW,GAAG,GAAG;oBAC9B,oBAAoB,EAAE,IAAI;oBAC1B,kBAAkB,EAAE,IAAI;iBACzB,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBAC/B,QAAQ;gBACR,WAAW,EAAE,WAAW,GAAG,GAAG;gBAC9B,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,0BAA0B;oBAClD,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC;oBAC5C,CAAC,CAAC,8EAA8E;wBAC9E,EAAE;wBACF,uEAAuE;wBACvE,4BAA4B;wBAC5B,SAAS;aACd,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,SAAS;gBACtB,CAAC,CAAC,6BAA6B,GAAG,CAAC,OAAO,EAAE;gBAC5C,CAAC,CAAC,0BAA0B,CAAA;YAEhC,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,KAAa,EACb,EACE,QAAQ,EACR,oBAAoB,GAAG,KAAK,EAC5B,kBAAkB,GAAG,KAAK,EAC1B,GAAG,OAAO,EACX,GAGG,EAAE;QAEN,wEAAwE;QACxE,yEAAyE;QACzE,WAAW;QAEX,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAc,KAAK,EAAE,OAAO,CAAC,CAAA;QAE/D,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,IAAI,SAAS,CAAC,wBAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;YACpE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,oBAAoB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACxD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC/D,MAAM,IAAI,SAAS,CAAC,wBAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;gBACpE,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAES,KAAK,CAAC,SAAS,CACvB,KAAa,EACb,OAA0C;QAE1C,OAAO,SAAS,CAAc,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YACnD,GAAG,OAAO;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;SAChB,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,YAAY,CACvB,KAA6B,EAC7B,MAEC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAA;QAEvD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC3B,CAAC;QAED,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,kBAAkB,IAAI,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,mBAAmB,CAC3B,iCAAiC,MAAM,iCAAiC,CACzE,CAAA;YACH,CAAC;YAED,IAAI,KAAK,CAAC,qBAAqB,KAAK,gCAAgC,EAAE,CAAC;gBACrE,wDAAwD;gBAExD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAGhC,KAAK,CAAC,gBAAgB,EAAE;oBACzB,oEAAoE;oBACpE,6DAA6D;oBAC7D,EAAE;oBACF,iDAAiD;oBAEjD,oEAAoE;oBACpE,sEAAsE;oBACtE,oEAAoE;oBACpE,oDAAoD;oBACpD,OAAO,EAAE,IAAI,CAAC,EAAE;oBAEhB,mEAAmE;oBACnE,qEAAqE;oBACrE,oEAAoE;oBACpE,mEAAmE;oBACnE,gEAAgE;oBAChE,QAAQ,EAAE,MAAM,CAAC,6BAA6B;oBAE9C,cAAc,EAAE;wBACd,kEAAkE;wBAClE,gEAAgE;wBAChE,EAAE;wBACF,gEAAgE;wBAChE,mEAAmE;wBACnE,wDAAwD;wBACxD,mEAAmE;wBACnE,+CAA+C;wBAE/C,SAAS;wBAET,kEAAkE;wBAClE,iEAAiE;wBACjE,oEAAoE;wBACpE,iEAAiE;wBACjE,mEAAmE;wBACnE,gBAAgB;wBAChB,KAAK;qBACN;oBAED,4DAA4D;oBAC5D,8DAA8D;oBAC9D,gCAAgC;oBAChC,EAAE;oBACF,mCAAmC;oBAEnC,sEAAsE;oBACtE,4DAA4D;oBAC5D,sEAAsE;oBACtE,6CAA6C;oBAC7C,WAAW,EAAE,wBAAwB,GAAG,IAAI;iBAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACf,MAAM,GAAG,GACP,GAAG,YAAY,SAAS;wBACtB,CAAC,CAAC,4CAA4C,GAAG,CAAC,OAAO,EAAE;wBAC3D,CAAC,CAAC,yCAAyC,CAAA;oBAE/C,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBACxC,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC;oBAChC,MAAM,IAAI,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;gBACpE,CAAC;gBAED,OAAO;oBACL,MAAM,EAAE,iBAAiB;oBACzB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;oBACvB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;oBACvB,GAAG,EAAE,MAAM,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC;oBACxC,GAAG,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG;oBAC/B,GAAG,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG;iBAChC,CAAA;YACH,CAAC;YAED,MAAM,IAAI,kBAAkB,CAC1B,sCAAsC,KAAK,CAAC,qBAAqB,GAAG,CACrE,CAAA;QACH,CAAC;QAED,wEAAwE;QACxE,4CAA4C;QAC5C,IAAI,MAAM,CAAC,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,+CAA+C;gBAC7C,MAAM,CAAC,sBAAsB;aAC9B,EAAE,CACJ,CAAA;QACH,CAAC;QAED,MAAM,IAAI,0BAA0B,CAClC,2CAA2C,MAAM,GAAG,CACrD,CAAA;IACH,CAAC;IAED;;OAEG;IACI,eAAe,CACpB,UAAyD;QAEzD,IAAI,UAAU,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,kBAAkB,CAC1B,UAAU,EACV,0FAA0F,CAC3F,CAAA;QACH,CAAC;QAED,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,qEAAqE;YACrE,YAAY;YACZ,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;YAEtD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,+CAA+C,CAChD,CAAA;YACH,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpC,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,UAAU,KAAK,0CAA0C,CAC1D,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,kBAAkB,CAC1B,UAAU,EACV,0BAA0B,UAAU,CAAC,aAAa,2BAA2B,CAC9E,CAAA;QACH,CAAC;QAED,IAAI,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,kBAAkB,CAC1B,UAAU,EACV,uEAAuE,CACxE,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,GAAG,UAAU,CAAA;QACnC,IAAI,YAAY,EAAE,CAAC;YACjB,IACE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CACtC,EACD,CAAC;gBACD,MAAM,IAAI,kBAAkB,CAC1B,UAAU,EACV,wBAAwB,YAAY,EAAE,CACvC,CAAA;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAA;YACnC,IAAI,kBAAkB,EAAE,CAAC;gBACvB,UAAU,GAAG,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAA;YAClE,CAAC;iBAAM,CAAC;gBACN,uFAAuF;gBACvF,EAAE;gBACF,wEAAwE;gBACxE,4EAA4E;gBAC5E,YAAY;gBACZ,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAA;YACtE,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,qBAAqB,EAAE,CAAC;YACrC,MAAM,EAAE,2BAA2B,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAA;YACrD,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBACjC,MAAM,IAAI,gCAAgC,CACxC,UAAU,EACV,8DAA8D,CAC/D,CAAA;YACH,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,CAAC;gBACtD,IAAI,CAAC,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxD,MAAM,IAAI,gCAAgC,CACxC,UAAU,EACV,yEAAyE,MAAM,CAAC,IAAI,GAAG,CACxF,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAA;QACvC,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClE,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAyB;IAEzB,IAAI,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAA;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;IACvE,CAAC;AACH,CAAC","sourcesContent":["import {\n  JWTClaimVerificationOptions,\n  type JWTHeaderParameters,\n  type JWTPayload,\n  type JWTVerifyOptions,\n  type JWTVerifyResult,\n  type KeyLike,\n  type ResolvedKey,\n  UnsecuredJWT,\n  type UnsecuredResult,\n  calculateJwkThumbprint,\n  createLocalJWKSet,\n  createRemoteJWKSet,\n  errors,\n  exportJWK,\n  jwtVerify,\n} from 'jose'\nimport { Jwks, SignedJwt, UnsignedJwt } from '@atproto/jwk'\nimport {\n  CLIENT_ASSERTION_TYPE_JWT_BEARER,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientCredentials,\n  OAuthClientMetadata,\n  OAuthRedirectUri,\n} from '@atproto/oauth-types'\nimport { CLIENT_ASSERTION_MAX_AGE, JAR_MAX_AGE } from '../constants.js'\nimport { AuthorizationError } from '../errors/authorization-error.js'\nimport { InvalidAuthorizationDetailsError } from '../errors/invalid-authorization-details-error.js'\nimport { InvalidClientError } from '../errors/invalid-client-error.js'\nimport { InvalidClientMetadataError } from '../errors/invalid-client-metadata-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport { InvalidScopeError } from '../errors/invalid-scope-error.js'\nimport { asArray } from '../lib/util/cast.js'\nimport { compareRedirectUri } from '../lib/util/redirect-uri.js'\nimport { Awaitable } from '../lib/util/type.js'\nimport { ClientAuth } from './client-auth.js'\nimport { ClientId } from './client-id.js'\nimport { ClientInfo } from './client-info.js'\n\nconst { JOSEError } = errors\n\nexport class Client {\n  /**\n   * @see {@link https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#token-endpoint-auth-method}\n   */\n  static readonly AUTH_METHODS_SUPPORTED = ['none', 'private_key_jwt'] as const\n\n  private readonly keyGetter: (\n    protectedHeader: JWTHeaderParameters,\n  ) => Awaitable<KeyLike | Uint8Array>\n\n  constructor(\n    public readonly id: ClientId,\n    public readonly metadata: OAuthClientMetadata,\n    public readonly jwks: undefined | Jwks = metadata.jwks,\n    public readonly info: ClientInfo,\n  ) {\n    // If the remote JWKS content is provided, we don't need to fetch it again.\n    this.keyGetter =\n      jwks || !metadata.jwks_uri\n        ? createLocalJWKSet(jwks || { keys: [] })\n        : createRemoteJWKSet(new URL(metadata.jwks_uri), {})\n  }\n\n  /**\n   * @see {@link https://www.rfc-editor.org/rfc/rfc9101.html#name-request-object-2}\n   */\n  public async decodeRequestObject(\n    jar: SignedJwt | UnsignedJwt,\n    audience: string,\n  ) {\n    // https://www.rfc-editor.org/rfc/rfc9101.html#name-request-object-2\n    // > If signed, the Authorization Request Object SHOULD contain the Claims\n    // > iss (issuer) and aud (audience) as members with their semantics being\n    // > the same as defined in the JWT [RFC7519] specification. The value of\n    // > aud should be the value of the authorization server (AS) issuer, as\n    // > defined in RFC 8414 [RFC8414].\n    try {\n      // We need to special case the \"none\" algorithm, as the validation method\n      // is different for signed and unsigned JWTs.\n      if (this.metadata.request_object_signing_alg === 'none') {\n        return await this.jwtVerifyUnsecured(jar, {\n          audience,\n          maxTokenAge: JAR_MAX_AGE / 1e3,\n          allowMissingAudience: true,\n          allowMissingIssuer: true,\n        })\n      }\n\n      return await this.jwtVerify(jar, {\n        audience,\n        maxTokenAge: JAR_MAX_AGE / 1e3,\n        algorithms: this.metadata.request_object_signing_alg\n          ? [this.metadata.request_object_signing_alg]\n          : // https://openid.net/specs/openid-connect-registration-1_0.html#rfc.section.2\n            //\n            // > The default, if omitted, is that any algorithm supported by the OP\n            // > and the RP MAY be used.\n            undefined,\n      })\n    } catch (err) {\n      const message =\n        err instanceof JOSEError\n          ? `Invalid \"request\" object: ${err.message}`\n          : `Invalid \"request\" object`\n\n      throw new InvalidRequestError(message, err)\n    }\n  }\n\n  protected async jwtVerifyUnsecured<PayloadType = JWTPayload>(\n    token: string,\n    {\n      audience,\n      allowMissingAudience = false,\n      allowMissingIssuer = false,\n      ...options\n    }: Omit<JWTClaimVerificationOptions, 'issuer'> & {\n      allowMissingIssuer?: boolean\n      allowMissingAudience?: boolean\n    } = {},\n  ): Promise<UnsecuredResult<PayloadType>> {\n    // jose does not support `allowMissingAudience` and `allowMissingIssuer`\n    // options, so we need to handle audience and issuer checks manually (see\n    // bellow).\n\n    const result = UnsecuredJWT.decode<PayloadType>(token, options)\n\n    if (!allowMissingIssuer || result.payload.iss != null) {\n      if (result.payload.iss !== this.id) {\n        throw new JOSEError(`Invalid \"iss\" claim \"${result.payload.iss}\"`)\n      }\n    }\n\n    if (!allowMissingAudience || result.payload.aud != null) {\n      if (audience != null) {\n        const payloadAud = asArray(result.payload.aud)\n        if (!asArray(audience).some((aud) => payloadAud.includes(aud))) {\n          throw new JOSEError(`Invalid \"aud\" claim \"${result.payload.aud}\"`)\n        }\n      }\n    }\n\n    return result\n  }\n\n  protected async jwtVerify<PayloadType = JWTPayload>(\n    token: string,\n    options?: Omit<JWTVerifyOptions, 'issuer'>,\n  ): Promise<JWTVerifyResult<PayloadType> & ResolvedKey<KeyLike>> {\n    return jwtVerify<PayloadType>(token, this.keyGetter, {\n      ...options,\n      issuer: this.id,\n    })\n  }\n\n  /**\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1}\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7523#section-3}\n   * @see {@link https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#token-endpoint-auth-method}\n   */\n  public async authenticate(\n    input: OAuthClientCredentials,\n    checks: {\n      authorizationServerIdentifier: string\n    },\n  ): Promise<ClientAuth> {\n    const method = this.metadata.token_endpoint_auth_method\n\n    if (method === 'none') {\n      return { method: 'none' }\n    }\n\n    if (method === 'private_key_jwt') {\n      if (!('client_assertion' in input)) {\n        throw new InvalidRequestError(\n          `client authentication method \"${method}\" required a \"client_assertion\"`,\n        )\n      }\n\n      if (input.client_assertion_type === CLIENT_ASSERTION_TYPE_JWT_BEARER) {\n        // https://www.rfc-editor.org/rfc/rfc7523.html#section-3\n\n        const result = await this.jwtVerify<{\n          jti: string\n          exp?: number\n        }>(input.client_assertion, {\n          // > 1. The JWT MUST contain an \"iss\" (issuer) claim that contains a\n          // >    unique identifier for the entity that issued the JWT.\n          //\n          // The \"issuer\" is already checked by jwtVerify()\n\n          // > 2. The JWT MUST contain a \"sub\" (subject) claim identifying the\n          // >    principal that is the subject of the JWT. Two cases need to be\n          // >    differentiated: [...] For client authentication, the subject\n          // >    MUST be the \"client_id\" of the OAuth client.\n          subject: this.id,\n\n          // > 3. The JWT MUST contain an \"aud\" (audience) claim containing a\n          // >    value that identifies the authorization server as an intended\n          // >    audience. The token endpoint URL of the authorization server\n          // >    MAY be used as a value for an \"aud\" element to identify the\n          // >    authorization server as an intended audience of the JWT.\n          audience: checks.authorizationServerIdentifier,\n\n          requiredClaims: [\n            // > 4. The JWT MUST contain an \"exp\" (expiration time) claim that\n            // >    limits the time window during which the JWT can be used.\n            //\n            // @TODO The presence of \"exp\" didn't use to be enforced by this\n            // implementation (or provided by the oauth-client). This is mostly\n            // fine because \"iat\" *is* required, but this makes this\n            // implementation non compliant with RFC7523. We can't just make it\n            // required as it might break existing clients.\n\n            // 'exp',\n\n            // > 7. The JWT MAY contain a \"jti\" (JWT ID) claim that provides a\n            // >    unique identifier for the token. The authorization server\n            // >    MAY ensure that JWTs are not replayed by maintaining the set\n            // >    of used \"jti\" values for the length of time for which the\n            // >    JWT would be considered valid based on the applicable \"exp\"\n            // >    instant.\n            'jti',\n          ],\n\n          // > 5. The JWT MAY contain an \"nbf\" (not before) claim that\n          // >    identifies the time before which the token MUST NOT be\n          // >    accepted for processing.\n          //\n          // This is already enforced by jose\n\n          // > 6. The JWT MAY contain an \"iat\" (issued at) claim that identifies\n          // >    the time at which the JWT was issued.  Note that the\n          // >    authorization server may reject JWTs with an \"iat\" claim value\n          // >    that is unreasonably far in the past.\n          maxTokenAge: CLIENT_ASSERTION_MAX_AGE / 1000,\n        }).catch((err) => {\n          const msg =\n            err instanceof JOSEError\n              ? `Validation of \"client_assertion\" failed: ${err.message}`\n              : `Unable to verify \"client_assertion\" JWT`\n\n          throw new InvalidClientError(msg, err)\n        })\n\n        if (!result.protectedHeader.kid) {\n          throw new InvalidClientError(`\"kid\" required in client_assertion`)\n        }\n\n        return {\n          method: 'private_key_jwt',\n          jti: result.payload.jti,\n          exp: result.payload.exp,\n          jkt: await authJwkThumbprint(result.key),\n          alg: result.protectedHeader.alg,\n          kid: result.protectedHeader.kid,\n        }\n      }\n\n      throw new InvalidClientError(\n        `Unsupported client_assertion_type \"${input.client_assertion_type}\"`,\n      )\n    }\n\n    // @ts-expect-error Ensure to keep Client.AUTH_METHODS_SUPPORTED in sync\n    // with the implementation of this function.\n    if (Client.AUTH_METHODS_SUPPORTED.includes(method)) {\n      throw new Error(\n        `verifyCredentials() should implement all of ${[\n          Client.AUTH_METHODS_SUPPORTED,\n        ]}`,\n      )\n    }\n\n    throw new InvalidClientMetadataError(\n      `Unsupported token_endpoint_auth_method \"${method}\"`,\n    )\n  }\n\n  /**\n   * Validates the request parameters against the client metadata.\n   */\n  public validateRequest(\n    parameters: Readonly<OAuthAuthorizationRequestParameters>,\n  ): Readonly<OAuthAuthorizationRequestParameters> {\n    if (parameters.client_id !== this.id) {\n      throw new AuthorizationError(\n        parameters,\n        'The \"client_id\" parameter field does not match the value used to authenticate the client',\n      )\n    }\n\n    if (parameters.scope !== undefined) {\n      // Any scope requested by the client must be registered in the client\n      // metadata.\n      const declaredScopes = this.metadata.scope?.split(' ')\n\n      if (!declaredScopes) {\n        throw new InvalidScopeError(\n          parameters,\n          'Client has no declared scopes in its metadata',\n        )\n      }\n\n      for (const scope of parameters.scope.split(' ')) {\n        if (!declaredScopes.includes(scope)) {\n          throw new InvalidScopeError(\n            parameters,\n            `Scope \"${scope}\" is not declared in the client metadata`,\n          )\n        }\n      }\n    }\n\n    if (!this.metadata.response_types.includes(parameters.response_type)) {\n      throw new AuthorizationError(\n        parameters,\n        `Invalid response_type \"${parameters.response_type}\" requested by the client`,\n      )\n    }\n\n    if (parameters.response_type.includes('code')) {\n      if (!this.metadata.grant_types.includes('authorization_code')) {\n        throw new AuthorizationError(\n          parameters,\n          `This client is not allowed to use the \"authorization_code\" grant type`,\n        )\n      }\n    }\n\n    const { redirect_uri } = parameters\n    if (redirect_uri) {\n      if (\n        !this.metadata.redirect_uris.some((uri) =>\n          compareRedirectUri(uri, redirect_uri),\n        )\n      ) {\n        throw new AuthorizationError(\n          parameters,\n          `Invalid redirect_uri ${redirect_uri}`,\n        )\n      }\n    } else {\n      const { defaultRedirectUri } = this\n      if (defaultRedirectUri) {\n        parameters = { ...parameters, redirect_uri: defaultRedirectUri }\n      } else {\n        // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-10#authorization-request\n        //\n        // > \"redirect_uri\": OPTIONAL if only one redirect URI is registered for\n        // > this client. REQUIRED if multiple redirect URIs are registered for this\n        // > client.\n        throw new AuthorizationError(parameters, 'redirect_uri is required')\n      }\n    }\n\n    if (parameters.authorization_details) {\n      const { authorization_details_types } = this.metadata\n      if (!authorization_details_types) {\n        throw new InvalidAuthorizationDetailsError(\n          parameters,\n          'Client Metadata does not declare any \"authorization_details\"',\n        )\n      }\n\n      for (const detail of parameters.authorization_details) {\n        if (!authorization_details_types?.includes(detail.type)) {\n          throw new InvalidAuthorizationDetailsError(\n            parameters,\n            `Client Metadata does not declare any \"authorization_details\" of type \"${detail.type}\"`,\n          )\n        }\n      }\n    }\n\n    return parameters\n  }\n\n  get defaultRedirectUri(): OAuthRedirectUri | undefined {\n    const { redirect_uris } = this.metadata\n    return redirect_uris.length === 1 ? redirect_uris[0] : undefined\n  }\n}\n\nexport async function authJwkThumbprint(\n  key: Uint8Array | KeyLike,\n): Promise<string> {\n  try {\n    return await calculateJwkThumbprint(await exportJWK(key), 'sha512')\n  } catch (err) {\n    throw new InvalidClientError('Unable to compute JWK thumbprint', err)\n  }\n}\n"]}

package/dist/customization/branding.d.ts

@@ -6,112 +6,112 @@ export declare const brandingSchema: z.ZodObject<{
         light: z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>;
         dark: z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>;
         contrastSaturation: z.ZodOptional<z.ZodNumber>;
-    }, Record<"error" | "success" | "warning" | "primary" | "info", z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>>>, Record<"errorContrast" | "successContrast" | "warningContrast" | "primaryContrast" | "infoContrast", z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>>>, Record<"errorHue" | "successHue" | "warningHue" | "primaryHue" | "infoHue", z.ZodOptional<z.ZodNumber>>>, "strip", z.ZodTypeAny, {
-        error?: import("../lib/util/color.js").RgbColor | undefined;
-        success?: import("../lib/util/color.js").RgbColor | undefined;
-        warning?: import("../lib/util/color.js").RgbColor | undefined;
+    }, Record<"error" | "info" | "primary" | "success" | "warning", z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>>>, Record<"errorContrast" | "infoContrast" | "primaryContrast" | "successContrast" | "warningContrast", z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>>>, Record<"errorHue" | "infoHue" | "primaryHue" | "successHue" | "warningHue", z.ZodOptional<z.ZodNumber>>>, "strip", z.ZodTypeAny, {
         light?: import("../lib/util/color.js").RgbColor | undefined;
         dark?: import("../lib/util/color.js").RgbColor | undefined;
         contrastSaturation?: number | undefined;
-        primary?: import("../lib/util/color.js").RgbColor | undefined;
-        info?: import("../lib/util/color.js").RgbColor | undefined;
+        error?: import("../lib/util/color.js").RgbColor | undefined;
         errorContrast?: import("../lib/util/color.js").RgbColor | undefined;
-        successContrast?: import("../lib/util/color.js").RgbColor | undefined;
-        warningContrast?: import("../lib/util/color.js").RgbColor | undefined;
-        primaryContrast?: import("../lib/util/color.js").RgbColor | undefined;
-        infoContrast?: import("../lib/util/color.js").RgbColor | undefined;
         errorHue?: number | undefined;
+        info?: import("../lib/util/color.js").RgbColor | undefined;
+        infoContrast?: import("../lib/util/color.js").RgbColor | undefined;
+        infoHue?: number | undefined;
+        primary?: import("../lib/util/color.js").RgbColor | undefined;
+        primaryContrast?: import("../lib/util/color.js").RgbColor | undefined;
+        primaryHue?: number | undefined;
+        success?: import("../lib/util/color.js").RgbColor | undefined;
+        successContrast?: import("../lib/util/color.js").RgbColor | undefined;
         successHue?: number | undefined;
+        warning?: import("../lib/util/color.js").RgbColor | undefined;
+        warningContrast?: import("../lib/util/color.js").RgbColor | undefined;
         warningHue?: number | undefined;
-        primaryHue?: number | undefined;
-        infoHue?: number | undefined;
     }, {
-        error?: string | undefined;
-        success?: string | undefined;
-        warning?: string | undefined;
         light?: string | undefined;
         dark?: string | undefined;
         contrastSaturation?: number | undefined;
-        primary?: string | undefined;
-        info?: string | undefined;
+        error?: string | undefined;
         errorContrast?: string | undefined;
-        successContrast?: string | undefined;
-        warningContrast?: string | undefined;
-        primaryContrast?: string | undefined;
-        infoContrast?: string | undefined;
         errorHue?: number | undefined;
+        info?: string | undefined;
+        infoContrast?: string | undefined;
+        infoHue?: number | undefined;
+        primary?: string | undefined;
+        primaryContrast?: string | undefined;
+        primaryHue?: number | undefined;
+        success?: string | undefined;
+        successContrast?: string | undefined;
         successHue?: number | undefined;
+        warning?: string | undefined;
+        warningContrast?: string | undefined;
         warningHue?: number | undefined;
-        primaryHue?: number | undefined;
-        infoHue?: number | undefined;
     }>>;
     links: z.ZodOptional<z.ZodArray<z.ZodObject<{
         title: z.ZodUnion<[z.ZodString, z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>]>;
         href: z.ZodString;
-        rel: z.ZodOptional<z.ZodEffects<z.ZodString, "search" | "expect" | "manifest" | "alternate" | "author" | "canonical" | "dns-prefetch" | "external" | "help" | "icon" | "license" | "me" | "modulepreload" | "next" | "pingback" | "preconnect" | "prefetch" | "preload" | "prerender" | "prev" | "privacy-policy" | "stylesheet" | "terms-of-service", string>>;
+        rel: z.ZodOptional<z.ZodEffects<z.ZodString, "alternate" | "author" | "canonical" | "dns-prefetch" | "expect" | "external" | "help" | "icon" | "license" | "manifest" | "me" | "modulepreload" | "next" | "pingback" | "preconnect" | "prefetch" | "preload" | "prerender" | "prev" | "privacy-policy" | "search" | "stylesheet" | "terms-of-service", string>>;
     }, "strip", z.ZodTypeAny, {
-        href: string;
         title: string | Record<string, string | undefined>;
-        rel?: "search" | "expect" | "manifest" | "alternate" | "author" | "canonical" | "dns-prefetch" | "external" | "help" | "icon" | "license" | "me" | "modulepreload" | "next" | "pingback" | "preconnect" | "prefetch" | "preload" | "prerender" | "prev" | "privacy-policy" | "stylesheet" | "terms-of-service" | undefined;
-    }, {
         href: string;
+        rel?: "alternate" | "author" | "canonical" | "dns-prefetch" | "expect" | "external" | "help" | "icon" | "license" | "manifest" | "me" | "modulepreload" | "next" | "pingback" | "preconnect" | "prefetch" | "preload" | "prerender" | "prev" | "privacy-policy" | "search" | "stylesheet" | "terms-of-service" | undefined;
+    }, {
         title: string | Record<string, string | undefined>;
+        href: string;
         rel?: string | undefined;
     }>, "many">>;
 }, "strip", z.ZodTypeAny, {
     name?: string | undefined;
     logo?: string | undefined;
     colors?: {
-        error?: import("../lib/util/color.js").RgbColor | undefined;
-        success?: import("../lib/util/color.js").RgbColor | undefined;
-        warning?: import("../lib/util/color.js").RgbColor | undefined;
         light?: import("../lib/util/color.js").RgbColor | undefined;
         dark?: import("../lib/util/color.js").RgbColor | undefined;
         contrastSaturation?: number | undefined;
-        primary?: import("../lib/util/color.js").RgbColor | undefined;
-        info?: import("../lib/util/color.js").RgbColor | undefined;
+        error?: import("../lib/util/color.js").RgbColor | undefined;
         errorContrast?: import("../lib/util/color.js").RgbColor | undefined;
-        successContrast?: import("../lib/util/color.js").RgbColor | undefined;
-        warningContrast?: import("../lib/util/color.js").RgbColor | undefined;
-        primaryContrast?: import("../lib/util/color.js").RgbColor | undefined;
-        infoContrast?: import("../lib/util/color.js").RgbColor | undefined;
         errorHue?: number | undefined;
+        info?: import("../lib/util/color.js").RgbColor | undefined;
+        infoContrast?: import("../lib/util/color.js").RgbColor | undefined;
+        infoHue?: number | undefined;
+        primary?: import("../lib/util/color.js").RgbColor | undefined;
+        primaryContrast?: import("../lib/util/color.js").RgbColor | undefined;
+        primaryHue?: number | undefined;
+        success?: import("../lib/util/color.js").RgbColor | undefined;
+        successContrast?: import("../lib/util/color.js").RgbColor | undefined;
         successHue?: number | undefined;
+        warning?: import("../lib/util/color.js").RgbColor | undefined;
+        warningContrast?: import("../lib/util/color.js").RgbColor | undefined;
         warningHue?: number | undefined;
-        primaryHue?: number | undefined;
-        infoHue?: number | undefined;
     } | undefined;
     links?: {
-        href: string;
         title: string | Record<string, string | undefined>;
-        rel?: "search" | "expect" | "manifest" | "alternate" | "author" | "canonical" | "dns-prefetch" | "external" | "help" | "icon" | "license" | "me" | "modulepreload" | "next" | "pingback" | "preconnect" | "prefetch" | "preload" | "prerender" | "prev" | "privacy-policy" | "stylesheet" | "terms-of-service" | undefined;
+        href: string;
+        rel?: "alternate" | "author" | "canonical" | "dns-prefetch" | "expect" | "external" | "help" | "icon" | "license" | "manifest" | "me" | "modulepreload" | "next" | "pingback" | "preconnect" | "prefetch" | "preload" | "prerender" | "prev" | "privacy-policy" | "search" | "stylesheet" | "terms-of-service" | undefined;
     }[] | undefined;
 }, {
     name?: string | undefined;
     logo?: string | undefined;
     colors?: {
-        error?: string | undefined;
-        success?: string | undefined;
-        warning?: string | undefined;
         light?: string | undefined;
         dark?: string | undefined;
         contrastSaturation?: number | undefined;
-        primary?: string | undefined;
-        info?: string | undefined;
+        error?: string | undefined;
         errorContrast?: string | undefined;
-        successContrast?: string | undefined;
-        warningContrast?: string | undefined;
-        primaryContrast?: string | undefined;
-        infoContrast?: string | undefined;
         errorHue?: number | undefined;
+        info?: string | undefined;
+        infoContrast?: string | undefined;
+        infoHue?: number | undefined;
+        primary?: string | undefined;
+        primaryContrast?: string | undefined;
+        primaryHue?: number | undefined;
+        success?: string | undefined;
+        successContrast?: string | undefined;
         successHue?: number | undefined;
+        warning?: string | undefined;
+        warningContrast?: string | undefined;
         warningHue?: number | undefined;
-        primaryHue?: number | undefined;
-        infoHue?: number | undefined;
     } | undefined;
     links?: {
-        href: string;
         title: string | Record<string, string | undefined>;
+        href: string;
         rel?: string | undefined;
     }[] | undefined;
 }>;

package/dist/customization/colors.d.ts

@@ -1,48 +1,48 @@
 import { z } from 'zod';
-export declare const COLOR_NAMES: readonly ["primary", "error", "warning", "info", "success"];
+export declare const COLOR_NAMES: readonly ['primary', 'error', 'warning', 'info', 'success'];
 export type ColorName = (typeof COLOR_NAMES)[number];
 export declare const colorsSchema: z.ZodObject<z.objectUtil.extendShape<z.objectUtil.extendShape<z.objectUtil.extendShape<{
     light: z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>;
     dark: z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>;
     contrastSaturation: z.ZodOptional<z.ZodNumber>;
-}, Record<"error" | "success" | "warning" | "primary" | "info", z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>>>, Record<"errorContrast" | "successContrast" | "warningContrast" | "primaryContrast" | "infoContrast", z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>>>, Record<"errorHue" | "successHue" | "warningHue" | "primaryHue" | "infoHue", z.ZodOptional<z.ZodNumber>>>, "strip", z.ZodTypeAny, {
-    error?: import("../lib/util/color.js").RgbColor | undefined;
-    success?: import("../lib/util/color.js").RgbColor | undefined;
-    warning?: import("../lib/util/color.js").RgbColor | undefined;
+}, Record<"error" | "info" | "primary" | "success" | "warning", z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>>>, Record<"errorContrast" | "infoContrast" | "primaryContrast" | "successContrast" | "warningContrast", z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>>>, Record<"errorHue" | "infoHue" | "primaryHue" | "successHue" | "warningHue", z.ZodOptional<z.ZodNumber>>>, "strip", z.ZodTypeAny, {
     light?: import("../lib/util/color.js").RgbColor | undefined;
     dark?: import("../lib/util/color.js").RgbColor | undefined;
     contrastSaturation?: number | undefined;
-    primary?: import("../lib/util/color.js").RgbColor | undefined;
-    info?: import("../lib/util/color.js").RgbColor | undefined;
+    error?: import("../lib/util/color.js").RgbColor | undefined;
     errorContrast?: import("../lib/util/color.js").RgbColor | undefined;
-    successContrast?: import("../lib/util/color.js").RgbColor | undefined;
-    warningContrast?: import("../lib/util/color.js").RgbColor | undefined;
-    primaryContrast?: import("../lib/util/color.js").RgbColor | undefined;
-    infoContrast?: import("../lib/util/color.js").RgbColor | undefined;
     errorHue?: number | undefined;
+    info?: import("../lib/util/color.js").RgbColor | undefined;
+    infoContrast?: import("../lib/util/color.js").RgbColor | undefined;
+    infoHue?: number | undefined;
+    primary?: import("../lib/util/color.js").RgbColor | undefined;
+    primaryContrast?: import("../lib/util/color.js").RgbColor | undefined;
+    primaryHue?: number | undefined;
+    success?: import("../lib/util/color.js").RgbColor | undefined;
+    successContrast?: import("../lib/util/color.js").RgbColor | undefined;
     successHue?: number | undefined;
+    warning?: import("../lib/util/color.js").RgbColor | undefined;
+    warningContrast?: import("../lib/util/color.js").RgbColor | undefined;
     warningHue?: number | undefined;
-    primaryHue?: number | undefined;
-    infoHue?: number | undefined;
 }, {
-    error?: string | undefined;
-    success?: string | undefined;
-    warning?: string | undefined;
     light?: string | undefined;
     dark?: string | undefined;
     contrastSaturation?: number | undefined;
-    primary?: string | undefined;
-    info?: string | undefined;
+    error?: string | undefined;
     errorContrast?: string | undefined;
-    successContrast?: string | undefined;
-    warningContrast?: string | undefined;
-    primaryContrast?: string | undefined;
-    infoContrast?: string | undefined;
     errorHue?: number | undefined;
+    info?: string | undefined;
+    infoContrast?: string | undefined;
+    infoHue?: number | undefined;
+    primary?: string | undefined;
+    primaryContrast?: string | undefined;
+    primaryHue?: number | undefined;
+    success?: string | undefined;
+    successContrast?: string | undefined;
     successHue?: number | undefined;
+    warning?: string | undefined;
+    warningContrast?: string | undefined;
     warningHue?: number | undefined;
-    primaryHue?: number | undefined;
-    infoHue?: number | undefined;
 }>;
 export type Colors = z.infer<typeof colorsSchema>;
 //# sourceMappingURL=colors.d.ts.map

package/dist/customization/colors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"colors.d.ts","sourceRoot":"","sources":["../../src/customization/colors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,eAAO,MAAM,WAAW,6DAMd,CAAA;AACV,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCtB,CAAA;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA"}
+{"version":3,"file":"colors.d.ts","sourceRoot":"","sources":["../../src/customization/colors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,eAAO,MAAM,WAAW,YACtB,SAAS,EACT,OAAO,EACP,SAAS,EACT,MAAM,EACN,SAAS,CACD,CAAA;AACV,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCtB,CAAA;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA"}

package/dist/customization/customization.d.ts

@@ -15,112 +15,112 @@ export declare const customizationSchema: z.ZodObject<{
             light: z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>;
             dark: z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>;
             contrastSaturation: z.ZodOptional<z.ZodNumber>;
-        }, Record<"error" | "success" | "warning" | "primary" | "info", z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>>>, Record<"errorContrast" | "successContrast" | "warningContrast" | "primaryContrast" | "infoContrast", z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>>>, Record<"errorHue" | "successHue" | "warningHue" | "primaryHue" | "infoHue", z.ZodOptional<z.ZodNumber>>>, "strip", z.ZodTypeAny, {
-            error?: import("../lib/util/color.js").RgbColor | undefined;
-            success?: import("../lib/util/color.js").RgbColor | undefined;
-            warning?: import("../lib/util/color.js").RgbColor | undefined;
+        }, Record<"error" | "info" | "primary" | "success" | "warning", z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>>>, Record<"errorContrast" | "infoContrast" | "primaryContrast" | "successContrast" | "warningContrast", z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>>>, Record<"errorHue" | "infoHue" | "primaryHue" | "successHue" | "warningHue", z.ZodOptional<z.ZodNumber>>>, "strip", z.ZodTypeAny, {
             light?: import("../lib/util/color.js").RgbColor | undefined;
             dark?: import("../lib/util/color.js").RgbColor | undefined;
             contrastSaturation?: number | undefined;
-            primary?: import("../lib/util/color.js").RgbColor | undefined;
-            info?: import("../lib/util/color.js").RgbColor | undefined;
+            error?: import("../lib/util/color.js").RgbColor | undefined;
             errorContrast?: import("../lib/util/color.js").RgbColor | undefined;
-            successContrast?: import("../lib/util/color.js").RgbColor | undefined;
-            warningContrast?: import("../lib/util/color.js").RgbColor | undefined;
-            primaryContrast?: import("../lib/util/color.js").RgbColor | undefined;
-            infoContrast?: import("../lib/util/color.js").RgbColor | undefined;
             errorHue?: number | undefined;
+            info?: import("../lib/util/color.js").RgbColor | undefined;
+            infoContrast?: import("../lib/util/color.js").RgbColor | undefined;
+            infoHue?: number | undefined;
+            primary?: import("../lib/util/color.js").RgbColor | undefined;
+            primaryContrast?: import("../lib/util/color.js").RgbColor | undefined;
+            primaryHue?: number | undefined;
+            success?: import("../lib/util/color.js").RgbColor | undefined;
+            successContrast?: import("../lib/util/color.js").RgbColor | undefined;
             successHue?: number | undefined;
+            warning?: import("../lib/util/color.js").RgbColor | undefined;
+            warningContrast?: import("../lib/util/color.js").RgbColor | undefined;
             warningHue?: number | undefined;
-            primaryHue?: number | undefined;
-            infoHue?: number | undefined;
         }, {
-            error?: string | undefined;
-            success?: string | undefined;
-            warning?: string | undefined;
             light?: string | undefined;
             dark?: string | undefined;
             contrastSaturation?: number | undefined;
-            primary?: string | undefined;
-            info?: string | undefined;
+            error?: string | undefined;
             errorContrast?: string | undefined;
-            successContrast?: string | undefined;
-            warningContrast?: string | undefined;
-            primaryContrast?: string | undefined;
-            infoContrast?: string | undefined;
             errorHue?: number | undefined;
+            info?: string | undefined;
+            infoContrast?: string | undefined;
+            infoHue?: number | undefined;
+            primary?: string | undefined;
+            primaryContrast?: string | undefined;
+            primaryHue?: number | undefined;
+            success?: string | undefined;
+            successContrast?: string | undefined;
             successHue?: number | undefined;
+            warning?: string | undefined;
+            warningContrast?: string | undefined;
             warningHue?: number | undefined;
-            primaryHue?: number | undefined;
-            infoHue?: number | undefined;
         }>>;
         links: z.ZodOptional<z.ZodArray<z.ZodObject<{
             title: z.ZodUnion<[z.ZodString, z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>]>;
             href: z.ZodString;
-            rel: z.ZodOptional<z.ZodEffects<z.ZodString, "search" | "expect" | "manifest" | "alternate" | "author" | "canonical" | "dns-prefetch" | "external" | "help" | "icon" | "license" | "me" | "modulepreload" | "next" | "pingback" | "preconnect" | "prefetch" | "preload" | "prerender" | "prev" | "privacy-policy" | "stylesheet" | "terms-of-service", string>>;
+            rel: z.ZodOptional<z.ZodEffects<z.ZodString, "alternate" | "author" | "canonical" | "dns-prefetch" | "expect" | "external" | "help" | "icon" | "license" | "manifest" | "me" | "modulepreload" | "next" | "pingback" | "preconnect" | "prefetch" | "preload" | "prerender" | "prev" | "privacy-policy" | "search" | "stylesheet" | "terms-of-service", string>>;
         }, "strip", z.ZodTypeAny, {
-            href: string;
             title: string | Record<string, string | undefined>;
-            rel?: "search" | "expect" | "manifest" | "alternate" | "author" | "canonical" | "dns-prefetch" | "external" | "help" | "icon" | "license" | "me" | "modulepreload" | "next" | "pingback" | "preconnect" | "prefetch" | "preload" | "prerender" | "prev" | "privacy-policy" | "stylesheet" | "terms-of-service" | undefined;
-        }, {
             href: string;
+            rel?: "alternate" | "author" | "canonical" | "dns-prefetch" | "expect" | "external" | "help" | "icon" | "license" | "manifest" | "me" | "modulepreload" | "next" | "pingback" | "preconnect" | "prefetch" | "preload" | "prerender" | "prev" | "privacy-policy" | "search" | "stylesheet" | "terms-of-service" | undefined;
+        }, {
             title: string | Record<string, string | undefined>;
+            href: string;
             rel?: string | undefined;
         }>, "many">>;
     }, "strip", z.ZodTypeAny, {
         name?: string | undefined;
         logo?: string | undefined;
         colors?: {
-            error?: import("../lib/util/color.js").RgbColor | undefined;
-            success?: import("../lib/util/color.js").RgbColor | undefined;
-            warning?: import("../lib/util/color.js").RgbColor | undefined;
             light?: import("../lib/util/color.js").RgbColor | undefined;
             dark?: import("../lib/util/color.js").RgbColor | undefined;
             contrastSaturation?: number | undefined;
-            primary?: import("../lib/util/color.js").RgbColor | undefined;
-            info?: import("../lib/util/color.js").RgbColor | undefined;
+            error?: import("../lib/util/color.js").RgbColor | undefined;
             errorContrast?: import("../lib/util/color.js").RgbColor | undefined;
-            successContrast?: import("../lib/util/color.js").RgbColor | undefined;
-            warningContrast?: import("../lib/util/color.js").RgbColor | undefined;
-            primaryContrast?: import("../lib/util/color.js").RgbColor | undefined;
-            infoContrast?: import("../lib/util/color.js").RgbColor | undefined;
             errorHue?: number | undefined;
+            info?: import("../lib/util/color.js").RgbColor | undefined;
+            infoContrast?: import("../lib/util/color.js").RgbColor | undefined;
+            infoHue?: number | undefined;
+            primary?: import("../lib/util/color.js").RgbColor | undefined;
+            primaryContrast?: import("../lib/util/color.js").RgbColor | undefined;
+            primaryHue?: number | undefined;
+            success?: import("../lib/util/color.js").RgbColor | undefined;
+            successContrast?: import("../lib/util/color.js").RgbColor | undefined;
             successHue?: number | undefined;
+            warning?: import("../lib/util/color.js").RgbColor | undefined;
+            warningContrast?: import("../lib/util/color.js").RgbColor | undefined;
             warningHue?: number | undefined;
-            primaryHue?: number | undefined;
-            infoHue?: number | undefined;
         } | undefined;
         links?: {
-            href: string;
             title: string | Record<string, string | undefined>;
-            rel?: "search" | "expect" | "manifest" | "alternate" | "author" | "canonical" | "dns-prefetch" | "external" | "help" | "icon" | "license" | "me" | "modulepreload" | "next" | "pingback" | "preconnect" | "prefetch" | "preload" | "prerender" | "prev" | "privacy-policy" | "stylesheet" | "terms-of-service" | undefined;
+            href: string;
+            rel?: "alternate" | "author" | "canonical" | "dns-prefetch" | "expect" | "external" | "help" | "icon" | "license" | "manifest" | "me" | "modulepreload" | "next" | "pingback" | "preconnect" | "prefetch" | "preload" | "prerender" | "prev" | "privacy-policy" | "search" | "stylesheet" | "terms-of-service" | undefined;
         }[] | undefined;
     }, {
         name?: string | undefined;
         logo?: string | undefined;
         colors?: {
-            error?: string | undefined;
-            success?: string | undefined;
-            warning?: string | undefined;
             light?: string | undefined;
             dark?: string | undefined;
             contrastSaturation?: number | undefined;
-            primary?: string | undefined;
-            info?: string | undefined;
+            error?: string | undefined;
             errorContrast?: string | undefined;
-            successContrast?: string | undefined;
-            warningContrast?: string | undefined;
-            primaryContrast?: string | undefined;
-            infoContrast?: string | undefined;
             errorHue?: number | undefined;
+            info?: string | undefined;
+            infoContrast?: string | undefined;
+            infoHue?: number | undefined;
+            primary?: string | undefined;
+            primaryContrast?: string | undefined;
+            primaryHue?: number | undefined;
+            success?: string | undefined;
+            successContrast?: string | undefined;
             successHue?: number | undefined;
+            warning?: string | undefined;
+            warningContrast?: string | undefined;
             warningHue?: number | undefined;
-            primaryHue?: number | undefined;
-            infoHue?: number | undefined;
         } | undefined;
         links?: {
-            href: string;
             title: string | Record<string, string | undefined>;
+            href: string;
             rel?: string | undefined;
         }[] | undefined;
     }>>;
@@ -157,29 +157,29 @@ export declare const customizationSchema: z.ZodObject<{
         name?: string | undefined;
         logo?: string | undefined;
         colors?: {
-            error?: import("../lib/util/color.js").RgbColor | undefined;
-            success?: import("../lib/util/color.js").RgbColor | undefined;
-            warning?: import("../lib/util/color.js").RgbColor | undefined;
             light?: import("../lib/util/color.js").RgbColor | undefined;
             dark?: import("../lib/util/color.js").RgbColor | undefined;
             contrastSaturation?: number | undefined;
-            primary?: import("../lib/util/color.js").RgbColor | undefined;
-            info?: import("../lib/util/color.js").RgbColor | undefined;
+            error?: import("../lib/util/color.js").RgbColor | undefined;
             errorContrast?: import("../lib/util/color.js").RgbColor | undefined;
-            successContrast?: import("../lib/util/color.js").RgbColor | undefined;
-            warningContrast?: import("../lib/util/color.js").RgbColor | undefined;
-            primaryContrast?: import("../lib/util/color.js").RgbColor | undefined;
-            infoContrast?: import("../lib/util/color.js").RgbColor | undefined;
             errorHue?: number | undefined;
+            info?: import("../lib/util/color.js").RgbColor | undefined;
+            infoContrast?: import("../lib/util/color.js").RgbColor | undefined;
+            infoHue?: number | undefined;
+            primary?: import("../lib/util/color.js").RgbColor | undefined;
+            primaryContrast?: import("../lib/util/color.js").RgbColor | undefined;
+            primaryHue?: number | undefined;
+            success?: import("../lib/util/color.js").RgbColor | undefined;
+            successContrast?: import("../lib/util/color.js").RgbColor | undefined;
             successHue?: number | undefined;
+            warning?: import("../lib/util/color.js").RgbColor | undefined;
+            warningContrast?: import("../lib/util/color.js").RgbColor | undefined;
             warningHue?: number | undefined;
-            primaryHue?: number | undefined;
-            infoHue?: number | undefined;
         } | undefined;
         links?: {
-            href: string;
             title: string | Record<string, string | undefined>;
-            rel?: "search" | "expect" | "manifest" | "alternate" | "author" | "canonical" | "dns-prefetch" | "external" | "help" | "icon" | "license" | "me" | "modulepreload" | "next" | "pingback" | "preconnect" | "prefetch" | "preload" | "prerender" | "prev" | "privacy-policy" | "stylesheet" | "terms-of-service" | undefined;
+            href: string;
+            rel?: "alternate" | "author" | "canonical" | "dns-prefetch" | "expect" | "external" | "help" | "icon" | "license" | "manifest" | "me" | "modulepreload" | "next" | "pingback" | "preconnect" | "prefetch" | "preload" | "prerender" | "prev" | "privacy-policy" | "search" | "stylesheet" | "terms-of-service" | undefined;
         }[] | undefined;
     } | undefined;
     inviteCodeRequired?: boolean | undefined;
@@ -196,28 +196,28 @@ export declare const customizationSchema: z.ZodObject<{
         name?: string | undefined;
         logo?: string | undefined;
         colors?: {
-            error?: string | undefined;
-            success?: string | undefined;
-            warning?: string | undefined;
             light?: string | undefined;
             dark?: string | undefined;
             contrastSaturation?: number | undefined;
-            primary?: string | undefined;
-            info?: string | undefined;
+            error?: string | undefined;
             errorContrast?: string | undefined;
-            successContrast?: string | undefined;
-            warningContrast?: string | undefined;
-            primaryContrast?: string | undefined;
-            infoContrast?: string | undefined;
             errorHue?: number | undefined;
+            info?: string | undefined;
+            infoContrast?: string | undefined;
+            infoHue?: number | undefined;
+            primary?: string | undefined;
+            primaryContrast?: string | undefined;
+            primaryHue?: number | undefined;
+            success?: string | undefined;
+            successContrast?: string | undefined;
             successHue?: number | undefined;
+            warning?: string | undefined;
+            warningContrast?: string | undefined;
             warningHue?: number | undefined;
-            primaryHue?: number | undefined;
-            infoHue?: number | undefined;
         } | undefined;
         links?: {
-            href: string;
             title: string | Record<string, string | undefined>;
+            href: string;
             rel?: string | undefined;
         }[] | undefined;
     } | undefined;