@atproto/oauth-provider 0.18.4 → 0.19.1

package/dist/signer/access-token-payload.d.ts

@@ -1817,7 +1817,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
                 t?: string | undefined;
             }[] | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -1841,7 +1841,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
             y: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -1865,7 +1865,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
             y: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -1888,7 +1888,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
             x: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         })) & {
             d?: never;
         }) | undefined;
@@ -2092,7 +2092,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
     }, z.ZodTypeAny, "passthrough">>, "many">>>;
 }, {
     jti: z.ZodEffects<z.ZodString, `tok-${string}`, string>;
-    sub: z.ZodString;
+    sub: z.ZodEffects<z.ZodString, `did:${string}:${string}`, string>;
     exp: z.ZodNumber;
     iat: z.ZodNumber;
     iss: z.ZodString;
@@ -3915,7 +3915,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
                 t?: string | undefined;
             }[] | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -3939,7 +3939,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
             y: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -3963,7 +3963,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
             y: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -3986,7 +3986,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
             x: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         })) & {
             d?: never;
         }) | undefined;
@@ -4190,7 +4190,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
     }, z.ZodTypeAny, "passthrough">>, "many">>>;
 }, {
     jti: z.ZodEffects<z.ZodString, `tok-${string}`, string>;
-    sub: z.ZodString;
+    sub: z.ZodEffects<z.ZodString, `did:${string}:${string}`, string>;
     exp: z.ZodNumber;
     iat: z.ZodNumber;
     iss: z.ZodString;
@@ -6013,7 +6013,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
                 t?: string | undefined;
             }[] | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -6037,7 +6037,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
             y: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -6061,7 +6061,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
             y: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -6084,7 +6084,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
             x: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         })) & {
             d?: never;
         }) | undefined;
@@ -6288,7 +6288,7 @@ export declare const accessTokenPayloadSchema: z.ZodObject<z.objectUtil.extendSh
     }, z.ZodTypeAny, "passthrough">>, "many">>>;
 }, {
     jti: z.ZodEffects<z.ZodString, `tok-${string}`, string>;
-    sub: z.ZodString;
+    sub: z.ZodEffects<z.ZodString, `did:${string}:${string}`, string>;
     exp: z.ZodNumber;
     iat: z.ZodNumber;
     iss: z.ZodString;

package/dist/signer/access-token-payload.js

@@ -1,14 +1,14 @@
 import { z } from 'zod';
+import { didSchema } from '@atproto/did';
 import { jwtPayloadSchema } from '@atproto/jwk';
 import { clientIdSchema } from '../client/client-id.js';
-import { subSchema } from '../oidc/sub.js';
 import { tokenIdSchema } from '../token/token-id.js';
 export const accessTokenPayloadSchema = jwtPayloadSchema
     .partial()
     .extend({
     // Following are required
     jti: tokenIdSchema,
-    sub: subSchema,
+    sub: didSchema,
     exp: z.number().int(),
     iat: z.number().int(),
     iss: z.string().min(1),

package/dist/signer/access-token-payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-token-payload.js","sourceRoot":"","sources":["../../src/signer/access-token-payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB;KACrD,OAAO,EAAE;KACT,MAAM,CAAC;IACN,yBAAyB;IACzB,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEtB,2EAA2E;IAC3E,mCAAmC;IAEnC,6BAA6B;IAC7B,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,WAAW,EAAE,CAAA","sourcesContent":["import { z } from 'zod'\nimport { jwtPayloadSchema } from '@atproto/jwk'\nimport { clientIdSchema } from '../client/client-id.js'\nimport { subSchema } from '../oidc/sub.js'\nimport { tokenIdSchema } from '../token/token-id.js'\n\nexport const accessTokenPayloadSchema = jwtPayloadSchema\n  .partial()\n  .extend({\n    // Following are required\n    jti: tokenIdSchema,\n    sub: subSchema,\n    exp: z.number().int(),\n    iat: z.number().int(),\n    iss: z.string().min(1),\n\n    // @NOTE \"aud\", \"scope\", \"client_id\" are not required, as are stored in the\n    // DB in 'light' access token mode.\n\n    // Restrict type of following\n    client_id: clientIdSchema.optional(),\n  })\n  .passthrough()\n\nexport type AccessTokenPayload = z.infer<typeof accessTokenPayloadSchema>\n"]}
+{"version":3,"file":"access-token-payload.js","sourceRoot":"","sources":["../../src/signer/access-token-payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB;KACrD,OAAO,EAAE;KACT,MAAM,CAAC;IACN,yBAAyB;IACzB,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEtB,2EAA2E;IAC3E,mCAAmC;IAEnC,6BAA6B;IAC7B,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,WAAW,EAAE,CAAA","sourcesContent":["import { z } from 'zod'\nimport { didSchema } from '@atproto/did'\nimport { jwtPayloadSchema } from '@atproto/jwk'\nimport { clientIdSchema } from '../client/client-id.js'\nimport { tokenIdSchema } from '../token/token-id.js'\n\nexport const accessTokenPayloadSchema = jwtPayloadSchema\n  .partial()\n  .extend({\n    // Following are required\n    jti: tokenIdSchema,\n    sub: didSchema,\n    exp: z.number().int(),\n    iat: z.number().int(),\n    iss: z.string().min(1),\n\n    // @NOTE \"aud\", \"scope\", \"client_id\" are not required, as are stored in the\n    // DB in 'light' access token mode.\n\n    // Restrict type of following\n    client_id: clientIdSchema.optional(),\n  })\n  .passthrough()\n\nexport type AccessTokenPayload = z.infer<typeof accessTokenPayloadSchema>\n"]}

package/dist/signer/api-token-payload.d.ts

@@ -1817,7 +1817,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
                 t?: string | undefined;
             }[] | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -1841,7 +1841,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
             y: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -1865,7 +1865,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
             y: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -1888,7 +1888,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
             x: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         })) & {
             d?: never;
         }) | undefined;
@@ -2091,7 +2091,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
         privileges: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, z.ZodTypeAny, "passthrough">>, "many">>;
 }, {
-    sub: z.ZodString;
+    sub: z.ZodEffects<z.ZodString, `did:${string}:${string}`, string>;
     deviceId: z.ZodEffects<z.ZodString, `dev-${string}`, string>;
     requestUri: z.ZodOptional<z.ZodEffects<z.ZodString, `urn:ietf:params:oauth:request_uri:req-${string}`, string>>;
 }>, "passthrough", z.ZodTypeAny, z.objectOutputType<z.objectUtil.extendShape<{
@@ -3912,7 +3912,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
                 t?: string | undefined;
             }[] | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -3936,7 +3936,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
             y: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -3960,7 +3960,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
             y: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -3983,7 +3983,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
             x: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         })) & {
             d?: never;
         }) | undefined;
@@ -4186,7 +4186,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
         privileges: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, z.ZodTypeAny, "passthrough">>, "many">>;
 }, {
-    sub: z.ZodString;
+    sub: z.ZodEffects<z.ZodString, `did:${string}:${string}`, string>;
     deviceId: z.ZodEffects<z.ZodString, `dev-${string}`, string>;
     requestUri: z.ZodOptional<z.ZodEffects<z.ZodString, `urn:ietf:params:oauth:request_uri:req-${string}`, string>>;
 }>, z.ZodTypeAny, "passthrough">, z.objectInputType<z.objectUtil.extendShape<{
@@ -6007,7 +6007,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
                 t?: string | undefined;
             }[] | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -6031,7 +6031,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
             y: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -6055,7 +6055,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
             y: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         }) | ({
             kid?: string | undefined;
             use?: "enc" | "sig" | undefined;
@@ -6078,7 +6078,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
             x: string;
             d?: string | undefined;
         } & {
-            kid: NonNullable<unknown>;
+            kid: {};
         })) & {
             d?: never;
         }) | undefined;
@@ -6281,7 +6281,7 @@ export declare const apiTokenPayloadSchema: z.ZodObject<z.objectUtil.extendShape
         privileges: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, z.ZodTypeAny, "passthrough">>, "many">>;
 }, {
-    sub: z.ZodString;
+    sub: z.ZodEffects<z.ZodString, `did:${string}:${string}`, string>;
     deviceId: z.ZodEffects<z.ZodString, `dev-${string}`, string>;
     requestUri: z.ZodOptional<z.ZodEffects<z.ZodString, `urn:ietf:params:oauth:request_uri:req-${string}`, string>>;
 }>, z.ZodTypeAny, "passthrough">>;

package/dist/signer/api-token-payload.js

@@ -1,10 +1,10 @@
+import { didSchema } from '@atproto/did';
 import { jwtPayloadSchema } from '@atproto/jwk';
 import { deviceIdSchema } from '../oauth-store.js';
-import { subSchema } from '../oidc/sub.js';
 import { requestUriSchema } from '../request/request-uri.js';
 export const apiTokenPayloadSchema = jwtPayloadSchema
     .extend({
-    sub: subSchema,
+    sub: didSchema,
     deviceId: deviceIdSchema,
     // If the token is bound to a particular authorization request, it can only
     // be used in the context of that request.

package/dist/signer/api-token-payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-payload.js","sourceRoot":"","sources":["../../src/signer/api-token-payload.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB;KAClD,MAAM,CAAC;IACN,GAAG,EAAE,SAAS;IAEd,QAAQ,EAAE,cAAc;IACxB,2EAA2E;IAC3E,0CAA0C;IAC1C,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,WAAW,EAAE,CAAA","sourcesContent":["import { z } from 'zod'\nimport { jwtPayloadSchema } from '@atproto/jwk'\nimport { deviceIdSchema } from '../oauth-store.js'\nimport { subSchema } from '../oidc/sub.js'\nimport { requestUriSchema } from '../request/request-uri.js'\n\nexport const apiTokenPayloadSchema = jwtPayloadSchema\n  .extend({\n    sub: subSchema,\n\n    deviceId: deviceIdSchema,\n    // If the token is bound to a particular authorization request, it can only\n    // be used in the context of that request.\n    requestUri: requestUriSchema.optional(),\n  })\n  .passthrough()\n\nexport type ApiTokenPayload = z.infer<typeof apiTokenPayloadSchema>\n"]}
+{"version":3,"file":"api-token-payload.js","sourceRoot":"","sources":["../../src/signer/api-token-payload.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB;KAClD,MAAM,CAAC;IACN,GAAG,EAAE,SAAS;IAEd,QAAQ,EAAE,cAAc;IACxB,2EAA2E;IAC3E,0CAA0C;IAC1C,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,WAAW,EAAE,CAAA","sourcesContent":["import { z } from 'zod'\nimport { didSchema } from '@atproto/did'\nimport { jwtPayloadSchema } from '@atproto/jwk'\nimport { deviceIdSchema } from '../oauth-store.js'\nimport { requestUriSchema } from '../request/request-uri.js'\n\nexport const apiTokenPayloadSchema = jwtPayloadSchema\n  .extend({\n    sub: didSchema,\n\n    deviceId: deviceIdSchema,\n    // If the token is bound to a particular authorization request, it can only\n    // be used in the context of that request.\n    requestUri: requestUriSchema.optional(),\n  })\n  .passthrough()\n\nexport type ApiTokenPayload = z.infer<typeof apiTokenPayloadSchema>\n"]}

package/dist/signer/signer.d.ts

@@ -1,4 +1,4 @@
-import { JwtPayload, JwtPayloadGetter, JwtSignHeader, Keyset, SignedJwt, VerifyOptions } from '@atproto/jwk';
+import { JwtHeader, JwtPayload, JwtPayloadGetter, JwtSignHeader, Key, Keyset, SignedJwt, VerifyOptions, VerifyResult } from '@atproto/jwk';
 import { OmitKey, RequiredKey } from '../lib/util/type.js';
 import { AccessTokenPayload } from './access-token-payload.js';
 import { ApiTokenPayload } from './api-token-payload.js';
@@ -11,199 +11,18 @@ export declare class Signer {
     readonly issuer: string;
     readonly keyset: Keyset;
     constructor(issuer: string, keyset: Keyset);
-    verify<C extends string = never>(token: SignedJwt, options?: Omit<VerifyOptions<C>, 'issuer'>): Promise<import("@atproto/jwk").VerifyResult<C> & {
-        key: import("@atproto/jwk").Key<{
-            kid?: string | undefined;
-            use?: "enc" | "sig" | undefined;
-            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
-            x5c?: string[] | undefined;
-            x5t?: string | undefined;
-            'x5t#S256'?: string | undefined;
-            x5u?: string | undefined;
-            ext?: boolean | undefined;
-            iat?: number | undefined;
-            exp?: number | undefined;
-            nbf?: number | undefined;
-            revoked?: {
-                revoked_at: number;
-                reason?: string | undefined;
-            } | undefined;
-            kty: "RSA";
-            alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
-            n: string;
-            e: string;
-            d?: string | undefined;
-            p?: string | undefined;
-            q?: string | undefined;
-            dp?: string | undefined;
-            dq?: string | undefined;
-            qi?: string | undefined;
-            oth?: {
-                r?: string | undefined;
-                d?: string | undefined;
-                t?: string | undefined;
-            }[] | undefined;
-        } | {
-            kid?: string | undefined;
-            use?: "enc" | "sig" | undefined;
-            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
-            x5c?: string[] | undefined;
-            x5t?: string | undefined;
-            'x5t#S256'?: string | undefined;
-            x5u?: string | undefined;
-            ext?: boolean | undefined;
-            iat?: number | undefined;
-            exp?: number | undefined;
-            nbf?: number | undefined;
-            revoked?: {
-                revoked_at: number;
-                reason?: string | undefined;
-            } | undefined;
-            kty: "EC";
-            alg?: "ES256" | "ES384" | "ES512" | undefined;
-            crv: "P-256" | "P-384" | "P-521";
-            x: string;
-            y: string;
-            d?: string | undefined;
-        } | {
-            kid?: string | undefined;
-            use?: "enc" | "sig" | undefined;
-            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
-            x5c?: string[] | undefined;
-            x5t?: string | undefined;
-            'x5t#S256'?: string | undefined;
-            x5u?: string | undefined;
-            ext?: boolean | undefined;
-            iat?: number | undefined;
-            exp?: number | undefined;
-            nbf?: number | undefined;
-            revoked?: {
-                revoked_at: number;
-                reason?: string | undefined;
-            } | undefined;
-            kty: "EC";
-            alg?: "ES256K" | undefined;
-            crv: "secp256k1";
-            x: string;
-            y: string;
-            d?: string | undefined;
-        } | {
-            kid?: string | undefined;
-            use?: "enc" | "sig" | undefined;
-            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
-            x5c?: string[] | undefined;
-            x5t?: string | undefined;
-            'x5t#S256'?: string | undefined;
-            x5u?: string | undefined;
-            ext?: boolean | undefined;
-            iat?: number | undefined;
-            exp?: number | undefined;
-            nbf?: number | undefined;
-            revoked?: {
-                revoked_at: number;
-                reason?: string | undefined;
-            } | undefined;
-            kty: "OKP";
-            alg?: "EdDSA" | undefined;
-            crv: "Ed25519" | "Ed448";
-            x: string;
-            d?: string | undefined;
-        } | {
-            kid?: string | undefined;
-            use?: "enc" | "sig" | undefined;
-            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
-            x5c?: string[] | undefined;
-            x5t?: string | undefined;
-            'x5t#S256'?: string | undefined;
-            x5u?: string | undefined;
-            ext?: boolean | undefined;
-            iat?: number | undefined;
-            exp?: number | undefined;
-            nbf?: number | undefined;
-            revoked?: {
-                revoked_at: number;
-                reason?: string | undefined;
-            } | undefined;
-            kty: "oct";
-            alg?: "HS256" | "HS384" | "HS512" | undefined;
-            k: string;
-        }>;
+    verify<C extends string = never>(token: SignedJwt, options?: Omit<VerifyOptions<C>, 'issuer'>): Promise<VerifyResult<C> & {
+        key: Key;
     }>;
     sign(signHeader: JwtSignHeader, payload: SignPayload | JwtPayloadGetter<SignPayload>): Promise<SignedJwt>;
     createAccessToken(payload: OmitKey<AccessTokenPayload, 'iss'>): Promise<SignedJwt>;
     verifyAccessToken<C extends string = never>(token: SignedJwt, options?: Omit<VerifyOptions<C>, 'issuer' | 'typ'>): Promise<{
-        protectedHeader: import("zod").objectOutputType<{
-            alg: import("zod").ZodString;
-            jku: import("zod").ZodOptional<import("zod").ZodString>;
-            jwk: import("zod").ZodOptional<import("zod").ZodObject<{
-                kty: import("zod").ZodString;
-                crv: import("zod").ZodOptional<import("zod").ZodString>;
-                x: import("zod").ZodOptional<import("zod").ZodString>;
-                y: import("zod").ZodOptional<import("zod").ZodString>;
-                e: import("zod").ZodOptional<import("zod").ZodString>;
-                n: import("zod").ZodOptional<import("zod").ZodString>;
-            }, "strip", import("zod").ZodTypeAny, {
-                kty: string;
-                crv?: string | undefined;
-                x?: string | undefined;
-                y?: string | undefined;
-                e?: string | undefined;
-                n?: string | undefined;
-            }, {
-                kty: string;
-                crv?: string | undefined;
-                x?: string | undefined;
-                y?: string | undefined;
-                e?: string | undefined;
-                n?: string | undefined;
-            }>>;
-            kid: import("zod").ZodOptional<import("zod").ZodString>;
-            x5u: import("zod").ZodOptional<import("zod").ZodString>;
-            x5c: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString, "many">>;
-            x5t: import("zod").ZodOptional<import("zod").ZodString>;
-            'x5t#S256': import("zod").ZodOptional<import("zod").ZodString>;
-            typ: import("zod").ZodOptional<import("zod").ZodString>;
-            cty: import("zod").ZodOptional<import("zod").ZodString>;
-            crit: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString, "many">>;
-        }, import("zod").ZodTypeAny, "passthrough">;
+        protectedHeader: JwtHeader;
         payload: RequiredKey<AccessTokenPayload, C>;
     }>;
-    createEphemeralToken(payload: OmitKey<ApiTokenPayload, 'iss' | 'aud' | 'iat'>): Promise<`${string}.${string}.${string}`>;
+    createEphemeralToken(payload: OmitKey<ApiTokenPayload, 'iss' | 'aud' | 'iat'>): Promise<SignedJwt>;
     verifyEphemeralToken<C extends string = never>(token: SignedJwt, options?: Omit<VerifyOptions<C>, 'issuer' | 'audience' | 'typ'>): Promise<{
-        protectedHeader: import("zod").objectOutputType<{
-            alg: import("zod").ZodString;
-            jku: import("zod").ZodOptional<import("zod").ZodString>;
-            jwk: import("zod").ZodOptional<import("zod").ZodObject<{
-                kty: import("zod").ZodString;
-                crv: import("zod").ZodOptional<import("zod").ZodString>;
-                x: import("zod").ZodOptional<import("zod").ZodString>;
-                y: import("zod").ZodOptional<import("zod").ZodString>;
-                e: import("zod").ZodOptional<import("zod").ZodString>;
-                n: import("zod").ZodOptional<import("zod").ZodString>;
-            }, "strip", import("zod").ZodTypeAny, {
-                kty: string;
-                crv?: string | undefined;
-                x?: string | undefined;
-                y?: string | undefined;
-                e?: string | undefined;
-                n?: string | undefined;
-            }, {
-                kty: string;
-                crv?: string | undefined;
-                x?: string | undefined;
-                y?: string | undefined;
-                e?: string | undefined;
-                n?: string | undefined;
-            }>>;
-            kid: import("zod").ZodOptional<import("zod").ZodString>;
-            x5u: import("zod").ZodOptional<import("zod").ZodString>;
-            x5c: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString, "many">>;
-            x5t: import("zod").ZodOptional<import("zod").ZodString>;
-            'x5t#S256': import("zod").ZodOptional<import("zod").ZodString>;
-            typ: import("zod").ZodOptional<import("zod").ZodString>;
-            cty: import("zod").ZodOptional<import("zod").ZodString>;
-            crit: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString, "many">>;
-        }, import("zod").ZodTypeAny, "passthrough">;
+        protectedHeader: JwtHeader;
         payload: RequiredKey<ApiTokenPayload, C>;
     }>;
 }

package/dist/signer/signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/signer/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,MAAM,EACN,SAAS,EACT,aAAa,EACd,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EACL,kBAAkB,EAEnB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,eAAe,EAAyB,MAAM,wBAAwB,CAAA;AAE/E,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG;IAAE,GAAG,CAAC,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtD,OAAO,EAAE,MAAM,EAAE,CAAA;AACjB,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,CAAA;AAEzE,qBAAa,MAAM;aAEC,MAAM,EAAE,MAAM;aACd,MAAM,EAAE,MAAM;IAFhC,YACkB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EAC5B;IAEE,MAAM,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EACnC,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAM3C;IAEY,IAAI,CACf,UAAU,EAAE,aAAa,EACzB,OAAO,EAAE,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,GACnD,OAAO,CAAC,SAAS,CAAC,CAOpB;IAEK,iBAAiB,CACrB,OAAO,EAAE,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,GAC1C,OAAO,CAAC,SAAS,CAAC,CASpB;IAEK,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EAC9C,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKW,WAAW,CACpE,kBAAkB,EAClB,CAAC,CACF;OAEJ;IAEK,oBAAoB,CACxB,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,4CAazD;IAEK,oBAAoB,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EACjD,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUL,WAAW,CACjE,eAAe,EACf,CAAC,CACF;OAEJ;CACF"}
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/signer/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,GAAG,EACH,MAAM,EACN,SAAS,EACT,aAAa,EACb,YAAY,EACb,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EACL,kBAAkB,EAEnB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,eAAe,EAAyB,MAAM,wBAAwB,CAAA;AAE/E,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG;IAAE,GAAG,CAAC,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtD,OAAO,EAAE,MAAM,EAAE,CAAA;AACjB,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,CAAA;AAEzE,qBAAa,MAAM;aAEC,MAAM,EAAE,MAAM;aACd,MAAM,EAAE,MAAM;IAFhC,YACkB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EAC5B;IAEE,MAAM,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EACnC,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GACzC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,CAAC,CAKzC;IAEY,IAAI,CACf,UAAU,EAAE,aAAa,EACzB,OAAO,EAAE,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,GACnD,OAAO,CAAC,SAAS,CAAC,CAOpB;IAEK,iBAAiB,CACrB,OAAO,EAAE,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,GAC1C,OAAO,CAAC,SAAS,CAAC,CASpB;IAEK,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EAC9C,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,GACjD,OAAO,CAAC;QACT,eAAe,EAAE,SAAS,CAAA;QAC1B,OAAO,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAA;KAC5C,CAAC,CASD;IAEK,oBAAoB,CACxB,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GACvD,OAAO,CAAC,SAAS,CAAC,CAYpB;IAEK,oBAAoB,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EACjD,KAAK,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAC,GAC9D,OAAO,CAAC;QACT,eAAe,EAAE,SAAS,CAAA;QAC1B,OAAO,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC,CAAC,CAAA;KACzC,CAAC,CAcD;CACF"}

package/dist/signer/signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/signer/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,MAAM,GAGP,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,EAEL,wBAAwB,GACzB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAmB,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAI/E,OAAO,EAAE,MAAM,EAAE,CAAA;AAGjB,MAAM,OAAO,MAAM;IACjB,YACkB,MAAc,EACd,MAAc;sBADd,MAAM;sBACN,MAAM;IACrB,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,KAAgB,EAChB,OAA0C;QAE1C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAI,KAAK,EAAE;YACrC,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;SACtB,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,IAAI,CACf,UAAyB,EACzB,OAAoD;QAEpD,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACxE,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU;gBAC/B,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;gBACrC,CAAC,CAAC,OAAO,CAAC;YACZ,GAAG,EAAE,IAAI,CAAC,MAAM;SACjB,CAAC,CAAC,CAAA;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,OAA2C;QAE3C,OAAO,IAAI,CAAC,IAAI,CACd;YACE,4DAA4D;YAC5D,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,QAAQ;SACd,EACD,OAAO,CACR,CAAA;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAgB,EAChB,OAAkD;QAElD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAI,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;QACzE,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAGrD;SACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,OAAwD;QAExD,OAAO,IAAI,CAAC,IAAI,CACd;YACE,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,QAAQ;SACd,EACD;YACE,GAAG,OAAO;YACV,GAAG,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;YACxC,GAAG,EAAE,WAAW,EAAE;SACnB,CACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAgB,EAChB,OAA+D;QAE/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAI,KAAK,EAAE;YACzC,GAAG,OAAO;YACV,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,yBAAyB,GAAG,GAAG;YACpE,QAAQ,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;YAC7C,GAAG,EAAE,QAAQ;SACd,CAAC,CAAA;QACF,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAGlD;SACF,CAAA;IACH,CAAC;CACF","sourcesContent":["import {\n  JwtPayload,\n  JwtPayloadGetter,\n  JwtSignHeader,\n  Keyset,\n  SignedJwt,\n  VerifyOptions,\n} from '@atproto/jwk'\nimport { EPHEMERAL_SESSION_MAX_AGE } from '../constants.js'\nimport { dateToEpoch } from '../lib/util/date.js'\nimport { OmitKey, RequiredKey } from '../lib/util/type.js'\nimport {\n  AccessTokenPayload,\n  accessTokenPayloadSchema,\n} from './access-token-payload.js'\nimport { ApiTokenPayload, apiTokenPayloadSchema } from './api-token-payload.js'\n\nexport type SignPayload = JwtPayload & { iss?: never }\n\nexport { Keyset }\nexport type { JwtPayloadGetter, JwtSignHeader, SignedJwt, VerifyOptions }\n\nexport class Signer {\n  constructor(\n    public readonly issuer: string,\n    public readonly keyset: Keyset,\n  ) {}\n\n  async verify<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer'>,\n  ) {\n    return this.keyset.verifyJwt<C>(token, {\n      ...options,\n      issuer: [this.issuer],\n    })\n  }\n\n  public async sign(\n    signHeader: JwtSignHeader,\n    payload: SignPayload | JwtPayloadGetter<SignPayload>,\n  ): Promise<SignedJwt> {\n    return this.keyset.createJwt(signHeader, async (protectedHeader, key) => ({\n      ...(typeof payload === 'function'\n        ? await payload(protectedHeader, key)\n        : payload),\n      iss: this.issuer,\n    }))\n  }\n\n  async createAccessToken(\n    payload: OmitKey<AccessTokenPayload, 'iss'>,\n  ): Promise<SignedJwt> {\n    return this.sign(\n      {\n        // https://datatracker.ietf.org/doc/html/rfc9068#section-2.1\n        alg: undefined,\n        typ: 'at+jwt',\n      },\n      payload,\n    )\n  }\n\n  async verifyAccessToken<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer' | 'typ'>,\n  ) {\n    const result = await this.verify<C>(token, { ...options, typ: 'at+jwt' })\n    return {\n      protectedHeader: result.protectedHeader,\n      payload: accessTokenPayloadSchema.parse(result.payload) as RequiredKey<\n        AccessTokenPayload,\n        C\n      >,\n    }\n  }\n\n  async createEphemeralToken(\n    payload: OmitKey<ApiTokenPayload, 'iss' | 'aud' | 'iat'>,\n  ) {\n    return this.sign(\n      {\n        alg: undefined,\n        typ: 'at+jwt',\n      },\n      {\n        ...payload,\n        aud: `oauth-provider-api@${this.issuer}`,\n        iat: dateToEpoch(),\n      },\n    )\n  }\n\n  async verifyEphemeralToken<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer' | 'audience' | 'typ'>,\n  ) {\n    const result = await this.verify<C>(token, {\n      ...options,\n      maxTokenAge: options?.maxTokenAge ?? EPHEMERAL_SESSION_MAX_AGE / 1e3,\n      audience: `oauth-provider-api@${this.issuer}`,\n      typ: 'at+jwt',\n    })\n    return {\n      protectedHeader: result.protectedHeader,\n      payload: apiTokenPayloadSchema.parse(result.payload) as RequiredKey<\n        ApiTokenPayload,\n        C\n      >,\n    }\n  }\n}\n"]}
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/signer/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,MAAM,GAIP,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,EAEL,wBAAwB,GACzB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAmB,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAI/E,OAAO,EAAE,MAAM,EAAE,CAAA;AAGjB,MAAM,OAAO,MAAM;IACjB,YACkB,MAAc,EACd,MAAc;sBADd,MAAM;sBACN,MAAM;IACrB,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,KAAgB,EAChB,OAA0C;QAE1C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAI,KAAK,EAAE;YACrC,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;SACtB,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,IAAI,CACf,UAAyB,EACzB,OAAoD;QAEpD,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACxE,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU;gBAC/B,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;gBACrC,CAAC,CAAC,OAAO,CAAC;YACZ,GAAG,EAAE,IAAI,CAAC,MAAM;SACjB,CAAC,CAAC,CAAA;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,OAA2C;QAE3C,OAAO,IAAI,CAAC,IAAI,CACd;YACE,4DAA4D;YAC5D,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,QAAQ;SACd,EACD,OAAO,CACR,CAAA;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAgB,EAChB,OAAkD;QAKlD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAI,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;QACzE,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAGrD;SACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,OAAwD;QAExD,OAAO,IAAI,CAAC,IAAI,CACd;YACE,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,QAAQ;SACd,EACD;YACE,GAAG,OAAO;YACV,GAAG,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;YACxC,GAAG,EAAE,WAAW,EAAE;SACnB,CACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAgB,EAChB,OAA+D;QAK/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAI,KAAK,EAAE;YACzC,GAAG,OAAO;YACV,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,yBAAyB,GAAG,GAAG;YACpE,QAAQ,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;YAC7C,GAAG,EAAE,QAAQ;SACd,CAAC,CAAA;QACF,OAAO;YACL,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAGlD;SACF,CAAA;IACH,CAAC;CACF","sourcesContent":["import {\n  JwtHeader,\n  JwtPayload,\n  JwtPayloadGetter,\n  JwtSignHeader,\n  Key,\n  Keyset,\n  SignedJwt,\n  VerifyOptions,\n  VerifyResult,\n} from '@atproto/jwk'\nimport { EPHEMERAL_SESSION_MAX_AGE } from '../constants.js'\nimport { dateToEpoch } from '../lib/util/date.js'\nimport { OmitKey, RequiredKey } from '../lib/util/type.js'\nimport {\n  AccessTokenPayload,\n  accessTokenPayloadSchema,\n} from './access-token-payload.js'\nimport { ApiTokenPayload, apiTokenPayloadSchema } from './api-token-payload.js'\n\nexport type SignPayload = JwtPayload & { iss?: never }\n\nexport { Keyset }\nexport type { JwtPayloadGetter, JwtSignHeader, SignedJwt, VerifyOptions }\n\nexport class Signer {\n  constructor(\n    public readonly issuer: string,\n    public readonly keyset: Keyset,\n  ) {}\n\n  async verify<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer'>,\n  ): Promise<VerifyResult<C> & { key: Key }> {\n    return this.keyset.verifyJwt<C>(token, {\n      ...options,\n      issuer: [this.issuer],\n    })\n  }\n\n  public async sign(\n    signHeader: JwtSignHeader,\n    payload: SignPayload | JwtPayloadGetter<SignPayload>,\n  ): Promise<SignedJwt> {\n    return this.keyset.createJwt(signHeader, async (protectedHeader, key) => ({\n      ...(typeof payload === 'function'\n        ? await payload(protectedHeader, key)\n        : payload),\n      iss: this.issuer,\n    }))\n  }\n\n  async createAccessToken(\n    payload: OmitKey<AccessTokenPayload, 'iss'>,\n  ): Promise<SignedJwt> {\n    return this.sign(\n      {\n        // https://datatracker.ietf.org/doc/html/rfc9068#section-2.1\n        alg: undefined,\n        typ: 'at+jwt',\n      },\n      payload,\n    )\n  }\n\n  async verifyAccessToken<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer' | 'typ'>,\n  ): Promise<{\n    protectedHeader: JwtHeader\n    payload: RequiredKey<AccessTokenPayload, C>\n  }> {\n    const result = await this.verify<C>(token, { ...options, typ: 'at+jwt' })\n    return {\n      protectedHeader: result.protectedHeader,\n      payload: accessTokenPayloadSchema.parse(result.payload) as RequiredKey<\n        AccessTokenPayload,\n        C\n      >,\n    }\n  }\n\n  async createEphemeralToken(\n    payload: OmitKey<ApiTokenPayload, 'iss' | 'aud' | 'iat'>,\n  ): Promise<SignedJwt> {\n    return this.sign(\n      {\n        alg: undefined,\n        typ: 'at+jwt',\n      },\n      {\n        ...payload,\n        aud: `oauth-provider-api@${this.issuer}`,\n        iat: dateToEpoch(),\n      },\n    )\n  }\n\n  async verifyEphemeralToken<C extends string = never>(\n    token: SignedJwt,\n    options?: Omit<VerifyOptions<C>, 'issuer' | 'audience' | 'typ'>,\n  ): Promise<{\n    protectedHeader: JwtHeader\n    payload: RequiredKey<ApiTokenPayload, C>\n  }> {\n    const result = await this.verify<C>(token, {\n      ...options,\n      maxTokenAge: options?.maxTokenAge ?? EPHEMERAL_SESSION_MAX_AGE / 1e3,\n      audience: `oauth-provider-api@${this.issuer}`,\n      typ: 'at+jwt',\n    })\n    return {\n      protectedHeader: result.protectedHeader,\n      payload: apiTokenPayloadSchema.parse(result.payload) as RequiredKey<\n        ApiTokenPayload,\n        C\n      >,\n    }\n  }\n}\n"]}

package/dist/token/token-claims.d.ts

@@ -1,3 +1,4 @@
+import { Did } from '@atproto/did';
 import { OAuthScope } from '@atproto/oauth-types';
 import { ClientId } from '../client/client-id.js';
 import { TokenId } from './token-id.js';
@@ -10,7 +11,7 @@ import { TokenId } from './token-id.js';
  */
 export type TokenClaims = {
     jti: TokenId;
-    sub: string;
+    sub: Did;
     iat: number;
     exp: number;
     aud: string | [string, ...string[]];

package/dist/token/token-claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-claims.d.ts","sourceRoot":"","sources":["../../src/token/token-claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAEvC;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,OAAO,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;IACnC,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACrB,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA"}
+{"version":3,"file":"token-claims.d.ts","sourceRoot":"","sources":["../../src/token/token-claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAEvC;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,OAAO,CAAA;IACZ,GAAG,EAAE,GAAG,CAAA;IACR,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;IACnC,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACrB,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA"}

package/dist/token/token-claims.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-claims.js","sourceRoot":"","sources":["../../src/token/token-claims.ts"],"names":[],"mappings":"","sourcesContent":["import { OAuthScope } from '@atproto/oauth-types'\nimport { ClientId } from '../client/client-id.js'\nimport { TokenId } from './token-id.js'\n\n/**\n * The access token claims that will be set by the {@link TokenManager} and that\n * will be passed to the \"onCreateToken\" hook.\n *\n * @note \"iss\" is missing here because it cannot be altered and will always be\n * set to the Authorization Server's identifier.\n */\nexport type TokenClaims = {\n  jti: TokenId\n  sub: string\n  iat: number\n  exp: number\n  aud: string | [string, ...string[]]\n  cnf?: { jkt: string }\n  scope?: OAuthScope\n  client_id: ClientId\n}\n"]}
+{"version":3,"file":"token-claims.js","sourceRoot":"","sources":["../../src/token/token-claims.ts"],"names":[],"mappings":"","sourcesContent":["import { Did } from '@atproto/did'\nimport { OAuthScope } from '@atproto/oauth-types'\nimport { ClientId } from '../client/client-id.js'\nimport { TokenId } from './token-id.js'\n\n/**\n * The access token claims that will be set by the {@link TokenManager} and that\n * will be passed to the \"onCreateToken\" hook.\n *\n * @note \"iss\" is missing here because it cannot be altered and will always be\n * set to the Authorization Server's identifier.\n */\nexport type TokenClaims = {\n  jti: TokenId\n  sub: Did\n  iat: number\n  exp: number\n  aud: string | [string, ...string[]]\n  cnf?: { jkt: string }\n  scope?: OAuthScope\n  client_id: ClientId\n}\n"]}

package/dist/token/token-data.d.ts

@@ -1,10 +1,10 @@
+import { Did } from '@atproto/did';
 import { OAuthAuthorizationDetails, OAuthAuthorizationRequestParameters } from '@atproto/oauth-types';
 import { ClientAuth, ClientAuthLegacy } from '../client/client-auth.js';
 import { ClientId } from '../client/client-id.js';
 import { DeviceId } from '../device/device-id.js';
-import { Sub } from '../oidc/sub.js';
 import { Code } from '../request/code.js';
-export type { ClientAuth, ClientId, Code, DeviceId, OAuthAuthorizationDetails, OAuthAuthorizationRequestParameters, Sub, };
+export type { ClientAuth, ClientId, Code, DeviceId, Did, OAuthAuthorizationDetails, OAuthAuthorizationRequestParameters, };
 export type TokenData = {
     createdAt: Date;
     updatedAt: Date;
@@ -12,7 +12,7 @@ export type TokenData = {
     clientId: ClientId;
     clientAuth: ClientAuth | ClientAuthLegacy;
     deviceId: DeviceId | null;
-    sub: Sub;
+    did: Did;
     parameters: OAuthAuthorizationRequestParameters;
     details?: null;
     code: Code | null;

package/dist/token/token-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-data.d.ts","sourceRoot":"","sources":["../../src/token/token-data.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,mCAAmC,EACpC,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACjD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAEzC,YAAY,EACV,UAAU,EACV,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,yBAAyB,EACzB,mCAAmC,EACnC,GAAG,GACJ,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;IACf,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,UAAU,GAAG,gBAAgB,CAAA;IACzC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,GAAG,EAAE,GAAG,CAAA;IACR,UAAU,EAAE,mCAAmC,CAAA;IAC/C,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IAEjB;;;;;OAKG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB,CAAA"}
+{"version":3,"file":"token-data.d.ts","sourceRoot":"","sources":["../../src/token/token-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EACL,yBAAyB,EACzB,mCAAmC,EACpC,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAEzC,YAAY,EACV,UAAU,EACV,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,GAAG,EACH,yBAAyB,EACzB,mCAAmC,GACpC,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;IACf,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,UAAU,GAAG,gBAAgB,CAAA;IACzC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,GAAG,EAAE,GAAG,CAAA;IACR,UAAU,EAAE,mCAAmC,CAAA;IAC/C,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IAEjB;;;;;OAKG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB,CAAA"}

package/dist/token/token-data.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-data.js","sourceRoot":"","sources":["../../src/token/token-data.ts"],"names":[],"mappings":"","sourcesContent":["import {\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n} from '@atproto/oauth-types'\nimport { ClientAuth, ClientAuthLegacy } from '../client/client-auth.js'\nimport { ClientId } from '../client/client-id.js'\nimport { DeviceId } from '../device/device-id.js'\nimport { Sub } from '../oidc/sub.js'\nimport { Code } from '../request/code.js'\n\nexport type {\n  ClientAuth,\n  ClientId,\n  Code,\n  DeviceId,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n  Sub,\n}\n\nexport type TokenData = {\n  createdAt: Date\n  updatedAt: Date\n  expiresAt: Date\n  clientId: ClientId\n  clientAuth: ClientAuth | ClientAuthLegacy\n  deviceId: DeviceId | null\n  sub: Sub\n  parameters: OAuthAuthorizationRequestParameters\n  details?: null // Legacy field, not used\n  code: Code | null\n\n  /**\n   * This will contain the parameter scope, translated into permissions\n   *\n   * @note null because this didn't use to exist. New tokens should always\n   * include a scope.\n   */\n  scope: string | null\n}\n"]}
+{"version":3,"file":"token-data.js","sourceRoot":"","sources":["../../src/token/token-data.ts"],"names":[],"mappings":"","sourcesContent":["import { Did } from '@atproto/did'\nimport {\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n} from '@atproto/oauth-types'\nimport { ClientAuth, ClientAuthLegacy } from '../client/client-auth.js'\nimport { ClientId } from '../client/client-id.js'\nimport { DeviceId } from '../device/device-id.js'\nimport { Code } from '../request/code.js'\n\nexport type {\n  ClientAuth,\n  ClientId,\n  Code,\n  DeviceId,\n  Did,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n}\n\nexport type TokenData = {\n  createdAt: Date\n  updatedAt: Date\n  expiresAt: Date\n  clientId: ClientId\n  clientAuth: ClientAuth | ClientAuthLegacy\n  deviceId: DeviceId | null\n  did: Did\n  parameters: OAuthAuthorizationRequestParameters\n  details?: null // Legacy field, not used\n  code: Code | null\n\n  /**\n   * This will contain the parameter scope, translated into permissions\n   *\n   * @note null because this didn't use to exist. New tokens should always\n   * include a scope.\n   */\n  scope: string | null\n}\n"]}