@atproto/oauth-provider 0.19.9 → 0.20.1

package/dist/oauth-hooks.d.ts

@@ -1,28 +1,24 @@
-import { Did } from '@atproto/did';
-import { Jwks } from '@atproto/jwk';
+import type { Did } from '@atproto/did';
+import type { Jwks } from '@atproto/jwk';
 import type { Account } from '@atproto/oauth-provider-api';
-import { OAuthAccessToken, OAuthAuthorizationDetails, OAuthAuthorizationRequestParameters, OAuthClientMetadata, OAuthTokenResponse, OAuthTokenType } from '@atproto/oauth-types';
-import { DeleteAccountConfirmInput, ResetPasswordConfirmInput, ResetPasswordRequestInput, SignUpData, UpdateEmailConfirmInput, UpdateEmailRequestInput, UpdateHandleData, VerifyEmailConfirmInput, VerifyEmailRequestInput } from './account/account-store.js';
-import { SignInData } from './account/sign-in-data.js';
-import { SignUpInput } from './account/sign-up-input.js';
-import { ClientAuth } from './client/client-auth.js';
-import { ClientId } from './client/client-id.js';
-import { ClientInfo } from './client/client-info.js';
-import { Client } from './client/client.js';
-import { DeviceId } from './device/device-id.js';
-import { DpopProof } from './dpop/dpop-proof.js';
-import { AccessDeniedError } from './errors/access-denied-error.js';
-import { AuthorizationError } from './errors/authorization-error.js';
-import { InvalidCredentialsError } from './errors/invalid-credentials-error.js';
-import { InvalidRequestError } from './errors/invalid-request-error.js';
-import { OAuthError } from './errors/oauth-error.js';
-import { HcaptchaClientTokens, HcaptchaConfig, HcaptchaVerifyResult } from './lib/hcaptcha.js';
-import { RequestMetadata } from './lib/http/request.js';
-import { Awaitable, OmitKey } from './lib/util/type.js';
-import { RequestId } from './request/request-id.js';
-import { AccessTokenPayload } from './signer/access-token-payload.js';
-import { TokenClaims } from './token/token-claims.js';
-export { AccessDeniedError, type AccessTokenPayload, type Account, AuthorizationError, type Awaitable, Client, type ClientAuth, type ClientId, type ClientInfo, type DeviceId, type Did, type DpopProof, type HcaptchaClientTokens, type HcaptchaConfig, type HcaptchaVerifyResult, InvalidCredentialsError, InvalidRequestError, type Jwks, type OAuthAccessToken, type OAuthAuthorizationDetails, type OAuthAuthorizationRequestParameters, type OAuthClientMetadata, OAuthError, type OAuthTokenResponse, type OAuthTokenType, type RequestMetadata, type ResetPasswordConfirmInput, type ResetPasswordRequestInput, type SignInData, type SignUpData, type SignUpInput, type TokenClaims, type UpdateHandleData, };
+import type { OAuthAccessToken, OAuthAuthorizationDetails, OAuthAuthorizationRequestParameters, OAuthClientMetadata, OAuthTokenResponse, OAuthTokenType } from '@atproto/oauth-types';
+import type { DeleteAccountConfirmInput, ResetPasswordConfirmInput, ResetPasswordRequestInput, SignUpData, UpdateEmailConfirmInput, UpdateEmailRequestInput, UpdateHandleData, VerifyEmailConfirmInput, VerifyEmailRequestInput } from './account/account-store.js';
+import type { SignInData } from './account/sign-in-data.js';
+import type { SignUpInput } from './account/sign-up-input.js';
+import type { ClientAuth } from './client/client-auth.js';
+import type { ClientId } from './client/client-id.js';
+import type { ClientInfo } from './client/client-info.js';
+import type { Client } from './client/client.js';
+import type { DeviceId } from './device/device-id.js';
+import type { DpopProof } from './dpop/dpop-proof.js';
+import type { InvalidRequestError } from './errors/invalid-request-error.js';
+import type { HcaptchaClientTokens, HcaptchaConfig, HcaptchaVerifyResult } from './lib/hcaptcha.js';
+import type { RequestMetadata } from './lib/http/request.js';
+import type { Awaitable, OmitKey } from './lib/util/type.js';
+import type { RequestId } from './request/request-id.js';
+import type { AccessTokenPayload } from './signer/access-token-payload.js';
+import type { TokenClaims } from './token/token-claims.js';
+export type { AccessTokenPayload, Account, Awaitable, Client, ClientAuth, ClientId, ClientInfo, DeviceId, Did, DpopProof, HcaptchaClientTokens, HcaptchaConfig, HcaptchaVerifyResult, Jwks, OAuthAccessToken, OAuthAuthorizationDetails, OAuthAuthorizationRequestParameters, OAuthClientMetadata, OAuthTokenResponse, OAuthTokenType, RequestMetadata, ResetPasswordConfirmInput, ResetPasswordRequestInput, SignInData, SignUpData, SignUpInput, TokenClaims, UpdateHandleData, };
 export type OAuthHooks = {
     /**
      * Use this to alter, override or validate the client metadata & jwks returned

package/dist/oauth-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-hooks.d.ts","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,mCAAmC,EACnC,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACf,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACrB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAGrD,OAAO,EACL,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,kBAAkB,EAClB,KAAK,SAAS,EACd,MAAM,EACN,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,GAAG,EACR,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,IAAI,EACT,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,mCAAmC,EACxC,KAAK,mBAAmB,EACxB,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE;QAAE,QAAQ,EAAE,mBAAmB,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAE,KACjD,SAAS,CAAC,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAE/C;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,WAAW,EAAE,OAAO,CAAA;KACrB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,KAAK,EAAE,gBAAgB,CAAA;QACvB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,KAAK,EAAE,gBAAgB,CAAA;QACvB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,KAAK,EAAE,yBAAyB,CAAA;KACjC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,KAAK,EAAE,WAAW,CAAA;QAClB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE,WAAW,CAAA;QAClB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,MAAM,EAAE,oBAAoB,CAAA;QAC5B,MAAM,EAAE,oBAAoB,CAAA;KAC7B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KACxB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,UAAU,CAAA;QAChB,OAAO,EAAE,OAAO,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,IAAI,EAAE,UAAU,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,CAAC,EAAE,QAAQ,CAAA;KACpB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,UAAU,CAAA;QAChB,OAAO,EAAE,OAAO,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,CAAC,EAAE,QAAQ,CAAA;KACpB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE,UAAU,CAAA;QAChB,KAAK,EAAE,mBAAmB,CAAA;QAC1B,GAAG,EAAE,GAAG,GAAG,IAAI,CAAA;QACf,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,CAAC,EAAE,QAAQ,CAAA;KACpB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,IAAI,GAAG,UAAU,CAAA;QAC7B,UAAU,EAAE,QAAQ,CAAC,mCAAmC,CAAC,CAAA;KAC1D,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;QAC/C,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,SAAS,EAAE,SAAS,CAAA;KACrB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;QAC/C,MAAM,EAAE,WAAW,CAAA;KACpB,KAAK,SAAS,CAAC,IAAI,GAAG,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAA;IAE1D;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,SAAS,EAAE,cAAc,CAAA;QACzB,KAAK,EAAE,gBAAgB,CAAA;QACvB,OAAO,EAAE,kBAAkB,CAAA;QAC3B,SAAS,EAAE,IAAI,GAAG,SAAS,CAAA;KAC5B,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IAExC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;KAChD,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;KAChD,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;CACtB,CAAA"}
+{"version":3,"file":"oauth-hooks.d.ts","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,KAAK,EACV,gBAAgB,EAChB,yBAAyB,EACzB,mCAAmC,EACnC,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACf,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EACV,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AAC5E,OAAO,KAAK,EACV,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACrB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAG1D,YAAY,EACV,kBAAkB,EAClB,OAAO,EACP,SAAS,EACT,MAAM,EACN,UAAU,EACV,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,GAAG,EACH,SAAS,EACT,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,IAAI,EACJ,gBAAgB,EAChB,yBAAyB,EACzB,mCAAmC,EACnC,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,gBAAgB,GACjB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE;QAAE,QAAQ,EAAE,mBAAmB,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAE,KACjD,SAAS,CAAC,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAE/C;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,WAAW,EAAE,OAAO,CAAA;KACrB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,KAAK,EAAE,gBAAgB,CAAA;QACvB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,KAAK,EAAE,gBAAgB,CAAA;QACvB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,KAAK,EAAE,yBAAyB,CAAA;KACjC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,KAAK,EAAE,WAAW,CAAA;QAClB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE,WAAW,CAAA;QAClB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,MAAM,EAAE,oBAAoB,CAAA;QAC5B,MAAM,EAAE,oBAAoB,CAAA;KAC7B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KACxB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,UAAU,CAAA;QAChB,OAAO,EAAE,OAAO,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,IAAI,EAAE,UAAU,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,CAAC,EAAE,QAAQ,CAAA;KACpB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,UAAU,CAAA;QAChB,OAAO,EAAE,OAAO,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,CAAC,EAAE,QAAQ,CAAA;KACpB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE,UAAU,CAAA;QAChB,KAAK,EAAE,mBAAmB,CAAA;QAC1B,GAAG,EAAE,GAAG,GAAG,IAAI,CAAA;QACf,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,CAAC,EAAE,QAAQ,CAAA;KACpB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,IAAI,GAAG,UAAU,CAAA;QAC7B,UAAU,EAAE,QAAQ,CAAC,mCAAmC,CAAC,CAAA;KAC1D,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;QAC/C,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,SAAS,EAAE,SAAS,CAAA;KACrB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;QAC/C,MAAM,EAAE,WAAW,CAAA;KACpB,KAAK,SAAS,CAAC,IAAI,GAAG,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAA;IAE1D;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,SAAS,EAAE,cAAc,CAAA;QACzB,KAAK,EAAE,gBAAgB,CAAA;QACvB,OAAO,EAAE,kBAAkB,CAAA;QAC3B,SAAS,EAAE,IAAI,GAAG,SAAS,CAAA;KAC5B,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IAExC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;KAChD,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;KAChD,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;CACtB,CAAA"}

package/dist/oauth-hooks.js

@@ -1,9 +1,2 @@
-import { Client } from './client/client.js';
-import { AccessDeniedError } from './errors/access-denied-error.js';
-import { AuthorizationError } from './errors/authorization-error.js';
-import { InvalidCredentialsError } from './errors/invalid-credentials-error.js';
-import { InvalidRequestError } from './errors/invalid-request-error.js';
-import { OAuthError } from './errors/oauth-error.js';
-// Make sure all types needed to implement the OAuthHooks are exported
-export { AccessDeniedError, AuthorizationError, Client, InvalidCredentialsError, InvalidRequestError, OAuthError, };
+export {};
 //# sourceMappingURL=oauth-hooks.js.map

package/dist/oauth-hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-hooks.js","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAG3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAYpD,sEAAsE;AACtE,OAAO,EACL,iBAAiB,EAGjB,kBAAkB,EAElB,MAAM,EAUN,uBAAuB,EACvB,mBAAmB,EAMnB,UAAU,GAWX,CAAA","sourcesContent":["import { Did } from '@atproto/did'\nimport { Jwks } from '@atproto/jwk'\nimport type { Account } from '@atproto/oauth-provider-api'\nimport {\n  OAuthAccessToken,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientMetadata,\n  OAuthTokenResponse,\n  OAuthTokenType,\n} from '@atproto/oauth-types'\nimport {\n  DeleteAccountConfirmInput,\n  ResetPasswordConfirmInput,\n  ResetPasswordRequestInput,\n  SignUpData,\n  UpdateEmailConfirmInput,\n  UpdateEmailRequestInput,\n  UpdateHandleData,\n  VerifyEmailConfirmInput,\n  VerifyEmailRequestInput,\n} from './account/account-store.js'\nimport { SignInData } from './account/sign-in-data.js'\nimport { SignUpInput } from './account/sign-up-input.js'\nimport { ClientAuth } from './client/client-auth.js'\nimport { ClientId } from './client/client-id.js'\nimport { ClientInfo } from './client/client-info.js'\nimport { Client } from './client/client.js'\nimport { DeviceId } from './device/device-id.js'\nimport { DpopProof } from './dpop/dpop-proof.js'\nimport { AccessDeniedError } from './errors/access-denied-error.js'\nimport { AuthorizationError } from './errors/authorization-error.js'\nimport { InvalidCredentialsError } from './errors/invalid-credentials-error.js'\nimport { InvalidRequestError } from './errors/invalid-request-error.js'\nimport { OAuthError } from './errors/oauth-error.js'\nimport {\n  HcaptchaClientTokens,\n  HcaptchaConfig,\n  HcaptchaVerifyResult,\n} from './lib/hcaptcha.js'\nimport { RequestMetadata } from './lib/http/request.js'\nimport { Awaitable, OmitKey } from './lib/util/type.js'\nimport { RequestId } from './request/request-id.js'\nimport { AccessTokenPayload } from './signer/access-token-payload.js'\nimport { TokenClaims } from './token/token-claims.js'\n\n// Make sure all types needed to implement the OAuthHooks are exported\nexport {\n  AccessDeniedError,\n  type AccessTokenPayload,\n  type Account,\n  AuthorizationError,\n  type Awaitable,\n  Client,\n  type ClientAuth,\n  type ClientId,\n  type ClientInfo,\n  type DeviceId,\n  type Did,\n  type DpopProof,\n  type HcaptchaClientTokens,\n  type HcaptchaConfig,\n  type HcaptchaVerifyResult,\n  InvalidCredentialsError,\n  InvalidRequestError,\n  type Jwks,\n  type OAuthAccessToken,\n  type OAuthAuthorizationDetails,\n  type OAuthAuthorizationRequestParameters,\n  type OAuthClientMetadata,\n  OAuthError,\n  type OAuthTokenResponse,\n  type OAuthTokenType,\n  type RequestMetadata,\n  type ResetPasswordConfirmInput,\n  type ResetPasswordRequestInput,\n  type SignInData,\n  type SignUpData,\n  type SignUpInput,\n  type TokenClaims,\n  type UpdateHandleData,\n}\n\nexport type OAuthHooks = {\n  /**\n   * Use this to alter, override or validate the client metadata & jwks returned\n   * by the client store.\n   *\n   * @throws {InvalidClientMetadataError} if the metadata is invalid\n   * @see {@link InvalidClientMetadataError}\n   */\n  getClientInfo?: (\n    clientId: ClientId,\n    data: { metadata: OAuthClientMetadata; jwks?: Jwks },\n  ) => Awaitable<undefined | Partial<ClientInfo>>\n\n  /**\n   * This hook is called when a user requests an email change, before the email\n   * change request is triggered on the account store. Only triggered with\n   * authenticated sessions, so the `account` is always available.\n   */\n  onChangeEmailRequest?: (data: {\n    input: UpdateEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user requests an email change, and the email\n   * change request was successfully triggered on the account store.\n   */\n  onChangeEmailRequested?: (data: {\n    input: UpdateEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms an email change, before the email\n   * change is actually confirmed on the account store. Only triggered with\n   * authenticated sessions, so the `account` is always available.\n   */\n  onUpdateEmailConfirm?: (data: {\n    input: UpdateEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user confirms an email change, and the email\n   * change was successfully confirmed on the account store.\n   */\n  onUpdateEmailConfirmed?: (data: {\n    input: UpdateEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n    prevAccount: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests an email verification, before the\n   * verification request is triggered on the account store. Only triggered with\n   * authenticated sessions, so the `account` is always available.\n   */\n  onVerifyEmailRequest?: (data: {\n    input: VerifyEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user requests an email verification, and the\n   * verification request was successfully triggered on the account store.\n   */\n  onVerifyEmailRequested?: (data: {\n    input: VerifyEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms an email verification, before the\n   * verification is actually confirmed on the account store. Only triggered\n   * with authenticated sessions, so the `account` is always available.\n   */\n  onVerifyEmailConfirm?: (data: {\n    input: VerifyEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user confirms an email verification, and the\n   * verification was successfully confirmed on the account store.\n   */\n  onVerifyEmailConfirmed?: (data: {\n    input: VerifyEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a handle change, before the change\n   * is performed on the account store. Only triggered with authenticated\n   * sessions, so the `account` is always available.\n   */\n  onUpdateHandle?: (data: {\n    input: UpdateHandleData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user successfully changed their handle on the\n   * account store.\n   */\n  onUpdatedHandle?: (data: {\n    input: UpdateHandleData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests account deactivation, before the\n   * account is deactivated on the account store.\n   */\n  onDeactivateAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user successfully deactivated their account on\n   * the account store.\n   */\n  onDeactivatedAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests account reactivation, before the\n   * account is reactivated on the account store.\n   */\n  onReactivateAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user successfully reactivated their account on\n   * the account store.\n   */\n  onReactivatedAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests account deletion, before the\n   * confirmation email is dispatched on the account store.\n   */\n  onDeleteAccountRequest?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user has requested account deletion and the\n   * confirmation email has been dispatched.\n   */\n  onDeleteAccountRequested?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms account deletion, before the\n   * account is actually deleted on the account store.\n   */\n  onDeleteAccountConfirm?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user has successfully deleted their account\n   * on the account store.\n   */\n  onDeleteAccountConfirmed?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n    input: DeleteAccountConfirmInput\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user attempts to sign up, after every validation\n   * has passed (including hcaptcha).\n   */\n  onSignUpAttempt?: (data: {\n    input: SignUpInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user attempts to sign up, after the hcaptcha\n   * `/siteverify` request has been made (and before the result is validated).\n   */\n  onHcaptchaResult?: (data: {\n    input: SignUpInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    tokens: HcaptchaClientTokens\n    result: HcaptchaVerifyResult\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a password reset, before the\n   * reset password request is triggered on the account store. Use this to\n   * potentially cancel the password reset.\n   */\n  onResetPasswordRequest?: (data: {\n    input: ResetPasswordRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a password reset, before the\n   * reset password request is triggered on the account store. If not account\n   * was found for the provided identifier, the `account` field will be `null`.\n   */\n  onResetPasswordRequested?: (data: {\n    input: ResetPasswordRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account | null\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms a password reset, before the\n   * password is actually reset on the account store.\n   */\n  onResetPasswordConfirm?: (data: {\n    input: ResetPasswordConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user confirms a password reset, and the\n   * password was successfully reset on the account store.\n   */\n  onResetPasswordConfirmed?: (data: {\n    input: ResetPasswordConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user successfully signs up.\n   *\n   * @throws {AccessDeniedError} to deny the sign-up\n   */\n  onSignedUp?: (data: {\n    data: SignUpData\n    account: Account\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request (i.e. the user is logging in to approve a\n   * client); it is omitted for first-party sign-ins that happen outside any\n   * authorization flow.\n   */\n  onSignInAttempt?: (data: {\n    data: SignInData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId?: ClientId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user successfully signs in.\n   *\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request; see {@link OAuthHooks.onSignInAttempt}.\n   *\n   * @throws {InvalidRequestError} when the sing-in should be denied\n   */\n  onSignedIn?: (data: {\n    data: SignInData\n    account: Account\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId?: ClientId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a sign-in attempt is rejected by the account\n   * store due to invalid credentials (e.g. unknown identifier, wrong\n   * password). It is *not* called for unexpected server errors, nor for flows\n   * that require an additional authentication factor.\n   *\n   * `sub` is populated when the store throws an\n   * {@link InvalidCredentialsError} that carries the matched subject\n   * identifier (i.e. identifier known, credentials wrong). It is `null` when\n   * the identifier was unknown or when the store threw a plain\n   * {@link InvalidRequestError} without distinguishing the two cases.\n   *\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request; see {@link OAuthHooks.onSignInAttempt}.\n   *\n   * Errors thrown from this hook are caught and ignored so that they do not\n   * mask the original authentication failure.\n   */\n  onSignInFailed?: (data: {\n    data: SignInData\n    error: InvalidRequestError\n    did: Did | null\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId?: ClientId\n  }) => Awaitable<void>\n\n  /**\n   * Allows validating an authorization request (typically the requested scopes)\n   * before it is created. Note that the validity against the client metadata is\n   * already enforced by the OAuth provider.\n   *\n   * @throws {AuthorizationError}\n   */\n  onAuthorizationRequest?: (data: {\n    client: Client\n    clientAuth: null | ClientAuth\n    parameters: Readonly<OAuthAuthorizationRequestParameters>\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a client is authorized.\n   *\n   * @throws {AuthorizationError} to deny the authorization request and redirect\n   * the user to the client with an OAuth error (other errors will result in an\n   * internal server error being displayed to the user)\n   *\n   * @note We use `deviceMetadata` instead of `clientMetadata` to make it clear\n   * that this metadata is from the user device, which might be different from\n   * the client metadata (because the OAuth client could live in a backend).\n   */\n  onAuthorized?: (data: {\n    client: Client\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    requestId: RequestId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called whenever a token is about to be created. You can use\n   * it to modify the token claims or perform additional validation.\n   *\n   * This hook should never throw an error.\n   */\n  onCreateToken?: (data: {\n    client: Client\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n    claims: TokenClaims\n  }) => Awaitable<void | OmitKey<AccessTokenPayload, 'iss'>>\n\n  /**\n   * This hook is called whenever a token was just decoded, and basic validation\n   * was performed (signature, expiration, not-before).\n   *\n   * It can be used to modify the payload (e.g., to add custom claims), or to\n   * perform additional validation.\n   *\n   * This hook is called when authenticating requests through the\n   * `authenticateRequest()` method in `OAuthVerifier` and `OAuthProvider`.\n   *\n   * Any error thrown here will be propagated.\n   */\n  onDecodeToken?: (data: {\n    tokenType: OAuthTokenType\n    token: OAuthAccessToken\n    payload: AccessTokenPayload\n    dpopProof: null | DpopProof\n  }) => Promise<AccessTokenPayload | void>\n\n  /**\n   * This hook is called when an authorized client exchanges an authorization\n   * code for an access token.\n   *\n   * @throws {OAuthError} to cancel the token creation and revoke the session\n   */\n  onTokenCreated?: (data: {\n    client: Client\n    clientAuth: ClientAuth\n    clientMetadata: RequestMetadata\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when an authorized client refreshes an access token.\n   *\n   * @throws {OAuthError} to cancel the token refresh and revoke the session\n   */\n  onTokenRefreshed?: (data: {\n    client: Client\n    clientAuth: ClientAuth\n    clientMetadata: RequestMetadata\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n  }) => Awaitable<void>\n}\n"]}
+{"version":3,"file":"oauth-hooks.js","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":"","sourcesContent":["import type { Did } from '@atproto/did'\nimport type { Jwks } from '@atproto/jwk'\nimport type { Account } from '@atproto/oauth-provider-api'\nimport type {\n  OAuthAccessToken,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientMetadata,\n  OAuthTokenResponse,\n  OAuthTokenType,\n} from '@atproto/oauth-types'\nimport type {\n  DeleteAccountConfirmInput,\n  ResetPasswordConfirmInput,\n  ResetPasswordRequestInput,\n  SignUpData,\n  UpdateEmailConfirmInput,\n  UpdateEmailRequestInput,\n  UpdateHandleData,\n  VerifyEmailConfirmInput,\n  VerifyEmailRequestInput,\n} from './account/account-store.js'\nimport type { SignInData } from './account/sign-in-data.js'\nimport type { SignUpInput } from './account/sign-up-input.js'\nimport type { ClientAuth } from './client/client-auth.js'\nimport type { ClientId } from './client/client-id.js'\nimport type { ClientInfo } from './client/client-info.js'\nimport type { Client } from './client/client.js'\nimport type { DeviceId } from './device/device-id.js'\nimport type { DpopProof } from './dpop/dpop-proof.js'\nimport type { InvalidRequestError } from './errors/invalid-request-error.js'\nimport type {\n  HcaptchaClientTokens,\n  HcaptchaConfig,\n  HcaptchaVerifyResult,\n} from './lib/hcaptcha.js'\nimport type { RequestMetadata } from './lib/http/request.js'\nimport type { Awaitable, OmitKey } from './lib/util/type.js'\nimport type { RequestId } from './request/request-id.js'\nimport type { AccessTokenPayload } from './signer/access-token-payload.js'\nimport type { TokenClaims } from './token/token-claims.js'\n\n// Make sure all types needed to implement the OAuthHooks are exported\nexport type {\n  AccessTokenPayload,\n  Account,\n  Awaitable,\n  Client,\n  ClientAuth,\n  ClientId,\n  ClientInfo,\n  DeviceId,\n  Did,\n  DpopProof,\n  HcaptchaClientTokens,\n  HcaptchaConfig,\n  HcaptchaVerifyResult,\n  Jwks,\n  OAuthAccessToken,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientMetadata,\n  OAuthTokenResponse,\n  OAuthTokenType,\n  RequestMetadata,\n  ResetPasswordConfirmInput,\n  ResetPasswordRequestInput,\n  SignInData,\n  SignUpData,\n  SignUpInput,\n  TokenClaims,\n  UpdateHandleData,\n}\n\nexport type OAuthHooks = {\n  /**\n   * Use this to alter, override or validate the client metadata & jwks returned\n   * by the client store.\n   *\n   * @throws {InvalidClientMetadataError} if the metadata is invalid\n   * @see {@link InvalidClientMetadataError}\n   */\n  getClientInfo?: (\n    clientId: ClientId,\n    data: { metadata: OAuthClientMetadata; jwks?: Jwks },\n  ) => Awaitable<undefined | Partial<ClientInfo>>\n\n  /**\n   * This hook is called when a user requests an email change, before the email\n   * change request is triggered on the account store. Only triggered with\n   * authenticated sessions, so the `account` is always available.\n   */\n  onChangeEmailRequest?: (data: {\n    input: UpdateEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user requests an email change, and the email\n   * change request was successfully triggered on the account store.\n   */\n  onChangeEmailRequested?: (data: {\n    input: UpdateEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms an email change, before the email\n   * change is actually confirmed on the account store. Only triggered with\n   * authenticated sessions, so the `account` is always available.\n   */\n  onUpdateEmailConfirm?: (data: {\n    input: UpdateEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user confirms an email change, and the email\n   * change was successfully confirmed on the account store.\n   */\n  onUpdateEmailConfirmed?: (data: {\n    input: UpdateEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n    prevAccount: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests an email verification, before the\n   * verification request is triggered on the account store. Only triggered with\n   * authenticated sessions, so the `account` is always available.\n   */\n  onVerifyEmailRequest?: (data: {\n    input: VerifyEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user requests an email verification, and the\n   * verification request was successfully triggered on the account store.\n   */\n  onVerifyEmailRequested?: (data: {\n    input: VerifyEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms an email verification, before the\n   * verification is actually confirmed on the account store. Only triggered\n   * with authenticated sessions, so the `account` is always available.\n   */\n  onVerifyEmailConfirm?: (data: {\n    input: VerifyEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user confirms an email verification, and the\n   * verification was successfully confirmed on the account store.\n   */\n  onVerifyEmailConfirmed?: (data: {\n    input: VerifyEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a handle change, before the change\n   * is performed on the account store. Only triggered with authenticated\n   * sessions, so the `account` is always available.\n   */\n  onUpdateHandle?: (data: {\n    input: UpdateHandleData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user successfully changed their handle on the\n   * account store.\n   */\n  onUpdatedHandle?: (data: {\n    input: UpdateHandleData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests account deactivation, before the\n   * account is deactivated on the account store.\n   */\n  onDeactivateAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user successfully deactivated their account on\n   * the account store.\n   */\n  onDeactivatedAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests account reactivation, before the\n   * account is reactivated on the account store.\n   */\n  onReactivateAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user successfully reactivated their account on\n   * the account store.\n   */\n  onReactivatedAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests account deletion, before the\n   * confirmation email is dispatched on the account store.\n   */\n  onDeleteAccountRequest?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user has requested account deletion and the\n   * confirmation email has been dispatched.\n   */\n  onDeleteAccountRequested?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms account deletion, before the\n   * account is actually deleted on the account store.\n   */\n  onDeleteAccountConfirm?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user has successfully deleted their account\n   * on the account store.\n   */\n  onDeleteAccountConfirmed?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n    input: DeleteAccountConfirmInput\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user attempts to sign up, after every validation\n   * has passed (including hcaptcha).\n   */\n  onSignUpAttempt?: (data: {\n    input: SignUpInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user attempts to sign up, after the hcaptcha\n   * `/siteverify` request has been made (and before the result is validated).\n   */\n  onHcaptchaResult?: (data: {\n    input: SignUpInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    tokens: HcaptchaClientTokens\n    result: HcaptchaVerifyResult\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a password reset, before the\n   * reset password request is triggered on the account store. Use this to\n   * potentially cancel the password reset.\n   */\n  onResetPasswordRequest?: (data: {\n    input: ResetPasswordRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a password reset, before the\n   * reset password request is triggered on the account store. If not account\n   * was found for the provided identifier, the `account` field will be `null`.\n   */\n  onResetPasswordRequested?: (data: {\n    input: ResetPasswordRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account | null\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms a password reset, before the\n   * password is actually reset on the account store.\n   */\n  onResetPasswordConfirm?: (data: {\n    input: ResetPasswordConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user confirms a password reset, and the\n   * password was successfully reset on the account store.\n   */\n  onResetPasswordConfirmed?: (data: {\n    input: ResetPasswordConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user successfully signs up.\n   *\n   * @throws {AccessDeniedError} to deny the sign-up\n   */\n  onSignedUp?: (data: {\n    data: SignUpData\n    account: Account\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request (i.e. the user is logging in to approve a\n   * client); it is omitted for first-party sign-ins that happen outside any\n   * authorization flow.\n   */\n  onSignInAttempt?: (data: {\n    data: SignInData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId?: ClientId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user successfully signs in.\n   *\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request; see {@link OAuthHooks.onSignInAttempt}.\n   *\n   * @throws {InvalidRequestError} when the sing-in should be denied\n   */\n  onSignedIn?: (data: {\n    data: SignInData\n    account: Account\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId?: ClientId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a sign-in attempt is rejected by the account\n   * store due to invalid credentials (e.g. unknown identifier, wrong\n   * password). It is *not* called for unexpected server errors, nor for flows\n   * that require an additional authentication factor.\n   *\n   * `sub` is populated when the store throws an\n   * {@link InvalidCredentialsError} that carries the matched subject\n   * identifier (i.e. identifier known, credentials wrong). It is `null` when\n   * the identifier was unknown or when the store threw a plain\n   * {@link InvalidRequestError} without distinguishing the two cases.\n   *\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request; see {@link OAuthHooks.onSignInAttempt}.\n   *\n   * Errors thrown from this hook are caught and ignored so that they do not\n   * mask the original authentication failure.\n   */\n  onSignInFailed?: (data: {\n    data: SignInData\n    error: InvalidRequestError\n    did: Did | null\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId?: ClientId\n  }) => Awaitable<void>\n\n  /**\n   * Allows validating an authorization request (typically the requested scopes)\n   * before it is created. Note that the validity against the client metadata is\n   * already enforced by the OAuth provider.\n   *\n   * @throws {AuthorizationError}\n   */\n  onAuthorizationRequest?: (data: {\n    client: Client\n    clientAuth: null | ClientAuth\n    parameters: Readonly<OAuthAuthorizationRequestParameters>\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a client is authorized.\n   *\n   * @throws {AuthorizationError} to deny the authorization request and redirect\n   * the user to the client with an OAuth error (other errors will result in an\n   * internal server error being displayed to the user)\n   *\n   * @note We use `deviceMetadata` instead of `clientMetadata` to make it clear\n   * that this metadata is from the user device, which might be different from\n   * the client metadata (because the OAuth client could live in a backend).\n   */\n  onAuthorized?: (data: {\n    client: Client\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    requestId: RequestId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called whenever a token is about to be created. You can use\n   * it to modify the token claims or perform additional validation.\n   *\n   * This hook should never throw an error.\n   */\n  onCreateToken?: (data: {\n    client: Client\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n    claims: TokenClaims\n  }) => Awaitable<void | OmitKey<AccessTokenPayload, 'iss'>>\n\n  /**\n   * This hook is called whenever a token was just decoded, and basic validation\n   * was performed (signature, expiration, not-before).\n   *\n   * It can be used to modify the payload (e.g., to add custom claims), or to\n   * perform additional validation.\n   *\n   * This hook is called when authenticating requests through the\n   * `authenticateRequest()` method in `OAuthVerifier` and `OAuthProvider`.\n   *\n   * Any error thrown here will be propagated.\n   */\n  onDecodeToken?: (data: {\n    tokenType: OAuthTokenType\n    token: OAuthAccessToken\n    payload: AccessTokenPayload\n    dpopProof: null | DpopProof\n  }) => Promise<AccessTokenPayload | void>\n\n  /**\n   * This hook is called when an authorized client exchanges an authorization\n   * code for an access token.\n   *\n   * @throws {OAuthError} to cancel the token creation and revoke the session\n   */\n  onTokenCreated?: (data: {\n    client: Client\n    clientAuth: ClientAuth\n    clientMetadata: RequestMetadata\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when an authorized client refreshes an access token.\n   *\n   * @throws {OAuthError} to cancel the token refresh and revoke the session\n   */\n  onTokenRefreshed?: (data: {\n    client: Client\n    clientAuth: ClientAuth\n    clientMetadata: RequestMetadata\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n  }) => Awaitable<void>\n}\n"]}

package/dist/oauth-middleware.d.ts

@@ -1,8 +1,8 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { Handler } from './lib/http/types.js';
-import { OAuthProvider } from './oauth-provider.js';
-import { ErrorHandler } from './router/error-handler.js';
-import { MiddlewareOptions } from './router/middleware-options.js';
+import type { Handler } from './lib/http/types.js';
+import type { OAuthProvider } from './oauth-provider.js';
+import type { ErrorHandler } from './router/error-handler.js';
+import type { MiddlewareOptions } from './router/middleware-options.js';
 export type { ErrorHandler, Handler, IncomingMessage, MiddlewareOptions, ServerResponse, };
 /**
  * @returns An http request handler that can be used with node's http server

package/dist/oauth-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-middleware.d.ts","sourceRoot":"","sources":["../src/oauth-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAMnD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAGlE,YAAY,EACV,YAAY,EACZ,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,cAAc,GACf,CAAA;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAE3C,MAAM,EAAE,aAAa,EACrB,EAAE,GAAG,OAAO,EAAE,GAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAM,GAC/C,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAqBzB"}
+{"version":3,"file":"oauth-middleware.d.ts","sourceRoot":"","sources":["../src/oauth-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAMxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAGvE,YAAY,EACV,YAAY,EACZ,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,cAAc,GACf,CAAA;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAE3C,MAAM,EAAE,aAAa,EACrB,EAAE,GAAG,OAAO,EAAE,GAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAM,GAC/C,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAqBzB"}

package/dist/oauth-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-middleware.js","sourceRoot":"","sources":["../src/oauth-middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAGxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAA;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvE,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAA;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAA;AAa3E;;;GAGG;AACH,MAAM,UAAU,eAAe,CAI7B,MAAqB,EACrB,EAAE,GAAG,OAAO,EAAE,GAAgC,EAAE;IAEhD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,sDAAsD;IACtD,OAAO,CAAC,OAAO;QACb,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,aAAa;YACvC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBACrB,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,IAAI,EAAE,GAAG,CAAC,CAAA;gBACnD,OAAO,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACtC,CAAC;YACH,CAAC,CAAC,OAAO,CAAA;IAEb,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACpC,gBAAgB;QAChB,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC;QACtC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC;QACpC,iCAAiC,CAAC,MAAM,EAAE,OAAO,CAAC;QAClD,2BAA2B,CAAC,MAAM,EAAE,OAAO,CAAC;KAC7C,CAAC,CAAA;IAEF,OAAO,SAAS,CAAC,UAAU,CAAC,CAAA;AAC9B,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport { asHandler, combineMiddlewares } from './lib/http/middleware.js'\nimport { Handler } from './lib/http/types.js'\nimport { OAuthProvider } from './oauth-provider.js'\nimport { assetsMiddleware } from './router/assets/assets.js'\nimport { createAccountPageMiddleware } from './router/create-account-page-middleware.js'\nimport { createApiMiddleware } from './router/create-api-middleware.js'\nimport { createAuthorizationPageMiddleware } from './router/create-authorization-page-middleware.js'\nimport { createOAuthMiddleware } from './router/create-oauth-middleware.js'\nimport { ErrorHandler } from './router/error-handler.js'\nimport { MiddlewareOptions } from './router/middleware-options.js'\n\n// Export all the types exposed\nexport type {\n  ErrorHandler,\n  Handler,\n  IncomingMessage,\n  MiddlewareOptions,\n  ServerResponse,\n}\n\n/**\n * @returns An http request handler that can be used with node's http server\n * or as a middleware with express / connect.\n */\nexport function oauthMiddleware<\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { ...options }: MiddlewareOptions<Req, Res> = {},\n): Handler<void, Req, Res> {\n  const { onError } = options\n\n  // options is shallow cloned so it's fine to mutate it\n  options.onError =\n    process.env['NODE_ENV'] === 'development'\n      ? (req, res, err, msg) => {\n          console.error(`OAuthProvider error (${msg}):`, err)\n          return onError?.(req, res, err, msg)\n        }\n      : onError\n\n  const middleware = combineMiddlewares([\n    assetsMiddleware,\n    createOAuthMiddleware(server, options),\n    createApiMiddleware(server, options),\n    createAuthorizationPageMiddleware(server, options),\n    createAccountPageMiddleware(server, options),\n  ])\n\n  return asHandler(middleware)\n}\n"]}
+{"version":3,"file":"oauth-middleware.js","sourceRoot":"","sources":["../src/oauth-middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAGxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAA;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvE,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAA;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAA;AAa3E;;;GAGG;AACH,MAAM,UAAU,eAAe,CAI7B,MAAqB,EACrB,EAAE,GAAG,OAAO,EAAE,GAAgC,EAAE;IAEhD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,sDAAsD;IACtD,OAAO,CAAC,OAAO;QACb,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,aAAa;YACvC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBACrB,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,IAAI,EAAE,GAAG,CAAC,CAAA;gBACnD,OAAO,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACtC,CAAC;YACH,CAAC,CAAC,OAAO,CAAA;IAEb,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACpC,gBAAgB;QAChB,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC;QACtC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC;QACpC,iCAAiC,CAAC,MAAM,EAAE,OAAO,CAAC;QAClD,2BAA2B,CAAC,MAAM,EAAE,OAAO,CAAC;KAC7C,CAAC,CAAA;IAEF,OAAO,SAAS,CAAC,UAAU,CAAC,CAAA;AAC9B,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport { asHandler, combineMiddlewares } from './lib/http/middleware.js'\nimport type { Handler } from './lib/http/types.js'\nimport type { OAuthProvider } from './oauth-provider.js'\nimport { assetsMiddleware } from './router/assets/assets.js'\nimport { createAccountPageMiddleware } from './router/create-account-page-middleware.js'\nimport { createApiMiddleware } from './router/create-api-middleware.js'\nimport { createAuthorizationPageMiddleware } from './router/create-authorization-page-middleware.js'\nimport { createOAuthMiddleware } from './router/create-oauth-middleware.js'\nimport type { ErrorHandler } from './router/error-handler.js'\nimport type { MiddlewareOptions } from './router/middleware-options.js'\n\n// Export all the types exposed\nexport type {\n  ErrorHandler,\n  Handler,\n  IncomingMessage,\n  MiddlewareOptions,\n  ServerResponse,\n}\n\n/**\n * @returns An http request handler that can be used with node's http server\n * or as a middleware with express / connect.\n */\nexport function oauthMiddleware<\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { ...options }: MiddlewareOptions<Req, Res> = {},\n): Handler<void, Req, Res> {\n  const { onError } = options\n\n  // options is shallow cloned so it's fine to mutate it\n  options.onError =\n    process.env['NODE_ENV'] === 'development'\n      ? (req, res, err, msg) => {\n          console.error(`OAuthProvider error (${msg}):`, err)\n          return onError?.(req, res, err, msg)\n        }\n      : onError\n\n  const middleware = combineMiddlewares([\n    assetsMiddleware,\n    createOAuthMiddleware(server, options),\n    createApiMiddleware(server, options),\n    createAuthorizationPageMiddleware(server, options),\n    createAccountPageMiddleware(server, options),\n  ])\n\n  return asHandler(middleware)\n}\n"]}

package/dist/oauth-provider.d.ts

@@ -1,41 +1,51 @@
 import type { Redis, RedisOptions } from 'ioredis';
-import { Jwks, Keyset } from '@atproto/jwk';
+import type { Jwks } from '@atproto/jwk';
 import { LexResolver } from '@atproto/lex-resolver';
-import { OAuthAccessToken, OAuthAuthorizationCodeGrantTokenRequest, OAuthAuthorizationRequestJar, OAuthAuthorizationRequestPar, OAuthAuthorizationRequestParameters, OAuthAuthorizationRequestQuery, OAuthAuthorizationServerMetadata, OAuthClientCredentials, OAuthClientMetadata, OAuthParResponse, OAuthRefreshTokenGrantTokenRequest, OAuthTokenIdentification, OAuthTokenRequest, OAuthTokenResponse, OAuthTokenType } from '@atproto/oauth-types';
-import { SimpleStore } from '@atproto-labs/simple-store';
+import { type OAuthAccessToken, type OAuthAuthorizationCodeGrantTokenRequest, type OAuthAuthorizationRequestJar, type OAuthAuthorizationRequestPar, type OAuthAuthorizationRequestParameters, type OAuthAuthorizationRequestQuery, type OAuthAuthorizationServerMetadata, type OAuthClientCredentials, type OAuthClientMetadata, type OAuthParResponse, type OAuthRefreshTokenGrantTokenRequest, type OAuthTokenIdentification, type OAuthTokenRequest, type OAuthTokenResponse, type OAuthTokenType } from '@atproto/oauth-types';
+import type { SimpleStore } from '@atproto-labs/simple-store';
 import { AccessTokenMode } from './access-token/access-token-mode.js';
 import { AccountManager } from './account/account-manager.js';
-import { AccountStore, AuthorizedClientData, DeviceAccount } from './account/account-store.js';
-import { ClientAuth, ClientAuthLegacy } from './client/client-auth.js';
-import { ClientId } from './client/client-id.js';
-import { ClientManager, LoopbackMetadataGetter } from './client/client-manager.js';
-import { ClientStore } from './client/client-store.js';
-import { Client } from './client/client.js';
-import { Branding, BrandingInput } from './customization/branding.js';
-import { Customization, CustomizationInput } from './customization/customization.js';
-import { DeviceInfo, DeviceManager, DeviceManagerOptions } from './device/device-manager.js';
-import { DeviceStore } from './device/device-store.js';
+import { type AccountStore, type AuthorizedClientData, type DeviceAccount } from './account/account-store.js';
+import type { ClientAuth, ClientAuthLegacy } from './client/client-auth.js';
+import type { ClientId } from './client/client-id.js';
+import { ClientManager, type LoopbackMetadataGetter } from './client/client-manager.js';
+import { type ClientStore } from './client/client-store.js';
+import type { Client } from './client/client.js';
+import type { Branding, BrandingConfig } from './customization/branding.js';
+import { type Customization, type CustomizationConfig } from './customization/customization.js';
+import { type DeviceInfo, DeviceManager, type DeviceManagerOptions } from './device/device-manager.js';
+import { type DeviceStore } from './device/device-store.js';
 import { LexiconManager } from './lexicon/lexicon-manager.js';
-import { LexiconStore } from './lexicon/lexicon-store.js';
-import { HcaptchaConfig } from './lib/hcaptcha.js';
-import { RequestMetadata } from './lib/http/request.js';
-import { MultiLangString } from './lib/util/locale.js';
-import { CustomMetadata } from './metadata/build-metadata.js';
-import { OAuthHooks } from './oauth-hooks.js';
-import { DpopProof, OAuthVerifier, OAuthVerifierOptions, VerifyTokenPayloadOptions } from './oauth-verifier.js';
-import { ReplayStore } from './replay/replay-store.js';
+import { type LexiconStore } from './lexicon/lexicon-store.js';
+import type { HcaptchaConfig } from './lib/hcaptcha.js';
+import type { RequestMetadata } from './lib/http/request.js';
+import type { MultiLangString } from './lib/util/locale.js';
+import { type CustomMetadata } from './metadata/build-metadata.js';
+import type { OAuthHooks } from './oauth-hooks.js';
+import { type DpopProof, OAuthVerifier, type OAuthVerifierOptions, type VerifyTokenPayloadOptions } from './oauth-verifier.js';
+import { type ReplayStore } from './replay/replay-store.js';
 import { RequestManager } from './request/request-manager.js';
-import { RequestStore } from './request/request-store.js';
-import { AuthorizationRedirectParameters } from './result/authorization-redirect-parameters.js';
-import { AuthorizationResultAuthorizePage } from './result/authorization-result-authorize-page.js';
-import { AuthorizationResultRedirect } from './result/authorization-result-redirect.js';
-import { ErrorHandler } from './router/error-handler.js';
-import { AccessTokenPayload } from './signer/access-token-payload.js';
-import { TokenData } from './token/token-data.js';
+import { type RequestStore } from './request/request-store.js';
+import type { AuthorizationRedirectParameters } from './result/authorization-redirect-parameters.js';
+import type { AuthorizationResultAuthorizePage } from './result/authorization-result-authorize-page.js';
+import type { AuthorizationResultRedirect } from './result/authorization-result-redirect.js';
+import type { ErrorHandler } from './router/error-handler.js';
+import type { AccessTokenPayload } from './signer/access-token-payload.js';
+import type { TokenData } from './token/token-data.js';
 import { TokenManager } from './token/token-manager.js';
-import { TokenStore } from './token/token-store.js';
-export { AccessTokenMode, Keyset, LexResolver };
-export type { AccessTokenPayload, AuthorizationRedirectParameters, AuthorizationResultAuthorizePage as AuthorizationResultAuthorize, AuthorizationResultRedirect, Branding, BrandingInput, CustomMetadata, Customization, CustomizationInput, ErrorHandler, HcaptchaConfig, MultiLangString, OAuthAuthorizationServerMetadata, VerifyTokenPayloadOptions, };
+import { type TokenStore } from './token/token-store.js';
+export { safeFetchWrap } from '@atproto-labs/fetch-node';
+export type * from '@atproto/jwk';
+export { Keyset } from '@atproto/jwk';
+export type * from '@atproto/jwk-jose';
+export { JoseKey } from '@atproto/jwk-jose';
+export type * from '@atproto/lex-resolver';
+export { LexResolver } from '@atproto/lex-resolver';
+export { AccessTokenMode };
+export type { AccessTokenPayload, AuthorizationRedirectParameters, AuthorizationResultAuthorizePage as AuthorizationResultAuthorize, AuthorizationResultRedirect, Branding, BrandingConfig, CustomMetadata, Customization, CustomizationConfig, ErrorHandler, HcaptchaConfig, LoopbackMetadataGetter, MultiLangString, OAuthAuthorizationServerMetadata, VerifyTokenPayloadOptions, };
+export type ClientJwksCache = SimpleStore<string, Jwks>;
+export type ClientMetadataCache = SimpleStore<string, OAuthClientMetadata>;
+export type OAuthStore = AccountStore & ClientStore & DeviceStore & LexiconStore & ReplayStore & RequestStore & TokenStore;
 type OAuthProviderConfig = {
     /**
      * Maximum age a device/account session can be before requiring
@@ -89,7 +99,7 @@ type OAuthProviderConfig = {
      * this store implements all the interfaces not provided in the other
      * `<name>Store` options.
      */
-    store?: Partial<AccountStore & ClientStore & DeviceStore & LexiconStore & ReplayStore & RequestStore & TokenStore>;
+    store?: Partial<OAuthStore>;
     accountStore?: AccountStore;
     clientStore?: ClientStore;
     deviceStore?: DeviceStore;
@@ -103,14 +113,14 @@ type OAuthProviderConfig = {
      *
      * @note the cached entries should automatically expire after a certain time (typically 10 minutes)
      */
-    clientJwksCache?: SimpleStore<string, Jwks>;
+    clientJwksCache?: ClientJwksCache;
     /**
      * In order to speed up the client fetching process, you can provide a cache
      * to store HTTP responses.
      *
      * @note the cached entries should automatically expire after a certain time (typically 10 minutes)
      */
-    clientMetadataCache?: SimpleStore<string, OAuthClientMetadata>;
+    clientMetadataCache?: ClientMetadataCache;
     /**
      * In order to enable loopback clients, you can provide a function that
      * returns the client metadata for a given loopback URL. This is useful for
@@ -121,7 +131,7 @@ type OAuthProviderConfig = {
      */
     loopbackMetadata?: null | false | LoopbackMetadataGetter;
 };
-export type OAuthProviderOptions = OAuthProviderConfig & OAuthVerifierOptions & OAuthHooks & DeviceManagerOptions & CustomizationInput;
+export type OAuthProviderOptions = OAuthProviderConfig & OAuthVerifierOptions & OAuthHooks & DeviceManagerOptions & CustomizationConfig;
 export declare class OAuthProvider extends OAuthVerifier {
     protected readonly accessTokenMode: AccessTokenMode;
     protected readonly hooks: OAuthHooks;
@@ -134,8 +144,7 @@ export declare class OAuthProvider extends OAuthVerifier {
     readonly lexiconManager: LexiconManager;
     readonly requestManager: RequestManager;
     readonly tokenManager: TokenManager;
-    constructor({ authenticationMaxAge, tokenMaxAge, accessTokenMode, metadata, safeFetch, store, // compound store implementation
-    lexResolver, accountStore, deviceStore, lexiconStore, tokenStore, requestStore, clientStore, replayStore, clientJwksCache, clientMetadataCache, loopbackMetadata, ...rest }: OAuthProviderOptions);
+    constructor({ authenticationMaxAge, tokenMaxAge, accessTokenMode, metadata, loopbackMetadata, safeFetch, lexResolver, store, accountStore, deviceStore, lexiconStore, tokenStore, requestStore, clientStore, replayStore, clientJwksCache, clientMetadataCache, ...rest }: OAuthProviderOptions);
     get jwks(): Readonly<{
         keys: readonly (Readonly<{
             kid?: string | undefined;

package/dist/oauth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,OAAO,EAEL,gBAAgB,EAChB,uCAAuC,EACvC,4BAA4B,EAC5B,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,kCAAkC,EAClC,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EAGf,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,aAAa,EAEd,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EACL,aAAa,EACb,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAS3C,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EACL,aAAa,EACb,kBAAkB,EAEnB,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EACL,UAAU,EACV,aAAa,EACb,oBAAoB,EACrB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AASrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAGvD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAiB,MAAM,8BAA8B,CAAA;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EACL,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAErE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AAEzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAA;AAC/F,OAAO,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAA;AAClG,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAA;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EACL,UAAU,EAGX,MAAM,wBAAwB,CAAA;AAG/B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAC/C,YAAY,EACV,kBAAkB,EAClB,+BAA+B,EAC/B,gCAAgC,IAAI,4BAA4B,EAChE,2BAA2B,EAC3B,QAAQ,EACR,aAAa,EACb,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,gCAAgC,EAChC,yBAAyB,GAC1B,CAAA;AAED,KAAK,mBAAmB,GAAG;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;OAEG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAEnC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,MAAM,CAAA;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CACb,YAAY,GACV,WAAW,GACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,UAAU,CACb,CAAA;IAED,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,UAAU,CAAC,EAAE,UAAU,CAAA;IAEvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAE3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,sBAAsB,CAAA;CACzD,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GACpD,oBAAoB,GACpB,UAAU,GACV,oBAAoB,GACpB,kBAAkB,CAAA;AAEpB,qBAAa,aAAc,SAAQ,aAAa;IAC9C,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACnD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAEpC,SAAgB,QAAQ,EAAE,gCAAgC,CAAA;IAC1D,SAAgB,aAAa,EAAE,aAAa,CAAA;IAE5C,SAAgB,oBAAoB,EAAE,MAAM,CAAA;IAE5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,YAAY,EAAE,YAAY,CAAA;IAE1C,YAAmB,EAEjB,oBAA6C,EAC7C,WAA2B,EAC3B,eAA2C,EAE3C,QAAQ,EAER,SAA2B,EAC3B,KAAK,EAAE,gCAAgC;IACvC,WAAmD,EAGnD,YAAoC,EACpC,WAAkC,EAClC,YAAoC,EACpC,UAAgC,EAChC,YAAoC,EAGpC,WAAkC,EAClC,WAAkC,EAElC,eAGE,EACF,mBAGE,EAEF,gBAAgD,EAMhD,GAAG,IAAI,EACR,EAAE,oBAAoB,EA0DtB;IAED,IAAI,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAEP;IAED;;OAEG;IACI,oBAAoB,CACzB,UAAU,EAAE,mCAAmC,EAC/C,UAAU,CAAC,EAAE,oBAAoB,WAelC;IAEM,kBAAkB,CAAC,aAAa,EAAE,aAAa,WAGrD;IAED,UAAgB,kBAAkB,CAChC,iBAAiB,EAAE,sBAAsB,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,CAAC,EAAE;QACR,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAChC,GACA,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;KACvB,CAAC,CA8CD;IAEK,SAAS,CACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,mCAAmC,CAAC,CAwB9C;IAED;;OAEG;IACU,0BAA0B,CACrC,WAAW,EAAE,sBAAsB,EACnC,oBAAoB,EAAE,4BAA4B,EAClD,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CA8D3B;YAEa,2BAA2B;IA6CzC;;OAEG;IACU,SAAS,CACpB,KAAK,EAAE,8BAA8B,EACrC,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,UAAU,GACvC,OAAO,CAAC,2BAA2B,GAAG,gCAAgC,CAAC,CAsJzE;IAEY,KAAK,CAChB,iBAAiB,EAAE,sBAAsB,EACzC,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAyC7B;IAED,UAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,EAAE;QACP,UAAU,EAAE,mCAAmC,CAAA;QAC/C,QAAQ,EAAE,QAAQ,CAAA;QAClB,UAAU,EAAE,IAAI,GAAG,UAAU,GAAG,gBAAgB,CAAA;KACjD,GACA,OAAO,CAAC,IAAI,CAAC,CA6Df;IAED,UAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uCAAuC,EAC9C,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CA6D7B;IAED,UAAgB,iBAAiB,CAC/B,UAAU,EAAE,mCAAmC,EAC/C,KAAK,EAAE,uCAAuC,GAC7C,OAAO,CAAC,IAAI,CAAC,CAiDf;IAED,UAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,kCAAkC,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;IAED,UAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC,CAkBf;IAED;;OAEG;IACU,MAAM,CACjB,iBAAiB,EAAE,sBAAsB,EACzC,EAAE,KAAK,EAAE,EAAE,wBAAwB,EACnC,SAAS,EAAE,IAAI,GAAG,SAAS,iBAqB5B;IAED,UAAyB,WAAW,CAClC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAkB7B;CACF"}
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,uCAAuC,EAC5C,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,mCAAmC,EACxC,KAAK,8BAA8B,EACnC,KAAK,gCAAgC,EACrC,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,kCAAkC,EACvC,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EAGpB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAEnB,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EACL,aAAa,EACb,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,KAAK,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC3E,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,mBAAmB,EAEzB,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EACL,KAAK,UAAU,EACf,aAAa,EACb,KAAK,oBAAoB,EAC1B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,KAAK,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAS1E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAG5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,8BAA8B,CAAA;AASrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EACL,KAAK,SAAS,EACd,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC/B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,KAAK,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AAE9E,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAA;AACpG,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAA;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAA;AAC5F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAE1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,wBAAwB,CAAA;AAKtE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,mBAAmB,cAAc,CAAA;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,mBAAmB,mBAAmB,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,mBAAmB,uBAAuB,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,OAAO,EAAE,eAAe,EAAE,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,+BAA+B,EAC/B,gCAAgC,IAAI,4BAA4B,EAChE,2BAA2B,EAC3B,QAAQ,EACR,cAAc,EACd,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,GAC1B,CAAA;AAED,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AACvD,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;AAC1E,MAAM,MAAM,UAAU,GAAG,YAAY,GACnC,WAAW,GACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,UAAU,CAAA;AAEZ,KAAK,mBAAmB,GAAG;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;OAEG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAEnC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,MAAM,CAAA;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAE3B,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,UAAU,CAAC,EAAE,UAAU,CAAA;IAEvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IAEzC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,sBAAsB,CAAA;CACzD,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GACpD,oBAAoB,GACpB,UAAU,GACV,oBAAoB,GACpB,mBAAmB,CAAA;AAErB,qBAAa,aAAc,SAAQ,aAAa;IAC9C,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACnD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAEpC,SAAgB,QAAQ,EAAE,gCAAgC,CAAA;IAC1D,SAAgB,aAAa,EAAE,aAAa,CAAA;IAE5C,SAAgB,oBAAoB,EAAE,MAAM,CAAA;IAE5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,YAAY,EAAE,YAAY,CAAA;IAE1C,YAAmB,EAEjB,oBAA6C,EAC7C,WAA2B,EAC3B,eAA2C,EAE3C,QAAQ,EACR,gBAAgD,EAGhD,SAA2B,EAC3B,WAAmD,EAGnD,KAAK,EAGL,YAAoC,EACpC,WAAkC,EAClC,YAAoC,EACpC,UAAgC,EAChC,YAAoC,EAGpC,WAAkC,EAClC,WAAkC,EAElC,eAGE,EACF,mBAGE,EAMF,GAAG,IAAI,EACR,EAAE,oBAAoB,EA0DtB;IAED,IAAI,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAEP;IAED;;OAEG;IACI,oBAAoB,CACzB,UAAU,EAAE,mCAAmC,EAC/C,UAAU,CAAC,EAAE,oBAAoB,WAelC;IAEM,kBAAkB,CAAC,aAAa,EAAE,aAAa,WAGrD;IAED,UAAgB,kBAAkB,CAChC,iBAAiB,EAAE,sBAAsB,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,CAAC,EAAE;QACR,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAChC,GACA,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;KACvB,CAAC,CA8CD;IAEK,SAAS,CACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,mCAAmC,CAAC,CAwB9C;IAED;;OAEG;IACU,0BAA0B,CACrC,WAAW,EAAE,sBAAsB,EACnC,oBAAoB,EAAE,4BAA4B,EAClD,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CA8D3B;YAEa,2BAA2B;IA6CzC;;OAEG;IACU,SAAS,CACpB,KAAK,EAAE,8BAA8B,EACrC,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,UAAU,GACvC,OAAO,CAAC,2BAA2B,GAAG,gCAAgC,CAAC,CAsJzE;IAEY,KAAK,CAChB,iBAAiB,EAAE,sBAAsB,EACzC,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAyC7B;IAED,UAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,EAAE;QACP,UAAU,EAAE,mCAAmC,CAAA;QAC/C,QAAQ,EAAE,QAAQ,CAAA;QAClB,UAAU,EAAE,IAAI,GAAG,UAAU,GAAG,gBAAgB,CAAA;KACjD,GACA,OAAO,CAAC,IAAI,CAAC,CA6Df;IAED,UAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uCAAuC,EAC9C,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CA6D7B;IAED,UAAgB,iBAAiB,CAC/B,UAAU,EAAE,mCAAmC,EAC/C,KAAK,EAAE,uCAAuC,GAC7C,OAAO,CAAC,IAAI,CAAC,CAiDf;IAED,UAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,kCAAkC,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;IAED,UAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC,CAkBf;IAED;;OAEG;IACU,MAAM,CACjB,iBAAiB,EAAE,sBAAsB,EACzC,EAAE,KAAK,EAAE,EAAE,wBAAwB,EACnC,SAAS,EAAE,IAAI,GAAG,SAAS,iBAqB5B;IAED,UAAyB,WAAW,CAClC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAkB7B;CACF"}

package/dist/oauth-provider.js

@@ -1,5 +1,4 @@
 import { createHash } from 'node:crypto';
-import { Keyset } from '@atproto/jwk';
 import { LexResolver } from '@atproto/lex-resolver';
 import { CLIENT_ASSERTION_TYPE_JWT_BEARER, atprotoLoopbackClientMetadata, oauthAuthorizationRequestParametersSchema, } from '@atproto/oauth-types';
 import { safeFetchWrap } from '@atproto-labs/fetch-node';
@@ -9,7 +8,6 @@ import { AccountManager } from './account/account-manager.js';
 import { asAccountStore, } from './account/account-store.js';
 import { ClientManager, } from './client/client-manager.js';
 import { ifClientStore } from './client/client-store.js';
-import { AUTHENTICATION_MAX_AGE, CONFIDENTIAL_CLIENT_REFRESH_LIFETIME, CONFIDENTIAL_CLIENT_SESSION_LIFETIME, PUBLIC_CLIENT_REFRESH_LIFETIME, PUBLIC_CLIENT_SESSION_LIFETIME, TOKEN_MAX_AGE, } from './constants.js';
 import { customizationSchema, } from './customization/customization.js';
 import { DeviceManager, } from './device/device-manager.js';
 import { asDeviceStore } from './device/device-store.js';
@@ -25,22 +23,33 @@ import { LexiconManager } from './lexicon/lexicon-manager.js';
 import { asLexiconStore } from './lexicon/lexicon-store.js';
 import { dateToRelativeSeconds } from './lib/util/date.js';
 import { formatError } from './lib/util/error.js';
-import { buildMetadata } from './metadata/build-metadata.js';
+import { buildMetadata, } from './metadata/build-metadata.js';
+import { AUTHENTICATION_MAX_AGE, CONFIDENTIAL_CLIENT_REFRESH_LIFETIME, CONFIDENTIAL_CLIENT_SESSION_LIFETIME, PUBLIC_CLIENT_REFRESH_LIFETIME, PUBLIC_CLIENT_SESSION_LIFETIME, TOKEN_MAX_AGE, } from './oauth-constants.js';
 import { OAuthVerifier, } from './oauth-verifier.js';
 import { ifReplayStore } from './replay/replay-store.js';
 import { codeSchema } from './request/code.js';
 import { RequestManager } from './request/request-manager.js';
 import { asRequestStore } from './request/request-store.js';
 import { parseRequestUri } from './request/request-uri.js';
+import { refreshTokenSchema } from './token/refresh-token.js';
 import { TokenManager } from './token/token-manager.js';
-import { asTokenStore, refreshTokenSchema, } from './token/token-store.js';
+import { asTokenStore } from './token/token-store.js';
 import { isPARResponseError } from './types/par-response-error.js';
-export { AccessTokenMode, Keyset, LexResolver };
+// Re-export dependencies that are part of the public API of this package, so
+// that consumers don't have to install them separately.
+export { safeFetchWrap } from '@atproto-labs/fetch-node';
+export { Keyset } from '@atproto/jwk';
+export { JoseKey } from '@atproto/jwk-jose';
+export { LexResolver } from '@atproto/lex-resolver';
+export { AccessTokenMode };
 export class OAuthProvider extends OAuthVerifier {
     constructor({ 
     // OAuthProviderConfig
-    authenticationMaxAge = AUTHENTICATION_MAX_AGE, tokenMaxAge = TOKEN_MAX_AGE, accessTokenMode = AccessTokenMode.stateless, metadata, safeFetch = safeFetchWrap(), store, // compound store implementation
-    lexResolver = new LexResolver({ fetch: safeFetch }), 
+    authenticationMaxAge = AUTHENTICATION_MAX_AGE, tokenMaxAge = TOKEN_MAX_AGE, accessTokenMode = AccessTokenMode.stateless, metadata, loopbackMetadata = atprotoLoopbackClientMetadata, 
+    // Services
+    safeFetch = safeFetchWrap(), lexResolver = new LexResolver({ fetch: safeFetch }), 
+    // compound store implementation
+    store, 
     // Required stores
     accountStore = asAccountStore(store), deviceStore = asDeviceStore(store), lexiconStore = asLexiconStore(store), tokenStore = asTokenStore(store), requestStore = asRequestStore(store), 
     // Optional stores
@@ -50,7 +59,7 @@ export class OAuthProvider extends OAuthVerifier {
     }), clientMetadataCache = new SimpleStoreMemory({
         maxSize: 50_000_000,
         ttl: 600e3,
-    }), loopbackMetadata = atprotoLoopbackClientMetadata, 
+    }), 
     // OAuthHooks &
     // OAuthVerifierOptions &
     // DeviceManagerOptions &