@atproto/oauth-provider 0.19.9 → 0.20.1

package/dist/router/assets/send-account-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"send-account-page.js","sourceRoot":"","sources":["../../../src/router/assets/send-account-page.ts"],"names":[],"mappings":"AAGA,OAAO,EAAqB,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAElE,MAAM,UAAU,sBAAsB,CACpC,aAA4B,EAC5B,OAA2B;IAE3B,MAAM,OAAO,GAAG,iBAAiB,CAAC,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAEzE,OAAO,KAAK,UAAU,eAAe,CACnC,GAAoB,EACpB,GAAmB,EACnB,IAEC;QAED,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE;YACvB,IAAI,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,cAAc,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { ActiveDeviceSession } from '@atproto/oauth-provider-api'\nimport { Customization } from '../../customization/customization.js'\nimport { SendWebAppOptions, sendWebAppFactory } from './assets.js'\n\nexport function sendAccountPageFactory(\n  customization: Customization,\n  options?: SendWebAppOptions,\n) {\n  const sendApp = sendWebAppFactory('account-page', customization, options)\n\n  return async function sendAccountPage(\n    req: IncomingMessage,\n    res: ServerResponse,\n    data: {\n      deviceSessions: readonly ActiveDeviceSession[]\n    },\n  ): Promise<void> {\n    return sendApp(req, res, {\n      data: { __deviceSessions: data.deviceSessions },\n    })\n  }\n}\n"]}
+{"version":3,"file":"send-account-page.js","sourceRoot":"","sources":["../../../src/router/assets/send-account-page.ts"],"names":[],"mappings":"AAGA,OAAO,EAA0B,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAEvE,MAAM,UAAU,sBAAsB,CACpC,aAA4B,EAC5B,OAA2B;IAE3B,MAAM,OAAO,GAAG,iBAAiB,CAAC,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAEzE,OAAO,KAAK,UAAU,eAAe,CACnC,GAAoB,EACpB,GAAmB,EACnB,IAEC;QAED,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE;YACvB,IAAI,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,cAAc,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { ActiveDeviceSession } from '@atproto/oauth-provider-api'\nimport type { Customization } from '../../customization/customization.js'\nimport { type SendWebAppOptions, sendWebAppFactory } from './assets.js'\n\nexport function sendAccountPageFactory(\n  customization: Customization,\n  options?: SendWebAppOptions,\n) {\n  const sendApp = sendWebAppFactory('account-page', customization, options)\n\n  return async function sendAccountPage(\n    req: IncomingMessage,\n    res: ServerResponse,\n    data: {\n      deviceSessions: readonly ActiveDeviceSession[]\n    },\n  ): Promise<void> {\n    return sendApp(req, res, {\n      data: { __deviceSessions: data.deviceSessions },\n    })\n  }\n}\n"]}

package/dist/router/assets/send-authorization-page.d.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { Customization } from '../../customization/customization.js';
-import { AuthorizationResultAuthorizePage } from '../../result/authorization-result-authorize-page.js';
-import { SendWebAppOptions } from './assets.js';
+import type { Customization } from '../../customization/customization.js';
+import type { AuthorizationResultAuthorizePage } from '../../result/authorization-result-authorize-page.js';
+import { type SendWebAppOptions } from './assets.js';
 export declare function sendAuthorizePageFactory(customization: Customization, options?: SendWebAppOptions): (req: IncomingMessage, res: ServerResponse, data: AuthorizationResultAuthorizePage) => Promise<void>;
 //# sourceMappingURL=send-authorization-page.d.ts.map

package/dist/router/assets/send-authorization-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"send-authorization-page.d.ts","sourceRoot":"","sources":["../../../src/router/assets/send-authorization-page.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAA;AACtG,OAAO,EAAE,iBAAiB,EAAqB,MAAM,aAAa,CAAA;AAElE,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,aAAa,EAC5B,OAAO,CAAC,EAAE,iBAAiB,SASpB,eAAe,OACf,cAAc,QACb,gCAAgC,KACrC,OAAO,CAAC,IAAI,CAAC,CAsBjB"}
+{"version":3,"file":"send-authorization-page.d.ts","sourceRoot":"","sources":["../../../src/router/assets/send-authorization-page.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AACzE,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAA;AAC3G,OAAO,EAAE,KAAK,iBAAiB,EAAqB,MAAM,aAAa,CAAA;AAEvE,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,aAAa,EAC5B,OAAO,CAAC,EAAE,iBAAiB,SASpB,eAAe,OACf,cAAc,QACb,gCAAgC,KACrC,OAAO,CAAC,IAAI,CAAC,CAsBjB"}

package/dist/router/assets/send-authorization-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"send-authorization-page.js","sourceRoot":"","sources":["../../../src/router/assets/send-authorization-page.ts"],"names":[],"mappings":"AAGA,OAAO,EAAqB,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAElE,MAAM,UAAU,wBAAwB,CACtC,aAA4B,EAC5B,OAA2B;IAE3B,MAAM,OAAO,GAAG,iBAAiB,CAC/B,oBAAoB,EACpB,aAAa,EACb,OAAO,CACR,CAAA;IAED,OAAO,KAAK,UAAU,iBAAiB,CACrC,GAAoB,EACpB,GAAmB,EACnB,IAAsC;QAEtC,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE;YACvB,IAAI,EAAE;gBACJ,eAAe,EAAE;oBACf,UAAU,EAAE,IAAI,CAAC,UAAU;oBAE3B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;oBACxB,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;oBACpC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS;oBACzC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY;oBAE/C,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;oBAC5B,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU;oBACrC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU;oBACrC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;oBAClC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC;oBACvD,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B;gBACD,UAAU,EAAE,IAAI,CAAC,QAAQ;aAC1B;SACF,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport { Customization } from '../../customization/customization.js'\nimport { AuthorizationResultAuthorizePage } from '../../result/authorization-result-authorize-page.js'\nimport { SendWebAppOptions, sendWebAppFactory } from './assets.js'\n\nexport function sendAuthorizePageFactory(\n  customization: Customization,\n  options?: SendWebAppOptions,\n) {\n  const sendApp = sendWebAppFactory(\n    'authorization-page',\n    customization,\n    options,\n  )\n\n  return async function sendAuthorizePage(\n    req: IncomingMessage,\n    res: ServerResponse,\n    data: AuthorizationResultAuthorizePage,\n  ): Promise<void> {\n    return sendApp(req, res, {\n      data: {\n        __authorizeData: {\n          requestUri: data.requestUri,\n\n          clientId: data.client.id,\n          clientMetadata: data.client.metadata,\n          clientTrusted: data.client.info.isTrusted,\n          clientFirstParty: data.client.info.isFirstParty,\n\n          scope: data.parameters.scope,\n          uiLocales: data.parameters.ui_locales,\n          loginHint: data.parameters.login_hint,\n          promptMode: data.parameters.prompt,\n          permissionSets: Object.fromEntries(data.permissionSets),\n          selectedDid: data.selectedDid,\n        },\n        __sessions: data.sessions,\n      },\n    })\n  }\n}\n"]}
+{"version":3,"file":"send-authorization-page.js","sourceRoot":"","sources":["../../../src/router/assets/send-authorization-page.ts"],"names":[],"mappings":"AAGA,OAAO,EAA0B,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAEvE,MAAM,UAAU,wBAAwB,CACtC,aAA4B,EAC5B,OAA2B;IAE3B,MAAM,OAAO,GAAG,iBAAiB,CAC/B,oBAAoB,EACpB,aAAa,EACb,OAAO,CACR,CAAA;IAED,OAAO,KAAK,UAAU,iBAAiB,CACrC,GAAoB,EACpB,GAAmB,EACnB,IAAsC;QAEtC,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE;YACvB,IAAI,EAAE;gBACJ,eAAe,EAAE;oBACf,UAAU,EAAE,IAAI,CAAC,UAAU;oBAE3B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;oBACxB,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;oBACpC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS;oBACzC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY;oBAE/C,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;oBAC5B,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU;oBACrC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU;oBACrC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;oBAClC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC;oBACvD,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B;gBACD,UAAU,EAAE,IAAI,CAAC,QAAQ;aAC1B;SACF,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Customization } from '../../customization/customization.js'\nimport type { AuthorizationResultAuthorizePage } from '../../result/authorization-result-authorize-page.js'\nimport { type SendWebAppOptions, sendWebAppFactory } from './assets.js'\n\nexport function sendAuthorizePageFactory(\n  customization: Customization,\n  options?: SendWebAppOptions,\n) {\n  const sendApp = sendWebAppFactory(\n    'authorization-page',\n    customization,\n    options,\n  )\n\n  return async function sendAuthorizePage(\n    req: IncomingMessage,\n    res: ServerResponse,\n    data: AuthorizationResultAuthorizePage,\n  ): Promise<void> {\n    return sendApp(req, res, {\n      data: {\n        __authorizeData: {\n          requestUri: data.requestUri,\n\n          clientId: data.client.id,\n          clientMetadata: data.client.metadata,\n          clientTrusted: data.client.info.isTrusted,\n          clientFirstParty: data.client.info.isFirstParty,\n\n          scope: data.parameters.scope,\n          uiLocales: data.parameters.ui_locales,\n          loginHint: data.parameters.login_hint,\n          promptMode: data.parameters.prompt,\n          permissionSets: Object.fromEntries(data.permissionSets),\n          selectedDid: data.selectedDid,\n        },\n        __sessions: data.sessions,\n      },\n    })\n  }\n}\n"]}

package/dist/router/assets/send-cookie-error-page.d.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { Customization } from '../../customization/customization.js';
-import { SendWebAppOptions } from './assets.js';
+import type { Customization } from '../../customization/customization.js';
+import { type SendWebAppOptions } from './assets.js';
 export declare function sendCookieErrorPageFactory(customization: Customization, options?: SendWebAppOptions): (req: IncomingMessage, res: ServerResponse, data: {
     continueUrl: URL;
 }) => Promise<void>;

package/dist/router/assets/send-cookie-error-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"send-cookie-error-page.d.ts","sourceRoot":"","sources":["../../../src/router/assets/send-cookie-error-page.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,aAAa,CAAA;AAElE,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,aAAa,EAC5B,OAAO,CAAC,EAAE,iBAAiB,SAKpB,eAAe,OACf,cAAc,QACb;IAAE,WAAW,EAAE,GAAG,CAAA;CAAE,mBAO7B"}
+{"version":3,"file":"send-cookie-error-page.d.ts","sourceRoot":"","sources":["../../../src/router/assets/send-cookie-error-page.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AACzE,OAAO,EAAE,KAAK,iBAAiB,EAAqB,MAAM,aAAa,CAAA;AAEvE,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,aAAa,EAC5B,OAAO,CAAC,EAAE,iBAAiB,SAKpB,eAAe,OACf,cAAc,QACb;IAAE,WAAW,EAAE,GAAG,CAAA;CAAE,mBAO7B"}

package/dist/router/assets/send-cookie-error-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"send-cookie-error-page.js","sourceRoot":"","sources":["../../../src/router/assets/send-cookie-error-page.ts"],"names":[],"mappings":"AAEA,OAAO,EAAqB,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAElE,MAAM,UAAU,0BAA0B,CACxC,aAA4B,EAC5B,OAA2B;IAE3B,MAAM,OAAO,GAAG,iBAAiB,CAAC,mBAAmB,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAE9E,OAAO,KAAK,UAAU,mBAAmB,CACvC,GAAoB,EACpB,GAAmB,EACnB,IAA0B;QAE1B,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE;YACvB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE;SACrD,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport { Customization } from '../../customization/customization.js'\nimport { SendWebAppOptions, sendWebAppFactory } from './assets.js'\n\nexport function sendCookieErrorPageFactory(\n  customization: Customization,\n  options?: SendWebAppOptions,\n) {\n  const sendApp = sendWebAppFactory('cookie-error-page', customization, options)\n\n  return async function sendCookieErrorPage(\n    req: IncomingMessage,\n    res: ServerResponse,\n    data: { continueUrl: URL },\n  ) {\n    return sendApp(req, res, {\n      status: 400,\n      data: { __continueUrl: data.continueUrl.toString() },\n    })\n  }\n}\n"]}
+{"version":3,"file":"send-cookie-error-page.js","sourceRoot":"","sources":["../../../src/router/assets/send-cookie-error-page.ts"],"names":[],"mappings":"AAEA,OAAO,EAA0B,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAEvE,MAAM,UAAU,0BAA0B,CACxC,aAA4B,EAC5B,OAA2B;IAE3B,MAAM,OAAO,GAAG,iBAAiB,CAAC,mBAAmB,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAE9E,OAAO,KAAK,UAAU,mBAAmB,CACvC,GAAoB,EACpB,GAAmB,EACnB,IAA0B;QAE1B,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE;YACvB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE;SACrD,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Customization } from '../../customization/customization.js'\nimport { type SendWebAppOptions, sendWebAppFactory } from './assets.js'\n\nexport function sendCookieErrorPageFactory(\n  customization: Customization,\n  options?: SendWebAppOptions,\n) {\n  const sendApp = sendWebAppFactory('cookie-error-page', customization, options)\n\n  return async function sendCookieErrorPage(\n    req: IncomingMessage,\n    res: ServerResponse,\n    data: { continueUrl: URL },\n  ) {\n    return sendApp(req, res, {\n      status: 400,\n      data: { __continueUrl: data.continueUrl.toString() },\n    })\n  }\n}\n"]}

package/dist/router/assets/send-error-page.d.ts

@@ -1,5 +1,5 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { Customization } from '../../customization/customization.js';
-import { SendWebAppOptions } from './assets.js';
+import type { Customization } from '../../customization/customization.js';
+import { type SendWebAppOptions } from './assets.js';
 export declare function sendErrorPageFactory(customization: Customization, options?: SendWebAppOptions): (req: IncomingMessage, res: ServerResponse, err: unknown) => Promise<void>;
 //# sourceMappingURL=send-error-page.d.ts.map

package/dist/router/assets/send-error-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"send-error-page.d.ts","sourceRoot":"","sources":["../../../src/router/assets/send-error-page.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AAKpE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,aAAa,CAAA;AAElE,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,aAAa,EAC5B,OAAO,CAAC,EAAE,iBAAiB,SAKpB,eAAe,OACf,cAAc,OACd,OAAO,KACX,OAAO,CAAC,IAAI,CAAC,CAMjB"}
+{"version":3,"file":"send-error-page.d.ts","sourceRoot":"","sources":["../../../src/router/assets/send-error-page.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AAKzE,OAAO,EAAE,KAAK,iBAAiB,EAAqB,MAAM,aAAa,CAAA;AAEvE,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,aAAa,EAC5B,OAAO,CAAC,EAAE,iBAAiB,SAKpB,eAAe,OACf,cAAc,OACd,OAAO,KACX,OAAO,CAAC,IAAI,CAAC,CAMjB"}

package/dist/router/assets/send-error-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"send-error-page.js","sourceRoot":"","sources":["../../../src/router/assets/send-error-page.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAqB,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAElE,MAAM,UAAU,oBAAoB,CAClC,aAA4B,EAC5B,OAA2B;IAE3B,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAEvE,OAAO,KAAK,UAAU,aAAa,CACjC,GAAoB,EACpB,GAAmB,EACnB,GAAY;QAEZ,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE;YACvB,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC;YAC7B,IAAI,EAAE,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE;SAC9C,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport { Customization } from '../../customization/customization.js'\nimport {\n  buildErrorPayload,\n  buildErrorStatus,\n} from '../../errors/error-parser.js'\nimport { SendWebAppOptions, sendWebAppFactory } from './assets.js'\n\nexport function sendErrorPageFactory(\n  customization: Customization,\n  options?: SendWebAppOptions,\n) {\n  const sendApp = sendWebAppFactory('error-page', customization, options)\n\n  return async function sendErrorPage(\n    req: IncomingMessage,\n    res: ServerResponse,\n    err: unknown,\n  ): Promise<void> {\n    return sendApp(req, res, {\n      status: buildErrorStatus(err),\n      data: { __errorData: buildErrorPayload(err) },\n    })\n  }\n}\n"]}
+{"version":3,"file":"send-error-page.js","sourceRoot":"","sources":["../../../src/router/assets/send-error-page.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAA0B,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAEvE,MAAM,UAAU,oBAAoB,CAClC,aAA4B,EAC5B,OAA2B;IAE3B,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAEvE,OAAO,KAAK,UAAU,aAAa,CACjC,GAAoB,EACpB,GAAmB,EACnB,GAAY;QAEZ,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE;YACvB,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC;YAC7B,IAAI,EAAE,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE;SAC9C,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Customization } from '../../customization/customization.js'\nimport {\n  buildErrorPayload,\n  buildErrorStatus,\n} from '../../errors/error-parser.js'\nimport { type SendWebAppOptions, sendWebAppFactory } from './assets.js'\n\nexport function sendErrorPageFactory(\n  customization: Customization,\n  options?: SendWebAppOptions,\n) {\n  const sendApp = sendWebAppFactory('error-page', customization, options)\n\n  return async function sendErrorPage(\n    req: IncomingMessage,\n    res: ServerResponse,\n    err: unknown,\n  ): Promise<void> {\n    return sendApp(req, res, {\n      status: buildErrorStatus(err),\n      data: { __errorData: buildErrorPayload(err) },\n    })\n  }\n}\n"]}

package/dist/router/assets/send-redirect.d.ts

@@ -1,8 +1,8 @@
 import type { ServerResponse } from 'node:http';
-import { OAuthAuthorizationRequestParameters, OAuthResponseMode } from '@atproto/oauth-types';
-import { WriteFormRedirectOptions } from '../../lib/write-form-redirect.js';
-import { AuthorizationRedirectParameters } from '../../result/authorization-redirect-parameters.js';
-import { AuthorizationResultRedirect } from '../../result/authorization-result-redirect.js';
+import type { OAuthAuthorizationRequestParameters, OAuthResponseMode } from '@atproto/oauth-types';
+import { type WriteFormRedirectOptions } from '../../lib/write-form-redirect.js';
+import type { AuthorizationRedirectParameters } from '../../result/authorization-redirect-parameters.js';
+import type { AuthorizationResultRedirect } from '../../result/authorization-result-redirect.js';
 export declare const SUCCESS_REDIRECT_KEYS: readonly ['code', 'id_token', 'access_token', 'expires_in', 'token_type'];
 export declare const ERROR_REDIRECT_KEYS: readonly ['error', 'error_description', 'error_uri'];
 export type OAuthRedirectQueryParameter = 'iss' | 'state' | (typeof SUCCESS_REDIRECT_KEYS)[number] | (typeof ERROR_REDIRECT_KEYS)[number];

package/dist/router/assets/send-redirect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"send-redirect.d.ts","sourceRoot":"","sources":["../../../src/router/assets/send-redirect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EACL,mCAAmC,EACnC,iBAAiB,EAClB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,wBAAwB,EAEzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAA;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAA;AAK3F,eAAO,MAAM,qBAAqB,YAChC,MAAM,EACN,UAAU,EACV,cAAc,EACd,YAAY,EACZ,YAAY,CACJ,CAAA;AAEV,eAAO,MAAM,mBAAmB,YAC9B,OAAO,EACP,mBAAmB,EACnB,WAAW,CACH,CAAA;AAEV,MAAM,MAAM,2BAA2B,GACnC,KAAK,GACL,OAAO,GACP,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,GACtC,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAA;AAExC,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,mCAAmC,GAC9C,MAAM,CAKR;AAED,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,mCAAmC,GAC9C,iBAAiB,CAGnB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,mCAAmC,EAC/C,QAAQ,EAAE,+BAA+B,GACxC,CAAC,2BAA2B,EAAE,MAAM,CAAC,EAAE,CAgBzC;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,2BAA2B,EACnC,OAAO,CAAC,EAAE,wBAAwB,QAanC;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,iBAAiB,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACnC,CAAA;AAED,wBAAgB,YAAY,CAC1B,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,CAAC,EAAE,wBAAwB,GACjC,IAAI,CAeN"}
+{"version":3,"file":"send-redirect.d.ts","sourceRoot":"","sources":["../../../src/router/assets/send-redirect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,KAAK,EACV,mCAAmC,EACnC,iBAAiB,EAClB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,KAAK,wBAAwB,EAE9B,MAAM,kCAAkC,CAAA;AACzC,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAA;AACxG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAA;AAKhG,eAAO,MAAM,qBAAqB,YAChC,MAAM,EACN,UAAU,EACV,cAAc,EACd,YAAY,EACZ,YAAY,CACJ,CAAA;AAEV,eAAO,MAAM,mBAAmB,YAC9B,OAAO,EACP,mBAAmB,EACnB,WAAW,CACH,CAAA;AAEV,MAAM,MAAM,2BAA2B,GACnC,KAAK,GACL,OAAO,GACP,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,GACtC,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAA;AAExC,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,mCAAmC,GAC9C,MAAM,CAKR;AAED,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,mCAAmC,GAC9C,iBAAiB,CAGnB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,mCAAmC,EAC/C,QAAQ,EAAE,+BAA+B,GACxC,CAAC,2BAA2B,EAAE,MAAM,CAAC,EAAE,CAgBzC;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,2BAA2B,EACnC,OAAO,CAAC,EAAE,wBAAwB,QAanC;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,iBAAiB,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACnC,CAAA;AAED,wBAAgB,YAAY,CAC1B,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,CAAC,EAAE,wBAAwB,GACjC,IAAI,CAeN"}

package/dist/router/assets/send-redirect.js.map

@@ -1 +1 @@
-{"version":3,"file":"send-redirect.js","sourceRoot":"","sources":["../../../src/router/assets/send-redirect.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AACxE,OAAO,EAEL,iBAAiB,GAClB,MAAM,kCAAkC,CAAA;AAIzC,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEhC,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,MAAM;IACN,UAAU;IACV,cAAc;IACd,YAAY;IACZ,YAAY;CACJ,CAAA;AAEV,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO;IACP,mBAAmB;IACnB,WAAW;CACH,CAAA;AAQV,MAAM,UAAU,gBAAgB,CAC9B,UAA+C;IAE/C,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAA;IACnC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAA;IAEnB,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAA;AAChF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,UAA+C;IAE/C,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,IAAI,OAAO,CAAA,CAAC,+CAA+C;IAChG,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,UAA+C,EAC/C,QAAyC;IAEzC,MAAM,MAAM,GAA4C;QACtD,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,UAAU;KAC5B,CAAA;IAED,IAAI,UAAU,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,mBAAmB,CAAA;IAC7E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,KAAK,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;IAC9C,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,GAAmB,EACnB,MAAmC,EACnC,OAAkC;IAElC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;IAE/C,OAAO,YAAY,CACjB,GAAG,EACH;QACE,WAAW,EAAE,gBAAgB,CAAC,UAAU,CAAC;QACzC,IAAI,EAAE,iBAAiB,CAAC,UAAU,CAAC;QACnC,MAAM,EAAE,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC;KAC1D,EACD,OAAO,CACR,CAAA;AACH,CAAC;AAQD,MAAM,UAAU,YAAY,CAC1B,GAAmB,EACnB,QAA8B,EAC9B,OAAkC;IAElC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;IAE1C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;IACnD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QACrC,KAAK,UAAU;YACb,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QACxC,KAAK,WAAW;YACd,OAAO,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/D,CAAC;IAED,8BAA8B;IAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,UAAU,CACjB,GAAmB,EACnB,GAAW,EACX,MAAkC;IAElC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACxB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACnE,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;AACnE,CAAC;AAED,SAAS,aAAa,CACpB,GAAmB,EACnB,GAAW,EACX,MAAkC;IAElC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACxB,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM;QAAE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC/D,GAAG,CAAC,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAA;IAClC,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;AACnE,CAAC","sourcesContent":["import type { ServerResponse } from 'node:http'\nimport {\n  OAuthAuthorizationRequestParameters,\n  OAuthResponseMode,\n} from '@atproto/oauth-types'\nimport { AuthorizationError } from '../../errors/authorization-error.js'\nimport {\n  WriteFormRedirectOptions,\n  writeFormRedirect,\n} from '../../lib/write-form-redirect.js'\nimport { AuthorizationRedirectParameters } from '../../result/authorization-redirect-parameters.js'\nimport { AuthorizationResultRedirect } from '../../result/authorization-result-redirect.js'\n\n// https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-7.5.4\nconst REDIRECT_STATUS_CODE = 303\n\nexport const SUCCESS_REDIRECT_KEYS = [\n  'code',\n  'id_token',\n  'access_token',\n  'expires_in',\n  'token_type',\n] as const\n\nexport const ERROR_REDIRECT_KEYS = [\n  'error',\n  'error_description',\n  'error_uri',\n] as const\n\nexport type OAuthRedirectQueryParameter =\n  | 'iss'\n  | 'state'\n  | (typeof SUCCESS_REDIRECT_KEYS)[number]\n  | (typeof ERROR_REDIRECT_KEYS)[number]\n\nexport function buildRedirectUri(\n  parameters: OAuthAuthorizationRequestParameters,\n): string {\n  const uri = parameters.redirect_uri\n  if (uri) return uri\n\n  throw new AuthorizationError(parameters, 'No redirect_uri', 'invalid_request')\n}\n\nexport function buildRedirectMode(\n  parameters: OAuthAuthorizationRequestParameters,\n): OAuthResponseMode {\n  const mode = parameters.response_mode || 'query' // @TODO default should depend on response_type\n  return mode\n}\n\nexport function buildRedirectParams(\n  issuer: string,\n  parameters: OAuthAuthorizationRequestParameters,\n  redirect: AuthorizationRedirectParameters,\n): [OAuthRedirectQueryParameter, string][] {\n  const params: [OAuthRedirectQueryParameter, string][] = [\n    ['iss', issuer], // rfc9207\n  ]\n\n  if (parameters.state != null) {\n    params.push(['state', parameters.state])\n  }\n\n  const keys = 'code' in redirect ? SUCCESS_REDIRECT_KEYS : ERROR_REDIRECT_KEYS\n  for (const key of keys) {\n    const value = redirect[key]\n    if (value != null) params.push([key, value])\n  }\n\n  return params\n}\n\nexport function sendAuthorizationResultRedirect(\n  res: ServerResponse,\n  result: AuthorizationResultRedirect,\n  options?: WriteFormRedirectOptions,\n) {\n  const { issuer, parameters, redirect } = result\n\n  return sendRedirect(\n    res,\n    {\n      redirectUri: buildRedirectUri(parameters),\n      mode: buildRedirectMode(parameters),\n      params: buildRedirectParams(issuer, parameters, redirect),\n    },\n    options,\n  )\n}\n\nexport type OAuthRedirectOptions = {\n  mode: OAuthResponseMode\n  redirectUri: string\n  params: Iterable<[string, string]>\n}\n\nexport function sendRedirect(\n  res: ServerResponse,\n  redirect: OAuthRedirectOptions,\n  options?: WriteFormRedirectOptions,\n): void {\n  res.setHeader('Cache-Control', 'no-store')\n\n  const { mode, redirectUri: uri, params } = redirect\n  switch (mode) {\n    case 'query':\n      return writeQuery(res, uri, params)\n    case 'fragment':\n      return writeFragment(res, uri, params)\n    case 'form_post':\n      return writeFormRedirect(res, 'post', uri, params, options)\n  }\n\n  // @ts-expect-error fool proof\n  throw new Error(`Unsupported mode: ${mode}`)\n}\n\nfunction writeQuery(\n  res: ServerResponse,\n  uri: string,\n  params: Iterable<[string, string]>,\n): void {\n  const url = new URL(uri)\n  for (const [key, value] of params) url.searchParams.set(key, value)\n  res.writeHead(REDIRECT_STATUS_CODE, { Location: url.href }).end()\n}\n\nfunction writeFragment(\n  res: ServerResponse,\n  uri: string,\n  params: Iterable<[string, string]>,\n): void {\n  const url = new URL(uri)\n  const searchParams = new URLSearchParams()\n  for (const [key, value] of params) searchParams.set(key, value)\n  url.hash = searchParams.toString()\n  res.writeHead(REDIRECT_STATUS_CODE, { Location: url.href }).end()\n}\n"]}
+{"version":3,"file":"send-redirect.js","sourceRoot":"","sources":["../../../src/router/assets/send-redirect.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AACxE,OAAO,EAEL,iBAAiB,GAClB,MAAM,kCAAkC,CAAA;AAIzC,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEhC,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,MAAM;IACN,UAAU;IACV,cAAc;IACd,YAAY;IACZ,YAAY;CACJ,CAAA;AAEV,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO;IACP,mBAAmB;IACnB,WAAW;CACH,CAAA;AAQV,MAAM,UAAU,gBAAgB,CAC9B,UAA+C;IAE/C,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAA;IACnC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAA;IAEnB,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAA;AAChF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,UAA+C;IAE/C,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,IAAI,OAAO,CAAA,CAAC,+CAA+C;IAChG,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,UAA+C,EAC/C,QAAyC;IAEzC,MAAM,MAAM,GAA4C;QACtD,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,UAAU;KAC5B,CAAA;IAED,IAAI,UAAU,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,mBAAmB,CAAA;IAC7E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,KAAK,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;IAC9C,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,GAAmB,EACnB,MAAmC,EACnC,OAAkC;IAElC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;IAE/C,OAAO,YAAY,CACjB,GAAG,EACH;QACE,WAAW,EAAE,gBAAgB,CAAC,UAAU,CAAC;QACzC,IAAI,EAAE,iBAAiB,CAAC,UAAU,CAAC;QACnC,MAAM,EAAE,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC;KAC1D,EACD,OAAO,CACR,CAAA;AACH,CAAC;AAQD,MAAM,UAAU,YAAY,CAC1B,GAAmB,EACnB,QAA8B,EAC9B,OAAkC;IAElC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;IAE1C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;IACnD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QACrC,KAAK,UAAU;YACb,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QACxC,KAAK,WAAW;YACd,OAAO,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/D,CAAC;IAED,8BAA8B;IAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,UAAU,CACjB,GAAmB,EACnB,GAAW,EACX,MAAkC;IAElC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACxB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACnE,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;AACnE,CAAC;AAED,SAAS,aAAa,CACpB,GAAmB,EACnB,GAAW,EACX,MAAkC;IAElC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACxB,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM;QAAE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC/D,GAAG,CAAC,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAA;IAClC,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;AACnE,CAAC","sourcesContent":["import type { ServerResponse } from 'node:http'\nimport type {\n  OAuthAuthorizationRequestParameters,\n  OAuthResponseMode,\n} from '@atproto/oauth-types'\nimport { AuthorizationError } from '../../errors/authorization-error.js'\nimport {\n  type WriteFormRedirectOptions,\n  writeFormRedirect,\n} from '../../lib/write-form-redirect.js'\nimport type { AuthorizationRedirectParameters } from '../../result/authorization-redirect-parameters.js'\nimport type { AuthorizationResultRedirect } from '../../result/authorization-result-redirect.js'\n\n// https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-7.5.4\nconst REDIRECT_STATUS_CODE = 303\n\nexport const SUCCESS_REDIRECT_KEYS = [\n  'code',\n  'id_token',\n  'access_token',\n  'expires_in',\n  'token_type',\n] as const\n\nexport const ERROR_REDIRECT_KEYS = [\n  'error',\n  'error_description',\n  'error_uri',\n] as const\n\nexport type OAuthRedirectQueryParameter =\n  | 'iss'\n  | 'state'\n  | (typeof SUCCESS_REDIRECT_KEYS)[number]\n  | (typeof ERROR_REDIRECT_KEYS)[number]\n\nexport function buildRedirectUri(\n  parameters: OAuthAuthorizationRequestParameters,\n): string {\n  const uri = parameters.redirect_uri\n  if (uri) return uri\n\n  throw new AuthorizationError(parameters, 'No redirect_uri', 'invalid_request')\n}\n\nexport function buildRedirectMode(\n  parameters: OAuthAuthorizationRequestParameters,\n): OAuthResponseMode {\n  const mode = parameters.response_mode || 'query' // @TODO default should depend on response_type\n  return mode\n}\n\nexport function buildRedirectParams(\n  issuer: string,\n  parameters: OAuthAuthorizationRequestParameters,\n  redirect: AuthorizationRedirectParameters,\n): [OAuthRedirectQueryParameter, string][] {\n  const params: [OAuthRedirectQueryParameter, string][] = [\n    ['iss', issuer], // rfc9207\n  ]\n\n  if (parameters.state != null) {\n    params.push(['state', parameters.state])\n  }\n\n  const keys = 'code' in redirect ? SUCCESS_REDIRECT_KEYS : ERROR_REDIRECT_KEYS\n  for (const key of keys) {\n    const value = redirect[key]\n    if (value != null) params.push([key, value])\n  }\n\n  return params\n}\n\nexport function sendAuthorizationResultRedirect(\n  res: ServerResponse,\n  result: AuthorizationResultRedirect,\n  options?: WriteFormRedirectOptions,\n) {\n  const { issuer, parameters, redirect } = result\n\n  return sendRedirect(\n    res,\n    {\n      redirectUri: buildRedirectUri(parameters),\n      mode: buildRedirectMode(parameters),\n      params: buildRedirectParams(issuer, parameters, redirect),\n    },\n    options,\n  )\n}\n\nexport type OAuthRedirectOptions = {\n  mode: OAuthResponseMode\n  redirectUri: string\n  params: Iterable<[string, string]>\n}\n\nexport function sendRedirect(\n  res: ServerResponse,\n  redirect: OAuthRedirectOptions,\n  options?: WriteFormRedirectOptions,\n): void {\n  res.setHeader('Cache-Control', 'no-store')\n\n  const { mode, redirectUri: uri, params } = redirect\n  switch (mode) {\n    case 'query':\n      return writeQuery(res, uri, params)\n    case 'fragment':\n      return writeFragment(res, uri, params)\n    case 'form_post':\n      return writeFormRedirect(res, 'post', uri, params, options)\n  }\n\n  // @ts-expect-error fool proof\n  throw new Error(`Unsupported mode: ${mode}`)\n}\n\nfunction writeQuery(\n  res: ServerResponse,\n  uri: string,\n  params: Iterable<[string, string]>,\n): void {\n  const url = new URL(uri)\n  for (const [key, value] of params) url.searchParams.set(key, value)\n  res.writeHead(REDIRECT_STATUS_CODE, { Location: url.href }).end()\n}\n\nfunction writeFragment(\n  res: ServerResponse,\n  uri: string,\n  params: Iterable<[string, string]>,\n): void {\n  const url = new URL(uri)\n  const searchParams = new URLSearchParams()\n  for (const [key, value] of params) searchParams.set(key, value)\n  url.hash = searchParams.toString()\n  res.writeHead(REDIRECT_STATUS_CODE, { Location: url.href }).end()\n}\n"]}

package/dist/router/create-account-page-middleware.d.ts

@@ -1,5 +1,5 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { Middleware } from '../lib/http/index.js';
+import { type Middleware } from '../lib/http/index.js';
 import type { OAuthProvider } from '../oauth-provider.js';
 import type { MiddlewareOptions } from './middleware-options.js';
 export declare function createAccountPageMiddleware<Ctx extends object | void = void, Req extends IncomingMessage = IncomingMessage, Res extends ServerResponse = ServerResponse>(server: OAuthProvider, { onError }: MiddlewareOptions<Req, Res>): Middleware<Ctx, Req, Res>;

package/dist/router/create-account-page-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-account-page-middleware.d.ts","sourceRoot":"","sources":["../../src/router/create-account-page-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,EACL,UAAU,EAMX,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,wBAAgB,2BAA2B,CACzC,GAAG,SAAS,MAAM,GAAG,IAAI,GAAG,IAAI,EAChC,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAE3C,MAAM,EAAE,aAAa,EACrB,EAAE,OAAO,EAAE,EAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,GACvC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAgE3B"}
+{"version":3,"file":"create-account-page-middleware.d.ts","sourceRoot":"","sources":["../../src/router/create-account-page-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,EACL,KAAK,UAAU,EAMhB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,wBAAgB,2BAA2B,CACzC,GAAG,SAAS,MAAM,GAAG,IAAI,GAAG,IAAI,EAChC,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAE3C,MAAM,EAAE,aAAa,EACrB,EAAE,OAAO,EAAE,EAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,GACvC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAgE3B"}

package/dist/router/create-account-page-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-account-page-middleware.js","sourceRoot":"","sources":["../../src/router/create-account-page-middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,MAAM,EACN,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,aAAa,GACd,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAGlE,MAAM,UAAU,2BAA2B,CAKzC,MAAqB,EACrB,EAAE,OAAO,EAA+B;IAExC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAA;IAErC,MAAM,eAAe,GAA2B;QAC9C,IAAI,EAAE,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACzD,CAAA;IAED,MAAM,eAAe,GAAG,sBAAsB,CAC5C,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IACD,MAAM,aAAa,GAAG,oBAAoB,CACxC,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAgB,SAAS,CAAC,CAAA;IAEnD,2CAA2C;IAC3C,6CAA6C;IAC7C,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,aAAa,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,yBAAyB,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,gCAAgC;IAChC,MAAM,CAAC,GAAG,CAAQ,sBAAsB,EAAE,KAAK,WAAW,GAAG,EAAE,GAAG;QAChE,IAAI,CAAC;YACH,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAA;YAE/C,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;YAC1C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;YAEnC,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;YACpC,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;YACpC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YAEjC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC9D,MAAM,cAAc,GAClB,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YAE1D,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE;gBACxB,cAAc,EAAE,cAAc,CAAC,GAAG,CAChC,CAAC,aAAa,EAAuB,EAAE,CAAC,CAAC;oBACvC,OAAO,EAAE,aAAa,CAAC,OAAO;oBAC9B,aAAa,EAAE,MAAM,CAAC,kBAAkB,CAAC,aAAa,CAAC;iBACxD,CAAC,CACH;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,CACP,GAAG,EACH,GAAG,EACH,GAAG,EACH,2CAA2C,GAAG,CAAC,GAAG,GAAG,CACtD,CAAA;YAED,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACrC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAC,eAAe,EAAE,CAAA;AACjC,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { ActiveDeviceSession } from '@atproto/oauth-provider-api'\nimport {\n  Middleware,\n  Router,\n  validateFetchDest,\n  validateFetchMode,\n  validateOrigin,\n  writeRedirect,\n} from '../lib/http/index.js'\nimport { SecurityHeadersOptions } from '../lib/http/security-headers.js'\nimport type { OAuthProvider } from '../oauth-provider.js'\nimport { sendAccountPageFactory } from './assets/send-account-page.js'\nimport { sendErrorPageFactory } from './assets/send-error-page.js'\nimport type { MiddlewareOptions } from './middleware-options.js'\n\nexport function createAccountPageMiddleware<\n  Ctx extends object | void = void,\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { onError }: MiddlewareOptions<Req, Res>,\n): Middleware<Ctx, Req, Res> {\n  const issuerUrl = new URL(server.issuer)\n  const issuerOrigin = issuerUrl.origin\n\n  const securityOptions: SecurityHeadersOptions = {\n    hsts: issuerUrl.protocol === 'http:' ? false : undefined,\n  }\n\n  const sendAccountPage = sendAccountPageFactory(\n    server.customization,\n    securityOptions,\n  )\n  const sendErrorPage = sendErrorPageFactory(\n    server.customization,\n    securityOptions,\n  )\n\n  const router = new Router<Ctx, Req, Res>(issuerUrl)\n\n  // Create password reset discovery endpoint\n  // https://www.w3.org/TR/change-password-url/\n  router.get('/.well-known/change-password', (_req, res) => {\n    writeRedirect(res, new URL('/account/reset-password', issuerUrl).toString())\n  })\n\n  // Create frontend account pages\n  router.get<never>(/^\\/account(?:\\/.*)?$/, async function (req, res) {\n    try {\n      res.setHeader('Referrer-Policy', 'same-origin')\n\n      res.setHeader('Cache-Control', 'no-store')\n      res.setHeader('Pragma', 'no-cache')\n\n      validateFetchMode(req, ['navigate'])\n      validateFetchDest(req, ['document'])\n      validateOrigin(req, issuerOrigin)\n\n      const { deviceId } = await server.deviceManager.load(req, res)\n      const deviceAccounts =\n        await server.accountManager.listDeviceAccounts(deviceId)\n\n      sendAccountPage(req, res, {\n        deviceSessions: deviceAccounts.map(\n          (deviceAccount): ActiveDeviceSession => ({\n            account: deviceAccount.account,\n            loginRequired: server.checkLoginRequired(deviceAccount),\n          }),\n        ),\n      })\n    } catch (err) {\n      onError?.(\n        req,\n        res,\n        err,\n        `Failed to handle navigation request to \"${req.url}\"`,\n      )\n\n      if (!res.headersSent) {\n        return sendErrorPage(req, res, err)\n      }\n    }\n  })\n\n  return router.buildMiddleware()\n}\n"]}
+{"version":3,"file":"create-account-page-middleware.js","sourceRoot":"","sources":["../../src/router/create-account-page-middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,MAAM,EACN,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,aAAa,GACd,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAGlE,MAAM,UAAU,2BAA2B,CAKzC,MAAqB,EACrB,EAAE,OAAO,EAA+B;IAExC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAA;IAErC,MAAM,eAAe,GAA2B;QAC9C,IAAI,EAAE,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACzD,CAAA;IAED,MAAM,eAAe,GAAG,sBAAsB,CAC5C,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IACD,MAAM,aAAa,GAAG,oBAAoB,CACxC,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAgB,SAAS,CAAC,CAAA;IAEnD,2CAA2C;IAC3C,6CAA6C;IAC7C,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,aAAa,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,yBAAyB,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,gCAAgC;IAChC,MAAM,CAAC,GAAG,CAAQ,sBAAsB,EAAE,KAAK,WAAW,GAAG,EAAE,GAAG;QAChE,IAAI,CAAC;YACH,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAA;YAE/C,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;YAC1C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;YAEnC,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;YACpC,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;YACpC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YAEjC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC9D,MAAM,cAAc,GAClB,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YAE1D,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE;gBACxB,cAAc,EAAE,cAAc,CAAC,GAAG,CAChC,CAAC,aAAa,EAAuB,EAAE,CAAC,CAAC;oBACvC,OAAO,EAAE,aAAa,CAAC,OAAO;oBAC9B,aAAa,EAAE,MAAM,CAAC,kBAAkB,CAAC,aAAa,CAAC;iBACxD,CAAC,CACH;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,CACP,GAAG,EACH,GAAG,EACH,GAAG,EACH,2CAA2C,GAAG,CAAC,GAAG,GAAG,CACtD,CAAA;YAED,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACrC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAC,eAAe,EAAE,CAAA;AACjC,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { ActiveDeviceSession } from '@atproto/oauth-provider-api'\nimport {\n  type Middleware,\n  Router,\n  validateFetchDest,\n  validateFetchMode,\n  validateOrigin,\n  writeRedirect,\n} from '../lib/http/index.js'\nimport type { SecurityHeadersOptions } from '../lib/http/security-headers.js'\nimport type { OAuthProvider } from '../oauth-provider.js'\nimport { sendAccountPageFactory } from './assets/send-account-page.js'\nimport { sendErrorPageFactory } from './assets/send-error-page.js'\nimport type { MiddlewareOptions } from './middleware-options.js'\n\nexport function createAccountPageMiddleware<\n  Ctx extends object | void = void,\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { onError }: MiddlewareOptions<Req, Res>,\n): Middleware<Ctx, Req, Res> {\n  const issuerUrl = new URL(server.issuer)\n  const issuerOrigin = issuerUrl.origin\n\n  const securityOptions: SecurityHeadersOptions = {\n    hsts: issuerUrl.protocol === 'http:' ? false : undefined,\n  }\n\n  const sendAccountPage = sendAccountPageFactory(\n    server.customization,\n    securityOptions,\n  )\n  const sendErrorPage = sendErrorPageFactory(\n    server.customization,\n    securityOptions,\n  )\n\n  const router = new Router<Ctx, Req, Res>(issuerUrl)\n\n  // Create password reset discovery endpoint\n  // https://www.w3.org/TR/change-password-url/\n  router.get('/.well-known/change-password', (_req, res) => {\n    writeRedirect(res, new URL('/account/reset-password', issuerUrl).toString())\n  })\n\n  // Create frontend account pages\n  router.get<never>(/^\\/account(?:\\/.*)?$/, async function (req, res) {\n    try {\n      res.setHeader('Referrer-Policy', 'same-origin')\n\n      res.setHeader('Cache-Control', 'no-store')\n      res.setHeader('Pragma', 'no-cache')\n\n      validateFetchMode(req, ['navigate'])\n      validateFetchDest(req, ['document'])\n      validateOrigin(req, issuerOrigin)\n\n      const { deviceId } = await server.deviceManager.load(req, res)\n      const deviceAccounts =\n        await server.accountManager.listDeviceAccounts(deviceId)\n\n      sendAccountPage(req, res, {\n        deviceSessions: deviceAccounts.map(\n          (deviceAccount): ActiveDeviceSession => ({\n            account: deviceAccount.account,\n            loginRequired: server.checkLoginRequired(deviceAccount),\n          }),\n        ),\n      })\n    } catch (err) {\n      onError?.(\n        req,\n        res,\n        err,\n        `Failed to handle navigation request to \"${req.url}\"`,\n      )\n\n      if (!res.headersSent) {\n        return sendErrorPage(req, res, err)\n      }\n    }\n  })\n\n  return router.buildMiddleware()\n}\n"]}

package/dist/router/create-api-middleware.d.ts

@@ -1,7 +1,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { Middleware } from '../lib/http/index.js';
+import { type Middleware } from '../lib/http/index.js';
 import type { OAuthProvider } from '../oauth-provider.js';
-import { OAuthRedirectOptions } from './assets/send-redirect.js';
+import { type OAuthRedirectOptions } from './assets/send-redirect.js';
 import type { MiddlewareOptions } from './middleware-options.js';
 export declare function createApiMiddleware<Ctx extends object | void = void, Req extends IncomingMessage = IncomingMessage, Res extends ServerResponse = ServerResponse>(server: OAuthProvider, { onError }: MiddlewareOptions<Req, Res>): Middleware<Ctx, Req, Res>;
 export declare function parseRedirectUrl(url: URL): OAuthRedirectOptions;

package/dist/router/create-api-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-api-middleware.d.ts","sourceRoot":"","sources":["../../src/router/create-api-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAgChE,OAAO,EAEL,UAAU,EAaX,MAAM,sBAAsB,CAAA;AAK7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AASzD,OAAO,EAEL,oBAAoB,EAMrB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,wBAAgB,mBAAmB,CACjC,GAAG,SAAS,MAAM,GAAG,IAAI,GAAG,IAAI,EAChC,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAE3C,MAAM,EAAE,aAAa,EACrB,EAAE,OAAO,EAAE,EAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,GACvC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAo4B3B;AA2BD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,GAAG,oBAAoB,CA4C/D"}
+{"version":3,"file":"create-api-middleware.d.ts","sourceRoot":"","sources":["../../src/router/create-api-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAgChE,OAAO,EAEL,KAAK,UAAU,EAahB,MAAM,sBAAsB,CAAA;AAK7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AASzD,OAAO,EAEL,KAAK,oBAAoB,EAM1B,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,wBAAgB,mBAAmB,CACjC,GAAG,SAAS,MAAM,GAAG,IAAI,GAAG,IAAI,EAChC,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAE3C,MAAM,EAAE,aAAa,EACrB,EAAE,OAAO,EAAE,EAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,GACvC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAo4B3B;AA2BD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,GAAG,oBAAoB,CA4C/D"}

package/dist/router/create-api-middleware.js

@@ -2,7 +2,7 @@ import createHttpError from 'http-errors';
 import { z } from 'zod';
 import { didSchema } from '@atproto/did';
 import { signedJwtSchema } from '@atproto/jwk';
-import { API_ENDPOINT_PREFIX, } from '@atproto/oauth-provider-api';
+import { API_ENDPOINT_PREFIX } from '@atproto/oauth-provider-api';
 import { oauthRedirectUriSchema, oauthResponseModeSchema, oauthScopeSchema, } from '@atproto/oauth-types';
 import { signInDataSchema } from '../account/sign-in-data.js';
 import { signUpInputSchema } from '../account/sign-up-input.js';

package/dist/router/create-api-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-api-middleware.js","sourceRoot":"","sources":["../../src/router/create-api-middleware.ts"],"names":[],"mappings":"AACA,OAAO,eAAe,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAO,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EACL,mBAAmB,GAMpB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAIL,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAY,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAEL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAIL,MAAM,EAGN,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,MAAM,EACN,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAY,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAGpD,OAAO,EAAc,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAExE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EACL,mBAAmB,EAGnB,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,2BAA2B,CAAA;AAGlC,MAAM,UAAU,mBAAmB,CAKjC,MAAqB,EACrB,EAAE,OAAO,EAA+B;IAExC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAA;IACrC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAgB,SAAS,CAAC,CAAA;IAEnD,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,6BAA6B;QACvC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACnD,KAAK,CAAC,OAAO;YACX,MAAM,MAAM,CAAC,cAAc,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACvE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAA;QACtC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,iBAAiB;QACzB,mBAAmB,EAAE,IAAI;QACzB,KAAK,CAAC,OAAO;YACX,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;YAE5D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,aAAa,CACvD,QAAQ,EACR,cAAc,EACd,KAAK,CACN,CAAA;YAED,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,UAAU,IAAI,IAAI,CAAA;YAEnC,4EAA4E;YAC5E,cAAc;YACd,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;YACxE,CAAC;YAED,MAAM,cAAc,GAAG,QAAQ;gBAC7B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC;oBACvC,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,QAAQ;oBACR,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAA;YAEN,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAA;YACxC,OAAO,EAAE,IAAI,EAAE,CAAA;QACjB,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QACrE,mBAAmB,EAAE,IAAI;QACzB,KAAK,CAAC,OAAO;YACX,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;YAErD,2DAA2D;YAC3D,MAAM,EAAE,QAAQ,GAAG,UAAU,IAAI,IAAI,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAA;YAE9D,kEAAkE;YAClE,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,UAAU;gBACzB,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,UAAU,CAAC;gBACtD,CAAC,CAAC,SAAS,CAAA;YAEb,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAC7D,QAAQ,EACR,cAAc,EACd,KAAK,EACL,QAAQ,CACT,CAAA;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;YACxE,CAAC;iBAAM,CAAC;gBACN,oEAAoE;gBACpE,iEAAiE;gBACjE,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;YACxE,CAAC;YAED,MAAM,cAAc,GAAG,QAAQ;gBAC7B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC;oBACvC,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,QAAQ;oBACR,UAAU;iBACX,CAAC,CAAA;YAEN,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAA;YACxC,OAAO,EAAE,IAAI,EAAE,CAAA;QACjB,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,WAAW;QACrB,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;SAC9C,CAAC;aACD,MAAM,EAAE;QACX,mBAAmB,EAAE,IAAI;QACzB,KAAK,CAAC,OAAO;YACX,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAEnD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YACrE,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAa,EAAE,EAAE,CAAA;QAC7C,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,yBAAyB;QACnC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,WAAW;SACnB,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO;YACX,MAAM,MAAM,CAAC,cAAc,CAAC,oBAAoB,CAC9C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,CACX,CAAA;YACD,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,yBAAyB;QACnC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,iBAAiB;SAC5B,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO;YACX,MAAM,MAAM,CAAC,cAAc,CAAC,oBAAoB,CAC9C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,CACX,CAAA;YACD,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,GAAG,EAAE,SAAS;YACd,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;SAChC,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAE3D,MAAM,EAAE,aAAa,EAAE,GACrB,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAC5C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,EACV,OAAO,CACR,CAAA;YAEH,OAAO,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,cAAc,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;SAChC,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAEzD,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,CACtD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,EACV,OAAO,CACR,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAA;QAC9B,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,GAAG,EAAE,SAAS;YACd,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;SAChC,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAE3D,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAC5C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,EACV,OAAO,CACR,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,cAAc;YACrB,KAAK,EAAE,WAAW;SACnB,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAEzD,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,CACtD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,EACV,OAAO,CACR,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAA;QAC9B,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,GAAG,EAAE,SAAS;YACd,MAAM,EAAE,YAAY;SACrB,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAEzD,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,YAAY,CAChD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,EACV,OAAO,CACR,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAA;QAC9B,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,qBAAqB;QAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAEzD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACzB,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,iBAAiB,CACrD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,OAAO,CACR,CAAA;YACH,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAA;QAC9B,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,qBAAqB;QAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAEzD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxB,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,iBAAiB,CACrD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,OAAO,CACR,CAAA;YACH,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAA;QAC9B,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,yBAAyB;QACnC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;aAC3D,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAE3D,MAAM,MAAM,CAAC,cAAc,CAAC,oBAAoB,CAC9C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,EACV,OAAO,CACR,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,yBAAyB;QACnC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,iBAAiB;SAC5B,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAE3D,MAAM,MAAM,CAAC,cAAc,CAAC,oBAAoB,CAC9C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,EACV,OAAO,CACR,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE,SAAS;QACjB,KAAK,CAAC,OAAO;YACX,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,CACnE,IAAI,CAAC,QAAQ,CACd,CAAA;YAED,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAC7B,CAAC,aAAa,EAAuB,EAAE,CAAC,CAAC;gBACvC,OAAO,EAAE,aAAa,CAAC,OAAO;gBAC9B,aAAa,EAAE,MAAM,CAAC,kBAAkB,CAAC,aAAa,CAAC;aACxD,CAAC,CACH,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,CAAA;QACjB,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAE3D,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAC5D,OAAO,CAAC,GAAG,CACZ,CAAA;YAED,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAExE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE;gBAChE,OAAO,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;oBACzB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,yBAAyB,QAAQ,EAAE,CAAC,CAAA;oBAC7D,OAAO,SAAS,CAAA,CAAC,wCAAwC;gBAC3D,CAAC;aACF,CAAC,CAAA;YAEF,qEAAqE;YACrE,iEAAiE;YACjE,4DAA4D;YAC5D,iCAAiC;YACjC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAsB,EAAE;gBAC/D,OAAO;oBACL,OAAO,EAAE,EAAE;oBAEX,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAmB;oBACxD,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAmB;oBAExD,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ;oBAEpD,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;iBAC7B,CAAA;YACH,CAAC,CAAC,CAAA;YAEF,OAAO,EAAE,IAAI,EAAE,CAAA;QACjB,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAE3D,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,CACnE,OAAO,CAAC,GAAG,CACZ,CAAA;YAED,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAC7B,CAAC,cAAc,EAAwB,EAAE,CAAC,CAAC;gBACzC,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,cAAc,EAAE;oBACd,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,SAAS;oBAC9C,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,SAAS;oBAC9C,UAAU,EACR,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,EAAmB;iBACtE;gBAED,eAAe,EAAE,cAAc,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;aAC3D,CAAC,CACH,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,CAAA;QACjB,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,yBAAyB;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;QACvE,KAAK,CAAC,OAAO;YACX,oEAAoE;YACpE,oEAAoE;YACpE,WAAW;YAEX,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAC7C,IAAI,CAAC,KAAK,CAAC,QAAQ,EACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CACf,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACrE,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAE3D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,YAAY,CACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CACnB,CAAA;YAED,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBACxD,gDAAgD;gBAChD,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAA;YAChD,CAAC;YAED,MAAM,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAEnD,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,CAAC;aACN,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,QAAQ,EAAE,EAAE,CAAC;aAC9D,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrB,MAAM,IAAI,mBAAmB,CAC3B,mEAAmE,CACpE,CAAA;YACH,CAAC;YAED,wEAAwE;YACxE,8CAA8C;YAC9C,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,GAAG,CAC9D,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,QAAQ,CACd,CAAA;gBAED,6DAA6D;gBAC7D,sBAAsB;gBACtB,IAAI,CAAC;oBACH,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAC5D,IAAI,EACJ,GAAG,EACH,GAAG,CACJ,CAAA;oBAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;oBAE7D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,aAAa,CACpD,IAAI,CAAC,UAAU,EACf,MAAM,EACN,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,CAAC,KAAK,CACjB,CAAA;oBAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;oBAClD,IAAI,MAAM,CAAC,oBAAoB,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;wBACxD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;wBAEpD,yDAAyD;wBAEzD,4DAA4D;wBAC5D,qCAAqC;wBACrC,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;4BAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;wBAEjE,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE;4BAC/D,GAAG,UAAU;4BACb,gBAAgB,EAAE,CAAC,GAAG,MAAM,CAAC;yBAC9B,CAAC,CAAA;oBACJ,CAAC;oBAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;oBAEjE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAA;gBAC1B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,6DAA6D;oBAC7D,sDAAsD;oBACtD,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBAChD,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,yCAAyC,CAAC,CAAA;gBAEnE,kEAAkE;gBAClE,oDAAoD;gBACpD,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBACrD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAA;gBACtD,CAAC;gBAED,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;oBACtC,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,gBAAgB,CAC1B,MAAM,CAAC,MAAM,EACb,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,MAAM,EAAE,CACb,CAAA;wBAED,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAA;oBAC1B,CAAC;oBAAC,MAAM,CAAC;wBACP,uCAAuC;oBACzC,CAAC;gBACH,CAAC;gBAED,iEAAiE;gBACjE,oEAAoE;gBACpE,8BAA8B;gBAC9B,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QAC7B,mBAAmB,EAAE,IAAI;QACzB,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;YAC3B,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,mBAAmB,CAC3B,mEAAmE,CACpE,CAAA;YACH,CAAC;YAED,+DAA+D;YAC/D,YAAY;YACZ,IAAI,CAAC;gBACH,sEAAsE;gBACtE,kDAAkD;gBAElD,wEAAwE;gBACxE,wEAAwE;gBACxE,sEAAsE;gBACtE,wEAAwE;gBACxE,uEAAuE;gBACvE,gEAAgE;gBAEhE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,GAAG,CACpD,UAAU,EACV,IAAI,CAAC,QAAQ,CACd,CAAA;gBAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE;oBACtD,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EAAE,+BAA+B;iBACnD,CAAC,CAAA;gBAEF,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAA;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,wCAAwC,CAAC,CAAA;gBAElE,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;oBACtC,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,gBAAgB,CAC1B,MAAM,CAAC,MAAM,EACb,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,MAAM,EAAE,CACb,CAAA;wBAED,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAA;oBAC1B,CAAC;oBAAC,MAAM,CAAC;wBACP,uCAAuC;oBACzC,CAAC;gBACH,CAAC;gBAED,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACpC,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC3D,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAA;gBACtD,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;KACF,CAAC,CACH,CAAA;IAED,OAAO,MAAM,CAAC,eAAe,EAAE,CAAA;IAE/B,KAAK,UAAU,YAAY,CAEzB,GAAQ,EACR,IAAS;QAET,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,+DAA+D;gBAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBACjD,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBACpD,MAAM,EAAE,OAAO,EAAE,GACf,MAAM,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAA;gBAE1D,IACE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG;oBAC9B,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;oBAClC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EACtC,CAAC;oBACD,OAAO,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAC5D,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,oBAAoB,CAC5B,cAAc,EACd,iCAAiC,EACjC,EAAE,MAAM,EAAE,EAAE,EAAE,EACd,GAAG,CACJ,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,wDAAwD;YACxD,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAChE,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CAAC,GAAG,CACf,CAAA;YAED,kDAAkD;YAClD,IAAI,MAAM,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAA;YACjD,CAAC;YAED,OAAO,aAAa,CAAA;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,oBAAoB,CAC5B,cAAc,EACd,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,mCAAmC,EACzD,EAAE,MAAM,EAAE,EAAE,EAAE,EACd,GAAG,CACJ,CAAA;QACH,CAAC;IACH,CAAC;IAwBD;;;;OAIG;IACH,SAAS,QAAQ,CAiBf,OAUD;QACC,OAAO,WAAW,CAChB,OAAO,CAAC,MAAM,EACd,GAAG,mBAAmB,GAAG,OAAO,CAAC,QAAQ,EAAE,EAC3C,aAAa,CAAC,OAAO,CAAC,CACvB,CAAA;IACH,CAAC;IAED,SAAS,aAAa,CAAqD,EACzE,MAAM,EACN,MAAM,EACN,mBAAmB,EACnB,OAAO,GAUR;QACC,MAAM,UAAU,GACd,MAAM,IAAI,IAAI,CAAC,oDAAoD;YACjE,CAAC,CAAC,KAAK,WAAW,GAAG;gBACjB,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;gBACtB,OAAO,SAAS,CAAA;YAClB,CAAC;YACH,CAAC,CAAC,MAAM,KAAK,MAAM;gBACjB,CAAC,CAAC,KAAK,WAAW,GAAG;oBACjB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;oBAClD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBACpD,CAAC;gBACH,CAAC,CAAC,KAAK,WAAW,GAAG;oBACjB,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;oBACtB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;oBACvD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACtD,CAAC,CAAA;QAET,OAAO,WAAW,CAAc,KAAK,WAAW,GAAG,EAAE,GAAG;YACtD,IAAI,CAAC;gBACH,gCAAgC;gBAChC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;gBAC1C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;gBAEnC,wBAAwB;gBACxB,iBAAiB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAA;gBACvC,iBAAiB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAA;gBACvC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;gBACjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;gBAEhE,mCAAmC;gBACnC;gBACE,mCAAmC;gBACnC,QAAQ,CAAC,QAAQ,KAAK,kBAAkB;oBACxC,QAAQ,CAAC,QAAQ,KAAK,UAAU;oBAChC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAC1C,CAAC;oBACD,MAAM,eAAe,CAAC,GAAG,EAAE,oBAAoB,QAAQ,EAAE,CAAC,CAAA;gBAC5D,CAAC;gBAED,0DAA0D;gBAC1D,MAAM,UAAU,GACd,QAAQ,CAAC,QAAQ,KAAK,kBAAkB;oBACtC,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,CAC/B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CACzC;oBACH,CAAC,CAAC,SAAS,CAAA;gBAEf,sBAAsB;gBACtB,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBAEjC,oCAAoC;gBACpC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;gBAE9C,2DAA2D;gBAC3D,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAClE,GAAG,EACH,GAAG,EACH,mBAAmB,CACpB,CAAA;gBAED,MAAM,OAAO,GAAsC,MAAM,CAAC,IAAI,EAAE;oBAC9D,KAAK;oBACL,UAAU;oBACV,QAAQ;oBACR,cAAc;iBACf,CAAC,CAAA;gBAEF,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAC9C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,8BAA8B,CAAC,CAAA;gBAExD,6CAA6C;gBAC7C,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACpC,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAY;IAC1C,0DAA0D;IAC1D,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAEpC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAW,EACX,UAA+C,EAC/C,QAAyC;IAEzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAA;IAErD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAA;IACpE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAA;IAElE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,mBAAmB,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAQ;IACvC,IAAI,GAAG,CAAC,QAAQ,KAAK,2BAA2B,EAAE,CAAC;QACjD,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,GAAG,CAAC,QAAQ,sBAAsB,CAC5D,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAA4C,EAAE,CAAA;IAE1D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;IAExC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;IAElC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,KAAK,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,KAAK,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAsB,uBAAuB,CAAC,KAAK,CAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CACtC,CAAA;QAED,MAAM,WAAW,GAAqB,sBAAsB,CAAC,KAAK,CAChE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CACrC,CAAA;QAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAC7D,CAAC;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport createHttpError from 'http-errors'\nimport { z } from 'zod'\nimport { Did, didSchema } from '@atproto/did'\nimport { signedJwtSchema } from '@atproto/jwk'\nimport {\n  API_ENDPOINT_PREFIX,\n  ActiveAccountSession,\n  ActiveDeviceSession,\n  ActiveOAuthSession,\n  ApiEndpoints,\n  ISODateString,\n} from '@atproto/oauth-provider-api'\nimport {\n  OAuthAuthorizationRequestParameters,\n  OAuthRedirectUri,\n  OAuthResponseMode,\n  oauthRedirectUriSchema,\n  oauthResponseModeSchema,\n  oauthScopeSchema,\n} from '@atproto/oauth-types'\nimport { signInDataSchema } from '../account/sign-in-data.js'\nimport { signUpInputSchema } from '../account/sign-up-input.js'\nimport { DeviceId, deviceIdSchema } from '../device/device-id.js'\nimport { AuthorizationError } from '../errors/authorization-error.js'\nimport {\n  ErrorPayload,\n  buildErrorPayload,\n  buildErrorStatus,\n} from '../errors/error-parser.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport { WWWAuthenticateError } from '../errors/www-authenticate-error.js'\nimport {\n  JsonResponse,\n  Middleware,\n  RequestMetadata,\n  Router,\n  RouterCtx,\n  SubCtx,\n  flushStream,\n  jsonHandler,\n  parseHttpRequest,\n  subCtx,\n  validateFetchMode,\n  validateFetchSite,\n  validateOrigin,\n  validateReferrer,\n} from '../lib/http/index.js'\nimport { RouteCtx, createRoute } from '../lib/http/route.js'\nimport { asArray } from '../lib/util/cast.js'\nimport { localeSchema } from '../lib/util/locale.js'\nimport type { Awaitable } from '../lib/util/type.js'\nimport type { OAuthProvider } from '../oauth-provider.js'\nimport { RequestUri, requestUriSchema } from '../request/request-uri.js'\nimport { AuthorizationRedirectParameters } from '../result/authorization-redirect-parameters.js'\nimport { tokenIdSchema } from '../token/token-id.js'\nimport { emailOtpSchema } from '../types/email-otp.js'\nimport { emailSchema } from '../types/email.js'\nimport { handleSchema } from '../types/handle.js'\nimport { newPasswordSchema, oldPasswordSchema } from '../types/password.js'\nimport { validateCsrfToken } from './assets/csrf.js'\nimport {\n  ERROR_REDIRECT_KEYS,\n  OAuthRedirectOptions,\n  OAuthRedirectQueryParameter,\n  SUCCESS_REDIRECT_KEYS,\n  buildRedirectMode,\n  buildRedirectParams,\n  buildRedirectUri,\n} from './assets/send-redirect.js'\nimport type { MiddlewareOptions } from './middleware-options.js'\n\nexport function createApiMiddleware<\n  Ctx extends object | void = void,\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { onError }: MiddlewareOptions<Req, Res>,\n): Middleware<Ctx, Req, Res> {\n  const issuerUrl = new URL(server.issuer)\n  const issuerOrigin = issuerUrl.origin\n  const router = new Router<Ctx, Req, Res>(issuerUrl)\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/verify-handle-availability',\n      schema: z.object({ handle: handleSchema }).strict(),\n      async handler() {\n        await server.accountManager.verifyHandleAvailability(this.input.handle)\n        return { json: { available: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/sign-up',\n      schema: signUpInputSchema,\n      rotateDeviceCookies: true,\n      async handler() {\n        const { deviceId, deviceMetadata, input, requestUri } = this\n\n        const account = await server.accountManager.createAccount(\n          deviceId,\n          deviceMetadata,\n          input,\n        )\n\n        // Remember when not in the context of a request by default\n        const remember = requestUri == null\n\n        // Only \"remember\" the newly created account if it was not created during an\n        // OAuth flow.\n        if (remember) {\n          await server.accountManager.upsertDeviceAccount(deviceId, account.did)\n        }\n\n        const ephemeralToken = remember\n          ? undefined\n          : await server.signer.createEphemeralToken({\n              sub: account.did,\n              deviceId,\n              requestUri: this.requestUri,\n            })\n\n        const json = { account, ephemeralToken }\n        return { json }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/sign-in',\n      schema: signInDataSchema.extend({ remember: z.boolean().optional() }),\n      rotateDeviceCookies: true,\n      async handler() {\n        const { deviceId, deviceMetadata, requestUri } = this\n\n        // Remember when not in the context of a request by default\n        const { remember = requestUri == null, ...input } = this.input\n\n        // Look up the client identifier associated with the pending OAuth\n        // request, if any, so it can be surfaced to the sign-in hooks.\n        const clientId = requestUri\n          ? await server.requestManager.peekClientId(requestUri)\n          : undefined\n\n        const account = await server.accountManager.authenticateAccount(\n          deviceId,\n          deviceMetadata,\n          input,\n          clientId,\n        )\n\n        if (remember) {\n          await server.accountManager.upsertDeviceAccount(deviceId, account.did)\n        } else {\n          // In case the user was already signed in, and signed in again, this\n          // time without \"remember me\", let's sign them off of the device.\n          await server.accountManager.removeDeviceAccount(deviceId, account.did)\n        }\n\n        const ephemeralToken = remember\n          ? undefined\n          : await server.signer.createEphemeralToken({\n              sub: account.did,\n              deviceId,\n              requestUri,\n            })\n\n        const json = { account, ephemeralToken }\n        return { json }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/sign-out',\n      schema: z\n        .object({\n          did: z.union([didSchema, z.array(didSchema)]),\n        })\n        .strict(),\n      rotateDeviceCookies: true,\n      async handler() {\n        const uniqueSubs = new Set(asArray(this.input.did))\n\n        for (const sub of uniqueSubs) {\n          await server.accountManager.removeDeviceAccount(this.deviceId, sub)\n        }\n\n        return { json: { success: true as const } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/reset-password-request',\n      schema: z\n        .object({\n          locale: localeSchema,\n          email: emailSchema,\n        })\n        .strict(),\n      async handler() {\n        await server.accountManager.resetPasswordRequest(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n        )\n        return { json: { success: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/reset-password-confirm',\n      schema: z\n        .object({\n          token: emailOtpSchema,\n          password: newPasswordSchema,\n        })\n        .strict(),\n      async handler() {\n        await server.accountManager.resetPasswordConfirm(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n        )\n        return { json: { success: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/update-email-request',\n      schema: z\n        .object({\n          did: didSchema,\n          locale: localeSchema.optional(),\n        })\n        .strict(),\n      async handler(req, res) {\n        const { account } = await authenticate.call(this, req, res)\n\n        const { tokenRequired } =\n          await server.accountManager.updateEmailRequest(\n            this.deviceId,\n            this.deviceMetadata,\n            this.input,\n            account,\n          )\n\n        return { json: { tokenRequired } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/update-email-confirm',\n      schema: z\n        .object({\n          did: didSchema,\n          email: emailSchema,\n          token: emailOtpSchema.optional(),\n          locale: localeSchema.optional(),\n        })\n        .strict(),\n      async handler(req, res) {\n        let { account } = await authenticate.call(this, req, res)\n\n        account = await server.accountManager.updateEmailConfirm(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n          account,\n        )\n\n        return { json: { account } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/verify-email-request',\n      schema: z\n        .object({\n          did: didSchema,\n          locale: localeSchema.optional(),\n        })\n        .strict(),\n      async handler(req, res) {\n        const { account } = await authenticate.call(this, req, res)\n\n        await server.accountManager.verifyEmailRequest(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n          account,\n        )\n\n        return { json: { success: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/verify-email-confirm',\n      schema: z\n        .object({\n          did: didSchema,\n          token: emailOtpSchema,\n          email: emailSchema,\n        })\n        .strict(),\n      async handler(req, res) {\n        let { account } = await authenticate.call(this, req, res)\n\n        account = await server.accountManager.verifyEmailConfirm(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n          account,\n        )\n\n        return { json: { account } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/update-handle',\n      schema: z\n        .object({\n          did: didSchema,\n          handle: handleSchema,\n        })\n        .strict(),\n      async handler(req, res) {\n        let { account } = await authenticate.call(this, req, res)\n\n        account = await server.accountManager.updateHandle(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n          account,\n        )\n\n        return { json: { account } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/deactivate-account',\n      schema: z.object({ did: didSchema }).strict(),\n      async handler(req, res) {\n        let { account } = await authenticate.call(this, req, res)\n\n        if (!account.deactivated) {\n          account = await server.accountManager.deactivateAccount(\n            this.deviceId,\n            this.deviceMetadata,\n            account,\n          )\n        }\n\n        return { json: { account } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/reactivate-account',\n      schema: z.object({ did: didSchema }).strict(),\n      async handler(req, res) {\n        let { account } = await authenticate.call(this, req, res)\n\n        if (account.deactivated) {\n          account = await server.accountManager.reactivateAccount(\n            this.deviceId,\n            this.deviceMetadata,\n            account,\n          )\n        }\n\n        return { json: { account } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/delete-account-request',\n      schema: z\n        .object({ did: didSchema, locale: localeSchema.optional() })\n        .strict(),\n      async handler(req, res) {\n        const { account } = await authenticate.call(this, req, res)\n\n        await server.accountManager.deleteAccountRequest(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n          account,\n        )\n\n        return { json: { success: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/delete-account-confirm',\n      schema: z\n        .object({\n          did: didSchema,\n          token: emailOtpSchema,\n          password: oldPasswordSchema,\n        })\n        .strict(),\n      async handler(req, res) {\n        const { account } = await authenticate.call(this, req, res)\n\n        await server.accountManager.deleteAccountConfirm(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n          account,\n        )\n\n        return { json: { success: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'GET',\n      endpoint: '/device-sessions',\n      schema: undefined,\n      async handler() {\n        const deviceAccounts = await server.accountManager.listDeviceAccounts(\n          this.deviceId,\n        )\n\n        const json = deviceAccounts.map(\n          (deviceAccount): ActiveDeviceSession => ({\n            account: deviceAccount.account,\n            loginRequired: server.checkLoginRequired(deviceAccount),\n          }),\n        )\n\n        return { json }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'GET',\n      endpoint: '/oauth-sessions',\n      schema: z.object({ did: didSchema }).strict(),\n      async handler(req, res) {\n        const { account } = await authenticate.call(this, req, res)\n\n        const tokenInfos = await server.tokenManager.listAccountTokens(\n          account.did,\n        )\n\n        const clientIds = tokenInfos.map((tokenInfo) => tokenInfo.data.clientId)\n\n        const clients = await server.clientManager.loadClients(clientIds, {\n          onError: (err, clientId) => {\n            onError?.(req, res, err, `Failed to load client ${clientId}`)\n            return undefined // metadata won't be available in the UI\n          },\n        })\n\n        // @TODO: We should ideally filter sessions that are expired (or even\n        // expose the expiration date). This requires a change to the way\n        // TokenInfo are stored (see TokenManager#isTokenExpired and\n        // TokenManager#isTokenInactive).\n        const json = tokenInfos.map(({ id, data }): ActiveOAuthSession => {\n          return {\n            tokenId: id,\n\n            createdAt: data.createdAt.toISOString() as ISODateString,\n            updatedAt: data.updatedAt.toISOString() as ISODateString,\n\n            clientId: data.clientId,\n            clientMetadata: clients.get(data.clientId)?.metadata,\n\n            scope: data.parameters.scope,\n          }\n        })\n\n        return { json }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'GET',\n      endpoint: '/account-sessions',\n      schema: z.object({ did: didSchema }).strict(),\n      async handler(req, res) {\n        const { account } = await authenticate.call(this, req, res)\n\n        const deviceAccounts = await server.accountManager.listAccountDevices(\n          account.did,\n        )\n\n        const json = deviceAccounts.map(\n          (accountSession): ActiveAccountSession => ({\n            deviceId: accountSession.deviceId,\n            deviceMetadata: {\n              ipAddress: accountSession.deviceData.ipAddress,\n              userAgent: accountSession.deviceData.userAgent,\n              lastSeenAt:\n                accountSession.deviceData.lastSeenAt.toISOString() as ISODateString,\n            },\n\n            isCurrentDevice: accountSession.deviceId === this.deviceId,\n          }),\n        )\n\n        return { json }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/revoke-account-session',\n      schema: z.object({ did: didSchema, deviceId: deviceIdSchema }).strict(),\n      async handler() {\n        // @NOTE This route is not authenticated. If a user is able to steal\n        // another user's session cookie, we allow them to revoke the device\n        // session.\n\n        await server.accountManager.removeDeviceAccount(\n          this.input.deviceId,\n          this.input.did,\n        )\n\n        return { json: { success: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/revoke-oauth-session',\n      schema: z.object({ did: didSchema, tokenId: tokenIdSchema }).strict(),\n      async handler(req, res) {\n        const { account } = await authenticate.call(this, req, res)\n\n        const tokenInfo = await server.tokenManager.getTokenInfo(\n          this.input.tokenId,\n        )\n\n        if (!tokenInfo || tokenInfo.account.did !== account.did) {\n          // report this as though the token was not found\n          throw new InvalidRequestError(`Invalid token`)\n        }\n\n        await server.tokenManager.deleteToken(tokenInfo.id)\n\n        return { json: { success: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/consent',\n      schema: z\n        .object({ did: didSchema, scope: oauthScopeSchema.optional() })\n        .strict(),\n      async handler(req, res) {\n        if (!this.requestUri) {\n          throw new InvalidRequestError(\n            'This endpoint can only be used in the context of an OAuth request',\n          )\n        }\n\n        // Any AuthorizationError caught in this block will result in a redirect\n        // to the client's redirect_uri with an error.\n        try {\n          const { clientId, parameters } = await server.requestManager.get(\n            this.requestUri,\n            this.deviceId,\n          )\n\n          // Any error thrown in this block will be transformed into an\n          // AuthorizationError.\n          try {\n            const { account, authorizedClients } = await authenticate.call(\n              this,\n              req,\n              res,\n            )\n\n            const client = await server.clientManager.getClient(clientId)\n\n            const code = await server.requestManager.setAuthorized(\n              this.requestUri,\n              client,\n              account,\n              this.deviceId,\n              this.deviceMetadata,\n              this.input.scope,\n            )\n\n            const clientData = authorizedClients.get(clientId)\n            if (server.checkConsentRequired(parameters, clientData)) {\n              const scopes = new Set(clientData?.authorizedScopes)\n\n              // Add the newly accepted scopes to the authorized scopes\n\n              // @NOTE `oauthScopeSchema` ensures that `scope` contains no\n              // leading/trailing/duplicate spaces.\n              for (const s of parameters.scope?.split(' ') ?? []) scopes.add(s)\n\n              await server.accountManager.setAuthorizedClient(account, client, {\n                ...clientData,\n                authorizedScopes: [...scopes],\n              })\n            }\n\n            const url = buildRedirectUrl(server.issuer, parameters, { code })\n\n            return { json: { url } }\n          } catch (err) {\n            // Since we have access to the parameters, we can re-throw an\n            // AuthorizationError with the redirect_uri parameter.\n            throw AuthorizationError.from(parameters, err)\n          }\n        } catch (err) {\n          onError?.(req, res, err, 'Failed to consent authorization request')\n\n          // If any error happened (unauthenticated, invalid request, etc.),\n          // lets make sure the request can no longer be used.\n          try {\n            await server.requestManager.delete(this.requestUri)\n          } catch (err) {\n            onError?.(req, res, err, 'Failed to delete request')\n          }\n\n          if (err instanceof AuthorizationError) {\n            try {\n              const url = buildRedirectUrl(\n                server.issuer,\n                err.parameters,\n                err.toJSON(),\n              )\n\n              return { json: { url } }\n            } catch {\n              // Unable to build redirect URL, ignore\n            }\n          }\n\n          // @NOTE Not re-throwing the error here, as the error was already\n          // handled by the `onError` callback, and apiRoute (`apiMiddleware`)\n          // would call `onError` again.\n          return buildErrorJsonResponse(err)\n        }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/reject',\n      schema: z.object({}).strict(),\n      rotateDeviceCookies: true,\n      async handler(req, res) {\n        const { requestUri } = this\n        if (!requestUri) {\n          throw new InvalidRequestError(\n            'This endpoint can only be used in the context of an OAuth request',\n          )\n        }\n\n        // Once this endpoint is called, the request will definitely be\n        // rejected.\n        try {\n          // No need to authenticate the user here as they are not authorizing a\n          // particular account (CSRF protection is enough).\n\n          // @NOTE that the client could *technically* trigger this endpoint while\n          // the user is on the authorize page by forging the request (because the\n          // client knows the RequestURI from PAR and has all the info needed to\n          // forge the request, including CSRF). This cannot be used as DoS attack\n          // as the request ID is not guessable and would only result in a bad UX\n          // for misbehaving clients, only for the users of those clients.\n\n          const { parameters } = await server.requestManager.get(\n            requestUri,\n            this.deviceId,\n          )\n\n          const url = buildRedirectUrl(server.issuer, parameters, {\n            error: 'access_denied',\n            error_description: 'The user rejected the request',\n          })\n\n          return { json: { url } }\n        } catch (err) {\n          onError?.(req, res, err, 'Failed to reject authorization request')\n\n          if (err instanceof AuthorizationError) {\n            try {\n              const url = buildRedirectUrl(\n                server.issuer,\n                err.parameters,\n                err.toJSON(),\n              )\n\n              return { json: { url } }\n            } catch {\n              // Unable to build redirect URL, ignore\n            }\n          }\n\n          return buildErrorJsonResponse(err)\n        } finally {\n          await server.requestManager.delete(requestUri).catch((err) => {\n            onError?.(req, res, err, 'Failed to delete request')\n          })\n        }\n      },\n    }),\n  )\n\n  return router.buildMiddleware()\n\n  async function authenticate(\n    this: ApiContext<void, { did: Did }>,\n    req: Req,\n    _res: Res,\n  ) {\n    if (req.headers.authorization?.startsWith('Bearer ')) {\n      try {\n        // If there is an authorization header, verify that the ephemeral token it\n        // contains is a jwt bound to the right [sub, device, request].\n        const bearer = req.headers.authorization.slice(7)\n        const ephemeralToken = signedJwtSchema.parse(bearer)\n        const { payload } =\n          await server.signer.verifyEphemeralToken(ephemeralToken)\n\n        if (\n          payload.sub === this.input.did &&\n          payload.deviceId === this.deviceId &&\n          payload.requestUri === this.requestUri\n        ) {\n          return await server.accountManager.getAccount(payload.sub)\n        }\n      } catch (err) {\n        throw new WWWAuthenticateError(\n          'unauthorized',\n          `Invalid or expired bearer token`,\n          { Bearer: {} },\n          err,\n        )\n      }\n    }\n\n    try {\n      // Ensures the \"sub\" has an active session on the device\n      const deviceAccount = await server.accountManager.getDeviceAccount(\n        this.deviceId,\n        this.input.did,\n      )\n\n      // The session exists but was created too long ago\n      if (server.checkLoginRequired(deviceAccount)) {\n        throw new InvalidRequestError('Login required')\n      }\n\n      return deviceAccount\n    } catch (err) {\n      throw new WWWAuthenticateError(\n        'unauthorized',\n        `User ${this.input.did} not authenticated on this device`,\n        { Bearer: {} },\n        err,\n      )\n    }\n  }\n\n  type ApiContext<T extends object | void, I = void> = SubCtx<\n    T,\n    {\n      deviceId: DeviceId\n      deviceMetadata: RequestMetadata\n\n      /**\n       * The parsed input data (json payload if \"POST\", query params if \"GET\").\n       */\n      input: I\n\n      /**\n       * When defined, the request originated from the authorize page.\n       */\n      requestUri?: RequestUri\n    }\n  >\n\n  type InferValidation<S extends void | z.ZodTypeAny> = S extends z.ZodTypeAny\n    ? z.infer<S>\n    : void\n\n  /**\n   * The main purpose of this function is to ensure that the endpoint\n   * implementation matches its type definition from {@link ApiEndpoints}.\n   * @private\n   */\n  function apiRoute<\n    C extends RouterCtx<Ctx>,\n    M extends 'GET' | 'POST',\n    E extends `/${string}` &\n      // Extract all the endpoint path that match the method (allows for\n      // auto-complete & better error reporting)\n      {\n        [E in keyof ApiEndpoints]: ApiEndpoints[E] extends { method: M }\n          ? E\n          : never\n      }[keyof ApiEndpoints],\n    S extends // A schema that validates the POST input or GET params\n      ApiEndpoints[E] extends { method: 'POST'; input: infer I }\n        ? z.ZodType<I, z.ZodTypeDef, unknown>\n        : ApiEndpoints[E] extends { method: 'GET'; params: infer P }\n          ? z.ZodType<P, z.ZodTypeDef, unknown>\n          : void,\n  >(options: {\n    method: M\n    endpoint: E\n    schema: S\n    rotateDeviceCookies?: boolean\n    handler: (\n      this: ApiContext<RouteCtx<C>, InferValidation<S>>,\n      req: Req,\n      res: Res,\n    ) => Awaitable<JsonResponse<ErrorPayload | ApiEndpoints[E]['output']>>\n  }): Middleware<C, Req, Res> {\n    return createRoute(\n      options.method,\n      `${API_ENDPOINT_PREFIX}${options.endpoint}`,\n      apiMiddleware(options),\n    )\n  }\n\n  function apiMiddleware<C extends RouterCtx, S extends void | z.ZodTypeAny>({\n    method,\n    schema,\n    rotateDeviceCookies,\n    handler,\n  }: {\n    method: 'GET' | 'POST'\n    schema: S\n    rotateDeviceCookies?: boolean\n    handler: (\n      this: ApiContext<C, InferValidation<S>>,\n      req: Req,\n      res: Res,\n    ) => Awaitable<JsonResponse>\n  }): Middleware<C, Req, Res> {\n    const parseInput: (this: C, req: Req) => Promise<InferValidation<S>> =\n      schema == null // No schema means endpoint doesn't accept any input\n        ? async function (req) {\n            await flushStream(req)\n            return undefined\n          }\n        : method === 'POST'\n          ? async function (req) {\n              const body = await parseHttpRequest(req, ['json'])\n              return schema.parseAsync(body, { path: ['body'] })\n            }\n          : async function (req) {\n              await flushStream(req)\n              const query = Object.fromEntries(this.url.searchParams)\n              return schema.parseAsync(query, { path: ['query'] })\n            }\n\n    return jsonHandler<C, Req, Res>(async function (req, res) {\n      try {\n        // Prevent caching of API routes\n        res.setHeader('Cache-Control', 'no-store')\n        res.setHeader('Pragma', 'no-cache')\n\n        // Prevent CORS requests\n        validateFetchMode(req, ['same-origin'])\n        validateFetchSite(req, ['same-origin'])\n        validateOrigin(req, issuerOrigin)\n        const referrer = validateReferrer(req, { origin: issuerOrigin })\n\n        // Ensure we are one the right page\n        if (\n          // trailing slashes are not allowed\n          referrer.pathname !== '/oauth/authorize' &&\n          referrer.pathname !== '/account' &&\n          !referrer.pathname.startsWith(`/account/`)\n        ) {\n          throw createHttpError(400, `Invalid referrer ${referrer}`)\n        }\n\n        // Check if the request originated from the authorize page\n        const requestUri =\n          referrer.pathname === '/oauth/authorize'\n            ? await requestUriSchema.parseAsync(\n                referrer.searchParams.get('request_uri'),\n              )\n            : undefined\n\n        // Validate CSRF token\n        await validateCsrfToken(req, res)\n\n        // Parse and validate the input data\n        const input = await parseInput.call(this, req)\n\n        // Load session data, rotating the session cookie if needed\n        const { deviceId, deviceMetadata } = await server.deviceManager.load(\n          req,\n          res,\n          rotateDeviceCookies,\n        )\n\n        const context: ApiContext<C, InferValidation<S>> = subCtx(this, {\n          input,\n          requestUri,\n          deviceId,\n          deviceMetadata,\n        })\n\n        return await handler.call(context, req, res)\n      } catch (err) {\n        onError?.(req, res, err, `Failed to handle API request`)\n\n        // Make sore to always return a JSON response\n        return buildErrorJsonResponse(err)\n      }\n    })\n  }\n}\n\nfunction buildErrorJsonResponse(err: unknown) {\n  // @TODO Rework the API error responses (relying on codes)\n  const json = buildErrorPayload(err)\n  const status = buildErrorStatus(err)\n\n  return { json, status }\n}\n\nfunction buildRedirectUrl(\n  iss: string,\n  parameters: OAuthAuthorizationRequestParameters,\n  redirect: AuthorizationRedirectParameters,\n): string {\n  const url = new URL('/oauth/authorize/redirect', iss)\n\n  url.searchParams.set('redirect_mode', buildRedirectMode(parameters))\n  url.searchParams.set('redirect_uri', buildRedirectUri(parameters))\n\n  for (const [key, value] of buildRedirectParams(iss, parameters, redirect)) {\n    url.searchParams.set(key, value)\n  }\n\n  return url.href\n}\n\nexport function parseRedirectUrl(url: URL): OAuthRedirectOptions {\n  if (url.pathname !== '/oauth/authorize/redirect') {\n    throw new InvalidRequestError(\n      `Invalid redirect URL: ${url.pathname} is not a valid path`,\n    )\n  }\n\n  const params: [OAuthRedirectQueryParameter, string][] = []\n\n  const state = url.searchParams.get('state')\n  if (state) params.push(['state', state])\n\n  const iss = url.searchParams.get('iss')\n  if (iss) params.push(['iss', iss])\n\n  if (url.searchParams.has('code')) {\n    for (const key of SUCCESS_REDIRECT_KEYS) {\n      const value = url.searchParams.get(key)\n      if (value != null) params.push([key, value])\n    }\n  } else if (url.searchParams.has('error')) {\n    for (const key of ERROR_REDIRECT_KEYS) {\n      const value = url.searchParams.get(key)\n      if (value != null) params.push([key, value])\n    }\n  } else {\n    throw new InvalidRequestError(\n      'Invalid redirect URL: neither code nor error found',\n    )\n  }\n\n  try {\n    const mode: OAuthResponseMode = oauthResponseModeSchema.parse(\n      url.searchParams.get('redirect_mode'),\n    )\n\n    const redirectUri: OAuthRedirectUri = oauthRedirectUriSchema.parse(\n      url.searchParams.get('redirect_uri'),\n    )\n\n    return { mode, redirectUri, params }\n  } catch (err) {\n    throw InvalidRequestError.from(err, 'Invalid redirect URL')\n  }\n}\n"]}
+{"version":3,"file":"create-api-middleware.js","sourceRoot":"","sources":["../../src/router/create-api-middleware.ts"],"names":[],"mappings":"AACA,OAAO,eAAe,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAY,SAAS,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAQ9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAIL,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAiB,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAEL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAIL,MAAM,EAGN,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,MAAM,EACN,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAiB,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAGpD,OAAO,EAAmB,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE7E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EACL,mBAAmB,EAGnB,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,2BAA2B,CAAA;AAGlC,MAAM,UAAU,mBAAmB,CAKjC,MAAqB,EACrB,EAAE,OAAO,EAA+B;IAExC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAA;IACrC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAgB,SAAS,CAAC,CAAA;IAEnD,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,6BAA6B;QACvC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACnD,KAAK,CAAC,OAAO;YACX,MAAM,MAAM,CAAC,cAAc,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACvE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAA;QACtC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,iBAAiB;QACzB,mBAAmB,EAAE,IAAI;QACzB,KAAK,CAAC,OAAO;YACX,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;YAE5D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,aAAa,CACvD,QAAQ,EACR,cAAc,EACd,KAAK,CACN,CAAA;YAED,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,UAAU,IAAI,IAAI,CAAA;YAEnC,4EAA4E;YAC5E,cAAc;YACd,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;YACxE,CAAC;YAED,MAAM,cAAc,GAAG,QAAQ;gBAC7B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC;oBACvC,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,QAAQ;oBACR,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAA;YAEN,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAA;YACxC,OAAO,EAAE,IAAI,EAAE,CAAA;QACjB,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QACrE,mBAAmB,EAAE,IAAI;QACzB,KAAK,CAAC,OAAO;YACX,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;YAErD,2DAA2D;YAC3D,MAAM,EAAE,QAAQ,GAAG,UAAU,IAAI,IAAI,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAA;YAE9D,kEAAkE;YAClE,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,UAAU;gBACzB,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,UAAU,CAAC;gBACtD,CAAC,CAAC,SAAS,CAAA;YAEb,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAC7D,QAAQ,EACR,cAAc,EACd,KAAK,EACL,QAAQ,CACT,CAAA;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;YACxE,CAAC;iBAAM,CAAC;gBACN,oEAAoE;gBACpE,iEAAiE;gBACjE,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;YACxE,CAAC;YAED,MAAM,cAAc,GAAG,QAAQ;gBAC7B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC;oBACvC,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,QAAQ;oBACR,UAAU;iBACX,CAAC,CAAA;YAEN,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAA;YACxC,OAAO,EAAE,IAAI,EAAE,CAAA;QACjB,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,WAAW;QACrB,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;SAC9C,CAAC;aACD,MAAM,EAAE;QACX,mBAAmB,EAAE,IAAI;QACzB,KAAK,CAAC,OAAO;YACX,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAEnD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YACrE,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAa,EAAE,EAAE,CAAA;QAC7C,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,yBAAyB;QACnC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,WAAW;SACnB,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO;YACX,MAAM,MAAM,CAAC,cAAc,CAAC,oBAAoB,CAC9C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,CACX,CAAA;YACD,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,yBAAyB;QACnC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,iBAAiB;SAC5B,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO;YACX,MAAM,MAAM,CAAC,cAAc,CAAC,oBAAoB,CAC9C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,CACX,CAAA;YACD,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,GAAG,EAAE,SAAS;YACd,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;SAChC,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAE3D,MAAM,EAAE,aAAa,EAAE,GACrB,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAC5C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,EACV,OAAO,CACR,CAAA;YAEH,OAAO,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,cAAc,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;SAChC,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAEzD,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,CACtD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,EACV,OAAO,CACR,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAA;QAC9B,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,GAAG,EAAE,SAAS;YACd,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;SAChC,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAE3D,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAC5C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,EACV,OAAO,CACR,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,cAAc;YACrB,KAAK,EAAE,WAAW;SACnB,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAEzD,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,CACtD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,EACV,OAAO,CACR,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAA;QAC9B,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,gBAAgB;QAC1B,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,GAAG,EAAE,SAAS;YACd,MAAM,EAAE,YAAY;SACrB,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAEzD,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,YAAY,CAChD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,EACV,OAAO,CACR,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAA;QAC9B,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,qBAAqB;QAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAEzD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACzB,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,iBAAiB,CACrD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,OAAO,CACR,CAAA;YACH,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAA;QAC9B,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,qBAAqB;QAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAEzD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxB,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,iBAAiB,CACrD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,OAAO,CACR,CAAA;YACH,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAA;QAC9B,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,yBAAyB;QACnC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;aAC3D,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAE3D,MAAM,MAAM,CAAC,cAAc,CAAC,oBAAoB,CAC9C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,EACV,OAAO,CACR,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,yBAAyB;QACnC,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,iBAAiB;SAC5B,CAAC;aACD,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAE3D,MAAM,MAAM,CAAC,cAAc,CAAC,oBAAoB,CAC9C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,EACV,OAAO,CACR,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE,SAAS;QACjB,KAAK,CAAC,OAAO;YACX,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,CACnE,IAAI,CAAC,QAAQ,CACd,CAAA;YAED,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAC7B,CAAC,aAAa,EAAuB,EAAE,CAAC,CAAC;gBACvC,OAAO,EAAE,aAAa,CAAC,OAAO;gBAC9B,aAAa,EAAE,MAAM,CAAC,kBAAkB,CAAC,aAAa,CAAC;aACxD,CAAC,CACH,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,CAAA;QACjB,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAE3D,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAC5D,OAAO,CAAC,GAAG,CACZ,CAAA;YAED,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAExE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE;gBAChE,OAAO,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;oBACzB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,yBAAyB,QAAQ,EAAE,CAAC,CAAA;oBAC7D,OAAO,SAAS,CAAA,CAAC,wCAAwC;gBAC3D,CAAC;aACF,CAAC,CAAA;YAEF,qEAAqE;YACrE,iEAAiE;YACjE,4DAA4D;YAC5D,iCAAiC;YACjC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAsB,EAAE;gBAC/D,OAAO;oBACL,OAAO,EAAE,EAAE;oBAEX,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAmB;oBACxD,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAmB;oBAExD,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ;oBAEpD,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;iBAC7B,CAAA;YACH,CAAC,CAAC,CAAA;YAEF,OAAO,EAAE,IAAI,EAAE,CAAA;QACjB,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,mBAAmB;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAE3D,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,kBAAkB,CACnE,OAAO,CAAC,GAAG,CACZ,CAAA;YAED,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAC7B,CAAC,cAAc,EAAwB,EAAE,CAAC,CAAC;gBACzC,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,cAAc,EAAE;oBACd,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,SAAS;oBAC9C,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,SAAS;oBAC9C,UAAU,EACR,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,EAAmB;iBACtE;gBAED,eAAe,EAAE,cAAc,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;aAC3D,CAAC,CACH,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,CAAA;QACjB,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,yBAAyB;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;QACvE,KAAK,CAAC,OAAO;YACX,oEAAoE;YACpE,oEAAoE;YACpE,WAAW;YAEX,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAC7C,IAAI,CAAC,KAAK,CAAC,QAAQ,EACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CACf,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACrE,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAE3D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,YAAY,CACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CACnB,CAAA;YAED,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBACxD,gDAAgD;gBAChD,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAA;YAChD,CAAC;YAED,MAAM,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAEnD,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACpC,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,CAAC;aACN,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,QAAQ,EAAE,EAAE,CAAC;aAC9D,MAAM,EAAE;QACX,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrB,MAAM,IAAI,mBAAmB,CAC3B,mEAAmE,CACpE,CAAA;YACH,CAAC;YAED,wEAAwE;YACxE,8CAA8C;YAC9C,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,GAAG,CAC9D,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,QAAQ,CACd,CAAA;gBAED,6DAA6D;gBAC7D,sBAAsB;gBACtB,IAAI,CAAC;oBACH,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAC5D,IAAI,EACJ,GAAG,EACH,GAAG,CACJ,CAAA;oBAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;oBAE7D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,aAAa,CACpD,IAAI,CAAC,UAAU,EACf,MAAM,EACN,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,KAAK,CAAC,KAAK,CACjB,CAAA;oBAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;oBAClD,IAAI,MAAM,CAAC,oBAAoB,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;wBACxD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;wBAEpD,yDAAyD;wBAEzD,4DAA4D;wBAC5D,qCAAqC;wBACrC,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;4BAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;wBAEjE,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE;4BAC/D,GAAG,UAAU;4BACb,gBAAgB,EAAE,CAAC,GAAG,MAAM,CAAC;yBAC9B,CAAC,CAAA;oBACJ,CAAC;oBAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;oBAEjE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAA;gBAC1B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,6DAA6D;oBAC7D,sDAAsD;oBACtD,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBAChD,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,yCAAyC,CAAC,CAAA;gBAEnE,kEAAkE;gBAClE,oDAAoD;gBACpD,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBACrD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAA;gBACtD,CAAC;gBAED,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;oBACtC,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,gBAAgB,CAC1B,MAAM,CAAC,MAAM,EACb,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,MAAM,EAAE,CACb,CAAA;wBAED,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAA;oBAC1B,CAAC;oBAAC,MAAM,CAAC;wBACP,uCAAuC;oBACzC,CAAC;gBACH,CAAC;gBAED,iEAAiE;gBACjE,oEAAoE;gBACpE,8BAA8B;gBAC9B,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;KACF,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,QAAQ,CAAC;QACP,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QAC7B,mBAAmB,EAAE,IAAI;QACzB,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;YAC3B,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,mBAAmB,CAC3B,mEAAmE,CACpE,CAAA;YACH,CAAC;YAED,+DAA+D;YAC/D,YAAY;YACZ,IAAI,CAAC;gBACH,sEAAsE;gBACtE,kDAAkD;gBAElD,wEAAwE;gBACxE,wEAAwE;gBACxE,sEAAsE;gBACtE,wEAAwE;gBACxE,uEAAuE;gBACvE,gEAAgE;gBAEhE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,GAAG,CACpD,UAAU,EACV,IAAI,CAAC,QAAQ,CACd,CAAA;gBAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE;oBACtD,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EAAE,+BAA+B;iBACnD,CAAC,CAAA;gBAEF,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAA;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,wCAAwC,CAAC,CAAA;gBAElE,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;oBACtC,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,gBAAgB,CAC1B,MAAM,CAAC,MAAM,EACb,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,MAAM,EAAE,CACb,CAAA;wBAED,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAA;oBAC1B,CAAC;oBAAC,MAAM,CAAC;wBACP,uCAAuC;oBACzC,CAAC;gBACH,CAAC;gBAED,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACpC,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC3D,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAA;gBACtD,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;KACF,CAAC,CACH,CAAA;IAED,OAAO,MAAM,CAAC,eAAe,EAAE,CAAA;IAE/B,KAAK,UAAU,YAAY,CAEzB,GAAQ,EACR,IAAS;QAET,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,+DAA+D;gBAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBACjD,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBACpD,MAAM,EAAE,OAAO,EAAE,GACf,MAAM,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAA;gBAE1D,IACE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG;oBAC9B,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;oBAClC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EACtC,CAAC;oBACD,OAAO,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAC5D,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,oBAAoB,CAC5B,cAAc,EACd,iCAAiC,EACjC,EAAE,MAAM,EAAE,EAAE,EAAE,EACd,GAAG,CACJ,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,wDAAwD;YACxD,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAChE,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CAAC,GAAG,CACf,CAAA;YAED,kDAAkD;YAClD,IAAI,MAAM,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAA;YACjD,CAAC;YAED,OAAO,aAAa,CAAA;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,oBAAoB,CAC5B,cAAc,EACd,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,mCAAmC,EACzD,EAAE,MAAM,EAAE,EAAE,EAAE,EACd,GAAG,CACJ,CAAA;QACH,CAAC;IACH,CAAC;IAwBD;;;;OAIG;IACH,SAAS,QAAQ,CAiBf,OAUD;QACC,OAAO,WAAW,CAChB,OAAO,CAAC,MAAM,EACd,GAAG,mBAAmB,GAAG,OAAO,CAAC,QAAQ,EAAE,EAC3C,aAAa,CAAC,OAAO,CAAC,CACvB,CAAA;IACH,CAAC;IAED,SAAS,aAAa,CAAqD,EACzE,MAAM,EACN,MAAM,EACN,mBAAmB,EACnB,OAAO,GAUR;QACC,MAAM,UAAU,GACd,MAAM,IAAI,IAAI,CAAC,oDAAoD;YACjE,CAAC,CAAC,KAAK,WAAW,GAAG;gBACjB,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;gBACtB,OAAO,SAAS,CAAA;YAClB,CAAC;YACH,CAAC,CAAC,MAAM,KAAK,MAAM;gBACjB,CAAC,CAAC,KAAK,WAAW,GAAG;oBACjB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;oBAClD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBACpD,CAAC;gBACH,CAAC,CAAC,KAAK,WAAW,GAAG;oBACjB,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;oBACtB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;oBACvD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACtD,CAAC,CAAA;QAET,OAAO,WAAW,CAAc,KAAK,WAAW,GAAG,EAAE,GAAG;YACtD,IAAI,CAAC;gBACH,gCAAgC;gBAChC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;gBAC1C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;gBAEnC,wBAAwB;gBACxB,iBAAiB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAA;gBACvC,iBAAiB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAA;gBACvC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;gBACjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;gBAEhE,mCAAmC;gBACnC;gBACE,mCAAmC;gBACnC,QAAQ,CAAC,QAAQ,KAAK,kBAAkB;oBACxC,QAAQ,CAAC,QAAQ,KAAK,UAAU;oBAChC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAC1C,CAAC;oBACD,MAAM,eAAe,CAAC,GAAG,EAAE,oBAAoB,QAAQ,EAAE,CAAC,CAAA;gBAC5D,CAAC;gBAED,0DAA0D;gBAC1D,MAAM,UAAU,GACd,QAAQ,CAAC,QAAQ,KAAK,kBAAkB;oBACtC,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,CAC/B,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CACzC;oBACH,CAAC,CAAC,SAAS,CAAA;gBAEf,sBAAsB;gBACtB,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBAEjC,oCAAoC;gBACpC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;gBAE9C,2DAA2D;gBAC3D,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAClE,GAAG,EACH,GAAG,EACH,mBAAmB,CACpB,CAAA;gBAED,MAAM,OAAO,GAAsC,MAAM,CAAC,IAAI,EAAE;oBAC9D,KAAK;oBACL,UAAU;oBACV,QAAQ;oBACR,cAAc;iBACf,CAAC,CAAA;gBAEF,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAC9C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,8BAA8B,CAAC,CAAA;gBAExD,6CAA6C;gBAC7C,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACpC,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAY;IAC1C,0DAA0D;IAC1D,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAEpC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAW,EACX,UAA+C,EAC/C,QAAyC;IAEzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAA;IAErD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAA;IACpE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAA;IAElE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,mBAAmB,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAQ;IACvC,IAAI,GAAG,CAAC,QAAQ,KAAK,2BAA2B,EAAE,CAAC;QACjD,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,GAAG,CAAC,QAAQ,sBAAsB,CAC5D,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAA4C,EAAE,CAAA;IAE1D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;IAExC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;IAElC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,KAAK,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,KAAK,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAsB,uBAAuB,CAAC,KAAK,CAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CACtC,CAAA;QAED,MAAM,WAAW,GAAqB,sBAAsB,CAAC,KAAK,CAChE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CACrC,CAAA;QAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAC7D,CAAC;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport createHttpError from 'http-errors'\nimport { z } from 'zod'\nimport { type Did, didSchema } from '@atproto/did'\nimport { signedJwtSchema } from '@atproto/jwk'\nimport type {\n  ActiveAccountSession,\n  ActiveDeviceSession,\n  ActiveOAuthSession,\n  ApiEndpoints,\n  ISODateString,\n} from '@atproto/oauth-provider-api'\nimport { API_ENDPOINT_PREFIX } from '@atproto/oauth-provider-api'\nimport {\n  type OAuthAuthorizationRequestParameters,\n  type OAuthRedirectUri,\n  type OAuthResponseMode,\n  oauthRedirectUriSchema,\n  oauthResponseModeSchema,\n  oauthScopeSchema,\n} from '@atproto/oauth-types'\nimport { signInDataSchema } from '../account/sign-in-data.js'\nimport { signUpInputSchema } from '../account/sign-up-input.js'\nimport { type DeviceId, deviceIdSchema } from '../device/device-id.js'\nimport { AuthorizationError } from '../errors/authorization-error.js'\nimport {\n  type ErrorPayload,\n  buildErrorPayload,\n  buildErrorStatus,\n} from '../errors/error-parser.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport { WWWAuthenticateError } from '../errors/www-authenticate-error.js'\nimport {\n  type JsonResponse,\n  type Middleware,\n  type RequestMetadata,\n  Router,\n  type RouterCtx,\n  type SubCtx,\n  flushStream,\n  jsonHandler,\n  parseHttpRequest,\n  subCtx,\n  validateFetchMode,\n  validateFetchSite,\n  validateOrigin,\n  validateReferrer,\n} from '../lib/http/index.js'\nimport { type RouteCtx, createRoute } from '../lib/http/route.js'\nimport { asArray } from '../lib/util/cast.js'\nimport { localeSchema } from '../lib/util/locale.js'\nimport type { Awaitable } from '../lib/util/type.js'\nimport type { OAuthProvider } from '../oauth-provider.js'\nimport { type RequestUri, requestUriSchema } from '../request/request-uri.js'\nimport type { AuthorizationRedirectParameters } from '../result/authorization-redirect-parameters.js'\nimport { tokenIdSchema } from '../token/token-id.js'\nimport { emailOtpSchema } from '../types/email-otp.js'\nimport { emailSchema } from '../types/email.js'\nimport { handleSchema } from '../types/handle.js'\nimport { newPasswordSchema, oldPasswordSchema } from '../types/password.js'\nimport { validateCsrfToken } from './assets/csrf.js'\nimport {\n  ERROR_REDIRECT_KEYS,\n  type OAuthRedirectOptions,\n  type OAuthRedirectQueryParameter,\n  SUCCESS_REDIRECT_KEYS,\n  buildRedirectMode,\n  buildRedirectParams,\n  buildRedirectUri,\n} from './assets/send-redirect.js'\nimport type { MiddlewareOptions } from './middleware-options.js'\n\nexport function createApiMiddleware<\n  Ctx extends object | void = void,\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { onError }: MiddlewareOptions<Req, Res>,\n): Middleware<Ctx, Req, Res> {\n  const issuerUrl = new URL(server.issuer)\n  const issuerOrigin = issuerUrl.origin\n  const router = new Router<Ctx, Req, Res>(issuerUrl)\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/verify-handle-availability',\n      schema: z.object({ handle: handleSchema }).strict(),\n      async handler() {\n        await server.accountManager.verifyHandleAvailability(this.input.handle)\n        return { json: { available: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/sign-up',\n      schema: signUpInputSchema,\n      rotateDeviceCookies: true,\n      async handler() {\n        const { deviceId, deviceMetadata, input, requestUri } = this\n\n        const account = await server.accountManager.createAccount(\n          deviceId,\n          deviceMetadata,\n          input,\n        )\n\n        // Remember when not in the context of a request by default\n        const remember = requestUri == null\n\n        // Only \"remember\" the newly created account if it was not created during an\n        // OAuth flow.\n        if (remember) {\n          await server.accountManager.upsertDeviceAccount(deviceId, account.did)\n        }\n\n        const ephemeralToken = remember\n          ? undefined\n          : await server.signer.createEphemeralToken({\n              sub: account.did,\n              deviceId,\n              requestUri: this.requestUri,\n            })\n\n        const json = { account, ephemeralToken }\n        return { json }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/sign-in',\n      schema: signInDataSchema.extend({ remember: z.boolean().optional() }),\n      rotateDeviceCookies: true,\n      async handler() {\n        const { deviceId, deviceMetadata, requestUri } = this\n\n        // Remember when not in the context of a request by default\n        const { remember = requestUri == null, ...input } = this.input\n\n        // Look up the client identifier associated with the pending OAuth\n        // request, if any, so it can be surfaced to the sign-in hooks.\n        const clientId = requestUri\n          ? await server.requestManager.peekClientId(requestUri)\n          : undefined\n\n        const account = await server.accountManager.authenticateAccount(\n          deviceId,\n          deviceMetadata,\n          input,\n          clientId,\n        )\n\n        if (remember) {\n          await server.accountManager.upsertDeviceAccount(deviceId, account.did)\n        } else {\n          // In case the user was already signed in, and signed in again, this\n          // time without \"remember me\", let's sign them off of the device.\n          await server.accountManager.removeDeviceAccount(deviceId, account.did)\n        }\n\n        const ephemeralToken = remember\n          ? undefined\n          : await server.signer.createEphemeralToken({\n              sub: account.did,\n              deviceId,\n              requestUri,\n            })\n\n        const json = { account, ephemeralToken }\n        return { json }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/sign-out',\n      schema: z\n        .object({\n          did: z.union([didSchema, z.array(didSchema)]),\n        })\n        .strict(),\n      rotateDeviceCookies: true,\n      async handler() {\n        const uniqueSubs = new Set(asArray(this.input.did))\n\n        for (const sub of uniqueSubs) {\n          await server.accountManager.removeDeviceAccount(this.deviceId, sub)\n        }\n\n        return { json: { success: true as const } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/reset-password-request',\n      schema: z\n        .object({\n          locale: localeSchema,\n          email: emailSchema,\n        })\n        .strict(),\n      async handler() {\n        await server.accountManager.resetPasswordRequest(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n        )\n        return { json: { success: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/reset-password-confirm',\n      schema: z\n        .object({\n          token: emailOtpSchema,\n          password: newPasswordSchema,\n        })\n        .strict(),\n      async handler() {\n        await server.accountManager.resetPasswordConfirm(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n        )\n        return { json: { success: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/update-email-request',\n      schema: z\n        .object({\n          did: didSchema,\n          locale: localeSchema.optional(),\n        })\n        .strict(),\n      async handler(req, res) {\n        const { account } = await authenticate.call(this, req, res)\n\n        const { tokenRequired } =\n          await server.accountManager.updateEmailRequest(\n            this.deviceId,\n            this.deviceMetadata,\n            this.input,\n            account,\n          )\n\n        return { json: { tokenRequired } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/update-email-confirm',\n      schema: z\n        .object({\n          did: didSchema,\n          email: emailSchema,\n          token: emailOtpSchema.optional(),\n          locale: localeSchema.optional(),\n        })\n        .strict(),\n      async handler(req, res) {\n        let { account } = await authenticate.call(this, req, res)\n\n        account = await server.accountManager.updateEmailConfirm(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n          account,\n        )\n\n        return { json: { account } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/verify-email-request',\n      schema: z\n        .object({\n          did: didSchema,\n          locale: localeSchema.optional(),\n        })\n        .strict(),\n      async handler(req, res) {\n        const { account } = await authenticate.call(this, req, res)\n\n        await server.accountManager.verifyEmailRequest(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n          account,\n        )\n\n        return { json: { success: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/verify-email-confirm',\n      schema: z\n        .object({\n          did: didSchema,\n          token: emailOtpSchema,\n          email: emailSchema,\n        })\n        .strict(),\n      async handler(req, res) {\n        let { account } = await authenticate.call(this, req, res)\n\n        account = await server.accountManager.verifyEmailConfirm(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n          account,\n        )\n\n        return { json: { account } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/update-handle',\n      schema: z\n        .object({\n          did: didSchema,\n          handle: handleSchema,\n        })\n        .strict(),\n      async handler(req, res) {\n        let { account } = await authenticate.call(this, req, res)\n\n        account = await server.accountManager.updateHandle(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n          account,\n        )\n\n        return { json: { account } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/deactivate-account',\n      schema: z.object({ did: didSchema }).strict(),\n      async handler(req, res) {\n        let { account } = await authenticate.call(this, req, res)\n\n        if (!account.deactivated) {\n          account = await server.accountManager.deactivateAccount(\n            this.deviceId,\n            this.deviceMetadata,\n            account,\n          )\n        }\n\n        return { json: { account } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/reactivate-account',\n      schema: z.object({ did: didSchema }).strict(),\n      async handler(req, res) {\n        let { account } = await authenticate.call(this, req, res)\n\n        if (account.deactivated) {\n          account = await server.accountManager.reactivateAccount(\n            this.deviceId,\n            this.deviceMetadata,\n            account,\n          )\n        }\n\n        return { json: { account } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/delete-account-request',\n      schema: z\n        .object({ did: didSchema, locale: localeSchema.optional() })\n        .strict(),\n      async handler(req, res) {\n        const { account } = await authenticate.call(this, req, res)\n\n        await server.accountManager.deleteAccountRequest(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n          account,\n        )\n\n        return { json: { success: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/delete-account-confirm',\n      schema: z\n        .object({\n          did: didSchema,\n          token: emailOtpSchema,\n          password: oldPasswordSchema,\n        })\n        .strict(),\n      async handler(req, res) {\n        const { account } = await authenticate.call(this, req, res)\n\n        await server.accountManager.deleteAccountConfirm(\n          this.deviceId,\n          this.deviceMetadata,\n          this.input,\n          account,\n        )\n\n        return { json: { success: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'GET',\n      endpoint: '/device-sessions',\n      schema: undefined,\n      async handler() {\n        const deviceAccounts = await server.accountManager.listDeviceAccounts(\n          this.deviceId,\n        )\n\n        const json = deviceAccounts.map(\n          (deviceAccount): ActiveDeviceSession => ({\n            account: deviceAccount.account,\n            loginRequired: server.checkLoginRequired(deviceAccount),\n          }),\n        )\n\n        return { json }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'GET',\n      endpoint: '/oauth-sessions',\n      schema: z.object({ did: didSchema }).strict(),\n      async handler(req, res) {\n        const { account } = await authenticate.call(this, req, res)\n\n        const tokenInfos = await server.tokenManager.listAccountTokens(\n          account.did,\n        )\n\n        const clientIds = tokenInfos.map((tokenInfo) => tokenInfo.data.clientId)\n\n        const clients = await server.clientManager.loadClients(clientIds, {\n          onError: (err, clientId) => {\n            onError?.(req, res, err, `Failed to load client ${clientId}`)\n            return undefined // metadata won't be available in the UI\n          },\n        })\n\n        // @TODO: We should ideally filter sessions that are expired (or even\n        // expose the expiration date). This requires a change to the way\n        // TokenInfo are stored (see TokenManager#isTokenExpired and\n        // TokenManager#isTokenInactive).\n        const json = tokenInfos.map(({ id, data }): ActiveOAuthSession => {\n          return {\n            tokenId: id,\n\n            createdAt: data.createdAt.toISOString() as ISODateString,\n            updatedAt: data.updatedAt.toISOString() as ISODateString,\n\n            clientId: data.clientId,\n            clientMetadata: clients.get(data.clientId)?.metadata,\n\n            scope: data.parameters.scope,\n          }\n        })\n\n        return { json }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'GET',\n      endpoint: '/account-sessions',\n      schema: z.object({ did: didSchema }).strict(),\n      async handler(req, res) {\n        const { account } = await authenticate.call(this, req, res)\n\n        const deviceAccounts = await server.accountManager.listAccountDevices(\n          account.did,\n        )\n\n        const json = deviceAccounts.map(\n          (accountSession): ActiveAccountSession => ({\n            deviceId: accountSession.deviceId,\n            deviceMetadata: {\n              ipAddress: accountSession.deviceData.ipAddress,\n              userAgent: accountSession.deviceData.userAgent,\n              lastSeenAt:\n                accountSession.deviceData.lastSeenAt.toISOString() as ISODateString,\n            },\n\n            isCurrentDevice: accountSession.deviceId === this.deviceId,\n          }),\n        )\n\n        return { json }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/revoke-account-session',\n      schema: z.object({ did: didSchema, deviceId: deviceIdSchema }).strict(),\n      async handler() {\n        // @NOTE This route is not authenticated. If a user is able to steal\n        // another user's session cookie, we allow them to revoke the device\n        // session.\n\n        await server.accountManager.removeDeviceAccount(\n          this.input.deviceId,\n          this.input.did,\n        )\n\n        return { json: { success: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/revoke-oauth-session',\n      schema: z.object({ did: didSchema, tokenId: tokenIdSchema }).strict(),\n      async handler(req, res) {\n        const { account } = await authenticate.call(this, req, res)\n\n        const tokenInfo = await server.tokenManager.getTokenInfo(\n          this.input.tokenId,\n        )\n\n        if (!tokenInfo || tokenInfo.account.did !== account.did) {\n          // report this as though the token was not found\n          throw new InvalidRequestError(`Invalid token`)\n        }\n\n        await server.tokenManager.deleteToken(tokenInfo.id)\n\n        return { json: { success: true } }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/consent',\n      schema: z\n        .object({ did: didSchema, scope: oauthScopeSchema.optional() })\n        .strict(),\n      async handler(req, res) {\n        if (!this.requestUri) {\n          throw new InvalidRequestError(\n            'This endpoint can only be used in the context of an OAuth request',\n          )\n        }\n\n        // Any AuthorizationError caught in this block will result in a redirect\n        // to the client's redirect_uri with an error.\n        try {\n          const { clientId, parameters } = await server.requestManager.get(\n            this.requestUri,\n            this.deviceId,\n          )\n\n          // Any error thrown in this block will be transformed into an\n          // AuthorizationError.\n          try {\n            const { account, authorizedClients } = await authenticate.call(\n              this,\n              req,\n              res,\n            )\n\n            const client = await server.clientManager.getClient(clientId)\n\n            const code = await server.requestManager.setAuthorized(\n              this.requestUri,\n              client,\n              account,\n              this.deviceId,\n              this.deviceMetadata,\n              this.input.scope,\n            )\n\n            const clientData = authorizedClients.get(clientId)\n            if (server.checkConsentRequired(parameters, clientData)) {\n              const scopes = new Set(clientData?.authorizedScopes)\n\n              // Add the newly accepted scopes to the authorized scopes\n\n              // @NOTE `oauthScopeSchema` ensures that `scope` contains no\n              // leading/trailing/duplicate spaces.\n              for (const s of parameters.scope?.split(' ') ?? []) scopes.add(s)\n\n              await server.accountManager.setAuthorizedClient(account, client, {\n                ...clientData,\n                authorizedScopes: [...scopes],\n              })\n            }\n\n            const url = buildRedirectUrl(server.issuer, parameters, { code })\n\n            return { json: { url } }\n          } catch (err) {\n            // Since we have access to the parameters, we can re-throw an\n            // AuthorizationError with the redirect_uri parameter.\n            throw AuthorizationError.from(parameters, err)\n          }\n        } catch (err) {\n          onError?.(req, res, err, 'Failed to consent authorization request')\n\n          // If any error happened (unauthenticated, invalid request, etc.),\n          // lets make sure the request can no longer be used.\n          try {\n            await server.requestManager.delete(this.requestUri)\n          } catch (err) {\n            onError?.(req, res, err, 'Failed to delete request')\n          }\n\n          if (err instanceof AuthorizationError) {\n            try {\n              const url = buildRedirectUrl(\n                server.issuer,\n                err.parameters,\n                err.toJSON(),\n              )\n\n              return { json: { url } }\n            } catch {\n              // Unable to build redirect URL, ignore\n            }\n          }\n\n          // @NOTE Not re-throwing the error here, as the error was already\n          // handled by the `onError` callback, and apiRoute (`apiMiddleware`)\n          // would call `onError` again.\n          return buildErrorJsonResponse(err)\n        }\n      },\n    }),\n  )\n\n  router.use(\n    apiRoute({\n      method: 'POST',\n      endpoint: '/reject',\n      schema: z.object({}).strict(),\n      rotateDeviceCookies: true,\n      async handler(req, res) {\n        const { requestUri } = this\n        if (!requestUri) {\n          throw new InvalidRequestError(\n            'This endpoint can only be used in the context of an OAuth request',\n          )\n        }\n\n        // Once this endpoint is called, the request will definitely be\n        // rejected.\n        try {\n          // No need to authenticate the user here as they are not authorizing a\n          // particular account (CSRF protection is enough).\n\n          // @NOTE that the client could *technically* trigger this endpoint while\n          // the user is on the authorize page by forging the request (because the\n          // client knows the RequestURI from PAR and has all the info needed to\n          // forge the request, including CSRF). This cannot be used as DoS attack\n          // as the request ID is not guessable and would only result in a bad UX\n          // for misbehaving clients, only for the users of those clients.\n\n          const { parameters } = await server.requestManager.get(\n            requestUri,\n            this.deviceId,\n          )\n\n          const url = buildRedirectUrl(server.issuer, parameters, {\n            error: 'access_denied',\n            error_description: 'The user rejected the request',\n          })\n\n          return { json: { url } }\n        } catch (err) {\n          onError?.(req, res, err, 'Failed to reject authorization request')\n\n          if (err instanceof AuthorizationError) {\n            try {\n              const url = buildRedirectUrl(\n                server.issuer,\n                err.parameters,\n                err.toJSON(),\n              )\n\n              return { json: { url } }\n            } catch {\n              // Unable to build redirect URL, ignore\n            }\n          }\n\n          return buildErrorJsonResponse(err)\n        } finally {\n          await server.requestManager.delete(requestUri).catch((err) => {\n            onError?.(req, res, err, 'Failed to delete request')\n          })\n        }\n      },\n    }),\n  )\n\n  return router.buildMiddleware()\n\n  async function authenticate(\n    this: ApiContext<void, { did: Did }>,\n    req: Req,\n    _res: Res,\n  ) {\n    if (req.headers.authorization?.startsWith('Bearer ')) {\n      try {\n        // If there is an authorization header, verify that the ephemeral token it\n        // contains is a jwt bound to the right [sub, device, request].\n        const bearer = req.headers.authorization.slice(7)\n        const ephemeralToken = signedJwtSchema.parse(bearer)\n        const { payload } =\n          await server.signer.verifyEphemeralToken(ephemeralToken)\n\n        if (\n          payload.sub === this.input.did &&\n          payload.deviceId === this.deviceId &&\n          payload.requestUri === this.requestUri\n        ) {\n          return await server.accountManager.getAccount(payload.sub)\n        }\n      } catch (err) {\n        throw new WWWAuthenticateError(\n          'unauthorized',\n          `Invalid or expired bearer token`,\n          { Bearer: {} },\n          err,\n        )\n      }\n    }\n\n    try {\n      // Ensures the \"sub\" has an active session on the device\n      const deviceAccount = await server.accountManager.getDeviceAccount(\n        this.deviceId,\n        this.input.did,\n      )\n\n      // The session exists but was created too long ago\n      if (server.checkLoginRequired(deviceAccount)) {\n        throw new InvalidRequestError('Login required')\n      }\n\n      return deviceAccount\n    } catch (err) {\n      throw new WWWAuthenticateError(\n        'unauthorized',\n        `User ${this.input.did} not authenticated on this device`,\n        { Bearer: {} },\n        err,\n      )\n    }\n  }\n\n  type ApiContext<T extends object | void, I = void> = SubCtx<\n    T,\n    {\n      deviceId: DeviceId\n      deviceMetadata: RequestMetadata\n\n      /**\n       * The parsed input data (json payload if \"POST\", query params if \"GET\").\n       */\n      input: I\n\n      /**\n       * When defined, the request originated from the authorize page.\n       */\n      requestUri?: RequestUri\n    }\n  >\n\n  type InferValidation<S extends void | z.ZodTypeAny> = S extends z.ZodTypeAny\n    ? z.infer<S>\n    : void\n\n  /**\n   * The main purpose of this function is to ensure that the endpoint\n   * implementation matches its type definition from {@link ApiEndpoints}.\n   * @private\n   */\n  function apiRoute<\n    C extends RouterCtx<Ctx>,\n    M extends 'GET' | 'POST',\n    E extends `/${string}` &\n      // Extract all the endpoint path that match the method (allows for\n      // auto-complete & better error reporting)\n      {\n        [E in keyof ApiEndpoints]: ApiEndpoints[E] extends { method: M }\n          ? E\n          : never\n      }[keyof ApiEndpoints],\n    S extends // A schema that validates the POST input or GET params\n      ApiEndpoints[E] extends { method: 'POST'; input: infer I }\n        ? z.ZodType<I, z.ZodTypeDef, unknown>\n        : ApiEndpoints[E] extends { method: 'GET'; params: infer P }\n          ? z.ZodType<P, z.ZodTypeDef, unknown>\n          : void,\n  >(options: {\n    method: M\n    endpoint: E\n    schema: S\n    rotateDeviceCookies?: boolean\n    handler: (\n      this: ApiContext<RouteCtx<C>, InferValidation<S>>,\n      req: Req,\n      res: Res,\n    ) => Awaitable<JsonResponse<ErrorPayload | ApiEndpoints[E]['output']>>\n  }): Middleware<C, Req, Res> {\n    return createRoute(\n      options.method,\n      `${API_ENDPOINT_PREFIX}${options.endpoint}`,\n      apiMiddleware(options),\n    )\n  }\n\n  function apiMiddleware<C extends RouterCtx, S extends void | z.ZodTypeAny>({\n    method,\n    schema,\n    rotateDeviceCookies,\n    handler,\n  }: {\n    method: 'GET' | 'POST'\n    schema: S\n    rotateDeviceCookies?: boolean\n    handler: (\n      this: ApiContext<C, InferValidation<S>>,\n      req: Req,\n      res: Res,\n    ) => Awaitable<JsonResponse>\n  }): Middleware<C, Req, Res> {\n    const parseInput: (this: C, req: Req) => Promise<InferValidation<S>> =\n      schema == null // No schema means endpoint doesn't accept any input\n        ? async function (req) {\n            await flushStream(req)\n            return undefined\n          }\n        : method === 'POST'\n          ? async function (req) {\n              const body = await parseHttpRequest(req, ['json'])\n              return schema.parseAsync(body, { path: ['body'] })\n            }\n          : async function (req) {\n              await flushStream(req)\n              const query = Object.fromEntries(this.url.searchParams)\n              return schema.parseAsync(query, { path: ['query'] })\n            }\n\n    return jsonHandler<C, Req, Res>(async function (req, res) {\n      try {\n        // Prevent caching of API routes\n        res.setHeader('Cache-Control', 'no-store')\n        res.setHeader('Pragma', 'no-cache')\n\n        // Prevent CORS requests\n        validateFetchMode(req, ['same-origin'])\n        validateFetchSite(req, ['same-origin'])\n        validateOrigin(req, issuerOrigin)\n        const referrer = validateReferrer(req, { origin: issuerOrigin })\n\n        // Ensure we are one the right page\n        if (\n          // trailing slashes are not allowed\n          referrer.pathname !== '/oauth/authorize' &&\n          referrer.pathname !== '/account' &&\n          !referrer.pathname.startsWith(`/account/`)\n        ) {\n          throw createHttpError(400, `Invalid referrer ${referrer}`)\n        }\n\n        // Check if the request originated from the authorize page\n        const requestUri =\n          referrer.pathname === '/oauth/authorize'\n            ? await requestUriSchema.parseAsync(\n                referrer.searchParams.get('request_uri'),\n              )\n            : undefined\n\n        // Validate CSRF token\n        await validateCsrfToken(req, res)\n\n        // Parse and validate the input data\n        const input = await parseInput.call(this, req)\n\n        // Load session data, rotating the session cookie if needed\n        const { deviceId, deviceMetadata } = await server.deviceManager.load(\n          req,\n          res,\n          rotateDeviceCookies,\n        )\n\n        const context: ApiContext<C, InferValidation<S>> = subCtx(this, {\n          input,\n          requestUri,\n          deviceId,\n          deviceMetadata,\n        })\n\n        return await handler.call(context, req, res)\n      } catch (err) {\n        onError?.(req, res, err, `Failed to handle API request`)\n\n        // Make sore to always return a JSON response\n        return buildErrorJsonResponse(err)\n      }\n    })\n  }\n}\n\nfunction buildErrorJsonResponse(err: unknown) {\n  // @TODO Rework the API error responses (relying on codes)\n  const json = buildErrorPayload(err)\n  const status = buildErrorStatus(err)\n\n  return { json, status }\n}\n\nfunction buildRedirectUrl(\n  iss: string,\n  parameters: OAuthAuthorizationRequestParameters,\n  redirect: AuthorizationRedirectParameters,\n): string {\n  const url = new URL('/oauth/authorize/redirect', iss)\n\n  url.searchParams.set('redirect_mode', buildRedirectMode(parameters))\n  url.searchParams.set('redirect_uri', buildRedirectUri(parameters))\n\n  for (const [key, value] of buildRedirectParams(iss, parameters, redirect)) {\n    url.searchParams.set(key, value)\n  }\n\n  return url.href\n}\n\nexport function parseRedirectUrl(url: URL): OAuthRedirectOptions {\n  if (url.pathname !== '/oauth/authorize/redirect') {\n    throw new InvalidRequestError(\n      `Invalid redirect URL: ${url.pathname} is not a valid path`,\n    )\n  }\n\n  const params: [OAuthRedirectQueryParameter, string][] = []\n\n  const state = url.searchParams.get('state')\n  if (state) params.push(['state', state])\n\n  const iss = url.searchParams.get('iss')\n  if (iss) params.push(['iss', iss])\n\n  if (url.searchParams.has('code')) {\n    for (const key of SUCCESS_REDIRECT_KEYS) {\n      const value = url.searchParams.get(key)\n      if (value != null) params.push([key, value])\n    }\n  } else if (url.searchParams.has('error')) {\n    for (const key of ERROR_REDIRECT_KEYS) {\n      const value = url.searchParams.get(key)\n      if (value != null) params.push([key, value])\n    }\n  } else {\n    throw new InvalidRequestError(\n      'Invalid redirect URL: neither code nor error found',\n    )\n  }\n\n  try {\n    const mode: OAuthResponseMode = oauthResponseModeSchema.parse(\n      url.searchParams.get('redirect_mode'),\n    )\n\n    const redirectUri: OAuthRedirectUri = oauthRedirectUriSchema.parse(\n      url.searchParams.get('redirect_uri'),\n    )\n\n    return { mode, redirectUri, params }\n  } catch (err) {\n    throw InvalidRequestError.from(err, 'Invalid redirect URL')\n  }\n}\n"]}

package/dist/router/create-authorization-page-middleware.d.ts

@@ -1,5 +1,5 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { Middleware } from '../lib/http/index.js';
+import { type Middleware } from '../lib/http/index.js';
 import type { OAuthProvider } from '../oauth-provider.js';
 import type { MiddlewareOptions } from './middleware-options.js';
 export declare function createAuthorizationPageMiddleware<Ctx extends object | void = void, Req extends IncomingMessage = IncomingMessage, Res extends ServerResponse = ServerResponse>(server: OAuthProvider, { onError }: MiddlewareOptions<Req, Res>): Middleware<Ctx, Req, Res>;

package/dist/router/create-authorization-page-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-authorization-page-middleware.d.ts","sourceRoot":"","sources":["../../src/router/create-authorization-page-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAOhE,OAAO,EACL,UAAU,EAUX,MAAM,sBAAsB,CAAA;AAK7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAUzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,wBAAgB,iCAAiC,CAC/C,GAAG,SAAS,MAAM,GAAG,IAAI,GAAG,IAAI,EAChC,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAE3C,MAAM,EAAE,aAAa,EACrB,EAAE,OAAO,EAAE,EAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,GACvC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CA6N3B"}
+{"version":3,"file":"create-authorization-page-middleware.d.ts","sourceRoot":"","sources":["../../src/router/create-authorization-page-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAOhE,OAAO,EACL,KAAK,UAAU,EAUhB,MAAM,sBAAsB,CAAA;AAK7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAUzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,wBAAgB,iCAAiC,CAC/C,GAAG,SAAS,MAAM,GAAG,IAAI,GAAG,IAAI,EAChC,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAE3C,MAAM,EAAE,aAAa,EACrB,EAAE,OAAO,EAAE,EAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,GACvC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CA6N3B"}