@atproto/oauth-provider 0.22.8 → 0.23.0

package/dist/customization/build-customization-csp.js

@@ -0,0 +1,56 @@
+/**
+ * @see {@link https://docs.hcaptcha.com/#content-security-policy-settings}
+ */
+const HCAPTCHA_CSP = {
+    'script-src': ['https://hcaptcha.com', 'https://*.hcaptcha.com'],
+    'frame-src': ['https://hcaptcha.com', 'https://*.hcaptcha.com'],
+    'style-src': ['https://hcaptcha.com', 'https://*.hcaptcha.com'],
+    'connect-src': ['https://hcaptcha.com', 'https://*.hcaptcha.com'],
+};
+/**
+ * Transforms the customization settings into a Content Security Policy (CSP)
+ * configuration, based on the ways customization settings are used in the
+ * @atproto/oauth-provider-ui web app.
+ */
+export function* buildCustomizationCsp({ branding, hcaptcha, }) {
+    // branding related CSP
+    if (branding) {
+        for (const uri of [
+            branding.logo,
+            branding.background?.dark,
+            branding.background?.light,
+        ]) {
+            if (uri != null) {
+                if (isHttpUri(uri)) {
+                    yield { 'img-src': [uri] };
+                }
+                else if (isDataUri(uri)) {
+                    // CSP hash sources (e.g. `sha256-<hash>`) do not authorize image
+                    // fetches: they only apply to inline scripts/styles (and external
+                    // scripts carrying integrity metadata), never to an `img-src` URL
+                    // match. See the "Sources" note in:
+                    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/img-src
+                    // So the only way to allow a `data:` image is the `data:` scheme
+                    // source, which we add here exclusively when the customization
+                    // actually references a `data:` uri.
+                    yield { 'img-src': ['data:'] };
+                }
+                else {
+                    throw new Error(`Unsupported URI format: ${uri}`);
+                }
+            }
+        }
+    }
+    // hCaptcha related CSP
+    if (hcaptcha) {
+        yield HCAPTCHA_CSP;
+    }
+}
+function isHttpUri(uri) {
+    return uri.startsWith('http://') || uri.startsWith('https://');
+}
+function isDataUri(uri) {
+    // Basic validation of data URIs
+    return uri.startsWith('data:') && uri.length > 5 && uri.indexOf(',', 5) !== -1;
+}
+//# sourceMappingURL=build-customization-csp.js.map

package/dist/customization/build-customization-csp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-customization-csp.js","sourceRoot":"","sources":["../../src/customization/build-customization-csp.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,YAAY,GAAc;IAC9B,YAAY,EAAE,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAChE,WAAW,EAAE,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAC/D,WAAW,EAAE,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;IAC/D,aAAa,EAAE,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;CAClE,CAAA;AAED;;;;GAIG;AACH,MAAM,SAAS,CAAC,CAAC,qBAAqB,CAAC,EACrC,QAAQ,EACR,QAAQ,GACM;IACd,uBAAuB;IACvB,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,GAAG,IAAI;YAChB,QAAQ,CAAC,IAAI;YACb,QAAQ,CAAC,UAAU,EAAE,IAAI;YACzB,QAAQ,CAAC,UAAU,EAAE,KAAK;SAC3B,EAAE,CAAC;YACF,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBAChB,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnB,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;gBAC5B,CAAC;qBAAM,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,iEAAiE;oBACjE,kEAAkE;oBAClE,kEAAkE;oBAClE,oCAAoC;oBACpC,sGAAsG;oBACtG,iEAAiE;oBACjE,+DAA+D;oBAC/D,qCAAqC;oBACrC,MAAM,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAA;gBAChC,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAA;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,YAAY,CAAA;IACpB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,GAAW;IAEX,OAAO,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AAChE,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,gCAAgC;IAChC,OAAO,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;AAChF,CAAC","sourcesContent":["import type { CspConfig } from '../lib/csp/index.js'\nimport type { Customization } from './customization.js'\n\n/**\n * @see {@link https://docs.hcaptcha.com/#content-security-policy-settings}\n */\nconst HCAPTCHA_CSP: CspConfig = {\n  'script-src': ['https://hcaptcha.com', 'https://*.hcaptcha.com'],\n  'frame-src': ['https://hcaptcha.com', 'https://*.hcaptcha.com'],\n  'style-src': ['https://hcaptcha.com', 'https://*.hcaptcha.com'],\n  'connect-src': ['https://hcaptcha.com', 'https://*.hcaptcha.com'],\n}\n\n/**\n * Transforms the customization settings into a Content Security Policy (CSP)\n * configuration, based on the ways customization settings are used in the\n * @atproto/oauth-provider-ui web app.\n */\nexport function* buildCustomizationCsp({\n  branding,\n  hcaptcha,\n}: Customization): Generator<CspConfig, void, unknown> {\n  // branding related CSP\n  if (branding) {\n    for (const uri of [\n      branding.logo,\n      branding.background?.dark,\n      branding.background?.light,\n    ]) {\n      if (uri != null) {\n        if (isHttpUri(uri)) {\n          yield { 'img-src': [uri] }\n        } else if (isDataUri(uri)) {\n          // CSP hash sources (e.g. `sha256-<hash>`) do not authorize image\n          // fetches: they only apply to inline scripts/styles (and external\n          // scripts carrying integrity metadata), never to an `img-src` URL\n          // match. See the \"Sources\" note in:\n          // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/img-src\n          // So the only way to allow a `data:` image is the `data:` scheme\n          // source, which we add here exclusively when the customization\n          // actually references a `data:` uri.\n          yield { 'img-src': ['data:'] }\n        } else {\n          throw new Error(`Unsupported URI format: ${uri}`)\n        }\n      }\n    }\n  }\n\n  // hCaptcha related CSP\n  if (hcaptcha) {\n    yield HCAPTCHA_CSP\n  }\n}\n\nfunction isHttpUri(\n  uri: string,\n): uri is `http://${string}` | `https://${string}` {\n  return uri.startsWith('http://') || uri.startsWith('https://')\n}\n\nfunction isDataUri(uri: string): uri is `data:${string}` {\n  // Basic validation of data URIs\n  return uri.startsWith('data:') && uri.length > 5 && uri.indexOf(',', 5) !== -1\n}\n"]}

package/dist/customization/customization.d.ts

@@ -10,7 +10,7 @@ export declare const customizationSchema: z.ZodObject<{
      */
     branding: z.ZodOptional<z.ZodObject<{
         name: z.ZodOptional<z.ZodString>;
-        logo: z.ZodOptional<z.ZodString>;
+        logo: z.ZodOptional<z.ZodEffects<z.ZodString, `data:${string}` | `http://${string}` | `https://${string}`, string>>;
         colors: z.ZodOptional<z.ZodObject<Record<"error" | "info" | "primary" | "success" | "warning", z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>>, "strip", z.ZodTypeAny, {
             error?: import("../lib/util/color.js").RgbColor | undefined;
             info?: import("../lib/util/color.js").RgbColor | undefined;
@@ -25,11 +25,11 @@ export declare const customizationSchema: z.ZodObject<{
             warning?: string | undefined;
         }>>;
         background: z.ZodOptional<z.ZodObject<{
-            light: z.ZodOptional<z.ZodString>;
-            dark: z.ZodOptional<z.ZodString>;
+            light: z.ZodOptional<z.ZodEffects<z.ZodString, `data:${string}` | `http://${string}` | `https://${string}`, string>>;
+            dark: z.ZodOptional<z.ZodEffects<z.ZodString, `data:${string}` | `http://${string}` | `https://${string}`, string>>;
         }, "strip", z.ZodTypeAny, {
-            light?: string | undefined;
-            dark?: string | undefined;
+            light?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
+            dark?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
         }, {
             light?: string | undefined;
             dark?: string | undefined;
@@ -49,7 +49,7 @@ export declare const customizationSchema: z.ZodObject<{
         }>, "many">>;
     }, "strip", z.ZodTypeAny, {
         name?: string | undefined;
-        logo?: string | undefined;
+        logo?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
         colors?: {
             error?: import("../lib/util/color.js").RgbColor | undefined;
             info?: import("../lib/util/color.js").RgbColor | undefined;
@@ -58,8 +58,8 @@ export declare const customizationSchema: z.ZodObject<{
             warning?: import("../lib/util/color.js").RgbColor | undefined;
         } | undefined;
         background?: {
-            light?: string | undefined;
-            dark?: string | undefined;
+            light?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
+            dark?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
         } | undefined;
         links?: {
             title: string | Record<string, string | undefined>;
@@ -117,7 +117,7 @@ export declare const customizationSchema: z.ZodObject<{
     availableUserDomains?: string[] | undefined;
     branding?: {
         name?: string | undefined;
-        logo?: string | undefined;
+        logo?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
         colors?: {
             error?: import("../lib/util/color.js").RgbColor | undefined;
             info?: import("../lib/util/color.js").RgbColor | undefined;
@@ -126,8 +126,8 @@ export declare const customizationSchema: z.ZodObject<{
             warning?: import("../lib/util/color.js").RgbColor | undefined;
         } | undefined;
         background?: {
-            light?: string | undefined;
-            dark?: string | undefined;
+            light?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
+            dark?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
         } | undefined;
         links?: {
             title: string | Record<string, string | undefined>;

package/dist/customization/image-url.d.ts

@@ -0,0 +1,3 @@
+import { z } from 'zod';
+export declare const imageUrlSchema: z.ZodEffects<z.ZodString, `data:${string}` | `http://${string}` | `https://${string}`, string>;
+//# sourceMappingURL=image-url.d.ts.map

package/dist/customization/image-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-url.d.ts","sourceRoot":"","sources":["../../src/customization/image-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,cAAc,gGAWxB,CAAA"}

package/dist/customization/image-url.js

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+export const imageUrlSchema = z
+    .string()
+    .url()
+    .refine((url) => url.startsWith('data:') ||
+    url.startsWith('http:') ||
+    url.startsWith('https:'), {
+    message: 'URL must start with data:, http:, or https:',
+});
+//# sourceMappingURL=image-url.js.map

package/dist/customization/image-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-url.js","sourceRoot":"","sources":["../../src/customization/image-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,EAAE;KACL,MAAM,CACL,CAAC,GAAG,EAAsE,EAAE,CAC1E,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;IACvB,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;IACvB,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC1B;IACE,OAAO,EAAE,6CAA6C;CACvD,CACF,CAAA","sourcesContent":["import { z } from 'zod'\n\nexport const imageUrlSchema = z\n  .string()\n  .url()\n  .refine(\n    (url): url is `data:${string}` | `http://${string}` | `https://${string}` =>\n      url.startsWith('data:') ||\n      url.startsWith('http:') ||\n      url.startsWith('https:'),\n    {\n      message: 'URL must start with data:, http:, or https:',\n    },\n  )\n"]}

package/dist/lib/csp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/csp/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE9D,MAAM,MAAM,QAAQ,GAChB,OAAO,GACP,QAAQ,MAAM,EAAE,GAChB,SAAS,MAAM,EAAE,GACjB,QAAQ,GACR,QAAQ,GACR,WAAW,MAAM,GAAG,GACpB,UAAU,MAAM,GAAG,GACnB,iBAAiB,GACjB,eAAe,GACf,kBAAkB,GAClB,iBAAiB,GACjB,iBAAiB,CAAA;AAErB,QAAA,MAAM,iBAAiB,YAAI,UAAU,CAAU,CAAA;AAC/C,QAAA,MAAM,kBAAkB,YACtB,2BAA2B,EAC3B,yBAAyB,CACjB,CAAA;AACV,QAAA,MAAM,gBAAgB,YACpB,aAAa,EACb,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,CACH,CAAA;AAEV,MAAM,MAAM,SAAS,GAAG,QAAQ,CAC9B;KACG,CAAC,IAAI,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO;CACrD,GAAG;KACD,CAAC,IAAI,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ;CACrD,GAAG;KACD,CAAC,IAAI,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;CAC9D,CACF,CAAA;AAID,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAkBlD;AAED,wBAAgB,QAAQ,CAAC,CAAC,SAAS,CAAC,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,EACjE,GAAG,OAAO,EAAE,CAAC,GAEiD,aAAa,CAAC,CAAC,CAAC,CAC/E;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,GAAG,SAAS,CA8BhE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/csp/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE9D,MAAM,MAAM,QAAQ,GAChB,OAAO,GACP,QAAQ,MAAM,EAAE,GAChB,SAAS,MAAM,EAAE,GACjB,QAAQ,GACR,QAAQ,GACR,WAAW,MAAM,GAAG,GACpB,UAAU,MAAM,GAAG,GACnB,iBAAiB,GACjB,eAAe,GACf,kBAAkB,GAClB,iBAAiB,GACjB,iBAAiB,CAAA;AAErB,QAAA,MAAM,iBAAiB,YAAI,UAAU,CAAU,CAAA;AAC/C,QAAA,MAAM,kBAAkB,YACtB,2BAA2B,EAC3B,yBAAyB,CACjB,CAAA;AACV,QAAA,MAAM,gBAAgB,YACpB,aAAa,EACb,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,CACH,CAAA;AAEV,MAAM,MAAM,SAAS,GAAG,QAAQ,CAC9B;KACG,CAAC,IAAI,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO;CACrD,GAAG;KACD,CAAC,IAAI,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ;CACrD,GAAG;KACD,CAAC,IAAI,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;CAC9D,CACF,CAAA;AAID,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAkBlD;AAED,wBAAgB,QAAQ,CAAC,CAAC,SAAS,CAAC,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,EACjE,GAAG,OAAO,EAAE,CAAC,oBAId;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,GAAG,SAAS,CAuChE"}

package/dist/lib/csp/index.js

@@ -33,6 +33,8 @@ export function buildCsp(config) {
     return values.join('; ');
 }
 export function mergeCsp(...configs) {
+    if (!configs.length)
+        return {};
     return configs.filter((v) => v != null).reduce(combineCsp);
 }
 export function combineCsp(a, b) {
@@ -57,12 +59,25 @@ export function combineCsp(a, b) {
             if (b[name])
                 for (const value of b[name])
                     set.add(value);
+            // Remove URL values if the protocol is already present in the set
+            for (const value of set) {
+                if (value.startsWith('http://')) {
+                    if (set.has('http:'))
+                        set.delete(value);
+                }
+                else if (value.startsWith('https://')) {
+                    if (set.has('https:'))
+                        set.delete(value);
+                }
+            }
             if (set.size > 1 && set.has(NONE))
                 set.delete(NONE);
             result[name] = [...set];
         }
-        else if (a[name] || b[name]) {
-            result[name] = a[name] || b[name];
+        else {
+            const value = a[name] || b[name];
+            if (value)
+                result[name] = [...value];
         }
     }
     return result;

package/dist/lib/csp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/csp/index.ts"],"names":[],"mappings":"AAgBA,MAAM,iBAAiB,GAAG,CAAC,UAAU,CAAU,CAAA;AAC/C,MAAM,kBAAkB,GAAG;IACzB,2BAA2B;IAC3B,yBAAyB;CACjB,CAAA;AACV,MAAM,gBAAgB,GAAG;IACvB,aAAa;IACb,aAAa;IACb,aAAa;IACb,iBAAiB;IACjB,WAAW;IACX,SAAS;IACT,YAAY;IACZ,WAAW;CACH,CAAA;AAYV,MAAM,IAAI,GAAG,QAAQ,CAAA;AAErB,MAAM,UAAU,QAAQ,CAAC,MAAiB;IACxC,MAAM,MAAM,GAAa,EAAE,CAAA;IAE3B,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,yCAAyC;QACzC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5D,IAAI,GAAG,EAAE,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,GAAG,OAAU;IAEb,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAqB,CAAA;AAChF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAY,EAAE,CAAY;IACnD,MAAM,MAAM,GAAc,EAAE,CAAA;IAE5B,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,wCAAwC;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,KAAK,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;IACzC,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACvD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACvD,2BAA2B;YAC3B,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,QAAQ,IAAI,IAAI,CAAA;QAC7C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;YAC5B,IAAI,CAAC,CAAC,IAAI,CAAC;gBAAE,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACxD,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACnD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAA;QACzB,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC","sourcesContent":["import type { CombinedTuple, Simplify } from '../util/type.js'\n\nexport type CspValue =\n  | `data:`\n  | `http:${string}`\n  | `https:${string}`\n  | `'none'`\n  | `'self'`\n  | `'sha256-${string}'`\n  | `'nonce-${string}'`\n  | `'unsafe-inline'`\n  | `'unsafe-eval'`\n  | `'strict-dynamic'`\n  | `'report-sample'`\n  | `'unsafe-hashes'`\n\nconst STRING_DIRECTIVES = ['base-uri'] as const\nconst BOOLEAN_DIRECTIVES = [\n  'upgrade-insecure-requests',\n  'block-all-mixed-content',\n] as const\nconst ARRAY_DIRECTIVES = [\n  'connect-src',\n  'default-src',\n  'form-action',\n  'frame-ancestors',\n  'frame-src',\n  'img-src',\n  'script-src',\n  'style-src',\n] as const\n\nexport type CspConfig = Simplify<\n  {\n    [K in (typeof BOOLEAN_DIRECTIVES)[number]]?: boolean\n  } & {\n    [K in (typeof STRING_DIRECTIVES)[number]]?: CspValue\n  } & {\n    [K in (typeof ARRAY_DIRECTIVES)[number]]?: Iterable<CspValue>\n  }\n>\n\nconst NONE = \"'none'\"\n\nexport function buildCsp(config: CspConfig): string {\n  const values: string[] = []\n\n  for (const name of BOOLEAN_DIRECTIVES) {\n    if (config[name] === true) values.push(name)\n  }\n\n  for (const name of STRING_DIRECTIVES) {\n    if (config[name]) values.push(`${name} ${config[name]}`)\n  }\n\n  for (const name of ARRAY_DIRECTIVES) {\n    // Remove duplicate values by using a Set\n    const val = config[name] ? new Set(config[name]) : undefined\n    if (val?.size) values.push(`${name} ${Array.from(val).join(' ')}`)\n  }\n\n  return values.join('; ')\n}\n\nexport function mergeCsp<C extends (CspConfig | null | undefined)[]>(\n  ...configs: C\n) {\n  return configs.filter((v) => v != null).reduce(combineCsp) as CombinedTuple<C>\n}\n\nexport function combineCsp(a: CspConfig, b: CspConfig): CspConfig {\n  const result: CspConfig = {}\n\n  for (const name of BOOLEAN_DIRECTIVES) {\n    // @NOTE b (if defined) takes precedence\n    const value = b[name] ?? a[name]\n    if (value != null) result[name] = value\n  }\n\n  for (const name of STRING_DIRECTIVES) {\n    if (a[name] || b[name]) {\n      const aNotNone = a[name] === NONE ? undefined : a[name]\n      const bNotNone = b[name] === NONE ? undefined : b[name]\n      // @NOTE b takes precedence\n      result[name] = bNotNone || aNotNone || NONE\n    }\n  }\n\n  for (const name of ARRAY_DIRECTIVES) {\n    if (a[name] && b[name]) {\n      const set = new Set(a[name])\n      if (b[name]) for (const value of b[name]) set.add(value)\n      if (set.size > 1 && set.has(NONE)) set.delete(NONE)\n      result[name] = [...set]\n    } else if (a[name] || b[name]) {\n      result[name] = a[name] || b[name]\n    }\n  }\n\n  return result\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/csp/index.ts"],"names":[],"mappings":"AAgBA,MAAM,iBAAiB,GAAG,CAAC,UAAU,CAAU,CAAA;AAC/C,MAAM,kBAAkB,GAAG;IACzB,2BAA2B;IAC3B,yBAAyB;CACjB,CAAA;AACV,MAAM,gBAAgB,GAAG;IACvB,aAAa;IACb,aAAa;IACb,aAAa;IACb,iBAAiB;IACjB,WAAW;IACX,SAAS;IACT,YAAY;IACZ,WAAW;CACH,CAAA;AAYV,MAAM,IAAI,GAAG,QAAQ,CAAA;AAErB,MAAM,UAAU,QAAQ,CAAC,MAAiB;IACxC,MAAM,MAAM,GAAa,EAAE,CAAA;IAE3B,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,yCAAyC;QACzC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5D,IAAI,GAAG,EAAE,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,GAAG,OAAU;IAEb,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAsB,CAAA;IAClD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAqB,CAAA;AAChF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAY,EAAE,CAAY;IACnD,MAAM,MAAM,GAAc,EAAE,CAAA;IAE5B,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,wCAAwC;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,KAAK,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;IACzC,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACvD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACvD,2BAA2B;YAC3B,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,QAAQ,IAAI,IAAI,CAAA;QAC7C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;YAC5B,IAAI,CAAC,CAAC,IAAI,CAAC;gBAAE,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACxD,kEAAkE;YAClE,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;gBACxB,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBAChC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;wBAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACzC,CAAC;qBAAM,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;wBAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBAC1C,CAAC;YACH,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACnD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC","sourcesContent":["import type { CombinedTuple, Simplify } from '../util/type.js'\n\nexport type CspValue =\n  | `data:`\n  | `http:${string}`\n  | `https:${string}`\n  | `'none'`\n  | `'self'`\n  | `'sha256-${string}'`\n  | `'nonce-${string}'`\n  | `'unsafe-inline'`\n  | `'unsafe-eval'`\n  | `'strict-dynamic'`\n  | `'report-sample'`\n  | `'unsafe-hashes'`\n\nconst STRING_DIRECTIVES = ['base-uri'] as const\nconst BOOLEAN_DIRECTIVES = [\n  'upgrade-insecure-requests',\n  'block-all-mixed-content',\n] as const\nconst ARRAY_DIRECTIVES = [\n  'connect-src',\n  'default-src',\n  'form-action',\n  'frame-ancestors',\n  'frame-src',\n  'img-src',\n  'script-src',\n  'style-src',\n] as const\n\nexport type CspConfig = Simplify<\n  {\n    [K in (typeof BOOLEAN_DIRECTIVES)[number]]?: boolean\n  } & {\n    [K in (typeof STRING_DIRECTIVES)[number]]?: CspValue\n  } & {\n    [K in (typeof ARRAY_DIRECTIVES)[number]]?: Iterable<CspValue>\n  }\n>\n\nconst NONE = \"'none'\"\n\nexport function buildCsp(config: CspConfig): string {\n  const values: string[] = []\n\n  for (const name of BOOLEAN_DIRECTIVES) {\n    if (config[name] === true) values.push(name)\n  }\n\n  for (const name of STRING_DIRECTIVES) {\n    if (config[name]) values.push(`${name} ${config[name]}`)\n  }\n\n  for (const name of ARRAY_DIRECTIVES) {\n    // Remove duplicate values by using a Set\n    const val = config[name] ? new Set(config[name]) : undefined\n    if (val?.size) values.push(`${name} ${Array.from(val).join(' ')}`)\n  }\n\n  return values.join('; ')\n}\n\nexport function mergeCsp<C extends (CspConfig | null | undefined)[]>(\n  ...configs: C\n) {\n  if (!configs.length) return {} as CombinedTuple<C>\n  return configs.filter((v) => v != null).reduce(combineCsp) as CombinedTuple<C>\n}\n\nexport function combineCsp(a: CspConfig, b: CspConfig): CspConfig {\n  const result: CspConfig = {}\n\n  for (const name of BOOLEAN_DIRECTIVES) {\n    // @NOTE b (if defined) takes precedence\n    const value = b[name] ?? a[name]\n    if (value != null) result[name] = value\n  }\n\n  for (const name of STRING_DIRECTIVES) {\n    if (a[name] || b[name]) {\n      const aNotNone = a[name] === NONE ? undefined : a[name]\n      const bNotNone = b[name] === NONE ? undefined : b[name]\n      // @NOTE b takes precedence\n      result[name] = bNotNone || aNotNone || NONE\n    }\n  }\n\n  for (const name of ARRAY_DIRECTIVES) {\n    if (a[name] && b[name]) {\n      const set = new Set(a[name])\n      if (b[name]) for (const value of b[name]) set.add(value)\n      // Remove URL values if the protocol is already present in the set\n      for (const value of set) {\n        if (value.startsWith('http://')) {\n          if (set.has('http:')) set.delete(value)\n        } else if (value.startsWith('https://')) {\n          if (set.has('https:')) set.delete(value)\n        }\n      }\n      if (set.size > 1 && set.has(NONE)) set.delete(NONE)\n      result[name] = [...set]\n    } else {\n      const value = a[name] || b[name]\n      if (value) result[name] = [...value]\n    }\n  }\n\n  return result\n}\n"]}

package/dist/oauth-hooks.d.ts

@@ -2,7 +2,7 @@ import type { Did } from '@atproto/did';
 import type { Jwks } from '@atproto/jwk';
 import type { Account } from '@atproto/oauth-provider-api';
 import type { OAuthAccessToken, OAuthAuthorizationDetails, OAuthAuthorizationRequestParameters, OAuthClientMetadata, OAuthTokenResponse, OAuthTokenType } from '@atproto/oauth-types';
-import type { DeleteAccountConfirmInput, ResetPasswordConfirmInput, ResetPasswordRequestInput, SignUpData, UpdateEmailConfirmInput, UpdateEmailRequestInput, UpdateHandleData, VerifyEmailConfirmInput, VerifyEmailRequestInput } from './account/account-store.js';
+import type { DeleteAccountConfirmInput, DisableEmailAuthFactorInput, EnableEmailAuthFactorInput, ResetPasswordConfirmInput, ResetPasswordRequestInput, SignUpData, UpdateEmailConfirmInput, UpdateEmailRequestInput, UpdateHandleData, VerifyEmailConfirmInput, VerifyEmailRequestInput } from './account/account-store.js';
 import type { SignInData } from './account/sign-in-data.js';
 import type { SignUpInput } from './account/sign-up-input.js';
 import type { ClientAuth } from './client/client-auth.js';
@@ -116,6 +116,61 @@ export type OAuthHooks = {
         deviceMetadata: RequestMetadata;
         account: Account;
     }) => Awaitable<void>;
+    /**
+     * This hook is called whenever a user is trying to enable their email auth
+     * factor (OTP), before the change is saved to the account store.
+     */
+    onEnableEmailAuthFactor?: (data: {
+        input: EnableEmailAuthFactorInput;
+        deviceId: DeviceId;
+        deviceMetadata: RequestMetadata;
+        account: Account;
+    }) => Awaitable<void>;
+    /**
+     * This hook is called only after the email auth factor was actually enabled
+     * on the account store. This follows
+     * {@link OAuthHooks.onEnableEmailAuthFactor} and is triggered only if the
+     * change succeeded and actually occurred.
+     */
+    onEnabledEmailAuthFactor?: (data: {
+        input: EnableEmailAuthFactorInput;
+        deviceId: DeviceId;
+        deviceMetadata: RequestMetadata;
+        account: Account;
+    }) => Awaitable<void>;
+    /**
+     * This hook is called when a user requests that their email auth factor (OTP)
+     * be disabled, before the change is saved to the account store.
+     *
+     * @note Disabling is two-phase:
+     * - First no {@link DisableEmailAuthFactorInput.token} is provided and the
+     * store implementation is expected to trigger an email confirmation. When
+     * that happens, {@link OAuthHooks.onDisabledEmailAuthFactor} will not be
+     * called during the processing of the first HTTP request.
+     * - In the second request, which follows the email confirmation, the
+     * {@link DisableEmailAuthFactorInput.token} is provided and the store
+     * implementation is expected to actually disable the email auth factor. At
+     * this point, {@link OAuthHooks.onDisabledEmailAuthFactor} will be called
+     * after the store has successfully processed the request.
+     */
+    onDisableEmailAuthFactor?: (data: {
+        input: DisableEmailAuthFactorInput;
+        deviceId: DeviceId;
+        deviceMetadata: RequestMetadata;
+        account: Account;
+    }) => Awaitable<void>;
+    /**
+     * This hook is called only after the email auth factor was actually disabled
+     * on the account store. This follows
+     * {@link OAuthHooks.onDisableEmailAuthFactor} and is triggered only if the
+     * change succeeded and actually occurred.
+     */
+    onDisabledEmailAuthFactor?: (data: {
+        input: DisableEmailAuthFactorInput;
+        deviceId: DeviceId;
+        deviceMetadata: RequestMetadata;
+        account: Account;
+    }) => Awaitable<void>;
     /**
      * This hook is called when a user requests a handle change, before the change
      * is performed on the account store. Only triggered with authenticated

package/dist/oauth-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-hooks.d.ts","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,KAAK,EACV,gBAAgB,EAChB,yBAAyB,EACzB,mCAAmC,EACnC,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACf,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EACV,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AAC5E,OAAO,KAAK,EACV,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACrB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAG1D,YAAY,EACV,kBAAkB,EAClB,OAAO,EACP,SAAS,EACT,MAAM,EACN,UAAU,EACV,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,GAAG,EACH,SAAS,EACT,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,IAAI,EACJ,gBAAgB,EAChB,yBAAyB,EACzB,mCAAmC,EACnC,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,gBAAgB,GACjB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE;QACJ,QAAQ,EAAE,mBAAmB,CAAA;QAC7B,IAAI,EAAE,IAAI,GAAG,SAAS,CAAA;KACvB,KACE,SAAS,CAAC,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAE/C;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,WAAW,EAAE,OAAO,CAAA;KACrB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,KAAK,EAAE,gBAAgB,CAAA;QACvB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,KAAK,EAAE,gBAAgB,CAAA;QACvB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,KAAK,EAAE,yBAAyB,CAAA;KACjC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,KAAK,EAAE,WAAW,CAAA;QAClB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAA;KAC/B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE,WAAW,CAAA;QAClB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,MAAM,EAAE,oBAAoB,CAAA;QAC5B,MAAM,EAAE,oBAAoB,CAAA;KAC7B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KACxB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,UAAU,CAAA;QAChB,OAAO,EAAE,OAAO,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAA;KAC/B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,IAAI,EAAE,UAAU,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAA;KAC/B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,UAAU,CAAA;QAChB,OAAO,EAAE,OAAO,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAA;KAC/B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE,UAAU,CAAA;QAChB,KAAK,EAAE,mBAAmB,CAAA;QAC1B,GAAG,EAAE,GAAG,GAAG,IAAI,CAAA;QACf,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAA;KAC/B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,IAAI,GAAG,UAAU,CAAA;QAC7B,UAAU,EAAE,QAAQ,CAAC,mCAAmC,CAAC,CAAA;KAC1D,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;QAC/C,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,SAAS,EAAE,SAAS,CAAA;KACrB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;QAC/C,MAAM,EAAE,WAAW,CAAA;KACpB,KAAK,SAAS,CAAC,IAAI,GAAG,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAA;IAE1D;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,SAAS,EAAE,cAAc,CAAA;QACzB,KAAK,EAAE,gBAAgB,CAAA;QACvB,OAAO,EAAE,kBAAkB,CAAA;QAC3B,SAAS,EAAE,IAAI,GAAG,SAAS,CAAA;KAC5B,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IAExC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;KAChD,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;KAChD,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;CACtB,CAAA"}
+{"version":3,"file":"oauth-hooks.d.ts","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,KAAK,EACV,gBAAgB,EAChB,yBAAyB,EACzB,mCAAmC,EACnC,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACf,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AAC5E,OAAO,KAAK,EACV,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACrB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAG1D,YAAY,EACV,kBAAkB,EAClB,OAAO,EACP,SAAS,EACT,MAAM,EACN,UAAU,EACV,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,GAAG,EACH,SAAS,EACT,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,IAAI,EACJ,gBAAgB,EAChB,yBAAyB,EACzB,mCAAmC,EACnC,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,gBAAgB,GACjB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE;QACJ,QAAQ,EAAE,mBAAmB,CAAA;QAC7B,IAAI,EAAE,IAAI,GAAG,SAAS,CAAA;KACvB,KACE,SAAS,CAAC,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAE/C;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,WAAW,EAAE,OAAO,CAAA;KACrB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,uBAAuB,CAAA;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC/B,KAAK,EAAE,0BAA0B,CAAA;QACjC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,0BAA0B,CAAA;QACjC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;;;;;;;;OAcG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,2BAA2B,CAAA;QAClC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,CAAC,IAAI,EAAE;QACjC,KAAK,EAAE,2BAA2B,CAAA;QAClC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,KAAK,EAAE,gBAAgB,CAAA;QACvB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,KAAK,EAAE,gBAAgB,CAAA;QACvB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC5B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,KAAK,EAAE,yBAAyB,CAAA;KACjC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,KAAK,EAAE,WAAW,CAAA;QAClB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAA;KAC/B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE,WAAW,CAAA;QAClB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,MAAM,EAAE,oBAAoB,CAAA;QAC5B,MAAM,EAAE,oBAAoB,CAAA;KAC7B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KACxB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,yBAAyB,CAAA;QAChC,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,UAAU,CAAA;QAChB,OAAO,EAAE,OAAO,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAA;KAC/B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,IAAI,EAAE,UAAU,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAA;KAC/B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,UAAU,CAAA;QAChB,OAAO,EAAE,OAAO,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAA;KAC/B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE,UAAU,CAAA;QAChB,KAAK,EAAE,mBAAmB,CAAA;QAC1B,GAAG,EAAE,GAAG,GAAG,IAAI,CAAA;QACf,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAA;KAC/B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,IAAI,GAAG,UAAU,CAAA;QAC7B,UAAU,EAAE,QAAQ,CAAC,mCAAmC,CAAC,CAAA;KAC1D,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;QAC/C,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,SAAS,EAAE,SAAS,CAAA;KACrB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;QAC/C,MAAM,EAAE,WAAW,CAAA;KACpB,KAAK,SAAS,CAAC,IAAI,GAAG,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAA;IAE1D;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,SAAS,EAAE,cAAc,CAAA;QACzB,KAAK,EAAE,gBAAgB,CAAA;QACvB,OAAO,EAAE,kBAAkB,CAAA;QAC3B,SAAS,EAAE,IAAI,GAAG,SAAS,CAAA;KAC5B,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IAExC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;KAChD,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;KAChD,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;CACtB,CAAA"}

package/dist/oauth-hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-hooks.js","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":"","sourcesContent":["import type { Did } from '@atproto/did'\nimport type { Jwks } from '@atproto/jwk'\nimport type { Account } from '@atproto/oauth-provider-api'\nimport type {\n  OAuthAccessToken,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientMetadata,\n  OAuthTokenResponse,\n  OAuthTokenType,\n} from '@atproto/oauth-types'\nimport type {\n  DeleteAccountConfirmInput,\n  ResetPasswordConfirmInput,\n  ResetPasswordRequestInput,\n  SignUpData,\n  UpdateEmailConfirmInput,\n  UpdateEmailRequestInput,\n  UpdateHandleData,\n  VerifyEmailConfirmInput,\n  VerifyEmailRequestInput,\n} from './account/account-store.js'\nimport type { SignInData } from './account/sign-in-data.js'\nimport type { SignUpInput } from './account/sign-up-input.js'\nimport type { ClientAuth } from './client/client-auth.js'\nimport type { ClientId } from './client/client-id.js'\nimport type { ClientInfo } from './client/client-info.js'\nimport type { Client } from './client/client.js'\nimport type { DeviceId } from './device/device-id.js'\nimport type { DpopProof } from './dpop/dpop-proof.js'\nimport type { InvalidRequestError } from './errors/invalid-request-error.js'\nimport type {\n  HcaptchaClientTokens,\n  HcaptchaConfig,\n  HcaptchaVerifyResult,\n} from './lib/hcaptcha.js'\nimport type { RequestMetadata } from './lib/http/request.js'\nimport type { Awaitable, OmitKey } from './lib/util/type.js'\nimport type { RequestId } from './request/request-id.js'\nimport type { AccessTokenPayload } from './signer/access-token-payload.js'\nimport type { TokenClaims } from './token/token-claims.js'\n\n// Make sure all types needed to implement the OAuthHooks are exported\nexport type {\n  AccessTokenPayload,\n  Account,\n  Awaitable,\n  Client,\n  ClientAuth,\n  ClientId,\n  ClientInfo,\n  DeviceId,\n  Did,\n  DpopProof,\n  HcaptchaClientTokens,\n  HcaptchaConfig,\n  HcaptchaVerifyResult,\n  Jwks,\n  OAuthAccessToken,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientMetadata,\n  OAuthTokenResponse,\n  OAuthTokenType,\n  RequestMetadata,\n  ResetPasswordConfirmInput,\n  ResetPasswordRequestInput,\n  SignInData,\n  SignUpData,\n  SignUpInput,\n  TokenClaims,\n  UpdateHandleData,\n}\n\nexport type OAuthHooks = {\n  /**\n   * Use this to alter, override or validate the client metadata & jwks returned\n   * by the client store.\n   *\n   * @throws {InvalidClientMetadataError} if the metadata is invalid\n   * @see {@link InvalidClientMetadataError}\n   */\n  getClientInfo?: (\n    clientId: ClientId,\n    data: {\n      metadata: OAuthClientMetadata\n      jwks: Jwks | undefined\n    },\n  ) => Awaitable<undefined | Partial<ClientInfo>>\n\n  /**\n   * This hook is called when a user requests an email change, before the email\n   * change request is triggered on the account store. Only triggered with\n   * authenticated sessions, so the `account` is always available.\n   */\n  onChangeEmailRequest?: (data: {\n    input: UpdateEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user requests an email change, and the email\n   * change request was successfully triggered on the account store.\n   */\n  onChangeEmailRequested?: (data: {\n    input: UpdateEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms an email change, before the email\n   * change is actually confirmed on the account store. Only triggered with\n   * authenticated sessions, so the `account` is always available.\n   */\n  onUpdateEmailConfirm?: (data: {\n    input: UpdateEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user confirms an email change, and the email\n   * change was successfully confirmed on the account store.\n   */\n  onUpdateEmailConfirmed?: (data: {\n    input: UpdateEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n    prevAccount: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests an email verification, before the\n   * verification request is triggered on the account store. Only triggered with\n   * authenticated sessions, so the `account` is always available.\n   */\n  onVerifyEmailRequest?: (data: {\n    input: VerifyEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user requests an email verification, and the\n   * verification request was successfully triggered on the account store.\n   */\n  onVerifyEmailRequested?: (data: {\n    input: VerifyEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms an email verification, before the\n   * verification is actually confirmed on the account store. Only triggered\n   * with authenticated sessions, so the `account` is always available.\n   */\n  onVerifyEmailConfirm?: (data: {\n    input: VerifyEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user confirms an email verification, and the\n   * verification was successfully confirmed on the account store.\n   */\n  onVerifyEmailConfirmed?: (data: {\n    input: VerifyEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a handle change, before the change\n   * is performed on the account store. Only triggered with authenticated\n   * sessions, so the `account` is always available.\n   */\n  onUpdateHandle?: (data: {\n    input: UpdateHandleData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user successfully changed their handle on the\n   * account store.\n   */\n  onUpdatedHandle?: (data: {\n    input: UpdateHandleData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests account deactivation, before the\n   * account is deactivated on the account store.\n   */\n  onDeactivateAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user successfully deactivated their account on\n   * the account store.\n   */\n  onDeactivatedAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests account reactivation, before the\n   * account is reactivated on the account store.\n   */\n  onReactivateAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user successfully reactivated their account on\n   * the account store.\n   */\n  onReactivatedAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests account deletion, before the\n   * confirmation email is dispatched on the account store.\n   */\n  onDeleteAccountRequest?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user has requested account deletion and the\n   * confirmation email has been dispatched.\n   */\n  onDeleteAccountRequested?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms account deletion, before the\n   * account is actually deleted on the account store.\n   */\n  onDeleteAccountConfirm?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user has successfully deleted their account\n   * on the account store.\n   */\n  onDeleteAccountConfirmed?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n    input: DeleteAccountConfirmInput\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user attempts to sign up, after every validation\n   * has passed (including hcaptcha).\n   */\n  onSignUpAttempt?: (data: {\n    input: SignUpInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId: ClientId | undefined\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user attempts to sign up, after the hcaptcha\n   * `/siteverify` request has been made (and before the result is validated).\n   */\n  onHcaptchaResult?: (data: {\n    input: SignUpInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    tokens: HcaptchaClientTokens\n    result: HcaptchaVerifyResult\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a password reset, before the\n   * reset password request is triggered on the account store. Use this to\n   * potentially cancel the password reset.\n   */\n  onResetPasswordRequest?: (data: {\n    input: ResetPasswordRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a password reset, before the\n   * reset password request is triggered on the account store. If not account\n   * was found for the provided identifier, the `account` field will be `null`.\n   */\n  onResetPasswordRequested?: (data: {\n    input: ResetPasswordRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account | null\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms a password reset, before the\n   * password is actually reset on the account store.\n   */\n  onResetPasswordConfirm?: (data: {\n    input: ResetPasswordConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user confirms a password reset, and the\n   * password was successfully reset on the account store.\n   */\n  onResetPasswordConfirmed?: (data: {\n    input: ResetPasswordConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user successfully signs up.\n   *\n   * @throws {AccessDeniedError} to deny the sign-up\n   */\n  onSignedUp?: (data: {\n    data: SignUpData\n    account: Account\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId: ClientId | undefined\n  }) => Awaitable<void>\n\n  /**\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request (i.e. the user is logging in to approve a\n   * client); it is omitted for first-party sign-ins that happen outside any\n   * authorization flow.\n   */\n  onSignInAttempt?: (data: {\n    data: SignInData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId: ClientId | undefined\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user successfully signs in.\n   *\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request; see {@link OAuthHooks.onSignInAttempt}.\n   *\n   * @throws {InvalidRequestError} when the sing-in should be denied\n   */\n  onSignedIn?: (data: {\n    data: SignInData\n    account: Account\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId: ClientId | undefined\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a sign-in attempt is rejected by the account\n   * store due to invalid credentials (e.g. unknown identifier, wrong\n   * password). It is *not* called for unexpected server errors, nor for flows\n   * that require an additional authentication factor.\n   *\n   * `sub` is populated when the store throws an\n   * {@link InvalidCredentialsError} that carries the matched subject\n   * identifier (i.e. identifier known, credentials wrong). It is `null` when\n   * the identifier was unknown or when the store threw a plain\n   * {@link InvalidRequestError} without distinguishing the two cases.\n   *\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request; see {@link OAuthHooks.onSignInAttempt}.\n   *\n   * Errors thrown from this hook are caught and ignored so that they do not\n   * mask the original authentication failure.\n   */\n  onSignInFailed?: (data: {\n    data: SignInData\n    error: InvalidRequestError\n    did: Did | null\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId: ClientId | undefined\n  }) => Awaitable<void>\n\n  /**\n   * Allows validating an authorization request (typically the requested scopes)\n   * before it is created. Note that the validity against the client metadata is\n   * already enforced by the OAuth provider.\n   *\n   * @throws {AuthorizationError}\n   */\n  onAuthorizationRequest?: (data: {\n    client: Client\n    clientAuth: null | ClientAuth\n    parameters: Readonly<OAuthAuthorizationRequestParameters>\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a client is authorized.\n   *\n   * @throws {AuthorizationError} to deny the authorization request and redirect\n   * the user to the client with an OAuth error (other errors will result in an\n   * internal server error being displayed to the user)\n   *\n   * @note We use `deviceMetadata` instead of `clientMetadata` to make it clear\n   * that this metadata is from the user device, which might be different from\n   * the client metadata (because the OAuth client could live in a backend).\n   */\n  onAuthorized?: (data: {\n    client: Client\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    requestId: RequestId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called whenever a token is about to be created. You can use\n   * it to modify the token claims or perform additional validation.\n   *\n   * This hook should never throw an error.\n   */\n  onCreateToken?: (data: {\n    client: Client\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n    claims: TokenClaims\n  }) => Awaitable<void | OmitKey<AccessTokenPayload, 'iss'>>\n\n  /**\n   * This hook is called whenever a token was just decoded, and basic validation\n   * was performed (signature, expiration, not-before).\n   *\n   * It can be used to modify the payload (e.g., to add custom claims), or to\n   * perform additional validation.\n   *\n   * This hook is called when authenticating requests through the\n   * `authenticateRequest()` method in `OAuthVerifier` and `OAuthProvider`.\n   *\n   * Any error thrown here will be propagated.\n   */\n  onDecodeToken?: (data: {\n    tokenType: OAuthTokenType\n    token: OAuthAccessToken\n    payload: AccessTokenPayload\n    dpopProof: null | DpopProof\n  }) => Promise<AccessTokenPayload | void>\n\n  /**\n   * This hook is called when an authorized client exchanges an authorization\n   * code for an access token.\n   *\n   * @throws {OAuthError} to cancel the token creation and revoke the session\n   */\n  onTokenCreated?: (data: {\n    client: Client\n    clientAuth: ClientAuth\n    clientMetadata: RequestMetadata\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when an authorized client refreshes an access token.\n   *\n   * @throws {OAuthError} to cancel the token refresh and revoke the session\n   */\n  onTokenRefreshed?: (data: {\n    client: Client\n    clientAuth: ClientAuth\n    clientMetadata: RequestMetadata\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n  }) => Awaitable<void>\n}\n"]}
+{"version":3,"file":"oauth-hooks.js","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":"","sourcesContent":["import type { Did } from '@atproto/did'\nimport type { Jwks } from '@atproto/jwk'\nimport type { Account } from '@atproto/oauth-provider-api'\nimport type {\n  OAuthAccessToken,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientMetadata,\n  OAuthTokenResponse,\n  OAuthTokenType,\n} from '@atproto/oauth-types'\nimport type {\n  DeleteAccountConfirmInput,\n  DisableEmailAuthFactorInput,\n  EnableEmailAuthFactorInput,\n  ResetPasswordConfirmInput,\n  ResetPasswordRequestInput,\n  SignUpData,\n  UpdateEmailConfirmInput,\n  UpdateEmailRequestInput,\n  UpdateHandleData,\n  VerifyEmailConfirmInput,\n  VerifyEmailRequestInput,\n} from './account/account-store.js'\nimport type { SignInData } from './account/sign-in-data.js'\nimport type { SignUpInput } from './account/sign-up-input.js'\nimport type { ClientAuth } from './client/client-auth.js'\nimport type { ClientId } from './client/client-id.js'\nimport type { ClientInfo } from './client/client-info.js'\nimport type { Client } from './client/client.js'\nimport type { DeviceId } from './device/device-id.js'\nimport type { DpopProof } from './dpop/dpop-proof.js'\nimport type { InvalidRequestError } from './errors/invalid-request-error.js'\nimport type {\n  HcaptchaClientTokens,\n  HcaptchaConfig,\n  HcaptchaVerifyResult,\n} from './lib/hcaptcha.js'\nimport type { RequestMetadata } from './lib/http/request.js'\nimport type { Awaitable, OmitKey } from './lib/util/type.js'\nimport type { RequestId } from './request/request-id.js'\nimport type { AccessTokenPayload } from './signer/access-token-payload.js'\nimport type { TokenClaims } from './token/token-claims.js'\n\n// Make sure all types needed to implement the OAuthHooks are exported\nexport type {\n  AccessTokenPayload,\n  Account,\n  Awaitable,\n  Client,\n  ClientAuth,\n  ClientId,\n  ClientInfo,\n  DeviceId,\n  Did,\n  DpopProof,\n  HcaptchaClientTokens,\n  HcaptchaConfig,\n  HcaptchaVerifyResult,\n  Jwks,\n  OAuthAccessToken,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientMetadata,\n  OAuthTokenResponse,\n  OAuthTokenType,\n  RequestMetadata,\n  ResetPasswordConfirmInput,\n  ResetPasswordRequestInput,\n  SignInData,\n  SignUpData,\n  SignUpInput,\n  TokenClaims,\n  UpdateHandleData,\n}\n\nexport type OAuthHooks = {\n  /**\n   * Use this to alter, override or validate the client metadata & jwks returned\n   * by the client store.\n   *\n   * @throws {InvalidClientMetadataError} if the metadata is invalid\n   * @see {@link InvalidClientMetadataError}\n   */\n  getClientInfo?: (\n    clientId: ClientId,\n    data: {\n      metadata: OAuthClientMetadata\n      jwks: Jwks | undefined\n    },\n  ) => Awaitable<undefined | Partial<ClientInfo>>\n\n  /**\n   * This hook is called when a user requests an email change, before the email\n   * change request is triggered on the account store. Only triggered with\n   * authenticated sessions, so the `account` is always available.\n   */\n  onChangeEmailRequest?: (data: {\n    input: UpdateEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user requests an email change, and the email\n   * change request was successfully triggered on the account store.\n   */\n  onChangeEmailRequested?: (data: {\n    input: UpdateEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms an email change, before the email\n   * change is actually confirmed on the account store. Only triggered with\n   * authenticated sessions, so the `account` is always available.\n   */\n  onUpdateEmailConfirm?: (data: {\n    input: UpdateEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user confirms an email change, and the email\n   * change was successfully confirmed on the account store.\n   */\n  onUpdateEmailConfirmed?: (data: {\n    input: UpdateEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n    prevAccount: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests an email verification, before the\n   * verification request is triggered on the account store. Only triggered with\n   * authenticated sessions, so the `account` is always available.\n   */\n  onVerifyEmailRequest?: (data: {\n    input: VerifyEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user requests an email verification, and the\n   * verification request was successfully triggered on the account store.\n   */\n  onVerifyEmailRequested?: (data: {\n    input: VerifyEmailRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms an email verification, before the\n   * verification is actually confirmed on the account store. Only triggered\n   * with authenticated sessions, so the `account` is always available.\n   */\n  onVerifyEmailConfirm?: (data: {\n    input: VerifyEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user confirms an email verification, and the\n   * verification was successfully confirmed on the account store.\n   */\n  onVerifyEmailConfirmed?: (data: {\n    input: VerifyEmailConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called whenever a user is trying to enable their email auth\n   * factor (OTP), before the change is saved to the account store.\n   */\n  onEnableEmailAuthFactor?: (data: {\n    input: EnableEmailAuthFactorInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called only after the email auth factor was actually enabled\n   * on the account store. This follows\n   * {@link OAuthHooks.onEnableEmailAuthFactor} and is triggered only if the\n   * change succeeded and actually occurred.\n   */\n  onEnabledEmailAuthFactor?: (data: {\n    input: EnableEmailAuthFactorInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests that their email auth factor (OTP)\n   * be disabled, before the change is saved to the account store.\n   *\n   * @note Disabling is two-phase:\n   * - First no {@link DisableEmailAuthFactorInput.token} is provided and the\n   * store implementation is expected to trigger an email confirmation. When\n   * that happens, {@link OAuthHooks.onDisabledEmailAuthFactor} will not be\n   * called during the processing of the first HTTP request.\n   * - In the second request, which follows the email confirmation, the\n   * {@link DisableEmailAuthFactorInput.token} is provided and the store\n   * implementation is expected to actually disable the email auth factor. At\n   * this point, {@link OAuthHooks.onDisabledEmailAuthFactor} will be called\n   * after the store has successfully processed the request.\n   */\n  onDisableEmailAuthFactor?: (data: {\n    input: DisableEmailAuthFactorInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called only after the email auth factor was actually disabled\n   * on the account store. This follows\n   * {@link OAuthHooks.onDisableEmailAuthFactor} and is triggered only if the\n   * change succeeded and actually occurred.\n   */\n  onDisabledEmailAuthFactor?: (data: {\n    input: DisableEmailAuthFactorInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a handle change, before the change\n   * is performed on the account store. Only triggered with authenticated\n   * sessions, so the `account` is always available.\n   */\n  onUpdateHandle?: (data: {\n    input: UpdateHandleData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user successfully changed their handle on the\n   * account store.\n   */\n  onUpdatedHandle?: (data: {\n    input: UpdateHandleData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests account deactivation, before the\n   * account is deactivated on the account store.\n   */\n  onDeactivateAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user successfully deactivated their account on\n   * the account store.\n   */\n  onDeactivatedAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests account reactivation, before the\n   * account is reactivated on the account store.\n   */\n  onReactivateAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user successfully reactivated their account on\n   * the account store.\n   */\n  onReactivatedAccount?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests account deletion, before the\n   * confirmation email is dispatched on the account store.\n   */\n  onDeleteAccountRequest?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user has requested account deletion and the\n   * confirmation email has been dispatched.\n   */\n  onDeleteAccountRequested?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms account deletion, before the\n   * account is actually deleted on the account store.\n   */\n  onDeleteAccountConfirm?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user has successfully deleted their account\n   * on the account store.\n   */\n  onDeleteAccountConfirmed?: (data: {\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n    input: DeleteAccountConfirmInput\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user attempts to sign up, after every validation\n   * has passed (including hcaptcha).\n   */\n  onSignUpAttempt?: (data: {\n    input: SignUpInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId: ClientId | undefined\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user attempts to sign up, after the hcaptcha\n   * `/siteverify` request has been made (and before the result is validated).\n   */\n  onHcaptchaResult?: (data: {\n    input: SignUpInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    tokens: HcaptchaClientTokens\n    result: HcaptchaVerifyResult\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a password reset, before the\n   * reset password request is triggered on the account store. Use this to\n   * potentially cancel the password reset.\n   */\n  onResetPasswordRequest?: (data: {\n    input: ResetPasswordRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user requests a password reset, before the\n   * reset password request is triggered on the account store. If not account\n   * was found for the provided identifier, the `account` field will be `null`.\n   */\n  onResetPasswordRequested?: (data: {\n    input: ResetPasswordRequestInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account | null\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user confirms a password reset, before the\n   * password is actually reset on the account store.\n   */\n  onResetPasswordConfirm?: (data: {\n    input: ResetPasswordConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called after a user confirms a password reset, and the\n   * password was successfully reset on the account store.\n   */\n  onResetPasswordConfirmed?: (data: {\n    input: ResetPasswordConfirmInput\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    account: Account\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user successfully signs up.\n   *\n   * @throws {AccessDeniedError} to deny the sign-up\n   */\n  onSignedUp?: (data: {\n    data: SignUpData\n    account: Account\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId: ClientId | undefined\n  }) => Awaitable<void>\n\n  /**\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request (i.e. the user is logging in to approve a\n   * client); it is omitted for first-party sign-ins that happen outside any\n   * authorization flow.\n   */\n  onSignInAttempt?: (data: {\n    data: SignInData\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId: ClientId | undefined\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a user successfully signs in.\n   *\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request; see {@link OAuthHooks.onSignInAttempt}.\n   *\n   * @throws {InvalidRequestError} when the sing-in should be denied\n   */\n  onSignedIn?: (data: {\n    data: SignInData\n    account: Account\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId: ClientId | undefined\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a sign-in attempt is rejected by the account\n   * store due to invalid credentials (e.g. unknown identifier, wrong\n   * password). It is *not* called for unexpected server errors, nor for flows\n   * that require an additional authentication factor.\n   *\n   * `sub` is populated when the store throws an\n   * {@link InvalidCredentialsError} that carries the matched subject\n   * identifier (i.e. identifier known, credentials wrong). It is `null` when\n   * the identifier was unknown or when the store threw a plain\n   * {@link InvalidRequestError} without distinguishing the two cases.\n   *\n   * `clientId` is populated when the sign-in is submitted in the context of\n   * an OAuth authorization request; see {@link OAuthHooks.onSignInAttempt}.\n   *\n   * Errors thrown from this hook are caught and ignored so that they do not\n   * mask the original authentication failure.\n   */\n  onSignInFailed?: (data: {\n    data: SignInData\n    error: InvalidRequestError\n    did: Did | null\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    clientId: ClientId | undefined\n  }) => Awaitable<void>\n\n  /**\n   * Allows validating an authorization request (typically the requested scopes)\n   * before it is created. Note that the validity against the client metadata is\n   * already enforced by the OAuth provider.\n   *\n   * @throws {AuthorizationError}\n   */\n  onAuthorizationRequest?: (data: {\n    client: Client\n    clientAuth: null | ClientAuth\n    parameters: Readonly<OAuthAuthorizationRequestParameters>\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when a client is authorized.\n   *\n   * @throws {AuthorizationError} to deny the authorization request and redirect\n   * the user to the client with an OAuth error (other errors will result in an\n   * internal server error being displayed to the user)\n   *\n   * @note We use `deviceMetadata` instead of `clientMetadata` to make it clear\n   * that this metadata is from the user device, which might be different from\n   * the client metadata (because the OAuth client could live in a backend).\n   */\n  onAuthorized?: (data: {\n    client: Client\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n    deviceId: DeviceId\n    deviceMetadata: RequestMetadata\n    requestId: RequestId\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called whenever a token is about to be created. You can use\n   * it to modify the token claims or perform additional validation.\n   *\n   * This hook should never throw an error.\n   */\n  onCreateToken?: (data: {\n    client: Client\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n    claims: TokenClaims\n  }) => Awaitable<void | OmitKey<AccessTokenPayload, 'iss'>>\n\n  /**\n   * This hook is called whenever a token was just decoded, and basic validation\n   * was performed (signature, expiration, not-before).\n   *\n   * It can be used to modify the payload (e.g., to add custom claims), or to\n   * perform additional validation.\n   *\n   * This hook is called when authenticating requests through the\n   * `authenticateRequest()` method in `OAuthVerifier` and `OAuthProvider`.\n   *\n   * Any error thrown here will be propagated.\n   */\n  onDecodeToken?: (data: {\n    tokenType: OAuthTokenType\n    token: OAuthAccessToken\n    payload: AccessTokenPayload\n    dpopProof: null | DpopProof\n  }) => Promise<AccessTokenPayload | void>\n\n  /**\n   * This hook is called when an authorized client exchanges an authorization\n   * code for an access token.\n   *\n   * @throws {OAuthError} to cancel the token creation and revoke the session\n   */\n  onTokenCreated?: (data: {\n    client: Client\n    clientAuth: ClientAuth\n    clientMetadata: RequestMetadata\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n  }) => Awaitable<void>\n\n  /**\n   * This hook is called when an authorized client refreshes an access token.\n   *\n   * @throws {OAuthError} to cancel the token refresh and revoke the session\n   */\n  onTokenRefreshed?: (data: {\n    client: Client\n    clientAuth: ClientAuth\n    clientMetadata: RequestMetadata\n    account: Account\n    parameters: OAuthAuthorizationRequestParameters\n  }) => Awaitable<void>\n}\n"]}

package/dist/oauth-provider.d.ts

@@ -40,7 +40,7 @@ export { Keyset } from '@atproto/jwk';
 export type * from '@atproto/jwk-jose';
 export { JoseKey } from '@atproto/jwk-jose';
 export type * from '@atproto/lex-resolver';
-export { LexResolver } from '@atproto/lex-resolver';
+export { LexResolver, LexResolverError } from '@atproto/lex-resolver';
 export { AccessTokenMode };
 export type { AccessTokenPayload, AuthorizationRedirectParameters, AuthorizationResultAuthorizePage as AuthorizationResultAuthorize, AuthorizationResultRedirect, Branding, BrandingConfig, CustomMetadata, Customization, CustomizationConfig, ErrorHandler, HcaptchaConfig, LoopbackMetadataGetter, MultiLangString, OAuthAuthorizationServerMetadata, VerifyTokenPayloadOptions, };
 export type ClientJwksCache = SimpleStore<string, Jwks>;

package/dist/oauth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,uCAAuC,EAC5C,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,mCAAmC,EACxC,KAAK,8BAA8B,EACnC,KAAK,gCAAgC,EACrC,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,kCAAkC,EACvC,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EAGpB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAEnB,MAAM,4BAA4B,CAAA;AAEnC,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EACL,aAAa,EACb,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,KAAK,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC3E,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,mBAAmB,EAEzB,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EACL,KAAK,UAAU,EACf,aAAa,EACb,KAAK,oBAAoB,EAC1B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,KAAK,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAS1E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAG5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,8BAA8B,CAAA;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EACL,KAAK,SAAS,EACd,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC/B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,KAAK,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AAE9E,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAA;AACpG,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAA;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAA;AAC5F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAE1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,wBAAwB,CAAA;AAKtE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,mBAAmB,cAAc,CAAA;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,mBAAmB,mBAAmB,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,mBAAmB,uBAAuB,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,OAAO,EAAE,eAAe,EAAE,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,+BAA+B,EAC/B,gCAAgC,IAAI,4BAA4B,EAChE,2BAA2B,EAC3B,QAAQ,EACR,cAAc,EACd,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,GAC1B,CAAA;AAED,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AACvD,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;AAC1E,MAAM,MAAM,UAAU,GAAG,YAAY,GACnC,WAAW,GACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,UAAU,CAAA;AAEZ,KAAK,mBAAmB,GAAG;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;OAEG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAEnC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,MAAM,CAAA;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAE3B,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,UAAU,CAAC,EAAE,UAAU,CAAA;IAEvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IAEzC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,sBAAsB,CAAA;CACzD,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GACpD,oBAAoB,GACpB,UAAU,GACV,oBAAoB,GACpB,mBAAmB,CAAA;AAErB,qBAAa,aAAc,SAAQ,aAAa;IAC9C,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACnD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAEpC,SAAgB,QAAQ,EAAE,gCAAgC,CAAA;IAC1D,SAAgB,aAAa,EAAE,aAAa,CAAA;IAE5C,SAAgB,oBAAoB,EAAE,MAAM,CAAA;IAE5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,YAAY,EAAE,YAAY,CAAA;IAE1C,YAAmB,EAEjB,oBAA6C,EAC7C,WAA2B,EAC3B,eAA2C,EAE3C,QAAQ,EACR,gBAAgD,EAGhD,SAA2B,EAC3B,WAAmD,EAGnD,KAAK,EAGL,YAAoC,EACpC,WAAkC,EAClC,YAAoC,EACpC,UAAgC,EAChC,YAAoC,EAGpC,WAAkC,EAClC,WAAkC,EAElC,eAGE,EACF,mBAGE,EAMF,GAAG,IAAI,EACR,EAAE,oBAAoB,EA0DtB;IAED,IAAI,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAEP;IAED;;OAEG;IACI,oBAAoB,CACzB,UAAU,EAAE,mCAAmC,EAC/C,UAAU,CAAC,EAAE,oBAAoB,WAelC;IAEM,kBAAkB,CAAC,aAAa,EAAE,aAAa,WAGrD;IAED,UAAgB,kBAAkB,CAChC,iBAAiB,EAAE,sBAAsB,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,CAAC,EAAE;QACR,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAChC,GACA,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;KACvB,CAAC,CA8CD;IAEK,SAAS,CACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,mCAAmC,CAAC,CAwB9C;IAED;;OAEG;IACU,0BAA0B,CACrC,WAAW,EAAE,sBAAsB,EACnC,oBAAoB,EAAE,4BAA4B,EAClD,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CA8D3B;YAEa,2BAA2B;IA6CzC;;OAEG;IACU,SAAS,CACpB,KAAK,EAAE,8BAA8B,EACrC,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,UAAU,GACvC,OAAO,CAAC,2BAA2B,GAAG,gCAAgC,CAAC,CA0JzE;IAEY,KAAK,CAChB,iBAAiB,EAAE,sBAAsB,EACzC,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAyC7B;IAED,UAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,EAAE;QACP,UAAU,EAAE,mCAAmC,CAAA;QAC/C,QAAQ,EAAE,QAAQ,CAAA;QAClB,UAAU,EAAE,IAAI,GAAG,UAAU,GAAG,gBAAgB,CAAA;KACjD,GACA,OAAO,CAAC,IAAI,CAAC,CA6Df;IAED,UAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uCAAuC,EAC9C,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CA6D7B;IAED,UAAgB,iBAAiB,CAC/B,UAAU,EAAE,mCAAmC,EAC/C,KAAK,EAAE,uCAAuC,GAC7C,OAAO,CAAC,IAAI,CAAC,CAiDf;IAED,UAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,kCAAkC,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CA6B7B;IAED,UAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,EACf,GAAG,OAAa,GACf,OAAO,CAAC,IAAI,CAAC,CAef;IAED;;OAEG;IACU,MAAM,CACjB,iBAAiB,EAAE,sBAAsB,EACzC,EAAE,KAAK,EAAE,EAAE,wBAAwB,EACnC,SAAS,EAAE,IAAI,GAAG,SAAS,iBAqB5B;IAED,UAAyB,WAAW,CAClC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAkB7B;CACF"}
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,uCAAuC,EAC5C,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,mCAAmC,EACxC,KAAK,8BAA8B,EACnC,KAAK,gCAAgC,EACrC,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,kCAAkC,EACvC,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EAGpB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAEnB,MAAM,4BAA4B,CAAA;AAEnC,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EACL,aAAa,EACb,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,KAAK,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC3E,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,mBAAmB,EAEzB,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EACL,KAAK,UAAU,EACf,aAAa,EACb,KAAK,oBAAoB,EAC1B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,KAAK,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAS1E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAG5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,8BAA8B,CAAA;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EACL,KAAK,SAAS,EACd,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC/B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,KAAK,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AAE9E,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAA;AACpG,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAA;AACvG,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAA;AAC5F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAE1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,wBAAwB,CAAA;AAKtE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,mBAAmB,cAAc,CAAA;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,mBAAmB,mBAAmB,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,mBAAmB,uBAAuB,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,eAAe,EAAE,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,+BAA+B,EAC/B,gCAAgC,IAAI,4BAA4B,EAChE,2BAA2B,EAC3B,QAAQ,EACR,cAAc,EACd,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,GAC1B,CAAA;AAED,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AACvD,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;AAC1E,MAAM,MAAM,UAAU,GAAG,YAAY,GACnC,WAAW,GACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,UAAU,CAAA;AAEZ,KAAK,mBAAmB,GAAG;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;OAEG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAEnC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,MAAM,CAAA;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAE3B,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,UAAU,CAAC,EAAE,UAAU,CAAA;IAEvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IAEzC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,sBAAsB,CAAA;CACzD,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GACpD,oBAAoB,GACpB,UAAU,GACV,oBAAoB,GACpB,mBAAmB,CAAA;AAErB,qBAAa,aAAc,SAAQ,aAAa;IAC9C,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACnD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAEpC,SAAgB,QAAQ,EAAE,gCAAgC,CAAA;IAC1D,SAAgB,aAAa,EAAE,aAAa,CAAA;IAE5C,SAAgB,oBAAoB,EAAE,MAAM,CAAA;IAE5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,YAAY,EAAE,YAAY,CAAA;IAE1C,YAAmB,EAEjB,oBAA6C,EAC7C,WAA2B,EAC3B,eAA2C,EAE3C,QAAQ,EACR,gBAAgD,EAGhD,SAA2B,EAC3B,WAAmD,EAGnD,KAAK,EAGL,YAAoC,EACpC,WAAkC,EAClC,YAAoC,EACpC,UAAgC,EAChC,YAAoC,EAGpC,WAAkC,EAClC,WAAkC,EAElC,eAGE,EACF,mBAGE,EAMF,GAAG,IAAI,EACR,EAAE,oBAAoB,EA0DtB;IAED,IAAI,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAEP;IAED;;OAEG;IACI,oBAAoB,CACzB,UAAU,EAAE,mCAAmC,EAC/C,UAAU,CAAC,EAAE,oBAAoB,WAelC;IAEM,kBAAkB,CAAC,aAAa,EAAE,aAAa,WAGrD;IAED,UAAgB,kBAAkB,CAChC,iBAAiB,EAAE,sBAAsB,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,CAAC,EAAE;QACR,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAChC,GACA,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;KACvB,CAAC,CA8CD;IAEK,SAAS,CACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,mCAAmC,CAAC,CAwB9C;IAED;;OAEG;IACU,0BAA0B,CACrC,WAAW,EAAE,sBAAsB,EACnC,oBAAoB,EAAE,4BAA4B,EAClD,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CA8D3B;YAEa,2BAA2B;IA6CzC;;OAEG;IACU,SAAS,CACpB,KAAK,EAAE,8BAA8B,EACrC,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,UAAU,GACvC,OAAO,CAAC,2BAA2B,GAAG,gCAAgC,CAAC,CA0JzE;IAEY,KAAK,CAChB,iBAAiB,EAAE,sBAAsB,EACzC,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAyC7B;IAED,UAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,OAAO,EAAE;QACP,UAAU,EAAE,mCAAmC,CAAA;QAC/C,QAAQ,EAAE,QAAQ,CAAA;QAClB,UAAU,EAAE,IAAI,GAAG,UAAU,GAAG,gBAAgB,CAAA;KACjD,GACA,OAAO,CAAC,IAAI,CAAC,CA6Df;IAED,UAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uCAAuC,EAC9C,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CA6D7B;IAED,UAAgB,iBAAiB,CAC/B,UAAU,EAAE,mCAAmC,EAC/C,KAAK,EAAE,uCAAuC,GAC7C,OAAO,CAAC,IAAI,CAAC,CAiDf;IAED,UAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,kCAAkC,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CA6B7B;IAED,UAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,EACf,GAAG,OAAa,GACf,OAAO,CAAC,IAAI,CAAC,CAef;IAED;;OAEG;IACU,MAAM,CACjB,iBAAiB,EAAE,sBAAsB,EACzC,EAAE,KAAK,EAAE,EAAE,wBAAwB,EACnC,SAAS,EAAE,IAAI,GAAG,SAAS,iBAqB5B;IAED,UAAyB,WAAW,CAClC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAkB7B;CACF"}

package/dist/oauth-provider.js

@@ -41,7 +41,7 @@ import { isPARResponseError } from './types/par-response-error.js';
 export { safeFetchWrap } from '@atproto-labs/fetch-node';
 export { Keyset } from '@atproto/jwk';
 export { JoseKey } from '@atproto/jwk-jose';
-export { LexResolver } from '@atproto/lex-resolver';
+export { LexResolver, LexResolverError } from '@atproto/lex-resolver';
 export { AccessTokenMode };
 export class OAuthProvider extends OAuthVerifier {
     constructor({