@atproto/oauth-provider 0.6.6 → 0.7.0

package/dist/oauth-errors.js

@@ -1,51 +1,43 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WWWAuthenticateError = exports.UseDpopNonceError = exports.UnauthorizedClientError = exports.SecondAuthenticationFactorRequiredError = exports.LoginRequiredError = exports.InvalidTokenError = exports.InvalidScopeError = exports.InvalidRequestError = exports.InvalidRedirectUriError = exports.InvalidParametersError = exports.InvalidInviteCodeError = exports.InvalidGrantError = exports.InvalidDpopProofError = exports.InvalidDpopKeyBindingError = exports.InvalidClientMetadataError = exports.InvalidClientIdError = exports.InvalidClientError = exports.InvalidAuthorizationDetailsError = exports.HandleUnavailableError = exports.ConsentRequiredError = exports.AccountSelectionRequiredError = exports.AccessDeniedError = exports.OAuthError = void 0;
+exports.OAuthError = void 0;
 // Root Error class
 var oauth_error_js_1 = require("./errors/oauth-error.js");
 Object.defineProperty(exports, "OAuthError", { enumerable: true, get: function () { return oauth_error_js_1.OAuthError; } });
-var access_denied_error_js_1 = require("./errors/access-denied-error.js");
-Object.defineProperty(exports, "AccessDeniedError", { enumerable: true, get: function () { return access_denied_error_js_1.AccessDeniedError; } });
-var account_selection_required_error_js_1 = require("./errors/account-selection-required-error.js");
-Object.defineProperty(exports, "AccountSelectionRequiredError", { enumerable: true, get: function () { return account_selection_required_error_js_1.AccountSelectionRequiredError; } });
-var consent_required_error_js_1 = require("./errors/consent-required-error.js");
-Object.defineProperty(exports, "ConsentRequiredError", { enumerable: true, get: function () { return consent_required_error_js_1.ConsentRequiredError; } });
-var handle_unavailable_error_js_1 = require("./errors/handle-unavailable-error.js");
-Object.defineProperty(exports, "HandleUnavailableError", { enumerable: true, get: function () { return handle_unavailable_error_js_1.HandleUnavailableError; } });
-var invalid_authorization_details_error_js_1 = require("./errors/invalid-authorization-details-error.js");
-Object.defineProperty(exports, "InvalidAuthorizationDetailsError", { enumerable: true, get: function () { return invalid_authorization_details_error_js_1.InvalidAuthorizationDetailsError; } });
-var invalid_client_error_js_1 = require("./errors/invalid-client-error.js");
-Object.defineProperty(exports, "InvalidClientError", { enumerable: true, get: function () { return invalid_client_error_js_1.InvalidClientError; } });
-var invalid_client_id_error_js_1 = require("./errors/invalid-client-id-error.js");
-Object.defineProperty(exports, "InvalidClientIdError", { enumerable: true, get: function () { return invalid_client_id_error_js_1.InvalidClientIdError; } });
-var invalid_client_metadata_error_js_1 = require("./errors/invalid-client-metadata-error.js");
-Object.defineProperty(exports, "InvalidClientMetadataError", { enumerable: true, get: function () { return invalid_client_metadata_error_js_1.InvalidClientMetadataError; } });
-var invalid_dpop_key_binding_error_js_1 = require("./errors/invalid-dpop-key-binding-error.js");
-Object.defineProperty(exports, "InvalidDpopKeyBindingError", { enumerable: true, get: function () { return invalid_dpop_key_binding_error_js_1.InvalidDpopKeyBindingError; } });
-var invalid_dpop_proof_error_js_1 = require("./errors/invalid-dpop-proof-error.js");
-Object.defineProperty(exports, "InvalidDpopProofError", { enumerable: true, get: function () { return invalid_dpop_proof_error_js_1.InvalidDpopProofError; } });
-var invalid_grant_error_js_1 = require("./errors/invalid-grant-error.js");
-Object.defineProperty(exports, "InvalidGrantError", { enumerable: true, get: function () { return invalid_grant_error_js_1.InvalidGrantError; } });
-var invalid_invite_code_error_js_1 = require("./errors/invalid-invite-code-error.js");
-Object.defineProperty(exports, "InvalidInviteCodeError", { enumerable: true, get: function () { return invalid_invite_code_error_js_1.InvalidInviteCodeError; } });
-var invalid_parameters_error_js_1 = require("./errors/invalid-parameters-error.js");
-Object.defineProperty(exports, "InvalidParametersError", { enumerable: true, get: function () { return invalid_parameters_error_js_1.InvalidParametersError; } });
-var invalid_redirect_uri_error_js_1 = require("./errors/invalid-redirect-uri-error.js");
-Object.defineProperty(exports, "InvalidRedirectUriError", { enumerable: true, get: function () { return invalid_redirect_uri_error_js_1.InvalidRedirectUriError; } });
-var invalid_request_error_js_1 = require("./errors/invalid-request-error.js");
-Object.defineProperty(exports, "InvalidRequestError", { enumerable: true, get: function () { return invalid_request_error_js_1.InvalidRequestError; } });
-var invalid_scope_error_js_1 = require("./errors/invalid-scope-error.js");
-Object.defineProperty(exports, "InvalidScopeError", { enumerable: true, get: function () { return invalid_scope_error_js_1.InvalidScopeError; } });
-var invalid_token_error_js_1 = require("./errors/invalid-token-error.js");
-Object.defineProperty(exports, "InvalidTokenError", { enumerable: true, get: function () { return invalid_token_error_js_1.InvalidTokenError; } });
-var login_required_error_js_1 = require("./errors/login-required-error.js");
-Object.defineProperty(exports, "LoginRequiredError", { enumerable: true, get: function () { return login_required_error_js_1.LoginRequiredError; } });
-var second_authentication_factor_required_error_js_1 = require("./errors/second-authentication-factor-required-error.js");
-Object.defineProperty(exports, "SecondAuthenticationFactorRequiredError", { enumerable: true, get: function () { return second_authentication_factor_required_error_js_1.SecondAuthenticationFactorRequiredError; } });
-var unauthorized_client_error_js_1 = require("./errors/unauthorized-client-error.js");
-Object.defineProperty(exports, "UnauthorizedClientError", { enumerable: true, get: function () { return unauthorized_client_error_js_1.UnauthorizedClientError; } });
-var use_dpop_nonce_error_js_1 = require("./errors/use-dpop-nonce-error.js");
-Object.defineProperty(exports, "UseDpopNonceError", { enumerable: true, get: function () { return use_dpop_nonce_error_js_1.UseDpopNonceError; } });
-var www_authenticate_error_js_1 = require("./errors/www-authenticate-error.js");
-Object.defineProperty(exports, "WWWAuthenticateError", { enumerable: true, get: function () { return www_authenticate_error_js_1.WWWAuthenticateError; } });
+__exportStar(require("./errors/access-denied-error.js"), exports);
+__exportStar(require("./errors/account-selection-required-error.js"), exports);
+__exportStar(require("./errors/consent-required-error.js"), exports);
+__exportStar(require("./errors/handle-unavailable-error.js"), exports);
+__exportStar(require("./errors/invalid-authorization-details-error.js"), exports);
+__exportStar(require("./errors/invalid-client-error.js"), exports);
+__exportStar(require("./errors/invalid-client-id-error.js"), exports);
+__exportStar(require("./errors/invalid-client-metadata-error.js"), exports);
+__exportStar(require("./errors/invalid-dpop-key-binding-error.js"), exports);
+__exportStar(require("./errors/invalid-dpop-proof-error.js"), exports);
+__exportStar(require("./errors/invalid-grant-error.js"), exports);
+__exportStar(require("./errors/invalid-invite-code-error.js"), exports);
+__exportStar(require("./errors/invalid-parameters-error.js"), exports);
+__exportStar(require("./errors/invalid-redirect-uri-error.js"), exports);
+__exportStar(require("./errors/invalid-request-error.js"), exports);
+__exportStar(require("./errors/invalid-scope-error.js"), exports);
+__exportStar(require("./errors/invalid-token-error.js"), exports);
+__exportStar(require("./errors/login-required-error.js"), exports);
+__exportStar(require("./errors/second-authentication-factor-required-error.js"), exports);
+__exportStar(require("./errors/unauthorized-client-error.js"), exports);
+__exportStar(require("./errors/use-dpop-nonce-error.js"), exports);
+__exportStar(require("./errors/www-authenticate-error.js"), exports);
 //# sourceMappingURL=oauth-errors.js.map

package/dist/oauth-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-errors.js","sourceRoot":"","sources":["../src/oauth-errors.ts"],"names":[],"mappings":";;;AAAA,mBAAmB;AACnB,0DAAoD;AAA3C,4GAAA,UAAU,OAAA;AAEnB,0EAAmE;AAA1D,2HAAA,iBAAiB,OAAA;AAC1B,oGAA4F;AAAnF,oJAAA,6BAA6B,OAAA;AACtC,gFAAyE;AAAhE,iIAAA,oBAAoB,OAAA;AAC7B,oFAA6E;AAApE,qIAAA,sBAAsB,OAAA;AAC/B,0GAAkG;AAAzF,0JAAA,gCAAgC,OAAA;AACzC,4EAAqE;AAA5D,6HAAA,kBAAkB,OAAA;AAC3B,kFAA0E;AAAjE,kIAAA,oBAAoB,OAAA;AAC7B,8FAAsF;AAA7E,8IAAA,0BAA0B,OAAA;AACnC,gGAAuF;AAA9E,+IAAA,0BAA0B,OAAA;AACnC,oFAA4E;AAAnE,oIAAA,qBAAqB,OAAA;AAC9B,0EAAmE;AAA1D,2HAAA,iBAAiB,OAAA;AAC1B,sFAA8E;AAArE,sIAAA,sBAAsB,OAAA;AAC/B,oFAA6E;AAApE,qIAAA,sBAAsB,OAAA;AAC/B,wFAAgF;AAAvE,wIAAA,uBAAuB,OAAA;AAChC,8EAAuE;AAA9D,+HAAA,mBAAmB,OAAA;AAC5B,0EAAmE;AAA1D,2HAAA,iBAAiB,OAAA;AAC1B,0EAAmE;AAA1D,2HAAA,iBAAiB,OAAA;AAC1B,4EAAqE;AAA5D,6HAAA,kBAAkB,OAAA;AAC3B,0HAAiH;AAAxG,yKAAA,uCAAuC,OAAA;AAChD,sFAA+E;AAAtE,uIAAA,uBAAuB,OAAA;AAChC,4EAAoE;AAA3D,4HAAA,iBAAiB,OAAA;AAC1B,gFAAyE;AAAhE,iIAAA,oBAAoB,OAAA"}
+{"version":3,"file":"oauth-errors.js","sourceRoot":"","sources":["../src/oauth-errors.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,mBAAmB;AACnB,0DAAoD;AAA3C,4GAAA,UAAU,OAAA;AAEnB,kEAA+C;AAC/C,+EAA4D;AAC5D,qEAAkD;AAClD,uEAAoD;AACpD,kFAA+D;AAC/D,mEAAgD;AAChD,sEAAmD;AACnD,4EAAyD;AACzD,6EAA0D;AAC1D,uEAAoD;AACpD,kEAA+C;AAC/C,wEAAqD;AACrD,uEAAoD;AACpD,yEAAsD;AACtD,oEAAiD;AACjD,kEAA+C;AAC/C,kEAA+C;AAC/C,mEAAgD;AAChD,0FAAuE;AACvE,wEAAqD;AACrD,mEAAgD;AAChD,qEAAkD"}

package/dist/oauth-hooks.d.ts

@@ -1,6 +1,6 @@
 import { Jwks } from '@atproto/jwk';
+import type { Account } from '@atproto/oauth-provider-api';
 import { OAuthAuthorizationDetails, OAuthAuthorizationRequestParameters, OAuthClientMetadata, OAuthTokenResponse } from '@atproto/oauth-types';
-import { Account } from './account/account.js';
 import { SignInData } from './account/sign-in-data.js';
 import { SignUpInput } from './account/sign-up-input.js';
 import { ClientAuth } from './client/client-auth.js';
@@ -12,8 +12,9 @@ import { HcaptchaClientTokens, HcaptchaConfig, HcaptchaVerifyResult } from './li
 import { RequestMetadata } from './lib/http/request.js';
 import { Awaitable } from './lib/util/type.js';
 import { AccessDeniedError, OAuthError } from './oauth-errors.js';
-import { DeviceAccountInfo, DeviceId, SignUpData } from './oauth-store.js';
-export { AccessDeniedError, type Account, type Awaitable, Client, type ClientAuth, type ClientId, type ClientInfo, type DeviceAccountInfo, type DeviceId, type HcaptchaClientTokens, type HcaptchaConfig, type HcaptchaVerifyResult, InvalidRequestError, type Jwks, type OAuthAuthorizationDetails, type OAuthAuthorizationRequestParameters, type OAuthClientMetadata, OAuthError, type OAuthTokenResponse, type RequestMetadata, type SignInData, type SignUpData, type SignUpInput, };
+import { DeviceId, SignUpData } from './oauth-store.js';
+import { RequestId } from './request/request-id.js';
+export { AccessDeniedError, type Account, type Awaitable, Client, type ClientAuth, type ClientId, type ClientInfo, type DeviceId, type HcaptchaClientTokens, type HcaptchaConfig, type HcaptchaVerifyResult, InvalidRequestError, type Jwks, type OAuthAuthorizationDetails, type OAuthAuthorizationRequestParameters, type OAuthClientMetadata, OAuthError, type OAuthTokenResponse, type RequestMetadata, type SignInData, type SignUpData, type SignUpInput, };
 export type OAuthHooks = {
     /**
      * Use this to alter, override or validate the client metadata & jwks returned
@@ -26,24 +27,11 @@ export type OAuthHooks = {
         metadata: OAuthClientMetadata;
         jwks?: Jwks;
     }) => Awaitable<undefined | Partial<ClientInfo>>;
-    /**
-     * Allows enriching the authorization details with additional information
-     * when the tokens are issued.
-     *
-     * @see {@link https://datatracker.ietf.org/doc/html/rfc9396 | RFC 9396}
-     */
-    getAuthorizationDetails?: (data: {
-        client: Client;
-        clientAuth: ClientAuth;
-        clientMetadata: RequestMetadata;
-        parameters: OAuthAuthorizationRequestParameters;
-        account: Account;
-    }) => Awaitable<undefined | OAuthAuthorizationDetails>;
     /**
      * This hook is called when a user attempts to sign up, after every validation
      * has passed (including hcaptcha).
      */
-    onSignupAttempt?: (data: {
+    onSignUpAttempt?: (data: {
         input: SignUpInput;
         deviceId: DeviceId;
         deviceMetadata: RequestMetadata;
@@ -66,11 +54,15 @@ export type OAuthHooks = {
      */
     onSignedUp?: (data: {
         data: SignUpData;
-        info: DeviceAccountInfo;
         account: Account;
         deviceId: DeviceId;
         deviceMetadata: RequestMetadata;
     }) => Awaitable<void>;
+    onSignInAttempt?: (data: {
+        data: SignInData;
+        deviceId: DeviceId;
+        deviceMetadata: RequestMetadata;
+    }) => Awaitable<void>;
     /**
      * This hook is called when a user successfully signs in.
      *
@@ -78,7 +70,6 @@ export type OAuthHooks = {
      */
     onSignedIn?: (data: {
         data: SignInData;
-        info: DeviceAccountInfo;
         account: Account;
         deviceId: DeviceId;
         deviceMetadata: RequestMetadata;
@@ -100,6 +91,7 @@ export type OAuthHooks = {
         parameters: OAuthAuthorizationRequestParameters;
         deviceId: DeviceId;
         deviceMetadata: RequestMetadata;
+        requestId: RequestId;
     }) => Awaitable<void>;
     /**
      * This hook is called when an authorized client exchanges an authorization
@@ -113,8 +105,6 @@ export type OAuthHooks = {
         clientMetadata: RequestMetadata;
         account: Account;
         parameters: OAuthAuthorizationRequestParameters;
-        /** null when "password grant" used (in which case {@link onAuthorized} won't have been called) */
-        deviceId: null | DeviceId;
     }) => Awaitable<void>;
     /**
      * This hook is called when an authorized client refreshes an access token.
@@ -127,8 +117,6 @@ export type OAuthHooks = {
         clientMetadata: RequestMetadata;
         account: Account;
         parameters: OAuthAuthorizationRequestParameters;
-        /** null when "password grant" used (in which case {@link onAuthorized} won't have been called) */
-        deviceId: null | DeviceId;
     }) => Awaitable<void>;
 };
 //# sourceMappingURL=oauth-hooks.d.ts.map

package/dist/oauth-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-hooks.d.ts","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,EACL,yBAAyB,EACzB,mCAAmC,EACnC,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvE,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACrB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACjE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAG1E,OAAO,EACL,iBAAiB,EACjB,KAAK,OAAO,EACZ,KAAK,SAAS,EACd,MAAM,EACN,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,KAAK,IAAI,EACT,KAAK,yBAAyB,EAC9B,KAAK,mCAAmC,EACxC,KAAK,mBAAmB,EACxB,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE;QAAE,QAAQ,EAAE,mBAAmB,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAE,KACjD,SAAS,CAAC,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAE/C;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC/B,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,cAAc,EAAE,eAAe,CAAA;QAC/B,UAAU,EAAE,mCAAmC,CAAA;QAC/C,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,SAAS,GAAG,yBAAyB,CAAC,CAAA;IAEtD;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,KAAK,EAAE,WAAW,CAAA;QAClB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE,WAAW,CAAA;QAClB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,MAAM,EAAE,oBAAoB,CAAA;QAC5B,MAAM,EAAE,oBAAoB,CAAA;KAC7B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,UAAU,CAAA;QAChB,IAAI,EAAE,iBAAiB,CAAA;QACvB,OAAO,EAAE,OAAO,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,UAAU,CAAA;QAChB,IAAI,EAAE,iBAAiB,CAAA;QACvB,OAAO,EAAE,OAAO,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;QAC/C,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;QAC/C,kGAAkG;QAClG,QAAQ,EAAE,IAAI,GAAG,QAAQ,CAAA;KAC1B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;QAC/C,kGAAkG;QAClG,QAAQ,EAAE,IAAI,GAAG,QAAQ,CAAA;KAC1B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;CACtB,CAAA"}
+{"version":3,"file":"oauth-hooks.d.ts","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EACL,yBAAyB,EACzB,mCAAmC,EACnC,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvE,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACrB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAGnD,OAAO,EACL,iBAAiB,EACjB,KAAK,OAAO,EACZ,KAAK,SAAS,EACd,MAAM,EACN,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,KAAK,IAAI,EACT,KAAK,yBAAyB,EAC9B,KAAK,mCAAmC,EACxC,KAAK,mBAAmB,EACxB,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE;QAAE,QAAQ,EAAE,mBAAmB,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAE,KACjD,SAAS,CAAC,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAE/C;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,KAAK,EAAE,WAAW,CAAA;QAClB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE,WAAW,CAAA;QAClB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,MAAM,EAAE,oBAAoB,CAAA;QAC5B,MAAM,EAAE,oBAAoB,CAAA;KAC7B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,UAAU,CAAA;QAChB,OAAO,EAAE,OAAO,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,IAAI,EAAE,UAAU,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,UAAU,CAAA;QAChB,OAAO,EAAE,OAAO,CAAA;QAChB,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;KAChC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;QAC/C,QAAQ,EAAE,QAAQ,CAAA;QAClB,cAAc,EAAE,eAAe,CAAA;QAC/B,SAAS,EAAE,SAAS,CAAA;KACrB,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QACtB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;KAChD,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;IAErB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,UAAU,CAAA;QACtB,cAAc,EAAE,eAAe,CAAA;QAC/B,OAAO,EAAE,OAAO,CAAA;QAChB,UAAU,EAAE,mCAAmC,CAAA;KAChD,KAAK,SAAS,CAAC,IAAI,CAAC,CAAA;CACtB,CAAA"}

package/dist/oauth-hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-hooks.js","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":";;;AAaA,kDAA2C;AAiBzC,uFAjBO,kBAAM,OAiBP;AAhBR,gFAAuE;AAyBrE,oGAzBO,8CAAmB,OAyBP;AAjBrB,uDAAiE;AAK/D,kGALO,mCAAiB,OAKP;AAiBjB,2FAtB0B,4BAAU,OAsB1B"}
+{"version":3,"file":"oauth-hooks.js","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":";;;AAaA,kDAA2C;AAkBzC,uFAlBO,kBAAM,OAkBP;AAjBR,gFAAuE;AAyBrE,oGAzBO,8CAAmB,OAyBP;AAjBrB,uDAAiE;AAM/D,kGANO,mCAAiB,OAMP;AAgBjB,2FAtB0B,4BAAU,OAsB1B"}

package/dist/oauth-middleware.d.ts

@@ -0,0 +1,12 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { Handler } from './lib/http/types.js';
+import { OAuthProvider } from './oauth-provider.js';
+import { ErrorHandler } from './router/error-handler.js';
+import { MiddlewareOptions } from './router/middleware-options.js';
+export type { ErrorHandler, Handler, IncomingMessage, MiddlewareOptions, ServerResponse, };
+/**
+ * @returns An http request handler that can be used with node's http server
+ * or as a middleware with express / connect.
+ */
+export declare function oauthMiddleware<Req extends IncomingMessage = IncomingMessage, Res extends ServerResponse = ServerResponse>(server: OAuthProvider, { ...options }?: MiddlewareOptions<Req, Res>): Handler<void, Req, Res>;
+//# sourceMappingURL=oauth-middleware.d.ts.map

package/dist/oauth-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-middleware.d.ts","sourceRoot":"","sources":["../src/oauth-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAMnD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAGlE,YAAY,EACV,YAAY,EACZ,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,cAAc,GACf,CAAA;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAE3C,MAAM,EAAE,aAAa,EACrB,EAAE,GAAG,OAAO,EAAE,GAAE,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAM,GAC/C,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAqBzB"}

package/dist/oauth-middleware.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthMiddleware = oauthMiddleware;
+const middleware_js_1 = require("./lib/http/middleware.js");
+const assets_js_1 = require("./router/assets/assets.js");
+const create_account_page_middleware_js_1 = require("./router/create-account-page-middleware.js");
+const create_api_middleware_js_1 = require("./router/create-api-middleware.js");
+const create_authorization_page_middleware_js_1 = require("./router/create-authorization-page-middleware.js");
+const create_oauth_middleware_js_1 = require("./router/create-oauth-middleware.js");
+/**
+ * @returns An http request handler that can be used with node's http server
+ * or as a middleware with express / connect.
+ */
+function oauthMiddleware(server, { ...options } = {}) {
+    const { onError } = options;
+    // options is shallow cloned so it's fine to mutate it
+    options.onError =
+        process.env['NODE_ENV'] === 'development'
+            ? (req, res, err, msg) => {
+                console.error(`OAuthProvider error (${msg}):`, err);
+                return onError?.(req, res, err, msg);
+            }
+            : onError;
+    return (0, middleware_js_1.asHandler)((0, middleware_js_1.combineMiddlewares)([
+        assets_js_1.assetsMiddleware,
+        (0, create_oauth_middleware_js_1.createOAuthMiddleware)(server, options),
+        (0, create_api_middleware_js_1.createApiMiddleware)(server, options),
+        (0, create_authorization_page_middleware_js_1.createAuthorizationPageMiddleware)(server, options),
+        (0, create_account_page_middleware_js_1.createAccountPageMiddleware)(server, options),
+    ]));
+}
+//# sourceMappingURL=oauth-middleware.js.map

package/dist/oauth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-middleware.js","sourceRoot":"","sources":["../src/oauth-middleware.ts"],"names":[],"mappings":";;AAyBA,0CA2BC;AAnDD,4DAAwE;AAGxE,yDAA4D;AAC5D,kGAAwF;AACxF,gFAAuE;AACvE,8GAAoG;AACpG,oFAA2E;AAa3E;;;GAGG;AACH,SAAgB,eAAe,CAI7B,MAAqB,EACrB,EAAE,GAAG,OAAO,KAAkC,EAAE;IAEhD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,sDAAsD;IACtD,OAAO,CAAC,OAAO;QACb,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,aAAa;YACvC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBACrB,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,IAAI,EAAE,GAAG,CAAC,CAAA;gBACnD,OAAO,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACtC,CAAC;YACH,CAAC,CAAC,OAAO,CAAA;IAEb,OAAO,IAAA,yBAAS,EACd,IAAA,kCAAkB,EAAC;QACjB,4BAAgB;QAChB,IAAA,kDAAqB,EAAC,MAAM,EAAE,OAAO,CAAC;QACtC,IAAA,8CAAmB,EAAC,MAAM,EAAE,OAAO,CAAC;QACpC,IAAA,2EAAiC,EAAC,MAAM,EAAE,OAAO,CAAC;QAClD,IAAA,+DAA2B,EAAC,MAAM,EAAE,OAAO,CAAC;KAC7C,CAAC,CACH,CAAA;AACH,CAAC"}

package/dist/oauth-provider.d.ts

@@ -1,56 +1,68 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { Redis, RedisOptions } from 'ioredis';
 import { Jwks, Keyset } from '@atproto/jwk';
-import { OAuthAccessToken, OAuthAuthorizationCodeGrantTokenRequest, OAuthAuthorizationRequestJar, OAuthAuthorizationRequestPar, OAuthAuthorizationRequestParameters, OAuthAuthorizationRequestQuery, OAuthAuthorizationServerMetadata, OAuthClientCredentials, OAuthClientCredentialsNone, OAuthClientMetadata, OAuthIntrospectionResponse, OAuthParResponse, OAuthRefreshTokenGrantTokenRequest, OAuthTokenIdentification, OAuthTokenRequest, OAuthTokenResponse, OAuthTokenType } from '@atproto/oauth-types';
+import type { Account } from '@atproto/oauth-provider-api';
+import { OAuthAccessToken, OAuthAuthorizationCodeGrantTokenRequest, OAuthAuthorizationRequestJar, OAuthAuthorizationRequestPar, OAuthAuthorizationRequestParameters, OAuthAuthorizationRequestQuery, OAuthAuthorizationServerMetadata, OAuthClientCredentials, OAuthClientCredentialsNone, OAuthClientMetadata, OAuthParResponse, OAuthRefreshTokenGrantTokenRequest, OAuthTokenIdentification, OAuthTokenRequest, OAuthTokenResponse, OAuthTokenType } from '@atproto/oauth-types';
 import { SimpleStore } from '@atproto-labs/simple-store';
+import { AccessTokenMode } from './access-token/access-token-mode.js';
 import { AccountManager } from './account/account-manager.js';
-import { AccountStore, DeviceAccountInfo } from './account/account-store.js';
-import { Account } from './account/account.js';
+import { AccountStore, AuthorizedClientData, DeviceAccount } from './account/account-store.js';
 import { ClientAuth } from './client/client-auth.js';
+import { ClientId } from './client/client-id.js';
 import { ClientManager, LoopbackMetadataGetter } from './client/client-manager.js';
 import { ClientStore } from './client/client-store.js';
 import { Client } from './client/client.js';
+import { Branding, BrandingInput } from './customization/branding.js';
+import { Customization, CustomizationInput } from './customization/customization.js';
 import { DeviceId } from './device/device-id.js';
 import { DeviceManager, DeviceManagerOptions } from './device/device-manager.js';
 import { DeviceStore } from './device/device-store.js';
 import { HcaptchaConfig } from './lib/hcaptcha.js';
-import { Handler, Router } from './lib/http/index.js';
 import { RequestMetadata } from './lib/http/request.js';
-import { Override } from './lib/util/type.js';
+import { LocalizedString, MultiLangString } from './lib/util/locale.js';
 import { CustomMetadata } from './metadata/build-metadata.js';
-import { OAuthHooks, SignInData, SignUpData } from './oauth-hooks.js';
+import { OAuthHooks } from './oauth-hooks.js';
 import { OAuthVerifier, OAuthVerifierOptions } from './oauth-verifier.js';
-import { AuthorizationResultAuthorize } from './output/build-authorize-data.js';
-import { Branding, BrandingInput, Customization, CustomizationInput } from './output/build-customization-data.js';
-import { OutputManager } from './output/output-manager.js';
-import { AuthorizationResultRedirect } from './output/send-authorize-redirect.js';
 import { ReplayStore } from './replay/replay-store.js';
 import { RequestManager } from './request/request-manager.js';
 import { RequestStore } from './request/request-store.js';
-import { RequestUri } from './request/request-uri.js';
+import { AuthorizationRedirectParameters } from './result/authorization-redirect-parameters.js';
+import { AuthorizationResultAuthorizePage } from './result/authorization-result-authorize-page.js';
+import { AuthorizationResultRedirect } from './result/authorization-result-redirect.js';
+import { ErrorHandler } from './router/error-handler.js';
 import { TokenManager } from './token/token-manager.js';
 import { TokenStore } from './token/token-store.js';
-import { VerifyTokenClaimsOptions } from './token/verify-token-claims.js';
-export { type Branding, type BrandingInput, type CustomMetadata, type Customization, type CustomizationInput, type Handler, type HcaptchaConfig, Keyset, type OAuthAuthorizationServerMetadata, };
-type ApiContext = {
-    requestUri: RequestUri;
-    deviceId: DeviceId;
-    deviceMetadata: RequestMetadata;
-};
-export type ErrorHandler<Req extends IncomingMessage = IncomingMessage, Res extends ServerResponse = ServerResponse> = (req: Req, res: Res, err: unknown, message: string) => void;
-export type RouterOptions<Req extends IncomingMessage = IncomingMessage, Res extends ServerResponse = ServerResponse> = {
-    onError?: ErrorHandler<Req, Res>;
-};
-export type OAuthProviderOptions = Override<OAuthVerifierOptions & OAuthHooks & DeviceManagerOptions & CustomizationInput, {
+import { VerifyTokenClaimsOptions, VerifyTokenClaimsResult } from './token/verify-token-claims.js';
+export { AccessTokenMode, Keyset };
+export type { AuthorizationRedirectParameters, AuthorizationResultAuthorizePage as AuthorizationResultAuthorize, AuthorizationResultRedirect, Branding, BrandingInput, CustomMetadata, Customization, CustomizationInput, ErrorHandler, HcaptchaConfig, LocalizedString, MultiLangString, OAuthAuthorizationServerMetadata, };
+type OAuthProviderConfig = {
     /**
      * Maximum age a device/account session can be before requiring
      * re-authentication.
      */
     authenticationMaxAge?: number;
+    /**
+     * Maximum age an ephemeral session (one where "remember me" was not
+     * checked) can be before requiring re-authentication.
+     */
     /**
      * Maximum age access & id tokens can be before requiring a refresh.
      */
     tokenMaxAge?: number;
+    /**
+     * If set to {@link AccessTokenMode.stateless}, the generated access tokens
+     * will contain all the necessary information to validate the token without
+     * needing to query the database. This is useful for cases where the Resource
+     * Server is on a different host/server than the Authorization Server.
+     *
+     * When set to {@link AccessTokenMode.light}, the access tokens will contain
+     * only the necessary information to validate the token, but the token id
+     * will need to be queried from the database to retrieve the full token
+     * information (scope, audience, etc.)
+     *
+     * @see {@link AccessTokenMode}
+     * @default {AccessTokenMode.stateless}
+     */
+    accessTokenMode?: AccessTokenMode;
     /**
      * Additional metadata to be included in the discovery document.
      */
@@ -105,117 +117,123 @@ export type OAuthProviderOptions = Override<OAuthVerifierOptions & OAuthHooks &
      * @default is as specified by ATPROTO
      */
     loopbackMetadata?: null | false | LoopbackMetadataGetter;
-}>;
+};
+export type OAuthProviderOptions = OAuthProviderConfig & OAuthVerifierOptions & OAuthHooks & DeviceManagerOptions & CustomizationInput;
 export declare class OAuthProvider extends OAuthVerifier {
+    protected readonly accessTokenMode: AccessTokenMode;
     readonly metadata: OAuthAuthorizationServerMetadata;
+    readonly customization: Customization;
     readonly authenticationMaxAge: number;
     readonly accountManager: AccountManager;
     readonly deviceManager: DeviceManager;
     readonly clientManager: ClientManager;
     readonly requestManager: RequestManager;
     readonly tokenManager: TokenManager;
-    readonly outputManager: OutputManager;
-    constructor({ metadata, authenticationMaxAge, tokenMaxAge, safeFetch, redis, store, // compound store implementation
+    constructor({ authenticationMaxAge, tokenMaxAge, accessTokenMode, metadata, safeFetch, redis, store, // compound store implementation
     accountStore, deviceStore, tokenStore, clientStore, replayStore, requestStore, clientJwksCache, clientMetadataCache, loopbackMetadata, ...rest }: OAuthProviderOptions);
     get jwks(): {
         readonly keys: readonly ({
             readonly kty: "RSA";
             readonly n: string;
             readonly e: string;
-            readonly alg?: "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | undefined;
-            readonly kid?: string | undefined;
-            readonly ext?: boolean | undefined;
-            readonly use?: "sig" | "enc" | undefined;
+            readonly alg?: "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | undefined | undefined;
+            readonly kid?: string | undefined | undefined;
+            readonly ext?: boolean | undefined | undefined;
+            readonly use?: "sig" | "enc" | undefined | undefined;
             readonly key_ops?: readonly ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
             readonly x5c?: readonly string[] | undefined;
-            readonly x5t?: string | undefined;
-            readonly 'x5t#S256'?: string | undefined;
-            readonly x5u?: string | undefined;
-            readonly d?: string | undefined;
-            readonly p?: string | undefined;
-            readonly q?: string | undefined;
-            readonly dp?: string | undefined;
-            readonly dq?: string | undefined;
-            readonly qi?: string | undefined;
+            readonly x5t?: string | undefined | undefined;
+            readonly 'x5t#S256'?: string | undefined | undefined;
+            readonly x5u?: string | undefined | undefined;
+            readonly d?: string | undefined | undefined;
+            readonly p?: string | undefined | undefined;
+            readonly q?: string | undefined | undefined;
+            readonly dp?: string | undefined | undefined;
+            readonly dq?: string | undefined | undefined;
+            readonly qi?: string | undefined | undefined;
             readonly oth?: readonly [{
-                readonly d?: string | undefined;
-                readonly r?: string | undefined;
-                readonly t?: string | undefined;
+                readonly d?: string | undefined | undefined;
+                readonly r?: string | undefined | undefined;
+                readonly t?: string | undefined | undefined;
             }, ...{
-                readonly d?: string | undefined;
-                readonly r?: string | undefined;
-                readonly t?: string | undefined;
+                readonly d?: string | undefined | undefined;
+                readonly r?: string | undefined | undefined;
+                readonly t?: string | undefined | undefined;
             }[]] | undefined;
         } | {
             readonly kty: "EC";
             readonly crv: "P-256" | "P-384" | "P-521";
             readonly x: string;
             readonly y: string;
-            readonly alg?: "ES256" | "ES384" | "ES512" | undefined;
-            readonly kid?: string | undefined;
-            readonly ext?: boolean | undefined;
-            readonly use?: "sig" | "enc" | undefined;
+            readonly alg?: "ES256" | "ES384" | "ES512" | undefined | undefined;
+            readonly kid?: string | undefined | undefined;
+            readonly ext?: boolean | undefined | undefined;
+            readonly use?: "sig" | "enc" | undefined | undefined;
             readonly key_ops?: readonly ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
             readonly x5c?: readonly string[] | undefined;
-            readonly x5t?: string | undefined;
-            readonly 'x5t#S256'?: string | undefined;
-            readonly x5u?: string | undefined;
-            readonly d?: string | undefined;
+            readonly x5t?: string | undefined | undefined;
+            readonly 'x5t#S256'?: string | undefined | undefined;
+            readonly x5u?: string | undefined | undefined;
+            readonly d?: string | undefined | undefined;
         } | {
             readonly kty: "EC";
             readonly crv: "secp256k1";
             readonly x: string;
             readonly y: string;
-            readonly alg?: "ES256K" | undefined;
-            readonly kid?: string | undefined;
-            readonly ext?: boolean | undefined;
-            readonly use?: "sig" | "enc" | undefined;
+            readonly alg?: "ES256K" | undefined | undefined;
+            readonly kid?: string | undefined | undefined;
+            readonly ext?: boolean | undefined | undefined;
+            readonly use?: "sig" | "enc" | undefined | undefined;
             readonly key_ops?: readonly ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
             readonly x5c?: readonly string[] | undefined;
-            readonly x5t?: string | undefined;
-            readonly 'x5t#S256'?: string | undefined;
-            readonly x5u?: string | undefined;
-            readonly d?: string | undefined;
+            readonly x5t?: string | undefined | undefined;
+            readonly 'x5t#S256'?: string | undefined | undefined;
+            readonly x5u?: string | undefined | undefined;
+            readonly d?: string | undefined | undefined;
         } | {
             readonly kty: "OKP";
             readonly crv: "Ed25519" | "Ed448";
             readonly x: string;
-            readonly alg?: "EdDSA" | undefined;
-            readonly kid?: string | undefined;
-            readonly ext?: boolean | undefined;
-            readonly use?: "sig" | "enc" | undefined;
+            readonly alg?: "EdDSA" | undefined | undefined;
+            readonly kid?: string | undefined | undefined;
+            readonly ext?: boolean | undefined | undefined;
+            readonly use?: "sig" | "enc" | undefined | undefined;
             readonly key_ops?: readonly ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
             readonly x5c?: readonly string[] | undefined;
-            readonly x5t?: string | undefined;
-            readonly 'x5t#S256'?: string | undefined;
-            readonly x5u?: string | undefined;
-            readonly d?: string | undefined;
+            readonly x5t?: string | undefined | undefined;
+            readonly 'x5t#S256'?: string | undefined | undefined;
+            readonly x5u?: string | undefined | undefined;
+            readonly d?: string | undefined | undefined;
         } | {
             readonly kty: "oct";
             readonly k: string;
-            readonly alg?: "HS256" | "HS384" | "HS512" | undefined;
-            readonly kid?: string | undefined;
-            readonly ext?: boolean | undefined;
-            readonly use?: "sig" | "enc" | undefined;
+            readonly alg?: "HS256" | "HS384" | "HS512" | undefined | undefined;
+            readonly kid?: string | undefined | undefined;
+            readonly ext?: boolean | undefined | undefined;
+            readonly use?: "sig" | "enc" | undefined | undefined;
             readonly key_ops?: readonly ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
             readonly x5c?: readonly string[] | undefined;
-            readonly x5t?: string | undefined;
-            readonly 'x5t#S256'?: string | undefined;
-            readonly x5u?: string | undefined;
+            readonly x5t?: string | undefined | undefined;
+            readonly 'x5t#S256'?: string | undefined | undefined;
+            readonly x5u?: string | undefined | undefined;
         } | {
             readonly kty: string;
-            readonly alg?: string | undefined;
-            readonly kid?: string | undefined;
-            readonly ext?: boolean | undefined;
-            readonly use?: "sig" | "enc" | undefined;
+            readonly alg?: string | undefined | undefined;
+            readonly kid?: string | undefined | undefined;
+            readonly ext?: boolean | undefined | undefined;
+            readonly use?: "sig" | "enc" | undefined | undefined;
             readonly key_ops?: readonly ("sign" | "verify" | "encrypt" | "decrypt" | "wrapKey" | "unwrapKey" | "deriveKey" | "deriveBits")[] | undefined;
             readonly x5c?: readonly string[] | undefined;
-            readonly x5t?: string | undefined;
-            readonly 'x5t#S256'?: string | undefined;
-            readonly x5u?: string | undefined;
+            readonly x5t?: string | undefined | undefined;
+            readonly 'x5t#S256'?: string | undefined | undefined;
+            readonly x5u?: string | undefined | undefined;
         })[];
     };
-    protected loginRequired(client: Client, parameters: OAuthAuthorizationRequestParameters, info: DeviceAccountInfo): boolean;
+    /**
+     * @returns true if the user's consent is required for the requested scopes
+     */
+    checkConsentRequired(parameters: OAuthAuthorizationRequestParameters, clientData?: AuthorizedClientData): boolean;
+    checkLoginRequired(deviceAccount: DeviceAccount): boolean;
     protected authenticateClient(credentials: OAuthClientCredentials): Promise<[Client, ClientAuth]>;
     protected decodeJAR(client: Client, input: OAuthAuthorizationRequestJar): Promise<{
         payload: OAuthAuthorizationRequestParameters;
@@ -230,48 +248,26 @@ export declare class OAuthProvider extends OAuthVerifier {
     /**
      * @see {@link https://datatracker.ietf.org/doc/html/rfc9126}
      */
-    protected pushedAuthorizationRequest(credentials: OAuthClientCredentials, authorizationRequest: OAuthAuthorizationRequestPar, dpopJkt: null | string): Promise<OAuthParResponse>;
+    pushedAuthorizationRequest(credentials: OAuthClientCredentials, authorizationRequest: OAuthAuthorizationRequestPar, dpopJkt: null | string): Promise<OAuthParResponse>;
     private processAuthorizationRequest;
-    private deleteRequest;
     /**
      * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-4.1.1}
      */
-    protected authorize(clientCredentials: OAuthClientCredentialsNone, query: OAuthAuthorizationRequestQuery, deviceId: DeviceId, deviceMetadata: RequestMetadata): Promise<AuthorizationResultRedirect | AuthorizationResultAuthorize>;
-    protected getSessions(client: Client, clientAuth: ClientAuth, deviceId: DeviceId, parameters: OAuthAuthorizationRequestParameters): Promise<{
+    authorize(clientCredentials: OAuthClientCredentialsNone, query: OAuthAuthorizationRequestQuery, deviceId: DeviceId, deviceMetadata: RequestMetadata): Promise<AuthorizationResultRedirect | AuthorizationResultAuthorizePage>;
+    protected getSessions(clientId: ClientId, deviceId: DeviceId, parameters: OAuthAuthorizationRequestParameters): Promise<{
         account: Account;
-        info: DeviceAccountInfo;
         selected: boolean;
         loginRequired: boolean;
         consentRequired: boolean;
         matchesHint: boolean;
     }[]>;
-    protected signUp({ requestUri, deviceId, deviceMetadata }: ApiContext, data: SignUpData): Promise<{
-        account: Account;
-        consentRequired: boolean;
-    }>;
-    protected signIn({ requestUri, deviceId, deviceMetadata }: ApiContext, data: SignInData): Promise<{
-        account: Account;
-        consentRequired: boolean;
-    }>;
-    protected acceptRequest({ requestUri, deviceId, deviceMetadata }: ApiContext, sub: string): Promise<AuthorizationResultRedirect>;
-    protected rejectRequest({ requestUri, deviceId, }: ApiContext): Promise<AuthorizationResultRedirect>;
-    protected token(clientCredentials: OAuthClientCredentials, clientMetadata: RequestMetadata, request: OAuthTokenRequest, dpopJkt: null | string): Promise<OAuthTokenResponse>;
+    token(clientCredentials: OAuthClientCredentials, clientMetadata: RequestMetadata, request: OAuthTokenRequest, dpopJkt: null | string): Promise<OAuthTokenResponse>;
     protected codeGrant(client: Client, clientAuth: ClientAuth, clientMetadata: RequestMetadata, input: OAuthAuthorizationCodeGrantTokenRequest, dpopJkt: null | string): Promise<OAuthTokenResponse>;
     refreshTokenGrant(client: Client, clientAuth: ClientAuth, clientMetadata: RequestMetadata, input: OAuthRefreshTokenGrantTokenRequest, dpopJkt: null | string): Promise<OAuthTokenResponse>;
     /**
      * @see {@link https://datatracker.ietf.org/doc/html/rfc7009#section-2.1 rfc7009}
      */
-    protected revoke({ token }: OAuthTokenIdentification): Promise<void>;
-    /**
-     * @see {@link https://datatracker.ietf.org/doc/html/rfc7662#section-2.1 rfc7662}
-     */
-    protected introspect(credentials: OAuthClientCredentials, { token }: OAuthTokenIdentification): Promise<OAuthIntrospectionResponse>;
-    protected authenticateToken(tokenType: OAuthTokenType, token: OAuthAccessToken, dpopJkt: string | null, verifyOptions?: VerifyTokenClaimsOptions): Promise<import("./token/verify-token-claims.js").VerifyTokenClaimsResult>;
-    /**
-     * @returns An http request handler that can be used with node's http server
-     * or as a middleware with express / connect.
-     */
-    httpHandler<T = void, Req extends IncomingMessage = IncomingMessage, Res extends ServerResponse = ServerResponse>(options?: RouterOptions<Req, Res>): Handler<T, Req, Res>;
-    buildRouter<T = void, Req extends IncomingMessage = IncomingMessage, Res extends ServerResponse = ServerResponse>(options?: RouterOptions<Req, Res>): Router<T, Req, Res>;
+    revoke(credentials: OAuthClientCredentials, { token }: OAuthTokenIdentification): Promise<void>;
+    protected verifyToken(tokenType: OAuthTokenType, token: OAuthAccessToken, dpopJkt: string | null, verifyOptions?: VerifyTokenClaimsOptions): Promise<VerifyTokenClaimsResult>;
 }
 //# sourceMappingURL=oauth-provider.d.ts.map