@atproto/oauth-types 0.1.3 → 0.1.5

package/dist/oauth-authorization-request-query.d.ts

@@ -0,0 +1,128 @@
+import { z } from 'zod';
+export declare const oauthAuthorizationRequestQuerySchema: z.ZodUnion<[z.ZodObject<{
+    client_id: z.ZodString;
+    state: z.ZodOptional<z.ZodString>;
+    redirect_uri: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    response_type: z.ZodEnum<["code", "token", "none", "code id_token token", "code id_token", "code token", "id_token token", "id_token"]>;
+    code_challenge: z.ZodOptional<z.ZodString>;
+    code_challenge_method: z.ZodOptional<z.ZodDefault<z.ZodEnum<["S256", "plain"]>>>;
+    dpop_jkt: z.ZodOptional<z.ZodString>;
+    response_mode: z.ZodOptional<z.ZodEnum<["query", "fragment", "form_post"]>>;
+    nonce: z.ZodOptional<z.ZodString>;
+    max_age: z.ZodOptional<z.ZodNumber>;
+    claims: z.ZodOptional<z.ZodRecord<z.ZodEnum<["userinfo", "id_token"]>, z.ZodRecord<z.ZodEnum<["auth_time", "nonce", "acr", "name", "family_name", "given_name", "middle_name", "nickname", "preferred_username", "gender", "picture", "profile", "website", "birthdate", "zoneinfo", "locale", "updated_at", "email", "email_verified", "phone_number", "phone_number_verified", "address"]>, z.ZodUnion<[z.ZodLiteral<null>, z.ZodObject<{
+        essential: z.ZodOptional<z.ZodBoolean>;
+        value: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        values: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        values?: (string | number | boolean)[] | undefined;
+        value?: string | number | boolean | undefined;
+        essential?: boolean | undefined;
+    }, {
+        values?: (string | number | boolean)[] | undefined;
+        value?: string | number | boolean | undefined;
+        essential?: boolean | undefined;
+    }>]>>>>;
+    login_hint: z.ZodOptional<z.ZodString>;
+    ui_locales: z.ZodOptional<z.ZodString>;
+    id_token_hint: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, `${string}.${string}.${string}`, string>>;
+    display: z.ZodOptional<z.ZodEnum<["page", "popup", "touch"]>>;
+    prompt: z.ZodOptional<z.ZodEnum<["none", "login", "consent", "select_account"]>>;
+    authorization_details: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+        locations: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        actions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        datatypes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        identifier: z.ZodOptional<z.ZodString>;
+        privileges: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        type: string;
+        locations?: string[] | undefined;
+        actions?: string[] | undefined;
+        datatypes?: string[] | undefined;
+        identifier?: string | undefined;
+        privileges?: string[] | undefined;
+    }, {
+        type: string;
+        locations?: string[] | undefined;
+        actions?: string[] | undefined;
+        datatypes?: string[] | undefined;
+        identifier?: string | undefined;
+        privileges?: string[] | undefined;
+    }>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    client_id: string;
+    response_type: "code" | "none" | "token" | "code id_token token" | "code id_token" | "code token" | "id_token token" | "id_token";
+    redirect_uri?: string | undefined;
+    scope?: string | undefined;
+    nonce?: string | undefined;
+    state?: string | undefined;
+    code_challenge?: string | undefined;
+    code_challenge_method?: "S256" | "plain" | undefined;
+    dpop_jkt?: string | undefined;
+    response_mode?: "query" | "fragment" | "form_post" | undefined;
+    max_age?: number | undefined;
+    claims?: Partial<Record<"id_token" | "userinfo", Partial<Record<"auth_time" | "nonce" | "acr" | "name" | "family_name" | "given_name" | "middle_name" | "nickname" | "preferred_username" | "gender" | "picture" | "profile" | "website" | "birthdate" | "zoneinfo" | "locale" | "updated_at" | "email" | "email_verified" | "phone_number" | "phone_number_verified" | "address", {
+        values?: (string | number | boolean)[] | undefined;
+        value?: string | number | boolean | undefined;
+        essential?: boolean | undefined;
+    } | null>>>> | undefined;
+    login_hint?: string | undefined;
+    ui_locales?: string | undefined;
+    id_token_hint?: `${string}.${string}.${string}` | undefined;
+    display?: "page" | "popup" | "touch" | undefined;
+    prompt?: "none" | "login" | "consent" | "select_account" | undefined;
+    authorization_details?: {
+        type: string;
+        locations?: string[] | undefined;
+        actions?: string[] | undefined;
+        datatypes?: string[] | undefined;
+        identifier?: string | undefined;
+        privileges?: string[] | undefined;
+    }[] | undefined;
+}, {
+    client_id: string;
+    response_type: "code" | "none" | "token" | "code id_token token" | "code id_token" | "code token" | "id_token token" | "id_token";
+    redirect_uri?: string | undefined;
+    scope?: string | undefined;
+    nonce?: string | undefined;
+    state?: string | undefined;
+    code_challenge?: string | undefined;
+    code_challenge_method?: "S256" | "plain" | undefined;
+    dpop_jkt?: string | undefined;
+    response_mode?: "query" | "fragment" | "form_post" | undefined;
+    max_age?: number | undefined;
+    claims?: Partial<Record<"id_token" | "userinfo", Partial<Record<"auth_time" | "nonce" | "acr" | "name" | "family_name" | "given_name" | "middle_name" | "nickname" | "preferred_username" | "gender" | "picture" | "profile" | "website" | "birthdate" | "zoneinfo" | "locale" | "updated_at" | "email" | "email_verified" | "phone_number" | "phone_number_verified" | "address", {
+        values?: (string | number | boolean)[] | undefined;
+        value?: string | number | boolean | undefined;
+        essential?: boolean | undefined;
+    } | null>>>> | undefined;
+    login_hint?: string | undefined;
+    ui_locales?: string | undefined;
+    id_token_hint?: string | undefined;
+    display?: "page" | "popup" | "touch" | undefined;
+    prompt?: "none" | "login" | "consent" | "select_account" | undefined;
+    authorization_details?: {
+        type: string;
+        locations?: string[] | undefined;
+        actions?: string[] | undefined;
+        datatypes?: string[] | undefined;
+        identifier?: string | undefined;
+        privileges?: string[] | undefined;
+    }[] | undefined;
+}>, z.ZodObject<{
+    request: z.ZodUnion<[z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, `${string}.${string}.${string}`, string>, z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, `${string}.${string}`, string>]>;
+}, "strip", z.ZodTypeAny, {
+    request: `${string}.${string}.${string}` | `${string}.${string}`;
+}, {
+    request: string;
+}>, z.ZodObject<{
+    request_uri: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    request_uri: string;
+}, {
+    request_uri: string;
+}>]>;
+export type OAuthAuthorizationRequestQuery = z.infer<typeof oauthAuthorizationRequestQuerySchema>;
+//# sourceMappingURL=oauth-authorization-request-query.d.ts.map

package/dist/oauth-authorization-request-query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-authorization-request-query.d.ts","sourceRoot":"","sources":["../src/oauth-authorization-request-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAI/C,CAAA;AAEF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAClD,OAAO,oCAAoC,CAC5C,CAAA"}

package/dist/oauth-authorization-request-query.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthAuthorizationRequestQuerySchema = void 0;
+const zod_1 = require("zod");
+const oauth_authorization_request_jar_js_1 = require("./oauth-authorization-request-jar.js");
+const oauth_authorization_request_parameters_js_1 = require("./oauth-authorization-request-parameters.js");
+const oauth_authorization_request_uri_js_1 = require("./oauth-authorization-request-uri.js");
+exports.oauthAuthorizationRequestQuerySchema = zod_1.z.union([
+    oauth_authorization_request_parameters_js_1.oauthAuthorizationRequestParametersSchema,
+    oauth_authorization_request_jar_js_1.oauthAuthorizationRequestJarSchema,
+    oauth_authorization_request_uri_js_1.oauthAuthorizationRequestUriSchema,
+]);
+//# sourceMappingURL=oauth-authorization-request-query.js.map

package/dist/oauth-authorization-request-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-authorization-request-query.js","sourceRoot":"","sources":["../src/oauth-authorization-request-query.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AAEvB,6FAAyF;AACzF,2GAAuG;AACvG,6FAAyF;AAE5E,QAAA,oCAAoC,GAAG,OAAC,CAAC,KAAK,CAAC;IAC1D,qFAAyC;IACzC,uEAAkC;IAClC,uEAAkC;CACnC,CAAC,CAAA"}

package/dist/oauth-authorization-request-uri.d.ts

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+export declare const oauthAuthorizationRequestUriSchema: z.ZodObject<{
+    request_uri: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    request_uri: string;
+}, {
+    request_uri: string;
+}>;
+export type OAuthAuthorizationRequestUri = z.infer<typeof oauthAuthorizationRequestUriSchema>;
+//# sourceMappingURL=oauth-authorization-request-uri.d.ts.map

package/dist/oauth-authorization-request-uri.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-authorization-request-uri.d.ts","sourceRoot":"","sources":["../src/oauth-authorization-request-uri.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,eAAO,MAAM,kCAAkC;;;;;;EAE7C,CAAA;AAEF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAA"}

package/dist/oauth-authorization-request-uri.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthAuthorizationRequestUriSchema = void 0;
+const zod_1 = require("zod");
+const oauth_request_uri_js_1 = require("./oauth-request-uri.js");
+exports.oauthAuthorizationRequestUriSchema = zod_1.z.object({
+    request_uri: oauth_request_uri_js_1.oauthRequestUriSchema,
+});
+//# sourceMappingURL=oauth-authorization-request-uri.js.map

package/dist/oauth-authorization-request-uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-authorization-request-uri.js","sourceRoot":"","sources":["../src/oauth-authorization-request-uri.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AAEvB,iEAA8D;AAEjD,QAAA,kCAAkC,GAAG,OAAC,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,4CAAqB;CACnC,CAAC,CAAA"}

package/dist/oauth-authorization-server-metadata.d.ts

@@ -15,7 +15,7 @@ export declare const oauthAuthorizationServerMetadataSchema: z.ZodObject<{
     response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodEnum<["S256", "plain"]>, "many">>;
     ui_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     id_token_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     display_values_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -55,7 +55,7 @@ export declare const oauthAuthorizationServerMetadataSchema: z.ZodObject<{
     response_types_supported?: string[] | undefined;
     response_modes_supported?: string[] | undefined;
     grant_types_supported?: string[] | undefined;
-    code_challenge_methods_supported?: string[] | undefined;
+    code_challenge_methods_supported?: ("S256" | "plain")[] | undefined;
     ui_locales_supported?: string[] | undefined;
     id_token_signing_alg_values_supported?: string[] | undefined;
     display_values_supported?: string[] | undefined;
@@ -92,7 +92,7 @@ export declare const oauthAuthorizationServerMetadataSchema: z.ZodObject<{
     response_types_supported?: string[] | undefined;
     response_modes_supported?: string[] | undefined;
     grant_types_supported?: string[] | undefined;
-    code_challenge_methods_supported?: string[] | undefined;
+    code_challenge_methods_supported?: ("S256" | "plain")[] | undefined;
     ui_locales_supported?: string[] | undefined;
     id_token_signing_alg_values_supported?: string[] | undefined;
     display_values_supported?: string[] | undefined;
@@ -128,7 +128,7 @@ export declare const oauthAuthorizationServerMetadataValidator: z.ZodEffects<z.Z
     response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodEnum<["S256", "plain"]>, "many">>;
     ui_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     id_token_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     display_values_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -168,7 +168,7 @@ export declare const oauthAuthorizationServerMetadataValidator: z.ZodEffects<z.Z
     response_types_supported?: string[] | undefined;
     response_modes_supported?: string[] | undefined;
     grant_types_supported?: string[] | undefined;
-    code_challenge_methods_supported?: string[] | undefined;
+    code_challenge_methods_supported?: ("S256" | "plain")[] | undefined;
     ui_locales_supported?: string[] | undefined;
     id_token_signing_alg_values_supported?: string[] | undefined;
     display_values_supported?: string[] | undefined;
@@ -205,7 +205,7 @@ export declare const oauthAuthorizationServerMetadataValidator: z.ZodEffects<z.Z
     response_types_supported?: string[] | undefined;
     response_modes_supported?: string[] | undefined;
     grant_types_supported?: string[] | undefined;
-    code_challenge_methods_supported?: string[] | undefined;
+    code_challenge_methods_supported?: ("S256" | "plain")[] | undefined;
     ui_locales_supported?: string[] | undefined;
     id_token_signing_alg_values_supported?: string[] | undefined;
     display_values_supported?: string[] | undefined;
@@ -242,7 +242,7 @@ export declare const oauthAuthorizationServerMetadataValidator: z.ZodEffects<z.Z
     response_types_supported?: string[] | undefined;
     response_modes_supported?: string[] | undefined;
     grant_types_supported?: string[] | undefined;
-    code_challenge_methods_supported?: string[] | undefined;
+    code_challenge_methods_supported?: ("S256" | "plain")[] | undefined;
     ui_locales_supported?: string[] | undefined;
     id_token_signing_alg_values_supported?: string[] | undefined;
     display_values_supported?: string[] | undefined;
@@ -279,7 +279,7 @@ export declare const oauthAuthorizationServerMetadataValidator: z.ZodEffects<z.Z
     response_types_supported?: string[] | undefined;
     response_modes_supported?: string[] | undefined;
     grant_types_supported?: string[] | undefined;
-    code_challenge_methods_supported?: string[] | undefined;
+    code_challenge_methods_supported?: ("S256" | "plain")[] | undefined;
     ui_locales_supported?: string[] | undefined;
     id_token_signing_alg_values_supported?: string[] | undefined;
     display_values_supported?: string[] | undefined;
@@ -316,7 +316,7 @@ export declare const oauthAuthorizationServerMetadataValidator: z.ZodEffects<z.Z
     response_types_supported?: string[] | undefined;
     response_modes_supported?: string[] | undefined;
     grant_types_supported?: string[] | undefined;
-    code_challenge_methods_supported?: string[] | undefined;
+    code_challenge_methods_supported?: ("S256" | "plain")[] | undefined;
     ui_locales_supported?: string[] | undefined;
     id_token_signing_alg_values_supported?: string[] | undefined;
     display_values_supported?: string[] | undefined;
@@ -353,7 +353,7 @@ export declare const oauthAuthorizationServerMetadataValidator: z.ZodEffects<z.Z
     response_types_supported?: string[] | undefined;
     response_modes_supported?: string[] | undefined;
     grant_types_supported?: string[] | undefined;
-    code_challenge_methods_supported?: string[] | undefined;
+    code_challenge_methods_supported?: ("S256" | "plain")[] | undefined;
     ui_locales_supported?: string[] | undefined;
     id_token_signing_alg_values_supported?: string[] | undefined;
     display_values_supported?: string[] | undefined;

package/dist/oauth-authorization-server-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-authorization-server-metadata.d.ts","sourceRoot":"","sources":["../src/oauth-authorization-server-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB;;GAEG;AACH,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwDjD,CAAA;AAEF,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAA;AAED,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBhD,CAAA"}
+{"version":3,"file":"oauth-authorization-server-metadata.d.ts","sourceRoot":"","sources":["../src/oauth-authorization-server-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB;;GAEG;AACH,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2DjD,CAAA;AAEF,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAA;AAED,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBhD,CAAA"}

package/dist/oauth-authorization-server-metadata.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.oauthAuthorizationServerMetadataValidator = exports.oauthAuthorizationServerMetadataSchema = void 0;
 const zod_1 = require("zod");
+const oauth_code_challenge_method_js_1 = require("./oauth-code-challenge-method.js");
 const oauth_issuer_identifier_js_1 = require("./oauth-issuer-identifier.js");
 /**
  * @see {@link https://datatracker.ietf.org/doc/html/rfc8414}
@@ -19,7 +20,10 @@ exports.oauthAuthorizationServerMetadataSchema = zod_1.z.object({
     response_types_supported: zod_1.z.array(zod_1.z.string()).optional(),
     response_modes_supported: zod_1.z.array(zod_1.z.string()).optional(),
     grant_types_supported: zod_1.z.array(zod_1.z.string()).optional(),
-    code_challenge_methods_supported: zod_1.z.array(zod_1.z.string()).min(1).optional(),
+    code_challenge_methods_supported: zod_1.z
+        .array(oauth_code_challenge_method_js_1.oauthCodeChallengeMethodSchema)
+        .min(1)
+        .optional(),
     ui_locales_supported: zod_1.z.array(zod_1.z.string()).optional(),
     id_token_signing_alg_values_supported: zod_1.z.array(zod_1.z.string()).optional(),
     display_values_supported: zod_1.z.array(zod_1.z.string()).optional(),

package/dist/oauth-authorization-server-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-authorization-server-metadata.js","sourceRoot":"","sources":["../src/oauth-authorization-server-metadata.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AAEvB,6EAA0E;AAE1E;;GAEG;AACU,QAAA,sCAAsC,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7D,MAAM,EAAE,wDAA2B;IAEnC,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,0BAA0B,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClD,2BAA2B,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnD,+BAA+B,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvD,gCAAgC,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,uBAAuB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,qBAAqB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,gCAAgC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvE,oBAAoB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,qCAAqC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrE,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,2CAA2C,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3E,8CAA8C,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtE,qCAAqC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrE,8CAA8C,EAAE,OAAC;SAC9C,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;IACb,8CAA8C,EAAE,OAAC;SAC9C,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;IAEb,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAErC,sBAAsB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,eAAe;IAEzD,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,eAAe;IACjD,qCAAqC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrE,gDAAgD,EAAE,OAAC;SAChD,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;IAEb,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChD,sBAAsB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnD,qCAAqC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAElE,qCAAqC,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7D,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjD,qBAAqB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAElD,4DAA4D;IAC5D,iCAAiC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjE,wFAAwF;IACxF,mBAAmB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEzD,kIAAkI;IAClI,qCAAqC,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9D,CAAC,CAAA;AAMW,QAAA,yCAAyC,GACpD,8CAAsC;KACnC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IACE,IAAI,CAAC,qCAAqC;QAC1C,CAAC,IAAI,CAAC,qCAAqC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,uGAAuG;SAC1G,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,kCAAkC;aAC5C,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA"}
+{"version":3,"file":"oauth-authorization-server-metadata.js","sourceRoot":"","sources":["../src/oauth-authorization-server-metadata.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AAEvB,qFAAiF;AACjF,6EAA0E;AAE1E;;GAEG;AACU,QAAA,sCAAsC,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7D,MAAM,EAAE,wDAA2B;IAEnC,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,0BAA0B,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClD,2BAA2B,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnD,+BAA+B,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvD,gCAAgC,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,uBAAuB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,qBAAqB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,gCAAgC,EAAE,OAAC;SAChC,KAAK,CAAC,+DAA8B,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;IACb,oBAAoB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,qCAAqC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrE,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,2CAA2C,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3E,8CAA8C,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtE,qCAAqC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrE,8CAA8C,EAAE,OAAC;SAC9C,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;IACb,8CAA8C,EAAE,OAAC;SAC9C,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;IAEb,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAErC,sBAAsB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,eAAe;IAEzD,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,eAAe;IACjD,qCAAqC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrE,gDAAgD,EAAE,OAAC;SAChD,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;IAEb,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChD,sBAAsB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnD,qCAAqC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAElE,qCAAqC,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7D,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjD,qBAAqB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAElD,4DAA4D;IAC5D,iCAAiC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjE,wFAAwF;IACxF,mBAAmB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEzD,kIAAkI;IAClI,qCAAqC,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9D,CAAC,CAAA;AAMW,QAAA,yCAAyC,GACpD,8CAAsC;KACnC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IACE,IAAI,CAAC,qCAAqC;QAC1C,CAAC,IAAI,CAAC,qCAAqC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,uGAAuG;SAC1G,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,kCAAkC;aAC5C,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA"}

package/dist/oauth-client-credentials-grant-token-request.d.ts

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+export declare const oauthClientCredentialsGrantTokenRequestSchema: z.ZodObject<{
+    grant_type: z.ZodLiteral<"client_credentials">;
+}, "strip", z.ZodTypeAny, {
+    grant_type: "client_credentials";
+}, {
+    grant_type: "client_credentials";
+}>;
+export type OAuthClientCredentialsGrantTokenRequest = z.infer<typeof oauthClientCredentialsGrantTokenRequestSchema>;
+//# sourceMappingURL=oauth-client-credentials-grant-token-request.d.ts.map

package/dist/oauth-client-credentials-grant-token-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client-credentials-grant-token-request.d.ts","sourceRoot":"","sources":["../src/oauth-client-credentials-grant-token-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,6CAA6C;;;;;;EAExD,CAAA;AAEF,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAC3D,OAAO,6CAA6C,CACrD,CAAA"}

package/dist/oauth-client-credentials-grant-token-request.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthClientCredentialsGrantTokenRequestSchema = void 0;
+const zod_1 = require("zod");
+exports.oauthClientCredentialsGrantTokenRequestSchema = zod_1.z.object({
+    grant_type: zod_1.z.literal('client_credentials'),
+});
+//# sourceMappingURL=oauth-client-credentials-grant-token-request.js.map

package/dist/oauth-client-credentials-grant-token-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client-credentials-grant-token-request.js","sourceRoot":"","sources":["../src/oauth-client-credentials-grant-token-request.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AAEV,QAAA,6CAA6C,GAAG,OAAC,CAAC,MAAM,CAAC;IACpE,UAAU,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;CAC5C,CAAC,CAAA"}

package/dist/oauth-client-credentials.d.ts

@@ -9,7 +9,7 @@ export declare const oauthClientCredentialsJwtBearerSchema: z.ZodObject<{
      * - The JWT MAY contain a "jti" (JWT ID) claim that provides a unique identifier for the token.
      * - Note that the authorization server may reject JWTs with an "exp" claim value that is unreasonably far in the future.
      *
-     * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-jwt-bearer-11#section-3}
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc7523#section-3}
      */
     client_assertion: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, `${string}.${string}.${string}`, string>;
 }, "strip", z.ZodTypeAny, {
@@ -21,6 +21,7 @@ export declare const oauthClientCredentialsJwtBearerSchema: z.ZodObject<{
     client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
     client_assertion: string;
 }>;
+export type OAuthClientCredentialsJwtBearer = z.infer<typeof oauthClientCredentialsJwtBearerSchema>;
 export declare const oauthClientCredentialsSecretPostSchema: z.ZodObject<{
     client_id: z.ZodString;
     client_secret: z.ZodString;
@@ -31,6 +32,15 @@ export declare const oauthClientCredentialsSecretPostSchema: z.ZodObject<{
     client_id: string;
     client_secret: string;
 }>;
+export type OAuthClientCredentialsSecretPost = z.infer<typeof oauthClientCredentialsSecretPostSchema>;
+export declare const oauthClientCredentialsNoneSchema: z.ZodObject<{
+    client_id: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    client_id: string;
+}, {
+    client_id: string;
+}>;
+export type OAuthClientCredentialsNone = z.infer<typeof oauthClientCredentialsNoneSchema>;
 export declare const oauthClientCredentialsSchema: z.ZodUnion<[z.ZodObject<{
     client_id: z.ZodString;
     client_assertion_type: z.ZodLiteral<"urn:ietf:params:oauth:client-assertion-type:jwt-bearer">;
@@ -41,7 +51,7 @@ export declare const oauthClientCredentialsSchema: z.ZodUnion<[z.ZodObject<{
      * - The JWT MAY contain a "jti" (JWT ID) claim that provides a unique identifier for the token.
      * - Note that the authorization server may reject JWTs with an "exp" claim value that is unreasonably far in the future.
      *
-     * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-jwt-bearer-11#section-3}
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc7523#section-3}
      */
     client_assertion: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, `${string}.${string}.${string}`, string>;
 }, "strip", z.ZodTypeAny, {
@@ -61,6 +71,12 @@ export declare const oauthClientCredentialsSchema: z.ZodUnion<[z.ZodObject<{
 }, {
     client_id: string;
     client_secret: string;
+}>, z.ZodObject<{
+    client_id: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    client_id: string;
+}, {
+    client_id: string;
 }>]>;
 export type OAuthClientCredentials = z.infer<typeof oauthClientCredentialsSchema>;
 //# sourceMappingURL=oauth-client-credentials.d.ts.map

package/dist/oauth-client-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client-credentials.d.ts","sourceRoot":"","sources":["../src/oauth-client-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,eAAO,MAAM,qCAAqC;;;IAGhD;;;;;;;;OAQG;;;;;;;;;;EAEH,CAAA;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;EAGjD,CAAA;AAEF,eAAO,MAAM,4BAA4B;;;IAjBvC;;;;;;;;OAQG;;;;;;;;;;;;;;;;;;;IAYH,CAAA;AAEF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA"}
+{"version":3,"file":"oauth-client-credentials.d.ts","sourceRoot":"","sources":["../src/oauth-client-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,eAAO,MAAM,qCAAqC;;;IAGhD;;;;;;;;OAQG;;;;;;;;;;EAEH,CAAA;AAEF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CACnD,OAAO,qCAAqC,CAC7C,CAAA;AAED,eAAO,MAAM,sCAAsC;;;;;;;;;EAGjD,CAAA;AAEF,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAA;AAED,eAAO,MAAM,gCAAgC;;;;;;EAE3C,CAAA;AAEF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAA;AAID,eAAO,MAAM,4BAA4B;;;IAnCvC;;;;;;;;OAQG;;;;;;;;;;;;;;;;;;;;;;;;;IAgCH,CAAA;AAEF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAA"}

package/dist/oauth-client-credentials.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.oauthClientCredentialsSchema = exports.oauthClientCredentialsSecretPostSchema = exports.oauthClientCredentialsJwtBearerSchema = void 0;
+exports.oauthClientCredentialsSchema = exports.oauthClientCredentialsNoneSchema = exports.oauthClientCredentialsSecretPostSchema = exports.oauthClientCredentialsJwtBearerSchema = void 0;
 const zod_1 = require("zod");
 const jwk_1 = require("@atproto/jwk");
 const oauth_client_id_js_1 = require("./oauth-client-id.js");
@@ -15,7 +15,7 @@ exports.oauthClientCredentialsJwtBearerSchema = zod_1.z.object({
      * - The JWT MAY contain a "jti" (JWT ID) claim that provides a unique identifier for the token.
      * - Note that the authorization server may reject JWTs with an "exp" claim value that is unreasonably far in the future.
      *
-     * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-jwt-bearer-11#section-3}
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc7523#section-3}
      */
     client_assertion: jwk_1.signedJwtSchema,
 });
@@ -23,8 +23,14 @@ exports.oauthClientCredentialsSecretPostSchema = zod_1.z.object({
     client_id: oauth_client_id_js_1.oauthClientIdSchema,
     client_secret: zod_1.z.string(),
 });
+exports.oauthClientCredentialsNoneSchema = zod_1.z.object({
+    client_id: oauth_client_id_js_1.oauthClientIdSchema,
+});
+//
 exports.oauthClientCredentialsSchema = zod_1.z.union([
     exports.oauthClientCredentialsJwtBearerSchema,
     exports.oauthClientCredentialsSecretPostSchema,
+    // Must be last since it is less specific
+    exports.oauthClientCredentialsNoneSchema,
 ]);
 //# sourceMappingURL=oauth-client-credentials.js.map

package/dist/oauth-client-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client-credentials.js","sourceRoot":"","sources":["../src/oauth-client-credentials.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,sCAA8C;AAE9C,6DAA0D;AAC1D,iDAAiE;AAEpD,QAAA,qCAAqC,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,wCAAmB;IAC9B,qBAAqB,EAAE,OAAC,CAAC,OAAO,CAAC,+CAAgC,CAAC;IAClE;;;;;;;;OAQG;IACH,gBAAgB,EAAE,qBAAe;CAClC,CAAC,CAAA;AAEW,QAAA,sCAAsC,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7D,SAAS,EAAE,wCAAmB;IAC9B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE;CAC1B,CAAC,CAAA;AAEW,QAAA,4BAA4B,GAAG,OAAC,CAAC,KAAK,CAAC;IAClD,6CAAqC;IACrC,8CAAsC;CACvC,CAAC,CAAA"}
+{"version":3,"file":"oauth-client-credentials.js","sourceRoot":"","sources":["../src/oauth-client-credentials.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,sCAA8C;AAE9C,6DAA0D;AAC1D,iDAAiE;AAEpD,QAAA,qCAAqC,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,wCAAmB;IAC9B,qBAAqB,EAAE,OAAC,CAAC,OAAO,CAAC,+CAAgC,CAAC;IAClE;;;;;;;;OAQG;IACH,gBAAgB,EAAE,qBAAe;CAClC,CAAC,CAAA;AAMW,QAAA,sCAAsC,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7D,SAAS,EAAE,wCAAmB;IAC9B,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE;CAC1B,CAAC,CAAA;AAMW,QAAA,gCAAgC,GAAG,OAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,wCAAmB;CAC/B,CAAC,CAAA;AAMF,EAAE;AAEW,QAAA,4BAA4B,GAAG,OAAC,CAAC,KAAK,CAAC;IAClD,6CAAqC;IACrC,8CAAsC;IACtC,yCAAyC;IACzC,wCAAgC;CACjC,CAAC,CAAA"}

package/dist/oauth-client-id-discoverable.d.ts

@@ -3,6 +3,7 @@ import { OAuthClientId } from './oauth-client-id.js';
  * @see {@link https://drafts.aaronpk.com/draft-parecki-oauth-client-id-metadata-document/draft-parecki-oauth-client-id-metadata-document.html}
  */
 export type OAuthClientIdDiscoverable = OAuthClientId & `https://${string}`;
-export declare function isOAuthClientIdDiscoverable<C extends OAuthClientId>(clientId: C): clientId is C & OAuthClientIdDiscoverable;
-export declare function parseOAuthDiscoverableClientId(clientId: OAuthClientId): URL;
+export declare function isOAuthClientIdDiscoverable(clientId: string): clientId is OAuthClientIdDiscoverable;
+export declare function assertOAuthDiscoverableClientId(value: string): asserts value is OAuthClientIdDiscoverable;
+export declare function parseOAuthDiscoverableClientId(clientId: string): URL;
 //# sourceMappingURL=oauth-client-id-discoverable.d.ts.map

package/dist/oauth-client-id-discoverable.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client-id-discoverable.d.ts","sourceRoot":"","sources":["../src/oauth-client-id-discoverable.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGpD;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,aAAa,GAAG,WAAW,MAAM,EAAE,CAAA;AAE3E,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,aAAa,EACjE,QAAQ,EAAE,CAAC,GACV,QAAQ,IAAI,CAAC,GAAG,yBAAyB,CAO3C;AAED,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,aAAa,GAAG,GAAG,CA6C3E"}
+{"version":3,"file":"oauth-client-id-discoverable.d.ts","sourceRoot":"","sources":["../src/oauth-client-id-discoverable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGpD;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,aAAa,GAAG,WAAW,MAAM,EAAE,CAAA;AAE3E,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,GACf,QAAQ,IAAI,yBAAyB,CAOvC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,IAAI,yBAAyB,CAE5C;AAED,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CA2CpE"}

package/dist/oauth-client-id-discoverable.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseOAuthDiscoverableClientId = exports.isOAuthClientIdDiscoverable = void 0;
-const oauth_client_id_url_js_1 = require("./oauth-client-id-url.js");
+exports.parseOAuthDiscoverableClientId = exports.assertOAuthDiscoverableClientId = exports.isOAuthClientIdDiscoverable = void 0;
 const util_js_1 = require("./util.js");
 function isOAuthClientIdDiscoverable(clientId) {
     try {
@@ -13,34 +12,38 @@ function isOAuthClientIdDiscoverable(clientId) {
     }
 }
 exports.isOAuthClientIdDiscoverable = isOAuthClientIdDiscoverable;
+function assertOAuthDiscoverableClientId(value) {
+    void parseOAuthDiscoverableClientId(value);
+}
+exports.assertOAuthDiscoverableClientId = assertOAuthDiscoverableClientId;
 function parseOAuthDiscoverableClientId(clientId) {
-    const url = (0, oauth_client_id_url_js_1.parseOAuthClientIdUrl)(clientId);
-    // Optimization: cheap checks first
-    if (url.hostname === 'localhost') {
-        throw new TypeError('ClientID must not be a loopback hostname');
-    }
+    const url = new URL(clientId);
     if (url.protocol !== 'https:') {
         throw new TypeError('ClientID must use the "https:" protocol');
     }
+    if (url.username || url.password) {
+        throw new TypeError('ClientID must not contain credentials');
+    }
     if (url.hash) {
         throw new TypeError('ClientID must not contain a fragment');
     }
-    if (url.username || url.password) {
-        throw new TypeError('ClientID must not contain credentials');
+    if (url.hostname === 'localhost') {
+        throw new TypeError('ClientID hostname must not be "localhost"');
     }
     if (url.pathname === '/') {
-        throw new TypeError('ClientID must contain a path (e.g. "/client-metadata")');
+        throw new TypeError('ClientID must contain a path component (e.g. "/client-metadata.json")');
     }
-    if (url.pathname !== '/' && url.pathname.endsWith('/')) {
-        throw new TypeError('ClientID must not end with a trailing slash');
+    if (url.pathname.endsWith('/')) {
+        throw new TypeError('ClientID path must not end with a trailing slash');
     }
-    if (url.pathname.includes('//')) {
-        throw new TypeError(`ClientID must not contain any double slashes in its path`);
+    if ((0, util_js_1.isHostnameIP)(url.hostname)) {
+        throw new TypeError('ClientID hostname must not be an IP address');
     }
-    // Note: Query string is allowed
-    // Note: no restriction on the port for non-loopback URIs
-    if ((0, util_js_1.isIP)(url.hostname)) {
-        throw new TypeError('ClientID must not be an IP address');
+    // URL constructor normalizes the URL, so we extract the path manually to
+    // avoid normalization, then compare it to the normalized path to ensure
+    // that the URL does not contain path traversal or other unexpected characters
+    if ((0, util_js_1.extractUrlPath)(clientId) !== url.pathname) {
+        throw new TypeError(`ClientID must be in canonical form ("${url.href}", got "${clientId}")`);
     }
     return url;
 }

package/dist/oauth-client-id-discoverable.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client-id-discoverable.js","sourceRoot":"","sources":["../src/oauth-client-id-discoverable.ts"],"names":[],"mappings":";;;AAAA,qEAAgE;AAEhE,uCAAgC;AAOhC,SAAgB,2BAA2B,CACzC,QAAW;IAEX,IAAI,CAAC;QACH,8BAA8B,CAAC,QAAQ,CAAC,CAAA;QACxC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AATD,kEASC;AAED,SAAgB,8BAA8B,CAAC,QAAuB;IACpE,MAAM,GAAG,GAAG,IAAA,8CAAqB,EAAC,QAAQ,CAAC,CAAA;IAE3C,mCAAmC;IAEnC,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAA;IAChE,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CACjB,wDAAwD,CACzD,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAA;IACpE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CACjB,0DAA0D,CAC3D,CAAA;IACH,CAAC;IAED,gCAAgC;IAChC,yDAAyD;IAEzD,IAAI,IAAA,cAAI,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAA;IAC3D,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AA7CD,wEA6CC"}
+{"version":3,"file":"oauth-client-id-discoverable.js","sourceRoot":"","sources":["../src/oauth-client-id-discoverable.ts"],"names":[],"mappings":";;;AACA,uCAAwD;AAOxD,SAAgB,2BAA2B,CACzC,QAAgB;IAEhB,IAAI,CAAC;QACH,8BAA8B,CAAC,QAAQ,CAAC,CAAA;QACxC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AATD,kEASC;AAED,SAAgB,+BAA+B,CAC7C,KAAa;IAEb,KAAK,8BAA8B,CAAC,KAAK,CAAC,CAAA;AAC5C,CAAC;AAJD,0EAIC;AAED,SAAgB,8BAA8B,CAAC,QAAgB;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE7B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAA;IAChE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CACjB,uEAAuE,CACxE,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAA;IACzE,CAAC;IAED,IAAI,IAAA,sBAAY,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAA;IACpE,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,8EAA8E;IAC9E,IAAI,IAAA,wBAAc,EAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,wCAAwC,GAAG,CAAC,IAAI,WAAW,QAAQ,IAAI,CACxE,CAAA;IACH,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AA3CD,wEA2CC"}

package/dist/oauth-client-id-loopback.d.ts

@@ -1,5 +1,12 @@
 import { OAuthClientId } from './oauth-client-id.js';
-export type OAuthClientIdLoopback = OAuthClientId & `http://localhost${'' | `${'/' | '?' | '#'}${string}`}`;
-export declare function isOAuthClientIdLoopback<C extends OAuthClientId>(clientId: C): clientId is C & OAuthClientIdLoopback;
-export declare function parseOAuthLoopbackClientId(clientId: OAuthClientId): URL;
+import { OAuthScope } from './oauth-scope.js';
+declare const OAUTH_CLIENT_ID_LOOPBACK_URL = "http://localhost";
+export type OAuthClientIdLoopback = OAuthClientId & `${typeof OAUTH_CLIENT_ID_LOOPBACK_URL}${'' | '/'}${'' | `?${string}`}`;
+export declare function isOAuthClientIdLoopback(clientId: string): clientId is OAuthClientIdLoopback;
+export declare function assertOAuthLoopbackClientId(clientId: string): asserts clientId is OAuthClientIdLoopback;
+export declare function parseOAuthLoopbackClientId(clientId: string): {
+    scope?: OAuthScope;
+    redirect_uris?: [string, ...string[]];
+};
+export {};
 //# sourceMappingURL=oauth-client-id-loopback.d.ts.map

package/dist/oauth-client-id-loopback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client-id-loopback.d.ts","sourceRoot":"","sources":["../src/oauth-client-id-loopback.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAC/C,mBAAmB,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,MAAM,EAAE,EAAE,CAAA;AAEzD,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,aAAa,EAC7D,QAAQ,EAAE,CAAC,GACV,QAAQ,IAAI,CAAC,GAAG,qBAAqB,CAOvC;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,aAAa,GAAG,GAAG,CAwCvE"}
+{"version":3,"file":"oauth-client-id-loopback.d.ts","sourceRoot":"","sources":["../src/oauth-client-id-loopback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAA;AAG/D,QAAA,MAAM,4BAA4B,qBAAqB,CAAA;AAEvD,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAC/C,GAAG,OAAO,4BAA4B,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE,EAAE,CAAA;AAEzE,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,GACf,QAAQ,IAAI,qBAAqB,CAOnC;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,IAAI,qBAAqB,CAE3C;AAID,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAC5D,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;CACtC,CA0EA"}