@atproto/oauth-types 0.4.2 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @atproto/oauth-types
 
+## 0.5.0
+
+### Minor Changes
+
+- [#4289](https://github.com/bluesky-social/atproto/pull/4289) [`8ff5ec4ca`](https://github.com/bluesky-social/atproto/commit/8ff5ec4caa9a1f5c1e453a416ba2af22d1ee4f58) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Remove exported `oauthHttpsRedirectURISchema` and `oauthPrivateUseRedirectURISchema` in favor of `oauthRedirectUriSchema` and `oauthLoopbackClientRedirectUriSchema`, which provide semantically meaningful groupings of redirect URIs based on OAuth client types.
+
+  `oauthHttpsRedirectURISchema` can still be accessed using `httpsUriSchema`.
+  `oauthPrivateUseRedirectURISchema` can still be accessed using `privateUseUriSchema`.
+
+- [#4289](https://github.com/bluesky-social/atproto/pull/4289) [`8ff5ec4ca`](https://github.com/bluesky-social/atproto/commit/8ff5ec4caa9a1f5c1e453a416ba2af22d1ee4f58) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Remove unused `isLoopbackUrl` utility
+
+### Patch Changes
+
+- [#4289](https://github.com/bluesky-social/atproto/pull/4289) [`8ff5ec4ca`](https://github.com/bluesky-social/atproto/commit/8ff5ec4caa9a1f5c1e453a416ba2af22d1ee4f58) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Enforce stronger validation of `privateUseUriSchema`
+
 ## 0.4.2
 
 ### Patch Changes

package/dist/atproto-loopback-client-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"atproto-loopback-client-id.d.ts","sourceRoot":"","sources":["../src/atproto-loopback-client-id.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EAIlB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEL,qBAAqB,EAEtB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,wBAAwB,EAEzB,MAAM,yBAAyB,CAAA;AAGhC,MAAM,MAAM,2BAA2B,GAAG;IACxC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CACjC,CAAA;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,CAAC,EAAE,2BAA2B,GACnC,qBAAqB,CA4BvB;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,KAAK,EAAE,iBAAiB,CAAA;IACxB,aAAa,EAAE,CAAC,wBAAwB,EAAE,GAAG,wBAAwB,EAAE,CAAC,CAAA;CACzE,CAAA;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,GACf,6BAA6B,CAY/B"}
+{"version":3,"file":"atproto-loopback-client-id.d.ts","sourceRoot":"","sources":["../src/atproto-loopback-client-id.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EAIlB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEL,qBAAqB,EAEtB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,wBAAwB,EAEzB,MAAM,yBAAyB,CAAA;AAGhC,MAAM,MAAM,2BAA2B,GAAG;IACxC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CACjC,CAAA;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,CAAC,EAAE,2BAA2B,GACnC,qBAAqB,CA+BvB;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,KAAK,EAAE,iBAAiB,CAAA;IACxB,aAAa,EAAE,CAAC,wBAAwB,EAAE,GAAG,wBAAwB,EAAE,CAAC,CAAA;CACzE,CAAA;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,GACf,6BAA6B,CAY/B"}

package/dist/atproto-loopback-client-id.js

@@ -21,7 +21,7 @@ function buildAtprotoLoopbackClientId(config) {
                 throw new TypeError(`Unexpected empty "redirect_uris" config`);
             }
             for (const uri of redirectUris) {
-                params.append('redirect_uri', oauth_redirect_uri_js_1.oauthLoopbackRedirectURISchema.parse(uri));
+                params.append('redirect_uri', oauth_redirect_uri_js_1.oauthLoopbackClientRedirectUriSchema.parse(uri));
             }
         }
         if (params.size) {

package/dist/atproto-loopback-client-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"atproto-loopback-client-id.js","sourceRoot":"","sources":["../src/atproto-loopback-client-id.ts"],"names":[],"mappings":";;AAuBA,oEA8BC;AAOD,oEAcC;AA1ED,yGAAkG;AAClG,qEAKiC;AACjC,+EAIsC;AACtC,mEAGgC;AAChC,uCAAoD;AAOpD,SAAgB,4BAA4B,CAC1C,MAAoC;IAEpC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QAEpC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAA;QACxB,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,oDAA2B,EAAE,CAAC;YAC3D,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAA,4CAAmB,EAAC,KAAK,CAAC,CAAC,CAAA;QACjD,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,iBAAO,EAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QAClD,IACE,YAAY;YACZ,CAAC,IAAA,yBAAe,EAAC,YAAY,EAAE,gFAAqC,CAAC,EACrE,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAA;YAChE,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC/B,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,sDAA8B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAC1E,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,GAAG,uDAAyB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,uDAAyB,CAAA;AAClC,CAAC;AAOD,SAAgB,4BAA4B,CAC1C,QAAgB;IAEhB,MAAM,EAAE,KAAK,GAAG,oDAA2B,EAAE,aAAa,EAAE,GAC1D,IAAA,wDAA0B,EAAC,QAAQ,CAAC,CAAA;IACtC,IAAI,CAAC,IAAA,4CAAmB,EAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CACjB,wDAAwD,CACzD,CAAA;IACH,CAAC;IACD,OAAO;QACL,KAAK;QACL,aAAa,EAAE,aAAa,IAAI,CAAC,GAAG,gFAAqC,CAAC;KAC3E,CAAA;AACH,CAAC","sourcesContent":["import { DEFAULT_LOOPBACK_CLIENT_REDIRECT_URIS } from './atproto-loopback-client-redirect-uris.js'\nimport {\n  AtprotoOAuthScope,\n  DEFAULT_ATPROTO_OAUTH_SCOPE,\n  asAtprotoOAuthScope,\n  isAtprotoOAuthScope,\n} from './atproto-oauth-scope.js'\nimport {\n  LOOPBACK_CLIENT_ID_ORIGIN,\n  OAuthClientIdLoopback,\n  parseOAuthLoopbackClientId,\n} from './oauth-client-id-loopback.js'\nimport {\n  OAuthLoopbackRedirectURI,\n  oauthLoopbackRedirectURISchema,\n} from './oauth-redirect-uri.js'\nimport { arrayEquivalent, asArray } from './util.js'\n\nexport type OAuthLoopbackClientIdConfig = {\n  scope?: string\n  redirect_uris?: Iterable<string>\n}\n\nexport function buildAtprotoLoopbackClientId(\n  config?: OAuthLoopbackClientIdConfig,\n): OAuthClientIdLoopback {\n  if (config) {\n    const params = new URLSearchParams()\n\n    const { scope } = config\n    if (scope != null && scope !== DEFAULT_ATPROTO_OAUTH_SCOPE) {\n      params.set('scope', asAtprotoOAuthScope(scope))\n    }\n\n    const redirectUris = asArray(config.redirect_uris)\n    if (\n      redirectUris &&\n      !arrayEquivalent(redirectUris, DEFAULT_LOOPBACK_CLIENT_REDIRECT_URIS)\n    ) {\n      if (!redirectUris.length) {\n        throw new TypeError(`Unexpected empty \"redirect_uris\" config`)\n      }\n      for (const uri of redirectUris) {\n        params.append('redirect_uri', oauthLoopbackRedirectURISchema.parse(uri))\n      }\n    }\n\n    if (params.size) {\n      return `${LOOPBACK_CLIENT_ID_ORIGIN}?${params.toString()}`\n    }\n  }\n\n  return LOOPBACK_CLIENT_ID_ORIGIN\n}\n\nexport type AtprotoLoopbackClientIdParams = {\n  scope: AtprotoOAuthScope\n  redirect_uris: [OAuthLoopbackRedirectURI, ...OAuthLoopbackRedirectURI[]]\n}\n\nexport function parseAtprotoLoopbackClientId(\n  clientId: string,\n): AtprotoLoopbackClientIdParams {\n  const { scope = DEFAULT_ATPROTO_OAUTH_SCOPE, redirect_uris } =\n    parseOAuthLoopbackClientId(clientId)\n  if (!isAtprotoOAuthScope(scope)) {\n    throw new TypeError(\n      'ATProto Loopback ClientID must include \"atproto\" scope',\n    )\n  }\n  return {\n    scope,\n    redirect_uris: redirect_uris ?? [...DEFAULT_LOOPBACK_CLIENT_REDIRECT_URIS],\n  }\n}\n"]}
+{"version":3,"file":"atproto-loopback-client-id.js","sourceRoot":"","sources":["../src/atproto-loopback-client-id.ts"],"names":[],"mappings":";;AAuBA,oEAiCC;AAOD,oEAcC;AA7ED,yGAAkG;AAClG,qEAKiC;AACjC,+EAIsC;AACtC,mEAGgC;AAChC,uCAAoD;AAOpD,SAAgB,4BAA4B,CAC1C,MAAoC;IAEpC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QAEpC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAA;QACxB,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,oDAA2B,EAAE,CAAC;YAC3D,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAA,4CAAmB,EAAC,KAAK,CAAC,CAAC,CAAA;QACjD,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,iBAAO,EAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QAClD,IACE,YAAY;YACZ,CAAC,IAAA,yBAAe,EAAC,YAAY,EAAE,gFAAqC,CAAC,EACrE,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAA;YAChE,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC/B,MAAM,CAAC,MAAM,CACX,cAAc,EACd,4DAAoC,CAAC,KAAK,CAAC,GAAG,CAAC,CAChD,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,GAAG,uDAAyB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,uDAAyB,CAAA;AAClC,CAAC;AAOD,SAAgB,4BAA4B,CAC1C,QAAgB;IAEhB,MAAM,EAAE,KAAK,GAAG,oDAA2B,EAAE,aAAa,EAAE,GAC1D,IAAA,wDAA0B,EAAC,QAAQ,CAAC,CAAA;IACtC,IAAI,CAAC,IAAA,4CAAmB,EAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CACjB,wDAAwD,CACzD,CAAA;IACH,CAAC;IACD,OAAO;QACL,KAAK;QACL,aAAa,EAAE,aAAa,IAAI,CAAC,GAAG,gFAAqC,CAAC;KAC3E,CAAA;AACH,CAAC","sourcesContent":["import { DEFAULT_LOOPBACK_CLIENT_REDIRECT_URIS } from './atproto-loopback-client-redirect-uris.js'\nimport {\n  AtprotoOAuthScope,\n  DEFAULT_ATPROTO_OAUTH_SCOPE,\n  asAtprotoOAuthScope,\n  isAtprotoOAuthScope,\n} from './atproto-oauth-scope.js'\nimport {\n  LOOPBACK_CLIENT_ID_ORIGIN,\n  OAuthClientIdLoopback,\n  parseOAuthLoopbackClientId,\n} from './oauth-client-id-loopback.js'\nimport {\n  OAuthLoopbackRedirectURI,\n  oauthLoopbackClientRedirectUriSchema,\n} from './oauth-redirect-uri.js'\nimport { arrayEquivalent, asArray } from './util.js'\n\nexport type OAuthLoopbackClientIdConfig = {\n  scope?: string\n  redirect_uris?: Iterable<string>\n}\n\nexport function buildAtprotoLoopbackClientId(\n  config?: OAuthLoopbackClientIdConfig,\n): OAuthClientIdLoopback {\n  if (config) {\n    const params = new URLSearchParams()\n\n    const { scope } = config\n    if (scope != null && scope !== DEFAULT_ATPROTO_OAUTH_SCOPE) {\n      params.set('scope', asAtprotoOAuthScope(scope))\n    }\n\n    const redirectUris = asArray(config.redirect_uris)\n    if (\n      redirectUris &&\n      !arrayEquivalent(redirectUris, DEFAULT_LOOPBACK_CLIENT_REDIRECT_URIS)\n    ) {\n      if (!redirectUris.length) {\n        throw new TypeError(`Unexpected empty \"redirect_uris\" config`)\n      }\n      for (const uri of redirectUris) {\n        params.append(\n          'redirect_uri',\n          oauthLoopbackClientRedirectUriSchema.parse(uri),\n        )\n      }\n    }\n\n    if (params.size) {\n      return `${LOOPBACK_CLIENT_ID_ORIGIN}?${params.toString()}`\n    }\n  }\n\n  return LOOPBACK_CLIENT_ID_ORIGIN\n}\n\nexport type AtprotoLoopbackClientIdParams = {\n  scope: AtprotoOAuthScope\n  redirect_uris: [OAuthLoopbackRedirectURI, ...OAuthLoopbackRedirectURI[]]\n}\n\nexport function parseAtprotoLoopbackClientId(\n  clientId: string,\n): AtprotoLoopbackClientIdParams {\n  const { scope = DEFAULT_ATPROTO_OAUTH_SCOPE, redirect_uris } =\n    parseOAuthLoopbackClientId(clientId)\n  if (!isAtprotoOAuthScope(scope)) {\n    throw new TypeError(\n      'ATProto Loopback ClientID must include \"atproto\" scope',\n    )\n  }\n  return {\n    scope,\n    redirect_uris: redirect_uris ?? [...DEFAULT_LOOPBACK_CLIENT_REDIRECT_URIS],\n  }\n}\n"]}

package/dist/oauth-authorization-server-metadata.js

@@ -60,9 +60,9 @@ exports.oauthAuthorizationServerMetadataSchema = zod_1.z.object({
     registration_endpoint: uri_js_1.webUriSchema.optional(),
     // https://datatracker.ietf.org/doc/html/rfc9449#section-5.1
     dpop_signing_alg_values_supported: zod_1.z.array(zod_1.z.string()).optional(),
-    // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-05#section-4
+    // https://www.rfc-editor.org/rfc/rfc9728.html#section-4
     protected_resources: zod_1.z.array(uri_js_1.webUriSchema).optional(),
-    // https://drafts.aaronpk.com/draft-parecki-oauth-client-id-metadata-document/draft-parecki-oauth-client-id-metadata-document.html
+    // https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html
     client_id_metadata_document_supported: zod_1.z.boolean().optional(),
 });
 exports.oauthAuthorizationServerMetadataValidator = exports.oauthAuthorizationServerMetadataSchema

package/dist/oauth-authorization-server-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-authorization-server-metadata.js","sourceRoot":"","sources":["../src/oauth-authorization-server-metadata.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,qFAAiF;AACjF,6EAA0E;AAC1E,qCAAuC;AAEvC;;;;;GAKG;AACU,QAAA,sCAAsC,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7D,MAAM,EAAE,wDAA2B;IAEnC,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,0BAA0B,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClD,2BAA2B,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnD,+BAA+B,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvD,gCAAgC,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,uBAAuB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,qBAAqB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,gCAAgC,EAAE,OAAC;SAChC,KAAK,CAAC,+DAA8B,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;IACb,oBAAoB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,qCAAqC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrE,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,2CAA2C,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3E,8CAA8C,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtE,qCAAqC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrE,8CAA8C,EAAE,OAAC;SAC9C,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;IACb,8CAA8C,EAAE,OAAC;SAC9C,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;IAEb,QAAQ,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAEjC,sBAAsB,EAAE,qBAAY,EAAE,eAAe;IAErD,cAAc,EAAE,qBAAY,EAAE,eAAe;IAC7C,wDAAwD;IACxD,qCAAqC,EAAE,OAAC;SACrC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;QAClB,4DAA4D;SAC3D,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC;IACnC,gDAAgD,EAAE,OAAC;SAChD,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;IAEb,mBAAmB,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAC5C,sBAAsB,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAC/C,qCAAqC,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAE9D,qCAAqC,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7D,iBAAiB,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAC1C,oBAAoB,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAC7C,qBAAqB,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAE9C,4DAA4D;IAC5D,iCAAiC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjE,wFAAwF;IACxF,mBAAmB,EAAE,OAAC,CAAC,KAAK,CAAC,qBAAY,CAAC,CAAC,QAAQ,EAAE;IAErD,kIAAkI;IAClI,qCAAqC,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9D,CAAC,CAAA;AAMW,QAAA,yCAAyC,GACpD,8CAAsC;KACnC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IACE,IAAI,CAAC,qCAAqC;QAC1C,CAAC,IAAI,CAAC,qCAAqC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,uGAAuG;SAC1G,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,kCAAkC;aAC5C,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IACE,IAAI,CAAC,gDAAgD,EAAE,QAAQ,CAAC,MAAM,CAAC,EACvE,CAAC;QACD,2EAA2E;QAC3E,uCAAuC;QACvC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { oauthCodeChallengeMethodSchema } from './oauth-code-challenge-method.js'\nimport { oauthIssuerIdentifierSchema } from './oauth-issuer-identifier.js'\nimport { webUriSchema } from './uri.js'\n\n/**\n * @see {@link https://datatracker.ietf.org/doc/html/rfc8414}\n * @note we do not enforce https: scheme in URIs to support development\n * environments. Make sure to validate the URIs before using it in a production\n * environment.\n */\nexport const oauthAuthorizationServerMetadataSchema = z.object({\n  issuer: oauthIssuerIdentifierSchema,\n\n  claims_supported: z.array(z.string()).optional(),\n  claims_locales_supported: z.array(z.string()).optional(),\n  claims_parameter_supported: z.boolean().optional(),\n  request_parameter_supported: z.boolean().optional(),\n  request_uri_parameter_supported: z.boolean().optional(),\n  require_request_uri_registration: z.boolean().optional(),\n  scopes_supported: z.array(z.string()).optional(),\n  subject_types_supported: z.array(z.string()).optional(),\n  response_types_supported: z.array(z.string()).optional(),\n  response_modes_supported: z.array(z.string()).optional(),\n  grant_types_supported: z.array(z.string()).optional(),\n  code_challenge_methods_supported: z\n    .array(oauthCodeChallengeMethodSchema)\n    .min(1)\n    .optional(),\n  ui_locales_supported: z.array(z.string()).optional(),\n  id_token_signing_alg_values_supported: z.array(z.string()).optional(),\n  display_values_supported: z.array(z.string()).optional(),\n  request_object_signing_alg_values_supported: z.array(z.string()).optional(),\n  authorization_response_iss_parameter_supported: z.boolean().optional(),\n  authorization_details_types_supported: z.array(z.string()).optional(),\n  request_object_encryption_alg_values_supported: z\n    .array(z.string())\n    .optional(),\n  request_object_encryption_enc_values_supported: z\n    .array(z.string())\n    .optional(),\n\n  jwks_uri: webUriSchema.optional(),\n\n  authorization_endpoint: webUriSchema, // .optional(),\n\n  token_endpoint: webUriSchema, // .optional(),\n  // https://www.rfc-editor.org/rfc/rfc8414.html#section-2\n  token_endpoint_auth_methods_supported: z\n    .array(z.string())\n    // > If omitted, the default is \"client_secret_basic\" [...].\n    .default(['client_secret_basic']),\n  token_endpoint_auth_signing_alg_values_supported: z\n    .array(z.string())\n    .optional(),\n\n  revocation_endpoint: webUriSchema.optional(),\n  introspection_endpoint: webUriSchema.optional(),\n  pushed_authorization_request_endpoint: webUriSchema.optional(),\n\n  require_pushed_authorization_requests: z.boolean().optional(),\n\n  userinfo_endpoint: webUriSchema.optional(),\n  end_session_endpoint: webUriSchema.optional(),\n  registration_endpoint: webUriSchema.optional(),\n\n  // https://datatracker.ietf.org/doc/html/rfc9449#section-5.1\n  dpop_signing_alg_values_supported: z.array(z.string()).optional(),\n\n  // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-05#section-4\n  protected_resources: z.array(webUriSchema).optional(),\n\n  // https://drafts.aaronpk.com/draft-parecki-oauth-client-id-metadata-document/draft-parecki-oauth-client-id-metadata-document.html\n  client_id_metadata_document_supported: z.boolean().optional(),\n})\n\nexport type OAuthAuthorizationServerMetadata = z.infer<\n  typeof oauthAuthorizationServerMetadataSchema\n>\n\nexport const oauthAuthorizationServerMetadataValidator =\n  oauthAuthorizationServerMetadataSchema\n    .superRefine((data, ctx) => {\n      if (\n        data.require_pushed_authorization_requests &&\n        !data.pushed_authorization_request_endpoint\n      ) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          message:\n            '\"pushed_authorization_request_endpoint\" required when \"require_pushed_authorization_requests\" is true',\n        })\n      }\n    })\n    .superRefine((data, ctx) => {\n      if (data.response_types_supported) {\n        if (!data.response_types_supported.includes('code')) {\n          ctx.addIssue({\n            code: z.ZodIssueCode.custom,\n            message: 'Response type \"code\" is required',\n          })\n        }\n      }\n    })\n    .superRefine((data, ctx) => {\n      if (\n        data.token_endpoint_auth_signing_alg_values_supported?.includes('none')\n      ) {\n        // https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3\n        // > The value `none` MUST NOT be used.\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          message: 'Client authentication method \"none\" is not allowed',\n        })\n      }\n    })\n"]}
+{"version":3,"file":"oauth-authorization-server-metadata.js","sourceRoot":"","sources":["../src/oauth-authorization-server-metadata.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,qFAAiF;AACjF,6EAA0E;AAC1E,qCAAuC;AAEvC;;;;;GAKG;AACU,QAAA,sCAAsC,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7D,MAAM,EAAE,wDAA2B;IAEnC,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,0BAA0B,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClD,2BAA2B,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnD,+BAA+B,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvD,gCAAgC,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,uBAAuB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,qBAAqB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,gCAAgC,EAAE,OAAC;SAChC,KAAK,CAAC,+DAA8B,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;IACb,oBAAoB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,qCAAqC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrE,wBAAwB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,2CAA2C,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3E,8CAA8C,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtE,qCAAqC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrE,8CAA8C,EAAE,OAAC;SAC9C,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;IACb,8CAA8C,EAAE,OAAC;SAC9C,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;IAEb,QAAQ,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAEjC,sBAAsB,EAAE,qBAAY,EAAE,eAAe;IAErD,cAAc,EAAE,qBAAY,EAAE,eAAe;IAC7C,wDAAwD;IACxD,qCAAqC,EAAE,OAAC;SACrC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;QAClB,4DAA4D;SAC3D,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC;IACnC,gDAAgD,EAAE,OAAC;SAChD,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;IAEb,mBAAmB,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAC5C,sBAAsB,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAC/C,qCAAqC,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAE9D,qCAAqC,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7D,iBAAiB,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAC1C,oBAAoB,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAC7C,qBAAqB,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAE9C,4DAA4D;IAC5D,iCAAiC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjE,wDAAwD;IACxD,mBAAmB,EAAE,OAAC,CAAC,KAAK,CAAC,qBAAY,CAAC,CAAC,QAAQ,EAAE;IAErD,uFAAuF;IACvF,qCAAqC,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9D,CAAC,CAAA;AAMW,QAAA,yCAAyC,GACpD,8CAAsC;KACnC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IACE,IAAI,CAAC,qCAAqC;QAC1C,CAAC,IAAI,CAAC,qCAAqC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,uGAAuG;SAC1G,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,kCAAkC;aAC5C,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC;KACD,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IACE,IAAI,CAAC,gDAAgD,EAAE,QAAQ,CAAC,MAAM,CAAC,EACvE,CAAC;QACD,2EAA2E;QAC3E,uCAAuC;QACvC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { oauthCodeChallengeMethodSchema } from './oauth-code-challenge-method.js'\nimport { oauthIssuerIdentifierSchema } from './oauth-issuer-identifier.js'\nimport { webUriSchema } from './uri.js'\n\n/**\n * @see {@link https://datatracker.ietf.org/doc/html/rfc8414}\n * @note we do not enforce https: scheme in URIs to support development\n * environments. Make sure to validate the URIs before using it in a production\n * environment.\n */\nexport const oauthAuthorizationServerMetadataSchema = z.object({\n  issuer: oauthIssuerIdentifierSchema,\n\n  claims_supported: z.array(z.string()).optional(),\n  claims_locales_supported: z.array(z.string()).optional(),\n  claims_parameter_supported: z.boolean().optional(),\n  request_parameter_supported: z.boolean().optional(),\n  request_uri_parameter_supported: z.boolean().optional(),\n  require_request_uri_registration: z.boolean().optional(),\n  scopes_supported: z.array(z.string()).optional(),\n  subject_types_supported: z.array(z.string()).optional(),\n  response_types_supported: z.array(z.string()).optional(),\n  response_modes_supported: z.array(z.string()).optional(),\n  grant_types_supported: z.array(z.string()).optional(),\n  code_challenge_methods_supported: z\n    .array(oauthCodeChallengeMethodSchema)\n    .min(1)\n    .optional(),\n  ui_locales_supported: z.array(z.string()).optional(),\n  id_token_signing_alg_values_supported: z.array(z.string()).optional(),\n  display_values_supported: z.array(z.string()).optional(),\n  request_object_signing_alg_values_supported: z.array(z.string()).optional(),\n  authorization_response_iss_parameter_supported: z.boolean().optional(),\n  authorization_details_types_supported: z.array(z.string()).optional(),\n  request_object_encryption_alg_values_supported: z\n    .array(z.string())\n    .optional(),\n  request_object_encryption_enc_values_supported: z\n    .array(z.string())\n    .optional(),\n\n  jwks_uri: webUriSchema.optional(),\n\n  authorization_endpoint: webUriSchema, // .optional(),\n\n  token_endpoint: webUriSchema, // .optional(),\n  // https://www.rfc-editor.org/rfc/rfc8414.html#section-2\n  token_endpoint_auth_methods_supported: z\n    .array(z.string())\n    // > If omitted, the default is \"client_secret_basic\" [...].\n    .default(['client_secret_basic']),\n  token_endpoint_auth_signing_alg_values_supported: z\n    .array(z.string())\n    .optional(),\n\n  revocation_endpoint: webUriSchema.optional(),\n  introspection_endpoint: webUriSchema.optional(),\n  pushed_authorization_request_endpoint: webUriSchema.optional(),\n\n  require_pushed_authorization_requests: z.boolean().optional(),\n\n  userinfo_endpoint: webUriSchema.optional(),\n  end_session_endpoint: webUriSchema.optional(),\n  registration_endpoint: webUriSchema.optional(),\n\n  // https://datatracker.ietf.org/doc/html/rfc9449#section-5.1\n  dpop_signing_alg_values_supported: z.array(z.string()).optional(),\n\n  // https://www.rfc-editor.org/rfc/rfc9728.html#section-4\n  protected_resources: z.array(webUriSchema).optional(),\n\n  // https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html\n  client_id_metadata_document_supported: z.boolean().optional(),\n})\n\nexport type OAuthAuthorizationServerMetadata = z.infer<\n  typeof oauthAuthorizationServerMetadataSchema\n>\n\nexport const oauthAuthorizationServerMetadataValidator =\n  oauthAuthorizationServerMetadataSchema\n    .superRefine((data, ctx) => {\n      if (\n        data.require_pushed_authorization_requests &&\n        !data.pushed_authorization_request_endpoint\n      ) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          message:\n            '\"pushed_authorization_request_endpoint\" required when \"require_pushed_authorization_requests\" is true',\n        })\n      }\n    })\n    .superRefine((data, ctx) => {\n      if (data.response_types_supported) {\n        if (!data.response_types_supported.includes('code')) {\n          ctx.addIssue({\n            code: z.ZodIssueCode.custom,\n            message: 'Response type \"code\" is required',\n          })\n        }\n      }\n    })\n    .superRefine((data, ctx) => {\n      if (\n        data.token_endpoint_auth_signing_alg_values_supported?.includes('none')\n      ) {\n        // https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3\n        // > The value `none` MUST NOT be used.\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          message: 'Client authentication method \"none\" is not allowed',\n        })\n      }\n    })\n"]}

package/dist/oauth-client-id-discoverable.d.ts

@@ -1,6 +1,6 @@
 import { TypeOf, z } from 'zod';
 /**
- * @see {@link https://drafts.aaronpk.com/draft-parecki-oauth-client-id-metadata-document/draft-parecki-oauth-client-id-metadata-document.html}
+ * @see {@link https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html}
  */
 export declare const oauthClientIdDiscoverableSchema: z.ZodEffects<z.ZodIntersection<z.ZodString, z.ZodEffects<z.ZodEffects<z.ZodString, `${string}:${string}`, string>, `https://${string}`, string>>, `https://${string}/${string}`, string>;
 export type OAuthClientIdDiscoverable = TypeOf<typeof oauthClientIdDiscoverableSchema>;

package/dist/oauth-client-id-discoverable.js

@@ -10,7 +10,7 @@ const oauth_client_id_js_1 = require("./oauth-client-id.js");
 const uri_js_1 = require("./uri.js");
 const util_js_1 = require("./util.js");
 /**
- * @see {@link https://drafts.aaronpk.com/draft-parecki-oauth-client-id-metadata-document/draft-parecki-oauth-client-id-metadata-document.html}
+ * @see {@link https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html}
  */
 exports.oauthClientIdDiscoverableSchema = zod_1.z
     .intersection(oauth_client_id_js_1.oauthClientIdSchema, uri_js_1.httpsUriSchema)

package/dist/oauth-client-id-discoverable.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client-id-discoverable.js","sourceRoot":"","sources":["../src/oauth-client-id-discoverable.ts"],"names":[],"mappings":";;;AAwEA,kEAIC;AAuCD,kEAIC;AAED,0EAIC;AAED,wEAEC;AAjID,6BAA+B;AAC/B,6DAA0D;AAC1D,qCAAyC;AACzC,uCAAwD;AAExD;;GAEG;AACU,QAAA,+BAA+B,GAAG,OAAC;KAC7C,YAAY,CAAC,wCAAmB,EAAE,uBAAc,CAAC;KACjD,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAA0C,EAAE;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAE1B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,uCAAuC;SACjD,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,sCAAsC;SAChD,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,uEAAuE;SAC1E,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,kDAAkD;SAC5D,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,IAAA,sBAAY,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,6CAA6C;SACvD,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,8EAA8E;IAC9E,IAAI,IAAA,wBAAc,EAAC,KAAK,CAAC,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC3C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,wCAAwC,GAAG,CAAC,IAAI,WAAW,KAAK,IAAI;SAC9E,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA;AAMJ,SAAgB,2BAA2B,CACzC,QAAgB;IAEhB,OAAO,uCAA+B,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAA;AACpE,CAAC;AAEY,QAAA,+BAA+B,GAC1C,uCAA+B,CAAC,WAAW,CACzC,CAAC,KAAK,EAAE,GAAG,EAA2D,EAAE;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAE1B,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,kCAAkC;SAC5C,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,0CAA0C;SACpD,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,6BAA6B,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CACF,CAAA;AAMH,SAAgB,2BAA2B,CACzC,QAAgB;IAEhB,OAAO,uCAA+B,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAA;AACpE,CAAC;AAED,SAAgB,+BAA+B,CAC7C,KAAa;IAEb,KAAK,uCAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AACnD,CAAC;AAED,SAAgB,8BAA8B,CAAC,QAAgB;IAC7D,OAAO,IAAI,GAAG,CAAC,uCAA+B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;AACjE,CAAC","sourcesContent":["import { TypeOf, z } from 'zod'\nimport { oauthClientIdSchema } from './oauth-client-id.js'\nimport { httpsUriSchema } from './uri.js'\nimport { extractUrlPath, isHostnameIP } from './util.js'\n\n/**\n * @see {@link https://drafts.aaronpk.com/draft-parecki-oauth-client-id-metadata-document/draft-parecki-oauth-client-id-metadata-document.html}\n */\nexport const oauthClientIdDiscoverableSchema = z\n  .intersection(oauthClientIdSchema, httpsUriSchema)\n  .superRefine((value, ctx): value is `https://${string}/${string}` => {\n    const url = new URL(value)\n\n    if (url.username || url.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'ClientID must not contain credentials',\n      })\n      return false\n    }\n\n    if (url.hash) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'ClientID must not contain a fragment',\n      })\n      return false\n    }\n\n    if (url.pathname === '/') {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message:\n          'ClientID must contain a path component (e.g. \"/client-metadata.json\")',\n      })\n      return false\n    }\n\n    if (url.pathname.endsWith('/')) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'ClientID path must not end with a trailing slash',\n      })\n      return false\n    }\n\n    if (isHostnameIP(url.hostname)) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'ClientID hostname must not be an IP address',\n      })\n      return false\n    }\n\n    // URL constructor normalizes the URL, so we extract the path manually to\n    // avoid normalization, then compare it to the normalized path to ensure\n    // that the URL does not contain path traversal or other unexpected characters\n    if (extractUrlPath(value) !== url.pathname) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: `ClientID must be in canonical form (\"${url.href}\", got \"${value}\")`,\n      })\n      return false\n    }\n\n    return true\n  })\n\nexport type OAuthClientIdDiscoverable = TypeOf<\n  typeof oauthClientIdDiscoverableSchema\n>\n\nexport function isOAuthClientIdDiscoverable(\n  clientId: string,\n): clientId is OAuthClientIdDiscoverable {\n  return oauthClientIdDiscoverableSchema.safeParse(clientId).success\n}\n\nexport const conventionalOAuthClientIdSchema =\n  oauthClientIdDiscoverableSchema.superRefine(\n    (value, ctx): value is `https://${string}/oauth-client-metadata.json` => {\n      const url = new URL(value)\n\n      if (url.port) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          message: 'ClientID must not contain a port',\n        })\n        return false\n      }\n\n      if (url.search) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          message: 'ClientID must not contain a query string',\n        })\n        return false\n      }\n\n      if (url.pathname !== '/oauth-client-metadata.json') {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          message: 'ClientID must be \"/oauth-client-metadata.json\"',\n        })\n        return false\n      }\n\n      return true\n    },\n  )\n\nexport type ConventionalOAuthClientId = TypeOf<\n  typeof conventionalOAuthClientIdSchema\n>\n\nexport function isConventionalOAuthClientId(\n  clientId: string,\n): clientId is ConventionalOAuthClientId {\n  return conventionalOAuthClientIdSchema.safeParse(clientId).success\n}\n\nexport function assertOAuthDiscoverableClientId(\n  value: string,\n): asserts value is OAuthClientIdDiscoverable {\n  void oauthClientIdDiscoverableSchema.parse(value)\n}\n\nexport function parseOAuthDiscoverableClientId(clientId: string): URL {\n  return new URL(oauthClientIdDiscoverableSchema.parse(clientId))\n}\n"]}
+{"version":3,"file":"oauth-client-id-discoverable.js","sourceRoot":"","sources":["../src/oauth-client-id-discoverable.ts"],"names":[],"mappings":";;;AAwEA,kEAIC;AAuCD,kEAIC;AAED,0EAIC;AAED,wEAEC;AAjID,6BAA+B;AAC/B,6DAA0D;AAC1D,qCAAyC;AACzC,uCAAwD;AAExD;;GAEG;AACU,QAAA,+BAA+B,GAAG,OAAC;KAC7C,YAAY,CAAC,wCAAmB,EAAE,uBAAc,CAAC;KACjD,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAA0C,EAAE;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAE1B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,uCAAuC;SACjD,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,sCAAsC;SAChD,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,uEAAuE;SAC1E,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,kDAAkD;SAC5D,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,IAAA,sBAAY,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,6CAA6C;SACvD,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,8EAA8E;IAC9E,IAAI,IAAA,wBAAc,EAAC,KAAK,CAAC,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC3C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,wCAAwC,GAAG,CAAC,IAAI,WAAW,KAAK,IAAI;SAC9E,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA;AAMJ,SAAgB,2BAA2B,CACzC,QAAgB;IAEhB,OAAO,uCAA+B,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAA;AACpE,CAAC;AAEY,QAAA,+BAA+B,GAC1C,uCAA+B,CAAC,WAAW,CACzC,CAAC,KAAK,EAAE,GAAG,EAA2D,EAAE;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAE1B,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,kCAAkC;SAC5C,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,0CAA0C;SACpD,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,6BAA6B,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CACF,CAAA;AAMH,SAAgB,2BAA2B,CACzC,QAAgB;IAEhB,OAAO,uCAA+B,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAA;AACpE,CAAC;AAED,SAAgB,+BAA+B,CAC7C,KAAa;IAEb,KAAK,uCAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AACnD,CAAC;AAED,SAAgB,8BAA8B,CAAC,QAAgB;IAC7D,OAAO,IAAI,GAAG,CAAC,uCAA+B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;AACjE,CAAC","sourcesContent":["import { TypeOf, z } from 'zod'\nimport { oauthClientIdSchema } from './oauth-client-id.js'\nimport { httpsUriSchema } from './uri.js'\nimport { extractUrlPath, isHostnameIP } from './util.js'\n\n/**\n * @see {@link https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html}\n */\nexport const oauthClientIdDiscoverableSchema = z\n  .intersection(oauthClientIdSchema, httpsUriSchema)\n  .superRefine((value, ctx): value is `https://${string}/${string}` => {\n    const url = new URL(value)\n\n    if (url.username || url.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'ClientID must not contain credentials',\n      })\n      return false\n    }\n\n    if (url.hash) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'ClientID must not contain a fragment',\n      })\n      return false\n    }\n\n    if (url.pathname === '/') {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message:\n          'ClientID must contain a path component (e.g. \"/client-metadata.json\")',\n      })\n      return false\n    }\n\n    if (url.pathname.endsWith('/')) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'ClientID path must not end with a trailing slash',\n      })\n      return false\n    }\n\n    if (isHostnameIP(url.hostname)) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'ClientID hostname must not be an IP address',\n      })\n      return false\n    }\n\n    // URL constructor normalizes the URL, so we extract the path manually to\n    // avoid normalization, then compare it to the normalized path to ensure\n    // that the URL does not contain path traversal or other unexpected characters\n    if (extractUrlPath(value) !== url.pathname) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: `ClientID must be in canonical form (\"${url.href}\", got \"${value}\")`,\n      })\n      return false\n    }\n\n    return true\n  })\n\nexport type OAuthClientIdDiscoverable = TypeOf<\n  typeof oauthClientIdDiscoverableSchema\n>\n\nexport function isOAuthClientIdDiscoverable(\n  clientId: string,\n): clientId is OAuthClientIdDiscoverable {\n  return oauthClientIdDiscoverableSchema.safeParse(clientId).success\n}\n\nexport const conventionalOAuthClientIdSchema =\n  oauthClientIdDiscoverableSchema.superRefine(\n    (value, ctx): value is `https://${string}/oauth-client-metadata.json` => {\n      const url = new URL(value)\n\n      if (url.port) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          message: 'ClientID must not contain a port',\n        })\n        return false\n      }\n\n      if (url.search) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          message: 'ClientID must not contain a query string',\n        })\n        return false\n      }\n\n      if (url.pathname !== '/oauth-client-metadata.json') {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          message: 'ClientID must be \"/oauth-client-metadata.json\"',\n        })\n        return false\n      }\n\n      return true\n    },\n  )\n\nexport type ConventionalOAuthClientId = TypeOf<\n  typeof conventionalOAuthClientIdSchema\n>\n\nexport function isConventionalOAuthClientId(\n  clientId: string,\n): clientId is ConventionalOAuthClientId {\n  return conventionalOAuthClientIdSchema.safeParse(clientId).success\n}\n\nexport function assertOAuthDiscoverableClientId(\n  value: string,\n): asserts value is OAuthClientIdDiscoverable {\n  void oauthClientIdDiscoverableSchema.parse(value)\n}\n\nexport function parseOAuthDiscoverableClientId(clientId: string): URL {\n  return new URL(oauthClientIdDiscoverableSchema.parse(clientId))\n}\n"]}

package/dist/oauth-client-id-loopback.js

@@ -91,7 +91,7 @@ function safeParseOAuthLoopbackClientIdQueryString(input) {
             params.scope = res.data;
         }
         else if (key === 'redirect_uri') {
-            const res = oauth_redirect_uri_js_1.oauthLoopbackRedirectURISchema.safeParse(value);
+            const res = oauth_redirect_uri_js_1.oauthLoopbackClientRedirectUriSchema.safeParse(value);
             if (!res.success) {
                 const reason = res.error.issues.map((i) => i.message).join(', ');
                 return {

package/dist/oauth-client-id-loopback.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client-id-loopback.js","sourceRoot":"","sources":["../src/oauth-client-id-loopback.ts"],"names":[],"mappings":";;;AAkCA,kEAIC;AAED,0DAIC;AAED,0DAGC;AAED,gEAOC;AAUD,wEA2CC;AAED,8FAkDC;AAnKD,6DAA0D;AAC1D,mEAGgC;AAChC,qDAA+D;AAElD,QAAA,yBAAyB,GAAG,kBAAkB,CAAA;AAiB9C,QAAA,2BAA2B,GAAG,wCAAmB,CAAC,WAAW,CACxE,CAAC,KAAK,EAAE,GAAG,EAAkC,EAAE;IAC7C,MAAM,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAA;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAA;AACvB,CAAC,CACF,CAAA;AAED,SAAgB,2BAA2B,CACzC,KAAa;IAEb,KAAK,0BAA0B,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC;AAED,SAAgB,uBAAuB,CACrC,KAAQ;IAER,OAAO,8BAA8B,CAAC,KAAK,CAAC,CAAC,OAAO,CAAA;AACtD,CAAC;AAED,SAAgB,uBAAuB,CAAmB,KAAQ;IAChE,2BAA2B,CAAC,KAAK,CAAC,CAAA;IAClC,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAgB,0BAA0B,CACxC,KAAa;IAEb,MAAM,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAA;IACpD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,KAAK,CAAA;IAEvC,MAAM,IAAI,SAAS,CAAC,+BAA+B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;AACtE,CAAC;AAUD,SAAgB,8BAA8B,CAC5C,KAAa;IAEb,oEAAoE;IACpE,wBAAwB;IAExB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,iCAAyB,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,0BAA0B,iCAAyB,GAAG;SAChE,CAAA;IACH,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,iCAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,yCAAyC;SACnD,CAAA;IACH,CAAC;IAED,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,cAAc,GAClB,KAAK,CAAC,MAAM,GAAG,iCAAyB,CAAC,MAAM;QAC/C,KAAK,CAAC,UAAU,CAAC,iCAAyB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS;QACnE,CAAC,CAAC,iCAAyB,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,iCAAyB,CAAC,MAAM,CAAA;IAEtC,2EAA2E;IAC3E,wEAAwE;IACxE,qDAAqD;IACrD,IACE,KAAK,CAAC,MAAM,KAAK,cAAc;QAC/B,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,SAAS,EACnD,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,yCAAyC;SACnD,CAAA;IACH,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAA;IACnD,OAAO,yCAAyC,CAAC,WAAW,CAAC,CAAA;AAC/D,CAAC;AAED,SAAgB,yCAAyC,CACvD,KAAsD;IAEtD,qBAAqB;IACrB,MAAM,MAAM,GAAgC,EAAE,CAAA;IAE9C,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACzE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;gBACtB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,mCAAmC;iBAC7C,CAAA;YACH,CAAC;YAED,MAAM,GAAG,GAAG,iCAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,oCAAoC,MAAM,IAAI,mBAAmB,EAAE;iBAC7E,CAAA;YACH,CAAC;YAED,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,IAAI,CAAA;QACzB,CAAC;aAAM,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,sDAA8B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YAC3D,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,2CAA2C,MAAM,IAAI,mBAAmB,EAAE;iBACpF,CAAA;YACH,CAAC;YAED,IAAI,MAAM,CAAC,aAAa,IAAI,IAAI;gBAAE,MAAM,CAAC,aAAa,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;;gBAC9D,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC1C,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,+BAA+B,GAAG,GAAG;aAC/C,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,MAAM;KACd,CAAA;AACH,CAAC","sourcesContent":["import { oauthClientIdSchema } from './oauth-client-id.js'\nimport {\n  OAuthLoopbackRedirectURI,\n  oauthLoopbackRedirectURISchema,\n} from './oauth-redirect-uri.js'\nimport { OAuthScope, oauthScopeSchema } from './oauth-scope.js'\n\nexport const LOOPBACK_CLIENT_ID_ORIGIN = 'http://localhost'\n\n// @NOTE This is not actually based on a standard, but rather a convention\n// established by Bluesky in the Atproto specs and implementation. As such, and\n// in order to respect the convention from this package, these should be\n// prefixed with \"Atproto\" instead of \"OAuth\". For legacy reasons, we keep the\n// current names, but we should rename them in a future major release, unless\n// loopback client ids have since then been standardized.\n\nexport type OAuthClientIdLoopback =\n  `http://localhost${'' | `/`}${'' | `?${string}`}`\n\nexport type OAuthLoopbackClientIdParams = {\n  scope?: OAuthScope\n  redirect_uris?: [OAuthLoopbackRedirectURI, ...OAuthLoopbackRedirectURI[]]\n}\n\nexport const oauthClientIdLoopbackSchema = oauthClientIdSchema.superRefine(\n  (input, ctx): input is OAuthClientIdLoopback => {\n    const result = safeParseOAuthLoopbackClientId(input)\n    if (!result.success) {\n      ctx.addIssue({ code: 'custom', message: result.message })\n    }\n    return result.success\n  },\n)\n\nexport function assertOAuthLoopbackClientId(\n  input: string,\n): asserts input is OAuthClientIdLoopback {\n  void parseOAuthLoopbackClientId(input)\n}\n\nexport function isOAuthClientIdLoopback<T extends string>(\n  input: T,\n): input is T & OAuthClientIdLoopback {\n  return safeParseOAuthLoopbackClientId(input).success\n}\n\nexport function asOAuthClientIdLoopback<T extends string>(input: T) {\n  assertOAuthLoopbackClientId(input)\n  return input\n}\n\nexport function parseOAuthLoopbackClientId(\n  input: string,\n): OAuthLoopbackClientIdParams {\n  const result = safeParseOAuthLoopbackClientId(input)\n  if (result.success) return result.value\n\n  throw new TypeError(`Invalid loopback client ID: ${result.message}`)\n}\n\n/**\n * Similar to Zod's {@link SafeParseReturnType} but uses a simple \"message\"\n * string instead of an \"error\" Error object.\n */\ntype LightParseReturnType<T> =\n  | { success: true; value: T }\n  | { success: false; message: string }\n\nexport function safeParseOAuthLoopbackClientId(\n  input: string,\n): LightParseReturnType<OAuthLoopbackClientIdParams> {\n  // @NOTE Not using \"new URL\" to ensure input indeed matches the type\n  // OAuthClientIdLoopback\n\n  if (!input.startsWith(LOOPBACK_CLIENT_ID_ORIGIN)) {\n    return {\n      success: false,\n      message: `Value must start with \"${LOOPBACK_CLIENT_ID_ORIGIN}\"`,\n    }\n  }\n\n  if (input.includes('#', LOOPBACK_CLIENT_ID_ORIGIN.length)) {\n    return {\n      success: false,\n      message: 'Value must not contain a hash component',\n    }\n  }\n\n  // Since we don't allow a path component (except for a single \"/\") the query\n  // string starts after the origin (+ 1 if there is a \"/\")\n  const queryStringIdx =\n    input.length > LOOPBACK_CLIENT_ID_ORIGIN.length &&\n    input.charCodeAt(LOOPBACK_CLIENT_ID_ORIGIN.length) === 0x2f /* '/' */\n      ? LOOPBACK_CLIENT_ID_ORIGIN.length + 1\n      : LOOPBACK_CLIENT_ID_ORIGIN.length\n\n  // Since we determined the position of the query string based on the origin\n  // length (instead of looking for a \"?\"), we need to make sure the query\n  // string position (if any) indeed starts with a \"?\".\n  if (\n    input.length !== queryStringIdx &&\n    input.charCodeAt(queryStringIdx) !== 0x3f /* '?' */\n  ) {\n    return {\n      success: false,\n      message: 'Value must not contain a path component',\n    }\n  }\n\n  const queryString = input.slice(queryStringIdx + 1)\n  return safeParseOAuthLoopbackClientIdQueryString(queryString)\n}\n\nexport function safeParseOAuthLoopbackClientIdQueryString(\n  input: string | Iterable<[key: string, value: string]>,\n): LightParseReturnType<OAuthLoopbackClientIdParams> {\n  // Parse query params\n  const params: OAuthLoopbackClientIdParams = {}\n\n  const it = typeof input === 'string' ? new URLSearchParams(input) : input\n  for (const [key, value] of it) {\n    if (key === 'scope') {\n      if ('scope' in params) {\n        return {\n          success: false,\n          message: 'Duplicate \"scope\" query parameter',\n        }\n      }\n\n      const res = oauthScopeSchema.safeParse(value)\n      if (!res.success) {\n        const reason = res.error.issues.map((i) => i.message).join(', ')\n        return {\n          success: false,\n          message: `Invalid \"scope\" query parameter: ${reason || 'Validation failed'}`,\n        }\n      }\n\n      params.scope = res.data\n    } else if (key === 'redirect_uri') {\n      const res = oauthLoopbackRedirectURISchema.safeParse(value)\n      if (!res.success) {\n        const reason = res.error.issues.map((i) => i.message).join(', ')\n        return {\n          success: false,\n          message: `Invalid \"redirect_uri\" query parameter: ${reason || 'Validation failed'}`,\n        }\n      }\n\n      if (params.redirect_uris == null) params.redirect_uris = [res.data]\n      else params.redirect_uris.push(res.data)\n    } else {\n      return {\n        success: false,\n        message: `Unexpected query parameter \"${key}\"`,\n      }\n    }\n  }\n\n  return {\n    success: true,\n    value: params,\n  }\n}\n"]}
+{"version":3,"file":"oauth-client-id-loopback.js","sourceRoot":"","sources":["../src/oauth-client-id-loopback.ts"],"names":[],"mappings":";;;AAkCA,kEAIC;AAED,0DAIC;AAED,0DAGC;AAED,gEAOC;AAUD,wEA2CC;AAED,8FAkDC;AAnKD,6DAA0D;AAC1D,mEAGgC;AAChC,qDAA+D;AAElD,QAAA,yBAAyB,GAAG,kBAAkB,CAAA;AAiB9C,QAAA,2BAA2B,GAAG,wCAAmB,CAAC,WAAW,CACxE,CAAC,KAAK,EAAE,GAAG,EAAkC,EAAE;IAC7C,MAAM,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAA;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAA;AACvB,CAAC,CACF,CAAA;AAED,SAAgB,2BAA2B,CACzC,KAAa;IAEb,KAAK,0BAA0B,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC;AAED,SAAgB,uBAAuB,CACrC,KAAQ;IAER,OAAO,8BAA8B,CAAC,KAAK,CAAC,CAAC,OAAO,CAAA;AACtD,CAAC;AAED,SAAgB,uBAAuB,CAAmB,KAAQ;IAChE,2BAA2B,CAAC,KAAK,CAAC,CAAA;IAClC,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAgB,0BAA0B,CACxC,KAAa;IAEb,MAAM,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAA;IACpD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,KAAK,CAAA;IAEvC,MAAM,IAAI,SAAS,CAAC,+BAA+B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;AACtE,CAAC;AAUD,SAAgB,8BAA8B,CAC5C,KAAa;IAEb,oEAAoE;IACpE,wBAAwB;IAExB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,iCAAyB,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,0BAA0B,iCAAyB,GAAG;SAChE,CAAA;IACH,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,iCAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,yCAAyC;SACnD,CAAA;IACH,CAAC;IAED,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,cAAc,GAClB,KAAK,CAAC,MAAM,GAAG,iCAAyB,CAAC,MAAM;QAC/C,KAAK,CAAC,UAAU,CAAC,iCAAyB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS;QACnE,CAAC,CAAC,iCAAyB,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,iCAAyB,CAAC,MAAM,CAAA;IAEtC,2EAA2E;IAC3E,wEAAwE;IACxE,qDAAqD;IACrD,IACE,KAAK,CAAC,MAAM,KAAK,cAAc;QAC/B,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,SAAS,EACnD,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,yCAAyC;SACnD,CAAA;IACH,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAA;IACnD,OAAO,yCAAyC,CAAC,WAAW,CAAC,CAAA;AAC/D,CAAC;AAED,SAAgB,yCAAyC,CACvD,KAAsD;IAEtD,qBAAqB;IACrB,MAAM,MAAM,GAAgC,EAAE,CAAA;IAE9C,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACzE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;gBACtB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,mCAAmC;iBAC7C,CAAA;YACH,CAAC;YAED,MAAM,GAAG,GAAG,iCAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,oCAAoC,MAAM,IAAI,mBAAmB,EAAE;iBAC7E,CAAA;YACH,CAAC;YAED,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,IAAI,CAAA;QACzB,CAAC;aAAM,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,4DAAoC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YACjE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,2CAA2C,MAAM,IAAI,mBAAmB,EAAE;iBACpF,CAAA;YACH,CAAC;YAED,IAAI,MAAM,CAAC,aAAa,IAAI,IAAI;gBAAE,MAAM,CAAC,aAAa,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;;gBAC9D,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC1C,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,+BAA+B,GAAG,GAAG;aAC/C,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,MAAM;KACd,CAAA;AACH,CAAC","sourcesContent":["import { oauthClientIdSchema } from './oauth-client-id.js'\nimport {\n  OAuthLoopbackRedirectURI,\n  oauthLoopbackClientRedirectUriSchema,\n} from './oauth-redirect-uri.js'\nimport { OAuthScope, oauthScopeSchema } from './oauth-scope.js'\n\nexport const LOOPBACK_CLIENT_ID_ORIGIN = 'http://localhost'\n\n// @NOTE This is not actually based on a standard, but rather a convention\n// established by Bluesky in the Atproto specs and implementation. As such, and\n// in order to respect the convention from this package, these should be\n// prefixed with \"Atproto\" instead of \"OAuth\". For legacy reasons, we keep the\n// current names, but we should rename them in a future major release, unless\n// loopback client ids have since then been standardized.\n\nexport type OAuthClientIdLoopback =\n  `http://localhost${'' | `/`}${'' | `?${string}`}`\n\nexport type OAuthLoopbackClientIdParams = {\n  scope?: OAuthScope\n  redirect_uris?: [OAuthLoopbackRedirectURI, ...OAuthLoopbackRedirectURI[]]\n}\n\nexport const oauthClientIdLoopbackSchema = oauthClientIdSchema.superRefine(\n  (input, ctx): input is OAuthClientIdLoopback => {\n    const result = safeParseOAuthLoopbackClientId(input)\n    if (!result.success) {\n      ctx.addIssue({ code: 'custom', message: result.message })\n    }\n    return result.success\n  },\n)\n\nexport function assertOAuthLoopbackClientId(\n  input: string,\n): asserts input is OAuthClientIdLoopback {\n  void parseOAuthLoopbackClientId(input)\n}\n\nexport function isOAuthClientIdLoopback<T extends string>(\n  input: T,\n): input is T & OAuthClientIdLoopback {\n  return safeParseOAuthLoopbackClientId(input).success\n}\n\nexport function asOAuthClientIdLoopback<T extends string>(input: T) {\n  assertOAuthLoopbackClientId(input)\n  return input\n}\n\nexport function parseOAuthLoopbackClientId(\n  input: string,\n): OAuthLoopbackClientIdParams {\n  const result = safeParseOAuthLoopbackClientId(input)\n  if (result.success) return result.value\n\n  throw new TypeError(`Invalid loopback client ID: ${result.message}`)\n}\n\n/**\n * Similar to Zod's {@link SafeParseReturnType} but uses a simple \"message\"\n * string instead of an \"error\" Error object.\n */\ntype LightParseReturnType<T> =\n  | { success: true; value: T }\n  | { success: false; message: string }\n\nexport function safeParseOAuthLoopbackClientId(\n  input: string,\n): LightParseReturnType<OAuthLoopbackClientIdParams> {\n  // @NOTE Not using \"new URL\" to ensure input indeed matches the type\n  // OAuthClientIdLoopback\n\n  if (!input.startsWith(LOOPBACK_CLIENT_ID_ORIGIN)) {\n    return {\n      success: false,\n      message: `Value must start with \"${LOOPBACK_CLIENT_ID_ORIGIN}\"`,\n    }\n  }\n\n  if (input.includes('#', LOOPBACK_CLIENT_ID_ORIGIN.length)) {\n    return {\n      success: false,\n      message: 'Value must not contain a hash component',\n    }\n  }\n\n  // Since we don't allow a path component (except for a single \"/\") the query\n  // string starts after the origin (+ 1 if there is a \"/\")\n  const queryStringIdx =\n    input.length > LOOPBACK_CLIENT_ID_ORIGIN.length &&\n    input.charCodeAt(LOOPBACK_CLIENT_ID_ORIGIN.length) === 0x2f /* '/' */\n      ? LOOPBACK_CLIENT_ID_ORIGIN.length + 1\n      : LOOPBACK_CLIENT_ID_ORIGIN.length\n\n  // Since we determined the position of the query string based on the origin\n  // length (instead of looking for a \"?\"), we need to make sure the query\n  // string position (if any) indeed starts with a \"?\".\n  if (\n    input.length !== queryStringIdx &&\n    input.charCodeAt(queryStringIdx) !== 0x3f /* '?' */\n  ) {\n    return {\n      success: false,\n      message: 'Value must not contain a path component',\n    }\n  }\n\n  const queryString = input.slice(queryStringIdx + 1)\n  return safeParseOAuthLoopbackClientIdQueryString(queryString)\n}\n\nexport function safeParseOAuthLoopbackClientIdQueryString(\n  input: string | Iterable<[key: string, value: string]>,\n): LightParseReturnType<OAuthLoopbackClientIdParams> {\n  // Parse query params\n  const params: OAuthLoopbackClientIdParams = {}\n\n  const it = typeof input === 'string' ? new URLSearchParams(input) : input\n  for (const [key, value] of it) {\n    if (key === 'scope') {\n      if ('scope' in params) {\n        return {\n          success: false,\n          message: 'Duplicate \"scope\" query parameter',\n        }\n      }\n\n      const res = oauthScopeSchema.safeParse(value)\n      if (!res.success) {\n        const reason = res.error.issues.map((i) => i.message).join(', ')\n        return {\n          success: false,\n          message: `Invalid \"scope\" query parameter: ${reason || 'Validation failed'}`,\n        }\n      }\n\n      params.scope = res.data\n    } else if (key === 'redirect_uri') {\n      const res = oauthLoopbackClientRedirectUriSchema.safeParse(value)\n      if (!res.success) {\n        const reason = res.error.issues.map((i) => i.message).join(', ')\n        return {\n          success: false,\n          message: `Invalid \"redirect_uri\" query parameter: ${reason || 'Validation failed'}`,\n        }\n      }\n\n      if (params.redirect_uris == null) params.redirect_uris = [res.data]\n      else params.redirect_uris.push(res.data)\n    } else {\n      return {\n        success: false,\n        message: `Unexpected query parameter \"${key}\"`,\n      }\n    }\n  }\n\n  return {\n    success: true,\n    value: params,\n  }\n}\n"]}

package/dist/oauth-protected-resource-metadata.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 /**
- * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-05#name-protected-resource-metadata-r}
+ * @see {@link https://www.rfc-editor.org/rfc/rfc9728.html#section-3.2}
  */
 export declare const oauthProtectedResourceMetadataSchema: z.ZodObject<{
     /**

package/dist/oauth-protected-resource-metadata.js

@@ -5,7 +5,7 @@ const zod_1 = require("zod");
 const oauth_issuer_identifier_js_1 = require("./oauth-issuer-identifier.js");
 const uri_js_1 = require("./uri.js");
 /**
- * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-05#name-protected-resource-metadata-r}
+ * @see {@link https://www.rfc-editor.org/rfc/rfc9728.html#section-3.2}
  */
 exports.oauthProtectedResourceMetadataSchema = zod_1.z.object({
     /**

package/dist/oauth-protected-resource-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-protected-resource-metadata.js","sourceRoot":"","sources":["../src/oauth-protected-resource-metadata.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,6EAA0E;AAC1E,qCAAuC;AAEvC;;GAEG;AACU,QAAA,oCAAoC,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3D;;;;;;;OAOG;IACH,QAAQ,EAAE,qBAAY;SACnB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;QACnC,OAAO,EAAE,gDAAgD;KAC1D,CAAC;SACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;QACnC,OAAO,EAAE,0CAA0C;KACpD,CAAC;IAEJ;;;;;;;OAOG;IACH,qBAAqB,EAAE,OAAC,CAAC,KAAK,CAAC,wDAA2B,CAAC,CAAC,QAAQ,EAAE;IAEtE;;;;;;;OAOG;IACH,QAAQ,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAEjC;;;;;OAKG;IACH,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEhD;;;;;OAKG;IACH,wBAAwB,EAAE,OAAC;SACxB,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;SAC1C,QAAQ,EAAE;IAEb;;;;;;OAMG;IACH,qCAAqC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAErE;;;OAGG;IACH,sBAAsB,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAE/C;;;;OAIG;IACH,mBAAmB,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAE5C;;;OAGG;IACH,gBAAgB,EAAE,qBAAY,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { oauthIssuerIdentifierSchema } from './oauth-issuer-identifier.js'\nimport { webUriSchema } from './uri.js'\n\n/**\n * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-05#name-protected-resource-metadata-r}\n */\nexport const oauthProtectedResourceMetadataSchema = z.object({\n  /**\n   * REQUIRED. The protected resource's resource identifier, which is a URL that\n   * uses the https scheme and has no query or fragment components. Using these\n   * well-known resources is described in Section 3.\n   *\n   * @note This schema allows non https URLs for testing & development purposes.\n   * Make sure to validate the URL before using it in a production environment.\n   */\n  resource: webUriSchema\n    .refine((url) => !url.includes('?'), {\n      message: 'Resource URL must not contain query parameters',\n    })\n    .refine((url) => !url.includes('#'), {\n      message: 'Resource URL must not contain a fragment',\n    }),\n\n  /**\n   * OPTIONAL. JSON array containing a list of OAuth authorization server issuer\n   * identifiers, as defined in [RFC8414], for authorization servers that can be\n   * used with this protected resource. Protected resources MAY choose not to\n   * advertise some supported authorization servers even when this parameter is\n   * used. In some use cases, the set of authorization servers will not be\n   * enumerable, in which case this metadata parameter would not be used.\n   */\n  authorization_servers: z.array(oauthIssuerIdentifierSchema).optional(),\n\n  /**\n   * OPTIONAL. URL of the protected resource's JWK Set [JWK] document. This\n   * contains public keys belonging to the protected resource, such as signing\n   * key(s) that the resource server uses to sign resource responses. This URL\n   * MUST use the https scheme. When both signing and encryption keys are made\n   * available, a use (public key use) parameter value is REQUIRED for all keys\n   * in the referenced JWK Set to indicate each key's intended usage.\n   */\n  jwks_uri: webUriSchema.optional(),\n\n  /**\n   * RECOMMENDED. JSON array containing a list of the OAuth 2.0 [RFC6749] scope\n   * values that are used in authorization requests to request access to this\n   * protected resource. Protected resources MAY choose not to advertise some\n   * scope values supported even when this parameter is used.\n   */\n  scopes_supported: z.array(z.string()).optional(),\n\n  /**\n   * OPTIONAL. JSON array containing a list of the supported methods of sending\n   * an OAuth 2.0 Bearer Token [RFC6750] to the protected resource. Defined\n   * values are [\"header\", \"body\", \"query\"], corresponding to Sections 2.1, 2.2,\n   * and 2.3 of RFC 6750.\n   */\n  bearer_methods_supported: z\n    .array(z.enum(['header', 'body', 'query']))\n    .optional(),\n\n  /**\n   * OPTIONAL. JSON array containing a list of the JWS [JWS] signing algorithms\n   * (alg values) [JWA] supported by the protected resource for signing resource\n   * responses, for instance, as described in [FAPI.MessageSigning]. No default\n   * algorithms are implied if this entry is omitted. The value none MUST NOT be\n   * used.\n   */\n  resource_signing_alg_values_supported: z.array(z.string()).optional(),\n\n  /**\n   * OPTIONAL. URL of a page containing human-readable information that\n   * developers might want or need to know when using the protected resource\n   */\n  resource_documentation: webUriSchema.optional(),\n\n  /**\n   * OPTIONAL. URL that the protected resource provides to read about the\n   * protected resource's requirements on how the client can use the data\n   * provided by the protected resource\n   */\n  resource_policy_uri: webUriSchema.optional(),\n\n  /**\n   * OPTIONAL. URL that the protected resource provides to read about the\n   * protected resource's terms of service\n   */\n  resource_tos_uri: webUriSchema.optional(),\n})\n\nexport type OAuthProtectedResourceMetadata = z.infer<\n  typeof oauthProtectedResourceMetadataSchema\n>\n"]}
+{"version":3,"file":"oauth-protected-resource-metadata.js","sourceRoot":"","sources":["../src/oauth-protected-resource-metadata.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,6EAA0E;AAC1E,qCAAuC;AAEvC;;GAEG;AACU,QAAA,oCAAoC,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3D;;;;;;;OAOG;IACH,QAAQ,EAAE,qBAAY;SACnB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;QACnC,OAAO,EAAE,gDAAgD;KAC1D,CAAC;SACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;QACnC,OAAO,EAAE,0CAA0C;KACpD,CAAC;IAEJ;;;;;;;OAOG;IACH,qBAAqB,EAAE,OAAC,CAAC,KAAK,CAAC,wDAA2B,CAAC,CAAC,QAAQ,EAAE;IAEtE;;;;;;;OAOG;IACH,QAAQ,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAEjC;;;;;OAKG;IACH,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEhD;;;;;OAKG;IACH,wBAAwB,EAAE,OAAC;SACxB,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;SAC1C,QAAQ,EAAE;IAEb;;;;;;OAMG;IACH,qCAAqC,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAErE;;;OAGG;IACH,sBAAsB,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAE/C;;;;OAIG;IACH,mBAAmB,EAAE,qBAAY,CAAC,QAAQ,EAAE;IAE5C;;;OAGG;IACH,gBAAgB,EAAE,qBAAY,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { oauthIssuerIdentifierSchema } from './oauth-issuer-identifier.js'\nimport { webUriSchema } from './uri.js'\n\n/**\n * @see {@link https://www.rfc-editor.org/rfc/rfc9728.html#section-3.2}\n */\nexport const oauthProtectedResourceMetadataSchema = z.object({\n  /**\n   * REQUIRED. The protected resource's resource identifier, which is a URL that\n   * uses the https scheme and has no query or fragment components. Using these\n   * well-known resources is described in Section 3.\n   *\n   * @note This schema allows non https URLs for testing & development purposes.\n   * Make sure to validate the URL before using it in a production environment.\n   */\n  resource: webUriSchema\n    .refine((url) => !url.includes('?'), {\n      message: 'Resource URL must not contain query parameters',\n    })\n    .refine((url) => !url.includes('#'), {\n      message: 'Resource URL must not contain a fragment',\n    }),\n\n  /**\n   * OPTIONAL. JSON array containing a list of OAuth authorization server issuer\n   * identifiers, as defined in [RFC8414], for authorization servers that can be\n   * used with this protected resource. Protected resources MAY choose not to\n   * advertise some supported authorization servers even when this parameter is\n   * used. In some use cases, the set of authorization servers will not be\n   * enumerable, in which case this metadata parameter would not be used.\n   */\n  authorization_servers: z.array(oauthIssuerIdentifierSchema).optional(),\n\n  /**\n   * OPTIONAL. URL of the protected resource's JWK Set [JWK] document. This\n   * contains public keys belonging to the protected resource, such as signing\n   * key(s) that the resource server uses to sign resource responses. This URL\n   * MUST use the https scheme. When both signing and encryption keys are made\n   * available, a use (public key use) parameter value is REQUIRED for all keys\n   * in the referenced JWK Set to indicate each key's intended usage.\n   */\n  jwks_uri: webUriSchema.optional(),\n\n  /**\n   * RECOMMENDED. JSON array containing a list of the OAuth 2.0 [RFC6749] scope\n   * values that are used in authorization requests to request access to this\n   * protected resource. Protected resources MAY choose not to advertise some\n   * scope values supported even when this parameter is used.\n   */\n  scopes_supported: z.array(z.string()).optional(),\n\n  /**\n   * OPTIONAL. JSON array containing a list of the supported methods of sending\n   * an OAuth 2.0 Bearer Token [RFC6750] to the protected resource. Defined\n   * values are [\"header\", \"body\", \"query\"], corresponding to Sections 2.1, 2.2,\n   * and 2.3 of RFC 6750.\n   */\n  bearer_methods_supported: z\n    .array(z.enum(['header', 'body', 'query']))\n    .optional(),\n\n  /**\n   * OPTIONAL. JSON array containing a list of the JWS [JWS] signing algorithms\n   * (alg values) [JWA] supported by the protected resource for signing resource\n   * responses, for instance, as described in [FAPI.MessageSigning]. No default\n   * algorithms are implied if this entry is omitted. The value none MUST NOT be\n   * used.\n   */\n  resource_signing_alg_values_supported: z.array(z.string()).optional(),\n\n  /**\n   * OPTIONAL. URL of a page containing human-readable information that\n   * developers might want or need to know when using the protected resource\n   */\n  resource_documentation: webUriSchema.optional(),\n\n  /**\n   * OPTIONAL. URL that the protected resource provides to read about the\n   * protected resource's requirements on how the client can use the data\n   * provided by the protected resource\n   */\n  resource_policy_uri: webUriSchema.optional(),\n\n  /**\n   * OPTIONAL. URL that the protected resource provides to read about the\n   * protected resource's terms of service\n   */\n  resource_tos_uri: webUriSchema.optional(),\n})\n\nexport type OAuthProtectedResourceMetadata = z.infer<\n  typeof oauthProtectedResourceMetadataSchema\n>\n"]}

package/dist/oauth-redirect-uri.d.ts

@@ -1,10 +1,22 @@
 import { TypeOf, z } from 'zod';
-export declare const oauthLoopbackRedirectURISchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, `${string}:${string}`, string>, `http://[::1]${string}` | "http://localhost" | `http://localhost#${string}` | `http://localhost?${string}` | `http://localhost/${string}` | `http://localhost:${string}` | "http://127.0.0.1" | `http://127.0.0.1#${string}` | `http://127.0.0.1?${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}`, string>, `http://[::1]${string}` | "http://127.0.0.1" | `http://127.0.0.1#${string}` | `http://127.0.0.1?${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}`, string>;
-export type OAuthLoopbackRedirectURI = TypeOf<typeof oauthLoopbackRedirectURISchema>;
-export declare const oauthHttpsRedirectURISchema: z.ZodEffects<z.ZodEffects<z.ZodString, `${string}:${string}`, string>, `https://${string}`, string>;
-export type OAuthHttpsRedirectURI = TypeOf<typeof oauthHttpsRedirectURISchema>;
-export declare const oauthPrivateUseRedirectURISchema: z.ZodEffects<z.ZodEffects<z.ZodString, `${string}:${string}`, string>, `${string}.${string}:/${string}`, string>;
-export type OAuthPrivateUseRedirectURI = TypeOf<typeof oauthPrivateUseRedirectURISchema>;
+/**
+ * This is a {@link loopbackUriSchema} with the additional restriction that
+ * the hostname `localhost` is not allowed.
+ *
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc8252#section-8.3 Loopback Redirect Considerations} RFC8252
+ *
+ * > While redirect URIs using localhost (i.e.,
+ * > "http://localhost:{port}/{path}") function similarly to loopback IP
+ * > redirects described in Section 7.3, the use of localhost is NOT
+ * > RECOMMENDED. Specifying a redirect URI with the loopback IP literal rather
+ * > than localhost avoids inadvertently listening on network interfaces other
+ * > than the loopback interface.  It is also less susceptible to client-side
+ * > firewalls and misconfigured host name resolution on the user's device.
+ */
+export declare const loopbackRedirectURISchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, `${string}:${string}`, string>, `http://[::1]${string}` | "http://localhost" | `http://localhost#${string}` | `http://localhost?${string}` | `http://localhost/${string}` | `http://localhost:${string}` | "http://127.0.0.1" | `http://127.0.0.1#${string}` | `http://127.0.0.1?${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}`, string>, `http://[::1]${string}` | "http://127.0.0.1" | `http://127.0.0.1#${string}` | `http://127.0.0.1?${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}`, string>;
+export type LoopbackRedirectURI = TypeOf<typeof loopbackRedirectURISchema>;
+export declare const oauthLoopbackClientRedirectUriSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, `${string}:${string}`, string>, `http://[::1]${string}` | "http://localhost" | `http://localhost#${string}` | `http://localhost?${string}` | `http://localhost/${string}` | `http://localhost:${string}` | "http://127.0.0.1" | `http://127.0.0.1#${string}` | `http://127.0.0.1?${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}`, string>, `http://[::1]${string}` | "http://127.0.0.1" | `http://127.0.0.1#${string}` | `http://127.0.0.1?${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}`, string>;
+export type OAuthLoopbackRedirectURI = TypeOf<typeof oauthLoopbackClientRedirectUriSchema>;
 export declare const oauthRedirectUriSchema: z.ZodUnion<[z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, `${string}:${string}`, string>, `http://[::1]${string}` | "http://localhost" | `http://localhost#${string}` | `http://localhost?${string}` | `http://localhost/${string}` | `http://localhost:${string}` | "http://127.0.0.1" | `http://127.0.0.1#${string}` | `http://127.0.0.1?${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}`, string>, `http://[::1]${string}` | "http://127.0.0.1" | `http://127.0.0.1#${string}` | `http://127.0.0.1?${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}`, string>, z.ZodEffects<z.ZodEffects<z.ZodString, `${string}:${string}`, string>, `https://${string}`, string>, z.ZodEffects<z.ZodEffects<z.ZodString, `${string}:${string}`, string>, `${string}.${string}:/${string}`, string>]>;
 export type OAuthRedirectUri = TypeOf<typeof oauthRedirectUriSchema>;
 //# sourceMappingURL=oauth-redirect-uri.d.ts.map

package/dist/oauth-redirect-uri.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-redirect-uri.d.ts","sourceRoot":"","sources":["../src/oauth-redirect-uri.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAA;AAQ7C,eAAO,MAAM,8BAA8B,2kBAuB1C,CAAA;AACD,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAC3C,OAAO,8BAA8B,CACtC,CAAA;AAED,eAAO,MAAM,2BAA2B,qGAAiB,CAAA;AACzD,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAE9E,eAAO,MAAM,gCAAgC,kHAAsB,CAAA;AACnE,MAAM,MAAM,0BAA0B,GAAG,MAAM,CAC7C,OAAO,gCAAgC,CACxC,CAAA;AAED,eAAO,MAAM,sBAAsB,gzBASlC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAA"}
+{"version":3,"file":"oauth-redirect-uri.d.ts","sourceRoot":"","sources":["../src/oauth-redirect-uri.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAA;AAQ7C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,2kBAarC,CAAA;AACD,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAE1E,eAAO,MAAM,oCAAoC,2kBAA4B,CAAA;AAC7E,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAC3C,OAAO,oCAAoC,CAC5C,CAAA;AAED,eAAO,MAAM,sBAAsB,gzBAKlC,CAAA;AACD,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAA"}

package/dist/oauth-redirect-uri.js

@@ -1,20 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.oauthRedirectUriSchema = exports.oauthPrivateUseRedirectURISchema = exports.oauthHttpsRedirectURISchema = exports.oauthLoopbackRedirectURISchema = void 0;
+exports.oauthRedirectUriSchema = exports.oauthLoopbackClientRedirectUriSchema = exports.loopbackRedirectURISchema = void 0;
 const zod_1 = require("zod");
 const uri_js_1 = require("./uri.js");
-exports.oauthLoopbackRedirectURISchema = uri_js_1.loopbackUriSchema.superRefine((value, ctx) => {
+/**
+ * This is a {@link loopbackUriSchema} with the additional restriction that
+ * the hostname `localhost` is not allowed.
+ *
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc8252#section-8.3 Loopback Redirect Considerations} RFC8252
+ *
+ * > While redirect URIs using localhost (i.e.,
+ * > "http://localhost:{port}/{path}") function similarly to loopback IP
+ * > redirects described in Section 7.3, the use of localhost is NOT
+ * > RECOMMENDED. Specifying a redirect URI with the loopback IP literal rather
+ * > than localhost avoids inadvertently listening on network interfaces other
+ * > than the loopback interface.  It is also less susceptible to client-side
+ * > firewalls and misconfigured host name resolution on the user's device.
+ */
+exports.loopbackRedirectURISchema = uri_js_1.loopbackUriSchema.superRefine((value, ctx) => {
     if (value.startsWith('http://localhost')) {
-        // https://datatracker.ietf.org/doc/html/rfc8252#section-8.3
-        //
-        // > While redirect URIs using localhost (i.e.,
-        // > "http://localhost:{port}/{path}") function similarly to loopback IP
-        // > redirects described in Section 7.3, the use of localhost is NOT
-        // > RECOMMENDED.  Specifying a redirect URI with the loopback IP literal
-        // > rather than localhost avoids inadvertently listening on network
-        // > interfaces other than the loopback interface.  It is also less
-        // > susceptible to client-side firewalls and misconfigured host name
-        // > resolution on the user's device.
         ctx.addIssue({
             code: zod_1.ZodIssueCode.custom,
             message: 'Use of "localhost" hostname is not allowed (RFC 8252), use a loopback IP such as "127.0.0.1" instead',
@@ -23,13 +27,8 @@ exports.oauthLoopbackRedirectURISchema = uri_js_1.loopbackUriSchema.superRefine(
     }
     return true;
 });
-exports.oauthHttpsRedirectURISchema = uri_js_1.httpsUriSchema;
-exports.oauthPrivateUseRedirectURISchema = uri_js_1.privateUseUriSchema;
-exports.oauthRedirectUriSchema = zod_1.z.union([
-    exports.oauthLoopbackRedirectURISchema,
-    exports.oauthHttpsRedirectURISchema,
-    exports.oauthPrivateUseRedirectURISchema,
-], {
+exports.oauthLoopbackClientRedirectUriSchema = exports.loopbackRedirectURISchema;
+exports.oauthRedirectUriSchema = zod_1.z.union([exports.loopbackRedirectURISchema, uri_js_1.httpsUriSchema, uri_js_1.privateUseUriSchema], {
     message: `URL must use the "https:" or "http:" protocol, or a private-use URI scheme (RFC 8252)`,
 });
 //# sourceMappingURL=oauth-redirect-uri.js.map

package/dist/oauth-redirect-uri.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-redirect-uri.js","sourceRoot":"","sources":["../src/oauth-redirect-uri.ts"],"names":[],"mappings":";;;AAAA,6BAA6C;AAC7C,qCAKiB;AAEJ,QAAA,8BAA8B,GAAG,0BAAiB,CAAC,WAAW,CACzE,CAAC,KAAK,EAAE,GAAG,EAA8D,EAAE;IACzE,IAAI,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACzC,4DAA4D;QAC5D,EAAE;QACF,+CAA+C;QAC/C,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,oEAAoE;QACpE,mEAAmE;QACnE,qEAAqE;QACrE,qCAAqC;QACrC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EACL,sGAAsG;SACzG,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CACF,CAAA;AAKY,QAAA,2BAA2B,GAAG,uBAAc,CAAA;AAG5C,QAAA,gCAAgC,GAAG,4BAAmB,CAAA;AAKtD,QAAA,sBAAsB,GAAG,OAAC,CAAC,KAAK,CAC3C;IACE,sCAA8B;IAC9B,mCAA2B;IAC3B,wCAAgC;CACjC,EACD;IACE,OAAO,EAAE,uFAAuF;CACjG,CACF,CAAA","sourcesContent":["import { TypeOf, ZodIssueCode, z } from 'zod'\nimport {\n  LoopbackUri,\n  httpsUriSchema,\n  loopbackUriSchema,\n  privateUseUriSchema,\n} from './uri.js'\n\nexport const oauthLoopbackRedirectURISchema = loopbackUriSchema.superRefine(\n  (value, ctx): value is Exclude<LoopbackUri, `http://localhost${string}`> => {\n    if (value.startsWith('http://localhost')) {\n      // https://datatracker.ietf.org/doc/html/rfc8252#section-8.3\n      //\n      // > While redirect URIs using localhost (i.e.,\n      // > \"http://localhost:{port}/{path}\") function similarly to loopback IP\n      // > redirects described in Section 7.3, the use of localhost is NOT\n      // > RECOMMENDED.  Specifying a redirect URI with the loopback IP literal\n      // > rather than localhost avoids inadvertently listening on network\n      // > interfaces other than the loopback interface.  It is also less\n      // > susceptible to client-side firewalls and misconfigured host name\n      // > resolution on the user's device.\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message:\n          'Use of \"localhost\" hostname is not allowed (RFC 8252), use a loopback IP such as \"127.0.0.1\" instead',\n      })\n      return false\n    }\n\n    return true\n  },\n)\nexport type OAuthLoopbackRedirectURI = TypeOf<\n  typeof oauthLoopbackRedirectURISchema\n>\n\nexport const oauthHttpsRedirectURISchema = httpsUriSchema\nexport type OAuthHttpsRedirectURI = TypeOf<typeof oauthHttpsRedirectURISchema>\n\nexport const oauthPrivateUseRedirectURISchema = privateUseUriSchema\nexport type OAuthPrivateUseRedirectURI = TypeOf<\n  typeof oauthPrivateUseRedirectURISchema\n>\n\nexport const oauthRedirectUriSchema = z.union(\n  [\n    oauthLoopbackRedirectURISchema,\n    oauthHttpsRedirectURISchema,\n    oauthPrivateUseRedirectURISchema,\n  ],\n  {\n    message: `URL must use the \"https:\" or \"http:\" protocol, or a private-use URI scheme (RFC 8252)`,\n  },\n)\n\nexport type OAuthRedirectUri = TypeOf<typeof oauthRedirectUriSchema>\n"]}
+{"version":3,"file":"oauth-redirect-uri.js","sourceRoot":"","sources":["../src/oauth-redirect-uri.ts"],"names":[],"mappings":";;;AAAA,6BAA6C;AAC7C,qCAKiB;AAEjB;;;;;;;;;;;;;GAaG;AACU,QAAA,yBAAyB,GAAG,0BAAiB,CAAC,WAAW,CACpE,CAAC,KAAK,EAAE,GAAG,EAA8D,EAAE;IACzE,IAAI,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EACL,sGAAsG;SACzG,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CACF,CAAA;AAGY,QAAA,oCAAoC,GAAG,iCAAyB,CAAA;AAKhE,QAAA,sBAAsB,GAAG,OAAC,CAAC,KAAK,CAC3C,CAAC,iCAAyB,EAAE,uBAAc,EAAE,4BAAmB,CAAC,EAChE;IACE,OAAO,EAAE,uFAAuF;CACjG,CACF,CAAA","sourcesContent":["import { TypeOf, ZodIssueCode, z } from 'zod'\nimport {\n  LoopbackUri,\n  httpsUriSchema,\n  loopbackUriSchema,\n  privateUseUriSchema,\n} from './uri.js'\n\n/**\n * This is a {@link loopbackUriSchema} with the additional restriction that\n * the hostname `localhost` is not allowed.\n *\n * @see {@link https://datatracker.ietf.org/doc/html/rfc8252#section-8.3 Loopback Redirect Considerations} RFC8252\n *\n * > While redirect URIs using localhost (i.e.,\n * > \"http://localhost:{port}/{path}\") function similarly to loopback IP\n * > redirects described in Section 7.3, the use of localhost is NOT\n * > RECOMMENDED. Specifying a redirect URI with the loopback IP literal rather\n * > than localhost avoids inadvertently listening on network interfaces other\n * > than the loopback interface.  It is also less susceptible to client-side\n * > firewalls and misconfigured host name resolution on the user's device.\n */\nexport const loopbackRedirectURISchema = loopbackUriSchema.superRefine(\n  (value, ctx): value is Exclude<LoopbackUri, `http://localhost${string}`> => {\n    if (value.startsWith('http://localhost')) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message:\n          'Use of \"localhost\" hostname is not allowed (RFC 8252), use a loopback IP such as \"127.0.0.1\" instead',\n      })\n      return false\n    }\n\n    return true\n  },\n)\nexport type LoopbackRedirectURI = TypeOf<typeof loopbackRedirectURISchema>\n\nexport const oauthLoopbackClientRedirectUriSchema = loopbackRedirectURISchema\nexport type OAuthLoopbackRedirectURI = TypeOf<\n  typeof oauthLoopbackClientRedirectUriSchema\n>\n\nexport const oauthRedirectUriSchema = z.union(\n  [loopbackRedirectURISchema, httpsUriSchema, privateUseUriSchema],\n  {\n    message: `URL must use the \"https:\" or \"http:\" protocol, or a private-use URI scheme (RFC 8252)`,\n  },\n)\nexport type OAuthRedirectUri = TypeOf<typeof oauthRedirectUriSchema>\n"]}

package/dist/uri.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uri.d.ts","sourceRoot":"","sources":["../src/uri.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAA;AAgB7C;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,0DAQ5B,CAAA;AAEH;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE5D,eAAO,MAAM,iBAAiB,2YA6B7B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE1D,eAAO,MAAM,cAAc,qGA6C1B,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAA;AAEpD,eAAO,MAAM,YAAY,oXAqBrB,CAAA;AAEJ,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,YAAY,CAAC,CAAA;AAEhD,eAAO,MAAM,mBAAmB,kHAsC/B,CAAA;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAA"}
+{"version":3,"file":"uri.d.ts","sourceRoot":"","sources":["../src/uri.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAA;AAQ7C;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,0DAQ5B,CAAA;AAEH;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE5D,eAAO,MAAM,iBAAiB,2YA6B7B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE1D,eAAO,MAAM,cAAc,qGA6C1B,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAA;AAEpD,eAAO,MAAM,YAAY,oXAqBrB,CAAA;AAEJ,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,YAAY,CAAC,CAAA;AAEhD,eAAO,MAAM,mBAAmB,kHAkF/B,CAAA;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAA"}

package/dist/uri.js

@@ -3,19 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.privateUseUriSchema = exports.webUriSchema = exports.httpsUriSchema = exports.loopbackUriSchema = exports.dangerousUriSchema = void 0;
 const zod_1 = require("zod");
 const util_js_1 = require("./util.js");
-const canParseUrl = 
-// eslint-disable-next-line n/no-unsupported-features/node-builtins
-URL.canParse?.bind(URL) ??
-    // URL.canParse is not available in Node.js < 18.7.0
-    ((urlStr) => {
-        try {
-            new URL(urlStr);
-            return true;
-        }
-        catch {
-            return false;
-        }
-    });
 /**
  * Valid, but potentially dangerous URL (`data:`, `file:`, `javascript:`, etc.).
  *
@@ -23,7 +10,7 @@ URL.canParse?.bind(URL) ??
  */
 exports.dangerousUriSchema = zod_1.z
     .string()
-    .refine((data) => data.includes(':') && canParseUrl(data), {
+    .refine((data) => data.includes(':') && (0, util_js_1.canParseUrl)(data), {
     message: 'Invalid URL',
 });
 exports.loopbackUriSchema = exports.dangerousUriSchema.superRefine((value, ctx) => {
@@ -127,11 +114,51 @@ exports.privateUseUriSchema = exports.dangerousUriSchema.superRefine((value, ctx
         });
         return false;
     }
-    if (url.hostname) {
-        // https://datatracker.ietf.org/doc/html/rfc8252#section-7.1
+    // https://datatracker.ietf.org/doc/html/rfc8252#section-7.1
+    //
+    // > When choosing a URI scheme to associate with the app, apps MUST use a
+    // > URI scheme based on a domain name under their control, expressed in
+    // > reverse order
+    //
+    // https://datatracker.ietf.org/doc/html/rfc8252#section-8.4
+    //
+    // > In addition to the collision-resistant properties, requiring a URI
+    // > scheme based on a domain name that is under the control of the app can
+    // > help to prove ownership in the event of a dispute where two apps claim
+    // > the same private-use URI scheme (where one app is acting maliciously).
+    //
+    // We can't check for ownership here (as there is no concept of proven
+    // ownership in a generic validation logic), besides excluding local domains
+    // as they can't be controlled/owned by the app.
+    //
+    // https://atproto.com/specs/oauth
+    //
+    // > Any custom scheme must match the `client_id` hostname in reverse-domain
+    // > order.
+    //
+    // This ATPROTO specific requirement cannot be enforced here, (as there is
+    // no concept of `client_id` in this context).
+    const uriScheme = url.protocol.slice(0, -1); // remove trailing ":"
+    const urlDomain = uriScheme.split('.').reverse().join('.');
+    if ((0, util_js_1.isLocalHostname)(urlDomain)) {
+        ctx.addIssue({
+            code: zod_1.ZodIssueCode.custom,
+            message: `Private-use URI Scheme redirect URI must not be a local hostname`,
+        });
+    }
+    // https://datatracker.ietf.org/doc/html/rfc8252#section-7.1
+    //
+    // > Following the requirements of Section 3.2 of [RFC3986], as there is no
+    // > naming authority for private-use URI scheme redirects, only a single
+    // > slash ("/") appears after the scheme component.
+    if (url.href.startsWith(`${url.protocol}//`) ||
+        url.username ||
+        url.password ||
+        url.hostname ||
+        url.port) {
         ctx.addIssue({
             code: zod_1.ZodIssueCode.custom,
-            message: 'Private-use URI schemes must not include a hostname (only one "/" is allowed after the protocol, as per RFC 8252)',
+            message: `Private-Use URI Scheme must be in the form ${url.protocol}/<path> (as per RFC 8252)`,
         });
         return false;
     }

package/dist/uri.js.map

@@ -1 +1 @@
-{"version":3,"file":"uri.js","sourceRoot":"","sources":["../src/uri.ts"],"names":[],"mappings":";;;AAAA,6BAA6C;AAC7C,uCAAwD;AAExD,MAAM,WAAW;AACf,mEAAmE;AACnE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC;IACvB,oDAAoD;IACpD,CAAC,CAAC,MAAc,EAAW,EAAE;QAC3B,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;YACf,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;AAEJ;;;;GAIG;AACU,QAAA,kBAAkB,GAAG,OAAC;KAChC,MAAM,EAAE;KACR,MAAM,CACL,CAAC,IAAI,EAAiC,EAAE,CACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EACzC;IACE,OAAO,EAAE,aAAa;CACvB,CACF,CAAA;AAOU,QAAA,iBAAiB,GAAG,0BAAkB,CAAC,WAAW,CAC7D,CACE,KAAK,EACL,GAAG,EAI6D,EAAE;IAClE,6CAA6C;IAC7C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAE1B,IAAI,CAAC,IAAA,wBAAc,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EAAE,8DAA8D;SACxE,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CACF,CAAA;AAIY,QAAA,cAAc,GAAG,0BAAkB,CAAC,WAAW,CAC1D,CAAC,KAAK,EAAE,GAAG,EAAgC,EAAE;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAE1B,oDAAoD;IACpD,IAAI,IAAA,wBAAc,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,IAAA,sBAAY,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,4BAA4B;IAC9B,CAAC;SAAM,CAAC;QACN,4BAA4B;QAC5B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,0DAA0D;YAC1D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,kBAAY,CAAC,MAAM;gBACzB,OAAO,EAAE,gDAAgD;aAC1D,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,kBAAY,CAAC,MAAM;gBACzB,OAAO,EAAE,wCAAwC;aAClD,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CACF,CAAA;AAIY,QAAA,YAAY,GAAG,OAAC;KAC1B,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAmC,EAAE;IAC3D,kEAAkE;IAClE,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,yBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QACnE,OAAO,MAAM,CAAC,OAAO,CAAA;IACvB,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,sBAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QACnE,OAAO,MAAM,CAAC,OAAO,CAAA;IACvB,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC;QACX,IAAI,EAAE,kBAAY,CAAC,MAAM;QACzB,OAAO,EAAE,+CAA+C;KACzD,CAAC,CAAA;IACF,OAAO,KAAK,CAAA;AACd,CAAC,CAAC,CAAA;AAIS,QAAA,mBAAmB,GAAG,0BAAkB,CAAC,WAAW,CAC/D,CAAC,KAAK,EAAE,GAAG,EAA6C,EAAE;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAEnC,6EAA6E;IAC7E,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC1D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EACL,+DAA+D;SAClE,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAE1B,iEAAiE;IACjE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,4DAA4D;QAC5D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EACL,mHAAmH;SACtH,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CACF,CAAA","sourcesContent":["import { TypeOf, ZodIssueCode, z } from 'zod'\nimport { isHostnameIP, isLoopbackHost } from './util.js'\n\nconst canParseUrl =\n  // eslint-disable-next-line n/no-unsupported-features/node-builtins\n  URL.canParse?.bind(URL) ??\n  // URL.canParse is not available in Node.js < 18.7.0\n  ((urlStr: string): boolean => {\n    try {\n      new URL(urlStr)\n      return true\n    } catch {\n      return false\n    }\n  })\n\n/**\n * Valid, but potentially dangerous URL (`data:`, `file:`, `javascript:`, etc.).\n *\n * Any value that matches this schema is safe to parse using `new URL()`.\n */\nexport const dangerousUriSchema = z\n  .string()\n  .refine(\n    (data): data is `${string}:${string}` =>\n      data.includes(':') && canParseUrl(data),\n    {\n      message: 'Invalid URL',\n    },\n  )\n\n/**\n * Valid, but potentially dangerous URL (`data:`, `file:`, `javascript:`, etc.).\n */\nexport type DangerousUrl = TypeOf<typeof dangerousUriSchema>\n\nexport const loopbackUriSchema = dangerousUriSchema.superRefine(\n  (\n    value,\n    ctx,\n  ): value is\n    | `http://[::1]${string}`\n    | `http://localhost${'' | `${':' | '/' | '?' | '#'}${string}`}`\n    | `http://127.0.0.1${'' | `${':' | '/' | '?' | '#'}${string}`}` => {\n    // Loopback url must use the \"http:\" protocol\n    if (!value.startsWith('http://')) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: 'URL must use the \"http:\" protocol',\n      })\n      return false\n    }\n\n    const url = new URL(value)\n\n    if (!isLoopbackHost(url.hostname)) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: 'URL must use \"localhost\", \"127.0.0.1\" or \"[::1]\" as hostname',\n      })\n      return false\n    }\n\n    return true\n  },\n)\n\nexport type LoopbackUri = TypeOf<typeof loopbackUriSchema>\n\nexport const httpsUriSchema = dangerousUriSchema.superRefine(\n  (value, ctx): value is `https://${string}` => {\n    if (!value.startsWith('https://')) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: 'URL must use the \"https:\" protocol',\n      })\n      return false\n    }\n\n    const url = new URL(value)\n\n    // Disallow loopback URLs with the `https:` protocol\n    if (isLoopbackHost(url.hostname)) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: 'https: URL must not use a loopback host',\n      })\n      return false\n    }\n\n    if (isHostnameIP(url.hostname)) {\n      // Hostname is an IP address\n    } else {\n      // Hostname is a domain name\n      if (!url.hostname.includes('.')) {\n        // we don't depend on PSL here, so we only check for a dot\n        ctx.addIssue({\n          code: ZodIssueCode.custom,\n          message: 'Domain name must contain at least two segments',\n        })\n        return false\n      }\n\n      if (url.hostname.endsWith('.local')) {\n        ctx.addIssue({\n          code: ZodIssueCode.custom,\n          message: 'Domain name must not end with \".local\"',\n        })\n        return false\n      }\n    }\n\n    return true\n  },\n)\n\nexport type HttpsUri = TypeOf<typeof httpsUriSchema>\n\nexport const webUriSchema = z\n  .string()\n  .superRefine((value, ctx): value is LoopbackUri | HttpsUri => {\n    // discriminated union of `loopbackUriSchema` and `httpsUriSchema`\n    if (value.startsWith('http://')) {\n      const result = loopbackUriSchema.safeParse(value)\n      if (!result.success) result.error.issues.forEach(ctx.addIssue, ctx)\n      return result.success\n    }\n\n    if (value.startsWith('https://')) {\n      const result = httpsUriSchema.safeParse(value)\n      if (!result.success) result.error.issues.forEach(ctx.addIssue, ctx)\n      return result.success\n    }\n\n    ctx.addIssue({\n      code: ZodIssueCode.custom,\n      message: 'URL must use the \"http:\" or \"https:\" protocol',\n    })\n    return false\n  })\n\nexport type WebUri = TypeOf<typeof webUriSchema>\n\nexport const privateUseUriSchema = dangerousUriSchema.superRefine(\n  (value, ctx): value is `${string}.${string}:/${string}` => {\n    const dotIdx = value.indexOf('.')\n    const colonIdx = value.indexOf(':')\n\n    // Optimization: avoid parsing the URL if the protocol does not contain a \".\"\n    if (dotIdx === -1 || colonIdx === -1 || dotIdx > colonIdx) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message:\n          'Private-use URI scheme requires a \".\" as part of the protocol',\n      })\n      return false\n    }\n\n    const url = new URL(value)\n\n    // Should be covered by the check before, but let's be extra sure\n    if (!url.protocol.includes('.')) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: 'Invalid private-use URI scheme',\n      })\n      return false\n    }\n\n    if (url.hostname) {\n      // https://datatracker.ietf.org/doc/html/rfc8252#section-7.1\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message:\n          'Private-use URI schemes must not include a hostname (only one \"/\" is allowed after the protocol, as per RFC 8252)',\n      })\n      return false\n    }\n\n    return true\n  },\n)\n\nexport type PrivateUseUri = TypeOf<typeof privateUseUriSchema>\n"]}
+{"version":3,"file":"uri.js","sourceRoot":"","sources":["../src/uri.ts"],"names":[],"mappings":";;;AAAA,6BAA6C;AAC7C,uCAKkB;AAElB;;;;GAIG;AACU,QAAA,kBAAkB,GAAG,OAAC;KAChC,MAAM,EAAE;KACR,MAAM,CACL,CAAC,IAAI,EAAiC,EAAE,CACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAA,qBAAW,EAAC,IAAI,CAAC,EACzC;IACE,OAAO,EAAE,aAAa;CACvB,CACF,CAAA;AAOU,QAAA,iBAAiB,GAAG,0BAAkB,CAAC,WAAW,CAC7D,CACE,KAAK,EACL,GAAG,EAI6D,EAAE;IAClE,6CAA6C;IAC7C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAE1B,IAAI,CAAC,IAAA,wBAAc,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EAAE,8DAA8D;SACxE,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CACF,CAAA;AAIY,QAAA,cAAc,GAAG,0BAAkB,CAAC,WAAW,CAC1D,CAAC,KAAK,EAAE,GAAG,EAAgC,EAAE;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAE1B,oDAAoD;IACpD,IAAI,IAAA,wBAAc,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,IAAA,sBAAY,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,4BAA4B;IAC9B,CAAC;SAAM,CAAC;QACN,4BAA4B;QAC5B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,0DAA0D;YAC1D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,kBAAY,CAAC,MAAM;gBACzB,OAAO,EAAE,gDAAgD;aAC1D,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,kBAAY,CAAC,MAAM;gBACzB,OAAO,EAAE,wCAAwC;aAClD,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CACF,CAAA;AAIY,QAAA,YAAY,GAAG,OAAC;KAC1B,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAmC,EAAE;IAC3D,kEAAkE;IAClE,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,yBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QACnE,OAAO,MAAM,CAAC,OAAO,CAAA;IACvB,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,sBAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QACnE,OAAO,MAAM,CAAC,OAAO,CAAA;IACvB,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC;QACX,IAAI,EAAE,kBAAY,CAAC,MAAM;QACzB,OAAO,EAAE,+CAA+C;KACzD,CAAC,CAAA;IACF,OAAO,KAAK,CAAA;AACd,CAAC,CAAC,CAAA;AAIS,QAAA,mBAAmB,GAAG,0BAAkB,CAAC,WAAW,CAC/D,CAAC,KAAK,EAAE,GAAG,EAA6C,EAAE;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAEnC,6EAA6E;IAC7E,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC1D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EACL,+DAA+D;SAClE,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAE1B,iEAAiE;IACjE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,4DAA4D;IAC5D,EAAE;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,kBAAkB;IAClB,EAAE;IACF,4DAA4D;IAC5D,EAAE;IACF,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,EAAE;IACF,sEAAsE;IACtE,4EAA4E;IAC5E,gDAAgD;IAChD,EAAE;IACF,kCAAkC;IAClC,EAAE;IACF,4EAA4E;IAC5E,WAAW;IACX,EAAE;IACF,0EAA0E;IAC1E,8CAA8C;IAE9C,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,sBAAsB;IAClE,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAE1D,IAAI,IAAA,yBAAe,EAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EAAE,kEAAkE;SAC5E,CAAC,CAAA;IACJ,CAAC;IAED,4DAA4D;IAC5D,EAAE;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,oDAAoD;IACpD,IACE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,QAAQ,IAAI,CAAC;QACxC,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,IAAI,EACR,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,kBAAY,CAAC,MAAM;YACzB,OAAO,EAAE,8CAA8C,GAAG,CAAC,QAAQ,2BAA2B;SAC/F,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CACF,CAAA","sourcesContent":["import { TypeOf, ZodIssueCode, z } from 'zod'\nimport {\n  canParseUrl,\n  isHostnameIP,\n  isLocalHostname,\n  isLoopbackHost,\n} from './util.js'\n\n/**\n * Valid, but potentially dangerous URL (`data:`, `file:`, `javascript:`, etc.).\n *\n * Any value that matches this schema is safe to parse using `new URL()`.\n */\nexport const dangerousUriSchema = z\n  .string()\n  .refine(\n    (data): data is `${string}:${string}` =>\n      data.includes(':') && canParseUrl(data),\n    {\n      message: 'Invalid URL',\n    },\n  )\n\n/**\n * Valid, but potentially dangerous URL (`data:`, `file:`, `javascript:`, etc.).\n */\nexport type DangerousUrl = TypeOf<typeof dangerousUriSchema>\n\nexport const loopbackUriSchema = dangerousUriSchema.superRefine(\n  (\n    value,\n    ctx,\n  ): value is\n    | `http://[::1]${string}`\n    | `http://localhost${'' | `${':' | '/' | '?' | '#'}${string}`}`\n    | `http://127.0.0.1${'' | `${':' | '/' | '?' | '#'}${string}`}` => {\n    // Loopback url must use the \"http:\" protocol\n    if (!value.startsWith('http://')) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: 'URL must use the \"http:\" protocol',\n      })\n      return false\n    }\n\n    const url = new URL(value)\n\n    if (!isLoopbackHost(url.hostname)) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: 'URL must use \"localhost\", \"127.0.0.1\" or \"[::1]\" as hostname',\n      })\n      return false\n    }\n\n    return true\n  },\n)\n\nexport type LoopbackUri = TypeOf<typeof loopbackUriSchema>\n\nexport const httpsUriSchema = dangerousUriSchema.superRefine(\n  (value, ctx): value is `https://${string}` => {\n    if (!value.startsWith('https://')) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: 'URL must use the \"https:\" protocol',\n      })\n      return false\n    }\n\n    const url = new URL(value)\n\n    // Disallow loopback URLs with the `https:` protocol\n    if (isLoopbackHost(url.hostname)) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: 'https: URL must not use a loopback host',\n      })\n      return false\n    }\n\n    if (isHostnameIP(url.hostname)) {\n      // Hostname is an IP address\n    } else {\n      // Hostname is a domain name\n      if (!url.hostname.includes('.')) {\n        // we don't depend on PSL here, so we only check for a dot\n        ctx.addIssue({\n          code: ZodIssueCode.custom,\n          message: 'Domain name must contain at least two segments',\n        })\n        return false\n      }\n\n      if (url.hostname.endsWith('.local')) {\n        ctx.addIssue({\n          code: ZodIssueCode.custom,\n          message: 'Domain name must not end with \".local\"',\n        })\n        return false\n      }\n    }\n\n    return true\n  },\n)\n\nexport type HttpsUri = TypeOf<typeof httpsUriSchema>\n\nexport const webUriSchema = z\n  .string()\n  .superRefine((value, ctx): value is LoopbackUri | HttpsUri => {\n    // discriminated union of `loopbackUriSchema` and `httpsUriSchema`\n    if (value.startsWith('http://')) {\n      const result = loopbackUriSchema.safeParse(value)\n      if (!result.success) result.error.issues.forEach(ctx.addIssue, ctx)\n      return result.success\n    }\n\n    if (value.startsWith('https://')) {\n      const result = httpsUriSchema.safeParse(value)\n      if (!result.success) result.error.issues.forEach(ctx.addIssue, ctx)\n      return result.success\n    }\n\n    ctx.addIssue({\n      code: ZodIssueCode.custom,\n      message: 'URL must use the \"http:\" or \"https:\" protocol',\n    })\n    return false\n  })\n\nexport type WebUri = TypeOf<typeof webUriSchema>\n\nexport const privateUseUriSchema = dangerousUriSchema.superRefine(\n  (value, ctx): value is `${string}.${string}:/${string}` => {\n    const dotIdx = value.indexOf('.')\n    const colonIdx = value.indexOf(':')\n\n    // Optimization: avoid parsing the URL if the protocol does not contain a \".\"\n    if (dotIdx === -1 || colonIdx === -1 || dotIdx > colonIdx) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message:\n          'Private-use URI scheme requires a \".\" as part of the protocol',\n      })\n      return false\n    }\n\n    const url = new URL(value)\n\n    // Should be covered by the check before, but let's be extra sure\n    if (!url.protocol.includes('.')) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: 'Invalid private-use URI scheme',\n      })\n      return false\n    }\n\n    // https://datatracker.ietf.org/doc/html/rfc8252#section-7.1\n    //\n    // > When choosing a URI scheme to associate with the app, apps MUST use a\n    // > URI scheme based on a domain name under their control, expressed in\n    // > reverse order\n    //\n    // https://datatracker.ietf.org/doc/html/rfc8252#section-8.4\n    //\n    // > In addition to the collision-resistant properties, requiring a URI\n    // > scheme based on a domain name that is under the control of the app can\n    // > help to prove ownership in the event of a dispute where two apps claim\n    // > the same private-use URI scheme (where one app is acting maliciously).\n    //\n    // We can't check for ownership here (as there is no concept of proven\n    // ownership in a generic validation logic), besides excluding local domains\n    // as they can't be controlled/owned by the app.\n    //\n    // https://atproto.com/specs/oauth\n    //\n    // > Any custom scheme must match the `client_id` hostname in reverse-domain\n    // > order.\n    //\n    // This ATPROTO specific requirement cannot be enforced here, (as there is\n    // no concept of `client_id` in this context).\n\n    const uriScheme = url.protocol.slice(0, -1) // remove trailing \":\"\n    const urlDomain = uriScheme.split('.').reverse().join('.')\n\n    if (isLocalHostname(urlDomain)) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: `Private-use URI Scheme redirect URI must not be a local hostname`,\n      })\n    }\n\n    // https://datatracker.ietf.org/doc/html/rfc8252#section-7.1\n    //\n    // > Following the requirements of Section 3.2 of [RFC3986], as there is no\n    // > naming authority for private-use URI scheme redirects, only a single\n    // > slash (\"/\") appears after the scheme component.\n    if (\n      url.href.startsWith(`${url.protocol}//`) ||\n      url.username ||\n      url.password ||\n      url.hostname ||\n      url.port\n    ) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: `Private-Use URI Scheme must be in the form ${url.protocol}/<path> (as per RFC 8252)`,\n      })\n      return false\n    }\n\n    return true\n  },\n)\n\nexport type PrivateUseUri = TypeOf<typeof privateUseUriSchema>\n"]}

package/dist/util.d.ts

@@ -1,7 +1,8 @@
+export declare const canParseUrl: (url: string | URL, base?: string | URL) => boolean;
 export declare function isHostnameIP(hostname: string): boolean;
 export type LoopbackHost = 'localhost' | '127.0.0.1' | '[::1]';
 export declare function isLoopbackHost(host: unknown): host is LoopbackHost;
-export declare function isLoopbackUrl(input: URL | string): boolean;
+export declare function isLocalHostname(hostname: string): boolean;
 export declare function safeUrl(input: URL | string): URL | null;
 export declare function extractUrlPath(url: any): any;
 export declare const jsonObjectPreprocess: (val: unknown) => any;

package/dist/util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,WAQ5C;AAED,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,CAAA;AAE9D,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,YAAY,CAElE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,CAG1D;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,IAAI,CAMvD;AAED,wBAAgB,cAAc,CAAC,GAAG,KAAA,OAsCjC;AAED,eAAO,MAAM,oBAAoB,GAAI,KAAK,OAAO,QAUhD,CAAA;AAED,eAAO,MAAM,gBAAgB,GAAI,KAAK,OAAO,KAAG,OAM/C,CAAA;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,CAAC,EAAE,WAGlE;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,WAExD;AAED,wBAAgB,OAAO,CAAC,CAAC,EACvB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,SAAS,GAC7B,SAAS,GAAG,SAAS,CAAC,EAAE,CAI1B;AAED,MAAM,MAAM,mBAAmB,CAAC,KAAK,SAAS,MAAM,IAClD,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,GAAG,KAAK,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE,EAAE,CAAA;AAEpD,eAAO,MAAM,qBAAqB,GAAI,KAAK,SAAS,MAAM,EACxD,OAAO,KAAK,EACZ,OAAO,MAAM,KACZ,KAAK,IAAI,mBAAmB,CAAC,KAAK,CA+BpC,CAAA"}
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,qDAWpB,CAAA;AAEJ,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,WAQ5C;AAED,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,CAAA;AAE9D,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,YAAY,CAElE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAYzD;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,IAAI,CAMvD;AAED,wBAAgB,cAAc,CAAC,GAAG,KAAA,OAsCjC;AAED,eAAO,MAAM,oBAAoB,GAAI,KAAK,OAAO,QAUhD,CAAA;AAED,eAAO,MAAM,gBAAgB,GAAI,KAAK,OAAO,KAAG,OAM/C,CAAA;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,CAAC,EAAE,WAGlE;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,WAExD;AAED,wBAAgB,OAAO,CAAC,CAAC,EACvB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,SAAS,GAC7B,SAAS,GAAG,SAAS,CAAC,EAAE,CAI1B;AAED,MAAM,MAAM,mBAAmB,CAAC,KAAK,SAAS,MAAM,IAClD,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,GAAG,KAAK,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE,EAAE,CAAA;AAEpD,eAAO,MAAM,qBAAqB,GAAI,KAAK,SAAS,MAAM,EACxD,OAAO,KAAK,EACZ,OAAO,MAAM,KACZ,KAAK,IAAI,mBAAmB,CAAC,KAAK,CA+BpC,CAAA"}

package/dist/util.js

@@ -1,14 +1,27 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isSpaceSeparatedValue = exports.numberPreprocess = exports.jsonObjectPreprocess = void 0;
+exports.isSpaceSeparatedValue = exports.numberPreprocess = exports.jsonObjectPreprocess = exports.canParseUrl = void 0;
 exports.isHostnameIP = isHostnameIP;
 exports.isLoopbackHost = isLoopbackHost;
-exports.isLoopbackUrl = isLoopbackUrl;
+exports.isLocalHostname = isLocalHostname;
 exports.safeUrl = safeUrl;
 exports.extractUrlPath = extractUrlPath;
 exports.arrayEquivalent = arrayEquivalent;
 exports.includedIn = includedIn;
 exports.asArray = asArray;
+exports.canParseUrl = 
+// eslint-disable-next-line n/no-unsupported-features/node-builtins
+URL.canParse?.bind(URL) ??
+    // URL.canParse is not available in Node.js < 18.7.0
+    ((urlStr) => {
+        try {
+            new URL(urlStr);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
 function isHostnameIP(hostname) {
     // IPv4
     if (hostname.match(/^\d+\.\d+\.\d+\.\d+$/))
@@ -21,9 +34,16 @@ function isHostnameIP(hostname) {
 function isLoopbackHost(host) {
     return host === 'localhost' || host === '127.0.0.1' || host === '[::1]';
 }
-function isLoopbackUrl(input) {
-    const url = typeof input === 'string' ? new URL(input) : input;
-    return isLoopbackHost(url.hostname);
+function isLocalHostname(hostname) {
+    const parts = hostname.split('.');
+    if (parts.length < 2)
+        return true;
+    const tld = parts.at(-1).toLowerCase();
+    return (tld === 'test' ||
+        tld === 'local' ||
+        tld === 'localhost' ||
+        tld === 'invalid' ||
+        tld === 'example');
 }
 function safeUrl(input) {
     try {

package/dist/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";;;AAAA,oCAQC;AAID,wCAEC;AAED,sCAGC;AAED,0BAMC;AAED,wCAsCC;AA0BD,0CAGC;AAED,gCAEC;AAED,0BAMC;AA5GD,SAAgB,YAAY,CAAC,QAAgB;IAC3C,OAAO;IACP,IAAI,QAAQ,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAAE,OAAO,IAAI,CAAA;IAEvD,OAAO;IACP,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEnE,OAAO,KAAK,CAAA;AACd,CAAC;AAID,SAAgB,cAAc,CAAC,IAAa;IAC1C,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,CAAA;AACzE,CAAC;AAED,SAAgB,aAAa,CAAC,KAAmB;IAC/C,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9D,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;AACrC,CAAC;AAED,SAAgB,OAAO,CAAC,KAAmB;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAgB,cAAc,CAAC,GAAG;IAChC,uEAAuE;IACvE,kCAAkC;IAClC,MAAM,aAAa,GAAG,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,CAAC,CAAC,CAAA;IACR,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAC/C,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAEnD,MAAM,WAAW,GACf,WAAW,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,GAAG,OAAO,CAAC;QAC7D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,CAAC,CAAC,CAAA;IAER,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,CAAC;QACZ,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC;YAClB,CAAC,CAAC,GAAG,CAAC,MAAM;YACZ,CAAC,CAAC,WAAW;QACf,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC;YAClB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAEtC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAEhD,MAAM,SAAS,GAAG,QAAQ,KAAK,CAAC,CAAC,IAAI,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAA;IAE5E,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,yBAAyB,CAAC,CAAA;IAChD,CAAC;IAED,OAAO,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;AAC1C,CAAC;AAEM,MAAM,oBAAoB,GAAG,CAAC,GAAY,EAAE,EAAE;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAA;QACZ,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAVY,QAAA,oBAAoB,wBAUhC;AAEM,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAAW,EAAE;IACxD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IAC1C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AANY,QAAA,gBAAgB,oBAM5B;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAI,CAAe,EAAE,CAAe;IACjE,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;AACzD,CAAC;AAED,SAAgB,UAAU,CAAwB,IAAO;IACvD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC5B,CAAC;AAED,SAAgB,OAAO,CACrB,KAA8B;IAE9B,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,SAAS,CAAA;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA,CAAC,sCAAsC;IAC7E,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC1B,CAAC;AAKM,MAAM,qBAAqB,GAAG,CACnC,KAAY,EACZ,KAAa,EACwB,EAAE;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAA;IACpE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAA;IAE3E,wBAAwB;IACxB,0CAA0C;IAE1C,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAA;IAChC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAA;IAEhC,IAAI,WAAW,GAAG,WAAW;QAAE,OAAO,KAAK,CAAA;IAE3C,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC9B,IAAI,MAAc,CAAA;IAElB,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,WAAW,CAAA;QAE1B;QACE,oCAAoC;QACpC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;YAC/C,8BAA8B;YAC9B,CAAC,MAAM,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,EAC3D,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,CAAA;IACxC,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAlCY,QAAA,qBAAqB,yBAkCjC","sourcesContent":["export function isHostnameIP(hostname: string) {\n  // IPv4\n  if (hostname.match(/^\\d+\\.\\d+\\.\\d+\\.\\d+$/)) return true\n\n  // IPv6\n  if (hostname.startsWith('[') && hostname.endsWith(']')) return true\n\n  return false\n}\n\nexport type LoopbackHost = 'localhost' | '127.0.0.1' | '[::1]'\n\nexport function isLoopbackHost(host: unknown): host is LoopbackHost {\n  return host === 'localhost' || host === '127.0.0.1' || host === '[::1]'\n}\n\nexport function isLoopbackUrl(input: URL | string): boolean {\n  const url = typeof input === 'string' ? new URL(input) : input\n  return isLoopbackHost(url.hostname)\n}\n\nexport function safeUrl(input: URL | string): URL | null {\n  try {\n    return new URL(input)\n  } catch {\n    return null\n  }\n}\n\nexport function extractUrlPath(url) {\n  // Extracts the path from a URL, without relying on the URL constructor\n  // (because it normalizes the URL)\n  const endOfProtocol = url.startsWith('https://')\n    ? 8\n    : url.startsWith('http://')\n      ? 7\n      : -1\n  if (endOfProtocol === -1) {\n    throw new TypeError('URL must use the \"https:\" or \"http:\" protocol')\n  }\n\n  const hashIdx = url.indexOf('#', endOfProtocol)\n  const questionIdx = url.indexOf('?', endOfProtocol)\n\n  const queryStrIdx =\n    questionIdx !== -1 && (hashIdx === -1 || questionIdx < hashIdx)\n      ? questionIdx\n      : -1\n\n  const pathEnd =\n    hashIdx === -1\n      ? queryStrIdx === -1\n        ? url.length\n        : queryStrIdx\n      : queryStrIdx === -1\n        ? hashIdx\n        : Math.min(hashIdx, queryStrIdx)\n\n  const slashIdx = url.indexOf('/', endOfProtocol)\n\n  const pathStart = slashIdx === -1 || slashIdx > pathEnd ? pathEnd : slashIdx\n\n  if (endOfProtocol === pathStart) {\n    throw new TypeError('URL must contain a host')\n  }\n\n  return url.substring(pathStart, pathEnd)\n}\n\nexport const jsonObjectPreprocess = (val: unknown) => {\n  if (typeof val === 'string' && val.startsWith('{') && val.endsWith('}')) {\n    try {\n      return JSON.parse(val)\n    } catch {\n      return val\n    }\n  }\n\n  return val\n}\n\nexport const numberPreprocess = (val: unknown): unknown => {\n  if (typeof val === 'string') {\n    const number = Number(val)\n    if (!Number.isNaN(number)) return number\n  }\n  return val\n}\n\n/**\n * Returns true if the two arrays contain the same elements, regardless of order\n * or duplicates.\n */\nexport function arrayEquivalent<T>(a: readonly T[], b: readonly T[]) {\n  if (a === b) return true\n  return a.every(includedIn, b) && b.every(includedIn, a)\n}\n\nexport function includedIn<T>(this: readonly T[], item: T) {\n  return this.includes(item)\n}\n\nexport function asArray<T>(\n  value: Iterable<T> | undefined,\n): undefined | readonly T[] {\n  if (value == null) return undefined\n  if (Array.isArray(value)) return value // already a (possibly readonly) array\n  return Array.from(value)\n}\n\nexport type SpaceSeparatedValue<Value extends string> =\n  `${'' | `${string} `}${Value}${'' | ` ${string}`}`\n\nexport const isSpaceSeparatedValue = <Value extends string>(\n  value: Value,\n  input: string,\n): input is SpaceSeparatedValue<Value> => {\n  if (value.length === 0) throw new TypeError('Value cannot be empty')\n  if (value.includes(' ')) throw new TypeError('Value cannot contain spaces')\n\n  // Optimized version of:\n  // return input.split(' ').includes(value)\n\n  const inputLength = input.length\n  const valueLength = value.length\n\n  if (inputLength < valueLength) return false\n\n  let idx = input.indexOf(value)\n  let idxEnd: number\n\n  while (idx !== -1) {\n    idxEnd = idx + valueLength\n\n    if (\n      // at beginning or preceded by space\n      (idx === 0 || input.charCodeAt(idx - 1) === 32) &&\n      // at end or followed by space\n      (idxEnd === inputLength || input.charCodeAt(idxEnd) === 32)\n    ) {\n      return true\n    }\n\n    idx = input.indexOf(value, idxEnd + 1)\n  }\n\n  return false\n}\n"]}
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";;;AAaA,oCAQC;AAID,wCAEC;AAED,0CAYC;AAED,0BAMC;AAED,wCAsCC;AA0BD,0CAGC;AAED,gCAEC;AAED,0BAMC;AAlIY,QAAA,WAAW;AACtB,mEAAmE;AACnE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC;IACvB,oDAAoD;IACpD,CAAC,CAAC,MAAc,EAAW,EAAE;QAC3B,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;YACf,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;AAEJ,SAAgB,YAAY,CAAC,QAAgB;IAC3C,OAAO;IACP,IAAI,QAAQ,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAAE,OAAO,IAAI,CAAA;IAEvD,OAAO;IACP,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEnE,OAAO,KAAK,CAAA;AACd,CAAC;AAID,SAAgB,cAAc,CAAC,IAAa;IAC1C,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,CAAA;AACzE,CAAC;AAED,SAAgB,eAAe,CAAC,QAAgB;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAA;IACvC,OAAO,CACL,GAAG,KAAK,MAAM;QACd,GAAG,KAAK,OAAO;QACf,GAAG,KAAK,WAAW;QACnB,GAAG,KAAK,SAAS;QACjB,GAAG,KAAK,SAAS,CAClB,CAAA;AACH,CAAC;AAED,SAAgB,OAAO,CAAC,KAAmB;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAgB,cAAc,CAAC,GAAG;IAChC,uEAAuE;IACvE,kCAAkC;IAClC,MAAM,aAAa,GAAG,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,CAAC,CAAC,CAAA;IACR,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAC/C,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAEnD,MAAM,WAAW,GACf,WAAW,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,GAAG,OAAO,CAAC;QAC7D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,CAAC,CAAC,CAAA;IAER,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,CAAC;QACZ,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC;YAClB,CAAC,CAAC,GAAG,CAAC,MAAM;YACZ,CAAC,CAAC,WAAW;QACf,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC;YAClB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAEtC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAEhD,MAAM,SAAS,GAAG,QAAQ,KAAK,CAAC,CAAC,IAAI,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAA;IAE5E,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,yBAAyB,CAAC,CAAA;IAChD,CAAC;IAED,OAAO,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;AAC1C,CAAC;AAEM,MAAM,oBAAoB,GAAG,CAAC,GAAY,EAAE,EAAE;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAA;QACZ,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAVY,QAAA,oBAAoB,wBAUhC;AAEM,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAAW,EAAE;IACxD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IAC1C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AANY,QAAA,gBAAgB,oBAM5B;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAI,CAAe,EAAE,CAAe;IACjE,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;AACzD,CAAC;AAED,SAAgB,UAAU,CAAwB,IAAO;IACvD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC5B,CAAC;AAED,SAAgB,OAAO,CACrB,KAA8B;IAE9B,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,SAAS,CAAA;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA,CAAC,sCAAsC;IAC7E,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC1B,CAAC;AAKM,MAAM,qBAAqB,GAAG,CACnC,KAAY,EACZ,KAAa,EACwB,EAAE;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAA;IACpE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAA;IAE3E,wBAAwB;IACxB,0CAA0C;IAE1C,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAA;IAChC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAA;IAEhC,IAAI,WAAW,GAAG,WAAW;QAAE,OAAO,KAAK,CAAA;IAE3C,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC9B,IAAI,MAAc,CAAA;IAElB,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,WAAW,CAAA;QAE1B;QACE,oCAAoC;QACpC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;YAC/C,8BAA8B;YAC9B,CAAC,MAAM,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,EAC3D,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,CAAA;IACxC,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAlCY,QAAA,qBAAqB,yBAkCjC","sourcesContent":["export const canParseUrl =\n  // eslint-disable-next-line n/no-unsupported-features/node-builtins\n  URL.canParse?.bind(URL) ??\n  // URL.canParse is not available in Node.js < 18.7.0\n  ((urlStr: string): boolean => {\n    try {\n      new URL(urlStr)\n      return true\n    } catch {\n      return false\n    }\n  })\n\nexport function isHostnameIP(hostname: string) {\n  // IPv4\n  if (hostname.match(/^\\d+\\.\\d+\\.\\d+\\.\\d+$/)) return true\n\n  // IPv6\n  if (hostname.startsWith('[') && hostname.endsWith(']')) return true\n\n  return false\n}\n\nexport type LoopbackHost = 'localhost' | '127.0.0.1' | '[::1]'\n\nexport function isLoopbackHost(host: unknown): host is LoopbackHost {\n  return host === 'localhost' || host === '127.0.0.1' || host === '[::1]'\n}\n\nexport function isLocalHostname(hostname: string): boolean {\n  const parts = hostname.split('.')\n  if (parts.length < 2) return true\n\n  const tld = parts.at(-1)!.toLowerCase()\n  return (\n    tld === 'test' ||\n    tld === 'local' ||\n    tld === 'localhost' ||\n    tld === 'invalid' ||\n    tld === 'example'\n  )\n}\n\nexport function safeUrl(input: URL | string): URL | null {\n  try {\n    return new URL(input)\n  } catch {\n    return null\n  }\n}\n\nexport function extractUrlPath(url) {\n  // Extracts the path from a URL, without relying on the URL constructor\n  // (because it normalizes the URL)\n  const endOfProtocol = url.startsWith('https://')\n    ? 8\n    : url.startsWith('http://')\n      ? 7\n      : -1\n  if (endOfProtocol === -1) {\n    throw new TypeError('URL must use the \"https:\" or \"http:\" protocol')\n  }\n\n  const hashIdx = url.indexOf('#', endOfProtocol)\n  const questionIdx = url.indexOf('?', endOfProtocol)\n\n  const queryStrIdx =\n    questionIdx !== -1 && (hashIdx === -1 || questionIdx < hashIdx)\n      ? questionIdx\n      : -1\n\n  const pathEnd =\n    hashIdx === -1\n      ? queryStrIdx === -1\n        ? url.length\n        : queryStrIdx\n      : queryStrIdx === -1\n        ? hashIdx\n        : Math.min(hashIdx, queryStrIdx)\n\n  const slashIdx = url.indexOf('/', endOfProtocol)\n\n  const pathStart = slashIdx === -1 || slashIdx > pathEnd ? pathEnd : slashIdx\n\n  if (endOfProtocol === pathStart) {\n    throw new TypeError('URL must contain a host')\n  }\n\n  return url.substring(pathStart, pathEnd)\n}\n\nexport const jsonObjectPreprocess = (val: unknown) => {\n  if (typeof val === 'string' && val.startsWith('{') && val.endsWith('}')) {\n    try {\n      return JSON.parse(val)\n    } catch {\n      return val\n    }\n  }\n\n  return val\n}\n\nexport const numberPreprocess = (val: unknown): unknown => {\n  if (typeof val === 'string') {\n    const number = Number(val)\n    if (!Number.isNaN(number)) return number\n  }\n  return val\n}\n\n/**\n * Returns true if the two arrays contain the same elements, regardless of order\n * or duplicates.\n */\nexport function arrayEquivalent<T>(a: readonly T[], b: readonly T[]) {\n  if (a === b) return true\n  return a.every(includedIn, b) && b.every(includedIn, a)\n}\n\nexport function includedIn<T>(this: readonly T[], item: T) {\n  return this.includes(item)\n}\n\nexport function asArray<T>(\n  value: Iterable<T> | undefined,\n): undefined | readonly T[] {\n  if (value == null) return undefined\n  if (Array.isArray(value)) return value // already a (possibly readonly) array\n  return Array.from(value)\n}\n\nexport type SpaceSeparatedValue<Value extends string> =\n  `${'' | `${string} `}${Value}${'' | ` ${string}`}`\n\nexport const isSpaceSeparatedValue = <Value extends string>(\n  value: Value,\n  input: string,\n): input is SpaceSeparatedValue<Value> => {\n  if (value.length === 0) throw new TypeError('Value cannot be empty')\n  if (value.includes(' ')) throw new TypeError('Value cannot contain spaces')\n\n  // Optimized version of:\n  // return input.split(' ').includes(value)\n\n  const inputLength = input.length\n  const valueLength = value.length\n\n  if (inputLength < valueLength) return false\n\n  let idx = input.indexOf(value)\n  let idxEnd: number\n\n  while (idx !== -1) {\n    idxEnd = idx + valueLength\n\n    if (\n      // at beginning or preceded by space\n      (idx === 0 || input.charCodeAt(idx - 1) === 32) &&\n      // at end or followed by space\n      (idxEnd === inputLength || input.charCodeAt(idxEnd) === 32)\n    ) {\n      return true\n    }\n\n    idx = input.indexOf(value, idxEnd + 1)\n  }\n\n  return false\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/oauth-types",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "license": "MIT",
   "description": "OAuth typing & validation library",
   "keywords": [

package/src/atproto-loopback-client-id.ts

@@ -12,7 +12,7 @@ import {
 } from './oauth-client-id-loopback.js'
 import {
   OAuthLoopbackRedirectURI,
-  oauthLoopbackRedirectURISchema,
+  oauthLoopbackClientRedirectUriSchema,
 } from './oauth-redirect-uri.js'
 import { arrayEquivalent, asArray } from './util.js'
 
@@ -41,7 +41,10 @@ export function buildAtprotoLoopbackClientId(
         throw new TypeError(`Unexpected empty "redirect_uris" config`)
       }
       for (const uri of redirectUris) {
-        params.append('redirect_uri', oauthLoopbackRedirectURISchema.parse(uri))
+        params.append(
+          'redirect_uri',
+          oauthLoopbackClientRedirectUriSchema.parse(uri),
+        )
       }
     }
 

package/src/oauth-authorization-server-metadata.ts

@@ -67,10 +67,10 @@ export const oauthAuthorizationServerMetadataSchema = z.object({
   // https://datatracker.ietf.org/doc/html/rfc9449#section-5.1
   dpop_signing_alg_values_supported: z.array(z.string()).optional(),
 
-  // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-05#section-4
+  // https://www.rfc-editor.org/rfc/rfc9728.html#section-4
   protected_resources: z.array(webUriSchema).optional(),
 
-  // https://drafts.aaronpk.com/draft-parecki-oauth-client-id-metadata-document/draft-parecki-oauth-client-id-metadata-document.html
+  // https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html
   client_id_metadata_document_supported: z.boolean().optional(),
 })
 

package/src/oauth-client-id-discoverable.ts

@@ -4,7 +4,7 @@ import { httpsUriSchema } from './uri.js'
 import { extractUrlPath, isHostnameIP } from './util.js'
 
 /**
- * @see {@link https://drafts.aaronpk.com/draft-parecki-oauth-client-id-metadata-document/draft-parecki-oauth-client-id-metadata-document.html}
+ * @see {@link https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html}
  */
 export const oauthClientIdDiscoverableSchema = z
   .intersection(oauthClientIdSchema, httpsUriSchema)

package/src/oauth-client-id-loopback.ts

@@ -1,7 +1,7 @@
 import { oauthClientIdSchema } from './oauth-client-id.js'
 import {
   OAuthLoopbackRedirectURI,
-  oauthLoopbackRedirectURISchema,
+  oauthLoopbackClientRedirectUriSchema,
 } from './oauth-redirect-uri.js'
 import { OAuthScope, oauthScopeSchema } from './oauth-scope.js'
 
@@ -138,7 +138,7 @@ export function safeParseOAuthLoopbackClientIdQueryString(
 
       params.scope = res.data
     } else if (key === 'redirect_uri') {
-      const res = oauthLoopbackRedirectURISchema.safeParse(value)
+      const res = oauthLoopbackClientRedirectUriSchema.safeParse(value)
       if (!res.success) {
         const reason = res.error.issues.map((i) => i.message).join(', ')
         return {

package/src/oauth-protected-resource-metadata.ts

@@ -3,7 +3,7 @@ import { oauthIssuerIdentifierSchema } from './oauth-issuer-identifier.js'
 import { webUriSchema } from './uri.js'
 
 /**
- * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-05#name-protected-resource-metadata-r}
+ * @see {@link https://www.rfc-editor.org/rfc/rfc9728.html#section-3.2}
  */
 export const oauthProtectedResourceMetadataSchema = z.object({
   /**

package/src/oauth-redirect-uri.ts

@@ -6,19 +6,23 @@ import {
   privateUseUriSchema,
 } from './uri.js'
 
-export const oauthLoopbackRedirectURISchema = loopbackUriSchema.superRefine(
+/**
+ * This is a {@link loopbackUriSchema} with the additional restriction that
+ * the hostname `localhost` is not allowed.
+ *
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc8252#section-8.3 Loopback Redirect Considerations} RFC8252
+ *
+ * > While redirect URIs using localhost (i.e.,
+ * > "http://localhost:{port}/{path}") function similarly to loopback IP
+ * > redirects described in Section 7.3, the use of localhost is NOT
+ * > RECOMMENDED. Specifying a redirect URI with the loopback IP literal rather
+ * > than localhost avoids inadvertently listening on network interfaces other
+ * > than the loopback interface.  It is also less susceptible to client-side
+ * > firewalls and misconfigured host name resolution on the user's device.
+ */
+export const loopbackRedirectURISchema = loopbackUriSchema.superRefine(
   (value, ctx): value is Exclude<LoopbackUri, `http://localhost${string}`> => {
     if (value.startsWith('http://localhost')) {
-      // https://datatracker.ietf.org/doc/html/rfc8252#section-8.3
-      //
-      // > While redirect URIs using localhost (i.e.,
-      // > "http://localhost:{port}/{path}") function similarly to loopback IP
-      // > redirects described in Section 7.3, the use of localhost is NOT
-      // > RECOMMENDED.  Specifying a redirect URI with the loopback IP literal
-      // > rather than localhost avoids inadvertently listening on network
-      // > interfaces other than the loopback interface.  It is also less
-      // > susceptible to client-side firewalls and misconfigured host name
-      // > resolution on the user's device.
       ctx.addIssue({
         code: ZodIssueCode.custom,
         message:
@@ -30,27 +34,17 @@ export const oauthLoopbackRedirectURISchema = loopbackUriSchema.superRefine(
     return true
   },
 )
-export type OAuthLoopbackRedirectURI = TypeOf<
-  typeof oauthLoopbackRedirectURISchema
->
-
-export const oauthHttpsRedirectURISchema = httpsUriSchema
-export type OAuthHttpsRedirectURI = TypeOf<typeof oauthHttpsRedirectURISchema>
+export type LoopbackRedirectURI = TypeOf<typeof loopbackRedirectURISchema>
 
-export const oauthPrivateUseRedirectURISchema = privateUseUriSchema
-export type OAuthPrivateUseRedirectURI = TypeOf<
-  typeof oauthPrivateUseRedirectURISchema
+export const oauthLoopbackClientRedirectUriSchema = loopbackRedirectURISchema
+export type OAuthLoopbackRedirectURI = TypeOf<
+  typeof oauthLoopbackClientRedirectUriSchema
 >
 
 export const oauthRedirectUriSchema = z.union(
-  [
-    oauthLoopbackRedirectURISchema,
-    oauthHttpsRedirectURISchema,
-    oauthPrivateUseRedirectURISchema,
-  ],
+  [loopbackRedirectURISchema, httpsUriSchema, privateUseUriSchema],
   {
     message: `URL must use the "https:" or "http:" protocol, or a private-use URI scheme (RFC 8252)`,
   },
 )
-
 export type OAuthRedirectUri = TypeOf<typeof oauthRedirectUriSchema>

package/src/uri.ts

@@ -1,18 +1,10 @@
 import { TypeOf, ZodIssueCode, z } from 'zod'
-import { isHostnameIP, isLoopbackHost } from './util.js'
-
-const canParseUrl =
-  // eslint-disable-next-line n/no-unsupported-features/node-builtins
-  URL.canParse?.bind(URL) ??
-  // URL.canParse is not available in Node.js < 18.7.0
-  ((urlStr: string): boolean => {
-    try {
-      new URL(urlStr)
-      return true
-    } catch {
-      return false
-    }
-  })
+import {
+  canParseUrl,
+  isHostnameIP,
+  isLocalHostname,
+  isLoopbackHost,
+} from './util.js'
 
 /**
  * Valid, but potentially dangerous URL (`data:`, `file:`, `javascript:`, etc.).
@@ -167,12 +159,56 @@ export const privateUseUriSchema = dangerousUriSchema.superRefine(
       return false
     }
 
-    if (url.hostname) {
-      // https://datatracker.ietf.org/doc/html/rfc8252#section-7.1
+    // https://datatracker.ietf.org/doc/html/rfc8252#section-7.1
+    //
+    // > When choosing a URI scheme to associate with the app, apps MUST use a
+    // > URI scheme based on a domain name under their control, expressed in
+    // > reverse order
+    //
+    // https://datatracker.ietf.org/doc/html/rfc8252#section-8.4
+    //
+    // > In addition to the collision-resistant properties, requiring a URI
+    // > scheme based on a domain name that is under the control of the app can
+    // > help to prove ownership in the event of a dispute where two apps claim
+    // > the same private-use URI scheme (where one app is acting maliciously).
+    //
+    // We can't check for ownership here (as there is no concept of proven
+    // ownership in a generic validation logic), besides excluding local domains
+    // as they can't be controlled/owned by the app.
+    //
+    // https://atproto.com/specs/oauth
+    //
+    // > Any custom scheme must match the `client_id` hostname in reverse-domain
+    // > order.
+    //
+    // This ATPROTO specific requirement cannot be enforced here, (as there is
+    // no concept of `client_id` in this context).
+
+    const uriScheme = url.protocol.slice(0, -1) // remove trailing ":"
+    const urlDomain = uriScheme.split('.').reverse().join('.')
+
+    if (isLocalHostname(urlDomain)) {
       ctx.addIssue({
         code: ZodIssueCode.custom,
-        message:
-          'Private-use URI schemes must not include a hostname (only one "/" is allowed after the protocol, as per RFC 8252)',
+        message: `Private-use URI Scheme redirect URI must not be a local hostname`,
+      })
+    }
+
+    // https://datatracker.ietf.org/doc/html/rfc8252#section-7.1
+    //
+    // > Following the requirements of Section 3.2 of [RFC3986], as there is no
+    // > naming authority for private-use URI scheme redirects, only a single
+    // > slash ("/") appears after the scheme component.
+    if (
+      url.href.startsWith(`${url.protocol}//`) ||
+      url.username ||
+      url.password ||
+      url.hostname ||
+      url.port
+    ) {
+      ctx.addIssue({
+        code: ZodIssueCode.custom,
+        message: `Private-Use URI Scheme must be in the form ${url.protocol}/<path> (as per RFC 8252)`,
       })
       return false
     }

package/src/util.ts

@@ -1,3 +1,16 @@
+export const canParseUrl =
+  // eslint-disable-next-line n/no-unsupported-features/node-builtins
+  URL.canParse?.bind(URL) ??
+  // URL.canParse is not available in Node.js < 18.7.0
+  ((urlStr: string): boolean => {
+    try {
+      new URL(urlStr)
+      return true
+    } catch {
+      return false
+    }
+  })
+
 export function isHostnameIP(hostname: string) {
   // IPv4
   if (hostname.match(/^\d+\.\d+\.\d+\.\d+$/)) return true
@@ -14,9 +27,18 @@ export function isLoopbackHost(host: unknown): host is LoopbackHost {
   return host === 'localhost' || host === '127.0.0.1' || host === '[::1]'
 }
 
-export function isLoopbackUrl(input: URL | string): boolean {
-  const url = typeof input === 'string' ? new URL(input) : input
-  return isLoopbackHost(url.hostname)
+export function isLocalHostname(hostname: string): boolean {
+  const parts = hostname.split('.')
+  if (parts.length < 2) return true
+
+  const tld = parts.at(-1)!.toLowerCase()
+  return (
+    tld === 'test' ||
+    tld === 'local' ||
+    tld === 'localhost' ||
+    tld === 'invalid' ||
+    tld === 'example'
+  )
 }
 
 export function safeUrl(input: URL | string): URL | null {