@atproto/pds 0.4.216 → 0.4.218

package/dist/api/com/atproto/temp/index.d.ts

@@ -1,4 +1,4 @@
+import { Server } from '@atproto/xrpc-server';
 import { AppContext } from '../../../../context';
-import { Server } from '../../../../lexicon';
 export default function (server: Server, ctx: AppContext): void;
 //# sourceMappingURL=index.d.ts.map

package/dist/api/com/atproto/temp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/temp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAG5C,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAEvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/temp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAGhD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAEvD"}

package/dist/api/com/atproto/temp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/temp/index.ts"],"names":[],"mappings":";;;;;AAIA,4BAEC;AAJD,0EAAiD;AAEjD,mBAAyB,MAAc,EAAE,GAAe;IACtD,IAAA,0BAAgB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAC/B,CAAC","sourcesContent":["import { AppContext } from '../../../../context'\nimport { Server } from '../../../../lexicon'\nimport checkSignupQueue from './checkSignupQueue'\n\nexport default function (server: Server, ctx: AppContext) {\n  checkSignupQueue(server, ctx)\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/temp/index.ts"],"names":[],"mappings":";;;;;AAIA,4BAEC;AAJD,0EAAiD;AAEjD,mBAAyB,MAAc,EAAE,GAAe;IACtD,IAAA,0BAAgB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAC/B,CAAC","sourcesContent":["import { Server } from '@atproto/xrpc-server'\nimport { AppContext } from '../../../../context'\nimport checkSignupQueue from './checkSignupQueue'\n\nexport default function (server: Server, ctx: AppContext) {\n  checkSignupQueue(server, ctx)\n}\n"]}

package/dist/api/index.d.ts

@@ -1,4 +1,4 @@
+import { Server } from '@atproto/xrpc-server';
 import { AppContext } from '../context';
-import { Server } from '../lexicon';
 export default function (server: Server, ctx: AppContext): Server;
 //# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAInC,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,UAIvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAIvC,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,UAIvD"}

package/dist/api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":";;;;;AAKA,4BAIC;AAPD,sDAAgC;AAChC,4DAAsC;AAEtC,mBAAyB,MAAc,EAAE,GAAe;IACtD,IAAA,iBAAU,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvB,IAAA,cAAO,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACpB,OAAO,MAAM,CAAA;AACf,CAAC","sourcesContent":["import { AppContext } from '../context'\nimport { Server } from '../lexicon'\nimport appBsky from './app/bsky'\nimport comAtproto from './com/atproto'\n\nexport default function (server: Server, ctx: AppContext) {\n  comAtproto(server, ctx)\n  appBsky(server, ctx)\n  return server\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":";;;;;AAKA,4BAIC;AAPD,sDAAgC;AAChC,4DAAsC;AAEtC,mBAAyB,MAAc,EAAE,GAAe;IACtD,IAAA,iBAAU,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvB,IAAA,cAAO,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACpB,OAAO,MAAM,CAAA;AACf,CAAC","sourcesContent":["import { Server } from '@atproto/xrpc-server'\nimport { AppContext } from '../context'\nimport appBsky from './app/bsky'\nimport comAtproto from './com/atproto'\n\nexport default function (server: Server, ctx: AppContext) {\n  comAtproto(server, ctx)\n  appBsky(server, ctx)\n  return server\n}\n"]}

package/dist/api/proxy.d.ts

@@ -1,13 +1,5 @@
 import { IncomingMessage } from 'node:http';
 import express from 'express';
-import { Headers } from '@atproto/xrpc';
-export declare const resultPassthru: <T>(result: {
-    headers: Headers;
-    data: T;
-}) => {
-    encoding: "application/json";
-    body: T;
-};
 export declare function authPassthru(req: IncomingMessage): {
     headers: {
         authorization: string;

package/dist/api/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/api/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3C,OAAO,OAAO,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC,eAAO,MAAM,cAAc,GAAI,CAAC,EAAE,QAAQ;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE;;;CAMtE,CAAA;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe;;;;cAuBhD;AAID,eAAO,MAAM,YAAY,GACvB,KAAK,OAAO,CAAC,OAAO,EACpB,QAAQ,YAAY,GAAG,SAAS,iBAQjC,CAAA;AAED,KAAK,YAAY,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAA"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/api/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3C,OAAO,OAAO,MAAM,SAAS,CAAA;AAG7B,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe;;;;cAuBhD;AAID,eAAO,MAAM,YAAY,GACvB,KAAK,OAAO,CAAC,OAAO,EACpB,QAAQ,YAAY,GAAG,SAAS,iBAQjC,CAAA;AAED,KAAK,YAAY,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAA"}

package/dist/api/proxy.js

@@ -1,16 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.forwardedFor = exports.resultPassthru = void 0;
+exports.forwardedFor = void 0;
 exports.authPassthru = authPassthru;
 const xrpc_server_1 = require("@atproto/xrpc-server");
-const resultPassthru = (result) => {
-    // @TODO pass through any headers that we always want to forward along
-    return {
-        encoding: 'application/json',
-        body: result.data,
-    };
-};
-exports.resultPassthru = resultPassthru;
 function authPassthru(req) {
     const { authorization } = req.headers;
     if (authorization) {

package/dist/api/proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/api/proxy.ts"],"names":[],"mappings":";;;AAaA,oCAuBC;AAjCD,sDAA0D;AAEnD,MAAM,cAAc,GAAG,CAAI,MAAqC,EAAE,EAAE;IACzE,sEAAsE;IACtE,OAAO;QACL,QAAQ,EAAE,kBAA2B;QACrC,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAA;AACH,CAAC,CAAA;AANY,QAAA,cAAc,kBAM1B;AAED,SAAgB,YAAY,CAAC,GAAoB;IAC/C,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,OAAO,CAAA;IAErC,IAAI,aAAa,EAAE,CAAC;QAClB,4EAA4E;QAC5E,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,qBAAqB;QAErB,wEAAwE;QACxE,2EAA2E;QAC3E,0BAA0B;QAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,iCAAmB,CAAC,8BAA8B,CAAC,CAAA;QAC/D,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,iCAAmB,CAAC,iCAAiC,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,CAAA;IACvC,CAAC;AACH,CAAC;AAED,kDAAkD;AAClD,0GAA0G;AACnG,MAAM,YAAY,GAAG,CAC1B,GAAoB,EACpB,MAAgC,EAChC,EAAE;IACF,MAAM,MAAM,GAAiB,MAAM,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACtD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAA;IACjB,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAA;IACxC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAVY,QAAA,YAAY,gBAUxB","sourcesContent":["import { IncomingMessage } from 'node:http'\nimport express from 'express'\nimport { Headers } from '@atproto/xrpc'\nimport { InvalidRequestError } from '@atproto/xrpc-server'\n\nexport const resultPassthru = <T>(result: { headers: Headers; data: T }) => {\n  // @TODO pass through any headers that we always want to forward along\n  return {\n    encoding: 'application/json' as const,\n    body: result.data,\n  }\n}\n\nexport function authPassthru(req: IncomingMessage) {\n  const { authorization } = req.headers\n\n  if (authorization) {\n    // DPoP requests are bound to the endpoint being called. Allowing them to be\n    // proxied would require that the receiving end allows DPoP proof not\n    // created for him. Since proxying is mainly there to support legacy\n    // clients, and DPoP is a new feature, we don't support DPoP requests\n    // through the proxy.\n\n    // This is fine since app views are usually called using the requester's\n    // credentials when \"auth.credentials.type === 'access'\", which is the only\n    // case were DPoP is used.\n    const [type] = authorization.split(' ', 1)\n    if (!type) {\n      throw new InvalidRequestError('Invalid authorization header')\n    }\n    if (type.toLowerCase() === 'dpop' || req.headers['dpop']) {\n      throw new InvalidRequestError('DPoP requests cannot be proxied')\n    }\n\n    return { headers: { authorization } }\n  }\n}\n\n// @NOTE this function may mutate its params input\n// future improvement here would be to forward along all untrusted ips rather than just the first (req.ip)\nexport const forwardedFor = (\n  req: express.Request,\n  params: HeadersParam | undefined,\n) => {\n  const result: HeadersParam = params ?? { headers: {} }\n  const ip = req.ip\n  if (ip) {\n    result.headers['x-forwarded-for'] = ip\n  }\n  return result\n}\n\ntype HeadersParam = { headers: Record<string, string> }\n"]}
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/api/proxy.ts"],"names":[],"mappings":";;;AAIA,oCAuBC;AAzBD,sDAA0D;AAE1D,SAAgB,YAAY,CAAC,GAAoB;IAC/C,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,OAAO,CAAA;IAErC,IAAI,aAAa,EAAE,CAAC;QAClB,4EAA4E;QAC5E,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,qBAAqB;QAErB,wEAAwE;QACxE,2EAA2E;QAC3E,0BAA0B;QAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,iCAAmB,CAAC,8BAA8B,CAAC,CAAA;QAC/D,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,iCAAmB,CAAC,iCAAiC,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,CAAA;IACvC,CAAC;AACH,CAAC;AAED,kDAAkD;AAClD,0GAA0G;AACnG,MAAM,YAAY,GAAG,CAC1B,GAAoB,EACpB,MAAgC,EAChC,EAAE;IACF,MAAM,MAAM,GAAiB,MAAM,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACtD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAA;IACjB,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAA;IACxC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAVY,QAAA,YAAY,gBAUxB","sourcesContent":["import { IncomingMessage } from 'node:http'\nimport express from 'express'\nimport { InvalidRequestError } from '@atproto/xrpc-server'\n\nexport function authPassthru(req: IncomingMessage) {\n  const { authorization } = req.headers\n\n  if (authorization) {\n    // DPoP requests are bound to the endpoint being called. Allowing them to be\n    // proxied would require that the receiving end allows DPoP proof not\n    // created for him. Since proxying is mainly there to support legacy\n    // clients, and DPoP is a new feature, we don't support DPoP requests\n    // through the proxy.\n\n    // This is fine since app views are usually called using the requester's\n    // credentials when \"auth.credentials.type === 'access'\", which is the only\n    // case were DPoP is used.\n    const [type] = authorization.split(' ', 1)\n    if (!type) {\n      throw new InvalidRequestError('Invalid authorization header')\n    }\n    if (type.toLowerCase() === 'dpop' || req.headers['dpop']) {\n      throw new InvalidRequestError('DPoP requests cannot be proxied')\n    }\n\n    return { headers: { authorization } }\n  }\n}\n\n// @NOTE this function may mutate its params input\n// future improvement here would be to forward along all untrusted ips rather than just the first (req.ip)\nexport const forwardedFor = (\n  req: express.Request,\n  params: HeadersParam | undefined,\n) => {\n  const result: HeadersParam = params ?? { headers: {} }\n  const ip = req.ip\n  if (ip) {\n    result.headers['x-forwarded-for'] = ip\n  }\n  return result\n}\n\ntype HeadersParam = { headers: Record<string, string> }\n"]}

package/dist/app-view.d.ts

@@ -1,4 +1,4 @@
-import { AtpAgent } from '@atproto/api';
+import { Client } from '@atproto/lex';
 export type AppViewOptions = {
     url: string;
     did: string;
@@ -6,7 +6,7 @@ export type AppViewOptions = {
 };
 export declare class AppView {
     did: string;
-    agent: AtpAgent;
+    client: Client;
     private cdnUrlPattern?;
     constructor(options: AppViewOptions);
     getImageUrl(pattern: string, did: string, cid: string): string | undefined;

package/dist/app-view.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-view.d.ts","sourceRoot":"","sources":["../src/app-view.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAEvC,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,qBAAa,OAAO;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,QAAQ,CAAA;IACtB,OAAO,CAAC,aAAa,CAAC,CAAQ;gBAElB,OAAO,EAAE,cAAc;IAMnC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAG3E"}
+{"version":3,"file":"app-view.d.ts","sourceRoot":"","sources":["../src/app-view.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,qBAAa,OAAO;IACX,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,aAAa,CAAC,CAAQ;gBAElB,OAAO,EAAE,cAAc;IAMnC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAG3E"}

package/dist/app-view.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AppView = void 0;
 const node_util_1 = require("node:util");
-const api_1 = require("@atproto/api");
+const lex_1 = require("@atproto/lex");
 class AppView {
     constructor(options) {
         Object.defineProperty(this, "did", {
@@ -11,7 +11,7 @@ class AppView {
             writable: true,
             value: void 0
         });
-        Object.defineProperty(this, "agent", {
+        Object.defineProperty(this, "client", {
             enumerable: true,
             configurable: true,
             writable: true,
@@ -24,7 +24,7 @@ class AppView {
             value: void 0
         });
         this.did = options.did;
-        this.agent = new api_1.AtpAgent({ service: options.url });
+        this.client = new lex_1.Client({ service: options.url });
         this.cdnUrlPattern = options.cdnUrlPattern;
     }
     getImageUrl(pattern, did, cid) {

package/dist/app-view.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-view.js","sourceRoot":"","sources":["../src/app-view.ts"],"names":[],"mappings":";;;AAAA,yCAAkC;AAClC,sCAAuC;AAQvC,MAAa,OAAO;IAKlB,YAAY,OAAuB;QAJ5B;;;;;WAAW;QACX;;;;;WAAe;QACd;;;;;WAAsB;QAG5B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,cAAQ,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC5C,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,GAAW;QACnD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAA,kBAAM,EAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;CACF;AAdD,0BAcC","sourcesContent":["import { format } from 'node:util'\nimport { AtpAgent } from '@atproto/api'\n\nexport type AppViewOptions = {\n  url: string\n  did: string\n  cdnUrlPattern?: string\n}\n\nexport class AppView {\n  public did: string\n  public agent: AtpAgent\n  private cdnUrlPattern?: string\n\n  constructor(options: AppViewOptions) {\n    this.did = options.did\n    this.agent = new AtpAgent({ service: options.url })\n    this.cdnUrlPattern = options.cdnUrlPattern\n  }\n\n  getImageUrl(pattern: string, did: string, cid: string): string | undefined {\n    if (this.cdnUrlPattern) return format(this.cdnUrlPattern, pattern, did, cid)\n  }\n}\n"]}
+{"version":3,"file":"app-view.js","sourceRoot":"","sources":["../src/app-view.ts"],"names":[],"mappings":";;;AAAA,yCAAkC;AAClC,sCAAqC;AAQrC,MAAa,OAAO;IAKlB,YAAY,OAAuB;QAJ5B;;;;;WAAW;QACX;;;;;WAAc;QACb;;;;;WAAsB;QAG5B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,YAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC5C,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,GAAW;QACnD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAA,kBAAM,EAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;CACF;AAdD,0BAcC","sourcesContent":["import { format } from 'node:util'\nimport { Client } from '@atproto/lex'\n\nexport type AppViewOptions = {\n  url: string\n  did: string\n  cdnUrlPattern?: string\n}\n\nexport class AppView {\n  public did: string\n  public client: Client\n  private cdnUrlPattern?: string\n\n  constructor(options: AppViewOptions) {\n    this.did = options.did\n    this.client = new Client({ service: options.url })\n    this.cdnUrlPattern = options.cdnUrlPattern\n  }\n\n  getImageUrl(pattern: string, did: string, cid: string): string | undefined {\n    if (this.cdnUrlPattern) return format(this.cdnUrlPattern, pattern, did, cid)\n  }\n}\n"]}

package/dist/auth-output.d.ts

@@ -1,4 +1,5 @@
 import { ScopePermissions } from '@atproto/oauth-scopes';
+import { DidString } from '@atproto/syntax';
 import { AuthScope } from './auth-scope';
 export type UnauthenticatedOutput = {
     credentials: null;
@@ -11,27 +12,27 @@ export type AdminTokenOutput = {
 export type ModServiceOutput = {
     credentials: {
         type: 'mod_service';
-        did: string;
+        did: DidString;
     };
 };
 export type AccessOutput<S extends AuthScope = AuthScope> = {
     credentials: {
         type: 'access';
-        did: string;
+        did: DidString;
         scope: S;
     };
 };
 export type OAuthOutput = {
     credentials: {
         type: 'oauth';
-        did: string;
+        did: DidString;
         permissions: ScopePermissions;
     };
 };
 export type RefreshOutput = {
     credentials: {
         type: 'refresh';
-        did: string;
+        did: DidString;
         scope: AuthScope.Refresh;
         tokenId: string;
     };
@@ -39,7 +40,7 @@ export type RefreshOutput = {
 export type UserServiceAuthOutput = {
     credentials: {
         type: 'user_service_auth';
-        did: string;
+        did: DidString;
     };
 };
 //# sourceMappingURL=auth-output.d.ts.map

package/dist/auth-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-output.d.ts","sourceRoot":"","sources":["../src/auth-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAExC,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,IAAI,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE;QACX,IAAI,EAAE,aAAa,CAAA;KACpB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE;QACX,IAAI,EAAE,aAAa,CAAA;QACnB,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;CACF,CAAA;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC1D,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAA;QACd,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,CAAC,CAAA;KACT,CAAA;CACF,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE;QACX,IAAI,EAAE,OAAO,CAAA;QACb,GAAG,EAAE,MAAM,CAAA;QACX,WAAW,EAAE,gBAAgB,CAAA;KAC9B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE;QACX,IAAI,EAAE,SAAS,CAAA;QACf,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,SAAS,CAAC,OAAO,CAAA;QACxB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE;QACX,IAAI,EAAE,mBAAmB,CAAA;QACzB,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;CACF,CAAA"}
+{"version":3,"file":"auth-output.d.ts","sourceRoot":"","sources":["../src/auth-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAExC,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,IAAI,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE;QACX,IAAI,EAAE,aAAa,CAAA;KACpB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE;QACX,IAAI,EAAE,aAAa,CAAA;QACnB,GAAG,EAAE,SAAS,CAAA;KACf,CAAA;CACF,CAAA;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC1D,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAA;QACd,GAAG,EAAE,SAAS,CAAA;QACd,KAAK,EAAE,CAAC,CAAA;KACT,CAAA;CACF,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE;QACX,IAAI,EAAE,OAAO,CAAA;QACb,GAAG,EAAE,SAAS,CAAA;QACd,WAAW,EAAE,gBAAgB,CAAA;KAC9B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE;QACX,IAAI,EAAE,SAAS,CAAA;QACf,GAAG,EAAE,SAAS,CAAA;QACd,KAAK,EAAE,SAAS,CAAC,OAAO,CAAA;QACxB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE;QACX,IAAI,EAAE,mBAAmB,CAAA;QACzB,GAAG,EAAE,SAAS,CAAA;KACf,CAAA;CACF,CAAA"}

package/dist/auth-output.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-output.js","sourceRoot":"","sources":["../src/auth-output.ts"],"names":[],"mappings":"","sourcesContent":["import { ScopePermissions } from '@atproto/oauth-scopes'\nimport { AuthScope } from './auth-scope'\n\nexport type UnauthenticatedOutput = {\n  credentials: null\n}\n\nexport type AdminTokenOutput = {\n  credentials: {\n    type: 'admin_token'\n  }\n}\n\nexport type ModServiceOutput = {\n  credentials: {\n    type: 'mod_service'\n    did: string\n  }\n}\n\nexport type AccessOutput<S extends AuthScope = AuthScope> = {\n  credentials: {\n    type: 'access'\n    did: string\n    scope: S\n  }\n}\n\nexport type OAuthOutput = {\n  credentials: {\n    type: 'oauth'\n    did: string\n    permissions: ScopePermissions\n  }\n}\n\nexport type RefreshOutput = {\n  credentials: {\n    type: 'refresh'\n    did: string\n    scope: AuthScope.Refresh\n    tokenId: string\n  }\n}\n\nexport type UserServiceAuthOutput = {\n  credentials: {\n    type: 'user_service_auth'\n    did: string\n  }\n}\n"]}
+{"version":3,"file":"auth-output.js","sourceRoot":"","sources":["../src/auth-output.ts"],"names":[],"mappings":"","sourcesContent":["import { ScopePermissions } from '@atproto/oauth-scopes'\nimport { DidString } from '@atproto/syntax'\nimport { AuthScope } from './auth-scope'\n\nexport type UnauthenticatedOutput = {\n  credentials: null\n}\n\nexport type AdminTokenOutput = {\n  credentials: {\n    type: 'admin_token'\n  }\n}\n\nexport type ModServiceOutput = {\n  credentials: {\n    type: 'mod_service'\n    did: DidString\n  }\n}\n\nexport type AccessOutput<S extends AuthScope = AuthScope> = {\n  credentials: {\n    type: 'access'\n    did: DidString\n    scope: S\n  }\n}\n\nexport type OAuthOutput = {\n  credentials: {\n    type: 'oauth'\n    did: DidString\n    permissions: ScopePermissions\n  }\n}\n\nexport type RefreshOutput = {\n  credentials: {\n    type: 'refresh'\n    did: DidString\n    scope: AuthScope.Refresh\n    tokenId: string\n  }\n}\n\nexport type UserServiceAuthOutput = {\n  credentials: {\n    type: 'user_service_auth'\n    did: DidString\n  }\n}\n"]}

package/dist/auth-verifier.d.ts

@@ -2,6 +2,7 @@ import { KeyObject } from 'node:crypto';
 import { IncomingMessage } from 'node:http';
 import * as jose from 'jose';
 import { IdResolver } from '@atproto/identity';
+import { AtIdentifierString, DidString } from '@atproto/lex';
 import { OAuthVerifier } from '@atproto/oauth-provider';
 import { ScopePermissions } from '@atproto/oauth-scopes';
 import { Awaitable, MethodAuthContext, MethodAuthVerifier, Params } from '@atproto/xrpc-server';
@@ -37,7 +38,7 @@ export type VerifyBearerJwtOptions<S extends AuthScope = AuthScope> = WithRequir
     scopes: readonly S[];
 }, 'audience' | 'typ'>;
 export type VerifyBearerJwtResult<S extends AuthScope = AuthScope> = {
-    sub: string;
+    sub: DidString;
     aud: string;
     jti: string | undefined;
     scope: S;
@@ -65,13 +66,13 @@ export declare class AuthVerifier {
     userServiceAuthOptional: MethodAuthVerifier<UserServiceAuthOutput | UnauthenticatedOutput>;
     authorizationOrUserServiceAuth<P extends Params>(options: VerifiedOptions & ScopedOptions & ExtraScopedOptions & AuthorizedOptions<P>): MethodAuthVerifier<UserServiceAuthOutput | OAuthOutput | AccessOutput, P>;
     protected oauth<P extends Params>({ authorize, ...verifyStatusOptions }: VerifiedOptions & AuthorizedOptions<P>): MethodAuthVerifier<OAuthOutput, P>;
-    protected verifyStatus(did: string, options: VerifiedOptions): Promise<void>;
+    protected verifyStatus(did: DidString, options: VerifiedOptions): Promise<void>;
     /**
      * Finds an account by its handle or DID, returning possibly deactivated or
      * taken down accounts (unless `options.checkDeactivated` or
      * `options.checkTakedown` are set to true, respectively).
      */
-    findAccount(handleOrDid: string, options: VerifiedOptions): Promise<ActorAccount>;
+    findAccount(handleOrDid: AtIdentifierString, options: VerifiedOptions): Promise<ActorAccount>;
     /**
      * Wraps {@link jose.jwtVerify} into a function that also validates the token
      * payload's type and wraps errors into {@link InvalidRequestError}.
@@ -80,7 +81,7 @@ export declare class AuthVerifier {
     protected verifyServiceJwt(req: IncomingMessage, opts?: {
         iss?: string[];
     }): Promise<{
-        iss: import("@atproto/syntax").DidString | `${import("@atproto/syntax").DidString}#${string}`;
+        iss: DidString | `${DidString}#${string}`;
         aud: string;
         exp: number;
         lxm?: string;

package/dist/auth-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-verifier.d.ts","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAoC,MAAM,aAAa,CAAA;AACzE,OAAO,EAAE,eAAe,EAAkB,MAAM,WAAW,CAAA;AAC3D,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAG5B,OAAO,EAAE,UAAU,EAA0B,MAAM,mBAAmB,CAAA;AACtE,OAAO,EAEL,aAAa,EAGd,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,gBAAgB,EAEjB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAEL,SAAS,EAGT,iBAAiB,EACjB,kBAAkB,EAClB,MAAM,EAIP,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAChE,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAmB,SAAS,EAAe,MAAM,cAAc,CAAA;AAGtE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE3C,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC3D,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAChE,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACzD,SAAS,EAAE,CACT,WAAW,EAAE,gBAAgB,EAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,KACtB,SAAS,CAAC,IAAI,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,SAAS,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAChE,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IACtC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;CACrB,EACD,UAAU,GAAG,KAAK,CACnB,CAAA;AAEH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IACnE,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,KAAK,EAAE,CAAC,CAAA;CACT,CAAA;AAED,qBAAa,YAAY;IAOd,cAAc,EAAE,cAAc;IAC9B,UAAU,EAAE,UAAU;IACtB,aAAa,EAAE,aAAa;IARrC,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,UAAU,CAAQ;IACnB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAA;gBAG5B,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa,EACnC,IAAI,EAAE,gBAAgB;IAUjB,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAchE;IAEM,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAYtD;IAEM,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CActD;IAEM,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAQtE;IAEH,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,SAAS,EAClC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GACpD,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IA8B/B,OAAO,CAAC,OAAO,CAAC,EAAE;QACvB,YAAY,CAAC,EAAE,OAAO,CAAA;KACvB,GAAG,kBAAkB,CAAC,aAAa,CAAC;IAiC9B,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,EACrC,MAAwB,EACxB,UAAe,EACf,GAAG,OAAO,EACX,EAAE,eAAe,GAChB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,YAAY,GAAG,WAAW,EAAE,CAAC,CAAC;IAiCnE,iCAAiC,CAAC,CAAC,SAAS,MAAM,EACvD,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CACnB,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,EACrE,CAAC,CACF;IAcM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAWhE;IAEM,uBAAuB,EAAE,kBAAkB,CAChD,qBAAqB,GAAG,qBAAqB,CAC9C,CAOA;IAEM,8BAA8B,CAAC,CAAC,SAAS,MAAM,EACpD,OAAO,EAAE,eAAe,GACtB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GACrB,kBAAkB,CAAC,qBAAqB,GAAG,WAAW,GAAG,YAAY,EAAE,CAAC,CAAC;IAW5E,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,EAChC,SAAS,EACT,GAAG,mBAAmB,EACvB,EAAE,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAC5D,WAAW,EACX,CAAC,CACF;cA0Ee,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC;IAMhB;;;;OAIG;IACU,WAAW,CACtB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,YAAY,CAAC;IAwBxB;;;OAGG;cACa,eAAe,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAC7D,GAAG,EAAE,eAAe,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;cA6DpB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE;;;;;;;CA4C5B;AAKD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,gBAAgB,GAAG,qBAAqB,EAC3E,GAAG,EAAE,MAAM,GACV,OAAO,CAQT;AA0ED,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,KAAG,SAEtD,CAAA;AAGD,eAAO,MAAM,qBAAqB,GAAI,cAAc,MAAM,KAAG,SAG5D,CAAA"}
+{"version":3,"file":"auth-verifier.d.ts","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAoC,MAAM,aAAa,CAAA;AACzE,OAAO,EAAE,eAAe,EAAkB,MAAM,WAAW,CAAA;AAC3D,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAG5B,OAAO,EAAE,UAAU,EAA0B,MAAM,mBAAmB,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAe,MAAM,cAAc,CAAA;AACzE,OAAO,EAEL,aAAa,EAGd,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,gBAAgB,EAEjB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAEL,SAAS,EAGT,iBAAiB,EACjB,kBAAkB,EAClB,MAAM,EAIP,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAChE,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAmB,SAAS,EAAe,MAAM,cAAc,CAAA;AAGtE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE3C,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC3D,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAChE,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACzD,SAAS,EAAE,CACT,WAAW,EAAE,gBAAgB,EAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,KACtB,SAAS,CAAC,IAAI,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,SAAS,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAChE,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IACtC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;CACrB,EACD,UAAU,GAAG,KAAK,CACnB,CAAA;AAEH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IACnE,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,KAAK,EAAE,CAAC,CAAA;CACT,CAAA;AAED,qBAAa,YAAY;IAOd,cAAc,EAAE,cAAc;IAC9B,UAAU,EAAE,UAAU;IACtB,aAAa,EAAE,aAAa;IARrC,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,UAAU,CAAQ;IACnB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAA;gBAG5B,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa,EACnC,IAAI,EAAE,gBAAgB;IAUjB,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAchE;IAEM,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAYtD;IAEM,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CActD;IAEM,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAQtE;IAEH,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,SAAS,EAClC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GACpD,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IA8B/B,OAAO,CAAC,OAAO,CAAC,EAAE;QACvB,YAAY,CAAC,EAAE,OAAO,CAAA;KACvB,GAAG,kBAAkB,CAAC,aAAa,CAAC;IAiC9B,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,EACrC,MAAwB,EACxB,UAAe,EACf,GAAG,OAAO,EACX,EAAE,eAAe,GAChB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,YAAY,GAAG,WAAW,EAAE,CAAC,CAAC;IAiCnE,iCAAiC,CAAC,CAAC,SAAS,MAAM,EACvD,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CACnB,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,EACrE,CAAC,CACF;IAcM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAWhE;IAEM,uBAAuB,EAAE,kBAAkB,CAChD,qBAAqB,GAAG,qBAAqB,CAC9C,CAOA;IAEM,8BAA8B,CAAC,CAAC,SAAS,MAAM,EACpD,OAAO,EAAE,eAAe,GACtB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GACrB,kBAAkB,CAAC,qBAAqB,GAAG,WAAW,GAAG,YAAY,EAAE,CAAC,CAAC;IAW5E,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,EAChC,SAAS,EACT,GAAG,mBAAmB,EACvB,EAAE,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAC5D,WAAW,EACX,CAAC,CACF;cA0Ee,YAAY,CAC1B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC;IAMhB;;;;OAIG;IACU,WAAW,CACtB,WAAW,EAAE,kBAAkB,EAC/B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,YAAY,CAAC;IAwBxB;;;OAGG;cACa,eAAe,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAC7D,GAAG,EAAE,eAAe,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;cA6DpB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE;;;;;;;CA6C5B;AAKD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,gBAAgB,GAAG,qBAAqB,EAC3E,GAAG,EAAE,MAAM,GACV,OAAO,CAQT;AA0ED,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,KAAG,SAEtD,CAAA;AAGD,eAAO,MAAM,qBAAqB,GAAI,cAAc,MAAM,KAAG,SAG5D,CAAA"}

package/dist/auth-verifier.js

@@ -43,6 +43,7 @@ const jose = __importStar(require("jose"));
 const key_encoder_1 = __importDefault(require("key-encoder"));
 const common_1 = require("@atproto/common");
 const identity_1 = require("@atproto/identity");
+const lex_1 = require("@atproto/lex");
 const oauth_provider_1 = require("@atproto/oauth-provider");
 const oauth_scopes_1 = require("@atproto/oauth-scopes");
 const xrpc_server_1 = require("@atproto/xrpc-server");
@@ -322,7 +323,7 @@ class AuthVerifier {
                 }
                 throw err;
             });
-            if (typeof did !== 'string' || !did.startsWith('did:')) {
+            if (!(0, lex_1.isDidString)(did)) {
                 throw new xrpc_server_1.InvalidRequestError('Malformed token', 'InvalidToken');
             }
             await this.verifyStatus(did, verifyStatusOptions);
@@ -410,7 +411,7 @@ class AuthVerifier {
             // https://www.rfc-editor.org/rfc/rfc7800.html
             throw new xrpc_server_1.InvalidRequestError('Malformed token', 'InvalidToken');
         }
-        if (typeof sub !== 'string' || !sub.startsWith('did:')) {
+        if (typeof sub !== 'string' || !(0, lex_1.isDidString)(sub)) {
             throw new xrpc_server_1.InvalidRequestError('Malformed token', 'InvalidToken');
         }
         if (typeof aud !== 'string' || !aud.startsWith('did:')) {
@@ -425,7 +426,12 @@ class AuthVerifier {
         return { sub, aud, jti, scope: scope };
     }
     async verifyServiceJwt(req, opts) {
-        const getSigningKey = async (iss, forceRefresh) => {
+        const jwtStr = bearerTokenFromReq(req);
+        if (!jwtStr) {
+            throw new xrpc_server_1.AuthRequiredError('missing jwt', 'MissingJwt');
+        }
+        const nsid = (0, xrpc_server_1.parseReqNsid)(req);
+        const payload = await (0, xrpc_server_1.verifyJwt)(jwtStr, null, nsid, async (iss, forceRefresh) => {
             if (opts?.iss && !opts.iss.includes(iss)) {
                 throw new xrpc_server_1.AuthRequiredError('Untrusted issuer', 'UntrustedIss');
             }
@@ -444,13 +450,7 @@ class AuthVerifier {
                 throw new xrpc_server_1.AuthRequiredError('missing or bad key in did doc');
             }
             return didKey;
-        };
-        const jwtStr = bearerTokenFromReq(req);
-        if (!jwtStr) {
-            throw new xrpc_server_1.AuthRequiredError('missing jwt', 'MissingJwt');
-        }
-        const nsid = (0, xrpc_server_1.parseReqNsid)(req);
-        const payload = await (0, xrpc_server_1.verifyJwt)(jwtStr, null, nsid, getSigningKey);
+        });
         if (payload.aud !== this.dids.pds &&
             (!this.dids.entryway || payload.aud !== this.dids.entryway)) {
             throw new xrpc_server_1.AuthRequiredError('jwt audience does not match service did', 'BadJwtAudience');

package/dist/auth-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-verifier.js","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4jBA,sCAWC;AAvkBD,6CAAyE;AAEzE,2CAA4B;AAC5B,8DAAoC;AACpC,4CAAyD;AACzD,gDAAsE;AACtE,4DAKgC;AAChC,wDAG8B;AAC9B,sDAW6B;AAY7B,6CAAsE;AACtE,6BAAkC;AAClC,sCAAwC;AAiDxC,MAAa,YAAY;IAMvB,YACS,cAA8B,EAC9B,UAAsB,EACtB,aAA4B,EACnC,IAAsB;QAHtB;;;;mBAAO,cAAc;WAAgB;QACrC;;;;mBAAO,UAAU;WAAY;QAC7B;;;;mBAAO,aAAa;WAAe;QAR7B;;;;;WAAkB;QAClB;;;;;WAAkB;QAClB;;;;;WAAkB;QACnB;;;;;WAA8B;QAcrC,0CAA0C;QAEnC;;;;mBAA6D,CAAC,GAAG,EAAE,EAAE;gBAC1E,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBAEvB,0EAA0E;gBAC1E,2EAA2E;gBAC3E,2EAA2E;gBAC3E,uBAAuB;gBACvB,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;oBACrC,MAAM,IAAI,+BAAiB,CAAC,8BAA8B,CAAC,CAAA;gBAC7D,CAAC;gBAED,OAAO;oBACL,WAAW,EAAE,IAAI;iBAClB,CAAA;YACH,CAAC;WAAA;QAEM;;;;mBAAmD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACvB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACtC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,+BAAiB,EAAE,CAAA;gBAC/B,CAAC;gBACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;gBACrC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;oBACzD,MAAM,IAAI,+BAAiB,EAAE,CAAA;gBAC/B,CAAC;gBAED,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAA;YACjD,CAAC;WAAA;QAEM;;;;mBAAmD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC1B,MAAM,IAAI,+BAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;gBACjE,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;oBACnD,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC;iBACvE,CAAC,CAAA;gBACF,OAAO;oBACL,WAAW,EAAE;wBACX,IAAI,EAAE,aAAa;wBACnB,GAAG,EAAE,OAAO,CAAC,GAAG;qBACjB;iBACF,CAAA;YACH,CAAC;WAAA;QAEM;;;;mBACL,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;gBAC7B,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;gBAC7B,CAAC;YACH,CAAC;WAAA;QAgII;;;;mBAA6D,KAAK,EACvE,GAAG,EACH,EAAE;gBACF,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO;oBACL,WAAW,EAAE;wBACX,IAAI,EAAE,mBAAmB;wBACzB,GAAG,EAAE,OAAO,CAAC,GAAG;qBACjB;iBACF,CAAA;YACH,CAAC;WAAA;QAEM;;;;mBAEH,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC7B,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBACxC,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBAClC,CAAC;YACH,CAAC;WAAA;QApNC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACvB,CAAC;IA4DS,MAAM,CACd,OAAqD;QAErD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAA;QAE5C,MAAM,gBAAgB,GAA8B;YAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YACvB,GAAG,EAAE,QAAQ;YACb,MAAM;YACJ,mEAAmE;YACnE,0BAA0B;YAC1B,aAAa,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,sBAAS,CAAC,SAAc,CAAC;gBACtE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,sBAAS,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,MAAM;SACb,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,GAAG,CAAC,GAAG,EACP,gBAAgB,CACjB,CAAA;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAE3C,OAAO;gBACL,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE;aAC5C,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,OAAO,CAAC,OAEd;QACC,MAAM,aAAa,GAA8C;YAC/D,cAAc,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC5D,GAAG,EAAE,aAAa;YAClB,oDAAoD;YACpD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACjE,MAAM,EAAE,CAAC,sBAAS,CAAC,OAAO,CAAC;SAC5B,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAEjE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAA;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,+BAAiB,CACzB,qCAAqC,EACrC,gBAAgB,CACjB,CAAA;YACH,CAAC;YAED,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO;iBACR;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,aAAa,CAAmB,EACrC,MAAM,GAAG,4BAAe,EACxB,UAAU,GAAG,EAAE,EACf,GAAG,OAAO,EAIU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC;SACnC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAErC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAA;YACnB,CAAC;YAED,uEAAuE;YACvE,+CAA+C;YAC/C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,iCAAmB,CAC3B,+BAA+B,EAC/B,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,IAAI,+BAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC,CAAA;IACH,CAAC;IAEM,iCAAiC,CACtC,IAAiE;QAKjE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IA0BM,8BAA8B,CACnC,OAGsB;QAEtB,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACzD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAmB,EAChC,SAAS,EACT,GAAG,mBAAmB,EACiB;QAIvC,MAAM,kBAAkB,GAA8B;YACpD,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,KAAK,EAAE,CAAC,SAAS,CAAC;SACnB,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAA;YAExB,4DAA4D;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAA;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;gBACtC,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,YAAY,CAAC,CAAA;YACjE,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;YACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YAEjD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa;iBACjD,mBAAmB,CAClB,GAAG,CAAC,MAAM,IAAI,KAAK,EACnB,GAAG,EACH,GAAG,CAAC,OAAO,EACX,kBAAkB,CACnB;iBACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,mEAAmE;gBACnE,0DAA0D;gBAC1D,IAAI,GAAG,YAAY,qCAAoB,EAAE,CAAC;oBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;oBAC5D,GAAG,CAAC,YAAY,CACd,+BAA+B,EAC/B,kBAAkB,CACnB,CAAA;gBACH,CAAC;gBAED,IAAI,GAAG,YAAY,2BAAU,EAAE,CAAC;oBAC9B,MAAM,IAAI,uBAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBACnE,CAAC;gBAED,MAAM,GAAG,CAAA;YACX,CAAC,CAAC,CAAA;YAEJ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAClE,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;YAEjD,MAAM,WAAW,GAAG,IAAI,yCAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAErE,sBAAsB;YACtB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,iCAAmB,CAC3B,2CAA2C,EAC3C,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;YAEjC,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,OAAO;oBACb,GAAG;oBACH,WAAW;iBACZ;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAC,YAAY,CAC1B,GAAW,EACX,OAAwB;QAExB,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,WAAW,CACtB,WAAmB,EACnB,OAAwB;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,EAAE;YAChE,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,yEAAyE;YACzE,MAAM,IAAI,4BAAc,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,IAAI,IAAA,gBAAW,EAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,+BAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,+BAAiB,CACzB,wBAAwB,EACxB,oBAAoB,CACrB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,eAAe,CAC7B,GAAoB,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAA6B;QAEjD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,+BAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI;aAC5C,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;aAC9D,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,IAAI,iCAAmB,CAAC,mBAAmB,EAAE,cAAc,EAAE;oBACjE,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,iCAAmB,CAC3B,6BAA6B,EAC7B,cAAc,EACd,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEJ,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,oDAAoD;QACpD,IAAI,eAAe,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,eAAe,CAAC,GAAG,EAAE,CAAC;YAC/D,MAAM,IAAI,iCAAmB,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAA;QACrE,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,sEAAsE;YACtE,yEAAyE;YACzE,+DAA+D;YAC/D,yEAAyE;YACzE,mBAAmB;YACnB,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,wDAAwD;YACxD,8CAA8C;YAC9C,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,CAAC,IAAA,wBAAW,EAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAU,EAAE,CAAA;IAC7C,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,GAAoB,EACpB,IAAyB;QAEzB,MAAM,aAAa,GAAG,KAAK,EACzB,GAAW,EACX,YAAqB,EACJ,EAAE;YACnB,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,+BAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,KAAK,GACT,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YACnE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,+BAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,SAAS,GAAG,IAAA,gCAAuB,EAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,+BAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,iCAAsB,EAAC,SAAS,CAAC,CAAA;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,+BAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CAAA;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,+BAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,0BAAY,EAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAA,uBAAgB,EAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;QACzE,IACE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,+BAAiB,CACzB,yCAAyC,EACzC,gBAAgB,CACjB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF;AA7dD,oCA6dC;AAED,UAAU;AACV,YAAY;AAEZ,SAAgB,aAAa,CAC3B,IAA2E,EAC3E,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,KAAK,GAAG,CAAA;IACrC,CAAC;AACH,CAAC;AAED,IAAK,QAIJ;AAJD,WAAK,QAAQ;IACX,2BAAe,CAAA;IACf,6BAAiB,CAAA;IACjB,yBAAa,CAAA;AACf,CAAC,EAJI,QAAQ,KAAR,QAAQ,QAIZ;AAED,MAAM,wBAAwB,GAAG,CAC/B,GAAoB,EAC4B,EAAE;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAClD,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,iCAAmB,CAC3B,gCAAgC,EAChC,cAAc,CACf,CAAA;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAExC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAElC,MAAM,IAAI,iCAAmB,CAC3B,mCAAmC,MAAM,CAAC,CAAC,CAAC,EAAE,EAC9C,cAAc,CACf,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAW,EAAE;IAChE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAmB,EAAE;IAChE,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC5C,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,GAAoB,EAAE,EAAE;IAClD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CACrB,GAAoB,EAC2B,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC3D,qEAAqE;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAEM,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAa,EAAE;IACjE,OAAO,IAAA,6BAAe,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAC7C,CAAC,CAAA;AAFY,QAAA,qBAAqB,yBAEjC;AAED,MAAM,UAAU,GAAG,IAAI,qBAAU,CAAC,WAAW,CAAC,CAAA;AACvC,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAa,EAAE;IACvE,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAC/D,OAAO,IAAA,6BAAe,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;AAChD,CAAC,CAAA;AAHY,QAAA,qBAAqB,yBAGjC;AAED,SAAS,cAAc,CAAC,GAAmB;IACzC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IACzC,IAAA,iBAAU,EAAC,GAAG,EAAE,eAAe,CAAC,CAAA;AAClC,CAAC","sourcesContent":["import { KeyObject, createPublicKey, createSecretKey } from 'node:crypto'\nimport { IncomingMessage, ServerResponse } from 'node:http'\nimport * as jose from 'jose'\nimport KeyEncoder from 'key-encoder'\nimport { getVerificationMaterial } from '@atproto/common'\nimport { IdResolver, getDidKeyFromMultibase } from '@atproto/identity'\nimport {\n  OAuthError,\n  OAuthVerifier,\n  VerifyTokenPayloadOptions,\n  WWWAuthenticateError,\n} from '@atproto/oauth-provider'\nimport {\n  ScopePermissions,\n  ScopePermissionsTransition,\n} from '@atproto/oauth-scopes'\nimport {\n  AuthRequiredError,\n  Awaitable,\n  ForbiddenError,\n  InvalidRequestError,\n  MethodAuthContext,\n  MethodAuthVerifier,\n  Params,\n  XRPCError,\n  parseReqNsid,\n  verifyJwt as verifyServiceJwt,\n} from '@atproto/xrpc-server'\nimport { AccountManager } from './account-manager/account-manager'\nimport { ActorAccount } from './account-manager/helpers/account'\nimport {\n  AccessOutput,\n  AdminTokenOutput,\n  ModServiceOutput,\n  OAuthOutput,\n  RefreshOutput,\n  UnauthenticatedOutput,\n  UserServiceAuthOutput,\n} from './auth-output'\nimport { ACCESS_STANDARD, AuthScope, isAuthScope } from './auth-scope'\nimport { softDeleted } from './db'\nimport { appendVary } from './util/http'\nimport { WithRequired } from './util/types'\n\nexport type VerifiedOptions = {\n  checkTakedown?: boolean\n  checkDeactivated?: boolean\n}\n\nexport type ScopedOptions<S extends AuthScope = AuthScope> = {\n  scopes?: readonly S[]\n}\n\nexport type ExtraScopedOptions<S extends AuthScope = AuthScope> = {\n  additional?: readonly S[]\n}\n\nexport type AuthorizedOptions<P extends Params = Params> = {\n  authorize: (\n    permissions: ScopePermissions,\n    ctx: MethodAuthContext<P>,\n  ) => Awaitable<void>\n}\n\nexport type AuthVerifierOpts = {\n  publicUrl: string\n  jwtKey: KeyObject\n  adminPass: string\n  dids: {\n    pds: string\n    entryway?: string\n    modService?: string\n  }\n}\n\nexport type VerifyBearerJwtOptions<S extends AuthScope = AuthScope> =\n  WithRequired<\n    Omit<jose.JWTVerifyOptions, 'scopes'> & {\n      scopes: readonly S[]\n    },\n    'audience' | 'typ'\n  >\n\nexport type VerifyBearerJwtResult<S extends AuthScope = AuthScope> = {\n  sub: string\n  aud: string\n  jti: string | undefined\n  scope: S\n}\n\nexport class AuthVerifier {\n  private _publicUrl: string\n  private _jwtKey: KeyObject\n  private _adminPass: string\n  public dids: AuthVerifierOpts['dids']\n\n  constructor(\n    public accountManager: AccountManager,\n    public idResolver: IdResolver,\n    public oauthVerifier: OAuthVerifier,\n    opts: AuthVerifierOpts,\n  ) {\n    this._publicUrl = opts.publicUrl\n    this._jwtKey = opts.jwtKey\n    this._adminPass = opts.adminPass\n    this.dids = opts.dids\n  }\n\n  // verifiers (arrow fns to preserve scope)\n\n  public unauthenticated: MethodAuthVerifier<UnauthenticatedOutput> = (ctx) => {\n    setAuthHeaders(ctx.res)\n\n    // @NOTE this auth method is typically used as fallback when no other auth\n    // method is applicable. This means that the presence of an \"authorization\"\n    // header means that that header is invalid (as it did not match any of the\n    // other auth methods).\n    if (ctx.req.headers['authorization']) {\n      throw new AuthRequiredError('Invalid authorization header')\n    }\n\n    return {\n      credentials: null,\n    }\n  }\n\n  public adminToken: MethodAuthVerifier<AdminTokenOutput> = async (ctx) => {\n    setAuthHeaders(ctx.res)\n    const parsed = parseBasicAuth(ctx.req)\n    if (!parsed) {\n      throw new AuthRequiredError()\n    }\n    const { username, password } = parsed\n    if (username !== 'admin' || password !== this._adminPass) {\n      throw new AuthRequiredError()\n    }\n\n    return { credentials: { type: 'admin_token' } }\n  }\n\n  public modService: MethodAuthVerifier<ModServiceOutput> = async (ctx) => {\n    setAuthHeaders(ctx.res)\n    if (!this.dids.modService) {\n      throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n    }\n    const payload = await this.verifyServiceJwt(ctx.req, {\n      iss: [this.dids.modService, `${this.dids.modService}#atproto_labeler`],\n    })\n    return {\n      credentials: {\n        type: 'mod_service',\n        did: payload.iss,\n      },\n    }\n  }\n\n  public moderator: MethodAuthVerifier<AdminTokenOutput | ModServiceOutput> =\n    async (ctx) => {\n      const type = extractAuthType(ctx.req)\n      if (type === AuthType.BEARER) {\n        return this.modService(ctx)\n      } else {\n        return this.adminToken(ctx)\n      }\n    }\n\n  protected access<S extends AuthScope>(\n    options: VerifiedOptions & Required<ScopedOptions<S>>,\n  ): MethodAuthVerifier<AccessOutput<S>> {\n    const { scopes, ...statusOptions } = options\n\n    const verifyJwtOptions: VerifyBearerJwtOptions<S> = {\n      audience: this.dids.pds,\n      typ: 'at+jwt',\n      scopes:\n        // @NOTE We can reject taken down credentials based on the scope if\n        // \"checkTakedown\" is set.\n        statusOptions.checkTakedown && scopes.includes(AuthScope.Takendown as S)\n          ? scopes.filter((s) => s !== AuthScope.Takendown)\n          : scopes,\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const { sub: did, scope } = await this.verifyBearerJwt(\n        ctx.req,\n        verifyJwtOptions,\n      )\n\n      await this.verifyStatus(did, statusOptions)\n\n      return {\n        credentials: { type: 'access', did, scope },\n      }\n    }\n  }\n\n  public refresh(options?: {\n    allowExpired?: boolean\n  }): MethodAuthVerifier<RefreshOutput> {\n    const verifyOptions: VerifyBearerJwtOptions<AuthScope.Refresh> = {\n      clockTolerance: options?.allowExpired ? Infinity : undefined,\n      typ: 'refresh+jwt',\n      // when using entryway, proxying refresh credentials\n      audience: this.dids.entryway ? this.dids.entryway : this.dids.pds,\n      scopes: [AuthScope.Refresh],\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const result = await this.verifyBearerJwt(ctx.req, verifyOptions)\n\n      const tokenId = result.jti\n      if (!tokenId) {\n        throw new AuthRequiredError(\n          'Unexpected missing refresh token id',\n          'MissingTokenId',\n        )\n      }\n\n      return {\n        credentials: {\n          type: 'refresh',\n          did: result.sub,\n          scope: result.scope,\n          tokenId,\n        },\n      }\n    }\n  }\n\n  public authorization<P extends Params>({\n    scopes = ACCESS_STANDARD,\n    additional = [],\n    ...options\n  }: VerifiedOptions &\n    ScopedOptions &\n    ExtraScopedOptions &\n    AuthorizedOptions<P>): MethodAuthVerifier<AccessOutput | OAuthOutput, P> {\n    const access = this.access({\n      ...options,\n      scopes: [...scopes, ...additional],\n    })\n    const oauth = this.oauth(options)\n\n    return async (ctx) => {\n      const type = extractAuthType(ctx.req)\n\n      if (type === AuthType.BEARER) {\n        return access(ctx)\n      }\n\n      if (type === AuthType.DPOP) {\n        return oauth(ctx)\n      }\n\n      // Auth headers are set through the access and oauth methods so we only\n      // need to set them here if we reach this point\n      setAuthHeaders(ctx.res)\n\n      if (type !== null) {\n        throw new InvalidRequestError(\n          'Unexpected authorization type',\n          'InvalidToken',\n        )\n      }\n\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n  }\n\n  public authorizationOrAdminTokenOptional<P extends Params>(\n    opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>,\n  ): MethodAuthVerifier<\n    OAuthOutput | AccessOutput | AdminTokenOutput | UnauthenticatedOutput,\n    P\n  > {\n    const authorization = this.authorization(opts)\n    return async (ctx) => {\n      const type = extractAuthType(ctx.req)\n      if (type === AuthType.BEARER || type === AuthType.DPOP) {\n        return authorization(ctx)\n      } else if (type === AuthType.BASIC) {\n        return this.adminToken(ctx)\n      } else {\n        return this.unauthenticated(ctx)\n      }\n    }\n  }\n\n  public userServiceAuth: MethodAuthVerifier<UserServiceAuthOutput> = async (\n    ctx,\n  ) => {\n    setAuthHeaders(ctx.res)\n    const payload = await this.verifyServiceJwt(ctx.req)\n    return {\n      credentials: {\n        type: 'user_service_auth',\n        did: payload.iss,\n      },\n    }\n  }\n\n  public userServiceAuthOptional: MethodAuthVerifier<\n    UserServiceAuthOutput | UnauthenticatedOutput\n  > = async (ctx) => {\n    const type = extractAuthType(ctx.req)\n    if (type === AuthType.BEARER) {\n      return await this.userServiceAuth(ctx)\n    } else {\n      return this.unauthenticated(ctx)\n    }\n  }\n\n  public authorizationOrUserServiceAuth<P extends Params>(\n    options: VerifiedOptions &\n      ScopedOptions &\n      ExtraScopedOptions &\n      AuthorizedOptions<P>,\n  ): MethodAuthVerifier<UserServiceAuthOutput | OAuthOutput | AccessOutput, P> {\n    const authorizationVerifier = this.authorization(options)\n    return async (ctx) => {\n      if (isDefinitelyServiceAuth(ctx.req)) {\n        return this.userServiceAuth(ctx)\n      } else {\n        return authorizationVerifier(ctx)\n      }\n    }\n  }\n\n  protected oauth<P extends Params>({\n    authorize,\n    ...verifyStatusOptions\n  }: VerifiedOptions & AuthorizedOptions<P>): MethodAuthVerifier<\n    OAuthOutput,\n    P\n  > {\n    const verifyTokenOptions: VerifyTokenPayloadOptions = {\n      audience: [this.dids.pds],\n      scope: ['atproto'],\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const { req, res } = ctx\n\n      // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2\n      const dpopNonce = this.oauthVerifier.nextDpopNonce()\n      if (dpopNonce) {\n        res.setHeader('DPoP-Nonce', dpopNonce)\n        res.appendHeader('Access-Control-Expose-Headers', 'DPoP-Nonce')\n      }\n\n      const originalUrl = req.originalUrl || req.url || '/'\n      const url = new URL(originalUrl, this._publicUrl)\n\n      const { scope, sub: did } = await this.oauthVerifier\n        .authenticateRequest(\n          req.method || 'GET',\n          url,\n          req.headers,\n          verifyTokenOptions,\n        )\n        .catch((err) => {\n          // Make sure to include any WWW-Authenticate header in the response\n          // (particularly useful for DPoP's \"use_dpop_nonce\" error)\n          if (err instanceof WWWAuthenticateError) {\n            res.setHeader('WWW-Authenticate', err.wwwAuthenticateHeader)\n            res.appendHeader(\n              'Access-Control-Expose-Headers',\n              'WWW-Authenticate',\n            )\n          }\n\n          if (err instanceof OAuthError) {\n            throw new XRPCError(err.status, err.error_description, err.error)\n          }\n\n          throw err\n        })\n\n      if (typeof did !== 'string' || !did.startsWith('did:')) {\n        throw new InvalidRequestError('Malformed token', 'InvalidToken')\n      }\n\n      await this.verifyStatus(did, verifyStatusOptions)\n\n      const permissions = new ScopePermissionsTransition(scope?.split(' '))\n\n      // Should never happen\n      if (!permissions.scopes.has('atproto')) {\n        throw new InvalidRequestError(\n          'OAuth token does not have \"atproto\" scope',\n          'InvalidToken',\n        )\n      }\n\n      await authorize(permissions, ctx)\n\n      return {\n        credentials: {\n          type: 'oauth',\n          did,\n          permissions,\n        },\n      }\n    }\n  }\n\n  protected async verifyStatus(\n    did: string,\n    options: VerifiedOptions,\n  ): Promise<void> {\n    if (options.checkDeactivated || options.checkTakedown) {\n      await this.findAccount(did, options)\n    }\n  }\n\n  /**\n   * Finds an account by its handle or DID, returning possibly deactivated or\n   * taken down accounts (unless `options.checkDeactivated` or\n   * `options.checkTakedown` are set to true, respectively).\n   */\n  public async findAccount(\n    handleOrDid: string,\n    options: VerifiedOptions,\n  ): Promise<ActorAccount> {\n    const account = await this.accountManager.getAccount(handleOrDid, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n    if (!account) {\n      // will be turned into ExpiredToken for the client if proxied by entryway\n      throw new ForbiddenError('Account not found', 'AccountNotFound')\n    }\n    if (options.checkTakedown && softDeleted(account)) {\n      throw new AuthRequiredError(\n        'Account has been taken down',\n        'AccountTakedown',\n      )\n    }\n    if (options.checkDeactivated && account.deactivatedAt) {\n      throw new AuthRequiredError(\n        'Account is deactivated',\n        'AccountDeactivated',\n      )\n    }\n    return account\n  }\n\n  /**\n   * Wraps {@link jose.jwtVerify} into a function that also validates the token\n   * payload's type and wraps errors into {@link InvalidRequestError}.\n   */\n  protected async verifyBearerJwt<S extends AuthScope = AuthScope>(\n    req: IncomingMessage,\n    { scopes, ...options }: VerifyBearerJwtOptions<S>,\n  ): Promise<VerifyBearerJwtResult<S>> {\n    const token = bearerTokenFromReq(req)\n    if (!token) {\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n\n    const { payload, protectedHeader } = await jose\n      .jwtVerify(token, this._jwtKey, { ...options, typ: undefined })\n      .catch((cause) => {\n        if (cause instanceof jose.errors.JWTExpired) {\n          throw new InvalidRequestError('Token has expired', 'ExpiredToken', {\n            cause,\n          })\n        } else {\n          throw new InvalidRequestError(\n            'Token could not be verified',\n            'InvalidToken',\n            { cause },\n          )\n        }\n      })\n\n    // @NOTE: the \"typ\" is now set in production environments, so we should be\n    // able to safely check it through jose.jwtVerify(). However, tests depend\n    // on @atproto/pds-entryway which does not set \"typ\" in the access tokens.\n    // For that reason, we still allow it to be missing.\n    if (protectedHeader.typ && options.typ !== protectedHeader.typ) {\n      throw new InvalidRequestError('Invalid token type', 'InvalidToken')\n    }\n\n    const { sub, aud, scope, lxm, cnf, jti } = payload\n\n    if (typeof lxm !== 'undefined') {\n      // Service auth tokens should never make it to here. But since service\n      // auth tokens do not have a \"typ\" header, the \"typ\" check above will not\n      // catch them. This check here is mainly to protect against the\n      // hypothetical case in which a PDS would issue service auth tokens using\n      // its private key.\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof cnf !== 'undefined') {\n      // Proof-of-Possession (PoP) tokens are not allowed here\n      // https://www.rfc-editor.org/rfc/rfc7800.html\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof sub !== 'string' || !sub.startsWith('did:')) {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof aud !== 'string' || !aud.startsWith('did:')) {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof jti !== 'string' && typeof jti !== 'undefined') {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (!isAuthScope(scope) || !scopes.includes(scope as any)) {\n      throw new InvalidRequestError('Bad token scope', 'InvalidToken')\n    }\n\n    return { sub, aud, jti, scope: scope as S }\n  }\n\n  protected async verifyServiceJwt(\n    req: IncomingMessage,\n    opts?: { iss?: string[] },\n  ) {\n    const getSigningKey = async (\n      iss: string,\n      forceRefresh: boolean,\n    ): Promise<string> => {\n      if (opts?.iss && !opts.iss.includes(iss)) {\n        throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n      }\n      const [did, serviceId] = iss.split('#')\n      const keyId =\n        serviceId === 'atproto_labeler' ? 'atproto_label' : 'atproto'\n      const didDoc = await this.idResolver.did.resolve(did, forceRefresh)\n      if (!didDoc) {\n        throw new AuthRequiredError('could not resolve iss did')\n      }\n      const parsedKey = getVerificationMaterial(didDoc, keyId)\n      if (!parsedKey) {\n        throw new AuthRequiredError('missing or bad key in did doc')\n      }\n      const didKey = getDidKeyFromMultibase(parsedKey)\n      if (!didKey) {\n        throw new AuthRequiredError('missing or bad key in did doc')\n      }\n      return didKey\n    }\n\n    const jwtStr = bearerTokenFromReq(req)\n    if (!jwtStr) {\n      throw new AuthRequiredError('missing jwt', 'MissingJwt')\n    }\n    const nsid = parseReqNsid(req)\n    const payload = await verifyServiceJwt(jwtStr, null, nsid, getSigningKey)\n    if (\n      payload.aud !== this.dids.pds &&\n      (!this.dids.entryway || payload.aud !== this.dids.entryway)\n    ) {\n      throw new AuthRequiredError(\n        'jwt audience does not match service did',\n        'BadJwtAudience',\n      )\n    }\n    return payload\n  }\n}\n\n// HELPERS\n// ---------\n\nexport function isUserOrAdmin(\n  auth: AccessOutput | OAuthOutput | AdminTokenOutput | UnauthenticatedOutput,\n  did: string,\n): boolean {\n  if (!auth.credentials) {\n    return false\n  } else if (auth.credentials.type === 'admin_token') {\n    return true\n  } else {\n    return auth.credentials.did === did\n  }\n}\n\nenum AuthType {\n  BASIC = 'Basic',\n  BEARER = 'Bearer',\n  DPOP = 'DPoP',\n}\n\nconst parseAuthorizationHeader = (\n  req: IncomingMessage,\n): [type: null] | [type: AuthType, token: string] => {\n  const authorization = req.headers['authorization']\n  if (!authorization) return [null]\n\n  const result = authorization.split(' ')\n  if (result.length !== 2) {\n    throw new InvalidRequestError(\n      'Malformed authorization header',\n      'InvalidToken',\n    )\n  }\n\n  // authorization type is case-insensitive\n  const authType = result[0].toUpperCase()\n\n  const type = Object.hasOwn(AuthType, authType) ? AuthType[authType] : null\n  if (type) return [type, result[1]]\n\n  throw new InvalidRequestError(\n    `Unsupported authorization type: ${result[0]}`,\n    'InvalidToken',\n  )\n}\n\n/**\n * @note Not all service auth tokens are guaranteed to have \"lxm\" claim, so this\n * function should not be used to verify service auth tokens. It is only used to\n * check if a token is definitely a service auth token.\n */\nconst isDefinitelyServiceAuth = (req: IncomingMessage): boolean => {\n  const token = bearerTokenFromReq(req)\n  if (!token) return false\n  const payload = jose.decodeJwt(token)\n  return payload['lxm'] != null\n}\n\nconst extractAuthType = (req: IncomingMessage): AuthType | null => {\n  const [type] = parseAuthorizationHeader(req)\n  return type\n}\n\nconst bearerTokenFromReq = (req: IncomingMessage) => {\n  const [type, token] = parseAuthorizationHeader(req)\n  return type === AuthType.BEARER ? token : null\n}\n\nconst parseBasicAuth = (\n  req: IncomingMessage,\n): { username: string; password: string } | null => {\n  try {\n    const [type, b64] = parseAuthorizationHeader(req)\n    if (type !== AuthType.BASIC) return null\n    const decoded = Buffer.from(b64, 'base64').toString('utf8')\n    // We must not use split(':') because the password can contain colons\n    const colon = decoded.indexOf(':')\n    if (colon === -1) return null\n    const username = decoded.slice(0, colon)\n    const password = decoded.slice(colon + 1)\n    return { username, password }\n  } catch (err) {\n    return null\n  }\n}\n\nexport const createSecretKeyObject = (secret: string): KeyObject => {\n  return createSecretKey(Buffer.from(secret))\n}\n\nconst keyEncoder = new KeyEncoder('secp256k1')\nexport const createPublicKeyObject = (publicKeyHex: string): KeyObject => {\n  const key = keyEncoder.encodePublic(publicKeyHex, 'raw', 'pem')\n  return createPublicKey({ format: 'pem', key })\n}\n\nfunction setAuthHeaders(res: ServerResponse) {\n  res.setHeader('Cache-Control', 'private')\n  appendVary(res, 'Authorization')\n}\n"]}
+{"version":3,"file":"auth-verifier.js","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8jBA,sCAWC;AAzkBD,6CAAyE;AAEzE,2CAA4B;AAC5B,8DAAoC;AACpC,4CAAyD;AACzD,gDAAsE;AACtE,sCAAyE;AACzE,4DAKgC;AAChC,wDAG8B;AAC9B,sDAW6B;AAY7B,6CAAsE;AACtE,6BAAkC;AAClC,sCAAwC;AAiDxC,MAAa,YAAY;IAMvB,YACS,cAA8B,EAC9B,UAAsB,EACtB,aAA4B,EACnC,IAAsB;QAHtB;;;;mBAAO,cAAc;WAAgB;QACrC;;;;mBAAO,UAAU;WAAY;QAC7B;;;;mBAAO,aAAa;WAAe;QAR7B;;;;;WAAkB;QAClB;;;;;WAAkB;QAClB;;;;;WAAkB;QACnB;;;;;WAA8B;QAcrC,0CAA0C;QAEnC;;;;mBAA6D,CAAC,GAAG,EAAE,EAAE;gBAC1E,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBAEvB,0EAA0E;gBAC1E,2EAA2E;gBAC3E,2EAA2E;gBAC3E,uBAAuB;gBACvB,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;oBACrC,MAAM,IAAI,+BAAiB,CAAC,8BAA8B,CAAC,CAAA;gBAC7D,CAAC;gBAED,OAAO;oBACL,WAAW,EAAE,IAAI;iBAClB,CAAA;YACH,CAAC;WAAA;QAEM;;;;mBAAmD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACvB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACtC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,+BAAiB,EAAE,CAAA;gBAC/B,CAAC;gBACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;gBACrC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;oBACzD,MAAM,IAAI,+BAAiB,EAAE,CAAA;gBAC/B,CAAC;gBAED,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAA;YACjD,CAAC;WAAA;QAEM;;;;mBAAmD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC1B,MAAM,IAAI,+BAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;gBACjE,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;oBACnD,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC;iBACvE,CAAC,CAAA;gBACF,OAAO;oBACL,WAAW,EAAE;wBACX,IAAI,EAAE,aAAa;wBACnB,GAAG,EAAE,OAAO,CAAC,GAAG;qBACjB;iBACF,CAAA;YACH,CAAC;WAAA;QAEM;;;;mBACL,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;gBAC7B,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;gBAC7B,CAAC;YACH,CAAC;WAAA;QAgII;;;;mBAA6D,KAAK,EACvE,GAAG,EACH,EAAE;gBACF,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO;oBACL,WAAW,EAAE;wBACX,IAAI,EAAE,mBAAmB;wBACzB,GAAG,EAAE,OAAO,CAAC,GAAG;qBACjB;iBACF,CAAA;YACH,CAAC;WAAA;QAEM;;;;mBAEH,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC7B,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBACxC,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBAClC,CAAC;YACH,CAAC;WAAA;QApNC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACvB,CAAC;IA4DS,MAAM,CACd,OAAqD;QAErD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAA;QAE5C,MAAM,gBAAgB,GAA8B;YAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YACvB,GAAG,EAAE,QAAQ;YACb,MAAM;YACJ,mEAAmE;YACnE,0BAA0B;YAC1B,aAAa,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,sBAAS,CAAC,SAAc,CAAC;gBACtE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,sBAAS,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,MAAM;SACb,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,GAAG,CAAC,GAAG,EACP,gBAAgB,CACjB,CAAA;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAE3C,OAAO;gBACL,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE;aAC5C,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,OAAO,CAAC,OAEd;QACC,MAAM,aAAa,GAA8C;YAC/D,cAAc,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC5D,GAAG,EAAE,aAAa;YAClB,oDAAoD;YACpD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACjE,MAAM,EAAE,CAAC,sBAAS,CAAC,OAAO,CAAC;SAC5B,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAEjE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAA;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,+BAAiB,CACzB,qCAAqC,EACrC,gBAAgB,CACjB,CAAA;YACH,CAAC;YAED,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO;iBACR;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,aAAa,CAAmB,EACrC,MAAM,GAAG,4BAAe,EACxB,UAAU,GAAG,EAAE,EACf,GAAG,OAAO,EAIU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC;SACnC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAErC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAA;YACnB,CAAC;YAED,uEAAuE;YACvE,+CAA+C;YAC/C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,iCAAmB,CAC3B,+BAA+B,EAC/B,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,IAAI,+BAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC,CAAA;IACH,CAAC;IAEM,iCAAiC,CACtC,IAAiE;QAKjE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IA0BM,8BAA8B,CACnC,OAGsB;QAEtB,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACzD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAmB,EAChC,SAAS,EACT,GAAG,mBAAmB,EACiB;QAIvC,MAAM,kBAAkB,GAA8B;YACpD,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,KAAK,EAAE,CAAC,SAAS,CAAC;SACnB,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAA;YAExB,4DAA4D;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAA;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;gBACtC,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,YAAY,CAAC,CAAA;YACjE,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;YACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YAEjD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa;iBACjD,mBAAmB,CAClB,GAAG,CAAC,MAAM,IAAI,KAAK,EACnB,GAAG,EACH,GAAG,CAAC,OAAO,EACX,kBAAkB,CACnB;iBACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,mEAAmE;gBACnE,0DAA0D;gBAC1D,IAAI,GAAG,YAAY,qCAAoB,EAAE,CAAC;oBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;oBAC5D,GAAG,CAAC,YAAY,CACd,+BAA+B,EAC/B,kBAAkB,CACnB,CAAA;gBACH,CAAC;gBAED,IAAI,GAAG,YAAY,2BAAU,EAAE,CAAC;oBAC9B,MAAM,IAAI,uBAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBACnE,CAAC;gBAED,MAAM,GAAG,CAAA;YACX,CAAC,CAAC,CAAA;YAEJ,IAAI,CAAC,IAAA,iBAAW,EAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAClE,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;YAEjD,MAAM,WAAW,GAAG,IAAI,yCAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAErE,sBAAsB;YACtB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,iCAAmB,CAC3B,2CAA2C,EAC3C,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;YAEjC,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,OAAO;oBACb,GAAG;oBACH,WAAW;iBACZ;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAC,YAAY,CAC1B,GAAc,EACd,OAAwB;QAExB,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,WAAW,CACtB,WAA+B,EAC/B,OAAwB;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,EAAE;YAChE,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,yEAAyE;YACzE,MAAM,IAAI,4BAAc,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,IAAI,IAAA,gBAAW,EAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,+BAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,+BAAiB,CACzB,wBAAwB,EACxB,oBAAoB,CACrB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,eAAe,CAC7B,GAAoB,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAA6B;QAEjD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,+BAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI;aAC5C,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;aAC9D,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,IAAI,iCAAmB,CAAC,mBAAmB,EAAE,cAAc,EAAE;oBACjE,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,iCAAmB,CAC3B,6BAA6B,EAC7B,cAAc,EACd,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEJ,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,oDAAoD;QACpD,IAAI,eAAe,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,eAAe,CAAC,GAAG,EAAE,CAAC;YAC/D,MAAM,IAAI,iCAAmB,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAA;QACrE,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,sEAAsE;YACtE,yEAAyE;YACzE,+DAA+D;YAC/D,yEAAyE;YACzE,mBAAmB;YACnB,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,wDAAwD;YACxD,8CAA8C;YAC9C,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAA,iBAAW,EAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,CAAC,IAAA,wBAAW,EAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAU,EAAE,CAAA;IAC7C,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,GAAoB,EACpB,IAAyB;QAEzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,+BAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0BAAY,EAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAA,uBAAgB,EACpC,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE;YAC1B,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,+BAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,KAAK,GACT,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YACnE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,+BAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,SAAS,GAAG,IAAA,gCAAuB,EAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,+BAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,iCAAsB,EAAC,SAAS,CAAC,CAAA;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,+BAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CACF,CAAA;QACD,IACE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,+BAAiB,CACzB,yCAAyC,EACzC,gBAAgB,CACjB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF;AA9dD,oCA8dC;AAED,UAAU;AACV,YAAY;AAEZ,SAAgB,aAAa,CAC3B,IAA2E,EAC3E,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,KAAK,GAAG,CAAA;IACrC,CAAC;AACH,CAAC;AAED,IAAK,QAIJ;AAJD,WAAK,QAAQ;IACX,2BAAe,CAAA;IACf,6BAAiB,CAAA;IACjB,yBAAa,CAAA;AACf,CAAC,EAJI,QAAQ,KAAR,QAAQ,QAIZ;AAED,MAAM,wBAAwB,GAAG,CAC/B,GAAoB,EAC4B,EAAE;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAClD,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,iCAAmB,CAC3B,gCAAgC,EAChC,cAAc,CACf,CAAA;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAExC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAElC,MAAM,IAAI,iCAAmB,CAC3B,mCAAmC,MAAM,CAAC,CAAC,CAAC,EAAE,EAC9C,cAAc,CACf,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAW,EAAE;IAChE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAmB,EAAE;IAChE,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC5C,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,GAAoB,EAAE,EAAE;IAClD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CACrB,GAAoB,EAC2B,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC3D,qEAAqE;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAEM,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAa,EAAE;IACjE,OAAO,IAAA,6BAAe,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAC7C,CAAC,CAAA;AAFY,QAAA,qBAAqB,yBAEjC;AAED,MAAM,UAAU,GAAG,IAAI,qBAAU,CAAC,WAAW,CAAC,CAAA;AACvC,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAa,EAAE;IACvE,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAC/D,OAAO,IAAA,6BAAe,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;AAChD,CAAC,CAAA;AAHY,QAAA,qBAAqB,yBAGjC;AAED,SAAS,cAAc,CAAC,GAAmB;IACzC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IACzC,IAAA,iBAAU,EAAC,GAAG,EAAE,eAAe,CAAC,CAAA;AAClC,CAAC","sourcesContent":["import { KeyObject, createPublicKey, createSecretKey } from 'node:crypto'\nimport { IncomingMessage, ServerResponse } from 'node:http'\nimport * as jose from 'jose'\nimport KeyEncoder from 'key-encoder'\nimport { getVerificationMaterial } from '@atproto/common'\nimport { IdResolver, getDidKeyFromMultibase } from '@atproto/identity'\nimport { AtIdentifierString, DidString, isDidString } from '@atproto/lex'\nimport {\n  OAuthError,\n  OAuthVerifier,\n  VerifyTokenPayloadOptions,\n  WWWAuthenticateError,\n} from '@atproto/oauth-provider'\nimport {\n  ScopePermissions,\n  ScopePermissionsTransition,\n} from '@atproto/oauth-scopes'\nimport {\n  AuthRequiredError,\n  Awaitable,\n  ForbiddenError,\n  InvalidRequestError,\n  MethodAuthContext,\n  MethodAuthVerifier,\n  Params,\n  XRPCError,\n  parseReqNsid,\n  verifyJwt as verifyServiceJwt,\n} from '@atproto/xrpc-server'\nimport { AccountManager } from './account-manager/account-manager'\nimport { ActorAccount } from './account-manager/helpers/account'\nimport {\n  AccessOutput,\n  AdminTokenOutput,\n  ModServiceOutput,\n  OAuthOutput,\n  RefreshOutput,\n  UnauthenticatedOutput,\n  UserServiceAuthOutput,\n} from './auth-output'\nimport { ACCESS_STANDARD, AuthScope, isAuthScope } from './auth-scope'\nimport { softDeleted } from './db'\nimport { appendVary } from './util/http'\nimport { WithRequired } from './util/types'\n\nexport type VerifiedOptions = {\n  checkTakedown?: boolean\n  checkDeactivated?: boolean\n}\n\nexport type ScopedOptions<S extends AuthScope = AuthScope> = {\n  scopes?: readonly S[]\n}\n\nexport type ExtraScopedOptions<S extends AuthScope = AuthScope> = {\n  additional?: readonly S[]\n}\n\nexport type AuthorizedOptions<P extends Params = Params> = {\n  authorize: (\n    permissions: ScopePermissions,\n    ctx: MethodAuthContext<P>,\n  ) => Awaitable<void>\n}\n\nexport type AuthVerifierOpts = {\n  publicUrl: string\n  jwtKey: KeyObject\n  adminPass: string\n  dids: {\n    pds: string\n    entryway?: string\n    modService?: string\n  }\n}\n\nexport type VerifyBearerJwtOptions<S extends AuthScope = AuthScope> =\n  WithRequired<\n    Omit<jose.JWTVerifyOptions, 'scopes'> & {\n      scopes: readonly S[]\n    },\n    'audience' | 'typ'\n  >\n\nexport type VerifyBearerJwtResult<S extends AuthScope = AuthScope> = {\n  sub: DidString\n  aud: string\n  jti: string | undefined\n  scope: S\n}\n\nexport class AuthVerifier {\n  private _publicUrl: string\n  private _jwtKey: KeyObject\n  private _adminPass: string\n  public dids: AuthVerifierOpts['dids']\n\n  constructor(\n    public accountManager: AccountManager,\n    public idResolver: IdResolver,\n    public oauthVerifier: OAuthVerifier,\n    opts: AuthVerifierOpts,\n  ) {\n    this._publicUrl = opts.publicUrl\n    this._jwtKey = opts.jwtKey\n    this._adminPass = opts.adminPass\n    this.dids = opts.dids\n  }\n\n  // verifiers (arrow fns to preserve scope)\n\n  public unauthenticated: MethodAuthVerifier<UnauthenticatedOutput> = (ctx) => {\n    setAuthHeaders(ctx.res)\n\n    // @NOTE this auth method is typically used as fallback when no other auth\n    // method is applicable. This means that the presence of an \"authorization\"\n    // header means that that header is invalid (as it did not match any of the\n    // other auth methods).\n    if (ctx.req.headers['authorization']) {\n      throw new AuthRequiredError('Invalid authorization header')\n    }\n\n    return {\n      credentials: null,\n    }\n  }\n\n  public adminToken: MethodAuthVerifier<AdminTokenOutput> = async (ctx) => {\n    setAuthHeaders(ctx.res)\n    const parsed = parseBasicAuth(ctx.req)\n    if (!parsed) {\n      throw new AuthRequiredError()\n    }\n    const { username, password } = parsed\n    if (username !== 'admin' || password !== this._adminPass) {\n      throw new AuthRequiredError()\n    }\n\n    return { credentials: { type: 'admin_token' } }\n  }\n\n  public modService: MethodAuthVerifier<ModServiceOutput> = async (ctx) => {\n    setAuthHeaders(ctx.res)\n    if (!this.dids.modService) {\n      throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n    }\n    const payload = await this.verifyServiceJwt(ctx.req, {\n      iss: [this.dids.modService, `${this.dids.modService}#atproto_labeler`],\n    })\n    return {\n      credentials: {\n        type: 'mod_service',\n        did: payload.iss,\n      },\n    }\n  }\n\n  public moderator: MethodAuthVerifier<AdminTokenOutput | ModServiceOutput> =\n    async (ctx) => {\n      const type = extractAuthType(ctx.req)\n      if (type === AuthType.BEARER) {\n        return this.modService(ctx)\n      } else {\n        return this.adminToken(ctx)\n      }\n    }\n\n  protected access<S extends AuthScope>(\n    options: VerifiedOptions & Required<ScopedOptions<S>>,\n  ): MethodAuthVerifier<AccessOutput<S>> {\n    const { scopes, ...statusOptions } = options\n\n    const verifyJwtOptions: VerifyBearerJwtOptions<S> = {\n      audience: this.dids.pds,\n      typ: 'at+jwt',\n      scopes:\n        // @NOTE We can reject taken down credentials based on the scope if\n        // \"checkTakedown\" is set.\n        statusOptions.checkTakedown && scopes.includes(AuthScope.Takendown as S)\n          ? scopes.filter((s) => s !== AuthScope.Takendown)\n          : scopes,\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const { sub: did, scope } = await this.verifyBearerJwt(\n        ctx.req,\n        verifyJwtOptions,\n      )\n\n      await this.verifyStatus(did, statusOptions)\n\n      return {\n        credentials: { type: 'access', did, scope },\n      }\n    }\n  }\n\n  public refresh(options?: {\n    allowExpired?: boolean\n  }): MethodAuthVerifier<RefreshOutput> {\n    const verifyOptions: VerifyBearerJwtOptions<AuthScope.Refresh> = {\n      clockTolerance: options?.allowExpired ? Infinity : undefined,\n      typ: 'refresh+jwt',\n      // when using entryway, proxying refresh credentials\n      audience: this.dids.entryway ? this.dids.entryway : this.dids.pds,\n      scopes: [AuthScope.Refresh],\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const result = await this.verifyBearerJwt(ctx.req, verifyOptions)\n\n      const tokenId = result.jti\n      if (!tokenId) {\n        throw new AuthRequiredError(\n          'Unexpected missing refresh token id',\n          'MissingTokenId',\n        )\n      }\n\n      return {\n        credentials: {\n          type: 'refresh',\n          did: result.sub,\n          scope: result.scope,\n          tokenId,\n        },\n      }\n    }\n  }\n\n  public authorization<P extends Params>({\n    scopes = ACCESS_STANDARD,\n    additional = [],\n    ...options\n  }: VerifiedOptions &\n    ScopedOptions &\n    ExtraScopedOptions &\n    AuthorizedOptions<P>): MethodAuthVerifier<AccessOutput | OAuthOutput, P> {\n    const access = this.access({\n      ...options,\n      scopes: [...scopes, ...additional],\n    })\n    const oauth = this.oauth(options)\n\n    return async (ctx) => {\n      const type = extractAuthType(ctx.req)\n\n      if (type === AuthType.BEARER) {\n        return access(ctx)\n      }\n\n      if (type === AuthType.DPOP) {\n        return oauth(ctx)\n      }\n\n      // Auth headers are set through the access and oauth methods so we only\n      // need to set them here if we reach this point\n      setAuthHeaders(ctx.res)\n\n      if (type !== null) {\n        throw new InvalidRequestError(\n          'Unexpected authorization type',\n          'InvalidToken',\n        )\n      }\n\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n  }\n\n  public authorizationOrAdminTokenOptional<P extends Params>(\n    opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>,\n  ): MethodAuthVerifier<\n    OAuthOutput | AccessOutput | AdminTokenOutput | UnauthenticatedOutput,\n    P\n  > {\n    const authorization = this.authorization(opts)\n    return async (ctx) => {\n      const type = extractAuthType(ctx.req)\n      if (type === AuthType.BEARER || type === AuthType.DPOP) {\n        return authorization(ctx)\n      } else if (type === AuthType.BASIC) {\n        return this.adminToken(ctx)\n      } else {\n        return this.unauthenticated(ctx)\n      }\n    }\n  }\n\n  public userServiceAuth: MethodAuthVerifier<UserServiceAuthOutput> = async (\n    ctx,\n  ) => {\n    setAuthHeaders(ctx.res)\n    const payload = await this.verifyServiceJwt(ctx.req)\n    return {\n      credentials: {\n        type: 'user_service_auth',\n        did: payload.iss,\n      },\n    }\n  }\n\n  public userServiceAuthOptional: MethodAuthVerifier<\n    UserServiceAuthOutput | UnauthenticatedOutput\n  > = async (ctx) => {\n    const type = extractAuthType(ctx.req)\n    if (type === AuthType.BEARER) {\n      return await this.userServiceAuth(ctx)\n    } else {\n      return this.unauthenticated(ctx)\n    }\n  }\n\n  public authorizationOrUserServiceAuth<P extends Params>(\n    options: VerifiedOptions &\n      ScopedOptions &\n      ExtraScopedOptions &\n      AuthorizedOptions<P>,\n  ): MethodAuthVerifier<UserServiceAuthOutput | OAuthOutput | AccessOutput, P> {\n    const authorizationVerifier = this.authorization(options)\n    return async (ctx) => {\n      if (isDefinitelyServiceAuth(ctx.req)) {\n        return this.userServiceAuth(ctx)\n      } else {\n        return authorizationVerifier(ctx)\n      }\n    }\n  }\n\n  protected oauth<P extends Params>({\n    authorize,\n    ...verifyStatusOptions\n  }: VerifiedOptions & AuthorizedOptions<P>): MethodAuthVerifier<\n    OAuthOutput,\n    P\n  > {\n    const verifyTokenOptions: VerifyTokenPayloadOptions = {\n      audience: [this.dids.pds],\n      scope: ['atproto'],\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const { req, res } = ctx\n\n      // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2\n      const dpopNonce = this.oauthVerifier.nextDpopNonce()\n      if (dpopNonce) {\n        res.setHeader('DPoP-Nonce', dpopNonce)\n        res.appendHeader('Access-Control-Expose-Headers', 'DPoP-Nonce')\n      }\n\n      const originalUrl = req.originalUrl || req.url || '/'\n      const url = new URL(originalUrl, this._publicUrl)\n\n      const { scope, sub: did } = await this.oauthVerifier\n        .authenticateRequest(\n          req.method || 'GET',\n          url,\n          req.headers,\n          verifyTokenOptions,\n        )\n        .catch((err) => {\n          // Make sure to include any WWW-Authenticate header in the response\n          // (particularly useful for DPoP's \"use_dpop_nonce\" error)\n          if (err instanceof WWWAuthenticateError) {\n            res.setHeader('WWW-Authenticate', err.wwwAuthenticateHeader)\n            res.appendHeader(\n              'Access-Control-Expose-Headers',\n              'WWW-Authenticate',\n            )\n          }\n\n          if (err instanceof OAuthError) {\n            throw new XRPCError(err.status, err.error_description, err.error)\n          }\n\n          throw err\n        })\n\n      if (!isDidString(did)) {\n        throw new InvalidRequestError('Malformed token', 'InvalidToken')\n      }\n\n      await this.verifyStatus(did, verifyStatusOptions)\n\n      const permissions = new ScopePermissionsTransition(scope?.split(' '))\n\n      // Should never happen\n      if (!permissions.scopes.has('atproto')) {\n        throw new InvalidRequestError(\n          'OAuth token does not have \"atproto\" scope',\n          'InvalidToken',\n        )\n      }\n\n      await authorize(permissions, ctx)\n\n      return {\n        credentials: {\n          type: 'oauth',\n          did,\n          permissions,\n        },\n      }\n    }\n  }\n\n  protected async verifyStatus(\n    did: DidString,\n    options: VerifiedOptions,\n  ): Promise<void> {\n    if (options.checkDeactivated || options.checkTakedown) {\n      await this.findAccount(did, options)\n    }\n  }\n\n  /**\n   * Finds an account by its handle or DID, returning possibly deactivated or\n   * taken down accounts (unless `options.checkDeactivated` or\n   * `options.checkTakedown` are set to true, respectively).\n   */\n  public async findAccount(\n    handleOrDid: AtIdentifierString,\n    options: VerifiedOptions,\n  ): Promise<ActorAccount> {\n    const account = await this.accountManager.getAccount(handleOrDid, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n    if (!account) {\n      // will be turned into ExpiredToken for the client if proxied by entryway\n      throw new ForbiddenError('Account not found', 'AccountNotFound')\n    }\n    if (options.checkTakedown && softDeleted(account)) {\n      throw new AuthRequiredError(\n        'Account has been taken down',\n        'AccountTakedown',\n      )\n    }\n    if (options.checkDeactivated && account.deactivatedAt) {\n      throw new AuthRequiredError(\n        'Account is deactivated',\n        'AccountDeactivated',\n      )\n    }\n    return account\n  }\n\n  /**\n   * Wraps {@link jose.jwtVerify} into a function that also validates the token\n   * payload's type and wraps errors into {@link InvalidRequestError}.\n   */\n  protected async verifyBearerJwt<S extends AuthScope = AuthScope>(\n    req: IncomingMessage,\n    { scopes, ...options }: VerifyBearerJwtOptions<S>,\n  ): Promise<VerifyBearerJwtResult<S>> {\n    const token = bearerTokenFromReq(req)\n    if (!token) {\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n\n    const { payload, protectedHeader } = await jose\n      .jwtVerify(token, this._jwtKey, { ...options, typ: undefined })\n      .catch((cause) => {\n        if (cause instanceof jose.errors.JWTExpired) {\n          throw new InvalidRequestError('Token has expired', 'ExpiredToken', {\n            cause,\n          })\n        } else {\n          throw new InvalidRequestError(\n            'Token could not be verified',\n            'InvalidToken',\n            { cause },\n          )\n        }\n      })\n\n    // @NOTE: the \"typ\" is now set in production environments, so we should be\n    // able to safely check it through jose.jwtVerify(). However, tests depend\n    // on @atproto/pds-entryway which does not set \"typ\" in the access tokens.\n    // For that reason, we still allow it to be missing.\n    if (protectedHeader.typ && options.typ !== protectedHeader.typ) {\n      throw new InvalidRequestError('Invalid token type', 'InvalidToken')\n    }\n\n    const { sub, aud, scope, lxm, cnf, jti } = payload\n\n    if (typeof lxm !== 'undefined') {\n      // Service auth tokens should never make it to here. But since service\n      // auth tokens do not have a \"typ\" header, the \"typ\" check above will not\n      // catch them. This check here is mainly to protect against the\n      // hypothetical case in which a PDS would issue service auth tokens using\n      // its private key.\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof cnf !== 'undefined') {\n      // Proof-of-Possession (PoP) tokens are not allowed here\n      // https://www.rfc-editor.org/rfc/rfc7800.html\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof sub !== 'string' || !isDidString(sub)) {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof aud !== 'string' || !aud.startsWith('did:')) {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof jti !== 'string' && typeof jti !== 'undefined') {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (!isAuthScope(scope) || !scopes.includes(scope as any)) {\n      throw new InvalidRequestError('Bad token scope', 'InvalidToken')\n    }\n\n    return { sub, aud, jti, scope: scope as S }\n  }\n\n  protected async verifyServiceJwt(\n    req: IncomingMessage,\n    opts?: { iss?: string[] },\n  ) {\n    const jwtStr = bearerTokenFromReq(req)\n    if (!jwtStr) {\n      throw new AuthRequiredError('missing jwt', 'MissingJwt')\n    }\n\n    const nsid = parseReqNsid(req)\n    const payload = await verifyServiceJwt(\n      jwtStr,\n      null,\n      nsid,\n      async (iss, forceRefresh) => {\n        if (opts?.iss && !opts.iss.includes(iss)) {\n          throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n        }\n        const [did, serviceId] = iss.split('#')\n        const keyId =\n          serviceId === 'atproto_labeler' ? 'atproto_label' : 'atproto'\n        const didDoc = await this.idResolver.did.resolve(did, forceRefresh)\n        if (!didDoc) {\n          throw new AuthRequiredError('could not resolve iss did')\n        }\n        const parsedKey = getVerificationMaterial(didDoc, keyId)\n        if (!parsedKey) {\n          throw new AuthRequiredError('missing or bad key in did doc')\n        }\n        const didKey = getDidKeyFromMultibase(parsedKey)\n        if (!didKey) {\n          throw new AuthRequiredError('missing or bad key in did doc')\n        }\n        return didKey\n      },\n    )\n    if (\n      payload.aud !== this.dids.pds &&\n      (!this.dids.entryway || payload.aud !== this.dids.entryway)\n    ) {\n      throw new AuthRequiredError(\n        'jwt audience does not match service did',\n        'BadJwtAudience',\n      )\n    }\n    return payload\n  }\n}\n\n// HELPERS\n// ---------\n\nexport function isUserOrAdmin(\n  auth: AccessOutput | OAuthOutput | AdminTokenOutput | UnauthenticatedOutput,\n  did: string,\n): boolean {\n  if (!auth.credentials) {\n    return false\n  } else if (auth.credentials.type === 'admin_token') {\n    return true\n  } else {\n    return auth.credentials.did === did\n  }\n}\n\nenum AuthType {\n  BASIC = 'Basic',\n  BEARER = 'Bearer',\n  DPOP = 'DPoP',\n}\n\nconst parseAuthorizationHeader = (\n  req: IncomingMessage,\n): [type: null] | [type: AuthType, token: string] => {\n  const authorization = req.headers['authorization']\n  if (!authorization) return [null]\n\n  const result = authorization.split(' ')\n  if (result.length !== 2) {\n    throw new InvalidRequestError(\n      'Malformed authorization header',\n      'InvalidToken',\n    )\n  }\n\n  // authorization type is case-insensitive\n  const authType = result[0].toUpperCase()\n\n  const type = Object.hasOwn(AuthType, authType) ? AuthType[authType] : null\n  if (type) return [type, result[1]]\n\n  throw new InvalidRequestError(\n    `Unsupported authorization type: ${result[0]}`,\n    'InvalidToken',\n  )\n}\n\n/**\n * @note Not all service auth tokens are guaranteed to have \"lxm\" claim, so this\n * function should not be used to verify service auth tokens. It is only used to\n * check if a token is definitely a service auth token.\n */\nconst isDefinitelyServiceAuth = (req: IncomingMessage): boolean => {\n  const token = bearerTokenFromReq(req)\n  if (!token) return false\n  const payload = jose.decodeJwt(token)\n  return payload['lxm'] != null\n}\n\nconst extractAuthType = (req: IncomingMessage): AuthType | null => {\n  const [type] = parseAuthorizationHeader(req)\n  return type\n}\n\nconst bearerTokenFromReq = (req: IncomingMessage) => {\n  const [type, token] = parseAuthorizationHeader(req)\n  return type === AuthType.BEARER ? token : null\n}\n\nconst parseBasicAuth = (\n  req: IncomingMessage,\n): { username: string; password: string } | null => {\n  try {\n    const [type, b64] = parseAuthorizationHeader(req)\n    if (type !== AuthType.BASIC) return null\n    const decoded = Buffer.from(b64, 'base64').toString('utf8')\n    // We must not use split(':') because the password can contain colons\n    const colon = decoded.indexOf(':')\n    if (colon === -1) return null\n    const username = decoded.slice(0, colon)\n    const password = decoded.slice(colon + 1)\n    return { username, password }\n  } catch (err) {\n    return null\n  }\n}\n\nexport const createSecretKeyObject = (secret: string): KeyObject => {\n  return createSecretKey(Buffer.from(secret))\n}\n\nconst keyEncoder = new KeyEncoder('secp256k1')\nexport const createPublicKeyObject = (publicKeyHex: string): KeyObject => {\n  const key = keyEncoder.encodePublic(publicKeyHex, 'raw', 'pem')\n  return createPublicKey({ format: 'pem', key })\n}\n\nfunction setAuthHeaders(res: ServerResponse) {\n  res.setHeader('Cache-Control', 'private')\n  appendVary(res, 'Authorization')\n}\n"]}

package/dist/bsky-app-view.d.ts

@@ -1,13 +1,14 @@
-import { AtpAgent } from '@atproto/api';
+import { Client } from '@atproto/lex';
 export type AppViewOptions = {
     url: string;
     did: string;
     cdnUrlPattern?: string;
+    validateResponse?: boolean;
 };
 export declare class BskyAppView {
     did: string;
     url: string;
-    agent: AtpAgent;
+    client: Client;
     private cdnUrlPattern?;
     constructor(options: AppViewOptions);
     getImageUrl(pattern: string, did: string, cid: string): string | undefined;

package/dist/bsky-app-view.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bsky-app-view.d.ts","sourceRoot":"","sources":["../src/bsky-app-view.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAEvC,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,qBAAa,WAAW;IACf,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,QAAQ,CAAA;IACtB,OAAO,CAAC,aAAa,CAAC,CAAQ;gBAElB,OAAO,EAAE,cAAc;IAOnC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAG3E"}
+{"version":3,"file":"bsky-app-view.d.ts","sourceRoot":"","sources":["../src/bsky-app-view.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED,qBAAa,WAAW;IACf,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,aAAa,CAAC,CAAQ;gBAElB,OAAO,EAAE,cAAc;IAanC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAG3E"}

package/dist/bsky-app-view.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BskyAppView = void 0;
 const node_util_1 = require("node:util");
-const api_1 = require("@atproto/api");
+const lex_1 = require("@atproto/lex");
 class BskyAppView {
     constructor(options) {
         Object.defineProperty(this, "did", {
@@ -17,7 +17,7 @@ class BskyAppView {
             writable: true,
             value: void 0
         });
-        Object.defineProperty(this, "agent", {
+        Object.defineProperty(this, "client", {
             enumerable: true,
             configurable: true,
             writable: true,
@@ -31,7 +31,10 @@ class BskyAppView {
         });
         this.did = options.did;
         this.url = options.url;
-        this.agent = new api_1.AtpAgent({ service: options.url });
+        this.client = new lex_1.Client({ service: options.url }, {
+            strictResponseProcessing: false,
+            validateResponse: options.validateResponse ?? false,
+        });
         this.cdnUrlPattern = options.cdnUrlPattern;
     }
     getImageUrl(pattern, did, cid) {

package/dist/bsky-app-view.js.map

@@ -1 +1 @@
-{"version":3,"file":"bsky-app-view.js","sourceRoot":"","sources":["../src/bsky-app-view.ts"],"names":[],"mappings":";;;AAAA,yCAAkC;AAClC,sCAAuC;AAQvC,MAAa,WAAW;IAMtB,YAAY,OAAuB;QAL5B;;;;;WAAW;QACX;;;;;WAAW;QACX;;;;;WAAe;QACd;;;;;WAAsB;QAG5B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,cAAQ,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC5C,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,GAAW;QACnD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAA,kBAAM,EAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;CACF;AAhBD,kCAgBC","sourcesContent":["import { format } from 'node:util'\nimport { AtpAgent } from '@atproto/api'\n\nexport type AppViewOptions = {\n  url: string\n  did: string\n  cdnUrlPattern?: string\n}\n\nexport class BskyAppView {\n  public did: string\n  public url: string\n  public agent: AtpAgent\n  private cdnUrlPattern?: string\n\n  constructor(options: AppViewOptions) {\n    this.did = options.did\n    this.url = options.url\n    this.agent = new AtpAgent({ service: options.url })\n    this.cdnUrlPattern = options.cdnUrlPattern\n  }\n\n  getImageUrl(pattern: string, did: string, cid: string): string | undefined {\n    if (this.cdnUrlPattern) return format(this.cdnUrlPattern, pattern, did, cid)\n  }\n}\n"]}
+{"version":3,"file":"bsky-app-view.js","sourceRoot":"","sources":["../src/bsky-app-view.ts"],"names":[],"mappings":";;;AAAA,yCAAkC;AAClC,sCAAqC;AASrC,MAAa,WAAW;IAMtB,YAAY,OAAuB;QAL5B;;;;;WAAW;QACX;;;;;WAAW;QACX;;;;;WAAc;QACb;;;;;WAAsB;QAG5B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,YAAM,CACtB,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EACxB;YACE,wBAAwB,EAAE,KAAK;YAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;SACpD,CACF,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC5C,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,GAAW;QACnD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAA,kBAAM,EAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;CACF;AAtBD,kCAsBC","sourcesContent":["import { format } from 'node:util'\nimport { Client } from '@atproto/lex'\n\nexport type AppViewOptions = {\n  url: string\n  did: string\n  cdnUrlPattern?: string\n  validateResponse?: boolean\n}\n\nexport class BskyAppView {\n  public did: string\n  public url: string\n  public client: Client\n  private cdnUrlPattern?: string\n\n  constructor(options: AppViewOptions) {\n    this.did = options.did\n    this.url = options.url\n    this.client = new Client(\n      { service: options.url },\n      {\n        strictResponseProcessing: false,\n        validateResponse: options.validateResponse ?? false,\n      },\n    )\n    this.cdnUrlPattern = options.cdnUrlPattern\n  }\n\n  getImageUrl(pattern: string, did: string, cid: string): string | undefined {\n    if (this.cdnUrlPattern) return format(this.cdnUrlPattern, pattern, did, cid)\n  }\n}\n"]}