@atproto/pds 0.4.223 → 0.4.225

package/dist/auth-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-verifier.js","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsjBA,sCAWC;AAjkBD,6CAAyE;AAEzE,2CAA4B;AAC5B,8DAAoC;AACpC,4CAAyD;AACzD,gDAAsE;AACtE,sCAAyE;AACzE,4DAKgC;AAChC,wDAG8B;AAC9B,sDAW6B;AAY7B,6CAAsE;AACtE,6BAAkC;AAClC,sCAAwC;AAiDxC,MAAa,YAAY;IAMvB,YACS,cAA8B,EAC9B,UAAsB,EACtB,aAA4B,EACnC,IAAsB;QAHtB;;;;mBAAO,cAAc;WAAgB;QACrC;;;;mBAAO,UAAU;WAAY;QAC7B;;;;mBAAO,aAAa;WAAe;QAR7B;;;;;WAAkB;QAClB;;;;;WAAkB;QAClB;;;;;WAAkB;QACnB;;;;;WAA8B;QAcrC,0CAA0C;QAEnC;;;;mBAA6D,CAAC,GAAG,EAAE,EAAE;gBAC1E,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBAEvB,0EAA0E;gBAC1E,2EAA2E;gBAC3E,2EAA2E;gBAC3E,uBAAuB;gBACvB,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;oBACrC,MAAM,IAAI,+BAAiB,CAAC,8BAA8B,CAAC,CAAA;gBAC7D,CAAC;gBAED,OAAO;oBACL,WAAW,EAAE,IAAI;iBAClB,CAAA;YACH,CAAC;WAAA;QAEM;;;;mBAAmD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACvB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACtC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,+BAAiB,EAAE,CAAA;gBAC/B,CAAC;gBACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;gBACrC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;oBACzD,MAAM,IAAI,+BAAiB,EAAE,CAAA;gBAC/B,CAAC;gBAED,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAA;YACjD,CAAC;WAAA;QAEM;;;;mBAAmD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC1B,MAAM,IAAI,+BAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;gBACjE,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;oBACnD,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC;iBACvE,CAAC,CAAA;gBACF,OAAO;oBACL,WAAW,EAAE;wBACX,IAAI,EAAE,aAAa;wBACnB,GAAG,EAAE,OAAO,CAAC,GAAG;qBACjB;iBACF,CAAA;YACH,CAAC;WAAA;QAEM;;;;mBACL,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;gBAC7B,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;gBAC7B,CAAC;YACH,CAAC;WAAA;QAgII;;;;mBAA6D,KAAK,EACvE,GAAG,EACH,EAAE;gBACF,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO;oBACL,WAAW,EAAE;wBACX,IAAI,EAAE,mBAAmB;wBACzB,GAAG,EAAE,OAAO,CAAC,GAAG;qBACjB;iBACF,CAAA;YACH,CAAC;WAAA;QAEM;;;;mBAEH,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC7B,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBACxC,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBAClC,CAAC;YACH,CAAC;WAAA;QApNC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACvB,CAAC;IA4DS,MAAM,CACd,OAAqD;QAErD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAA;QAE5C,MAAM,gBAAgB,GAA8B;YAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YACvB,GAAG,EAAE,QAAQ;YACb,MAAM;YACJ,mEAAmE;YACnE,0BAA0B;YAC1B,aAAa,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,sBAAS,CAAC,SAAc,CAAC;gBACtE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,sBAAS,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,MAAM;SACb,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,GAAG,CAAC,GAAG,EACP,gBAAgB,CACjB,CAAA;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAE3C,OAAO;gBACL,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE;aAC5C,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,OAAO,CAAC,OAEd;QACC,MAAM,aAAa,GAA8C;YAC/D,cAAc,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC5D,GAAG,EAAE,aAAa;YAClB,oDAAoD;YACpD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACjE,MAAM,EAAE,CAAC,sBAAS,CAAC,OAAO,CAAC;SAC5B,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAEjE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAA;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,+BAAiB,CACzB,qCAAqC,EACrC,gBAAgB,CACjB,CAAA;YACH,CAAC;YAED,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO;iBACR;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,aAAa,CAAmB,EACrC,MAAM,GAAG,4BAAe,EACxB,UAAU,GAAG,EAAE,EACf,GAAG,OAAO,EAIU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC;SACnC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAErC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAA;YACnB,CAAC;YAED,uEAAuE;YACvE,+CAA+C;YAC/C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,iCAAmB,CAC3B,+BAA+B,EAC/B,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,IAAI,+BAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC,CAAA;IACH,CAAC;IAEM,iCAAiC,CACtC,IAAiE;QAKjE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IA0BM,8BAA8B,CACnC,OAGsB;QAEtB,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACzD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAmB,EAChC,SAAS,EACT,GAAG,mBAAmB,EACiB;QAIvC,MAAM,kBAAkB,GAA8B;YACpD,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,KAAK,EAAE,CAAC,SAAS,CAAC;SACnB,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAA;YAExB,4DAA4D;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAA;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;gBACtC,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,YAAY,CAAC,CAAA;YACjE,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;YACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YAEjD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa;iBACjD,mBAAmB,CAClB,GAAG,CAAC,MAAM,IAAI,KAAK,EACnB,GAAG,EACH,GAAG,CAAC,OAAO,EACX,kBAAkB,CACnB;iBACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,mEAAmE;gBACnE,0DAA0D;gBAC1D,IAAI,GAAG,YAAY,qCAAoB,EAAE,CAAC;oBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;oBAC5D,GAAG,CAAC,YAAY,CACd,+BAA+B,EAC/B,kBAAkB,CACnB,CAAA;gBACH,CAAC;gBAED,IAAI,GAAG,YAAY,2BAAU,EAAE,CAAC;oBAC9B,MAAM,IAAI,uBAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBACnE,CAAC;gBAED,MAAM,GAAG,CAAA;YACX,CAAC,CAAC,CAAA;YAEJ,IAAI,CAAC,IAAA,iBAAW,EAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAClE,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;YAEjD,MAAM,WAAW,GAAG,IAAI,yCAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAErE,sBAAsB;YACtB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,iCAAmB,CAC3B,2CAA2C,EAC3C,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;YAEjC,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,OAAO;oBACb,GAAG;oBACH,WAAW;iBACZ;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAC,YAAY,CAC1B,GAAc,EACd,OAAwB;QAExB,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,WAAW,CACtB,WAA+B,EAC/B,OAAwB;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,EAAE;YAChE,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,yEAAyE;YACzE,MAAM,IAAI,4BAAc,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,IAAI,IAAA,gBAAW,EAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,+BAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,+BAAiB,CACzB,wBAAwB,EACxB,oBAAoB,CACrB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,eAAe,CAC7B,GAAoB,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAA6B;QAEjD,MAAM,KAAK,GAAG,IAAA,0BAAkB,EAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,+BAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI;aAC3B,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;aACvC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,IAAI,iCAAmB,CAAC,mBAAmB,EAAE,cAAc,EAAE;oBACjE,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,iCAAmB,CAC3B,6BAA6B,EAC7B,cAAc,EACd,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEJ,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,sEAAsE;YACtE,yEAAyE;YACzE,+DAA+D;YAC/D,yEAAyE;YACzE,mBAAmB;YACnB,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,wDAAwD;YACxD,8CAA8C;YAC9C,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAA,iBAAW,EAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,CAAC,IAAA,wBAAW,EAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAU,EAAE,CAAA;IAC7C,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,GAAoB,EACpB,IAAyB;QAEzB,MAAM,MAAM,GAAG,IAAA,0BAAkB,EAAC,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,+BAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0BAAY,EAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAA,uBAAgB,EACpC,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE;YAC1B,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,+BAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,KAAK,GACT,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YACnE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,+BAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,SAAS,GAAG,IAAA,gCAAuB,EAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,+BAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,iCAAsB,EAAC,SAAS,CAAC,CAAA;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,+BAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CACF,CAAA;QACD,IACE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,+BAAiB,CACzB,yCAAyC,EACzC,gBAAgB,CACjB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF;AAtdD,oCAsdC;AAED,UAAU;AACV,YAAY;AAEZ,SAAgB,aAAa,CAC3B,IAA2E,EAC3E,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,KAAK,GAAG,CAAA;IACrC,CAAC;AACH,CAAC;AAED,IAAK,QAIJ;AAJD,WAAK,QAAQ;IACX,2BAAe,CAAA;IACf,6BAAiB,CAAA;IACjB,yBAAa,CAAA;AACf,CAAC,EAJI,QAAQ,KAAR,QAAQ,QAIZ;AAED,MAAM,wBAAwB,GAAG,CAC/B,GAAoB,EAC4B,EAAE;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAClD,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,iCAAmB,CAC3B,gCAAgC,EAChC,cAAc,CACf,CAAA;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAExC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAElC,MAAM,IAAI,iCAAmB,CAC3B,mCAAmC,MAAM,CAAC,CAAC,CAAC,EAAE,EAC9C,cAAc,CACf,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAW,EAAE;IAChE,MAAM,KAAK,GAAG,IAAA,0BAAkB,EAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAmB,EAAE;IAChE,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC5C,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAEM,MAAM,kBAAkB,GAAG,CAAC,GAAoB,EAAE,EAAE;IACzD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC,CAAA;AAHY,QAAA,kBAAkB,sBAG9B;AAED,MAAM,cAAc,GAAG,CACrB,GAAoB,EAC2B,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC3D,qEAAqE;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAEM,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAa,EAAE;IACjE,OAAO,IAAA,6BAAe,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAC7C,CAAC,CAAA;AAFY,QAAA,qBAAqB,yBAEjC;AAED,MAAM,UAAU,GAAG,IAAI,qBAAU,CAAC,WAAW,CAAC,CAAA;AACvC,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAa,EAAE;IACvE,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAC/D,OAAO,IAAA,6BAAe,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;AAChD,CAAC,CAAA;AAHY,QAAA,qBAAqB,yBAGjC;AAED,SAAS,cAAc,CAAC,GAAmB;IACzC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IACzC,IAAA,iBAAU,EAAC,GAAG,EAAE,eAAe,CAAC,CAAA;AAClC,CAAC","sourcesContent":["import { KeyObject, createPublicKey, createSecretKey } from 'node:crypto'\nimport { IncomingMessage, ServerResponse } from 'node:http'\nimport * as jose from 'jose'\nimport KeyEncoder from 'key-encoder'\nimport { getVerificationMaterial } from '@atproto/common'\nimport { IdResolver, getDidKeyFromMultibase } from '@atproto/identity'\nimport { AtIdentifierString, DidString, isDidString } from '@atproto/lex'\nimport {\n  OAuthError,\n  OAuthVerifier,\n  VerifyTokenPayloadOptions,\n  WWWAuthenticateError,\n} from '@atproto/oauth-provider'\nimport {\n  ScopePermissions,\n  ScopePermissionsTransition,\n} from '@atproto/oauth-scopes'\nimport {\n  AuthRequiredError,\n  Awaitable,\n  ForbiddenError,\n  InvalidRequestError,\n  MethodAuthContext,\n  MethodAuthVerifier,\n  Params,\n  XRPCError,\n  parseReqNsid,\n  verifyJwt as verifyServiceJwt,\n} from '@atproto/xrpc-server'\nimport { AccountManager } from './account-manager/account-manager'\nimport { ActorAccount } from './account-manager/helpers/account'\nimport {\n  AccessOutput,\n  AdminTokenOutput,\n  ModServiceOutput,\n  OAuthOutput,\n  RefreshOutput,\n  UnauthenticatedOutput,\n  UserServiceAuthOutput,\n} from './auth-output'\nimport { ACCESS_STANDARD, AuthScope, isAuthScope } from './auth-scope'\nimport { softDeleted } from './db'\nimport { appendVary } from './util/http'\nimport { WithRequired } from './util/types'\n\nexport type VerifiedOptions = {\n  checkTakedown?: boolean\n  checkDeactivated?: boolean\n}\n\nexport type ScopedOptions<S extends AuthScope = AuthScope> = {\n  scopes?: readonly S[]\n}\n\nexport type ExtraScopedOptions<S extends AuthScope = AuthScope> = {\n  additional?: readonly S[]\n}\n\nexport type AuthorizedOptions<P extends Params = Params> = {\n  authorize: (\n    permissions: ScopePermissions,\n    ctx: MethodAuthContext<P>,\n  ) => Awaitable<void>\n}\n\nexport type AuthVerifierOpts = {\n  publicUrl: string\n  jwtKey: KeyObject\n  adminPass: string\n  dids: {\n    pds: string\n    entryway?: string\n    modService?: string\n  }\n}\n\nexport type VerifyBearerJwtOptions<S extends AuthScope = AuthScope> =\n  WithRequired<\n    Omit<jose.JWTVerifyOptions, 'scopes'> & {\n      scopes: readonly S[]\n    },\n    'audience' | 'typ'\n  >\n\nexport type VerifyBearerJwtResult<S extends AuthScope = AuthScope> = {\n  sub: DidString\n  aud: string\n  jti: string | undefined\n  scope: S\n}\n\nexport class AuthVerifier {\n  private _publicUrl: string\n  private _jwtKey: KeyObject\n  private _adminPass: string\n  public dids: AuthVerifierOpts['dids']\n\n  constructor(\n    public accountManager: AccountManager,\n    public idResolver: IdResolver,\n    public oauthVerifier: OAuthVerifier,\n    opts: AuthVerifierOpts,\n  ) {\n    this._publicUrl = opts.publicUrl\n    this._jwtKey = opts.jwtKey\n    this._adminPass = opts.adminPass\n    this.dids = opts.dids\n  }\n\n  // verifiers (arrow fns to preserve scope)\n\n  public unauthenticated: MethodAuthVerifier<UnauthenticatedOutput> = (ctx) => {\n    setAuthHeaders(ctx.res)\n\n    // @NOTE this auth method is typically used as fallback when no other auth\n    // method is applicable. This means that the presence of an \"authorization\"\n    // header means that that header is invalid (as it did not match any of the\n    // other auth methods).\n    if (ctx.req.headers['authorization']) {\n      throw new AuthRequiredError('Invalid authorization header')\n    }\n\n    return {\n      credentials: null,\n    }\n  }\n\n  public adminToken: MethodAuthVerifier<AdminTokenOutput> = async (ctx) => {\n    setAuthHeaders(ctx.res)\n    const parsed = parseBasicAuth(ctx.req)\n    if (!parsed) {\n      throw new AuthRequiredError()\n    }\n    const { username, password } = parsed\n    if (username !== 'admin' || password !== this._adminPass) {\n      throw new AuthRequiredError()\n    }\n\n    return { credentials: { type: 'admin_token' } }\n  }\n\n  public modService: MethodAuthVerifier<ModServiceOutput> = async (ctx) => {\n    setAuthHeaders(ctx.res)\n    if (!this.dids.modService) {\n      throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n    }\n    const payload = await this.verifyServiceJwt(ctx.req, {\n      iss: [this.dids.modService, `${this.dids.modService}#atproto_labeler`],\n    })\n    return {\n      credentials: {\n        type: 'mod_service',\n        did: payload.iss,\n      },\n    }\n  }\n\n  public moderator: MethodAuthVerifier<AdminTokenOutput | ModServiceOutput> =\n    async (ctx) => {\n      const type = extractAuthType(ctx.req)\n      if (type === AuthType.BEARER) {\n        return this.modService(ctx)\n      } else {\n        return this.adminToken(ctx)\n      }\n    }\n\n  protected access<S extends AuthScope>(\n    options: VerifiedOptions & Required<ScopedOptions<S>>,\n  ): MethodAuthVerifier<AccessOutput<S>> {\n    const { scopes, ...statusOptions } = options\n\n    const verifyJwtOptions: VerifyBearerJwtOptions<S> = {\n      audience: this.dids.pds,\n      typ: 'at+jwt',\n      scopes:\n        // @NOTE We can reject taken down credentials based on the scope if\n        // \"checkTakedown\" is set.\n        statusOptions.checkTakedown && scopes.includes(AuthScope.Takendown as S)\n          ? scopes.filter((s) => s !== AuthScope.Takendown)\n          : scopes,\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const { sub: did, scope } = await this.verifyBearerJwt(\n        ctx.req,\n        verifyJwtOptions,\n      )\n\n      await this.verifyStatus(did, statusOptions)\n\n      return {\n        credentials: { type: 'access', did, scope },\n      }\n    }\n  }\n\n  public refresh(options?: {\n    allowExpired?: boolean\n  }): MethodAuthVerifier<RefreshOutput> {\n    const verifyOptions: VerifyBearerJwtOptions<AuthScope.Refresh> = {\n      clockTolerance: options?.allowExpired ? Infinity : undefined,\n      typ: 'refresh+jwt',\n      // when using entryway, proxying refresh credentials\n      audience: this.dids.entryway ? this.dids.entryway : this.dids.pds,\n      scopes: [AuthScope.Refresh],\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const result = await this.verifyBearerJwt(ctx.req, verifyOptions)\n\n      const tokenId = result.jti\n      if (!tokenId) {\n        throw new AuthRequiredError(\n          'Unexpected missing refresh token id',\n          'MissingTokenId',\n        )\n      }\n\n      return {\n        credentials: {\n          type: 'refresh',\n          did: result.sub,\n          scope: result.scope,\n          tokenId,\n        },\n      }\n    }\n  }\n\n  public authorization<P extends Params>({\n    scopes = ACCESS_STANDARD,\n    additional = [],\n    ...options\n  }: VerifiedOptions &\n    ScopedOptions &\n    ExtraScopedOptions &\n    AuthorizedOptions<P>): MethodAuthVerifier<AccessOutput | OAuthOutput, P> {\n    const access = this.access({\n      ...options,\n      scopes: [...scopes, ...additional],\n    })\n    const oauth = this.oauth(options)\n\n    return async (ctx) => {\n      const type = extractAuthType(ctx.req)\n\n      if (type === AuthType.BEARER) {\n        return access(ctx)\n      }\n\n      if (type === AuthType.DPOP) {\n        return oauth(ctx)\n      }\n\n      // Auth headers are set through the access and oauth methods so we only\n      // need to set them here if we reach this point\n      setAuthHeaders(ctx.res)\n\n      if (type !== null) {\n        throw new InvalidRequestError(\n          'Unexpected authorization type',\n          'InvalidToken',\n        )\n      }\n\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n  }\n\n  public authorizationOrAdminTokenOptional<P extends Params>(\n    opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>,\n  ): MethodAuthVerifier<\n    OAuthOutput | AccessOutput | AdminTokenOutput | UnauthenticatedOutput,\n    P\n  > {\n    const authorization = this.authorization(opts)\n    return async (ctx) => {\n      const type = extractAuthType(ctx.req)\n      if (type === AuthType.BEARER || type === AuthType.DPOP) {\n        return authorization(ctx)\n      } else if (type === AuthType.BASIC) {\n        return this.adminToken(ctx)\n      } else {\n        return this.unauthenticated(ctx)\n      }\n    }\n  }\n\n  public userServiceAuth: MethodAuthVerifier<UserServiceAuthOutput> = async (\n    ctx,\n  ) => {\n    setAuthHeaders(ctx.res)\n    const payload = await this.verifyServiceJwt(ctx.req)\n    return {\n      credentials: {\n        type: 'user_service_auth',\n        did: payload.iss,\n      },\n    }\n  }\n\n  public userServiceAuthOptional: MethodAuthVerifier<\n    UserServiceAuthOutput | UnauthenticatedOutput\n  > = async (ctx) => {\n    const type = extractAuthType(ctx.req)\n    if (type === AuthType.BEARER) {\n      return await this.userServiceAuth(ctx)\n    } else {\n      return this.unauthenticated(ctx)\n    }\n  }\n\n  public authorizationOrUserServiceAuth<P extends Params>(\n    options: VerifiedOptions &\n      ScopedOptions &\n      ExtraScopedOptions &\n      AuthorizedOptions<P>,\n  ): MethodAuthVerifier<UserServiceAuthOutput | OAuthOutput | AccessOutput, P> {\n    const authorizationVerifier = this.authorization(options)\n    return async (ctx) => {\n      if (isDefinitelyServiceAuth(ctx.req)) {\n        return this.userServiceAuth(ctx)\n      } else {\n        return authorizationVerifier(ctx)\n      }\n    }\n  }\n\n  protected oauth<P extends Params>({\n    authorize,\n    ...verifyStatusOptions\n  }: VerifiedOptions & AuthorizedOptions<P>): MethodAuthVerifier<\n    OAuthOutput,\n    P\n  > {\n    const verifyTokenOptions: VerifyTokenPayloadOptions = {\n      audience: [this.dids.pds],\n      scope: ['atproto'],\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const { req, res } = ctx\n\n      // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2\n      const dpopNonce = this.oauthVerifier.nextDpopNonce()\n      if (dpopNonce) {\n        res.setHeader('DPoP-Nonce', dpopNonce)\n        res.appendHeader('Access-Control-Expose-Headers', 'DPoP-Nonce')\n      }\n\n      const originalUrl = req.originalUrl || req.url || '/'\n      const url = new URL(originalUrl, this._publicUrl)\n\n      const { scope, sub: did } = await this.oauthVerifier\n        .authenticateRequest(\n          req.method || 'GET',\n          url,\n          req.headers,\n          verifyTokenOptions,\n        )\n        .catch((err) => {\n          // Make sure to include any WWW-Authenticate header in the response\n          // (particularly useful for DPoP's \"use_dpop_nonce\" error)\n          if (err instanceof WWWAuthenticateError) {\n            res.setHeader('WWW-Authenticate', err.wwwAuthenticateHeader)\n            res.appendHeader(\n              'Access-Control-Expose-Headers',\n              'WWW-Authenticate',\n            )\n          }\n\n          if (err instanceof OAuthError) {\n            throw new XRPCError(err.status, err.error_description, err.error)\n          }\n\n          throw err\n        })\n\n      if (!isDidString(did)) {\n        throw new InvalidRequestError('Malformed token', 'InvalidToken')\n      }\n\n      await this.verifyStatus(did, verifyStatusOptions)\n\n      const permissions = new ScopePermissionsTransition(scope?.split(' '))\n\n      // Should never happen\n      if (!permissions.scopes.has('atproto')) {\n        throw new InvalidRequestError(\n          'OAuth token does not have \"atproto\" scope',\n          'InvalidToken',\n        )\n      }\n\n      await authorize(permissions, ctx)\n\n      return {\n        credentials: {\n          type: 'oauth',\n          did,\n          permissions,\n        },\n      }\n    }\n  }\n\n  protected async verifyStatus(\n    did: DidString,\n    options: VerifiedOptions,\n  ): Promise<void> {\n    if (options.checkDeactivated || options.checkTakedown) {\n      await this.findAccount(did, options)\n    }\n  }\n\n  /**\n   * Finds an account by its handle or DID, returning possibly deactivated or\n   * taken down accounts (unless `options.checkDeactivated` or\n   * `options.checkTakedown` are set to true, respectively).\n   */\n  public async findAccount(\n    handleOrDid: AtIdentifierString,\n    options: VerifiedOptions,\n  ): Promise<ActorAccount> {\n    const account = await this.accountManager.getAccount(handleOrDid, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n    if (!account) {\n      // will be turned into ExpiredToken for the client if proxied by entryway\n      throw new ForbiddenError('Account not found', 'AccountNotFound')\n    }\n    if (options.checkTakedown && softDeleted(account)) {\n      throw new AuthRequiredError(\n        'Account has been taken down',\n        'AccountTakedown',\n      )\n    }\n    if (options.checkDeactivated && account.deactivatedAt) {\n      throw new AuthRequiredError(\n        'Account is deactivated',\n        'AccountDeactivated',\n      )\n    }\n    return account\n  }\n\n  /**\n   * Wraps {@link jose.jwtVerify} into a function that also validates the token\n   * payload's type and wraps errors into {@link InvalidRequestError}.\n   */\n  protected async verifyBearerJwt<S extends AuthScope = AuthScope>(\n    req: IncomingMessage,\n    { scopes, ...options }: VerifyBearerJwtOptions<S>,\n  ): Promise<VerifyBearerJwtResult<S>> {\n    const token = bearerTokenFromReq(req)\n    if (!token) {\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n\n    const { payload } = await jose\n      .jwtVerify(token, this._jwtKey, options)\n      .catch((cause) => {\n        if (cause instanceof jose.errors.JWTExpired) {\n          throw new InvalidRequestError('Token has expired', 'ExpiredToken', {\n            cause,\n          })\n        } else {\n          throw new InvalidRequestError(\n            'Token could not be verified',\n            'InvalidToken',\n            { cause },\n          )\n        }\n      })\n\n    const { sub, aud, scope, lxm, cnf, jti } = payload\n\n    if (typeof lxm !== 'undefined') {\n      // Service auth tokens should never make it to here. But since service\n      // auth tokens do not have a \"typ\" header, the \"typ\" check above will not\n      // catch them. This check here is mainly to protect against the\n      // hypothetical case in which a PDS would issue service auth tokens using\n      // its private key.\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof cnf !== 'undefined') {\n      // Proof-of-Possession (PoP) tokens are not allowed here\n      // https://www.rfc-editor.org/rfc/rfc7800.html\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof sub !== 'string' || !isDidString(sub)) {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof aud !== 'string' || !aud.startsWith('did:')) {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof jti !== 'string' && typeof jti !== 'undefined') {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (!isAuthScope(scope) || !scopes.includes(scope as any)) {\n      throw new InvalidRequestError('Bad token scope', 'InvalidToken')\n    }\n\n    return { sub, aud, jti, scope: scope as S }\n  }\n\n  protected async verifyServiceJwt(\n    req: IncomingMessage,\n    opts?: { iss?: string[] },\n  ) {\n    const jwtStr = bearerTokenFromReq(req)\n    if (!jwtStr) {\n      throw new AuthRequiredError('missing jwt', 'MissingJwt')\n    }\n\n    const nsid = parseReqNsid(req)\n    const payload = await verifyServiceJwt(\n      jwtStr,\n      null,\n      nsid,\n      async (iss, forceRefresh) => {\n        if (opts?.iss && !opts.iss.includes(iss)) {\n          throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n        }\n        const [did, serviceId] = iss.split('#')\n        const keyId =\n          serviceId === 'atproto_labeler' ? 'atproto_label' : 'atproto'\n        const didDoc = await this.idResolver.did.resolve(did, forceRefresh)\n        if (!didDoc) {\n          throw new AuthRequiredError('could not resolve iss did')\n        }\n        const parsedKey = getVerificationMaterial(didDoc, keyId)\n        if (!parsedKey) {\n          throw new AuthRequiredError('missing or bad key in did doc')\n        }\n        const didKey = getDidKeyFromMultibase(parsedKey)\n        if (!didKey) {\n          throw new AuthRequiredError('missing or bad key in did doc')\n        }\n        return didKey\n      },\n    )\n    if (\n      payload.aud !== this.dids.pds &&\n      (!this.dids.entryway || payload.aud !== this.dids.entryway)\n    ) {\n      throw new AuthRequiredError(\n        'jwt audience does not match service did',\n        'BadJwtAudience',\n      )\n    }\n    return payload\n  }\n}\n\n// HELPERS\n// ---------\n\nexport function isUserOrAdmin(\n  auth: AccessOutput | OAuthOutput | AdminTokenOutput | UnauthenticatedOutput,\n  did: string,\n): boolean {\n  if (!auth.credentials) {\n    return false\n  } else if (auth.credentials.type === 'admin_token') {\n    return true\n  } else {\n    return auth.credentials.did === did\n  }\n}\n\nenum AuthType {\n  BASIC = 'Basic',\n  BEARER = 'Bearer',\n  DPOP = 'DPoP',\n}\n\nconst parseAuthorizationHeader = (\n  req: IncomingMessage,\n): [type: null] | [type: AuthType, token: string] => {\n  const authorization = req.headers['authorization']\n  if (!authorization) return [null]\n\n  const result = authorization.split(' ')\n  if (result.length !== 2) {\n    throw new InvalidRequestError(\n      'Malformed authorization header',\n      'InvalidToken',\n    )\n  }\n\n  // authorization type is case-insensitive\n  const authType = result[0].toUpperCase()\n\n  const type = Object.hasOwn(AuthType, authType) ? AuthType[authType] : null\n  if (type) return [type, result[1]]\n\n  throw new InvalidRequestError(\n    `Unsupported authorization type: ${result[0]}`,\n    'InvalidToken',\n  )\n}\n\n/**\n * @note Not all service auth tokens are guaranteed to have \"lxm\" claim, so this\n * function should not be used to verify service auth tokens. It is only used to\n * check if a token is definitely a service auth token.\n */\nconst isDefinitelyServiceAuth = (req: IncomingMessage): boolean => {\n  const token = bearerTokenFromReq(req)\n  if (!token) return false\n  const payload = jose.decodeJwt(token)\n  return payload['lxm'] != null\n}\n\nconst extractAuthType = (req: IncomingMessage): AuthType | null => {\n  const [type] = parseAuthorizationHeader(req)\n  return type\n}\n\nexport const bearerTokenFromReq = (req: IncomingMessage) => {\n  const [type, token] = parseAuthorizationHeader(req)\n  return type === AuthType.BEARER ? token : null\n}\n\nconst parseBasicAuth = (\n  req: IncomingMessage,\n): { username: string; password: string } | null => {\n  try {\n    const [type, b64] = parseAuthorizationHeader(req)\n    if (type !== AuthType.BASIC) return null\n    const decoded = Buffer.from(b64, 'base64').toString('utf8')\n    // We must not use split(':') because the password can contain colons\n    const colon = decoded.indexOf(':')\n    if (colon === -1) return null\n    const username = decoded.slice(0, colon)\n    const password = decoded.slice(colon + 1)\n    return { username, password }\n  } catch (err) {\n    return null\n  }\n}\n\nexport const createSecretKeyObject = (secret: string): KeyObject => {\n  return createSecretKey(Buffer.from(secret))\n}\n\nconst keyEncoder = new KeyEncoder('secp256k1')\nexport const createPublicKeyObject = (publicKeyHex: string): KeyObject => {\n  const key = keyEncoder.encodePublic(publicKeyHex, 'raw', 'pem')\n  return createPublicKey({ format: 'pem', key })\n}\n\nfunction setAuthHeaders(res: ServerResponse) {\n  res.setHeader('Cache-Control', 'private')\n  appendVary(res, 'Authorization')\n}\n"]}
+{"version":3,"file":"auth-verifier.js","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEzE,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,gBAAgB,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAc,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,EAAiC,WAAW,EAAE,MAAM,cAAc,CAAA;AACzE,OAAO,EACL,UAAU,EAGV,oBAAoB,GACrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEL,0BAA0B,GAC3B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EAInB,SAAS,EACT,YAAY,EACZ,SAAS,IAAI,gBAAgB,GAC9B,MAAM,sBAAsB,CAAA;AAY7B,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C,2FAA2F;AAC3F,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAA;AAgD5D,MAAM,OAAO,YAAY;IAMvB,YACS,cAA8B,EAC9B,UAAsB,EACtB,aAA4B,EACnC,IAAsB;QAHf,mBAAc,GAAd,cAAc,CAAgB;QAC9B,eAAU,GAAV,UAAU,CAAY;QACtB,kBAAa,GAAb,aAAa,CAAe;QASrC,0CAA0C;QAEnC,oBAAe,GAA8C,CAAC,GAAG,EAAE,EAAE;YAC1E,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,uBAAuB;YACvB,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;YAC7D,CAAC;YAED,OAAO;gBACL,WAAW,EAAE,IAAI;aAClB,CAAA;QACH,CAAC,CAAA;QAEM,eAAU,GAAyC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;YACrC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzD,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YAED,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAA;QACjD,CAAC,CAAA;QAEM,eAAU,GAAyC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;gBACnD,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC;aACvE,CAAC,CAAA;YACF,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,aAAa;oBACnB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;aACF,CAAA;QACH,CAAC,CAAA;QAEM,cAAS,GACd,KAAK,EAAE,GAAG,EAAE,EAAE;YACZ,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC,CAAA;QAgII,oBAAe,GAA8C,KAAK,EACvE,GAAG,EACH,EAAE;YACF,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACpD,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,mBAAmB;oBACzB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;aACF,CAAA;QACH,CAAC,CAAA;QAEM,4BAAuB,GAE1B,KAAK,EAAE,GAAG,EAAE,EAAE;YAChB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YACxC,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;QApNC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACvB,CAAC;IA4DS,MAAM,CACd,OAAqD;QAErD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAA;QAE5C,MAAM,gBAAgB,GAA8B;YAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YACvB,GAAG,EAAE,QAAQ;YACb,MAAM;YACJ,mEAAmE;YACnE,0BAA0B;YAC1B,aAAa,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAc,CAAC;gBACtE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,MAAM;SACb,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,GAAG,CAAC,GAAG,EACP,gBAAgB,CACjB,CAAA;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAE3C,OAAO;gBACL,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE;aAC5C,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,OAAO,CAAC,OAEd;QACC,MAAM,aAAa,GAA8C;YAC/D,cAAc,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC5D,GAAG,EAAE,aAAa;YAClB,oDAAoD;YACpD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACjE,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;SAC5B,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAEjE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAA;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,iBAAiB,CACzB,qCAAqC,EACrC,gBAAgB,CACjB,CAAA;YACH,CAAC;YAED,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO;iBACR;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,aAAa,CAAmB,EACrC,MAAM,GAAG,eAAe,EACxB,UAAU,GAAG,EAAE,EACf,GAAG,OAAO,EAIU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC;SACnC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAErC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAA;YACnB,CAAC;YAED,uEAAuE;YACvE,+CAA+C;YAC/C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,mBAAmB,CAC3B,+BAA+B,EAC/B,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC,CAAA;IACH,CAAC;IAEM,iCAAiC,CACtC,IAAiE;QAKjE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IA0BM,8BAA8B,CACnC,OAGsB;QAEtB,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACzD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAmB,EAChC,SAAS,EACT,GAAG,mBAAmB,EACiB;QAIvC,MAAM,kBAAkB,GAA8B;YACpD,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,KAAK,EAAE,CAAC,SAAS,CAAC;SACnB,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAA;YAExB,4DAA4D;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAA;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;gBACtC,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,YAAY,CAAC,CAAA;YACjE,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;YACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YAEjD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa;iBACjD,mBAAmB,CAClB,GAAG,CAAC,MAAM,IAAI,KAAK,EACnB,GAAG,EACH,GAAG,CAAC,OAAO,EACX,kBAAkB,CACnB;iBACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,mEAAmE;gBACnE,0DAA0D;gBAC1D,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;oBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;oBAC5D,GAAG,CAAC,YAAY,CACd,+BAA+B,EAC/B,kBAAkB,CACnB,CAAA;gBACH,CAAC;gBAED,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;oBAC9B,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBACnE,CAAC;gBAED,MAAM,GAAG,CAAA;YACX,CAAC,CAAC,CAAA;YAEJ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAClE,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;YAEjD,MAAM,WAAW,GAAG,IAAI,0BAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAErE,sBAAsB;YACtB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,mBAAmB,CAC3B,2CAA2C,EAC3C,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;YAEjC,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,OAAO;oBACb,GAAG;oBACH,WAAW;iBACZ;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAC,YAAY,CAC1B,GAAc,EACd,OAAwB;QAExB,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,WAAW,CACtB,WAA+B,EAC/B,OAAwB;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,EAAE;YAChE,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,yEAAyE;YACzE,MAAM,IAAI,cAAc,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,iBAAiB,CACzB,wBAAwB,EACxB,oBAAoB,CACrB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,eAAe,CAC7B,GAAoB,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAA6B;QAEjD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI;aAC3B,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;aACvC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,cAAc,EAAE;oBACjE,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,cAAc,EACd,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEJ,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,sEAAsE;YACtE,yEAAyE;YACzE,+DAA+D;YAC/D,yEAAyE;YACzE,mBAAmB;YACnB,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,wDAAwD;YACxD,8CAA8C;YAC9C,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAU,EAAE,CAAA;IAC7C,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,GAAoB,EACpB,IAAyB;QAEzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE;YAC1B,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,KAAK,GACT,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YACnE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CACF,CAAA;QACD,IACE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,yCAAyC,EACzC,gBAAgB,CACjB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF;AAED,UAAU;AACV,YAAY;AAEZ,MAAM,UAAU,aAAa,CAC3B,IAA2E,EAC3E,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,KAAK,GAAG,CAAA;IACrC,CAAC;AACH,CAAC;AAED,IAAK,QAIJ;AAJD,WAAK,QAAQ;IACX,2BAAe,CAAA;IACf,6BAAiB,CAAA;IACjB,yBAAa,CAAA;AACf,CAAC,EAJI,QAAQ,KAAR,QAAQ,QAIZ;AAED,MAAM,wBAAwB,GAAG,CAC/B,GAAoB,EAC4B,EAAE;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAClD,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,cAAc,CACf,CAAA;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAExC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAElC,MAAM,IAAI,mBAAmB,CAC3B,mCAAmC,MAAM,CAAC,CAAC,CAAC,EAAE,EAC9C,cAAc,CACf,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAW,EAAE;IAChE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAmB,EAAE;IAChE,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC5C,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAoB,EAAE,EAAE;IACzD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CACrB,GAAoB,EAC2B,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC3D,qEAAqE;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAa,EAAE;IACjE,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAA;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAa,EAAE;IACvE,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAC/D,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;AAChD,CAAC,CAAA;AAED,SAAS,cAAc,CAAC,GAAmB;IACzC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;AAClC,CAAC","sourcesContent":["import { KeyObject, createPublicKey, createSecretKey } from 'node:crypto'\nimport { IncomingMessage, ServerResponse } from 'node:http'\nimport * as jose from 'jose'\nimport KeyEncoderModule from 'key-encoder'\nimport { getVerificationMaterial } from '@atproto/common'\nimport { IdResolver, getDidKeyFromMultibase } from '@atproto/identity'\nimport { AtIdentifierString, DidString, isDidString } from '@atproto/lex'\nimport {\n  OAuthError,\n  OAuthVerifier,\n  VerifyTokenPayloadOptions,\n  WWWAuthenticateError,\n} from '@atproto/oauth-provider'\nimport {\n  ScopePermissions,\n  ScopePermissionsTransition,\n} from '@atproto/oauth-scopes'\nimport {\n  AuthRequiredError,\n  Awaitable,\n  ForbiddenError,\n  InvalidRequestError,\n  MethodAuthContext,\n  MethodAuthVerifier,\n  Params,\n  XRPCError,\n  parseReqNsid,\n  verifyJwt as verifyServiceJwt,\n} from '@atproto/xrpc-server'\nimport { AccountManager } from './account-manager/account-manager.js'\nimport { ActorAccount } from './account-manager/helpers/account.js'\nimport {\n  AccessOutput,\n  AdminTokenOutput,\n  ModServiceOutput,\n  OAuthOutput,\n  RefreshOutput,\n  UnauthenticatedOutput,\n  UserServiceAuthOutput,\n} from './auth-output.js'\nimport { ACCESS_STANDARD, AuthScope, isAuthScope } from './auth-scope.js'\nimport { softDeleted } from './db/index.js'\nimport { appendVary } from './util/http.js'\nimport { WithRequired } from './util/types.js'\n\n// key-encoder is CJS with exports.default; Node ESM interop wraps it as { default: Class }\nconst KeyEncoder = ((m) => m.default ?? m)(KeyEncoderModule)\n\nexport type VerifiedOptions = {\n  checkTakedown?: boolean\n  checkDeactivated?: boolean\n}\n\nexport type ScopedOptions<S extends AuthScope = AuthScope> = {\n  scopes?: readonly S[]\n}\n\nexport type ExtraScopedOptions<S extends AuthScope = AuthScope> = {\n  additional?: readonly S[]\n}\n\nexport type AuthorizedOptions<P extends Params = Params> = {\n  authorize: (\n    permissions: ScopePermissions,\n    ctx: MethodAuthContext<P>,\n  ) => Awaitable<void>\n}\n\nexport type AuthVerifierOpts = {\n  publicUrl: string\n  jwtKey: KeyObject\n  adminPass: string\n  dids: {\n    pds: string\n    entryway?: string\n    modService?: string\n  }\n}\n\nexport type VerifyBearerJwtOptions<S extends AuthScope = AuthScope> =\n  WithRequired<\n    Omit<jose.JWTVerifyOptions, 'scopes'> & {\n      scopes: readonly S[]\n    },\n    'audience' | 'typ'\n  >\n\nexport type VerifyBearerJwtResult<S extends AuthScope = AuthScope> = {\n  sub: DidString\n  aud: string\n  jti: string | undefined\n  scope: S\n}\n\nexport class AuthVerifier {\n  private _publicUrl: string\n  private _jwtKey: KeyObject\n  private _adminPass: string\n  public dids: AuthVerifierOpts['dids']\n\n  constructor(\n    public accountManager: AccountManager,\n    public idResolver: IdResolver,\n    public oauthVerifier: OAuthVerifier,\n    opts: AuthVerifierOpts,\n  ) {\n    this._publicUrl = opts.publicUrl\n    this._jwtKey = opts.jwtKey\n    this._adminPass = opts.adminPass\n    this.dids = opts.dids\n  }\n\n  // verifiers (arrow fns to preserve scope)\n\n  public unauthenticated: MethodAuthVerifier<UnauthenticatedOutput> = (ctx) => {\n    setAuthHeaders(ctx.res)\n\n    // @NOTE this auth method is typically used as fallback when no other auth\n    // method is applicable. This means that the presence of an \"authorization\"\n    // header means that that header is invalid (as it did not match any of the\n    // other auth methods).\n    if (ctx.req.headers['authorization']) {\n      throw new AuthRequiredError('Invalid authorization header')\n    }\n\n    return {\n      credentials: null,\n    }\n  }\n\n  public adminToken: MethodAuthVerifier<AdminTokenOutput> = async (ctx) => {\n    setAuthHeaders(ctx.res)\n    const parsed = parseBasicAuth(ctx.req)\n    if (!parsed) {\n      throw new AuthRequiredError()\n    }\n    const { username, password } = parsed\n    if (username !== 'admin' || password !== this._adminPass) {\n      throw new AuthRequiredError()\n    }\n\n    return { credentials: { type: 'admin_token' } }\n  }\n\n  public modService: MethodAuthVerifier<ModServiceOutput> = async (ctx) => {\n    setAuthHeaders(ctx.res)\n    if (!this.dids.modService) {\n      throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n    }\n    const payload = await this.verifyServiceJwt(ctx.req, {\n      iss: [this.dids.modService, `${this.dids.modService}#atproto_labeler`],\n    })\n    return {\n      credentials: {\n        type: 'mod_service',\n        did: payload.iss,\n      },\n    }\n  }\n\n  public moderator: MethodAuthVerifier<AdminTokenOutput | ModServiceOutput> =\n    async (ctx) => {\n      const type = extractAuthType(ctx.req)\n      if (type === AuthType.BEARER) {\n        return this.modService(ctx)\n      } else {\n        return this.adminToken(ctx)\n      }\n    }\n\n  protected access<S extends AuthScope>(\n    options: VerifiedOptions & Required<ScopedOptions<S>>,\n  ): MethodAuthVerifier<AccessOutput<S>> {\n    const { scopes, ...statusOptions } = options\n\n    const verifyJwtOptions: VerifyBearerJwtOptions<S> = {\n      audience: this.dids.pds,\n      typ: 'at+jwt',\n      scopes:\n        // @NOTE We can reject taken down credentials based on the scope if\n        // \"checkTakedown\" is set.\n        statusOptions.checkTakedown && scopes.includes(AuthScope.Takendown as S)\n          ? scopes.filter((s) => s !== AuthScope.Takendown)\n          : scopes,\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const { sub: did, scope } = await this.verifyBearerJwt(\n        ctx.req,\n        verifyJwtOptions,\n      )\n\n      await this.verifyStatus(did, statusOptions)\n\n      return {\n        credentials: { type: 'access', did, scope },\n      }\n    }\n  }\n\n  public refresh(options?: {\n    allowExpired?: boolean\n  }): MethodAuthVerifier<RefreshOutput> {\n    const verifyOptions: VerifyBearerJwtOptions<AuthScope.Refresh> = {\n      clockTolerance: options?.allowExpired ? Infinity : undefined,\n      typ: 'refresh+jwt',\n      // when using entryway, proxying refresh credentials\n      audience: this.dids.entryway ? this.dids.entryway : this.dids.pds,\n      scopes: [AuthScope.Refresh],\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const result = await this.verifyBearerJwt(ctx.req, verifyOptions)\n\n      const tokenId = result.jti\n      if (!tokenId) {\n        throw new AuthRequiredError(\n          'Unexpected missing refresh token id',\n          'MissingTokenId',\n        )\n      }\n\n      return {\n        credentials: {\n          type: 'refresh',\n          did: result.sub,\n          scope: result.scope,\n          tokenId,\n        },\n      }\n    }\n  }\n\n  public authorization<P extends Params>({\n    scopes = ACCESS_STANDARD,\n    additional = [],\n    ...options\n  }: VerifiedOptions &\n    ScopedOptions &\n    ExtraScopedOptions &\n    AuthorizedOptions<P>): MethodAuthVerifier<AccessOutput | OAuthOutput, P> {\n    const access = this.access({\n      ...options,\n      scopes: [...scopes, ...additional],\n    })\n    const oauth = this.oauth(options)\n\n    return async (ctx) => {\n      const type = extractAuthType(ctx.req)\n\n      if (type === AuthType.BEARER) {\n        return access(ctx)\n      }\n\n      if (type === AuthType.DPOP) {\n        return oauth(ctx)\n      }\n\n      // Auth headers are set through the access and oauth methods so we only\n      // need to set them here if we reach this point\n      setAuthHeaders(ctx.res)\n\n      if (type !== null) {\n        throw new InvalidRequestError(\n          'Unexpected authorization type',\n          'InvalidToken',\n        )\n      }\n\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n  }\n\n  public authorizationOrAdminTokenOptional<P extends Params>(\n    opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>,\n  ): MethodAuthVerifier<\n    OAuthOutput | AccessOutput | AdminTokenOutput | UnauthenticatedOutput,\n    P\n  > {\n    const authorization = this.authorization(opts)\n    return async (ctx) => {\n      const type = extractAuthType(ctx.req)\n      if (type === AuthType.BEARER || type === AuthType.DPOP) {\n        return authorization(ctx)\n      } else if (type === AuthType.BASIC) {\n        return this.adminToken(ctx)\n      } else {\n        return this.unauthenticated(ctx)\n      }\n    }\n  }\n\n  public userServiceAuth: MethodAuthVerifier<UserServiceAuthOutput> = async (\n    ctx,\n  ) => {\n    setAuthHeaders(ctx.res)\n    const payload = await this.verifyServiceJwt(ctx.req)\n    return {\n      credentials: {\n        type: 'user_service_auth',\n        did: payload.iss,\n      },\n    }\n  }\n\n  public userServiceAuthOptional: MethodAuthVerifier<\n    UserServiceAuthOutput | UnauthenticatedOutput\n  > = async (ctx) => {\n    const type = extractAuthType(ctx.req)\n    if (type === AuthType.BEARER) {\n      return await this.userServiceAuth(ctx)\n    } else {\n      return this.unauthenticated(ctx)\n    }\n  }\n\n  public authorizationOrUserServiceAuth<P extends Params>(\n    options: VerifiedOptions &\n      ScopedOptions &\n      ExtraScopedOptions &\n      AuthorizedOptions<P>,\n  ): MethodAuthVerifier<UserServiceAuthOutput | OAuthOutput | AccessOutput, P> {\n    const authorizationVerifier = this.authorization(options)\n    return async (ctx) => {\n      if (isDefinitelyServiceAuth(ctx.req)) {\n        return this.userServiceAuth(ctx)\n      } else {\n        return authorizationVerifier(ctx)\n      }\n    }\n  }\n\n  protected oauth<P extends Params>({\n    authorize,\n    ...verifyStatusOptions\n  }: VerifiedOptions & AuthorizedOptions<P>): MethodAuthVerifier<\n    OAuthOutput,\n    P\n  > {\n    const verifyTokenOptions: VerifyTokenPayloadOptions = {\n      audience: [this.dids.pds],\n      scope: ['atproto'],\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const { req, res } = ctx\n\n      // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2\n      const dpopNonce = this.oauthVerifier.nextDpopNonce()\n      if (dpopNonce) {\n        res.setHeader('DPoP-Nonce', dpopNonce)\n        res.appendHeader('Access-Control-Expose-Headers', 'DPoP-Nonce')\n      }\n\n      const originalUrl = req.originalUrl || req.url || '/'\n      const url = new URL(originalUrl, this._publicUrl)\n\n      const { scope, sub: did } = await this.oauthVerifier\n        .authenticateRequest(\n          req.method || 'GET',\n          url,\n          req.headers,\n          verifyTokenOptions,\n        )\n        .catch((err) => {\n          // Make sure to include any WWW-Authenticate header in the response\n          // (particularly useful for DPoP's \"use_dpop_nonce\" error)\n          if (err instanceof WWWAuthenticateError) {\n            res.setHeader('WWW-Authenticate', err.wwwAuthenticateHeader)\n            res.appendHeader(\n              'Access-Control-Expose-Headers',\n              'WWW-Authenticate',\n            )\n          }\n\n          if (err instanceof OAuthError) {\n            throw new XRPCError(err.status, err.error_description, err.error)\n          }\n\n          throw err\n        })\n\n      if (!isDidString(did)) {\n        throw new InvalidRequestError('Malformed token', 'InvalidToken')\n      }\n\n      await this.verifyStatus(did, verifyStatusOptions)\n\n      const permissions = new ScopePermissionsTransition(scope?.split(' '))\n\n      // Should never happen\n      if (!permissions.scopes.has('atproto')) {\n        throw new InvalidRequestError(\n          'OAuth token does not have \"atproto\" scope',\n          'InvalidToken',\n        )\n      }\n\n      await authorize(permissions, ctx)\n\n      return {\n        credentials: {\n          type: 'oauth',\n          did,\n          permissions,\n        },\n      }\n    }\n  }\n\n  protected async verifyStatus(\n    did: DidString,\n    options: VerifiedOptions,\n  ): Promise<void> {\n    if (options.checkDeactivated || options.checkTakedown) {\n      await this.findAccount(did, options)\n    }\n  }\n\n  /**\n   * Finds an account by its handle or DID, returning possibly deactivated or\n   * taken down accounts (unless `options.checkDeactivated` or\n   * `options.checkTakedown` are set to true, respectively).\n   */\n  public async findAccount(\n    handleOrDid: AtIdentifierString,\n    options: VerifiedOptions,\n  ): Promise<ActorAccount> {\n    const account = await this.accountManager.getAccount(handleOrDid, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n    if (!account) {\n      // will be turned into ExpiredToken for the client if proxied by entryway\n      throw new ForbiddenError('Account not found', 'AccountNotFound')\n    }\n    if (options.checkTakedown && softDeleted(account)) {\n      throw new AuthRequiredError(\n        'Account has been taken down',\n        'AccountTakedown',\n      )\n    }\n    if (options.checkDeactivated && account.deactivatedAt) {\n      throw new AuthRequiredError(\n        'Account is deactivated',\n        'AccountDeactivated',\n      )\n    }\n    return account\n  }\n\n  /**\n   * Wraps {@link jose.jwtVerify} into a function that also validates the token\n   * payload's type and wraps errors into {@link InvalidRequestError}.\n   */\n  protected async verifyBearerJwt<S extends AuthScope = AuthScope>(\n    req: IncomingMessage,\n    { scopes, ...options }: VerifyBearerJwtOptions<S>,\n  ): Promise<VerifyBearerJwtResult<S>> {\n    const token = bearerTokenFromReq(req)\n    if (!token) {\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n\n    const { payload } = await jose\n      .jwtVerify(token, this._jwtKey, options)\n      .catch((cause) => {\n        if (cause instanceof jose.errors.JWTExpired) {\n          throw new InvalidRequestError('Token has expired', 'ExpiredToken', {\n            cause,\n          })\n        } else {\n          throw new InvalidRequestError(\n            'Token could not be verified',\n            'InvalidToken',\n            { cause },\n          )\n        }\n      })\n\n    const { sub, aud, scope, lxm, cnf, jti } = payload\n\n    if (typeof lxm !== 'undefined') {\n      // Service auth tokens should never make it to here. But since service\n      // auth tokens do not have a \"typ\" header, the \"typ\" check above will not\n      // catch them. This check here is mainly to protect against the\n      // hypothetical case in which a PDS would issue service auth tokens using\n      // its private key.\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof cnf !== 'undefined') {\n      // Proof-of-Possession (PoP) tokens are not allowed here\n      // https://www.rfc-editor.org/rfc/rfc7800.html\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof sub !== 'string' || !isDidString(sub)) {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof aud !== 'string' || !aud.startsWith('did:')) {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof jti !== 'string' && typeof jti !== 'undefined') {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (!isAuthScope(scope) || !scopes.includes(scope as any)) {\n      throw new InvalidRequestError('Bad token scope', 'InvalidToken')\n    }\n\n    return { sub, aud, jti, scope: scope as S }\n  }\n\n  protected async verifyServiceJwt(\n    req: IncomingMessage,\n    opts?: { iss?: string[] },\n  ) {\n    const jwtStr = bearerTokenFromReq(req)\n    if (!jwtStr) {\n      throw new AuthRequiredError('missing jwt', 'MissingJwt')\n    }\n\n    const nsid = parseReqNsid(req)\n    const payload = await verifyServiceJwt(\n      jwtStr,\n      null,\n      nsid,\n      async (iss, forceRefresh) => {\n        if (opts?.iss && !opts.iss.includes(iss)) {\n          throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n        }\n        const [did, serviceId] = iss.split('#')\n        const keyId =\n          serviceId === 'atproto_labeler' ? 'atproto_label' : 'atproto'\n        const didDoc = await this.idResolver.did.resolve(did, forceRefresh)\n        if (!didDoc) {\n          throw new AuthRequiredError('could not resolve iss did')\n        }\n        const parsedKey = getVerificationMaterial(didDoc, keyId)\n        if (!parsedKey) {\n          throw new AuthRequiredError('missing or bad key in did doc')\n        }\n        const didKey = getDidKeyFromMultibase(parsedKey)\n        if (!didKey) {\n          throw new AuthRequiredError('missing or bad key in did doc')\n        }\n        return didKey\n      },\n    )\n    if (\n      payload.aud !== this.dids.pds &&\n      (!this.dids.entryway || payload.aud !== this.dids.entryway)\n    ) {\n      throw new AuthRequiredError(\n        'jwt audience does not match service did',\n        'BadJwtAudience',\n      )\n    }\n    return payload\n  }\n}\n\n// HELPERS\n// ---------\n\nexport function isUserOrAdmin(\n  auth: AccessOutput | OAuthOutput | AdminTokenOutput | UnauthenticatedOutput,\n  did: string,\n): boolean {\n  if (!auth.credentials) {\n    return false\n  } else if (auth.credentials.type === 'admin_token') {\n    return true\n  } else {\n    return auth.credentials.did === did\n  }\n}\n\nenum AuthType {\n  BASIC = 'Basic',\n  BEARER = 'Bearer',\n  DPOP = 'DPoP',\n}\n\nconst parseAuthorizationHeader = (\n  req: IncomingMessage,\n): [type: null] | [type: AuthType, token: string] => {\n  const authorization = req.headers['authorization']\n  if (!authorization) return [null]\n\n  const result = authorization.split(' ')\n  if (result.length !== 2) {\n    throw new InvalidRequestError(\n      'Malformed authorization header',\n      'InvalidToken',\n    )\n  }\n\n  // authorization type is case-insensitive\n  const authType = result[0].toUpperCase()\n\n  const type = Object.hasOwn(AuthType, authType) ? AuthType[authType] : null\n  if (type) return [type, result[1]]\n\n  throw new InvalidRequestError(\n    `Unsupported authorization type: ${result[0]}`,\n    'InvalidToken',\n  )\n}\n\n/**\n * @note Not all service auth tokens are guaranteed to have \"lxm\" claim, so this\n * function should not be used to verify service auth tokens. It is only used to\n * check if a token is definitely a service auth token.\n */\nconst isDefinitelyServiceAuth = (req: IncomingMessage): boolean => {\n  const token = bearerTokenFromReq(req)\n  if (!token) return false\n  const payload = jose.decodeJwt(token)\n  return payload['lxm'] != null\n}\n\nconst extractAuthType = (req: IncomingMessage): AuthType | null => {\n  const [type] = parseAuthorizationHeader(req)\n  return type\n}\n\nexport const bearerTokenFromReq = (req: IncomingMessage) => {\n  const [type, token] = parseAuthorizationHeader(req)\n  return type === AuthType.BEARER ? token : null\n}\n\nconst parseBasicAuth = (\n  req: IncomingMessage,\n): { username: string; password: string } | null => {\n  try {\n    const [type, b64] = parseAuthorizationHeader(req)\n    if (type !== AuthType.BASIC) return null\n    const decoded = Buffer.from(b64, 'base64').toString('utf8')\n    // We must not use split(':') because the password can contain colons\n    const colon = decoded.indexOf(':')\n    if (colon === -1) return null\n    const username = decoded.slice(0, colon)\n    const password = decoded.slice(colon + 1)\n    return { username, password }\n  } catch (err) {\n    return null\n  }\n}\n\nexport const createSecretKeyObject = (secret: string): KeyObject => {\n  return createSecretKey(Buffer.from(secret))\n}\n\nconst keyEncoder = new KeyEncoder('secp256k1')\nexport const createPublicKeyObject = (publicKeyHex: string): KeyObject => {\n  const key = keyEncoder.encodePublic(publicKeyHex, 'raw', 'pem')\n  return createPublicKey({ format: 'pem', key })\n}\n\nfunction setAuthHeaders(res: ServerResponse) {\n  res.setHeader('Cache-Control', 'private')\n  appendVary(res, 'Authorization')\n}\n"]}

package/dist/background.d.ts

@@ -1,6 +1,6 @@
 import PQueue from 'p-queue';
 export declare class BackgroundQueue {
-    queue: PQueue<import("p-queue/dist/priority-queue").default, import("p-queue").DefaultAddOptions>;
+    queue: InstanceType<typeof PQueue>;
     destroyed: boolean;
     constructor();
     add(task: Task): void;

package/dist/background.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"background.d.ts","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAA;AAK5B,qBAAa,eAAe;IAC1B,KAAK,6FAAiC;IACtC,SAAS,UAAQ;;IAGjB,GAAG,CAAC,IAAI,EAAE,IAAI;IAWR,UAAU;IAMV,OAAO;CAId;AAED,KAAK,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA"}
+{"version":3,"file":"background.d.ts","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAA;AAK5B,qBAAa,eAAe;IAC1B,KAAK,EAAE,YAAY,CAAC,OAAO,MAAM,CAAC,CAAiC;IACnE,SAAS,UAAQ;;IAGjB,GAAG,CAAC,IAAI,EAAE,IAAI;IAWR,UAAU;IAMV,OAAO;CAId;AAED,KAAK,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA"}

package/dist/background.js

@@ -1,26 +1,10 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BackgroundQueue = void 0;
-const p_queue_1 = __importDefault(require("p-queue"));
-const logger_1 = require("./logger");
+import PQueue from 'p-queue';
+import { dbLogger } from './logger.js';
 // A simple queue for in-process, out-of-band/backgrounded work
-class BackgroundQueue {
+export class BackgroundQueue {
     constructor() {
-        Object.defineProperty(this, "queue", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: new p_queue_1.default({ concurrency: 5 })
-        });
-        Object.defineProperty(this, "destroyed", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: false
-        });
+        this.queue = new PQueue({ concurrency: 5 });
+        this.destroyed = false;
     }
     add(task) {
         if (this.destroyed) {
@@ -29,7 +13,7 @@ class BackgroundQueue {
         this.queue
             .add(() => task())
             .catch((err) => {
-            logger_1.dbLogger.error({ err }, 'background queue task failed');
+            dbLogger.error({ err }, 'background queue task failed');
         });
     }
     async processAll() {
@@ -42,5 +26,4 @@ class BackgroundQueue {
         await this.queue.onIdle();
     }
 }
-exports.BackgroundQueue = BackgroundQueue;
 //# sourceMappingURL=background.js.map

package/dist/background.js.map

@@ -1 +1 @@
-{"version":3,"file":"background.js","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":";;;;;;AAAA,sDAA4B;AAC5B,qCAAmC;AAEnC,+DAA+D;AAE/D,MAAa,eAAe;IAG1B;QAFA;;;;mBAAQ,IAAI,iBAAM,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;WAAA;QACtC;;;;mBAAY,KAAK;WAAA;IACF,CAAC;IAEhB,GAAG,CAAC,IAAU;QACZ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,KAAK;aACP,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;aACjB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,iBAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAA;QACzD,CAAC,CAAC,CAAA;IACN,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;IAC3B,CAAC;IAED,sFAAsF;IACtF,oGAAoG;IACpG,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;IAC3B,CAAC;CACF;AA1BD,0CA0BC","sourcesContent":["import PQueue from 'p-queue'\nimport { dbLogger } from './logger'\n\n// A simple queue for in-process, out-of-band/backgrounded work\n\nexport class BackgroundQueue {\n  queue = new PQueue({ concurrency: 5 })\n  destroyed = false\n  constructor() {}\n\n  add(task: Task) {\n    if (this.destroyed) {\n      return\n    }\n    this.queue\n      .add(() => task())\n      .catch((err) => {\n        dbLogger.error({ err }, 'background queue task failed')\n      })\n  }\n\n  async processAll() {\n    await this.queue.onIdle()\n  }\n\n  // On destroy we stop accepting new tasks, but complete all pending/in-progress tasks.\n  // The application calls this only once http connections have drained (tasks no longer being added).\n  async destroy() {\n    this.destroyed = true\n    await this.queue.onIdle()\n  }\n}\n\ntype Task = () => Promise<void>\n"]}
+{"version":3,"file":"background.js","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,+DAA+D;AAE/D,MAAM,OAAO,eAAe;IAG1B;QAFA,UAAK,GAAgC,IAAI,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;QACnE,cAAS,GAAG,KAAK,CAAA;IACF,CAAC;IAEhB,GAAG,CAAC,IAAU;QACZ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,KAAK;aACP,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;aACjB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAA;QACzD,CAAC,CAAC,CAAA;IACN,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;IAC3B,CAAC;IAED,sFAAsF;IACtF,oGAAoG;IACpG,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;IAC3B,CAAC;CACF","sourcesContent":["import PQueue from 'p-queue'\nimport { dbLogger } from './logger.js'\n\n// A simple queue for in-process, out-of-band/backgrounded work\n\nexport class BackgroundQueue {\n  queue: InstanceType<typeof PQueue> = new PQueue({ concurrency: 5 })\n  destroyed = false\n  constructor() {}\n\n  add(task: Task) {\n    if (this.destroyed) {\n      return\n    }\n    this.queue\n      .add(() => task())\n      .catch((err) => {\n        dbLogger.error({ err }, 'background queue task failed')\n      })\n  }\n\n  async processAll() {\n    await this.queue.onIdle()\n  }\n\n  // On destroy we stop accepting new tasks, but complete all pending/in-progress tasks.\n  // The application calls this only once http connections have drained (tasks no longer being added).\n  async destroy() {\n    this.destroyed = true\n    await this.queue.onIdle()\n  }\n}\n\ntype Task = () => Promise<void>\n"]}

package/dist/basic-routes.d.ts

@@ -1,4 +1,4 @@
 import { Router } from 'express';
-import { AppContext } from './context';
+import { AppContext } from './context.js';
 export declare const createRouter: (ctx: AppContext) => Router;
 //# sourceMappingURL=basic-routes.d.ts.map

package/dist/basic-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"basic-routes.d.ts","sourceRoot":"","sources":["../src/basic-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAEhC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEtC,eAAO,MAAM,YAAY,GAAI,KAAK,UAAU,KAAG,MA+C9C,CAAA"}
+{"version":3,"file":"basic-routes.d.ts","sourceRoot":"","sources":["../src/basic-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAEhC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAEzC,eAAO,MAAM,YAAY,GAAI,KAAK,UAAU,KAAG,MA+C9C,CAAA"}

package/dist/basic-routes.js

@@ -1,10 +1,7 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createRouter = void 0;
-const express_1 = require("express");
-const kysely_1 = require("kysely");
-const createRouter = (ctx) => {
-    const router = (0, express_1.Router)();
+import { Router } from 'express';
+import { sql } from 'kysely';
+export const createRouter = (ctx) => {
+    const router = Router();
     router.get('/', function (req, res) {
         res.type('text/plain');
         res.send(`
@@ -35,7 +32,7 @@ Most API routes are under /xrpc/
     router.get('/xrpc/_health', async function (req, res) {
         const { version } = ctx.cfg.service;
         try {
-            await (0, kysely_1.sql) `select 1`.execute(ctx.accountManager.db.db);
+            await sql `select 1`.execute(ctx.accountManager.db.db);
         }
         catch (err) {
             req.log.error({ err }, 'failed health check');
@@ -46,5 +43,4 @@ Most API routes are under /xrpc/
     });
     return router;
 };
-exports.createRouter = createRouter;
 //# sourceMappingURL=basic-routes.js.map

package/dist/basic-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"basic-routes.js","sourceRoot":"","sources":["../src/basic-routes.ts"],"names":[],"mappings":";;;AAAA,qCAAgC;AAChC,mCAA4B;AAGrB,MAAM,YAAY,GAAG,CAAC,GAAe,EAAU,EAAE;IACtD,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAA;IAEvB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,EAAE,GAAG;QAChC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACtB,GAAG,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;CAmBZ,CAAC,CAAA;IACA,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,GAAG,EAAE,GAAG;QAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACtB,GAAG,CAAC,IAAI,CACN,2EAA2E,CAC5E,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,WAAW,GAAG,EAAE,GAAG;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAA;QACnC,IAAI,CAAC;YACH,MAAM,IAAA,YAAG,EAAA,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,qBAAqB,CAAC,CAAA;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;YAC/D,OAAM;QACR,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AA/CY,QAAA,YAAY,gBA+CxB","sourcesContent":["import { Router } from 'express'\nimport { sql } from 'kysely'\nimport { AppContext } from './context'\n\nexport const createRouter = (ctx: AppContext): Router => {\n  const router = Router()\n\n  router.get('/', function (req, res) {\n    res.type('text/plain')\n    res.send(`\n         __                         __\n        /\\\\ \\\\__                     /\\\\ \\\\__\n    __  \\\\ \\\\ ,_\\\\  _____   _ __   ___\\\\ \\\\ ,_\\\\   ___\n  /'__'\\\\ \\\\ \\\\ \\\\/ /\\\\ '__'\\\\/\\\\''__\\\\/ __'\\\\ \\\\ \\\\/  / __'\\\\\n /\\\\ \\\\L\\\\.\\\\_\\\\ \\\\ \\\\_\\\\ \\\\ \\\\L\\\\ \\\\ \\\\ \\\\//\\\\ \\\\L\\\\ \\\\ \\\\ \\\\_/\\\\ \\\\L\\\\ \\\\\n \\\\ \\\\__/.\\\\_\\\\\\\\ \\\\__\\\\\\\\ \\\\ ,__/\\\\ \\\\_\\\\\\\\ \\\\____/\\\\ \\\\__\\\\ \\\\____/\n  \\\\/__/\\\\/_/ \\\\/__/ \\\\ \\\\ \\\\/  \\\\/_/ \\\\/___/  \\\\/__/\\\\/___/\n                   \\\\ \\\\_\\\\\n                    \\\\/_/\n\n\nThis is an AT Protocol Personal Data Server (aka, an atproto PDS)\n\nMost API routes are under /xrpc/\n\n      Code: https://github.com/bluesky-social/atproto\n Self-Host: https://github.com/bluesky-social/pds\n  Protocol: https://atproto.com\n`)\n  })\n\n  router.get('/robots.txt', function (req, res) {\n    res.type('text/plain')\n    res.send(\n      '# Hello!\\n\\n# Crawling the public API is allowed\\nUser-agent: *\\nAllow: /',\n    )\n  })\n\n  router.get('/xrpc/_health', async function (req, res) {\n    const { version } = ctx.cfg.service\n    try {\n      await sql`select 1`.execute(ctx.accountManager.db.db)\n    } catch (err) {\n      req.log.error({ err }, 'failed health check')\n      res.status(503).send({ version, error: 'Service Unavailable' })\n      return\n    }\n    res.send({ version })\n  })\n\n  return router\n}\n"]}
+{"version":3,"file":"basic-routes.js","sourceRoot":"","sources":["../src/basic-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAG5B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAe,EAAU,EAAE;IACtD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAA;IAEvB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,EAAE,GAAG;QAChC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACtB,GAAG,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;CAmBZ,CAAC,CAAA;IACA,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,GAAG,EAAE,GAAG;QAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACtB,GAAG,CAAC,IAAI,CACN,2EAA2E,CAC5E,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,WAAW,GAAG,EAAE,GAAG;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAA;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,CAAA,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,qBAAqB,CAAC,CAAA;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;YAC/D,OAAM;QACR,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA","sourcesContent":["import { Router } from 'express'\nimport { sql } from 'kysely'\nimport { AppContext } from './context.js'\n\nexport const createRouter = (ctx: AppContext): Router => {\n  const router = Router()\n\n  router.get('/', function (req, res) {\n    res.type('text/plain')\n    res.send(`\n         __                         __\n        /\\\\ \\\\__                     /\\\\ \\\\__\n    __  \\\\ \\\\ ,_\\\\  _____   _ __   ___\\\\ \\\\ ,_\\\\   ___\n  /'__'\\\\ \\\\ \\\\ \\\\/ /\\\\ '__'\\\\/\\\\''__\\\\/ __'\\\\ \\\\ \\\\/  / __'\\\\\n /\\\\ \\\\L\\\\.\\\\_\\\\ \\\\ \\\\_\\\\ \\\\ \\\\L\\\\ \\\\ \\\\ \\\\//\\\\ \\\\L\\\\ \\\\ \\\\ \\\\_/\\\\ \\\\L\\\\ \\\\\n \\\\ \\\\__/.\\\\_\\\\\\\\ \\\\__\\\\\\\\ \\\\ ,__/\\\\ \\\\_\\\\\\\\ \\\\____/\\\\ \\\\__\\\\ \\\\____/\n  \\\\/__/\\\\/_/ \\\\/__/ \\\\ \\\\ \\\\/  \\\\/_/ \\\\/___/  \\\\/__/\\\\/___/\n                   \\\\ \\\\_\\\\\n                    \\\\/_/\n\n\nThis is an AT Protocol Personal Data Server (aka, an atproto PDS)\n\nMost API routes are under /xrpc/\n\n      Code: https://github.com/bluesky-social/atproto\n Self-Host: https://github.com/bluesky-social/pds\n  Protocol: https://atproto.com\n`)\n  })\n\n  router.get('/robots.txt', function (req, res) {\n    res.type('text/plain')\n    res.send(\n      '# Hello!\\n\\n# Crawling the public API is allowed\\nUser-agent: *\\nAllow: /',\n    )\n  })\n\n  router.get('/xrpc/_health', async function (req, res) {\n    const { version } = ctx.cfg.service\n    try {\n      await sql`select 1`.execute(ctx.accountManager.db.db)\n    } catch (err) {\n      req.log.error({ err }, 'failed health check')\n      res.status(503).send({ version, error: 'Service Unavailable' })\n      return\n    }\n    res.send({ version })\n  })\n\n  return router\n}\n"]}

package/dist/bsky-app-view.js

@@ -1,37 +1,10 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BskyAppView = void 0;
-const node_util_1 = require("node:util");
-const lex_1 = require("@atproto/lex");
-class BskyAppView {
+import { format } from 'node:util';
+import { Client } from '@atproto/lex';
+export class BskyAppView {
     constructor(options) {
-        Object.defineProperty(this, "did", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "url", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "client", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "cdnUrlPattern", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
         this.did = options.did;
         this.url = options.url;
-        this.client = new lex_1.Client({ service: options.url }, {
+        this.client = new Client({ service: options.url }, {
             strictResponseProcessing: false,
             validateResponse: options.validateResponse ?? false,
         });
@@ -39,8 +12,7 @@ class BskyAppView {
     }
     getImageUrl(pattern, did, cid) {
         if (this.cdnUrlPattern)
-            return (0, node_util_1.format)(this.cdnUrlPattern, pattern, did, cid);
+            return format(this.cdnUrlPattern, pattern, did, cid);
     }
 }
-exports.BskyAppView = BskyAppView;
 //# sourceMappingURL=bsky-app-view.js.map

package/dist/bsky-app-view.js.map

@@ -1 +1 @@
-{"version":3,"file":"bsky-app-view.js","sourceRoot":"","sources":["../src/bsky-app-view.ts"],"names":[],"mappings":";;;AAAA,yCAAkC;AAClC,sCAAqC;AASrC,MAAa,WAAW;IAMtB,YAAY,OAAuB;QAL5B;;;;;WAAW;QACX;;;;;WAAW;QACX;;;;;WAAc;QACb;;;;;WAAsB;QAG5B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,YAAM,CACtB,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EACxB;YACE,wBAAwB,EAAE,KAAK;YAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;SACpD,CACF,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC5C,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,GAAW;QACnD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAA,kBAAM,EAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;CACF;AAtBD,kCAsBC","sourcesContent":["import { format } from 'node:util'\nimport { Client } from '@atproto/lex'\n\nexport type AppViewOptions = {\n  url: string\n  did: string\n  cdnUrlPattern?: string\n  validateResponse?: boolean\n}\n\nexport class BskyAppView {\n  public did: string\n  public url: string\n  public client: Client\n  private cdnUrlPattern?: string\n\n  constructor(options: AppViewOptions) {\n    this.did = options.did\n    this.url = options.url\n    this.client = new Client(\n      { service: options.url },\n      {\n        strictResponseProcessing: false,\n        validateResponse: options.validateResponse ?? false,\n      },\n    )\n    this.cdnUrlPattern = options.cdnUrlPattern\n  }\n\n  getImageUrl(pattern: string, did: string, cid: string): string | undefined {\n    if (this.cdnUrlPattern) return format(this.cdnUrlPattern, pattern, did, cid)\n  }\n}\n"]}
+{"version":3,"file":"bsky-app-view.js","sourceRoot":"","sources":["../src/bsky-app-view.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AASrC,MAAM,OAAO,WAAW;IAMtB,YAAY,OAAuB;QACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CACtB,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EACxB;YACE,wBAAwB,EAAE,KAAK;YAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;SACpD,CACF,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC5C,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,GAAW;QACnD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;CACF","sourcesContent":["import { format } from 'node:util'\nimport { Client } from '@atproto/lex'\n\nexport type AppViewOptions = {\n  url: string\n  did: string\n  cdnUrlPattern?: string\n  validateResponse?: boolean\n}\n\nexport class BskyAppView {\n  public did: string\n  public url: string\n  public client: Client\n  private cdnUrlPattern?: string\n\n  constructor(options: AppViewOptions) {\n    this.did = options.did\n    this.url = options.url\n    this.client = new Client(\n      { service: options.url },\n      {\n        strictResponseProcessing: false,\n        validateResponse: options.validateResponse ?? false,\n      },\n    )\n    this.cdnUrlPattern = options.cdnUrlPattern\n  }\n\n  getImageUrl(pattern: string, did: string, cid: string): string | undefined {\n    if (this.cdnUrlPattern) return format(this.cdnUrlPattern, pattern, did, cid)\n  }\n}\n"]}

package/dist/config/config.d.ts

@@ -1,5 +1,5 @@
 import { BrandingInput, HcaptchaConfig } from '@atproto/oauth-provider';
-import { ServerEnvironment } from './env';
+import { ServerEnvironment } from './env.js';
 export declare const envToCfg: (env: ServerEnvironment) => ServerConfig;
 export type ServerConfig = {
     service: ServiceConfig;

package/dist/config/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAA;AAKzC,eAAO,MAAM,QAAQ,GAAI,KAAK,iBAAiB,KAAG,YAgWjD,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,aAAa,CAAA;IACtB,EAAE,EAAE,cAAc,CAAA;IAClB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,SAAS,EAAE,iBAAiB,GAAG,mBAAmB,CAAA;IAClD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,eAAe,EAAE,WAAW,GAAG,IAAI,CAAA;IACnC,YAAY,EAAE,kBAAkB,CAAA;IAChC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACrC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACnC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACzC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,gBAAgB,EAAE,OAAO,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,IAAI,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;IAClC,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,UAAU,EAAE,OAAO,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAElB;;;;;;OAMG;IACH,gBAAgB,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,cAAc,CAAA;QACzB,QAAQ,EAAE,aAAa,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAC1B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,CAAC,EAAE,OAAO,MAAM,IAAI,MAAM,EAAE,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,aAAa,GACrB;IACE,QAAQ,EAAE,IAAI,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;CACd,GACD;IACE,QAAQ,EAAE,KAAK,CAAA;CAChB,CAAA;AAEL,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,OAAO,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,GACD;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAK5C,eAAO,MAAM,QAAQ,GAAI,KAAK,iBAAiB,KAAG,YAgWjD,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,aAAa,CAAA;IACtB,EAAE,EAAE,cAAc,CAAA;IAClB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,SAAS,EAAE,iBAAiB,GAAG,mBAAmB,CAAA;IAClD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,eAAe,EAAE,WAAW,GAAG,IAAI,CAAA;IACnC,YAAY,EAAE,kBAAkB,CAAA;IAChC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACrC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACnC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACzC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,gBAAgB,EAAE,OAAO,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,IAAI,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;IAClC,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,UAAU,EAAE,OAAO,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAElB;;;;;;OAMG;IACH,gBAAgB,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,cAAc,CAAA;QACzB,QAAQ,EAAE,aAAa,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAC1B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,CAAC,EAAE,OAAO,MAAM,IAAI,MAAM,EAAE,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,aAAa,GACrB;IACE,QAAQ,EAAE,IAAI,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;CACd,GACD;IACE,QAAQ,EAAE,KAAK,CAAA;CAChB,CAAA;AAEL,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,OAAO,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,GACD;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA"}

package/dist/config/config.js

@@ -1,16 +1,10 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.envToCfg = void 0;
-const node_assert_1 = __importDefault(require("node:assert"));
-const node_path_1 = __importDefault(require("node:path"));
-const common_1 = require("@atproto/common");
-const syntax_1 = require("@atproto/syntax");
+import assert from 'node:assert';
+import path from 'node:path';
+import { DAY, HOUR, SECOND } from '@atproto/common';
+import { ensureValidDid } from '@atproto/syntax';
 // off-config but still from env:
 // logging: LOG_LEVEL, LOG_SYSTEMS, LOG_ENABLED, LOG_DESTINATION
-const envToCfg = (env) => {
+export const envToCfg = (env) => {
     const port = env.port ?? 2583;
     const hostname = env.hostname ?? 'localhost';
     const publicUrl = hostname === 'localhost'
@@ -32,7 +26,7 @@ const envToCfg = (env) => {
         devMode: env.devMode ?? false,
     };
     const dbLoc = (name) => {
-        return env.dataDirectory ? node_path_1.default.join(env.dataDirectory, name) : name;
+        return env.dataDirectory ? path.join(env.dataDirectory, name) : name;
     };
     const disableWalAutoCheckpoint = env.disableWalAutoCheckpoint ?? false;
     const dbCfg = {
@@ -97,9 +91,9 @@ const envToCfg = (env) => {
     }
     const identityCfg = {
         plcUrl: env.didPlcUrl ?? 'https://plc.directory',
-        cacheMaxTTL: env.didCacheMaxTTL ?? common_1.DAY,
-        cacheStaleTTL: env.didCacheStaleTTL ?? common_1.HOUR,
-        resolverTimeout: env.resolverTimeout ?? 3 * common_1.SECOND,
+        cacheMaxTTL: env.didCacheMaxTTL ?? DAY,
+        cacheStaleTTL: env.didCacheStaleTTL ?? HOUR,
+        resolverTimeout: env.resolverTimeout ?? 3 * SECOND,
         recoveryDidKey: env.recoveryDidKey ?? null,
         serviceHandleDomains,
         handleBackupNameservers: env.handleBackupNameservers,
@@ -107,7 +101,7 @@ const envToCfg = (env) => {
     };
     let entrywayCfg = null;
     if (env.entrywayUrl) {
-        (0, node_assert_1.default)(env.entrywayJwtVerifyKeyK256PublicKeyHex &&
+        assert(env.entrywayJwtVerifyKeyK256PublicKeyHex &&
             env.entrywayPlcRotationKey &&
             env.entrywayDid, 'if entryway url is configured, must include all required entryway configuration');
         entrywayCfg = {
@@ -155,11 +149,11 @@ const envToCfg = (env) => {
     }
     const subscriptionCfg = {
         maxBuffer: env.maxSubscriptionBuffer ?? 500,
-        repoBackfillLimitMs: env.repoBackfillLimitMs ?? common_1.DAY,
+        repoBackfillLimitMs: env.repoBackfillLimitMs ?? DAY,
     };
     let bskyAppViewCfg = null;
     if (env.bskyAppViewUrl) {
-        (0, node_assert_1.default)(env.bskyAppViewDid, 'if bsky appview service url is configured, must configure its did as well.');
+        assert(env.bskyAppViewDid, 'if bsky appview service url is configured, must configure its did as well.');
         bskyAppViewCfg = {
             url: env.bskyAppViewUrl,
             did: env.bskyAppViewDid,
@@ -168,7 +162,7 @@ const envToCfg = (env) => {
     }
     let modServiceCfg = null;
     if (env.modServiceUrl) {
-        (0, node_assert_1.default)(env.modServiceDid, 'if mod service url is configured, must configure its did as well.');
+        assert(env.modServiceDid, 'if mod service url is configured, must configure its did as well.');
         modServiceCfg = {
             url: env.modServiceUrl,
             did: env.modServiceDid,
@@ -176,7 +170,7 @@ const envToCfg = (env) => {
     }
     let reportServiceCfg = null;
     if (env.reportServiceUrl) {
-        (0, node_assert_1.default)(env.reportServiceDid, 'if report service url is configured, must configure its did as well.');
+        assert(env.reportServiceDid, 'if report service url is configured, must configure its did as well.');
         reportServiceCfg = {
             url: env.reportServiceUrl,
             did: env.reportServiceDid,
@@ -283,7 +277,7 @@ const envToCfg = (env) => {
         };
     const lexiconCfg = {};
     if (env.lexiconDidAuthority != null) {
-        (0, syntax_1.ensureValidDid)(env.lexiconDidAuthority);
+        ensureValidDid(env.lexiconDidAuthority);
         lexiconCfg.didAuthority = env.lexiconDidAuthority;
     }
     return {
@@ -309,5 +303,4 @@ const envToCfg = (env) => {
         oauth: oauthCfg,
     };
 };
-exports.envToCfg = envToCfg;
 //# sourceMappingURL=config.js.map