@atcute/oauth-types 0.1.0 → 0.1.1

package/dist/build-client-metadata.d.ts

@@ -1,7 +1,6 @@
 import type { Keyset } from '@atcute/oauth-keyset';
 /**
- * builds an atproto client metadata
- *
+ * builds an atproto client metadata for a confidential client.
  *
  * @param input client metadata
  * @param keyset available keys
@@ -165,4 +164,178 @@ export declare const buildClientMetadata: (input: {
     dpop_bound_access_tokens?: boolean | undefined;
     authorization_details_types?: string[] | undefined;
 };
+/**
+ * builds an atproto client metadata for a public client.
+ *
+ * public clients use `token_endpoint_auth_method: 'none'` and don't require a keyset.
+ * per AT Protocol spec, they have shorter token lifetimes and cannot use silent sign-in.
+ *
+ * - if `client_id` is omitted: loopback client (client_id built from redirect_uris/scope)
+ * - if `client_id` is provided: discoverable public client
+ *
+ * @param input public client metadata
+ * @returns built client metadata
+ */
+export declare const buildPublicClientMetadata: (input: {
+    client_id?: undefined;
+    redirect_uris: string[];
+    scope: string | string[];
+} | {
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    application_type?: "native" | "web" | undefined;
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+}) => {
+    redirect_uris: string[];
+    response_types?: ("code" | "code id_token" | "code id_token token" | "code token" | "id_token" | "id_token token" | "none" | "token")[] | undefined;
+    grant_types?: ("authorization_code" | "client_credentials" | "implicit" | "password" | "refresh_token" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer")[] | undefined;
+    scope?: string | undefined;
+    token_endpoint_auth_method?: "client_secret_basic" | "client_secret_jwt" | "client_secret_post" | "none" | "private_key_jwt" | "self_signed_tls_client_auth" | "tls_client_auth" | undefined;
+    token_endpoint_auth_signing_alg?: string | undefined;
+    userinfo_signed_response_alg?: string | undefined;
+    userinfo_encrypted_response_alg?: string | undefined;
+    jwks_uri?: string | undefined;
+    jwks?: {
+        keys: ({
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "RSA";
+            alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
+            n: string;
+            e: string;
+            d?: string | undefined;
+            p?: string | undefined;
+            q?: string | undefined;
+            dp?: string | undefined;
+            dq?: string | undefined;
+            qi?: string | undefined;
+            oth?: {
+                r?: string | undefined;
+                d?: string | undefined;
+                t?: string | undefined;
+            }[] | undefined;
+        } | {
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "EC";
+            alg?: "ES256" | "ES384" | "ES512" | undefined;
+            crv: "P-256" | "P-384" | "P-521";
+            x: string;
+            y: string;
+            d?: string | undefined;
+        } | {
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "EC";
+            alg?: "ES256K" | undefined;
+            crv: "secp256k1";
+            x: string;
+            y: string;
+            d?: string | undefined;
+        } | {
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "OKP";
+            alg?: "EdDSA" | undefined;
+            crv: "Ed25519" | "Ed448";
+            x: string;
+            d?: string | undefined;
+        } | {
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "oct";
+            alg?: "HS256" | "HS384" | "HS512" | undefined;
+            k: string;
+        })[];
+    } | undefined;
+    application_type?: "native" | "web" | undefined;
+    subject_type?: "pairwise" | "public" | undefined;
+    request_object_signing_alg?: string | undefined;
+    id_token_signed_response_alg?: string | undefined;
+    authorization_signed_response_alg?: string | undefined;
+    authorization_encrypted_response_enc?: "A128CBC-HS256" | undefined;
+    authorization_encrypted_response_alg?: string | undefined;
+    client_id?: string | undefined;
+    client_name?: string | undefined;
+    client_uri?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    default_max_age?: number | undefined;
+    require_auth_time?: boolean | undefined;
+    contacts?: string[] | undefined;
+    tls_client_certificate_bound_access_tokens?: boolean | undefined;
+    dpop_bound_access_tokens?: boolean | undefined;
+    authorization_details_types?: string[] | undefined;
+};
 //# sourceMappingURL=build-client-metadata.d.ts.map

package/dist/build-client-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-client-metadata.d.ts","sourceRoot":"","sources":["../lib/build-client-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AASnD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsD/B,CAAC"}
+{"version":3,"file":"build-client-metadata.d.ts","sourceRoot":"","sources":["../lib/build-client-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAcnD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsD/B,CAAC;AA6BF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCrC,CAAC"}

package/dist/build-client-metadata.js

@@ -1,8 +1,9 @@
 import { FALLBACK_ALG } from './constants.js';
 import { confidentialClientMetadataSchema, } from './schemas/atcute-confidential-client-metadata.js';
+import { publicClientMetadataSchema, } from './schemas/atcute-public-client-metadata.js';
+import { DEFAULT_ATPROTO_OAUTH_SCOPE } from './schemas/atproto-oauth-scope.js';
 /**
- * builds an atproto client metadata
- *
+ * builds an atproto client metadata for a confidential client.
  *
  * @param input client metadata
  * @param keyset available keys
@@ -50,4 +51,72 @@ export const buildClientMetadata = (input, keyset) => {
     }
     return metadata;
 };
+/**
+ * builds a loopback client_id from redirect_uris and scope.
+ *
+ * @param redirectUris loopback redirect URIs
+ * @param scope OAuth scope string
+ * @returns loopback client_id URL
+ */
+const buildLoopbackClientId = (redirectUris, scope) => {
+    const params = new URLSearchParams();
+    // only include scope if not the default
+    if (scope !== DEFAULT_ATPROTO_OAUTH_SCOPE) {
+        params.set('scope', scope);
+    }
+    // include redirect URIs
+    for (const uri of redirectUris) {
+        params.append('redirect_uri', uri);
+    }
+    if (params.size > 0) {
+        return `http://localhost?${params.toString()}`;
+    }
+    return 'http://localhost';
+};
+/**
+ * builds an atproto client metadata for a public client.
+ *
+ * public clients use `token_endpoint_auth_method: 'none'` and don't require a keyset.
+ * per AT Protocol spec, they have shorter token lifetimes and cannot use silent sign-in.
+ *
+ * - if `client_id` is omitted: loopback client (client_id built from redirect_uris/scope)
+ * - if `client_id` is provided: discoverable public client
+ *
+ * @param input public client metadata
+ * @returns built client metadata
+ */
+export const buildPublicClientMetadata = (input) => {
+    const parsed = publicClientMetadataSchema.parse(input, { mode: 'passthrough' });
+    const scope = Array.isArray(parsed.scope) ? parsed.scope.join(' ') : parsed.scope;
+    if (parsed.client_id === undefined) {
+        // loopback client - server generates metadata from client_id URL
+        return {
+            client_id: buildLoopbackClientId(parsed.redirect_uris, scope),
+            redirect_uris: parsed.redirect_uris,
+            scope,
+            application_type: 'native',
+            response_types: ['code'],
+            grant_types: ['authorization_code', 'refresh_token'],
+            token_endpoint_auth_method: 'none',
+            dpop_bound_access_tokens: true,
+        };
+    }
+    // discoverable public client
+    return {
+        client_id: parsed.client_id,
+        client_name: parsed.client_name,
+        client_uri: parsed.client_uri,
+        policy_uri: parsed.policy_uri,
+        tos_uri: parsed.tos_uri,
+        logo_uri: parsed.logo_uri,
+        redirect_uris: parsed.redirect_uris,
+        scope,
+        application_type: parsed.application_type ?? 'web',
+        subject_type: 'public',
+        response_types: ['code'],
+        grant_types: ['authorization_code', 'refresh_token'],
+        token_endpoint_auth_method: 'none',
+        dpop_bound_access_tokens: true,
+    };
+};
 //# sourceMappingURL=build-client-metadata.js.map

package/dist/build-client-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-client-metadata.js","sourceRoot":"","sources":["../lib/build-client-metadata.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EACN,gCAAgC,GAEhC,MAAM,kDAAkD,CAAC;AAG1D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAClC,KAAiC,EACjC,MAAc,EACQ,EAAE,CAAC;IACzB,yCAAyC;IACzC,MAAM,IAAI,GAAG,gCAAgC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAEpF,uEAAuE;IACvE,MAAM,QAAQ,GAAwB;QACrC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK;QAEpE,gBAAgB,EAAE,KAAK;QACvB,YAAY,EAAE,QAAQ;QACtB,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAEpD,0BAA0B,EAAE,iBAAiB;QAC7C,+BAA+B,EAAE,YAAY;QAC7C,wBAAwB,EAAE,IAAI;QAE9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,MAAM,CAAC,UAA0C;KACpF,CAAC;IAEF,0DAA0D;IAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,YAAY,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,4CAA4C,YAAY,eAAe,CAAC,CAAC;IAC9F,CAAC;IAED,+DAA+D;IAC/D,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,QAAQ,CAAC,IAAI,CAAC,IAAI;aAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;aACjB,MAAM,CAAC,OAAO,CAAC,CACjB,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,SAAS,CAAC,gBAAgB,GAAG,CAAC,GAAG,qBAAqB,CAAC,CAAC;YACnE,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AAAA,CAChB,CAAC"}
+{"version":3,"file":"build-client-metadata.js","sourceRoot":"","sources":["../lib/build-client-metadata.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EACN,gCAAgC,GAEhC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACN,0BAA0B,GAE1B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAG/E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAClC,KAAiC,EACjC,MAAc,EACQ,EAAE,CAAC;IACzB,yCAAyC;IACzC,MAAM,IAAI,GAAG,gCAAgC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAEpF,uEAAuE;IACvE,MAAM,QAAQ,GAAwB;QACrC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK;QAEpE,gBAAgB,EAAE,KAAK;QACvB,YAAY,EAAE,QAAQ;QACtB,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAEpD,0BAA0B,EAAE,iBAAiB;QAC7C,+BAA+B,EAAE,YAAY;QAC7C,wBAAwB,EAAE,IAAI;QAE9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,MAAM,CAAC,UAA0C;KACpF,CAAC;IAEF,0DAA0D;IAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,YAAY,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,4CAA4C,YAAY,eAAe,CAAC,CAAC;IAC9F,CAAC;IAED,+DAA+D;IAC/D,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,QAAQ,CAAC,IAAI,CAAC,IAAI;aAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;aACjB,MAAM,CAAC,OAAO,CAAC,CACjB,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,SAAS,CAAC,gBAAgB,GAAG,CAAC,GAAG,qBAAqB,CAAC,CAAC;YACnE,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AAAA,CAChB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,CAAC,YAA+B,EAAE,KAAa,EAAU,EAAE,CAAC;IACzF,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAErC,wCAAwC;IACxC,IAAI,KAAK,KAAK,2BAA2B,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,oBAAoB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,kBAAkB,CAAC;AAAA,CAC1B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAA2B,EAAuB,EAAE,CAAC;IAC9F,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAElF,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,iEAAiE;QACjE,OAAO;YACN,SAAS,EAAE,qBAAqB,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC;YAC7D,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,KAAK;YAEL,gBAAgB,EAAE,QAAQ;YAC1B,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAEpD,0BAA0B,EAAE,MAAM;YAClC,wBAAwB,EAAE,IAAI;SAC9B,CAAC;IACH,CAAC;IAED,6BAA6B;IAC7B,OAAO;QACN,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,KAAK;QAEL,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,KAAK;QAClD,YAAY,EAAE,QAAQ;QACtB,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAEpD,0BAA0B,EAAE,MAAM;QAClC,wBAAwB,EAAE,IAAI;KAC9B,CAAC;AAAA,CACF,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,8 @@
-export { buildClientMetadata } from './build-client-metadata.js';
+export { buildClientMetadata, buildPublicClientMetadata } from './build-client-metadata.js';
 export { CLIENT_ASSERTION_TYPE_JWT_BEARER, FALLBACK_ALG } from './constants.js';
 export * as scope from './scope.js';
 export { confidentialClientMetadataSchema, type ConfidentialClientMetadata, } from './schemas/atcute-confidential-client-metadata.js';
+export { discoverablePublicClientMetadataSchema, loopbackClientMetadataSchema, publicClientMetadataSchema, type DiscoverablePublicClientMetadata, type LoopbackClientMetadata, type PublicClientMetadata, } from './schemas/atcute-public-client-metadata.js';
 export { atprotoOAuthScopeSchema, ATPROTO_SCOPE_VALUE, DEFAULT_ATPROTO_OAUTH_SCOPE, type AtprotoOAuthScope, } from './schemas/atproto-oauth-scope.js';
 export { jwkPubSchema, jwkSchema, keyUsageSchema, publicKeyUsageSchema, type Jwk, type JwkPub, type KeyUsage, } from './schemas/jwk.js';
 export { jwksPubSchema, jwksSchema, type Jwks, type JwksPub } from './schemas/jwks.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,gCAAgC,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAGpC,OAAO,EACN,gCAAgC,EAChC,KAAK,0BAA0B,GAC/B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,KAAK,iBAAiB,GACtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,YAAY,EACZ,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,KAAK,GAAG,EACR,KAAK,MAAM,EACX,KAAK,QAAQ,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,KAAK,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzG,OAAO,EACN,6BAA6B,EAC7B,KAAK,uBAAuB,GAC5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EACN,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACnG,OAAO,EACN,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,UAAU,GACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,SAAS,EACT,YAAY,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,qBAAqB,GACrB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,KAAK,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACtG,OAAO,EACN,+BAA+B,EAC/B,KAAK,yBAAyB,GAC9B,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAE,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAChG,OAAO,EACN,8BAA8B,EAC9B,KAAK,wBAAwB,GAC7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAGhF,OAAO,EACN,8BAA8B,EAC9B,+BAA+B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,GAC9B,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EACN,2BAA2B,EAC3B,KAAK,qBAAqB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACN,sCAAsC,EACtC,yCAAyC,EACzC,KAAK,gCAAgC,GACrC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACN,2CAA2C,EAC3C,KAAK,kCAAkC,GACvC,MAAM,oDAAoD,CAAC;AAG5D,OAAO,EACN,uBAAuB,EACvB,oCAAoC,EACpC,uCAAuC,EACvC,KAAK,iBAAiB,EACtB,KAAK,8BAA8B,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACN,yCAAyC,EACzC,KAAK,gCAAgC,GACrC,MAAM,kDAAkD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,gCAAgC,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAGpC,OAAO,EACN,gCAAgC,EAChC,KAAK,0BAA0B,GAC/B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACN,sCAAsC,EACtC,4BAA4B,EAC5B,0BAA0B,EAC1B,KAAK,gCAAgC,EACrC,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,GACzB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,KAAK,iBAAiB,GACtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,YAAY,EACZ,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,KAAK,GAAG,EACR,KAAK,MAAM,EACX,KAAK,QAAQ,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,KAAK,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzG,OAAO,EACN,6BAA6B,EAC7B,KAAK,uBAAuB,GAC5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EACN,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACnG,OAAO,EACN,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,UAAU,GACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,SAAS,EACT,YAAY,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,qBAAqB,GACrB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,KAAK,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACtG,OAAO,EACN,+BAA+B,EAC/B,KAAK,yBAAyB,GAC9B,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAE,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAChG,OAAO,EACN,8BAA8B,EAC9B,KAAK,wBAAwB,GAC7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAGhF,OAAO,EACN,8BAA8B,EAC9B,+BAA+B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,GAC9B,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EACN,2BAA2B,EAC3B,KAAK,qBAAqB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACN,sCAAsC,EACtC,yCAAyC,EACzC,KAAK,gCAAgC,GACrC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACN,2CAA2C,EAC3C,KAAK,kCAAkC,GACvC,MAAM,oDAAoD,CAAC;AAG5D,OAAO,EACN,uBAAuB,EACvB,oCAAoC,EACpC,uCAAuC,EACvC,KAAK,iBAAiB,EACtB,KAAK,8BAA8B,GACnC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACN,yCAAyC,EACzC,KAAK,gCAAgC,GACrC,MAAM,kDAAkD,CAAC"}

package/dist/index.js

@@ -1,8 +1,9 @@
-export { buildClientMetadata } from './build-client-metadata.js';
+export { buildClientMetadata, buildPublicClientMetadata } from './build-client-metadata.js';
 export { CLIENT_ASSERTION_TYPE_JWT_BEARER, FALLBACK_ALG } from './constants.js';
 export * as scope from './scope.js';
 // schemas
 export { confidentialClientMetadataSchema, } from './schemas/atcute-confidential-client-metadata.js';
+export { discoverablePublicClientMetadataSchema, loopbackClientMetadataSchema, publicClientMetadataSchema, } from './schemas/atcute-public-client-metadata.js';
 export { atprotoOAuthScopeSchema, ATPROTO_SCOPE_VALUE, DEFAULT_ATPROTO_OAUTH_SCOPE, } from './schemas/atproto-oauth-scope.js';
 export { jwkPubSchema, jwkSchema, keyUsageSchema, publicKeyUsageSchema, } from './schemas/jwk.js';
 export { jwksPubSchema, jwksSchema } from './schemas/jwks.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,gCAAgC,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAEpC,UAAU;AACV,OAAO,EACN,gCAAgC,GAEhC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,GAE3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,YAAY,EACZ,SAAS,EACT,cAAc,EACd,oBAAoB,GAIpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,UAAU,EAA2B,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAsB,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAA4B,MAAM,oCAAoC,CAAC;AACzG,OAAO,EACN,6BAA6B,GAE7B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAuB,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EACN,yBAAyB,EACzB,sBAAsB,GAGtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAA0B,MAAM,kCAAkC,CAAC;AACnG,OAAO,EACN,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,GAEhB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,SAAS,EACT,YAAY,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,qBAAqB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,gBAAgB;AAChB,OAAO,EAAE,oBAAoB,EAAuB,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAA2B,MAAM,mCAAmC,CAAC;AACtG,OAAO,EACN,+BAA+B,GAE/B,MAAM,2CAA2C,CAAC;AAEnD,cAAc;AACd,OAAO,EAAE,sBAAsB,EAAyB,MAAM,iCAAiC,CAAC;AAChG,OAAO,EACN,8BAA8B,GAE9B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAA0B,MAAM,kCAAkC,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAoB,MAAM,2BAA2B,CAAC;AAEhF,wBAAwB;AACxB,OAAO,EACN,8BAA8B,EAC9B,+BAA+B,GAG/B,MAAM,0CAA0C,CAAC;AAElD,kBAAkB;AAClB,OAAO,EACN,2BAA2B,GAE3B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACN,sCAAsC,EACtC,yCAAyC,GAEzC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACN,2CAA2C,GAE3C,MAAM,oDAAoD,CAAC;AAE5D,8BAA8B;AAC9B,OAAO,EACN,uBAAuB,EACvB,oCAAoC,EACpC,uCAAuC,GAGvC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACN,yCAAyC,GAEzC,MAAM,kDAAkD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,gCAAgC,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAEpC,UAAU;AACV,OAAO,EACN,gCAAgC,GAEhC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACN,sCAAsC,EACtC,4BAA4B,EAC5B,0BAA0B,GAI1B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,GAE3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,YAAY,EACZ,SAAS,EACT,cAAc,EACd,oBAAoB,GAIpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,UAAU,EAA2B,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAsB,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAA4B,MAAM,oCAAoC,CAAC;AACzG,OAAO,EACN,6BAA6B,GAE7B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAuB,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EACN,yBAAyB,EACzB,sBAAsB,GAGtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAA0B,MAAM,kCAAkC,CAAC;AACnG,OAAO,EACN,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,GAEhB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,SAAS,EACT,YAAY,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,qBAAqB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,gBAAgB;AAChB,OAAO,EAAE,oBAAoB,EAAuB,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAA2B,MAAM,mCAAmC,CAAC;AACtG,OAAO,EACN,+BAA+B,GAE/B,MAAM,2CAA2C,CAAC;AAEnD,cAAc;AACd,OAAO,EAAE,sBAAsB,EAAyB,MAAM,iCAAiC,CAAC;AAChG,OAAO,EACN,8BAA8B,GAE9B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAA0B,MAAM,kCAAkC,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAoB,MAAM,2BAA2B,CAAC;AAEhF,wBAAwB;AACxB,OAAO,EACN,8BAA8B,EAC9B,+BAA+B,GAG/B,MAAM,0CAA0C,CAAC;AAElD,kBAAkB;AAClB,OAAO,EACN,2BAA2B,GAE3B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACN,sCAAsC,EACtC,yCAAyC,GAEzC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACN,2CAA2C,GAE3C,MAAM,oDAAoD,CAAC;AAE5D,8BAA8B;AAC9B,OAAO,EACN,uBAAuB,EACvB,oCAAoC,EACpC,uCAAuC,GAGvC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACN,yCAAyC,GAEzC,MAAM,kDAAkD,CAAC"}

package/dist/schemas/atcute-public-client-metadata.d.ts

@@ -0,0 +1,55 @@
+import * as v from '@badrap/valita';
+/**
+ * user-facing client metadata for configuring a loopback public OAuth client.
+ *
+ * loopback clients are for localhost development and CLI tools. they use
+ * `http://localhost` as the client_id origin, which is built automatically
+ * from the redirect_uris and scope.
+ */
+export declare const loopbackClientMetadataSchema: v.Type<{
+    client_id?: undefined;
+    redirect_uris: string[];
+    scope: string | string[];
+}>;
+export type LoopbackClientMetadata = v.Infer<typeof loopbackClientMetadataSchema>;
+/**
+ * user-facing client metadata for configuring a discoverable public OAuth client.
+ *
+ * discoverable public clients have an HTTPS client_id URL where metadata is hosted,
+ * but don't use a keyset (token_endpoint_auth_method: 'none').
+ */
+export declare const discoverablePublicClientMetadataSchema: v.Type<{
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    application_type?: "native" | "web" | undefined;
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+}>;
+export type DiscoverablePublicClientMetadata = v.Infer<typeof discoverablePublicClientMetadataSchema>;
+/**
+ * user-facing client metadata for configuring a public OAuth client.
+ *
+ * - if `client_id` is omitted: loopback client (for localhost dev / CLI tools)
+ * - if `client_id` is provided: discoverable public client (HTTPS URL)
+ */
+export declare const publicClientMetadataSchema: v.UnionType<[v.Type<{
+    client_id?: undefined;
+    redirect_uris: string[];
+    scope: string | string[];
+}>, v.Type<{
+    client_id: string;
+    redirect_uris: string[];
+    scope: string | string[];
+    application_type?: "native" | "web" | undefined;
+    client_uri?: string | undefined;
+    client_name?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+}>]>;
+export type PublicClientMetadata = v.Infer<typeof publicClientMetadataSchema>;
+//# sourceMappingURL=atcute-public-client-metadata.d.ts.map

package/dist/schemas/atcute-public-client-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atcute-public-client-metadata.d.ts","sourceRoot":"","sources":["../../lib/schemas/atcute-public-client-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAgEpC;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;;EAuCtC,CAAC;AAEJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,sCAAsC;;;;;;;;;;EA6DhD,CAAC;AAEJ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;IAGtC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/schemas/atcute-public-client-metadata.js

@@ -0,0 +1,159 @@
+import * as v from '@badrap/valita';
+import { atprotoOAuthScopeSchema } from './atproto-oauth-scope.js';
+import { oauthClientIdDiscoverableSchema } from './oauth-client-id-discoverable.js';
+import { loopbackRedirectUriSchema, oauthRedirectUriSchema } from './oauth-redirect-uri.js';
+import { nonLocalWebUriSchema, privateUseUriSchema, webUriSchema } from './uri.js';
+import { isLoopbackHost } from './utils.js';
+const SINGLE_SCOPE_RE = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
+const singleScopeSchema = v.string().assert((input) => SINGLE_SCOPE_RE.test(input), `invalid OAuth scope`);
+const scopeSchema = v.union(atprotoOAuthScopeSchema.chain((input) => {
+    const scopes = input.split(/\s+/);
+    for (let i = 0, len = scopes.length; i < len; i++) {
+        const aka = scopes[i];
+        for (let j = 0; j < i; j++) {
+            if (aka === scopes[j]) {
+                return v.err(`duplicate "${aka}" scope`);
+            }
+        }
+    }
+    return v.ok(input);
+}), v.array(singleScopeSchema).chain((input) => {
+    if (!input.includes('atproto')) {
+        input = ['atproto', ...input];
+    }
+    for (let i = 0, len = input.length; i < len; i++) {
+        const aka = input[i];
+        for (let j = 0; j < i; j++) {
+            if (aka === input[j]) {
+                return v.err(`duplicate "${aka}" scope`);
+            }
+        }
+    }
+    return v.ok(input);
+}));
+const redirectUrisSchema = v
+    .array(oauthRedirectUriSchema)
+    .assert((arr) => arr.length > 0, `must have at least one redirect URI`)
+    .assert((arr) => {
+    for (const uri of arr) {
+        // private-use URIs don't have URL-style credentials
+        if (!uri.includes('://')) {
+            continue;
+        }
+        const url = new URL(uri);
+        if (url.username || url.password) {
+            return false;
+        }
+    }
+    return true;
+}, `redirect URIs must not contain credentials`);
+/**
+ * user-facing client metadata for configuring a loopback public OAuth client.
+ *
+ * loopback clients are for localhost development and CLI tools. they use
+ * `http://localhost` as the client_id origin, which is built automatically
+ * from the redirect_uris and scope.
+ */
+export const loopbackClientMetadataSchema = v
+    .object({
+    /** must not be provided for loopback clients */
+    client_id: v.undefined().optional(),
+    /**
+     * redirect URIs for authorization responses.
+     *
+     * must be loopback IP addresses (127.0.0.1 or [::1]).
+     * per RFC 8252, port numbers are ignored during redirect URI matching,
+     * allowing ephemeral ports.
+     */
+    redirect_uris: redirectUrisSchema,
+    /** OAuth scope (must include "atproto") */
+    scope: scopeSchema,
+})
+    .chain((input) => {
+    // validate all redirect URIs are loopback
+    for (let i = 0; i < input.redirect_uris.length; i++) {
+        const uri = input.redirect_uris[i];
+        const result = loopbackRedirectUriSchema.try(uri, { mode: 'strict' });
+        if (!result.ok) {
+            return v.err({
+                message: `loopback clients require loopback redirect URIs (127.0.0.1 or [::1]): ${result.message}`,
+                path: ['redirect_uris', i],
+            });
+        }
+        const url = new URL(uri);
+        if (!isLoopbackHost(url.hostname) || url.hostname === 'localhost') {
+            return v.err({
+                message: `loopback redirect URIs must use 127.0.0.1 or [::1], not ${url.hostname}`,
+                path: ['redirect_uris', i],
+            });
+        }
+    }
+    return v.ok(input);
+});
+/**
+ * user-facing client metadata for configuring a discoverable public OAuth client.
+ *
+ * discoverable public clients have an HTTPS client_id URL where metadata is hosted,
+ * but don't use a keyset (token_endpoint_auth_method: 'none').
+ */
+export const discoverablePublicClientMetadataSchema = v
+    .object({
+    /** discoverable HTTPS client_id URL */
+    client_id: oauthClientIdDiscoverableSchema,
+    /** redirect URIs for authorization responses */
+    redirect_uris: redirectUrisSchema,
+    /** OAuth scope (must include "atproto") */
+    scope: scopeSchema,
+    /**
+     * application type - defaults to 'web'.
+     */
+    application_type: v.union(v.literal('web'), v.literal('native')).optional(),
+    /** optional client homepage */
+    client_uri: webUriSchema.optional(),
+    /** optional display name */
+    client_name: v.string().optional(),
+    /** optional policy url */
+    policy_uri: nonLocalWebUriSchema.optional(),
+    /** optional terms of service url */
+    tos_uri: nonLocalWebUriSchema.optional(),
+    /** optional logo url */
+    logo_uri: nonLocalWebUriSchema.optional(),
+})
+    .chain((input) => {
+    // validate redirect URIs are HTTPS, loopback, or private-use
+    for (let i = 0; i < input.redirect_uris.length; i++) {
+        const uri = input.redirect_uris[i];
+        // private-use URIs are allowed
+        if (!uri.includes('://')) {
+            const result = privateUseUriSchema.try(uri, { mode: 'strict' });
+            if (!result.ok) {
+                return v.err({
+                    message: `invalid redirect URI: ${result.message}`,
+                    path: ['redirect_uris', i],
+                });
+            }
+            continue;
+        }
+        const url = new URL(uri);
+        // loopback http URIs are allowed for native apps
+        if (url.protocol === 'http:' && isLoopbackHost(url.hostname)) {
+            continue;
+        }
+        // otherwise must be https
+        if (url.protocol !== 'https:') {
+            return v.err({
+                message: `redirect URI must use https:, http: loopback, or private-use scheme`,
+                path: ['redirect_uris', i],
+            });
+        }
+    }
+    return v.ok(input);
+});
+/**
+ * user-facing client metadata for configuring a public OAuth client.
+ *
+ * - if `client_id` is omitted: loopback client (for localhost dev / CLI tools)
+ * - if `client_id` is provided: discoverable public client (HTTPS URL)
+ */
+export const publicClientMetadataSchema = v.union(loopbackClientMetadataSchema, discoverablePublicClientMetadataSchema);
+//# sourceMappingURL=atcute-public-client-metadata.js.map

package/dist/schemas/atcute-public-client-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atcute-public-client-metadata.js","sourceRoot":"","sources":["../../lib/schemas/atcute-public-client-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAEpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAEtD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAE3G,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAC1B,uBAAuB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAEtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,IAAI,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;YAC1C,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AAAA,CACnB,CAAC,EACF,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,KAAK,GAAG,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;YAC1C,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AAAA,CACnB,CAAC,CACF,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC;KAC1B,KAAK,CAAC,sBAAsB,CAAC;KAC7B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,qCAAqC,CAAC;KACtE,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,oDAAoD;QACpD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,SAAS;QACV,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ,EAAE,4CAA4C,CAAC,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACP,gDAAgD;IAChD,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE;IAEnC;;;;;;OAMG;IACH,aAAa,EAAE,kBAAkB;IAEjC,2CAA2C;IAC3C,KAAK,EAAE,WAAW;CAClB,CAAC;KACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACjB,0CAA0C;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC,GAAG,CAAC;gBACZ,OAAO,EAAE,yEAAyE,MAAM,CAAC,OAAO,EAAE;gBAClG,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;aAC1B,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACnE,OAAO,CAAC,CAAC,GAAG,CAAC;gBACZ,OAAO,EAAE,2DAA2D,GAAG,CAAC,QAAQ,EAAE;gBAClF,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;aAC1B,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AAAA,CACnB,CAAC,CAAC;AAIJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACrD,MAAM,CAAC;IACP,uCAAuC;IACvC,SAAS,EAAE,+BAA+B;IAE1C,gDAAgD;IAChD,aAAa,EAAE,kBAAkB;IAEjC,2CAA2C;IAC3C,KAAK,EAAE,WAAW;IAElB;;OAEG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE3E,+BAA+B;IAC/B,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE;IACnC,4BAA4B;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,0BAA0B;IAC1B,UAAU,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC3C,oCAAoC;IACpC,OAAO,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACxC,wBAAwB;IACxB,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACjB,6DAA6D;IAC7D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAEnC,+BAA+B;QAC/B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,CAAC,CAAC,GAAG,CAAC;oBACZ,OAAO,EAAE,yBAAyB,MAAM,CAAC,OAAO,EAAE;oBAClD,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;iBAC1B,CAAC,CAAC;YACJ,CAAC;YACD,SAAS;QACV,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAEzB,iDAAiD;QACjD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9D,SAAS;QACV,CAAC;QAED,0BAA0B;QAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,GAAG,CAAC;gBACZ,OAAO,EAAE,qEAAqE;gBAC9E,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;aAC1B,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AAAA,CACnB,CAAC,CAAC;AAIJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAChD,4BAA4B,EAC5B,sCAAsC,CACtC,CAAC"}

package/lib/build-client-metadata.ts

@@ -5,11 +5,15 @@ import {
 	confidentialClientMetadataSchema,
 	type ConfidentialClientMetadata,
 } from './schemas/atcute-confidential-client-metadata.js';
+import {
+	publicClientMetadataSchema,
+	type PublicClientMetadata,
+} from './schemas/atcute-public-client-metadata.js';
+import { DEFAULT_ATPROTO_OAUTH_SCOPE } from './schemas/atproto-oauth-scope.js';
 import type { OAuthClientMetadata } from './schemas/oauth-client-metadata.js';
 
 /**
- * builds an atproto client metadata
- *
+ * builds an atproto client metadata for a confidential client.
  *
  * @param input client metadata
  * @param keyset available keys
@@ -70,3 +74,83 @@ export const buildClientMetadata = (
 
 	return metadata;
 };
+
+/**
+ * builds a loopback client_id from redirect_uris and scope.
+ *
+ * @param redirectUris loopback redirect URIs
+ * @param scope OAuth scope string
+ * @returns loopback client_id URL
+ */
+const buildLoopbackClientId = (redirectUris: readonly string[], scope: string): string => {
+	const params = new URLSearchParams();
+
+	// only include scope if not the default
+	if (scope !== DEFAULT_ATPROTO_OAUTH_SCOPE) {
+		params.set('scope', scope);
+	}
+
+	// include redirect URIs
+	for (const uri of redirectUris) {
+		params.append('redirect_uri', uri);
+	}
+
+	if (params.size > 0) {
+		return `http://localhost?${params.toString()}`;
+	}
+
+	return 'http://localhost';
+};
+
+/**
+ * builds an atproto client metadata for a public client.
+ *
+ * public clients use `token_endpoint_auth_method: 'none'` and don't require a keyset.
+ * per AT Protocol spec, they have shorter token lifetimes and cannot use silent sign-in.
+ *
+ * - if `client_id` is omitted: loopback client (client_id built from redirect_uris/scope)
+ * - if `client_id` is provided: discoverable public client
+ *
+ * @param input public client metadata
+ * @returns built client metadata
+ */
+export const buildPublicClientMetadata = (input: PublicClientMetadata): OAuthClientMetadata => {
+	const parsed = publicClientMetadataSchema.parse(input, { mode: 'passthrough' });
+	const scope = Array.isArray(parsed.scope) ? parsed.scope.join(' ') : parsed.scope;
+
+	if (parsed.client_id === undefined) {
+		// loopback client - server generates metadata from client_id URL
+		return {
+			client_id: buildLoopbackClientId(parsed.redirect_uris, scope),
+			redirect_uris: parsed.redirect_uris,
+			scope,
+
+			application_type: 'native',
+			response_types: ['code'],
+			grant_types: ['authorization_code', 'refresh_token'],
+
+			token_endpoint_auth_method: 'none',
+			dpop_bound_access_tokens: true,
+		};
+	}
+
+	// discoverable public client
+	return {
+		client_id: parsed.client_id,
+		client_name: parsed.client_name,
+		client_uri: parsed.client_uri,
+		policy_uri: parsed.policy_uri,
+		tos_uri: parsed.tos_uri,
+		logo_uri: parsed.logo_uri,
+		redirect_uris: parsed.redirect_uris,
+		scope,
+
+		application_type: parsed.application_type ?? 'web',
+		subject_type: 'public',
+		response_types: ['code'],
+		grant_types: ['authorization_code', 'refresh_token'],
+
+		token_endpoint_auth_method: 'none',
+		dpop_bound_access_tokens: true,
+	};
+};

package/lib/index.ts

@@ -1,4 +1,4 @@
-export { buildClientMetadata } from './build-client-metadata.js';
+export { buildClientMetadata, buildPublicClientMetadata } from './build-client-metadata.js';
 export { CLIENT_ASSERTION_TYPE_JWT_BEARER, FALLBACK_ALG } from './constants.js';
 
 export * as scope from './scope.js';
@@ -8,6 +8,14 @@ export {
 	confidentialClientMetadataSchema,
 	type ConfidentialClientMetadata,
 } from './schemas/atcute-confidential-client-metadata.js';
+export {
+	discoverablePublicClientMetadataSchema,
+	loopbackClientMetadataSchema,
+	publicClientMetadataSchema,
+	type DiscoverablePublicClientMetadata,
+	type LoopbackClientMetadata,
+	type PublicClientMetadata,
+} from './schemas/atcute-public-client-metadata.js';
 export {
 	atprotoOAuthScopeSchema,
 	ATPROTO_SCOPE_VALUE,

package/lib/schemas/atcute-public-client-metadata.ts

@@ -0,0 +1,197 @@
+import * as v from '@badrap/valita';
+
+import { atprotoOAuthScopeSchema } from './atproto-oauth-scope.js';
+import { oauthClientIdDiscoverableSchema } from './oauth-client-id-discoverable.js';
+import { loopbackRedirectUriSchema, oauthRedirectUriSchema } from './oauth-redirect-uri.js';
+import { nonLocalWebUriSchema, privateUseUriSchema, webUriSchema } from './uri.js';
+import { isLoopbackHost } from './utils.js';
+
+const SINGLE_SCOPE_RE = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
+
+const singleScopeSchema = v.string().assert((input) => SINGLE_SCOPE_RE.test(input), `invalid OAuth scope`);
+
+const scopeSchema = v.union(
+	atprotoOAuthScopeSchema.chain((input) => {
+		const scopes = input.split(/\s+/);
+
+		for (let i = 0, len = scopes.length; i < len; i++) {
+			const aka = scopes[i];
+
+			for (let j = 0; j < i; j++) {
+				if (aka === scopes[j]) {
+					return v.err(`duplicate "${aka}" scope`);
+				}
+			}
+		}
+
+		return v.ok(input);
+	}),
+	v.array(singleScopeSchema).chain((input) => {
+		if (!input.includes('atproto')) {
+			input = ['atproto', ...input];
+		}
+
+		for (let i = 0, len = input.length; i < len; i++) {
+			const aka = input[i];
+
+			for (let j = 0; j < i; j++) {
+				if (aka === input[j]) {
+					return v.err(`duplicate "${aka}" scope`);
+				}
+			}
+		}
+
+		return v.ok(input);
+	}),
+);
+
+const redirectUrisSchema = v
+	.array(oauthRedirectUriSchema)
+	.assert((arr) => arr.length > 0, `must have at least one redirect URI`)
+	.assert((arr) => {
+		for (const uri of arr) {
+			// private-use URIs don't have URL-style credentials
+			if (!uri.includes('://')) {
+				continue;
+			}
+			const url = new URL(uri);
+			if (url.username || url.password) {
+				return false;
+			}
+		}
+		return true;
+	}, `redirect URIs must not contain credentials`);
+
+/**
+ * user-facing client metadata for configuring a loopback public OAuth client.
+ *
+ * loopback clients are for localhost development and CLI tools. they use
+ * `http://localhost` as the client_id origin, which is built automatically
+ * from the redirect_uris and scope.
+ */
+export const loopbackClientMetadataSchema = v
+	.object({
+		/** must not be provided for loopback clients */
+		client_id: v.undefined().optional(),
+
+		/**
+		 * redirect URIs for authorization responses.
+		 *
+		 * must be loopback IP addresses (127.0.0.1 or [::1]).
+		 * per RFC 8252, port numbers are ignored during redirect URI matching,
+		 * allowing ephemeral ports.
+		 */
+		redirect_uris: redirectUrisSchema,
+
+		/** OAuth scope (must include "atproto") */
+		scope: scopeSchema,
+	})
+	.chain((input) => {
+		// validate all redirect URIs are loopback
+		for (let i = 0; i < input.redirect_uris.length; i++) {
+			const uri = input.redirect_uris[i];
+			const result = loopbackRedirectUriSchema.try(uri, { mode: 'strict' });
+			if (!result.ok) {
+				return v.err({
+					message: `loopback clients require loopback redirect URIs (127.0.0.1 or [::1]): ${result.message}`,
+					path: ['redirect_uris', i],
+				});
+			}
+
+			const url = new URL(uri);
+			if (!isLoopbackHost(url.hostname) || url.hostname === 'localhost') {
+				return v.err({
+					message: `loopback redirect URIs must use 127.0.0.1 or [::1], not ${url.hostname}`,
+					path: ['redirect_uris', i],
+				});
+			}
+		}
+
+		return v.ok(input);
+	});
+
+export type LoopbackClientMetadata = v.Infer<typeof loopbackClientMetadataSchema>;
+
+/**
+ * user-facing client metadata for configuring a discoverable public OAuth client.
+ *
+ * discoverable public clients have an HTTPS client_id URL where metadata is hosted,
+ * but don't use a keyset (token_endpoint_auth_method: 'none').
+ */
+export const discoverablePublicClientMetadataSchema = v
+	.object({
+		/** discoverable HTTPS client_id URL */
+		client_id: oauthClientIdDiscoverableSchema,
+
+		/** redirect URIs for authorization responses */
+		redirect_uris: redirectUrisSchema,
+
+		/** OAuth scope (must include "atproto") */
+		scope: scopeSchema,
+
+		/**
+		 * application type - defaults to 'web'.
+		 */
+		application_type: v.union(v.literal('web'), v.literal('native')).optional(),
+
+		/** optional client homepage */
+		client_uri: webUriSchema.optional(),
+		/** optional display name */
+		client_name: v.string().optional(),
+		/** optional policy url */
+		policy_uri: nonLocalWebUriSchema.optional(),
+		/** optional terms of service url */
+		tos_uri: nonLocalWebUriSchema.optional(),
+		/** optional logo url */
+		logo_uri: nonLocalWebUriSchema.optional(),
+	})
+	.chain((input) => {
+		// validate redirect URIs are HTTPS, loopback, or private-use
+		for (let i = 0; i < input.redirect_uris.length; i++) {
+			const uri = input.redirect_uris[i];
+
+			// private-use URIs are allowed
+			if (!uri.includes('://')) {
+				const result = privateUseUriSchema.try(uri, { mode: 'strict' });
+				if (!result.ok) {
+					return v.err({
+						message: `invalid redirect URI: ${result.message}`,
+						path: ['redirect_uris', i],
+					});
+				}
+				continue;
+			}
+
+			const url = new URL(uri);
+
+			// loopback http URIs are allowed for native apps
+			if (url.protocol === 'http:' && isLoopbackHost(url.hostname)) {
+				continue;
+			}
+
+			// otherwise must be https
+			if (url.protocol !== 'https:') {
+				return v.err({
+					message: `redirect URI must use https:, http: loopback, or private-use scheme`,
+					path: ['redirect_uris', i],
+				});
+			}
+		}
+
+		return v.ok(input);
+	});
+
+export type DiscoverablePublicClientMetadata = v.Infer<typeof discoverablePublicClientMetadataSchema>;
+
+/**
+ * user-facing client metadata for configuring a public OAuth client.
+ *
+ * - if `client_id` is omitted: loopback client (for localhost dev / CLI tools)
+ * - if `client_id` is provided: discoverable public client (HTTPS URL)
+ */
+export const publicClientMetadataSchema = v.union(
+	loopbackClientMetadataSchema,
+	discoverablePublicClientMetadataSchema,
+);
+
+export type PublicClientMetadata = v.Infer<typeof publicClientMetadataSchema>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atcute/oauth-types",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "OAuth types and schemas for AT Protocol",
   "license": "0BSD",
   "repository": {
@@ -24,8 +24,8 @@
   "dependencies": {
     "@badrap/valita": "^0.4.6",
     "@atcute/identity": "^1.1.3",
-    "@atcute/oauth-keyset": "^0.1.0",
-    "@atcute/lexicons": "^1.2.7"
+    "@atcute/lexicons": "^1.2.7",
+    "@atcute/oauth-keyset": "^0.1.0"
   },
   "devDependencies": {
     "vitest": "^4.0.16"