@atproto/lex-password-session 0.0.0

package/dist/password-session.js

@@ -0,0 +1,242 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordSession = void 0;
+const lex_client_1 = require("@atproto/lex-client");
+const error_js_1 = require("./error.js");
+const index_js_1 = require("./lexicons/index.js");
+const util_js_1 = require("./util.js");
+class PasswordSession {
+    options;
+    /**
+     * Internal {@link Agent} used for session management towards the
+     * authentication service only.
+     */
+    #serviceAgent;
+    #sessionData;
+    #sessionPromise;
+    constructor(sessionData, options) {
+        this.options = options;
+        this.#serviceAgent = (0, lex_client_1.buildAgent)({
+            service: sessionData.service,
+            fetch: options.fetch,
+        });
+        this.#sessionData = sessionData;
+        this.#sessionPromise = Promise.resolve(this.#sessionData);
+    }
+    get did() {
+        return this.session.did;
+    }
+    get handle() {
+        return this.session.handle;
+    }
+    get session() {
+        if (this.#sessionData)
+            return this.#sessionData;
+        throw new lex_client_1.LexRpcError('AuthenticationRequired', 'Logged out');
+    }
+    get destroyed() {
+        return this.#sessionData === null;
+    }
+    async fetchHandler(path, init) {
+        const headers = new Headers(init.headers);
+        if (headers.has('authorization')) {
+            throw new TypeError("Unexpected 'authorization' header set");
+        }
+        const sessionPromise = this.#sessionPromise;
+        const sessionData = await sessionPromise;
+        const fetch = this.options.fetch ?? globalThis.fetch;
+        headers.set('authorization', `Bearer ${sessionData.accessJwt}`);
+        const initialRes = await fetch(fetchUrl(sessionData, path), {
+            ...init,
+            headers,
+        });
+        const refreshNeeded = initialRes.status === 401 ||
+            (initialRes.status === 400 &&
+                (await (0, util_js_1.extractLexRpcErrorCode)(initialRes)) === 'ExpiredToken');
+        if (!refreshNeeded) {
+            return initialRes;
+        }
+        // Refresh session (unless it was already refreshed in the meantime)
+        const newSessionPromise = this.#sessionPromise === sessionPromise
+            ? this.refresh()
+            : this.#sessionPromise;
+        // Error should have been propagated through hooks
+        const newSessionData = await newSessionPromise.catch((_err) => null);
+        if (!newSessionData) {
+            return initialRes;
+        }
+        // refresh silently failed, no point in retrying.
+        if (newSessionData.accessJwt === sessionData.accessJwt) {
+            return initialRes;
+        }
+        if (init?.signal?.aborted) {
+            return initialRes;
+        }
+        // The stream was already consumed. We cannot retry the request. A solution
+        // would be to tee() the input stream but that would bufferize the entire
+        // stream in memory which can lead to memory starvation. Instead, we will
+        // return the original response and let the calling code handle retries.
+        if (ReadableStream && init?.body instanceof ReadableStream) {
+            return initialRes;
+        }
+        // Make sure the initial request is cancelled to avoid leaking resources
+        // (NodeJS 👀): https://undici.nodejs.org/#/?id=garbage-collection
+        if (!initialRes.bodyUsed) {
+            await initialRes.body?.cancel();
+        }
+        // Finally, retry the request with the new access token
+        headers.set('authorization', `Bearer ${newSessionData.accessJwt}`);
+        return fetch(fetchUrl(newSessionData, path), { ...init, headers });
+    }
+    async refresh() {
+        this.#sessionPromise = this.#sessionPromise.then(async (sessionData) => {
+            const response = await (0, lex_client_1.xrpcSafe)(this.#serviceAgent, index_js_1.com.atproto.server.refreshSession.main, { headers: { Authorization: `Bearer ${sessionData.refreshJwt}` } });
+            if (!response.success && response.matchesSchema()) {
+                // Expected errors that indicate the session is no longer valid
+                await this.options.onDeleted.call(this, sessionData);
+                // Update the session promise to a rejected state
+                this.#sessionData = null;
+                throw response;
+            }
+            if (!response.success) {
+                // We failed to refresh the token, assume the session might still be
+                // valid by returning the existing session.
+                await this.options.onUpdateFailure?.call(this, sessionData, response);
+                return sessionData;
+            }
+            const data = response.body;
+            // Historically, refreshSession did not return all the fields from
+            // getSession. In particular, emailConfirmed and didDoc were missing.
+            // Similarly, some servers might not return the didDoc in refreshSession.
+            // We fetch them via getSession if missing, allowing to ensure that we are
+            // always talking with the right PDS.
+            if (data.emailConfirmed == null || data.didDoc == null) {
+                const extraData = await (0, lex_client_1.xrpcSafe)(this.#serviceAgent, index_js_1.com.atproto.server.getSession.main, { headers: { Authorization: `Bearer ${data.accessJwt}` } });
+                if (extraData.success && extraData.body.did === data.did) {
+                    Object.assign(data, extraData.body);
+                }
+            }
+            const newSession = {
+                ...data,
+                service: sessionData.service,
+            };
+            await this.options.onUpdated.call(this, newSession);
+            return (this.#sessionData = newSession);
+        });
+        return this.#sessionPromise;
+    }
+    async logout() {
+        let reason = null;
+        this.#sessionPromise = this.#sessionPromise.then(async (sessionData) => {
+            const result = await (0, lex_client_1.xrpcSafe)(this.#serviceAgent, index_js_1.com.atproto.server.deleteSession.main, { headers: { Authorization: `Bearer ${sessionData.refreshJwt}` } });
+            if (result.success || result.matchesSchema()) {
+                await this.options.onDeleted.call(this, sessionData);
+                // Update the session promise to a rejected state
+                this.#sessionData = null;
+                throw new lex_client_1.LexRpcError('AuthenticationRequired', 'Logged out');
+            }
+            else {
+                // Capture the reason for the failure to re-throw in the outer promise
+                reason = result;
+                // An unknown/unexpected error occurred (network, server down, etc)
+                await this.options.onDeleteFailure?.call(this, sessionData, result);
+                // Keep the session in an active state
+                return sessionData;
+            }
+        });
+        return this.#sessionPromise.then((_session) => {
+            // If the promise above resolved, then logout failed. Re-throw the
+            // reason captured earlier.
+            throw reason;
+        }, (_err) => {
+            // Successful logout
+        });
+    }
+    /**
+     * @note It is **not** recommended to use {@link PasswordSession} with main
+     * account credentials. Instead, it is strongly advised to use OAuth based
+     * authentication for main username/password credentials and use
+     * {@link PasswordSession} with an app-password, for bots, scripts, or similar
+     * use-cases.
+     *
+     * @throws If unable to create a session. In particular, if the server
+     * requires a 2FA token, a {@link LexRpcResponseError} with the
+     * `AuthFactorTokenRequired` error code will be thrown.
+     *
+     *
+     * @example Handling 2FA errors
+     *
+     * ```ts
+     * try {
+     *   const session = await PasswordSession.create({
+     *     service: 'https://example.com',
+     *     identifier: 'alice',
+     *     password: 'correct horse battery staple',
+     *   })
+     * } catch (err) {
+     *   if (err instanceof LexRpcResponseError && err.error === 'AuthFactorTokenRequired') {
+     *     // Prompt user for 2FA token and re-attempt session creation
+     *   }
+     * }
+     * ```
+     */
+    static async create({ service, identifier, password, allowTakendown, authFactorToken, ...options }) {
+        const xrpcAgent = (0, lex_client_1.buildAgent)({
+            service,
+            fetch: options.fetch,
+        });
+        const response = await (0, lex_client_1.xrpcSafe)(xrpcAgent, index_js_1.com.atproto.server.createSession.main, { body: { identifier, password, allowTakendown, authFactorToken } });
+        if (!response.success) {
+            if (response.error === 'AuthFactorTokenRequired') {
+                throw new error_js_1.LexAuthFactorError(response);
+            }
+            throw response.reason;
+        }
+        const data = {
+            ...response.body,
+            service: String(service),
+        };
+        const agent = new PasswordSession(data, options);
+        await options.onUpdated.call(agent, data);
+        return agent;
+    }
+    /**
+     * Resume an existing session, ensuring it is still valid by refreshing it.
+     * Any error thrown here indicates that the session is definitely no longer
+     * valid. Network errors will be propagated through the
+     * {@link PasswordSessionOptions.onUpdateFailure} hook, and not re-thrown
+     * here. This means that a resolved promise does not necessarily indicate a
+     * valid session, only that it's refresh did not definitively fail.
+     *
+     * This is the same as calling {@link PasswordSession.refresh} after
+     * constructing the {@link PasswordSession} manually.
+     *
+     * @throws If, and only if, the session is definitely no longer valid.
+     */
+    static async resume(data, options) {
+        const agent = new PasswordSession(data, options);
+        await agent.refresh();
+        return agent;
+    }
+    /**
+     * Delete a session without having to {@link resume resume()} it first, or
+     * provide hooks.
+     *
+     * @throws In case of unexpected error (network issue, server down, etc)
+     * meaning that the session may still be valid.
+     */
+    static async delete(data, options) {
+        const agent = new PasswordSession(data, {
+            ...options,
+            onUpdated: options?.onUpdated ?? util_js_1.noop,
+            onDeleted: options?.onDeleted ?? util_js_1.noop,
+        });
+        await agent.logout();
+    }
+}
+exports.PasswordSession = PasswordSession;
+function fetchUrl(sessionData, path) {
+    const pdsUrl = (0, util_js_1.extractPdsUrl)(sessionData.didDoc);
+    return new URL(path, pdsUrl ?? sessionData.service);
+}
+//# sourceMappingURL=password-session.js.map

package/dist/password-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-session.js","sourceRoot":"","sources":["../src/password-session.ts"],"names":[],"mappings":";;;AAAA,oDAM4B;AAC5B,yCAA+C;AAC/C,kDAAyC;AACzC,uCAAuE;AA6EvE,MAAa,eAAe;IAYL;IAXrB;;;OAGG;IACH,aAAa,CAAO;IAEpB,YAAY,CAAoB;IAChC,eAAe,CAAsB;IAErC,YACE,WAAwB,EACL,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;QAElD,IAAI,CAAC,aAAa,GAAG,IAAA,uBAAU,EAAC;YAC9B,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAA;QAEF,IAAI,CAAC,YAAY,GAAG,WAAW,CAAA;QAC/B,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC3D,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAA;IACzB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;IAC5B,CAAC;IAED,IAAI,OAAO;QACT,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,CAAA;QAC/C,MAAM,IAAI,wBAAW,CAAC,wBAAwB,EAAE,YAAY,CAAC,CAAA;IAC/D,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,YAAY,KAAK,IAAI,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,IAAiB;QAChD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAA;QAC3C,MAAM,WAAW,GAAG,MAAM,cAAc,CAAA;QAExC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;QAEpD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,WAAW,CAAC,SAAS,EAAE,CAAC,CAAA;QAC/D,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE;YAC1D,GAAG,IAAI;YACP,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,aAAa,GACjB,UAAU,CAAC,MAAM,KAAK,GAAG;YACzB,CAAC,UAAU,CAAC,MAAM,KAAK,GAAG;gBACxB,CAAC,MAAM,IAAA,gCAAsB,EAAC,UAAU,CAAC,CAAC,KAAK,cAAc,CAAC,CAAA;QAElE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,oEAAoE;QACpE,MAAM,iBAAiB,GACrB,IAAI,CAAC,eAAe,KAAK,cAAc;YACrC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE;YAChB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAA;QAE1B,kDAAkD;QAClD,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;QACpE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,iDAAiD;QACjD,IAAI,cAAc,CAAC,SAAS,KAAK,WAAW,CAAC,SAAS,EAAE,CAAC;YACvD,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,IAAI,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC1B,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,cAAc,IAAI,IAAI,EAAE,IAAI,YAAY,cAAc,EAAE,CAAC;YAC3D,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,wEAAwE;QACxE,kEAAkE;QAClE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;QACjC,CAAC;QAED,uDAAuD;QACvD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,cAAc,CAAC,SAAS,EAAE,CAAC,CAAA;QAClE,OAAO,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;YACrE,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAQ,EAC7B,IAAI,CAAC,aAAa,EAClB,cAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EACtC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,CAAC,UAAU,EAAE,EAAE,EAAE,CACnE,CAAA;YAED,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;gBAClD,+DAA+D;gBAC/D,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;gBAEpD,iDAAiD;gBACjD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;gBACxB,MAAM,QAAQ,CAAA;YAChB,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,oEAAoE;gBACpE,2CAA2C;gBAC3C,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;gBAErE,OAAO,WAAW,CAAA;YACpB,CAAC;YAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;YAE1B,kEAAkE;YAClE,qEAAqE;YACrE,yEAAyE;YACzE,0EAA0E;YAC1E,qCAAqC;YACrC,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBACvD,MAAM,SAAS,GAAG,MAAM,IAAA,qBAAQ,EAC9B,IAAI,CAAC,aAAa,EAClB,cAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAClC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,CAC3D,CAAA;gBACD,IAAI,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;oBACzD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;gBACrC,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAgB;gBAC9B,GAAG,IAAI;gBACP,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAA;YAED,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;YAEnD,OAAO,CAAC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,CAAA;QACzC,CAAC,CAAC,CAAA;QAEF,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,MAAM,GAAyB,IAAI,CAAA;QAEvC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;YACrE,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAQ,EAC3B,IAAI,CAAC,aAAa,EAClB,cAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EACrC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,CAAC,UAAU,EAAE,EAAE,EAAE,CACnE,CAAA;YAED,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;gBAEpD,iDAAiD;gBACjD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;gBACxB,MAAM,IAAI,wBAAW,CAAC,wBAAwB,EAAE,YAAY,CAAC,CAAA;YAC/D,CAAC;iBAAM,CAAC;gBACN,sEAAsE;gBACtE,MAAM,GAAG,MAAM,CAAA;gBAEf,mEAAmE;gBACnE,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;gBAEnE,sCAAsC;gBACtC,OAAO,WAAW,CAAA;YACpB,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAC9B,CAAC,QAAQ,EAAE,EAAE;YACX,kEAAkE;YAClE,2BAA2B;YAC3B,MAAM,MAAO,CAAA;QACf,CAAC,EACD,CAAC,IAAI,EAAE,EAAE;YACP,oBAAoB;QACtB,CAAC,CACF,CAAA;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAClB,OAAO,EACP,UAAU,EACV,QAAQ,EACR,cAAc,EACd,eAAe,EACf,GAAG,OAAO,EAOX;QACC,MAAM,SAAS,GAAG,IAAA,uBAAU,EAAC;YAC3B,OAAO;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAQ,EAC7B,SAAS,EACT,cAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EACrC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe,EAAE,EAAE,CACpE,CAAA;QAED,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,QAAQ,CAAC,KAAK,KAAK,yBAAyB,EAAE,CAAC;gBACjD,MAAM,IAAI,6BAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,QAAQ,CAAC,MAAM,CAAA;QACvB,CAAC;QAED,MAAM,IAAI,GAAgB;YACxB,GAAG,QAAQ,CAAC,IAAI;YAChB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;SACzB,CAAA;QAED,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAChD,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACzC,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,IAAiB,EACjB,OAA+B;QAE/B,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAChD,MAAM,KAAK,CAAC,OAAO,EAAE,CAAA;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,IAAiB,EACjB,OAAyC;QAEzC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,IAAI,EAAE;YACtC,GAAG,OAAO;YACV,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,cAAI;YACrC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,cAAI;SACtC,CAAC,CAAA;QACF,MAAM,KAAK,CAAC,MAAM,EAAE,CAAA;IACtB,CAAC;CACF;AAxTD,0CAwTC;AAED,SAAS,QAAQ,CAAC,WAAwB,EAAE,IAAY;IACtD,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,WAAW,CAAC,MAAM,CAAC,CAAA;IAChD,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,CAAA;AACrD,CAAC","sourcesContent":["import {\n  Agent,\n  LexRpcError,\n  LexRpcFailure,\n  buildAgent,\n  xrpcSafe,\n} from '@atproto/lex-client'\nimport { LexAuthFactorError } from './error.js'\nimport { com } from './lexicons/index.js'\nimport { extractLexRpcErrorCode, extractPdsUrl, noop } from './util.js'\n\nexport type RefreshFailure = LexRpcFailure<\n  typeof com.atproto.server.refreshSession.main\n>\n\nexport type DeleteFailure = LexRpcFailure<\n  typeof com.atproto.server.deleteSession.main\n>\n\nexport type SessionData = com.atproto.server.createSession.OutputBody & {\n  service: string\n}\n\nexport type PasswordSessionOptions = {\n  /**\n   * Custom fetch implementation to use for network requests\n   */\n  fetch?: typeof globalThis.fetch\n\n  /**\n   * Called whenever the session is successfully created/refreshed, and new\n   * credentials have been obtained. Use this hook to persist the updated\n   * session information.\n   *\n   * If this callback returns a promise, this function will never be called\n   * again (on the same process) until the promise resolves.\n   *\n   * @note this function **must** not throw\n   */\n  onUpdated: (this: PasswordSession, data: SessionData) => void | Promise<void>\n\n  /**\n   * Called whenever the session update fails due to an expected error, such as\n   * a network issue or server unavailability. This function can be used to log\n   * the error or notify the user, but should not assume that the session is\n   * invalid.\n   *\n   * @note this function **must** not throw\n   */\n  onUpdateFailure?: (\n    this: PasswordSession,\n    data: SessionData,\n    err: RefreshFailure,\n  ) => void | Promise<void>\n\n  /**\n   * Called whenever the session is deleted, either due to an explicit logout or\n   * because the refresh operation indicated that the session is no longer\n   * valid. Use this hook to clean up any persisted session information and\n   * update the application state accordingly.\n   *\n   * @note this function **must** not throw\n   */\n  onDeleted: (this: PasswordSession, data: SessionData) => void | Promise<void>\n\n  /**\n   * Called whenever a session deletion fails due to an unexpected error, such\n   * as a network issue or server unavailability. This function can be used to\n   * log the error or notify the user. When this function is called, the session\n   * might still be valid on the server. It is up to the implementation to\n   * decide whether to retry the deletion or keep the session active. Ignoring\n   * these errors is not recommended as it can lead to orphaned sessions on the\n   * server, or security issues if the user believes they have logged out when a\n   * bad actor is still using the session. The implementation should consider\n   * keeping track of failed deletions and retrying them later, until they\n   * succeed.\n   *\n   * @note this function **must** not throw\n   */\n  onDeleteFailure?: (\n    this: PasswordSession,\n    data: SessionData,\n    err: DeleteFailure,\n  ) => void | Promise<void>\n}\n\nexport class PasswordSession implements Agent {\n  /**\n   * Internal {@link Agent} used for session management towards the\n   * authentication service only.\n   */\n  #serviceAgent: Agent\n\n  #sessionData: null | SessionData\n  #sessionPromise: Promise<SessionData>\n\n  constructor(\n    sessionData: SessionData,\n    protected readonly options: PasswordSessionOptions,\n  ) {\n    this.#serviceAgent = buildAgent({\n      service: sessionData.service,\n      fetch: options.fetch,\n    })\n\n    this.#sessionData = sessionData\n    this.#sessionPromise = Promise.resolve(this.#sessionData)\n  }\n\n  get did() {\n    return this.session.did\n  }\n\n  get handle() {\n    return this.session.handle\n  }\n\n  get session() {\n    if (this.#sessionData) return this.#sessionData\n    throw new LexRpcError('AuthenticationRequired', 'Logged out')\n  }\n\n  get destroyed(): boolean {\n    return this.#sessionData === null\n  }\n\n  async fetchHandler(path: string, init: RequestInit): Promise<Response> {\n    const headers = new Headers(init.headers)\n    if (headers.has('authorization')) {\n      throw new TypeError(\"Unexpected 'authorization' header set\")\n    }\n\n    const sessionPromise = this.#sessionPromise\n    const sessionData = await sessionPromise\n\n    const fetch = this.options.fetch ?? globalThis.fetch\n\n    headers.set('authorization', `Bearer ${sessionData.accessJwt}`)\n    const initialRes = await fetch(fetchUrl(sessionData, path), {\n      ...init,\n      headers,\n    })\n\n    const refreshNeeded =\n      initialRes.status === 401 ||\n      (initialRes.status === 400 &&\n        (await extractLexRpcErrorCode(initialRes)) === 'ExpiredToken')\n\n    if (!refreshNeeded) {\n      return initialRes\n    }\n\n    // Refresh session (unless it was already refreshed in the meantime)\n    const newSessionPromise =\n      this.#sessionPromise === sessionPromise\n        ? this.refresh()\n        : this.#sessionPromise\n\n    // Error should have been propagated through hooks\n    const newSessionData = await newSessionPromise.catch((_err) => null)\n    if (!newSessionData) {\n      return initialRes\n    }\n\n    // refresh silently failed, no point in retrying.\n    if (newSessionData.accessJwt === sessionData.accessJwt) {\n      return initialRes\n    }\n\n    if (init?.signal?.aborted) {\n      return initialRes\n    }\n\n    // The stream was already consumed. We cannot retry the request. A solution\n    // would be to tee() the input stream but that would bufferize the entire\n    // stream in memory which can lead to memory starvation. Instead, we will\n    // return the original response and let the calling code handle retries.\n    if (ReadableStream && init?.body instanceof ReadableStream) {\n      return initialRes\n    }\n\n    // Make sure the initial request is cancelled to avoid leaking resources\n    // (NodeJS 👀): https://undici.nodejs.org/#/?id=garbage-collection\n    if (!initialRes.bodyUsed) {\n      await initialRes.body?.cancel()\n    }\n\n    // Finally, retry the request with the new access token\n    headers.set('authorization', `Bearer ${newSessionData.accessJwt}`)\n    return fetch(fetchUrl(newSessionData, path), { ...init, headers })\n  }\n\n  async refresh(): Promise<SessionData> {\n    this.#sessionPromise = this.#sessionPromise.then(async (sessionData) => {\n      const response = await xrpcSafe(\n        this.#serviceAgent,\n        com.atproto.server.refreshSession.main,\n        { headers: { Authorization: `Bearer ${sessionData.refreshJwt}` } },\n      )\n\n      if (!response.success && response.matchesSchema()) {\n        // Expected errors that indicate the session is no longer valid\n        await this.options.onDeleted.call(this, sessionData)\n\n        // Update the session promise to a rejected state\n        this.#sessionData = null\n        throw response\n      }\n\n      if (!response.success) {\n        // We failed to refresh the token, assume the session might still be\n        // valid by returning the existing session.\n        await this.options.onUpdateFailure?.call(this, sessionData, response)\n\n        return sessionData\n      }\n\n      const data = response.body\n\n      // Historically, refreshSession did not return all the fields from\n      // getSession. In particular, emailConfirmed and didDoc were missing.\n      // Similarly, some servers might not return the didDoc in refreshSession.\n      // We fetch them via getSession if missing, allowing to ensure that we are\n      // always talking with the right PDS.\n      if (data.emailConfirmed == null || data.didDoc == null) {\n        const extraData = await xrpcSafe(\n          this.#serviceAgent,\n          com.atproto.server.getSession.main,\n          { headers: { Authorization: `Bearer ${data.accessJwt}` } },\n        )\n        if (extraData.success && extraData.body.did === data.did) {\n          Object.assign(data, extraData.body)\n        }\n      }\n\n      const newSession: SessionData = {\n        ...data,\n        service: sessionData.service,\n      }\n\n      await this.options.onUpdated.call(this, newSession)\n\n      return (this.#sessionData = newSession)\n    })\n\n    return this.#sessionPromise\n  }\n\n  async logout(): Promise<void> {\n    let reason: DeleteFailure | null = null\n\n    this.#sessionPromise = this.#sessionPromise.then(async (sessionData) => {\n      const result = await xrpcSafe(\n        this.#serviceAgent,\n        com.atproto.server.deleteSession.main,\n        { headers: { Authorization: `Bearer ${sessionData.refreshJwt}` } },\n      )\n\n      if (result.success || result.matchesSchema()) {\n        await this.options.onDeleted.call(this, sessionData)\n\n        // Update the session promise to a rejected state\n        this.#sessionData = null\n        throw new LexRpcError('AuthenticationRequired', 'Logged out')\n      } else {\n        // Capture the reason for the failure to re-throw in the outer promise\n        reason = result\n\n        // An unknown/unexpected error occurred (network, server down, etc)\n        await this.options.onDeleteFailure?.call(this, sessionData, result)\n\n        // Keep the session in an active state\n        return sessionData\n      }\n    })\n\n    return this.#sessionPromise.then(\n      (_session) => {\n        // If the promise above resolved, then logout failed. Re-throw the\n        // reason captured earlier.\n        throw reason!\n      },\n      (_err) => {\n        // Successful logout\n      },\n    )\n  }\n\n  /**\n   * @note It is **not** recommended to use {@link PasswordSession} with main\n   * account credentials. Instead, it is strongly advised to use OAuth based\n   * authentication for main username/password credentials and use\n   * {@link PasswordSession} with an app-password, for bots, scripts, or similar\n   * use-cases.\n   *\n   * @throws If unable to create a session. In particular, if the server\n   * requires a 2FA token, a {@link LexRpcResponseError} with the\n   * `AuthFactorTokenRequired` error code will be thrown.\n   *\n   *\n   * @example Handling 2FA errors\n   *\n   * ```ts\n   * try {\n   *   const session = await PasswordSession.create({\n   *     service: 'https://example.com',\n   *     identifier: 'alice',\n   *     password: 'correct horse battery staple',\n   *   })\n   * } catch (err) {\n   *   if (err instanceof LexRpcResponseError && err.error === 'AuthFactorTokenRequired') {\n   *     // Prompt user for 2FA token and re-attempt session creation\n   *   }\n   * }\n   * ```\n   */\n  static async create({\n    service,\n    identifier,\n    password,\n    allowTakendown,\n    authFactorToken,\n    ...options\n  }: PasswordSessionOptions & {\n    service: string | URL\n    identifier: string\n    password: string\n    allowTakendown?: boolean\n    authFactorToken?: string\n  }): Promise<PasswordSession> {\n    const xrpcAgent = buildAgent({\n      service,\n      fetch: options.fetch,\n    })\n\n    const response = await xrpcSafe(\n      xrpcAgent,\n      com.atproto.server.createSession.main,\n      { body: { identifier, password, allowTakendown, authFactorToken } },\n    )\n\n    if (!response.success) {\n      if (response.error === 'AuthFactorTokenRequired') {\n        throw new LexAuthFactorError(response)\n      }\n      throw response.reason\n    }\n\n    const data: SessionData = {\n      ...response.body,\n      service: String(service),\n    }\n\n    const agent = new PasswordSession(data, options)\n    await options.onUpdated.call(agent, data)\n    return agent\n  }\n\n  /**\n   * Resume an existing session, ensuring it is still valid by refreshing it.\n   * Any error thrown here indicates that the session is definitely no longer\n   * valid. Network errors will be propagated through the\n   * {@link PasswordSessionOptions.onUpdateFailure} hook, and not re-thrown\n   * here. This means that a resolved promise does not necessarily indicate a\n   * valid session, only that it's refresh did not definitively fail.\n   *\n   * This is the same as calling {@link PasswordSession.refresh} after\n   * constructing the {@link PasswordSession} manually.\n   *\n   * @throws If, and only if, the session is definitely no longer valid.\n   */\n  static async resume(\n    data: SessionData,\n    options: PasswordSessionOptions,\n  ): Promise<PasswordSession> {\n    const agent = new PasswordSession(data, options)\n    await agent.refresh()\n    return agent\n  }\n\n  /**\n   * Delete a session without having to {@link resume resume()} it first, or\n   * provide hooks.\n   *\n   * @throws In case of unexpected error (network issue, server down, etc)\n   * meaning that the session may still be valid.\n   */\n  static async delete(\n    data: SessionData,\n    options?: Partial<PasswordSessionOptions>,\n  ): Promise<void> {\n    const agent = new PasswordSession(data, {\n      ...options,\n      onUpdated: options?.onUpdated ?? noop,\n      onDeleted: options?.onDeleted ?? noop,\n    })\n    await agent.logout()\n  }\n}\n\nfunction fetchUrl(sessionData: SessionData, path: string): URL {\n  const pdsUrl = extractPdsUrl(sessionData.didDoc)\n  return new URL(path, pdsUrl ?? sessionData.service)\n}\n"]}

package/dist/util.d.ts

@@ -0,0 +1,5 @@
+import { LexMap } from '@atproto/lex-client';
+export declare const noop: () => void;
+export declare function extractLexRpcErrorCode(response: Response): Promise<string | null>;
+export declare function extractPdsUrl(didDoc?: LexMap): string | null;
+//# sourceMappingURL=util.d.ts.map

package/dist/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAY,MAAM,qBAAqB,CAAA;AAGtD,eAAO,MAAM,IAAI,YAAW,CAAA;AAE5B,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKxB;AA4BD,wBAAgB,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM5D"}

package/dist/util.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noop = void 0;
+exports.extractLexRpcErrorCode = extractLexRpcErrorCode;
+exports.extractPdsUrl = extractPdsUrl;
+const lex_schema_1 = require("@atproto/lex-schema");
+const noop = () => { };
+exports.noop = noop;
+async function extractLexRpcErrorCode(response) {
+    const json = await peekJson(response, 10 * 1024); // Avoid reading large bodies
+    if (json === undefined)
+        return null;
+    if (!lex_schema_1.l.lexErrorData.matches(json))
+        return null;
+    return json.error;
+}
+async function peekJson(response, maxSize = Infinity) {
+    const type = extractType(response);
+    if (type !== 'application/json')
+        return undefined;
+    const length = extractLength(response);
+    if (length != null && length > maxSize)
+        return undefined;
+    try {
+        return (await response.clone().json());
+    }
+    catch {
+        return undefined;
+    }
+}
+function extractLength({ headers }) {
+    return headers.get('Content-Length')
+        ? Number(headers.get('Content-Length'))
+        : undefined;
+}
+function extractType({ headers }) {
+    return headers.get('Content-Type')?.split(';')[0]?.trim().toLowerCase();
+}
+function extractPdsUrl(didDoc) {
+    const pdsService = ifArray(didDoc?.service)?.find((service) => ifString(service?.id)?.endsWith('#atproto_pds'));
+    const pdsEndpoint = ifString(pdsService?.serviceEndpoint);
+    return pdsEndpoint && URL.canParse(pdsEndpoint) ? pdsEndpoint : null;
+}
+const ifString = (v) => (typeof v === 'string' ? v : undefined);
+const ifArray = (v) => (Array.isArray(v) ? v : undefined);
+//# sourceMappingURL=util.js.map

package/dist/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";;;AAKA,wDAOC;AA4BD,sCAMC;AA7CD,oDAAuC;AAEhC,MAAM,IAAI,GAAG,GAAG,EAAE,GAAE,CAAC,CAAA;AAAf,QAAA,IAAI,QAAW;AAErB,KAAK,UAAU,sBAAsB,CAC1C,QAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,CAAA,CAAC,6BAA6B;IAC9E,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,CAAC,cAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9C,OAAO,IAAI,CAAC,KAAK,CAAA;AACnB,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,QAAkB,EAClB,OAAO,GAAG,QAAQ;IAElB,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAA;IACjD,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACtC,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,GAAG,OAAO;QAAE,OAAO,SAAS,CAAA;IAExD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAsB,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,EAAE,OAAO,EAAY;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAClC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACvC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,WAAW,CAAC,EAAE,OAAO,EAAY;IACxC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;AACzE,CAAC;AAED,SAAgB,aAAa,CAAC,MAAe;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5D,QAAQ,CAAE,OAAe,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC,CACzD,CAAA;IACD,MAAM,WAAW,GAAG,QAAQ,CAAE,UAAkB,EAAE,eAAe,CAAC,CAAA;IAClE,OAAO,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAA;AACtE,CAAC;AAED,MAAM,QAAQ,GAAG,CAAI,CAAI,EAAE,EAAE,CAC3B,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAIvB,CAAA;AAEjB,MAAM,OAAO,GAAG,CAAI,CAAI,EAAE,EAAE,CAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAIlB,CAAA","sourcesContent":["import { LexMap, LexValue } from '@atproto/lex-client'\nimport { l } from '@atproto/lex-schema'\n\nexport const noop = () => {}\n\nexport async function extractLexRpcErrorCode(\n  response: Response,\n): Promise<string | null> {\n  const json = await peekJson(response, 10 * 1024) // Avoid reading large bodies\n  if (json === undefined) return null\n  if (!l.lexErrorData.matches(json)) return null\n  return json.error\n}\n\nasync function peekJson(\n  response: Response,\n  maxSize = Infinity,\n): Promise<undefined | LexValue> {\n  const type = extractType(response)\n  if (type !== 'application/json') return undefined\n  const length = extractLength(response)\n  if (length != null && length > maxSize) return undefined\n\n  try {\n    return (await response.clone().json()) as Promise<LexValue>\n  } catch {\n    return undefined\n  }\n}\n\nfunction extractLength({ headers }: Response) {\n  return headers.get('Content-Length')\n    ? Number(headers.get('Content-Length'))\n    : undefined\n}\n\nfunction extractType({ headers }: Response) {\n  return headers.get('Content-Type')?.split(';')[0]?.trim().toLowerCase()\n}\n\nexport function extractPdsUrl(didDoc?: LexMap): string | null {\n  const pdsService = ifArray(didDoc?.service)?.find((service) =>\n    ifString((service as any)?.id)?.endsWith('#atproto_pds'),\n  )\n  const pdsEndpoint = ifString((pdsService as any)?.serviceEndpoint)\n  return pdsEndpoint && URL.canParse(pdsEndpoint) ? pdsEndpoint : null\n}\n\nconst ifString = <T>(v: T) =>\n  (typeof v === 'string' ? v : undefined) as unknown extends T\n    ? undefined | string\n    : T extends string\n      ? string\n      : undefined\n\nconst ifArray = <T>(v: T) =>\n  (Array.isArray(v) ? v : undefined) as unknown extends T\n    ? undefined | unknown[]\n    : T extends unknown[]\n      ? Extract<T, unknown[]>\n      : undefined\n"]}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@atproto/lex-password-session",
+  "version": "0.0.0",
+  "license": "MIT",
+  "description": "Password based client authentication for AT Lexicons",
+  "keywords": [
+    "atproto",
+    "lexicon",
+    "utilities"
+  ],
+  "homepage": "https://atproto.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/bluesky-social/atproto",
+    "directory": "packages/lex/lex-password-session"
+  },
+  "files": [
+    "./src",
+    "./tsconfig.build.json",
+    "./tsconfig.tests.json",
+    "./tsconfig.json",
+    "./dist",
+    "./CHANGELOG.md"
+  ],
+  "sideEffects": false,
+  "type": "commonjs",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "browser": "./dist/index.js",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@atproto/lex-client": "workspace:*",
+    "@atproto/lex-schema": "workspace:*",
+    "tslib": "^2.8.1"
+  },
+  "devDependencies": {
+    "@atproto/lex-builder": "workspace:*",
+    "@atproto/lex-server": "workspace:*",
+    "vitest": "^4.0.16"
+  },
+  "scripts": {
+    "prebuild": "node ./scripts/lex-build.mjs",
+    "build": "tsc --build tsconfig.build.json",
+    "test": "vitest run"
+  }
+}

package/src/error.ts

@@ -0,0 +1,14 @@
+import { LexError, LexRpcResponseError } from '@atproto/lex-client'
+import { com } from './lexicons'
+
+export class LexAuthFactorError extends LexError {
+  name = 'LexAuthFactorError'
+
+  constructor(
+    readonly response: LexRpcResponseError<
+      typeof com.atproto.server.createSession.main
+    >,
+  ) {
+    super(response.error, response.message, { cause: response.reason })
+  }
+}

package/src/index.ts

@@ -0,0 +1,2 @@
+export * from './error.js'
+export * from './password-session.js'

package/src/lexicons/com/atproto/server/createAccount.defs.ts

@@ -0,0 +1,56 @@
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+
+import { l } from '@atproto/lex-schema'
+
+const $nsid = 'com.atproto.server.createAccount'
+
+export { $nsid }
+
+/** Create an account. Implemented by PDS. */
+const main =
+  /*#__PURE__*/
+  l.procedure(
+    $nsid,
+    /*#__PURE__*/ l.params(),
+    /*#__PURE__*/ l.jsonPayload({
+      email: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.string()),
+      handle: /*#__PURE__*/ l.string({ format: 'handle' }),
+      did: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.string({ format: 'did' })),
+      inviteCode: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.string()),
+      verificationCode: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.string()),
+      verificationPhone: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.string()),
+      password: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.string()),
+      recoveryKey: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.string()),
+      plcOp: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.unknownObject()),
+    }),
+    /*#__PURE__*/ l.jsonPayload({
+      accessJwt: /*#__PURE__*/ l.string(),
+      refreshJwt: /*#__PURE__*/ l.string(),
+      handle: /*#__PURE__*/ l.string({ format: 'handle' }),
+      did: /*#__PURE__*/ l.string({ format: 'did' }),
+      didDoc: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.unknownObject()),
+    }),
+    [
+      'InvalidHandle',
+      'InvalidPassword',
+      'InvalidInviteCode',
+      'HandleNotAvailable',
+      'UnsupportedDomain',
+      'UnresolvableDid',
+      'IncompatibleDidDoc',
+    ],
+  )
+export { main }
+
+export type Params = l.InferMethodParams<typeof main>
+export type Input = l.InferMethodInput<typeof main>
+export type InputBody = l.InferMethodInputBody<typeof main>
+export type Output = l.InferMethodOutput<typeof main>
+export type OutputBody = l.InferMethodOutputBody<typeof main>
+
+export const $lxm = /*#__PURE__*/ main.nsid,
+  $params = /*#__PURE__*/ main.parameters,
+  $input = /*#__PURE__*/ main.input,
+  $output = /*#__PURE__*/ main.output

package/src/lexicons/com/atproto/server/createAccount.ts

@@ -0,0 +1,6 @@
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+
+export * from './createAccount.defs.js'
+export * as $defs from './createAccount.defs.js'

package/src/lexicons/com/atproto/server/createSession.defs.ts

@@ -0,0 +1,48 @@
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+
+import { l } from '@atproto/lex-schema'
+
+const $nsid = 'com.atproto.server.createSession'
+
+export { $nsid }
+
+/** Create an authentication session. */
+const main =
+  /*#__PURE__*/
+  l.procedure(
+    $nsid,
+    /*#__PURE__*/ l.params(),
+    /*#__PURE__*/ l.jsonPayload({
+      identifier: /*#__PURE__*/ l.string(),
+      password: /*#__PURE__*/ l.string(),
+      authFactorToken: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.string()),
+      allowTakendown: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.boolean()),
+    }),
+    /*#__PURE__*/ l.jsonPayload({
+      accessJwt: /*#__PURE__*/ l.string(),
+      refreshJwt: /*#__PURE__*/ l.string(),
+      handle: /*#__PURE__*/ l.string({ format: 'handle' }),
+      did: /*#__PURE__*/ l.string({ format: 'did' }),
+      didDoc: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.unknownObject()),
+      email: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.string()),
+      emailConfirmed: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.boolean()),
+      emailAuthFactor: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.boolean()),
+      active: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.boolean()),
+      status: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.string()),
+    }),
+    ['AccountTakedown', 'AuthFactorTokenRequired'],
+  )
+export { main }
+
+export type Params = l.InferMethodParams<typeof main>
+export type Input = l.InferMethodInput<typeof main>
+export type InputBody = l.InferMethodInputBody<typeof main>
+export type Output = l.InferMethodOutput<typeof main>
+export type OutputBody = l.InferMethodOutputBody<typeof main>
+
+export const $lxm = /*#__PURE__*/ main.nsid,
+  $params = /*#__PURE__*/ main.parameters,
+  $input = /*#__PURE__*/ main.input,
+  $output = /*#__PURE__*/ main.output

package/src/lexicons/com/atproto/server/createSession.ts

@@ -0,0 +1,6 @@
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+
+export * from './createSession.defs.js'
+export * as $defs from './createSession.defs.js'

package/src/lexicons/com/atproto/server/deleteSession.defs.ts

@@ -0,0 +1,32 @@
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+
+import { l } from '@atproto/lex-schema'
+
+const $nsid = 'com.atproto.server.deleteSession'
+
+export { $nsid }
+
+/** Delete the current session. Requires auth using the 'refreshJwt' (not the 'accessJwt'). */
+const main =
+  /*#__PURE__*/
+  l.procedure(
+    $nsid,
+    /*#__PURE__*/ l.params(),
+    /*#__PURE__*/ l.payload(),
+    /*#__PURE__*/ l.payload(),
+    ['InvalidToken', 'ExpiredToken'],
+  )
+export { main }
+
+export type Params = l.InferMethodParams<typeof main>
+export type Input = l.InferMethodInput<typeof main>
+export type InputBody = l.InferMethodInputBody<typeof main>
+export type Output = l.InferMethodOutput<typeof main>
+export type OutputBody = l.InferMethodOutputBody<typeof main>
+
+export const $lxm = /*#__PURE__*/ main.nsid,
+  $params = /*#__PURE__*/ main.parameters,
+  $input = /*#__PURE__*/ main.input,
+  $output = /*#__PURE__*/ main.output

package/src/lexicons/com/atproto/server/deleteSession.ts

@@ -0,0 +1,6 @@
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+
+export * from './deleteSession.defs.js'
+export * as $defs from './deleteSession.defs.js'

package/src/lexicons/com/atproto/server/getSession.defs.ts

@@ -0,0 +1,36 @@
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+
+import { l } from '@atproto/lex-schema'
+
+const $nsid = 'com.atproto.server.getSession'
+
+export { $nsid }
+
+/** Get information about the current auth session. Requires auth. */
+const main =
+  /*#__PURE__*/
+  l.query(
+    $nsid,
+    /*#__PURE__*/ l.params(),
+    /*#__PURE__*/ l.jsonPayload({
+      handle: /*#__PURE__*/ l.string({ format: 'handle' }),
+      did: /*#__PURE__*/ l.string({ format: 'did' }),
+      didDoc: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.unknownObject()),
+      email: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.string()),
+      emailConfirmed: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.boolean()),
+      emailAuthFactor: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.boolean()),
+      active: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.boolean()),
+      status: /*#__PURE__*/ l.optional(/*#__PURE__*/ l.string()),
+    }),
+  )
+export { main }
+
+export type Params = l.InferMethodParams<typeof main>
+export type Output = l.InferMethodOutput<typeof main>
+export type OutputBody = l.InferMethodOutputBody<typeof main>
+
+export const $lxm = /*#__PURE__*/ main.nsid,
+  $params = main.parameters,
+  $output = main.output

package/src/lexicons/com/atproto/server/getSession.ts

@@ -0,0 +1,6 @@
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+
+export * from './getSession.defs.js'
+export * as $defs from './getSession.defs.js'