@atproto/oauth-client-node 0.0.0-spaces-alpha-20260818163953

package/LICENSE.txt

@@ -0,0 +1,7 @@
+Dual MIT/Apache-2.0 License
+
+Copyright (c) 2022-2026 Bluesky Social PBC, and Contributors
+
+Except as otherwise noted in individual files, this software is licensed under the MIT license (<http://opensource.org/licenses/MIT>), or the Apache License, Version 2.0 (<http://www.apache.org/licenses/LICENSE-2.0>).
+
+Downstream projects and end users may chose either license individually, or both together, at their discretion. The motivation for this dual-licensing is the additional software patent assurance provided by Apache 2.0.

package/README.md

@@ -0,0 +1,469 @@
+# atproto OAuth Client for NodeJS
+
+This package implements all the OAuth features required by [ATPROTO] (PKCE,
+etc.) to run in a NodeJS based environment such as desktop apps built with
+Electron or traditional web app backends built with frameworks like Express.
+
+## Setup
+
+### Client configuration
+
+The `client_id` is what identifies your application to the OAuth server. It is
+used to fetch the client metadata, and to initiate the OAuth flow. The
+`client_id` must be a URL that points to the client metadata.
+
+Your OAuth client metadata should be hosted at a URL that corresponds to the
+`client_id` of your application. This URL should return a JSON object with the
+client metadata. The client metadata should be configured according to the
+needs of your application, and must respect the [ATPROTO].
+
+#### From a backend service
+
+The `client_metadata` object will typically be built by the backend at startup.
+
+```ts
+import { NodeOAuthClient, Session } from '@atproto/oauth-client-node'
+import { JoseKey } from '@atproto/jwk-jose'
+
+const client = new NodeOAuthClient({
+  // This object will be used to build the payload of the /client-metadata.json
+  // endpoint metadata, exposing the client metadata to the OAuth server.
+  clientMetadata: {
+    // Must be a URL that will be exposing this metadata
+    client_id: 'https://my-app.com/client-metadata.json',
+    client_name: 'My App',
+    client_uri: 'https://my-app.com',
+    logo_uri: 'https://my-app.com/logo.png',
+    tos_uri: 'https://my-app.com/tos',
+    policy_uri: 'https://my-app.com/policy',
+    redirect_uris: ['https://my-app.com/callback'],
+    grant_types: ['authorization_code', 'refresh_token'],
+    scope: 'atproto transition:generic',
+    response_types: ['code'],
+    application_type: 'web',
+    token_endpoint_auth_method: 'private_key_jwt',
+    token_endpoint_auth_signing_alg: 'RS256',
+    dpop_bound_access_tokens: true,
+    jwks_uri: 'https://my-app.com/jwks.json',
+  },
+
+  // Used to authenticate the client to the token endpoint. Will be used to
+  // build the jwks object to be exposed on the "jwks_uri" endpoint.
+  keyset: await Promise.all([
+    JoseKey.fromImportable(process.env.PRIVATE_KEY_1, 'key1'),
+    JoseKey.fromImportable(process.env.PRIVATE_KEY_2, 'key2'),
+    JoseKey.fromImportable(process.env.PRIVATE_KEY_3, 'key3'),
+  ]),
+
+  // Interface to store authorization state data (during authorization flows)
+  stateStore: {
+    async set(key: string, internalState: NodeSavedState): Promise<void> {},
+    async get(key: string): Promise<NodeSavedState | undefined> {},
+    async del(key: string): Promise<void> {},
+  },
+
+  // Interface to store authenticated session data
+  sessionStore: {
+    async set(sub: string, session: Session): Promise<void> {},
+    async get(sub: string): Promise<Session | undefined> {},
+    async del(sub: string): Promise<void> {},
+  },
+
+  // A lock to prevent concurrent access to the session store. Optional if only one instance is running.
+  requestLock,
+})
+
+const app = express()
+
+// Expose the metadata and jwks
+app.get('client-metadata.json', (req, res) => res.json(client.clientMetadata))
+app.get('jwks.json', (req, res) => res.json(client.jwks))
+
+// Create an endpoint to initiate the OAuth flow
+app.get('/login', async (req, res, next) => {
+  try {
+    const handle = 'some-handle.bsky.social' // eg. from query string
+    const state = '434321'
+
+    // Revoke any pending authentication requests if the connection is closed (optional)
+    const ac = new AbortController()
+    req.on('close', () => ac.abort())
+
+    const url = await client.authorize(handle, {
+      signal: ac.signal,
+      state,
+      // Only supported if OAuth server is openid-compliant
+      ui_locales: 'fr-CA fr en',
+    })
+
+    res.redirect(url)
+  } catch (err) {
+    next(err)
+  }
+})
+
+// Create an endpoint to handle the OAuth callback
+app.get('/atproto-oauth-callback', async (req, res, next) => {
+  try {
+    const params = new URLSearchParams(req.url.split('?')[1])
+
+    const { session, state } = await client.callback(params)
+
+    // Process successful authentication here
+    console.log('authorize() was called with state:', state)
+
+    console.log('User authenticated as:', session.did)
+
+    const agent = new Agent(session)
+
+    // Make Authenticated API calls
+    const profile = await agent.getProfile({ actor: agent.did })
+    console.log('Bsky profile:', profile.data)
+
+    res.json({ ok: true })
+  } catch (err) {
+    next(err)
+  }
+})
+
+// Whenever needed, restore a user's session
+async function worker() {
+  const userDid = 'did:plc:123'
+
+  const oauthSession = await client.restore(userDid)
+
+  // Note: If the current access_token is expired, the session will automatically
+  // (and transparently) refresh it. The new token set will be saved though
+  // the client's session store.
+
+  const agent = new Agent(oauthSession)
+
+  // Make Authenticated API calls
+  const profile = await agent.getProfile({ actor: agent.did })
+  console.log('Bsky profile:', profile.data)
+}
+```
+
+#### From a native application
+
+This applies to mobile apps, desktop apps, etc. based on NodeJS (e.g. Electron).
+
+The client metadata must be hosted on an internet-accessible URL owned by you.
+The client metadata will typically contain:
+
+```json
+{
+  "client_id": "https://my-app.com/client-metadata.json",
+  "client_name": "My App",
+  "client_uri": "https://my-app.com",
+  "logo_uri": "https://my-app.com/logo.png",
+  "tos_uri": "https://my-app.com/tos",
+  "policy_uri": "https://my-app.com/policy",
+  "redirect_uris": ["https://my-app.com/atproto-oauth-callback"],
+  "scope": "atproto",
+  "grant_types": ["authorization_code", "refresh_token"],
+  "response_types": ["code"],
+  "application_type": "native",
+  "token_endpoint_auth_method": "none",
+  "dpop_bound_access_tokens": true
+}
+```
+
+Instead of hard-coding the client metadata in your app, you can fetch it when
+the app starts:
+
+```ts
+import { NodeOAuthClient } from '@atproto/oauth-client-node'
+
+const client = await NodeOAuthClient.fromClientId({
+  clientId: 'https://my-app.com/client-metadata.json',
+
+  stateStore: {
+    async set(key: string, internalState: NodeSavedState): Promise<void> {},
+    async get(key: string): Promise<NodeSavedState | undefined> {},
+    async del(key: string): Promise<void> {},
+  },
+
+  sessionStore: {
+    async set(sub: string, session: Session): Promise<void> {},
+    async get(sub: string): Promise<Session | undefined> {},
+    async del(sub: string): Promise<void> {},
+  },
+
+  // A lock to prevent concurrent access to the session store. Optional if only one instance is running.
+  requestLock,
+})
+```
+
+> [!NOTE]
+>
+> There is no `keyset` in this instance. This is due to the fact that app
+> clients cannot safely store a private key. The `token_endpoint_auth_method` is
+> set to `none` in the client metadata, which means that the client will not be
+> authenticating itself to the token endpoint. This will cause sessions to have
+> a shorter lifetime. You can circumvent this by providing a "BFF" (Backend for
+> Frontend) that will perform an authenticated OAuth flow and use a session id
+> based mechanism to authenticate the client.
+
+### Common configuration options
+
+The `OAuthClient` and `OAuthAgent` classes will manage and refresh OAuth tokens
+transparently. They are also responsible to properly format the HTTP requests
+payload, using DPoP, and transparently retrying requests when the access token
+expires.
+
+For this to work, the client must be configured with the following options:
+
+#### `sessionStore`
+
+A simple key-value store to save the OAuth session data. This is used to save
+the access token, refresh token, and other session data.
+
+```ts
+const sessionStore: NodeSavedSessionStore = {
+  async set(sub: string, sessionData: NodeSavedSession) {
+    // Insert or update the session data in your database
+    await saveSessionDataToDb(sub, sessionData)
+  },
+
+  async get(sub: string) {
+    // Retrieve the session data from your database
+    const sessionData = await getSessionDataFromDb(sub)
+    if (!sessionData) return undefined
+
+    return sessionData
+  },
+
+  async del(sub: string) {
+    // Delete the session data from your database
+    await deleteSessionDataFromDb(sub)
+  },
+}
+```
+
+#### `stateStore`
+
+A simple key-value store to save the state of the OAuth
+authorization flow. This is used to prevent CSRF attacks.
+
+The implementation of the `StateStore` is similar to the
+[`sessionStore`](#sessionstore).
+
+```ts
+interface NodeSavedStateStore {
+  set: (key: string, internalState: NodeSavedState) => Promise<void>
+  get: (key: string) => Promise<NodeSavedState | undefined>
+  del: (key: string) => Promise<void>
+}
+```
+
+One notable exception is that state store items can (and should) be deleted
+after a short period of time (one hour should be more than enough).
+
+#### `requestLock`
+
+When multiple instances of the client are running, this lock will prevent
+concurrent refreshes of the same session. If the lock fails to be acquired an
+error should be thrown.
+
+Here is an example implementation based on [`redlock`](https://www.npmjs.com/package/redlock):
+
+```ts
+import { RuntimeLock } from '@atproto/oauth-client-node'
+import Redis from 'ioredis'
+import Redlock from 'redlock'
+
+const redisClients = new Redis()
+const redlock = new Redlock(redisClients)
+
+const requestLock: RuntimeLock = async (key, fn) => {
+  // 30 seconds should be enough. Since we will be using one lock per user id
+  // we can be quite liberal with the lock duration here.
+  const lock = await redlock.lock(key, 45e3)
+  try {
+    return await fn()
+  } finally {
+    await redlock.unlock(lock)
+  }
+}
+```
+
+## Usage with `@atproto/api`
+
+`@atproto/oauth-client-*` packages all return an `ApiClient` instance upon
+successful authentication. This instance can be used to make authenticated
+requests using all the `ApiClient` methods defined in [[API]] (non exhaustive
+list of examples below). Any refresh of the credentials will happen under the
+hood, and the new tokens will be saved in the session store.
+
+```ts
+const session = await client.restore('did:plc:123')
+const agent = new Agent(session)
+
+// Feeds and content
+await agent.getTimeline(params, opts)
+await agent.getAuthorFeed(params, opts)
+await agent.getPostThread(params, opts)
+await agent.getPost(params)
+await agent.getPosts(params, opts)
+await agent.getLikes(params, opts)
+await agent.getRepostedBy(params, opts)
+await agent.post(record)
+await agent.deletePost(postUri)
+await agent.like(uri, cid)
+await agent.deleteLike(likeUri)
+await agent.repost(uri, cid)
+await agent.deleteRepost(repostUri)
+await agent.uploadBlob(data, opts)
+
+// Social graph
+await agent.getFollows(params, opts)
+await agent.getFollowers(params, opts)
+await agent.follow(did)
+await agent.deleteFollow(followUri)
+
+// Actors
+await agent.getProfile(params, opts)
+await agent.upsertProfile(updateFn)
+await agent.getProfiles(params, opts)
+await agent.getSuggestions(params, opts)
+await agent.searchActors(params, opts)
+await agent.searchActorsTypeahead(params, opts)
+await agent.mute(did)
+await agent.unmute(did)
+await agent.muteModList(listUri)
+await agent.unmuteModList(listUri)
+await agent.blockModList(listUri)
+await agent.unblockModList(listUri)
+
+// Notifications
+await agent.listNotifications(params, opts)
+await agent.countUnreadNotifications(params, opts)
+await agent.updateSeenNotifications()
+
+// Identity
+await agent.resolveHandle(params, opts)
+await agent.updateHandle(params, opts)
+
+// etc.
+
+// Always remember to revoke the credentials when you are done
+await session.signOut()
+```
+
+## Advances use-cases
+
+### Listening for session updates and deletion
+
+The `OAuthClient` will emit events whenever a session is updated or deleted.
+
+```ts
+import {
+  Session,
+  TokenRefreshError,
+  TokenRevokedError,
+} from '@atproto/oauth-client-node'
+
+client.addEventListener('updated', (event: CustomEvent<Session>) => {
+  console.log('Refreshed tokens were saved in the store:', event.detail)
+})
+
+client.addEventListener(
+  'deleted',
+  (
+    event: CustomEvent<{
+      sub: string
+      cause: TokenRefreshError | TokenRevokedError | unknown
+    }>,
+  ) => {
+    console.log('Session was deleted from the session store:', event.detail)
+
+    const { cause } = event.detail
+
+    if (cause instanceof TokenRefreshError) {
+      // - refresh_token unavailable or expired
+      // - oauth response error (`cause.cause instanceof OAuthResponseError`)
+      // - session data does not match expected values returned by the OAuth server
+    } else if (cause instanceof TokenRevokedError) {
+      // Session was revoked through:
+      // - session.signOut()
+      // - client.revoke(sub)
+    } else {
+      // An unexpected error occurred, causing the session to be deleted
+    }
+  },
+)
+```
+
+### Silent Sign-In
+
+Using silent sign-in requires to handle retries on the callback endpoint.
+
+```ts
+app.get('/login', async (req, res) => {
+  const handle = 'some-handle.bsky.social' // eg. from query string
+  const user = req.user.id
+
+  const url = await client.authorize(handle, {
+    // Use "prompt=none" to attempt silent sign-in
+    prompt: 'none',
+
+    // Build an internal state to map the login request to the user, and allow retries
+    state: JSON.stringify({
+      user,
+      handle,
+    }),
+  })
+
+  res.redirect(url)
+})
+
+app.get('/atproto-oauth-callback', async (req, res) => {
+  const params = new URLSearchParams(req.url.split('?')[1])
+  try {
+    try {
+      const { session, state } = await client.callback(params)
+
+      // Process successful authentication here. For example:
+
+      const agent = new Agent(session)
+
+      const profile = await agent.getProfile({ actor: agent.did })
+
+      console.log('Bsky profile:', profile.data)
+    } catch (err) {
+      // Silent sign-in failed, retry without prompt=none
+      if (
+        err instanceof OAuthCallbackError &&
+        ['login_required', 'consent_required'].includes(err.params.get('error'))
+      ) {
+        // Parse previous state
+        const { user, handle } = JSON.parse(err.state)
+
+        const url = await client.authorize(handle, {
+          // Note that we omit the prompt parameter here. Setting "prompt=none"
+          // here would result in an infinite redirect loop.
+
+          // Build a new state (or re-use the previous one)
+          state: JSON.stringify({
+            user,
+            handle,
+          }),
+        })
+
+        // redirect to new URL
+        res.redirect(url)
+
+        return
+      }
+
+      throw err
+    }
+  } catch (err) {
+    next(err)
+  }
+})
+```
+
+[ATPROTO]: https://atproto.com/ 'AT Protocol'
+[API]: ../../api/README.md

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from '@atproto-labs/handle-resolver-node';
+export * from '@atproto/jwk-webcrypto';
+export * from '@atproto/oauth-client';
+export * from '@atproto/jwk-jose';
+export * from './node-oauth-client.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAA;AAClD,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,mBAAmB,CAAA;AAEjC,cAAc,wBAAwB,CAAA"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export * from '@atproto-labs/handle-resolver-node';
+export * from '@atproto/jwk-webcrypto';
+export * from '@atproto/oauth-client';
+export * from '@atproto/jwk-jose';
+export * from './node-oauth-client.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAA;AAClD,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,mBAAmB,CAAA;AAEjC,cAAc,wBAAwB,CAAA","sourcesContent":["export * from '@atproto-labs/handle-resolver-node'\nexport * from '@atproto/jwk-webcrypto'\nexport * from '@atproto/oauth-client'\nexport * from '@atproto/jwk-jose'\n\nexport * from './node-oauth-client.js'\n"]}

package/dist/node-dpop-store.d.ts

@@ -0,0 +1,22 @@
+import type { Jwk, Key } from '@atproto/jwk';
+import type { InternalStateData, Session } from '@atproto/oauth-client';
+import type { SimpleStore } from '@atproto-labs/simple-store';
+type ToDpopJwkValue<V extends {
+    dpopKey: Key;
+}> = Omit<V, 'dpopKey'> & {
+    dpopJwk: Jwk;
+};
+/**
+ * Utility function that allows to simplify the store interface by exposing a
+ * JWK (JSON) instead of a Key instance.
+ */
+export declare function toDpopKeyStore<K extends string, V extends {
+    dpopKey: Key;
+    dpopJwk?: never;
+}>(store: SimpleStore<K, ToDpopJwkValue<V>>): SimpleStore<K, V>;
+export type NodeSavedState = ToDpopJwkValue<InternalStateData>;
+export type NodeSavedStateStore = SimpleStore<string, NodeSavedState>;
+export type NodeSavedSession = ToDpopJwkValue<Session>;
+export type NodeSavedSessionStore = SimpleStore<string, NodeSavedSession>;
+export {};
+//# sourceMappingURL=node-dpop-store.d.ts.map

package/dist/node-dpop-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-dpop-store.d.ts","sourceRoot":"","sources":["../src/node-dpop-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAE5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAE7D,KAAK,cAAc,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,GAAG,CAAA;CAAE,IAAI,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG;IACrE,OAAO,EAAE,GAAG,CAAA;CACb,CAAA;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS;IAAE,OAAO,EAAE,GAAG,CAAC;IAAC,OAAO,CAAC,EAAE,KAAK,CAAA;CAAE,EAC3C,KAAK,EAAE,WAAW,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAqB7D;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAA;AAC9D,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;AAErE,MAAM,MAAM,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;AACtD,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA"}

package/dist/node-dpop-store.js

@@ -0,0 +1,26 @@
+import { JoseKey } from '@atproto/jwk-jose';
+/**
+ * Utility function that allows to simplify the store interface by exposing a
+ * JWK (JSON) instead of a Key instance.
+ */
+export function toDpopKeyStore(store) {
+    return {
+        async set(sub, { dpopKey, ...data }) {
+            const dpopJwk = dpopKey.privateJwk;
+            if (!dpopJwk)
+                throw new Error('Private DPoP JWK is missing.');
+            await store.set(sub, { ...data, dpopJwk });
+        },
+        async get(sub) {
+            const result = await store.get(sub);
+            if (!result)
+                return undefined;
+            const { dpopJwk, ...data } = result;
+            const dpopKey = await JoseKey.fromJWK(dpopJwk);
+            return { ...data, dpopKey };
+        },
+        del: store.del.bind(store),
+        clear: store.clear?.bind(store),
+    };
+}
+//# sourceMappingURL=node-dpop-store.js.map

package/dist/node-dpop-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-dpop-store.js","sourceRoot":"","sources":["../src/node-dpop-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAQ3C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAG5B,KAAwC;IACxC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAM,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,EAAK;YACvC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAA;YAClC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;YAE7D,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAC5C,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,GAAM;YACd,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACnC,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAA;YAE7B,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;YACnC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YAC9C,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAkB,CAAA;QAC7C,CAAC;QAED,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;KAChC,CAAA;AACH,CAAC","sourcesContent":["import type { Jwk, Key } from '@atproto/jwk'\nimport { JoseKey } from '@atproto/jwk-jose'\nimport type { InternalStateData, Session } from '@atproto/oauth-client'\nimport type { SimpleStore } from '@atproto-labs/simple-store'\n\ntype ToDpopJwkValue<V extends { dpopKey: Key }> = Omit<V, 'dpopKey'> & {\n  dpopJwk: Jwk\n}\n\n/**\n * Utility function that allows to simplify the store interface by exposing a\n * JWK (JSON) instead of a Key instance.\n */\nexport function toDpopKeyStore<\n  K extends string,\n  V extends { dpopKey: Key; dpopJwk?: never },\n>(store: SimpleStore<K, ToDpopJwkValue<V>>): SimpleStore<K, V> {\n  return {\n    async set(sub: K, { dpopKey, ...data }: V) {\n      const dpopJwk = dpopKey.privateJwk\n      if (!dpopJwk) throw new Error('Private DPoP JWK is missing.')\n\n      await store.set(sub, { ...data, dpopJwk })\n    },\n\n    async get(sub: K) {\n      const result = await store.get(sub)\n      if (!result) return undefined\n\n      const { dpopJwk, ...data } = result\n      const dpopKey = await JoseKey.fromJWK(dpopJwk)\n      return { ...data, dpopKey } as unknown as V\n    },\n\n    del: store.del.bind(store),\n    clear: store.clear?.bind(store),\n  }\n}\n\nexport type NodeSavedState = ToDpopJwkValue<InternalStateData>\nexport type NodeSavedStateStore = SimpleStore<string, NodeSavedState>\n\nexport type NodeSavedSession = ToDpopJwkValue<Session>\nexport type NodeSavedSessionStore = SimpleStore<string, NodeSavedSession>\n"]}

package/dist/node-oauth-client.d.ts

@@ -0,0 +1,30 @@
+import { type HandleResolver, OAuthClient, type OAuthClientFetchMetadataOptions, type OAuthClientOptions, type RuntimeImplementation, type RuntimeLock } from '@atproto/oauth-client';
+import type { OAuthResponseMode } from '@atproto/oauth-types';
+import { type AtprotoHandleResolverNodeOptions } from '@atproto-labs/handle-resolver-node';
+import { type NodeSavedSessionStore, type NodeSavedStateStore } from './node-dpop-store.js';
+import type { Override } from './util.js';
+export type * from './node-dpop-store.js';
+export type { OAuthClientOptions, OAuthResponseMode, RuntimeLock };
+export type NodeOAuthClientOptions = Override<OAuthClientOptions, {
+    responseMode?: Exclude<OAuthResponseMode, 'fragment'>;
+    stateStore: NodeSavedStateStore;
+    sessionStore: NodeSavedSessionStore;
+    /**
+     * Used to build a {@link NodeOAuthClientOptions.handleResolver} if none is
+     * provided.
+     */
+    fallbackNameservers?: AtprotoHandleResolverNodeOptions['fallbackNameservers'];
+    handleResolver?: HandleResolver | string | URL;
+    /**
+     * Used to build a {@link NodeOAuthClientOptions.runtimeImplementation} if
+     * none is provided. Pass in `requestLocalLock` from `@atproto/oauth-client`
+     * to mute warning.
+     */
+    requestLock?: RuntimeLock;
+    runtimeImplementation?: RuntimeImplementation;
+}>;
+export type NodeOAuthClientFromMetadataOptions = OAuthClientFetchMetadataOptions & Omit<NodeOAuthClientOptions, 'clientMetadata'>;
+export declare class NodeOAuthClient extends OAuthClient {
+    constructor({ requestLock, fallbackNameservers, fetch, responseMode, stateStore, sessionStore, handleResolver, runtimeImplementation, ...options }: NodeOAuthClientOptions);
+}
+//# sourceMappingURL=node-oauth-client.d.ts.map

package/dist/node-oauth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-oauth-client.d.ts","sourceRoot":"","sources":["../src/node-oauth-client.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,cAAc,EACnB,WAAW,EACX,KAAK,+BAA+B,EACpC,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EAEzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEzC,mBAAmB,sBAAsB,CAAA;AACzC,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAA;AAElE,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAC3C,kBAAkB,EAClB;IACE,YAAY,CAAC,EAAE,OAAO,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAA;IAErD,UAAU,EAAE,mBAAmB,CAAA;IAC/B,YAAY,EAAE,qBAAqB,CAAA;IAEnC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,gCAAgC,CAAC,qBAAqB,CAAC,CAAA;IAE7E,cAAc,CAAC,EAAE,cAAc,GAAG,MAAM,GAAG,GAAG,CAAA;IAE9C;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;CAC9C,CACF,CAAA;AAED,MAAM,MAAM,kCAAkC,GAC5C,+BAA+B,GAC7B,IAAI,CAAC,sBAAsB,EAAE,gBAAgB,CAAC,CAAA;AAElD,qBAAa,eAAgB,SAAQ,WAAW;IAC9C,YAAY,EACV,WAAuB,EACvB,mBAA+B,EAE/B,KAAK,EACL,YAAsB,EAEtB,UAAU,EACV,YAAY,EAEZ,cAGE,EAEF,qBAMC,EAED,GAAG,OAAO,EACX,EAAE,sBAAsB,EAiBxB;CACF"}

package/dist/node-oauth-client.js

@@ -0,0 +1,31 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { JoseKey } from '@atproto/jwk-jose';
+import { OAuthClient, } from '@atproto/oauth-client';
+import { AtprotoHandleResolverNode, } from '@atproto-labs/handle-resolver-node';
+import { toDpopKeyStore, } from './node-dpop-store.js';
+export class NodeOAuthClient extends OAuthClient {
+    constructor({ requestLock = undefined, fallbackNameservers = undefined, fetch, responseMode = 'query', stateStore, sessionStore, handleResolver = new AtprotoHandleResolverNode({
+        fetch,
+        fallbackNameservers,
+    }), runtimeImplementation = {
+        requestLock,
+        createKey: (algs) => JoseKey.generate(algs),
+        getRandomValues: randomBytes,
+        digest: (bytes, algorithm) => createHash(algorithm.name).update(bytes).digest(),
+    }, ...options }) {
+        if (!runtimeImplementation.requestLock) {
+            // Ok if only one instance of the client is running at a time.
+            console.warn('No lock mechanism provided. Credentials might get revoked.');
+        }
+        super({
+            ...options,
+            fetch,
+            responseMode,
+            handleResolver,
+            runtimeImplementation,
+            stateStore: toDpopKeyStore(stateStore),
+            sessionStore: toDpopKeyStore(sessionStore),
+        });
+    }
+}
+//# sourceMappingURL=node-oauth-client.js.map

package/dist/node-oauth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-oauth-client.js","sourceRoot":"","sources":["../src/node-oauth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAEL,WAAW,GAKZ,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EACL,yBAAyB,GAE1B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAGL,cAAc,GACf,MAAM,sBAAsB,CAAA;AAqC7B,MAAM,OAAO,eAAgB,SAAQ,WAAW;IAC9C,YAAY,EACV,WAAW,GAAG,SAAS,EACvB,mBAAmB,GAAG,SAAS,EAE/B,KAAK,EACL,YAAY,GAAG,OAAO,EAEtB,UAAU,EACV,YAAY,EAEZ,cAAc,GAAG,IAAI,yBAAyB,CAAC;QAC7C,KAAK;QACL,mBAAmB;KACpB,CAAC,EAEF,qBAAqB,GAAG;QACtB,WAAW;QACX,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC3C,eAAe,EAAE,WAAW;QAC5B,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAC3B,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE;KACpD,EAED,GAAG,OAAO,EACa;QACvB,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,CAAC;YACvC,8DAA8D;YAC9D,OAAO,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAA;QAC5E,CAAC;QAED,KAAK,CAAC;YACJ,GAAG,OAAO;YAEV,KAAK;YACL,YAAY;YACZ,cAAc;YACd,qBAAqB;YAErB,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC;YACtC,YAAY,EAAE,cAAc,CAAC,YAAY,CAAC;SAC3C,CAAC,CAAA;IACJ,CAAC;CACF","sourcesContent":["import { createHash, randomBytes } from 'node:crypto'\nimport { JoseKey } from '@atproto/jwk-jose'\nimport {\n  type HandleResolver,\n  OAuthClient,\n  type OAuthClientFetchMetadataOptions,\n  type OAuthClientOptions,\n  type RuntimeImplementation,\n  type RuntimeLock,\n} from '@atproto/oauth-client'\nimport type { OAuthResponseMode } from '@atproto/oauth-types'\nimport {\n  AtprotoHandleResolverNode,\n  type AtprotoHandleResolverNodeOptions,\n} from '@atproto-labs/handle-resolver-node'\nimport {\n  type NodeSavedSessionStore,\n  type NodeSavedStateStore,\n  toDpopKeyStore,\n} from './node-dpop-store.js'\nimport type { Override } from './util.js'\n\nexport type * from './node-dpop-store.js'\nexport type { OAuthClientOptions, OAuthResponseMode, RuntimeLock }\n\nexport type NodeOAuthClientOptions = Override<\n  OAuthClientOptions,\n  {\n    responseMode?: Exclude<OAuthResponseMode, 'fragment'>\n\n    stateStore: NodeSavedStateStore\n    sessionStore: NodeSavedSessionStore\n\n    /**\n     * Used to build a {@link NodeOAuthClientOptions.handleResolver} if none is\n     * provided.\n     */\n    fallbackNameservers?: AtprotoHandleResolverNodeOptions['fallbackNameservers']\n\n    handleResolver?: HandleResolver | string | URL\n\n    /**\n     * Used to build a {@link NodeOAuthClientOptions.runtimeImplementation} if\n     * none is provided. Pass in `requestLocalLock` from `@atproto/oauth-client`\n     * to mute warning.\n     */\n    requestLock?: RuntimeLock\n\n    runtimeImplementation?: RuntimeImplementation\n  }\n>\n\nexport type NodeOAuthClientFromMetadataOptions =\n  OAuthClientFetchMetadataOptions &\n    Omit<NodeOAuthClientOptions, 'clientMetadata'>\n\nexport class NodeOAuthClient extends OAuthClient {\n  constructor({\n    requestLock = undefined,\n    fallbackNameservers = undefined,\n\n    fetch,\n    responseMode = 'query',\n\n    stateStore,\n    sessionStore,\n\n    handleResolver = new AtprotoHandleResolverNode({\n      fetch,\n      fallbackNameservers,\n    }),\n\n    runtimeImplementation = {\n      requestLock,\n      createKey: (algs) => JoseKey.generate(algs),\n      getRandomValues: randomBytes,\n      digest: (bytes, algorithm) =>\n        createHash(algorithm.name).update(bytes).digest(),\n    },\n\n    ...options\n  }: NodeOAuthClientOptions) {\n    if (!runtimeImplementation.requestLock) {\n      // Ok if only one instance of the client is running at a time.\n      console.warn('No lock mechanism provided. Credentials might get revoked.')\n    }\n\n    super({\n      ...options,\n\n      fetch,\n      responseMode,\n      handleResolver,\n      runtimeImplementation,\n\n      stateStore: toDpopKeyStore(stateStore),\n      sessionStore: toDpopKeyStore(sessionStore),\n    })\n  }\n}\n"]}

package/dist/util.d.ts

@@ -0,0 +1,5 @@
+export type Simplify<T> = {
+    [K in keyof T]: T[K];
+} & {};
+export type Override<T, V> = Simplify<V & Omit<T, keyof V>>;
+//# sourceMappingURL=util.d.ts.map

package/dist/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,GAAG,EAAE,CAAA;AACvD,MAAM,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA"}

package/dist/util.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=util.js.map

package/dist/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"","sourcesContent":["export type Simplify<T> = { [K in keyof T]: T[K] } & {}\nexport type Override<T, V> = Simplify<V & Omit<T, keyof V>>\n"]}