@atproto/oauth-client 0.0.0-spaces-alpha-20260818021221

package/dist/oauth-session.js

@@ -0,0 +1,120 @@
+import { bindFetch } from '@atproto-labs/fetch';
+import { TokenInvalidError } from './errors/token-invalid-error.js';
+import { TokenRevokedError } from './errors/token-revoked-error.js';
+import { dpopFetchWrapper } from './fetch-dpop.js';
+const ReadableStream = globalThis.ReadableStream;
+export class OAuthSession {
+    constructor(server, sub, sessionGetter, fetch = globalThis.fetch) {
+        this.server = server;
+        this.sub = sub;
+        this.sessionGetter = sessionGetter;
+        this.dpopFetch = dpopFetchWrapper({
+            fetch: bindFetch(fetch),
+            key: server.dpopKey,
+            supportedAlgs: server.serverMetadata.dpop_signing_alg_values_supported,
+            sha256: async (v) => server.runtime.sha256(v),
+            nonces: server.dpopNonces,
+            isAuthServer: false,
+        });
+    }
+    get did() {
+        return this.sub;
+    }
+    get serverMetadata() {
+        return this.server.serverMetadata;
+    }
+    /**
+     * @param refresh When `true`, the credentials will be refreshed even if they
+     * are not expired. When `false`, the credentials will not be refreshed even
+     * if they are expired. When `undefined`, the credentials will be refreshed
+     * if, and only if, they are (about to be) expired. Defaults to `undefined`.
+     */
+    async getTokenSet(refresh) {
+        const { tokenSet } = await this.sessionGetter.getSession(this.sub, refresh);
+        return tokenSet;
+    }
+    async getTokenInfo(refresh = 'auto') {
+        const tokenSet = await this.getTokenSet(refresh);
+        const expiresAt = tokenSet.expires_at == null ? undefined : new Date(tokenSet.expires_at);
+        return {
+            expiresAt,
+            get expired() {
+                return expiresAt == null
+                    ? undefined
+                    : expiresAt.getTime() < Date.now() - 5e3;
+            },
+            scope: tokenSet.scope,
+            iss: tokenSet.iss,
+            aud: tokenSet.aud,
+            sub: tokenSet.sub,
+        };
+    }
+    async signOut() {
+        try {
+            const tokenSet = await this.getTokenSet(false);
+            await this.server.revoke(tokenSet.access_token);
+        }
+        finally {
+            await this.sessionGetter.delStored(this.sub, new TokenRevokedError(this.sub));
+        }
+    }
+    async fetchHandler(pathname, init) {
+        // This will try and refresh the token if it is known to be expired
+        const tokenSet = await this.getTokenSet('auto');
+        const initialUrl = new URL(pathname, tokenSet.aud);
+        const initialAuth = `${tokenSet.token_type} ${tokenSet.access_token}`;
+        const headers = new Headers(init?.headers);
+        headers.set('Authorization', initialAuth);
+        const initialResponse = await this.dpopFetch(initialUrl, {
+            ...init,
+            headers,
+        });
+        // If the token is not expired, we don't need to refresh it
+        if (!isInvalidTokenResponse(initialResponse)) {
+            return initialResponse;
+        }
+        let tokenSetFresh;
+        try {
+            // Force a refresh
+            tokenSetFresh = await this.getTokenSet(true);
+        }
+        catch (err) {
+            return initialResponse;
+        }
+        // The stream was already consumed. We cannot retry the request. A solution
+        // would be to tee() the input stream but that would bufferize the entire
+        // stream in memory which can lead to memory starvation. Instead, we will
+        // return the original response and let the calling code handle retries.
+        if (ReadableStream && init?.body instanceof ReadableStream) {
+            return initialResponse;
+        }
+        const finalAuth = `${tokenSetFresh.token_type} ${tokenSetFresh.access_token}`;
+        const finalUrl = new URL(pathname, tokenSetFresh.aud);
+        headers.set('Authorization', finalAuth);
+        const finalResponse = await this.dpopFetch(finalUrl, { ...init, headers });
+        // The token was successfully refreshed, but is still not accepted by the
+        // resource server. This might be due to the resource server not accepting
+        // credentials from the authorization server (e.g. because some migration
+        // occurred). Any ways, there is no point in keeping the session.
+        if (isInvalidTokenResponse(finalResponse)) {
+            // @TODO Is there a "softer" way to handle this, e.g. by marking the
+            // session as "expired" in the session store, allowing the user to trigger
+            // a new login (using login_hint)?
+            await this.sessionGetter.delStored(this.sub, new TokenInvalidError(this.sub));
+        }
+        return finalResponse;
+    }
+}
+/**
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3}
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc9449#name-resource-server-provided-no}
+ */
+function isInvalidTokenResponse(response) {
+    if (response.status !== 401)
+        return false;
+    const wwwAuth = response.headers.get('WWW-Authenticate');
+    return (wwwAuth != null &&
+        (wwwAuth.startsWith('Bearer ') || wwwAuth.startsWith('DPoP ')) &&
+        wwwAuth.includes('error="invalid_token"'));
+}
+//# sourceMappingURL=oauth-session.js.map

package/dist/oauth-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-session.js","sourceRoot":"","sources":["../src/oauth-session.ts"],"names":[],"mappings":"AAKA,OAAO,EAAc,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAIlD,MAAM,cAAc,GAAG,UAAU,CAAC,cACY,CAAA;AAY9C,MAAM,OAAO,YAAY;IAGvB,YACkB,MAAwB,EACxB,GAAe,EACd,aAA4B,EAC7C,KAAK,GAAU,UAAU,CAAC,KAAK;sBAHf,MAAM;mBACN,GAAG;6BACF,aAAa;QAG9B,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAO;YACtC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC;YACvB,GAAG,EAAE,MAAM,CAAC,OAAO;YACnB,aAAa,EAAE,MAAM,CAAC,cAAc,CAAC,iCAAiC;YACtE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7C,MAAM,EAAE,MAAM,CAAC,UAAU;YACzB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAA;IACnC,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,WAAW,CAAC,OAAyB;QACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAE3E,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAO,GAAqB,MAAM;QACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAChD,MAAM,SAAS,GACb,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QAEzE,OAAO;YACL,SAAS;YACT,IAAI,OAAO;gBACT,OAAO,SAAS,IAAI,IAAI;oBACtB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAA;YAC5C,CAAC;YACD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YAC9C,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QACjD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAChC,IAAI,CAAC,GAAG,EACR,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAChC,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,IAAkB;QACrD,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAE/C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAoB,CAAC,CAAA;QACnE,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAA;QAErE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAA;QAEzC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE;YACvD,GAAG,IAAI;YACP,OAAO;SACR,CAAC,CAAA;QAEF,2DAA2D;QAC3D,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,CAAC;YAC7C,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,IAAI,aAAuB,CAAA;QAC3B,IAAI,CAAC;YACH,kBAAkB;YAClB,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,cAAc,IAAI,IAAI,EAAE,IAAI,YAAY,cAAc,EAAE,CAAC;YAC3D,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,aAAa,CAAC,UAAU,IAAI,aAAa,CAAC,YAAY,EAAE,CAAA;QAC7E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAA;QAErD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;QAEvC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAE1E,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1C,oEAAoE;YACpE,0EAA0E;YAC1E,kCAAkC;YAClC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAChC,IAAI,CAAC,GAAG,EACR,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAChC,CAAA;QACH,CAAC;QAED,OAAO,aAAa,CAAA;IACtB,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,QAAkB;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IACxD,OAAO,CACL,OAAO,IAAI,IAAI;QACf,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAC1C,CAAA;AACH,CAAC","sourcesContent":["import type { AtprotoDid } from '@atproto/did'\nimport type {\n  AtprotoOAuthScope,\n  OAuthAuthorizationServerMetadata,\n} from '@atproto/oauth-types'\nimport { type Fetch, bindFetch } from '@atproto-labs/fetch'\nimport { TokenInvalidError } from './errors/token-invalid-error.js'\nimport { TokenRevokedError } from './errors/token-revoked-error.js'\nimport { dpopFetchWrapper } from './fetch-dpop.js'\nimport type { OAuthServerAgent, TokenSet } from './oauth-server-agent.js'\nimport type { SessionGetter } from './session-getter.js'\n\nconst ReadableStream = globalThis.ReadableStream as\n  typeof globalThis.ReadableStream | undefined\n\nexport type { AtprotoDid, AtprotoOAuthScope }\nexport type TokenInfo = {\n  expiresAt?: Date\n  expired?: boolean\n  scope: AtprotoOAuthScope\n  iss: string\n  aud: string\n  sub: AtprotoDid\n}\n\nexport class OAuthSession {\n  protected dpopFetch: Fetch<unknown>\n\n  constructor(\n    public readonly server: OAuthServerAgent,\n    public readonly sub: AtprotoDid,\n    private readonly sessionGetter: SessionGetter,\n    fetch: Fetch = globalThis.fetch,\n  ) {\n    this.dpopFetch = dpopFetchWrapper<void>({\n      fetch: bindFetch(fetch),\n      key: server.dpopKey,\n      supportedAlgs: server.serverMetadata.dpop_signing_alg_values_supported,\n      sha256: async (v) => server.runtime.sha256(v),\n      nonces: server.dpopNonces,\n      isAuthServer: false,\n    })\n  }\n\n  get did(): AtprotoDid {\n    return this.sub\n  }\n\n  get serverMetadata(): Readonly<OAuthAuthorizationServerMetadata> {\n    return this.server.serverMetadata\n  }\n\n  /**\n   * @param refresh When `true`, the credentials will be refreshed even if they\n   * are not expired. When `false`, the credentials will not be refreshed even\n   * if they are expired. When `undefined`, the credentials will be refreshed\n   * if, and only if, they are (about to be) expired. Defaults to `undefined`.\n   */\n  protected async getTokenSet(refresh: boolean | 'auto'): Promise<TokenSet> {\n    const { tokenSet } = await this.sessionGetter.getSession(this.sub, refresh)\n\n    return tokenSet\n  }\n\n  async getTokenInfo(refresh: boolean | 'auto' = 'auto'): Promise<TokenInfo> {\n    const tokenSet = await this.getTokenSet(refresh)\n    const expiresAt =\n      tokenSet.expires_at == null ? undefined : new Date(tokenSet.expires_at)\n\n    return {\n      expiresAt,\n      get expired() {\n        return expiresAt == null\n          ? undefined\n          : expiresAt.getTime() < Date.now() - 5e3\n      },\n      scope: tokenSet.scope,\n      iss: tokenSet.iss,\n      aud: tokenSet.aud,\n      sub: tokenSet.sub,\n    }\n  }\n\n  async signOut(): Promise<void> {\n    try {\n      const tokenSet = await this.getTokenSet(false)\n      await this.server.revoke(tokenSet.access_token)\n    } finally {\n      await this.sessionGetter.delStored(\n        this.sub,\n        new TokenRevokedError(this.sub),\n      )\n    }\n  }\n\n  async fetchHandler(pathname: string, init?: RequestInit): Promise<Response> {\n    // This will try and refresh the token if it is known to be expired\n    const tokenSet = await this.getTokenSet('auto')\n\n    const initialUrl = new URL(pathname, tokenSet.aud satisfies string)\n    const initialAuth = `${tokenSet.token_type} ${tokenSet.access_token}`\n\n    const headers = new Headers(init?.headers)\n    headers.set('Authorization', initialAuth)\n\n    const initialResponse = await this.dpopFetch(initialUrl, {\n      ...init,\n      headers,\n    })\n\n    // If the token is not expired, we don't need to refresh it\n    if (!isInvalidTokenResponse(initialResponse)) {\n      return initialResponse\n    }\n\n    let tokenSetFresh: TokenSet\n    try {\n      // Force a refresh\n      tokenSetFresh = await this.getTokenSet(true)\n    } catch (err) {\n      return initialResponse\n    }\n\n    // The stream was already consumed. We cannot retry the request. A solution\n    // would be to tee() the input stream but that would bufferize the entire\n    // stream in memory which can lead to memory starvation. Instead, we will\n    // return the original response and let the calling code handle retries.\n    if (ReadableStream && init?.body instanceof ReadableStream) {\n      return initialResponse\n    }\n\n    const finalAuth = `${tokenSetFresh.token_type} ${tokenSetFresh.access_token}`\n    const finalUrl = new URL(pathname, tokenSetFresh.aud)\n\n    headers.set('Authorization', finalAuth)\n\n    const finalResponse = await this.dpopFetch(finalUrl, { ...init, headers })\n\n    // The token was successfully refreshed, but is still not accepted by the\n    // resource server. This might be due to the resource server not accepting\n    // credentials from the authorization server (e.g. because some migration\n    // occurred). Any ways, there is no point in keeping the session.\n    if (isInvalidTokenResponse(finalResponse)) {\n      // @TODO Is there a \"softer\" way to handle this, e.g. by marking the\n      // session as \"expired\" in the session store, allowing the user to trigger\n      // a new login (using login_hint)?\n      await this.sessionGetter.delStored(\n        this.sub,\n        new TokenInvalidError(this.sub),\n      )\n    }\n\n    return finalResponse\n  }\n}\n\n/**\n * @see {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3}\n * @see {@link https://datatracker.ietf.org/doc/html/rfc9449#name-resource-server-provided-no}\n */\nfunction isInvalidTokenResponse(response: Response) {\n  if (response.status !== 401) return false\n  const wwwAuth = response.headers.get('WWW-Authenticate')\n  return (\n    wwwAuth != null &&\n    (wwwAuth.startsWith('Bearer ') || wwwAuth.startsWith('DPoP ')) &&\n    wwwAuth.includes('error=\"invalid_token\"')\n  )\n}\n"]}

package/dist/runtime-implementation.d.ts

@@ -0,0 +1,17 @@
+import type { Key } from '@atproto/jwk';
+import type { Awaitable } from './util.js';
+export type { Key };
+export type RuntimeKeyFactory = (algs: string[]) => Key | PromiseLike<Key>;
+export type RuntimeRandomValues = (length: number) => Awaitable<Uint8Array>;
+export type DigestAlgorithm = {
+    name: 'sha256' | 'sha384' | 'sha512';
+};
+export type RuntimeDigest = (data: Uint8Array<ArrayBuffer>, alg: DigestAlgorithm) => Awaitable<Uint8Array>;
+export type RuntimeLock = <T>(name: string, fn: () => Awaitable<T>) => Awaitable<T>;
+export interface RuntimeImplementation {
+    createKey: RuntimeKeyFactory;
+    getRandomValues: RuntimeRandomValues;
+    digest: RuntimeDigest;
+    requestLock?: RuntimeLock;
+}
+//# sourceMappingURL=runtime-implementation.d.ts.map

package/dist/runtime-implementation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-implementation.d.ts","sourceRoot":"","sources":["../src/runtime-implementation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAE1C,YAAY,EAAE,GAAG,EAAE,CAAA;AACnB,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;AAE1E,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,UAAU,CAAC,CAAA;AAE3E,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;CAAE,CAAA;AACtE,MAAM,MAAM,aAAa,GAAG,CAC1B,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,EAC7B,GAAG,EAAE,eAAe,KACjB,SAAS,CAAC,UAAU,CAAC,CAAA;AAE1B,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,EAC1B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,SAAS,CAAC,CAAC,CAAC,KACnB,SAAS,CAAC,CAAC,CAAC,CAAA;AAEjB,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,iBAAiB,CAAA;IAC5B,eAAe,EAAE,mBAAmB,CAAA;IACpC,MAAM,EAAE,aAAa,CAAA;IACrB,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B"}

package/dist/runtime-implementation.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=runtime-implementation.js.map

package/dist/runtime-implementation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-implementation.js","sourceRoot":"","sources":["../src/runtime-implementation.ts"],"names":[],"mappings":"","sourcesContent":["import type { Key } from '@atproto/jwk'\nimport type { Awaitable } from './util.js'\n\nexport type { Key }\nexport type RuntimeKeyFactory = (algs: string[]) => Key | PromiseLike<Key>\n\nexport type RuntimeRandomValues = (length: number) => Awaitable<Uint8Array>\n\nexport type DigestAlgorithm = { name: 'sha256' | 'sha384' | 'sha512' }\nexport type RuntimeDigest = (\n  data: Uint8Array<ArrayBuffer>,\n  alg: DigestAlgorithm,\n) => Awaitable<Uint8Array>\n\nexport type RuntimeLock = <T>(\n  name: string,\n  fn: () => Awaitable<T>,\n) => Awaitable<T>\n\nexport interface RuntimeImplementation {\n  createKey: RuntimeKeyFactory\n  getRandomValues: RuntimeRandomValues\n  digest: RuntimeDigest\n  requestLock?: RuntimeLock\n}\n"]}

package/dist/runtime.d.ts

@@ -0,0 +1,26 @@
+import type { Jwk, Key } from '@atproto/jwk';
+import type { RuntimeImplementation, RuntimeLock } from './runtime-implementation.js';
+export declare class Runtime {
+    protected implementation: RuntimeImplementation;
+    readonly hasImplementationLock: boolean;
+    readonly usingLock: RuntimeLock;
+    constructor(implementation: RuntimeImplementation);
+    generateKey(algs: string[]): Promise<Key>;
+    sha256(text: string): Promise<string>;
+    generateNonce(length?: number): Promise<string>;
+    generatePKCE(byteLength?: number): Promise<{
+        verifier: string;
+        challenge: string;
+        method: 'S256';
+    }>;
+    calculateJwkThumbprint(jwk: Jwk): Promise<string>;
+    /**
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc7636#section-4.1}
+     * @note It is RECOMMENDED that the output of a suitable random number generator
+     * be used to create a 32-octet sequence. The octet sequence is then
+     * base64url-encoded to produce a 43-octet URL safe string to use as the code
+     * verifier.
+     */
+    protected generateVerifier(byteLength?: number): Promise<string>;
+}
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAE5C,OAAO,KAAK,EACV,qBAAqB,EACrB,WAAW,EACZ,MAAM,6BAA6B,CAAA;AAEpC,qBAAa,OAAO;IAIN,SAAS,CAAC,cAAc,EAAE,qBAAqB;IAH3D,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAA;IAE/B,YAAsB,cAAc,EAAE,qBAAqB,EAQ1D;IAEY,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAGrD;IAEY,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIjD;IAEY,aAAa,CAAC,MAAM,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAGvD;IAEY,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM;;;gBAKjC,MAAM;OAEjB;IAEY,sBAAsB,CAAC,GAAG,EAAE,GAAG,mBAI3C;IAED;;;;;;OAMG;IACH,UAAgB,gBAAgB,CAAC,UAAU,SAAK,mBAM/C;CACF"}

package/dist/runtime.js

@@ -0,0 +1,100 @@
+import { base64url } from 'multiformats/bases/base64';
+import { requestLocalLock } from './lock.js';
+export class Runtime {
+    constructor(implementation) {
+        this.implementation = implementation;
+        const { requestLock } = implementation;
+        this.hasImplementationLock = requestLock != null;
+        this.usingLock =
+            requestLock?.bind(implementation) ||
+                // Falling back to a local lock
+                requestLocalLock;
+    }
+    async generateKey(algs) {
+        const algsSorted = Array.from(algs).sort(compareAlgos);
+        return this.implementation.createKey(algsSorted);
+    }
+    async sha256(text) {
+        const bytes = new TextEncoder().encode(text);
+        const digest = await this.implementation.digest(bytes, { name: 'sha256' });
+        return base64url.baseEncode(digest);
+    }
+    async generateNonce(length = 16) {
+        const bytes = await this.implementation.getRandomValues(length);
+        return base64url.baseEncode(bytes);
+    }
+    async generatePKCE(byteLength) {
+        const verifier = await this.generateVerifier(byteLength);
+        return {
+            verifier,
+            challenge: await this.sha256(verifier),
+            method: 'S256',
+        };
+    }
+    async calculateJwkThumbprint(jwk) {
+        const components = extractJktComponents(jwk);
+        const data = JSON.stringify(components);
+        return this.sha256(data);
+    }
+    /**
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc7636#section-4.1}
+     * @note It is RECOMMENDED that the output of a suitable random number generator
+     * be used to create a 32-octet sequence. The octet sequence is then
+     * base64url-encoded to produce a 43-octet URL safe string to use as the code
+     * verifier.
+     */
+    async generateVerifier(byteLength = 32) {
+        if (byteLength < 32 || byteLength > 96) {
+            throw new TypeError('Invalid code_verifier length');
+        }
+        const bytes = await this.implementation.getRandomValues(byteLength);
+        return base64url.baseEncode(bytes);
+    }
+}
+function extractJktComponents(jwk) {
+    const get = (field) => {
+        const value = jwk[field];
+        if (typeof value !== 'string' || !value) {
+            throw new TypeError(`"${field}" Parameter missing or invalid`);
+        }
+        return value;
+    };
+    switch (jwk.kty) {
+        case 'EC':
+            return { crv: get('crv'), kty: get('kty'), x: get('x'), y: get('y') };
+        case 'OKP':
+            return { crv: get('crv'), kty: get('kty'), x: get('x') };
+        case 'RSA':
+            return { e: get('e'), kty: get('kty'), n: get('n') };
+        case 'oct':
+            return { k: get('k'), kty: get('kty') };
+        default:
+            throw new TypeError('"kty" (Key Type) Parameter missing or unsupported');
+    }
+}
+/**
+ * 256K > ES (256 > 384 > 512) > PS (256 > 384 > 512) > RS (256 > 384 > 512) > other (in original order)
+ */
+function compareAlgos(a, b) {
+    if (a === 'ES256K')
+        return -1;
+    if (b === 'ES256K')
+        return 1;
+    for (const prefix of ['ES', 'PS', 'RS']) {
+        if (a.startsWith(prefix)) {
+            if (b.startsWith(prefix)) {
+                const aLen = parseInt(a.slice(2, 5));
+                const bLen = parseInt(b.slice(2, 5));
+                // Prefer shorter key lengths
+                return aLen - bLen;
+            }
+            return -1;
+        }
+        else if (b.startsWith(prefix)) {
+            return 1;
+        }
+    }
+    // Don't know how to compare, keep original order
+    return 0;
+}
+//# sourceMappingURL=runtime.js.map

package/dist/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAM5C,MAAM,OAAO,OAAO;IAIlB,YAAsB,cAAqC;8BAArC,cAAc;QAClC,MAAM,EAAE,WAAW,EAAE,GAAG,cAAc,CAAA;QAEtC,IAAI,CAAC,qBAAqB,GAAG,WAAW,IAAI,IAAI,CAAA;QAChD,IAAI,CAAC,SAAS;YACZ,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;gBACjC,+BAA+B;gBAC/B,gBAAgB,CAAA;IACpB,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,IAAc;QACrC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACtD,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAClD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC1E,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE;QACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;QAC/D,OAAO,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,UAAmB;QAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;QACxD,OAAO;YACL,QAAQ;YACR,SAAS,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;YACtC,MAAM,EAAE,MAAe;SACxB,CAAA;IACH,CAAC;IAEM,KAAK,CAAC,sBAAsB,CAAC,GAAQ;QAC1C,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,gBAAgB,CAAC,UAAU,GAAG,EAAE;QAC9C,IAAI,UAAU,GAAG,EAAE,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAA;QACrD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,UAAU,CAAC,CAAA;QACnE,OAAO,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,GAA4B;IACxD,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,MAAM,IAAI,SAAS,CAAC,IAAI,KAAK,gCAAgC,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,QAAQ,GAAG,CAAC,GAAG,EAAE,CAAC;QAChB,KAAK,IAAI;YACP,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAA;QACvE,KAAK,KAAK;YACR,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAA;QAC1D,KAAK,KAAK;YACR,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAA;QACtD,KAAK,KAAK;YACR,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAA;QACzC;YACE,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAA;IAC5E,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,CAAA;IAC7B,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAA;IAE5B,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAEpC,6BAA6B;gBAC7B,OAAO,IAAI,GAAG,IAAI,CAAA;YACpB,CAAC;YACD,OAAO,CAAC,CAAC,CAAA;QACX,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,CAAA;QACV,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,OAAO,CAAC,CAAA;AACV,CAAC","sourcesContent":["import { base64url } from 'multiformats/bases/base64'\nimport type { Jwk, Key } from '@atproto/jwk'\nimport { requestLocalLock } from './lock.js'\nimport type {\n  RuntimeImplementation,\n  RuntimeLock,\n} from './runtime-implementation.js'\n\nexport class Runtime {\n  readonly hasImplementationLock: boolean\n  readonly usingLock: RuntimeLock\n\n  constructor(protected implementation: RuntimeImplementation) {\n    const { requestLock } = implementation\n\n    this.hasImplementationLock = requestLock != null\n    this.usingLock =\n      requestLock?.bind(implementation) ||\n      // Falling back to a local lock\n      requestLocalLock\n  }\n\n  public async generateKey(algs: string[]): Promise<Key> {\n    const algsSorted = Array.from(algs).sort(compareAlgos)\n    return this.implementation.createKey(algsSorted)\n  }\n\n  public async sha256(text: string): Promise<string> {\n    const bytes = new TextEncoder().encode(text)\n    const digest = await this.implementation.digest(bytes, { name: 'sha256' })\n    return base64url.baseEncode(digest)\n  }\n\n  public async generateNonce(length = 16): Promise<string> {\n    const bytes = await this.implementation.getRandomValues(length)\n    return base64url.baseEncode(bytes)\n  }\n\n  public async generatePKCE(byteLength?: number) {\n    const verifier = await this.generateVerifier(byteLength)\n    return {\n      verifier,\n      challenge: await this.sha256(verifier),\n      method: 'S256' as const,\n    }\n  }\n\n  public async calculateJwkThumbprint(jwk: Jwk) {\n    const components = extractJktComponents(jwk)\n    const data = JSON.stringify(components)\n    return this.sha256(data)\n  }\n\n  /**\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7636#section-4.1}\n   * @note It is RECOMMENDED that the output of a suitable random number generator\n   * be used to create a 32-octet sequence. The octet sequence is then\n   * base64url-encoded to produce a 43-octet URL safe string to use as the code\n   * verifier.\n   */\n  protected async generateVerifier(byteLength = 32) {\n    if (byteLength < 32 || byteLength > 96) {\n      throw new TypeError('Invalid code_verifier length')\n    }\n    const bytes = await this.implementation.getRandomValues(byteLength)\n    return base64url.baseEncode(bytes)\n  }\n}\n\nfunction extractJktComponents(jwk: Record<string, unknown>) {\n  const get = (field: string) => {\n    const value = jwk[field]\n    if (typeof value !== 'string' || !value) {\n      throw new TypeError(`\"${field}\" Parameter missing or invalid`)\n    }\n    return value\n  }\n\n  switch (jwk.kty) {\n    case 'EC':\n      return { crv: get('crv'), kty: get('kty'), x: get('x'), y: get('y') }\n    case 'OKP':\n      return { crv: get('crv'), kty: get('kty'), x: get('x') }\n    case 'RSA':\n      return { e: get('e'), kty: get('kty'), n: get('n') }\n    case 'oct':\n      return { k: get('k'), kty: get('kty') }\n    default:\n      throw new TypeError('\"kty\" (Key Type) Parameter missing or unsupported')\n  }\n}\n\n/**\n * 256K > ES (256 > 384 > 512) > PS (256 > 384 > 512) > RS (256 > 384 > 512) > other (in original order)\n */\nfunction compareAlgos(a: string, b: string): number {\n  if (a === 'ES256K') return -1\n  if (b === 'ES256K') return 1\n\n  for (const prefix of ['ES', 'PS', 'RS']) {\n    if (a.startsWith(prefix)) {\n      if (b.startsWith(prefix)) {\n        const aLen = parseInt(a.slice(2, 5))\n        const bLen = parseInt(b.slice(2, 5))\n\n        // Prefer shorter key lengths\n        return aLen - bLen\n      }\n      return -1\n    } else if (b.startsWith(prefix)) {\n      return 1\n    }\n  }\n\n  // Don't know how to compare, keep original order\n  return 0\n}\n"]}

package/dist/session-getter.d.ts

@@ -0,0 +1,44 @@
+import type { AtprotoDid } from '@atproto/did';
+import type { Key } from '@atproto/jwk';
+import { CachedGetter, type GetCachedOptions, type SimpleStore } from '@atproto-labs/simple-store';
+import { AuthMethodUnsatisfiableError } from './errors/auth-method-unsatisfiable-error.js';
+import { TokenInvalidError } from './errors/token-invalid-error.js';
+import { TokenRefreshError } from './errors/token-refresh-error.js';
+import { TokenRevokedError } from './errors/token-revoked-error.js';
+import type { ClientAuthMethod } from './oauth-client-auth.js';
+import type { TokenSet } from './oauth-server-agent.js';
+import type { OAuthServerFactory } from './oauth-server-factory.js';
+import type { Runtime } from './runtime.js';
+export type Session = {
+    dpopKey: Key;
+    authMethod: ClientAuthMethod;
+    tokenSet: TokenSet;
+};
+export type SessionStore = SimpleStore<string, Session>;
+export type SessionGetterOptions = {
+    onSessionUpdated?: (sub: AtprotoDid, session: Session) => void;
+    onSessionDeleted?: (sub: AtprotoDid, cause: TokenRefreshError | TokenRevokedError | TokenInvalidError | unknown) => void;
+};
+export declare function isExpectedSessionError(err: unknown): err is AuthMethodUnsatisfiableError | TokenInvalidError | TokenRefreshError | TokenRevokedError | TypeError;
+/**
+ * There are several advantages to wrapping the sessionStore in a (single)
+ * CachedGetter, the main of which is that the cached getter will ensure that at
+ * most one fresh call is ever being made. Another advantage, is that it
+ * contains the logic for reading from the cache which, if the cache is based on
+ * localStorage/indexedDB, will sync across multiple tabs (for a given sub).
+ */
+export declare class SessionGetter extends CachedGetter<AtprotoDid, Session> {
+    #private;
+    constructor(sessionStore: SessionStore, serverFactory: OAuthServerFactory, runtime: Runtime, options?: SessionGetterOptions);
+    setStored(sub: AtprotoDid, session: Session): Promise<void>;
+    delStored(sub: AtprotoDid, cause?: unknown): Promise<void>;
+    get(sub: AtprotoDid, options?: GetCachedOptions): Promise<Session>;
+    /**
+     * @param refresh When `true`, the credentials will be refreshed even if they
+     * are not expired. When `false`, the credentials will not be refreshed even
+     * if they are expired. When `undefined`, the credentials will be refreshed
+     * if, and only if, they are (about to be) expired. Defaults to `undefined`.
+     */
+    getSession(sub: AtprotoDid, refresh?: boolean | 'auto'): Promise<Session>;
+}
+//# sourceMappingURL=session-getter.d.ts.map

package/dist/session-getter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-getter.d.ts","sourceRoot":"","sources":["../src/session-getter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EACL,YAAY,EACZ,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAA;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAG3C,MAAM,MAAM,OAAO,GAAG;IACpB,OAAO,EAAE,GAAG,CAAA;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,QAAQ,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEvD,MAAM,MAAM,oBAAoB,GAAG;IACjC,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAA;IAC9D,gBAAgB,CAAC,EAAE,CACjB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,OAAO,KACvE,IAAI,CAAA;CACV,CAAA;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,+GAUlD;AAED;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC;;IAKlE,YACE,YAAY,EAAE,YAAY,EAC1B,aAAa,EAAE,kBAAkB,EACjC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,oBAAyB,EAwInC;IAEc,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,iBAqCzD;IAEc,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxE;IAEc,GAAG,CAChB,GAAG,EAAE,UAAU,EACf,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,OAAO,CAAC,CAuBlB;IAED;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,GAAE,OAAO,GAAG,MAAe,oBAKnE;CACF"}

package/dist/session-getter.js

@@ -0,0 +1,265 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+import { CachedGetter, } from '@atproto-labs/simple-store';
+import { AuthMethodUnsatisfiableError } from './errors/auth-method-unsatisfiable-error.js';
+import { TokenInvalidError } from './errors/token-invalid-error.js';
+import { TokenRefreshError } from './errors/token-refresh-error.js';
+import { TokenRevokedError } from './errors/token-revoked-error.js';
+import { OAuthResponseError } from './oauth-response-error.js';
+import { combineSignals, timeoutSignal } from './util.js';
+export function isExpectedSessionError(err) {
+    return (err instanceof TokenRefreshError ||
+        err instanceof TokenRevokedError ||
+        err instanceof TokenInvalidError ||
+        err instanceof AuthMethodUnsatisfiableError ||
+        // The stored session is invalid (e.g. missing properties) and cannot
+        // be used properly
+        err instanceof TypeError);
+}
+/**
+ * There are several advantages to wrapping the sessionStore in a (single)
+ * CachedGetter, the main of which is that the cached getter will ensure that at
+ * most one fresh call is ever being made. Another advantage, is that it
+ * contains the logic for reading from the cache which, if the cache is based on
+ * localStorage/indexedDB, will sync across multiple tabs (for a given sub).
+ */
+export class SessionGetter extends CachedGetter {
+    #serverFactory;
+    #runtime;
+    #options;
+    constructor(sessionStore, serverFactory, runtime, options = {}) {
+        super(async (sub, { signal }, storedSession) => {
+            // There needs to be a previous session to be able to refresh. If
+            // storedSession is undefined, it means that the store does not contain
+            // a session for the given sub.
+            if (storedSession === undefined) {
+                // Because the session is not in the store, this.delStored() method
+                // will not be called by the CachedGetter class (because there is
+                // nothing to delete). This would typically happen if there is no
+                // synchronization mechanism between instances of this class. Let's
+                // make sure an event is dispatched here if this occurs.
+                const msg = 'The session was deleted by another process';
+                const cause = new TokenRefreshError(sub, msg);
+                await options.onSessionDeleted?.call(null, sub, cause);
+                throw cause;
+            }
+            // @NOTE Throwing a TokenRefreshError (or any other error class defined
+            // in the deleteOnError options) will result in this.delStored() being
+            // called.
+            const { dpopKey, authMethod, tokenSet } = storedSession;
+            if (sub !== tokenSet.sub) {
+                // Fool-proofing (e.g. against invalid session storage)
+                throw new TokenRefreshError(sub, 'Stored session sub mismatch');
+            }
+            if (!tokenSet.refresh_token) {
+                throw new TokenRefreshError(sub, 'No refresh token available');
+            }
+            const server = await serverFactory.fromIssuer(tokenSet.iss, authMethod, dpopKey, { signal });
+            // Because refresh tokens can only be used once, we must not use the
+            // "signal" to abort the refresh, or throw any abort error beyond this
+            // point. Any thrown error beyond this point will prevent the
+            // TokenGetter from obtaining, and storing, the new token set,
+            // effectively rendering the currently saved session unusable.
+            signal?.throwIfAborted();
+            try {
+                const newTokenSet = await server.refresh(tokenSet);
+                if (sub !== newTokenSet.sub) {
+                    // The server returned another sub. Was the tokenSet manipulated?
+                    throw new TokenRefreshError(sub, 'Token set sub mismatch');
+                }
+                return {
+                    dpopKey,
+                    tokenSet: newTokenSet,
+                    authMethod: server.authMethod,
+                };
+            }
+            catch (cause) {
+                // Since refresh tokens can only be used once, we might run into
+                // concurrency issues if multiple instances (e.g. browser tabs) are
+                // trying to refresh the same token simultaneously. The chances of
+                // this happening when multiple instances are started simultaneously
+                // is reduced by randomizing the expiry time (see isStale() below).
+                // The best solution is to use a mutex/lock to ensure that only one
+                // instance is refreshing the token at a time (runtime.usingLock) but
+                // that is not always possible. Let's try to recover from concurrency
+                // issues, or force the session to be deleted by throwing a
+                // TokenRefreshError.
+                if (cause instanceof OAuthResponseError &&
+                    cause.status === 400 &&
+                    cause.error === 'invalid_grant') {
+                    // In case there is no lock implementation in the runtime, we will
+                    // wait for a short time to give the other concurrent instances a
+                    // chance to finish their refreshing of the token. If a concurrent
+                    // refresh did occur, we will pretend that this one succeeded.
+                    if (!runtime.hasImplementationLock) {
+                        await new Promise((r) => setTimeout(r, 1000));
+                        const stored = await this.getStored(sub);
+                        if (stored === undefined) {
+                            // A concurrent refresh occurred and caused the session to be
+                            // deleted (for a reason we can't know at this point).
+                            // Using a distinct error message mainly for debugging
+                            // purposes. Also, throwing a TokenRefreshError to trigger
+                            // deletion through the deleteOnError callback.
+                            const msg = 'The session was deleted by another process';
+                            throw new TokenRefreshError(sub, msg, { cause });
+                        }
+                        else if (stored.tokenSet.access_token !== tokenSet.access_token ||
+                            stored.tokenSet.refresh_token !== tokenSet.refresh_token) {
+                            // A concurrent refresh occurred. Pretend this one succeeded.
+                            return stored;
+                        }
+                        else {
+                            // There were no concurrent refresh. The token is (likely)
+                            // simply no longer valid.
+                        }
+                    }
+                    // Make sure the session gets deleted from the store
+                    const msg = cause.errorDescription ?? 'The session was revoked';
+                    throw new TokenRefreshError(sub, msg, { cause });
+                }
+                throw cause;
+            }
+        }, sessionStore, {
+            isStale: (sub, { tokenSet }) => {
+                return (tokenSet.expires_at != null &&
+                    new Date(tokenSet.expires_at).getTime() <
+                        Date.now() +
+                            // Add some lee way to ensure the token is not expired when it
+                            // reaches the server.
+                            10e3 +
+                            // Add some randomness to reduce the chances of multiple
+                            // instances trying to refresh the token at the same.
+                            30e3 * Math.random());
+            },
+            deleteOnError: isExpectedSessionError,
+        });
+        this.#serverFactory = serverFactory;
+        this.#runtime = runtime;
+        this.#options = options;
+    }
+    async setStored(sub, session) {
+        // Prevent tampering with the stored value
+        if (sub !== session.tokenSet.sub) {
+            throw new Error('Token set does not match the expected sub');
+        }
+        try {
+            await super.setStored(sub, session);
+        }
+        catch (err) {
+            // If we fail to persist the session, we assume that we won't be able to
+            // fetch it again. We don't want to leave the session in a "limbo" state,
+            // so we proactively revoke the session and delete it from the store.
+            const errors = [err];
+            try {
+                const { tokenSet, dpopKey, authMethod } = session;
+                const server = await this.#serverFactory.fromIssuer(tokenSet.iss, authMethod, dpopKey);
+                await server.revoke(tokenSet.refresh_token ?? tokenSet.access_token);
+            }
+            catch (err) {
+                errors.push(err);
+            }
+            try {
+                await this.delStored(sub, err);
+            }
+            catch (err) {
+                errors.push(err);
+            }
+            throw new AggregateError(errors, `Failed to store session for ${sub}`);
+        }
+        await this.#options.onSessionUpdated?.call(null, sub, session);
+    }
+    async delStored(sub, cause) {
+        await super.delStored(sub, cause);
+        await this.#options.onSessionDeleted?.call(null, sub, cause);
+    }
+    async get(sub, options) {
+        const session = await this.#runtime.usingLock(`@atproto-oauth-client-${sub}`, async () => {
+            const env_1 = { stack: [], error: void 0, hasError: false };
+            try {
+                // Make sure, even if there is no signal in the options, that the
+                // request will be cancelled after at most 30 seconds.
+                const signal = timeoutSignal(30e3);
+                const abortController = __addDisposableResource(env_1, combineSignals([options?.signal, signal]), false);
+                return await super.get(sub, {
+                    ...options,
+                    signal: abortController.signal,
+                });
+            }
+            catch (e_1) {
+                env_1.error = e_1;
+                env_1.hasError = true;
+            }
+            finally {
+                __disposeResources(env_1);
+            }
+        });
+        if (sub !== session.tokenSet.sub) {
+            // Fool-proofing (e.g. against invalid session storage)
+            throw new Error('Token set does not match the expected sub');
+        }
+        return session;
+    }
+    /**
+     * @param refresh When `true`, the credentials will be refreshed even if they
+     * are not expired. When `false`, the credentials will not be refreshed even
+     * if they are expired. When `undefined`, the credentials will be refreshed
+     * if, and only if, they are (about to be) expired. Defaults to `undefined`.
+     */
+    async getSession(sub, refresh = 'auto') {
+        return this.get(sub, {
+            noCache: refresh === true,
+            allowStale: refresh === false,
+        });
+    }
+}
+//# sourceMappingURL=session-getter.js.map