@atproto/oauth-client 0.0.0-spaces-alpha-20260818021221

package/dist/session-getter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-getter.js","sourceRoot":"","sources":["../src/session-getter.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,OAAO,EACL,YAAY,GAGb,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAA;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAI9D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAkBzD,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,OAAO,CACL,GAAG,YAAY,iBAAiB;QAChC,GAAG,YAAY,iBAAiB;QAChC,GAAG,YAAY,iBAAiB;QAChC,GAAG,YAAY,4BAA4B;QAC3C,qEAAqE;QACrE,mBAAmB;QACnB,GAAG,YAAY,SAAS,CACzB,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,aAAc,SAAQ,YAAiC;IACzD,cAAc,CAAoB;IAClC,QAAQ,CAAS;IACjB,QAAQ,CAAsB;IAEvC,YACE,YAA0B,EAC1B,aAAiC,EACjC,OAAgB,EAChB,OAAO,GAAyB,EAAE;QAElC,KAAK,CACH,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE;YACvC,iEAAiE;YACjE,uEAAuE;YACvE,+BAA+B;YAC/B,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,mEAAmE;gBACnE,iEAAiE;gBACjE,iEAAiE;gBACjE,mEAAmE;gBACnE,wDAAwD;gBACxD,MAAM,GAAG,GAAG,4CAA4C,CAAA;gBACxD,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBAC7C,MAAM,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;gBACtD,MAAM,KAAK,CAAA;YACb,CAAC;YAED,uEAAuE;YACvE,sEAAsE;YACtE,UAAU;YAEV,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAA;YAEvD,IAAI,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACzB,uDAAuD;gBACvD,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAA;YACjE,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC5B,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAA;YAChE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAC3C,QAAQ,CAAC,GAAG,EACZ,UAAU,EACV,OAAO,EACP,EAAE,MAAM,EAAE,CACX,CAAA;YAED,oEAAoE;YACpE,sEAAsE;YACtE,6DAA6D;YAC7D,8DAA8D;YAC9D,8DAA8D;YAC9D,MAAM,EAAE,cAAc,EAAE,CAAA;YAExB,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;gBAElD,IAAI,GAAG,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;oBAC5B,iEAAiE;oBACjE,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAA;gBAC5D,CAAC;gBAED,OAAO;oBACL,OAAO;oBACP,QAAQ,EAAE,WAAW;oBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAA;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,gEAAgE;gBAChE,mEAAmE;gBACnE,kEAAkE;gBAClE,oEAAoE;gBACpE,mEAAmE;gBACnE,mEAAmE;gBACnE,qEAAqE;gBACrE,qEAAqE;gBACrE,2DAA2D;gBAC3D,qBAAqB;gBACrB,IACE,KAAK,YAAY,kBAAkB;oBACnC,KAAK,CAAC,MAAM,KAAK,GAAG;oBACpB,KAAK,CAAC,KAAK,KAAK,eAAe,EAC/B,CAAC;oBACD,kEAAkE;oBAClE,iEAAiE;oBACjE,kEAAkE;oBAClE,8DAA8D;oBAC9D,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;wBACnC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;wBAE7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;wBACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;4BACzB,6DAA6D;4BAC7D,sDAAsD;4BAEtD,sDAAsD;4BACtD,0DAA0D;4BAC1D,+CAA+C;4BAC/C,MAAM,GAAG,GAAG,4CAA4C,CAAA;4BACxD,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;wBAClD,CAAC;6BAAM,IACL,MAAM,CAAC,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;4BACtD,MAAM,CAAC,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,EACxD,CAAC;4BACD,6DAA6D;4BAC7D,OAAO,MAAM,CAAA;wBACf,CAAC;6BAAM,CAAC;4BACN,0DAA0D;4BAC1D,0BAA0B;wBAC5B,CAAC;oBACH,CAAC;oBAED,oDAAoD;oBACpD,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB,IAAI,yBAAyB,CAAA;oBAC/D,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;gBAClD,CAAC;gBAED,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC,EACD,YAAY,EACZ;YACE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;gBAC7B,OAAO,CACL,QAAQ,CAAC,UAAU,IAAI,IAAI;oBAC3B,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;wBACrC,IAAI,CAAC,GAAG,EAAE;4BACR,8DAA8D;4BAC9D,sBAAsB;4BACtB,IAAI;4BACJ,wDAAwD;4BACxD,qDAAqD;4BACrD,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CACzB,CAAA;YACH,CAAC;YACD,aAAa,EAAE,sBAAsB;SACtC,CACF,CAAA;QAED,IAAI,CAAC,cAAc,GAAG,aAAa,CAAA;QACnC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;IACzB,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,GAAe,EAAE,OAAgB;QACxD,0CAA0C;QAC1C,IAAI,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,yEAAyE;YACzE,qEAAqE;YAErE,MAAM,MAAM,GAAc,CAAC,GAAG,CAAC,CAAA;YAE/B,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;gBACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CACjD,QAAQ,CAAC,GAAG,EACZ,UAAU,EACV,OAAO,CACR,CAAA;gBACD,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAA;YACtE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAClB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAClB,CAAC;YAED,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,+BAA+B,GAAG,EAAE,CAAC,CAAA;QACxE,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAChE,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,GAAe,EAAE,KAAe;QACvD,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IAC9D,CAAC;IAEQ,KAAK,CAAC,GAAG,CAChB,GAAe,EACf,OAA0B;QAE1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAC3C,yBAAyB,GAAG,EAAE,EAC9B,KAAK,IAAI,EAAE;;;gBACT,iEAAiE;gBACjE,sDAAsD;gBACtD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;gBAElC,MAAM,eAAe,kCAAG,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAA,CAAA;gBAEjE,OAAO,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;oBAC1B,GAAG,OAAO;oBACV,MAAM,EAAE,eAAe,CAAC,MAAM;iBAC/B,CAAC,CAAA;;;;;;;;;QACJ,CAAC,CACF,CAAA;QAED,IAAI,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjC,uDAAuD;YACvD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,GAAe,EAAE,OAAO,GAAqB,MAAM;QAClE,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;YACnB,OAAO,EAAE,OAAO,KAAK,IAAI;YACzB,UAAU,EAAE,OAAO,KAAK,KAAK;SAC9B,CAAC,CAAA;IACJ,CAAC;CACF","sourcesContent":["import type { AtprotoDid } from '@atproto/did'\nimport type { Key } from '@atproto/jwk'\nimport {\n  CachedGetter,\n  type GetCachedOptions,\n  type SimpleStore,\n} from '@atproto-labs/simple-store'\nimport { AuthMethodUnsatisfiableError } from './errors/auth-method-unsatisfiable-error.js'\nimport { TokenInvalidError } from './errors/token-invalid-error.js'\nimport { TokenRefreshError } from './errors/token-refresh-error.js'\nimport { TokenRevokedError } from './errors/token-revoked-error.js'\nimport type { ClientAuthMethod } from './oauth-client-auth.js'\nimport { OAuthResponseError } from './oauth-response-error.js'\nimport type { TokenSet } from './oauth-server-agent.js'\nimport type { OAuthServerFactory } from './oauth-server-factory.js'\nimport type { Runtime } from './runtime.js'\nimport { combineSignals, timeoutSignal } from './util.js'\n\nexport type Session = {\n  dpopKey: Key\n  authMethod: ClientAuthMethod\n  tokenSet: TokenSet\n}\n\nexport type SessionStore = SimpleStore<string, Session>\n\nexport type SessionGetterOptions = {\n  onSessionUpdated?: (sub: AtprotoDid, session: Session) => void\n  onSessionDeleted?: (\n    sub: AtprotoDid,\n    cause: TokenRefreshError | TokenRevokedError | TokenInvalidError | unknown,\n  ) => void\n}\n\nexport function isExpectedSessionError(err: unknown) {\n  return (\n    err instanceof TokenRefreshError ||\n    err instanceof TokenRevokedError ||\n    err instanceof TokenInvalidError ||\n    err instanceof AuthMethodUnsatisfiableError ||\n    // The stored session is invalid (e.g. missing properties) and cannot\n    // be used properly\n    err instanceof TypeError\n  )\n}\n\n/**\n * There are several advantages to wrapping the sessionStore in a (single)\n * CachedGetter, the main of which is that the cached getter will ensure that at\n * most one fresh call is ever being made. Another advantage, is that it\n * contains the logic for reading from the cache which, if the cache is based on\n * localStorage/indexedDB, will sync across multiple tabs (for a given sub).\n */\nexport class SessionGetter extends CachedGetter<AtprotoDid, Session> {\n  readonly #serverFactory: OAuthServerFactory\n  readonly #runtime: Runtime\n  readonly #options: SessionGetterOptions\n\n  constructor(\n    sessionStore: SessionStore,\n    serverFactory: OAuthServerFactory,\n    runtime: Runtime,\n    options: SessionGetterOptions = {},\n  ) {\n    super(\n      async (sub, { signal }, storedSession) => {\n        // There needs to be a previous session to be able to refresh. If\n        // storedSession is undefined, it means that the store does not contain\n        // a session for the given sub.\n        if (storedSession === undefined) {\n          // Because the session is not in the store, this.delStored() method\n          // will not be called by the CachedGetter class (because there is\n          // nothing to delete). This would typically happen if there is no\n          // synchronization mechanism between instances of this class. Let's\n          // make sure an event is dispatched here if this occurs.\n          const msg = 'The session was deleted by another process'\n          const cause = new TokenRefreshError(sub, msg)\n          await options.onSessionDeleted?.call(null, sub, cause)\n          throw cause\n        }\n\n        // @NOTE Throwing a TokenRefreshError (or any other error class defined\n        // in the deleteOnError options) will result in this.delStored() being\n        // called.\n\n        const { dpopKey, authMethod, tokenSet } = storedSession\n\n        if (sub !== tokenSet.sub) {\n          // Fool-proofing (e.g. against invalid session storage)\n          throw new TokenRefreshError(sub, 'Stored session sub mismatch')\n        }\n\n        if (!tokenSet.refresh_token) {\n          throw new TokenRefreshError(sub, 'No refresh token available')\n        }\n\n        const server = await serverFactory.fromIssuer(\n          tokenSet.iss,\n          authMethod,\n          dpopKey,\n          { signal },\n        )\n\n        // Because refresh tokens can only be used once, we must not use the\n        // \"signal\" to abort the refresh, or throw any abort error beyond this\n        // point. Any thrown error beyond this point will prevent the\n        // TokenGetter from obtaining, and storing, the new token set,\n        // effectively rendering the currently saved session unusable.\n        signal?.throwIfAborted()\n\n        try {\n          const newTokenSet = await server.refresh(tokenSet)\n\n          if (sub !== newTokenSet.sub) {\n            // The server returned another sub. Was the tokenSet manipulated?\n            throw new TokenRefreshError(sub, 'Token set sub mismatch')\n          }\n\n          return {\n            dpopKey,\n            tokenSet: newTokenSet,\n            authMethod: server.authMethod,\n          }\n        } catch (cause) {\n          // Since refresh tokens can only be used once, we might run into\n          // concurrency issues if multiple instances (e.g. browser tabs) are\n          // trying to refresh the same token simultaneously. The chances of\n          // this happening when multiple instances are started simultaneously\n          // is reduced by randomizing the expiry time (see isStale() below).\n          // The best solution is to use a mutex/lock to ensure that only one\n          // instance is refreshing the token at a time (runtime.usingLock) but\n          // that is not always possible. Let's try to recover from concurrency\n          // issues, or force the session to be deleted by throwing a\n          // TokenRefreshError.\n          if (\n            cause instanceof OAuthResponseError &&\n            cause.status === 400 &&\n            cause.error === 'invalid_grant'\n          ) {\n            // In case there is no lock implementation in the runtime, we will\n            // wait for a short time to give the other concurrent instances a\n            // chance to finish their refreshing of the token. If a concurrent\n            // refresh did occur, we will pretend that this one succeeded.\n            if (!runtime.hasImplementationLock) {\n              await new Promise((r) => setTimeout(r, 1000))\n\n              const stored = await this.getStored(sub)\n              if (stored === undefined) {\n                // A concurrent refresh occurred and caused the session to be\n                // deleted (for a reason we can't know at this point).\n\n                // Using a distinct error message mainly for debugging\n                // purposes. Also, throwing a TokenRefreshError to trigger\n                // deletion through the deleteOnError callback.\n                const msg = 'The session was deleted by another process'\n                throw new TokenRefreshError(sub, msg, { cause })\n              } else if (\n                stored.tokenSet.access_token !== tokenSet.access_token ||\n                stored.tokenSet.refresh_token !== tokenSet.refresh_token\n              ) {\n                // A concurrent refresh occurred. Pretend this one succeeded.\n                return stored\n              } else {\n                // There were no concurrent refresh. The token is (likely)\n                // simply no longer valid.\n              }\n            }\n\n            // Make sure the session gets deleted from the store\n            const msg = cause.errorDescription ?? 'The session was revoked'\n            throw new TokenRefreshError(sub, msg, { cause })\n          }\n\n          throw cause\n        }\n      },\n      sessionStore,\n      {\n        isStale: (sub, { tokenSet }) => {\n          return (\n            tokenSet.expires_at != null &&\n            new Date(tokenSet.expires_at).getTime() <\n              Date.now() +\n                // Add some lee way to ensure the token is not expired when it\n                // reaches the server.\n                10e3 +\n                // Add some randomness to reduce the chances of multiple\n                // instances trying to refresh the token at the same.\n                30e3 * Math.random()\n          )\n        },\n        deleteOnError: isExpectedSessionError,\n      },\n    )\n\n    this.#serverFactory = serverFactory\n    this.#runtime = runtime\n    this.#options = options\n  }\n\n  override async setStored(sub: AtprotoDid, session: Session) {\n    // Prevent tampering with the stored value\n    if (sub !== session.tokenSet.sub) {\n      throw new Error('Token set does not match the expected sub')\n    }\n\n    try {\n      await super.setStored(sub, session)\n    } catch (err) {\n      // If we fail to persist the session, we assume that we won't be able to\n      // fetch it again. We don't want to leave the session in a \"limbo\" state,\n      // so we proactively revoke the session and delete it from the store.\n\n      const errors: unknown[] = [err]\n\n      try {\n        const { tokenSet, dpopKey, authMethod } = session\n        const server = await this.#serverFactory.fromIssuer(\n          tokenSet.iss,\n          authMethod,\n          dpopKey,\n        )\n        await server.revoke(tokenSet.refresh_token ?? tokenSet.access_token)\n      } catch (err) {\n        errors.push(err)\n      }\n\n      try {\n        await this.delStored(sub, err)\n      } catch (err) {\n        errors.push(err)\n      }\n\n      throw new AggregateError(errors, `Failed to store session for ${sub}`)\n    }\n\n    await this.#options.onSessionUpdated?.call(null, sub, session)\n  }\n\n  override async delStored(sub: AtprotoDid, cause?: unknown): Promise<void> {\n    await super.delStored(sub, cause)\n    await this.#options.onSessionDeleted?.call(null, sub, cause)\n  }\n\n  override async get(\n    sub: AtprotoDid,\n    options?: GetCachedOptions,\n  ): Promise<Session> {\n    const session = await this.#runtime.usingLock(\n      `@atproto-oauth-client-${sub}`,\n      async () => {\n        // Make sure, even if there is no signal in the options, that the\n        // request will be cancelled after at most 30 seconds.\n        const signal = timeoutSignal(30e3)\n\n        using abortController = combineSignals([options?.signal, signal])\n\n        return await super.get(sub, {\n          ...options,\n          signal: abortController.signal,\n        })\n      },\n    )\n\n    if (sub !== session.tokenSet.sub) {\n      // Fool-proofing (e.g. against invalid session storage)\n      throw new Error('Token set does not match the expected sub')\n    }\n\n    return session\n  }\n\n  /**\n   * @param refresh When `true`, the credentials will be refreshed even if they\n   * are not expired. When `false`, the credentials will not be refreshed even\n   * if they are expired. When `undefined`, the credentials will be refreshed\n   * if, and only if, they are (about to be) expired. Defaults to `undefined`.\n   */\n  async getSession(sub: AtprotoDid, refresh: boolean | 'auto' = 'auto') {\n    return this.get(sub, {\n      noCache: refresh === true,\n      allowStale: refresh === false,\n    })\n  }\n}\n"]}

package/dist/state-store.d.ts

@@ -0,0 +1,23 @@
+import type { Key } from '@atproto/jwk';
+import type { SimpleStore } from '@atproto-labs/simple-store';
+import type { ClientAuthMethod } from './oauth-client-auth.js';
+export type InternalStateData = {
+    iss: string;
+    dpopKey: Key;
+    authMethod: ClientAuthMethod;
+    verifier: string;
+    appState?: string;
+};
+/**
+ * A store pending oauth authorization flows. The key is the "state" parameter
+ * used in the authorization request, and the value is an object containing the
+ * necessary information to complete the flow once the user is redirected back
+ * to the client.
+ *
+ * @note The data stored in this store is typically short-lived. It should be
+ * automatically cleared after a certain period of time (e.g. 1 hour) to prevent
+ * the store from growing indefinitely. It is up to the implementation to
+ * implement this cleanup mechanism.
+ */
+export type StateStore = SimpleStore<string, InternalStateData>;
+//# sourceMappingURL=state-store.d.ts.map

package/dist/state-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-store.d.ts","sourceRoot":"","sources":["../src/state-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,GAAG,CAAA;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA"}

package/dist/state-store.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=state-store.js.map

package/dist/state-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-store.js","sourceRoot":"","sources":["../src/state-store.ts"],"names":[],"mappings":"","sourcesContent":["import type { Key } from '@atproto/jwk'\nimport type { SimpleStore } from '@atproto-labs/simple-store'\nimport type { ClientAuthMethod } from './oauth-client-auth.js'\n\nexport type InternalStateData = {\n  iss: string\n  dpopKey: Key\n  authMethod: ClientAuthMethod\n  verifier: string\n  appState?: string\n}\n\n/**\n * A store pending oauth authorization flows. The key is the \"state\" parameter\n * used in the authorization request, and the value is an object containing the\n * necessary information to complete the flow once the user is redirected back\n * to the client.\n *\n * @note The data stored in this store is typically short-lived. It should be\n * automatically cleared after a certain period of time (e.g. 1 hour) to prevent\n * the store from growing indefinitely. It is up to the implementation to\n * implement this cleanup mechanism.\n */\nexport type StateStore = SimpleStore<string, InternalStateData>\n"]}

package/dist/types.d.ts

@@ -0,0 +1,430 @@
+import { type TypeOf, z } from 'zod';
+import { type OAuthAuthorizationRequestParameters } from '@atproto/oauth-types';
+import type { Simplify } from './util.js';
+export type AuthorizeOptions = Simplify<Omit<OAuthAuthorizationRequestParameters, 'client_id' | 'response_mode' | 'response_type' | 'login_hint' | 'code_challenge' | 'code_challenge_method'> & {
+    signal?: AbortSignal;
+}>;
+export type CallbackOptions = Simplify<Partial<Pick<OAuthAuthorizationRequestParameters, 'redirect_uri'>>>;
+export declare const clientMetadataSchema: z.ZodObject<z.objectUtil.extendShape<{
+    redirect_uris: z.ZodArray<z.ZodEffects<z.ZodString, "http://127.0.0.1" | `${string}.${string}:/${string}` | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `https://${string}`, string>, "atleastone">;
+    response_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["code", "token", "none", "code id_token token", "code id_token", "code token", "id_token token", "id_token"]>, "atleastone">>;
+    grant_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["authorization_code", "implicit", "refresh_token", "password", "client_credentials", "urn:ietf:params:oauth:grant-type:jwt-bearer", "urn:ietf:params:oauth:grant-type:saml2-bearer"]>, "atleastone">>;
+    scope: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    token_endpoint_auth_method: z.ZodDefault<z.ZodEnum<["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"]>>;
+    token_endpoint_auth_signing_alg: z.ZodOptional<z.ZodString>;
+    userinfo_signed_response_alg: z.ZodOptional<z.ZodString>;
+    userinfo_encrypted_response_alg: z.ZodOptional<z.ZodString>;
+    jwks_uri: z.ZodOptional<z.ZodEffects<z.ZodString, "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}`, string>>;
+    jwks: z.ZodOptional<z.ZodObject<{
+        keys: z.ZodEffects<z.ZodArray<z.ZodUnknown, "many">, ((({
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "RSA";
+            alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
+            n: string;
+            e: string;
+            d?: string | undefined;
+            p?: string | undefined;
+            q?: string | undefined;
+            dp?: string | undefined;
+            dq?: string | undefined;
+            qi?: string | undefined;
+            oth?: {
+                r?: string | undefined;
+                d?: string | undefined;
+                t?: string | undefined;
+            }[] | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        }) | ({
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "EC";
+            alg?: "ES256" | "ES384" | "ES512" | undefined;
+            crv: "P-256" | "P-384" | "P-521";
+            x: string;
+            y: string;
+            d?: string | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        }) | ({
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "EC";
+            alg?: "ES256K" | undefined;
+            crv: "secp256k1";
+            x: string;
+            y: string;
+            d?: string | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        }) | ({
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "OKP";
+            alg?: "EdDSA" | undefined;
+            crv: "Ed25519" | "Ed448";
+            x: string;
+            d?: string | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        })) & {
+            d?: never;
+        })[], unknown[]>;
+    }, "strip", z.ZodTypeAny, {
+        keys: ((({
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "RSA";
+            alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
+            n: string;
+            e: string;
+            d?: string | undefined;
+            p?: string | undefined;
+            q?: string | undefined;
+            dp?: string | undefined;
+            dq?: string | undefined;
+            qi?: string | undefined;
+            oth?: {
+                r?: string | undefined;
+                d?: string | undefined;
+                t?: string | undefined;
+            }[] | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        }) | ({
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "EC";
+            alg?: "ES256" | "ES384" | "ES512" | undefined;
+            crv: "P-256" | "P-384" | "P-521";
+            x: string;
+            y: string;
+            d?: string | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        }) | ({
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "EC";
+            alg?: "ES256K" | undefined;
+            crv: "secp256k1";
+            x: string;
+            y: string;
+            d?: string | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        }) | ({
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "OKP";
+            alg?: "EdDSA" | undefined;
+            crv: "Ed25519" | "Ed448";
+            x: string;
+            d?: string | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        })) & {
+            d?: never;
+        })[];
+    }, {
+        keys: unknown[];
+    }>>;
+    application_type: z.ZodDefault<z.ZodEnum<["web", "native"]>>;
+    subject_type: z.ZodDefault<z.ZodEnum<["public", "pairwise"]>>;
+    request_object_signing_alg: z.ZodOptional<z.ZodString>;
+    id_token_signed_response_alg: z.ZodOptional<z.ZodString>;
+    authorization_signed_response_alg: z.ZodDefault<z.ZodString>;
+    authorization_encrypted_response_enc: z.ZodOptional<z.ZodEnum<["A128CBC-HS256"]>>;
+    authorization_encrypted_response_alg: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_name: z.ZodOptional<z.ZodString>;
+    client_uri: z.ZodOptional<z.ZodEffects<z.ZodString, "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}`, string>>;
+    policy_uri: z.ZodOptional<z.ZodEffects<z.ZodString, "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}`, string>>;
+    tos_uri: z.ZodOptional<z.ZodEffects<z.ZodString, "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}`, string>>;
+    logo_uri: z.ZodOptional<z.ZodEffects<z.ZodString, "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}`, string>>;
+    default_max_age: z.ZodOptional<z.ZodNumber>;
+    require_auth_time: z.ZodOptional<z.ZodBoolean>;
+    contacts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    tls_client_certificate_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
+    dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
+    authorization_details_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, {
+    client_id: z.ZodUnion<[z.ZodEffects<z.ZodIntersection<z.ZodString, z.ZodEffects<z.ZodEffects<z.ZodString, `${string}:${string}`, string>, `https://${string}`, string>>, `https://${string}/${string}`, string>, z.ZodEffects<z.ZodString, "http://localhost" | "http://localhost/" | `http://localhost/?${string}` | `http://localhost?${string}`, string>]>;
+}>, "strip", z.ZodTypeAny, {
+    redirect_uris: ["http://127.0.0.1" | `${string}.${string}:/${string}` | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `https://${string}`, ...("http://127.0.0.1" | `${string}.${string}:/${string}` | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `https://${string}`)[]];
+    response_types: ["code" | "code id_token" | "code id_token token" | "code token" | "id_token" | "id_token token" | "none" | "token", ...("code" | "code id_token" | "code id_token token" | "code token" | "id_token" | "id_token token" | "none" | "token")[]];
+    grant_types: ["authorization_code" | "client_credentials" | "implicit" | "password" | "refresh_token" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer", ...("authorization_code" | "client_credentials" | "implicit" | "password" | "refresh_token" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer")[]];
+    scope?: string | undefined;
+    token_endpoint_auth_method: "client_secret_basic" | "client_secret_jwt" | "client_secret_post" | "none" | "private_key_jwt" | "self_signed_tls_client_auth" | "tls_client_auth";
+    token_endpoint_auth_signing_alg?: string | undefined;
+    userinfo_signed_response_alg?: string | undefined;
+    userinfo_encrypted_response_alg?: string | undefined;
+    jwks_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
+    jwks?: {
+        keys: ((({
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "RSA";
+            alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
+            n: string;
+            e: string;
+            d?: string | undefined;
+            p?: string | undefined;
+            q?: string | undefined;
+            dp?: string | undefined;
+            dq?: string | undefined;
+            qi?: string | undefined;
+            oth?: {
+                r?: string | undefined;
+                d?: string | undefined;
+                t?: string | undefined;
+            }[] | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        }) | ({
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "EC";
+            alg?: "ES256" | "ES384" | "ES512" | undefined;
+            crv: "P-256" | "P-384" | "P-521";
+            x: string;
+            y: string;
+            d?: string | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        }) | ({
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "EC";
+            alg?: "ES256K" | undefined;
+            crv: "secp256k1";
+            x: string;
+            y: string;
+            d?: string | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        }) | ({
+            kid?: string | undefined;
+            use?: "enc" | "sig" | undefined;
+            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
+            x5c?: string[] | undefined;
+            x5t?: string | undefined;
+            'x5t#S256'?: string | undefined;
+            x5u?: string | undefined;
+            ext?: boolean | undefined;
+            iat?: number | undefined;
+            exp?: number | undefined;
+            nbf?: number | undefined;
+            revoked?: {
+                revoked_at: number;
+                reason?: string | undefined;
+            } | undefined;
+            kty: "OKP";
+            alg?: "EdDSA" | undefined;
+            crv: "Ed25519" | "Ed448";
+            x: string;
+            d?: string | undefined;
+        } & {
+            kid: NonNullable<unknown>;
+        })) & {
+            d?: never;
+        })[];
+    } | undefined;
+    application_type: "native" | "web";
+    subject_type: "pairwise" | "public";
+    request_object_signing_alg?: string | undefined;
+    id_token_signed_response_alg?: string | undefined;
+    authorization_signed_response_alg: string;
+    authorization_encrypted_response_enc?: "A128CBC-HS256" | undefined;
+    authorization_encrypted_response_alg?: string | undefined;
+    client_name?: string | undefined;
+    client_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
+    policy_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
+    tos_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
+    logo_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
+    default_max_age?: number | undefined;
+    require_auth_time?: boolean | undefined;
+    contacts?: string[] | undefined;
+    tls_client_certificate_bound_access_tokens?: boolean | undefined;
+    dpop_bound_access_tokens?: boolean | undefined;
+    authorization_details_types?: string[] | undefined;
+    client_id: "http://localhost" | "http://localhost/" | `http://localhost/?${string}` | `http://localhost?${string}` | `https://${string}/${string}`;
+}, {
+    redirect_uris: [string, ...string[]];
+    response_types?: ["code" | "code id_token" | "code id_token token" | "code token" | "id_token" | "id_token token" | "none" | "token", ...("code" | "code id_token" | "code id_token token" | "code token" | "id_token" | "id_token token" | "none" | "token")[]] | undefined;
+    grant_types?: ["authorization_code" | "client_credentials" | "implicit" | "password" | "refresh_token" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer", ...("authorization_code" | "client_credentials" | "implicit" | "password" | "refresh_token" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer")[]] | undefined;
+    scope?: string | undefined;
+    token_endpoint_auth_method?: "client_secret_basic" | "client_secret_jwt" | "client_secret_post" | "none" | "private_key_jwt" | "self_signed_tls_client_auth" | "tls_client_auth" | undefined;
+    token_endpoint_auth_signing_alg?: string | undefined;
+    userinfo_signed_response_alg?: string | undefined;
+    userinfo_encrypted_response_alg?: string | undefined;
+    jwks_uri?: string | undefined;
+    jwks?: {
+        keys: unknown[];
+    } | undefined;
+    application_type?: "native" | "web" | undefined;
+    subject_type?: "pairwise" | "public" | undefined;
+    request_object_signing_alg?: string | undefined;
+    id_token_signed_response_alg?: string | undefined;
+    authorization_signed_response_alg?: string | undefined;
+    authorization_encrypted_response_enc?: "A128CBC-HS256" | undefined;
+    authorization_encrypted_response_alg?: string | undefined;
+    client_name?: string | undefined;
+    client_uri?: string | undefined;
+    policy_uri?: string | undefined;
+    tos_uri?: string | undefined;
+    logo_uri?: string | undefined;
+    default_max_age?: number | undefined;
+    require_auth_time?: boolean | undefined;
+    contacts?: string[] | undefined;
+    tls_client_certificate_bound_access_tokens?: boolean | undefined;
+    dpop_bound_access_tokens?: boolean | undefined;
+    authorization_details_types?: string[] | undefined;
+    client_id: string;
+}>;
+export type ClientMetadata = TypeOf<typeof clientMetadataSchema>;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACpC,OAAO,EACL,KAAK,mCAAmC,EAIzC,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAMzC,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CACrC,IAAI,CACF,mCAAmC,EACjC,WAAW,GACX,eAAe,GACf,eAAe,GACf,YAAY,GACZ,gBAAgB,GAChB,uBAAuB,CAC1B,GAAG;IACF,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,CACF,CAAA;AAED,MAAM,MAAM,eAAe,GAAG,QAAQ,CACpC,OAAO,CAAC,IAAI,CAAC,mCAAmC,EAAE,cAAc,CAAC,CAAC,CACnE,CAAA;AAED,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK/B,CAAA;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAA"}

package/dist/types.js

@@ -0,0 +1,9 @@
+import { z } from 'zod';
+import { oauthClientIdDiscoverableSchema, oauthClientIdLoopbackSchema, oauthClientMetadataSchema, } from '@atproto/oauth-types';
+export const clientMetadataSchema = oauthClientMetadataSchema.extend({
+    client_id: z.union([
+        oauthClientIdDiscoverableSchema,
+        oauthClientIdLoopbackSchema,
+    ]),
+});
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,CAAC,EAAE,MAAM,KAAK,CAAA;AACpC,OAAO,EAEL,+BAA+B,EAC/B,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAyB7B,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,MAAM,CAAC;IACnE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC;QACjB,+BAA+B;QAC/B,2BAA2B;KAC5B,CAAC;CACH,CAAC,CAAA","sourcesContent":["import { type TypeOf, z } from 'zod'\nimport {\n  type OAuthAuthorizationRequestParameters,\n  oauthClientIdDiscoverableSchema,\n  oauthClientIdLoopbackSchema,\n  oauthClientMetadataSchema,\n} from '@atproto/oauth-types'\nimport type { Simplify } from './util.js'\n\n// Note: These types are not prefixed with `OAuth` because they are not specific\n// to OAuth. They are specific to this packages. OAuth specific types are in\n// `@atproto/oauth-types`.\n\nexport type AuthorizeOptions = Simplify<\n  Omit<\n    OAuthAuthorizationRequestParameters,\n    | 'client_id'\n    | 'response_mode'\n    | 'response_type'\n    | 'login_hint'\n    | 'code_challenge'\n    | 'code_challenge_method'\n  > & {\n    signal?: AbortSignal\n  }\n>\n\nexport type CallbackOptions = Simplify<\n  Partial<Pick<OAuthAuthorizationRequestParameters, 'redirect_uri'>>\n>\n\nexport const clientMetadataSchema = oauthClientMetadataSchema.extend({\n  client_id: z.union([\n    oauthClientIdDiscoverableSchema,\n    oauthClientIdLoopbackSchema,\n  ]),\n})\n\nexport type ClientMetadata = TypeOf<typeof clientMetadataSchema>\n"]}

package/dist/util.d.ts

@@ -0,0 +1,20 @@
+export type Awaitable<T> = T | PromiseLike<T>;
+export type Simplify<T> = {
+    [K in keyof T]: T[K];
+} & NonNullable<unknown>;
+export declare const ifString: <V>(v: V) => (V & string) | undefined;
+export declare function contentMime(headers: Headers): string | undefined;
+/**
+ * Returns an {@link AbortSignal} that aborts after `ms` milliseconds.
+ *
+ * Uses the native {@link AbortSignal.timeout} when available, and otherwise
+ * falls back to an {@link AbortController} + `setTimeout`. The static
+ * `AbortSignal.timeout` method is not implemented in every runtime this package
+ * targets (notably React Native / Expo), so relying on it directly throws a
+ * `TypeError: AbortSignal.timeout is not a function` at runtime.
+ *
+ * @see {@link https://github.com/facebook/react-native/issues/42042}
+ */
+export declare function timeoutSignal(ms: number): AbortSignal;
+export declare function combineSignals(signals: readonly (AbortSignal | undefined)[]): AbortController & Disposable;
+//# sourceMappingURL=util.d.ts.map

package/dist/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;AAC7C,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;AAEzE,eAAO,MAAM,QAAQ,GAAI,CAAC,KAAK,CAAC,6BAA4C,CAAA;AAE5E,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEhE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW,CAQrD;AAgBD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,EAAE,GAC5C,eAAe,GAAG,UAAU,CAwB9B"}

package/dist/util.js

@@ -0,0 +1,68 @@
+export const ifString = (v) => (typeof v === 'string' ? v : undefined);
+export function contentMime(headers) {
+    return headers.get('content-type')?.split(';')[0].trim();
+}
+/**
+ * Returns an {@link AbortSignal} that aborts after `ms` milliseconds.
+ *
+ * Uses the native {@link AbortSignal.timeout} when available, and otherwise
+ * falls back to an {@link AbortController} + `setTimeout`. The static
+ * `AbortSignal.timeout` method is not implemented in every runtime this package
+ * targets (notably React Native / Expo), so relying on it directly throws a
+ * `TypeError: AbortSignal.timeout is not a function` at runtime.
+ *
+ * @see {@link https://github.com/facebook/react-native/issues/42042}
+ */
+export function timeoutSignal(ms) {
+    if (typeof AbortSignal.timeout === 'function') {
+        return AbortSignal.timeout(ms);
+    }
+    const controller = new AbortController();
+    setTimeout(() => controller.abort(timeoutError(ms)), ms);
+    return controller.signal;
+}
+/**
+ * Builds the reason used to abort a {@link timeoutSignal} fallback. Mirrors the
+ * native `AbortSignal.timeout` behaviour (a `TimeoutError` `DOMException`) when
+ * `DOMException` is available, and degrades to a plain `Error` in runtimes that
+ * lack it.
+ */
+function timeoutError(ms) {
+    const message = `The operation timed out after ${ms} ms`;
+    if (typeof DOMException === 'function') {
+        return new DOMException(message, 'TimeoutError');
+    }
+    return new Error(message);
+}
+export function combineSignals(signals) {
+    const controller = new DisposableAbortController();
+    const onAbort = function (_event) {
+        const reason = new Error('This operation was aborted', {
+            cause: this.reason,
+        });
+        controller.abort(reason);
+    };
+    try {
+        for (const sig of signals) {
+            if (sig) {
+                sig.throwIfAborted();
+                sig.addEventListener('abort', onAbort, { signal: controller.signal });
+            }
+        }
+        return controller;
+    }
+    catch (err) {
+        controller.abort(err);
+        throw err;
+    }
+}
+/**
+ * Allows using {@link AbortController} with the `using` keyword, in order to
+ * automatically abort them once the execution block ends.
+ */
+class DisposableAbortController extends AbortController {
+    [Symbol.dispose]() {
+        this.abort(new Error('AbortController was disposed'));
+    }
+}
+//# sourceMappingURL=util.js.map

package/dist/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAI,CAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAE5E,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,IAAI,OAAO,WAAW,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAChC,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACxD,OAAO,UAAU,CAAC,MAAM,CAAA;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,EAAU;IAC9B,MAAM,OAAO,GAAG,iCAAiC,EAAE,KAAK,CAAA;IACxD,IAAI,OAAO,YAAY,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,OAA6C;IAE7C,MAAM,UAAU,GAAG,IAAI,yBAAyB,EAAE,CAAA;IAElD,MAAM,OAAO,GAAG,UAA6B,MAAa;QACxD,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,4BAA4B,EAAE;YACrD,KAAK,EAAE,IAAI,CAAC,MAAM;SACnB,CAAC,CAAA;QAEF,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC,CAAA;IAED,IAAI,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,EAAE,CAAC;gBACR,GAAG,CAAC,cAAc,EAAE,CAAA;gBACpB,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;YACvE,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,yBAA0B,SAAQ,eAAe;IACrD,CAAC,MAAM,CAAC,OAAO,CAAC;QACd,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAA;IACvD,CAAC;CACF","sourcesContent":["export type Awaitable<T> = T | PromiseLike<T>\nexport type Simplify<T> = { [K in keyof T]: T[K] } & NonNullable<unknown>\n\nexport const ifString = <V>(v: V) => (typeof v === 'string' ? v : undefined)\n\nexport function contentMime(headers: Headers): string | undefined {\n  return headers.get('content-type')?.split(';')[0]!.trim()\n}\n\n/**\n * Returns an {@link AbortSignal} that aborts after `ms` milliseconds.\n *\n * Uses the native {@link AbortSignal.timeout} when available, and otherwise\n * falls back to an {@link AbortController} + `setTimeout`. The static\n * `AbortSignal.timeout` method is not implemented in every runtime this package\n * targets (notably React Native / Expo), so relying on it directly throws a\n * `TypeError: AbortSignal.timeout is not a function` at runtime.\n *\n * @see {@link https://github.com/facebook/react-native/issues/42042}\n */\nexport function timeoutSignal(ms: number): AbortSignal {\n  if (typeof AbortSignal.timeout === 'function') {\n    return AbortSignal.timeout(ms)\n  }\n\n  const controller = new AbortController()\n  setTimeout(() => controller.abort(timeoutError(ms)), ms)\n  return controller.signal\n}\n\n/**\n * Builds the reason used to abort a {@link timeoutSignal} fallback. Mirrors the\n * native `AbortSignal.timeout` behaviour (a `TimeoutError` `DOMException`) when\n * `DOMException` is available, and degrades to a plain `Error` in runtimes that\n * lack it.\n */\nfunction timeoutError(ms: number): unknown {\n  const message = `The operation timed out after ${ms} ms`\n  if (typeof DOMException === 'function') {\n    return new DOMException(message, 'TimeoutError')\n  }\n  return new Error(message)\n}\n\nexport function combineSignals(\n  signals: readonly (AbortSignal | undefined)[],\n): AbortController & Disposable {\n  const controller = new DisposableAbortController()\n\n  const onAbort = function (this: AbortSignal, _event: Event) {\n    const reason = new Error('This operation was aborted', {\n      cause: this.reason,\n    })\n\n    controller.abort(reason)\n  }\n\n  try {\n    for (const sig of signals) {\n      if (sig) {\n        sig.throwIfAborted()\n        sig.addEventListener('abort', onAbort, { signal: controller.signal })\n      }\n    }\n\n    return controller\n  } catch (err) {\n    controller.abort(err)\n    throw err\n  }\n}\n\n/**\n * Allows using {@link AbortController} with the `using` keyword, in order to\n * automatically abort them once the execution block ends.\n */\nclass DisposableAbortController extends AbortController implements Disposable {\n  [Symbol.dispose]() {\n    this.abort(new Error('AbortController was disposed'))\n  }\n}\n"]}