@atproto/oauth-client 0.1.0

package/dist/oauth-resolver.d.ts

@@ -0,0 +1,62 @@
+import { ResolveOptions as IdentityResolveOptions, IdentityResolver, ResolvedIdentity } from '@atproto-labs/identity-resolver';
+import { OAuthAuthorizationServerMetadata } from '@atproto/oauth-types';
+import { GetCachedOptions, OAuthAuthorizationServerMetadataResolver } from './oauth-authorization-server-metadata-resolver.js';
+import { OAuthProtectedResourceMetadataResolver } from './oauth-protected-resource-metadata-resolver.js';
+export type { GetCachedOptions };
+export type ResolveOptions = GetCachedOptions & IdentityResolveOptions;
+export declare class OAuthResolver {
+    readonly identityResolver: IdentityResolver;
+    readonly protectedResourceMetadataResolver: OAuthProtectedResourceMetadataResolver;
+    readonly authorizationServerMetadataResolver: OAuthAuthorizationServerMetadataResolver;
+    constructor(identityResolver: IdentityResolver, protectedResourceMetadataResolver: OAuthProtectedResourceMetadataResolver, authorizationServerMetadataResolver: OAuthAuthorizationServerMetadataResolver);
+    resolveIdentity(input: string, options?: IdentityResolveOptions): Promise<ResolvedIdentity>;
+    resolveMetadata(issuer: string, options?: GetCachedOptions): Promise<OAuthAuthorizationServerMetadata>;
+    resolvePdsMetadata(pds: string | URL, options?: GetCachedOptions): Promise<{
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri?: string | undefined;
+        claims_supported?: string[] | undefined;
+        claims_locales_supported?: string[] | undefined;
+        claims_parameter_supported?: boolean | undefined;
+        request_parameter_supported?: boolean | undefined;
+        request_uri_parameter_supported?: boolean | undefined;
+        require_request_uri_registration?: boolean | undefined;
+        scopes_supported?: string[] | undefined;
+        subject_types_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        response_modes_supported?: string[] | undefined;
+        grant_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        ui_locales_supported?: string[] | undefined;
+        id_token_signing_alg_values_supported?: string[] | undefined;
+        display_values_supported?: string[] | undefined;
+        request_object_signing_alg_values_supported?: string[] | undefined;
+        authorization_response_iss_parameter_supported?: boolean | undefined;
+        authorization_details_types_supported?: string[] | undefined;
+        request_object_encryption_alg_values_supported?: string[] | undefined;
+        request_object_encryption_enc_values_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        token_endpoint_auth_signing_alg_values_supported?: string[] | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+        revocation_endpoint_auth_signing_alg_values_supported?: string[] | undefined;
+        introspection_endpoint?: string | undefined;
+        introspection_endpoint_auth_methods_supported?: string[] | undefined;
+        introspection_endpoint_auth_signing_alg_values_supported?: string[] | undefined;
+        pushed_authorization_request_endpoint?: string | undefined;
+        pushed_authorization_request_endpoint_auth_methods_supported?: string[] | undefined;
+        pushed_authorization_request_endpoint_auth_signing_alg_values_supported?: string[] | undefined;
+        require_pushed_authorization_requests?: boolean | undefined;
+        userinfo_endpoint?: string | undefined;
+        end_session_endpoint?: string | undefined;
+        registration_endpoint?: string | undefined;
+        dpop_signing_alg_values_supported?: string[] | undefined;
+        protected_resources?: string[] | undefined;
+    }>;
+    resolve(input: string, options?: ResolveOptions): Promise<{
+        identity: ResolvedIdentity;
+        metadata: OAuthAuthorizationServerMetadata;
+    }>;
+}
+//# sourceMappingURL=oauth-resolver.d.ts.map

package/dist/oauth-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-resolver.d.ts","sourceRoot":"","sources":["../src/oauth-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,IAAI,sBAAsB,EACxC,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAA;AAGvE,OAAO,EACL,gBAAgB,EAChB,wCAAwC,EACzC,MAAM,mDAAmD,CAAA;AAC1D,OAAO,EAAE,sCAAsC,EAAE,MAAM,iDAAiD,CAAA;AAExG,YAAY,EAAE,gBAAgB,EAAE,CAAA;AAChC,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,sBAAsB,CAAA;AAEtE,qBAAa,aAAa;IAEtB,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB;IAC3C,QAAQ,CAAC,iCAAiC,EAAE,sCAAsC;IAClF,QAAQ,CAAC,mCAAmC,EAAE,wCAAwC;gBAF7E,gBAAgB,EAAE,gBAAgB,EAClC,iCAAiC,EAAE,sCAAsC,EACzE,mCAAmC,EAAE,wCAAwC;IAG3E,eAAe,CAC1B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAWf,eAAe,CAC1B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,gCAAgC,CAAC;IAW/B,kBAAkB,CAC7B,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,OAAO,CAAC,EAAE,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuCf,OAAO,CAClB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC;QACT,QAAQ,EAAE,gBAAgB,CAAA;QAC1B,QAAQ,EAAE,gCAAgC,CAAA;KAC3C,CAAC;CAWH"}

package/dist/oauth-resolver.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthResolver = void 0;
+const oauth_resolver_error_js_1 = require("./oauth-resolver-error.js");
+class OAuthResolver {
+    constructor(identityResolver, protectedResourceMetadataResolver, authorizationServerMetadataResolver) {
+        Object.defineProperty(this, "identityResolver", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: identityResolver
+        });
+        Object.defineProperty(this, "protectedResourceMetadataResolver", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: protectedResourceMetadataResolver
+        });
+        Object.defineProperty(this, "authorizationServerMetadataResolver", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: authorizationServerMetadataResolver
+        });
+    }
+    async resolveIdentity(input, options) {
+        try {
+            return await this.identityResolver.resolve(input, options);
+        }
+        catch (cause) {
+            throw oauth_resolver_error_js_1.OAuthResolverError.from(cause, `Failed to resolve identity: ${input}`);
+        }
+    }
+    async resolveMetadata(issuer, options) {
+        try {
+            return await this.authorizationServerMetadataResolver.get(issuer, options);
+        }
+        catch (cause) {
+            throw oauth_resolver_error_js_1.OAuthResolverError.from(cause, `Failed to resolve OAuth server metadata for issuer: ${issuer}`);
+        }
+    }
+    async resolvePdsMetadata(pds, options) {
+        try {
+            const rsMetadata = await this.protectedResourceMetadataResolver.get(pds, options);
+            const issuer = rsMetadata.authorization_servers?.[0];
+            if (!issuer) {
+                throw new oauth_resolver_error_js_1.OAuthResolverError(`No authorization servers found for PDS: ${pds}`);
+            }
+            options?.signal?.throwIfAborted();
+            const asMetadata = await this.resolveMetadata(issuer, options);
+            // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-05#section-4
+            if (asMetadata.protected_resources) {
+                if (!asMetadata.protected_resources.includes(rsMetadata.resource)) {
+                    throw new oauth_resolver_error_js_1.OAuthResolverError(`PDS "${pds}" not protected by issuer "${issuer}"`);
+                }
+            }
+            return asMetadata;
+        }
+        catch (cause) {
+            options?.signal?.throwIfAborted();
+            throw oauth_resolver_error_js_1.OAuthResolverError.from(cause, `Failed to resolve OAuth server metadata for resource: ${pds}`);
+        }
+    }
+    async resolve(input, options) {
+        options?.signal?.throwIfAborted();
+        const identity = await this.resolveIdentity(input, options);
+        options?.signal?.throwIfAborted();
+        const metadata = await this.resolvePdsMetadata(identity.pds, options);
+        return { identity, metadata };
+    }
+}
+exports.OAuthResolver = OAuthResolver;
+//# sourceMappingURL=oauth-resolver.js.map

package/dist/oauth-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-resolver.js","sourceRoot":"","sources":["../src/oauth-resolver.ts"],"names":[],"mappings":";;;AAOA,uEAA8D;AAU9D,MAAa,aAAa;IACxB,YACW,gBAAkC,EAClC,iCAAyE,EACzE,mCAA6E;QAFtF;;;;mBAAS,gBAAgB;WAAkB;QAC3C;;;;mBAAS,iCAAiC;WAAwC;QAClF;;;;mBAAS,mCAAmC;WAA0C;IACrF,CAAC;IAEG,KAAK,CAAC,eAAe,CAC1B,KAAa,EACb,OAAgC;QAEhC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,4CAAkB,CAAC,IAAI,CAC3B,KAAK,EACL,+BAA+B,KAAK,EAAE,CACvC,CAAA;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,eAAe,CAC1B,MAAc,EACd,OAA0B;QAE1B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,4CAAkB,CAAC,IAAI,CAC3B,KAAK,EACL,uDAAuD,MAAM,EAAE,CAChE,CAAA;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,GAAiB,EACjB,OAA0B;QAE1B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,GAAG,CACjE,GAAG,EACH,OAAO,CACR,CAAA;YAED,MAAM,MAAM,GAAG,UAAU,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAA;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,4CAAkB,CAC1B,2CAA2C,GAAG,EAAE,CACjD,CAAA;YACH,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;YAEjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAE9D,wFAAwF;YACxF,IAAI,UAAU,CAAC,mBAAmB,EAAE,CAAC;gBACnC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAClE,MAAM,IAAI,4CAAkB,CAC1B,QAAQ,GAAG,8BAA8B,MAAM,GAAG,CACnD,CAAA;gBACH,CAAC;YACH,CAAC;YAED,OAAO,UAAU,CAAA;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;YAEjC,MAAM,4CAAkB,CAAC,IAAI,CAC3B,KAAK,EACL,yDAAyD,GAAG,EAAE,CAC/D,CAAA;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,OAAO,CAClB,KAAa,EACb,OAAwB;QAKxB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;QAEjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAE3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;QAEjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAErE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;CACF;AA7FD,sCA6FC"}

package/dist/oauth-response-error.d.ts

@@ -0,0 +1,11 @@
+import { Json } from '@atproto-labs/fetch';
+export declare class OAuthResponseError extends Error {
+    readonly response: Response;
+    readonly payload: Json;
+    readonly error?: string;
+    readonly errorDescription?: string;
+    constructor(response: Response, payload: Json);
+    get status(): number;
+    get headers(): Headers;
+}
+//# sourceMappingURL=oauth-response-error.d.ts.map

package/dist/oauth-response-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-response-error.d.ts","sourceRoot":"","sources":["../src/oauth-response-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAsB,MAAM,qBAAqB,CAAA;AAE9D,qBAAa,kBAAmB,SAAQ,KAAK;aAKzB,QAAQ,EAAE,QAAQ;aAClB,OAAO,EAAE,IAAI;IAL/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;gBAGhB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,IAAI;IAe/B,IAAI,MAAM,WAET;IAED,IAAI,OAAO,YAEV;CACF"}

package/dist/oauth-response-error.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthResponseError = void 0;
+const fetch_1 = require("@atproto-labs/fetch");
+class OAuthResponseError extends Error {
+    constructor(response, payload) {
+        const error = (0, fetch_1.ifString)((0, fetch_1.ifObject)(payload)?.['error']);
+        const errorDescription = (0, fetch_1.ifString)((0, fetch_1.ifObject)(payload)?.['error_description']);
+        const messageError = error ? `"${error}"` : 'unknown';
+        const messageDesc = errorDescription ? `: ${errorDescription}` : '';
+        const message = `OAuth ${messageError} error${messageDesc}`;
+        super(message);
+        Object.defineProperty(this, "response", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: response
+        });
+        Object.defineProperty(this, "payload", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: payload
+        });
+        Object.defineProperty(this, "error", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "errorDescription", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.error = error;
+        this.errorDescription = errorDescription;
+    }
+    get status() {
+        return this.response.status;
+    }
+    get headers() {
+        return this.response.headers;
+    }
+}
+exports.OAuthResponseError = OAuthResponseError;
+//# sourceMappingURL=oauth-response-error.js.map

package/dist/oauth-response-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-response-error.js","sourceRoot":"","sources":["../src/oauth-response-error.ts"],"names":[],"mappings":";;;AAAA,+CAA8D;AAE9D,MAAa,kBAAmB,SAAQ,KAAK;IAI3C,YACkB,QAAkB,EAClB,OAAa;QAE7B,MAAM,KAAK,GAAG,IAAA,gBAAQ,EAAC,IAAA,gBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;QACpD,MAAM,gBAAgB,GAAG,IAAA,gBAAQ,EAAC,IAAA,gBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAA;QAE3E,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;QACrD,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACnE,MAAM,OAAO,GAAG,SAAS,YAAY,SAAS,WAAW,EAAE,CAAA;QAE3D,KAAK,CAAC,OAAO,CAAC,CAAA;QAVd;;;;mBAAgB,QAAQ;WAAU;QAClC;;;;mBAAgB,OAAO;WAAM;QALtB;;;;;WAAc;QACd;;;;;WAAyB;QAehC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAA;IAC1C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAA;IAC7B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAA;IAC9B,CAAC;CACF;AA5BD,gDA4BC"}

package/dist/oauth-server-agent.d.ts

@@ -0,0 +1,51 @@
+import { Fetch, Json } from '@atproto-labs/fetch';
+import { SimpleStore } from '@atproto-labs/simple-store';
+import { Key, Keyset, SignedJwt } from '@atproto/jwk';
+import { OAuthAuthorizationServerMetadata, OAuthClientIdentification, OAuthEndpointName, OAuthParResponse, OAuthTokenResponse, OAuthTokenType } from '@atproto/oauth-types';
+import { OAuthResolver } from './oauth-resolver.js';
+import { Runtime } from './runtime.js';
+import { ClientMetadata } from './types.js';
+export type TokenSet = {
+    iss: string;
+    sub: string;
+    aud: string;
+    scope?: string;
+    id_token?: SignedJwt;
+    refresh_token?: string;
+    access_token: string;
+    token_type: OAuthTokenType;
+    /** ISO Date */
+    expires_at?: string;
+};
+export type DpopNonceCache = SimpleStore<string, string>;
+export declare class OAuthServerAgent {
+    readonly dpopKey: Key;
+    readonly serverMetadata: OAuthAuthorizationServerMetadata;
+    readonly clientMetadata: ClientMetadata;
+    readonly dpopNonces: DpopNonceCache;
+    readonly oauthResolver: OAuthResolver;
+    readonly runtime: Runtime;
+    readonly keyset?: Keyset<Key> | undefined;
+    protected dpopFetch: Fetch<unknown>;
+    constructor(dpopKey: Key, serverMetadata: OAuthAuthorizationServerMetadata, clientMetadata: ClientMetadata, dpopNonces: DpopNonceCache, oauthResolver: OAuthResolver, runtime: Runtime, keyset?: Keyset<Key> | undefined, fetch?: Fetch);
+    revoke(token: string): Promise<void>;
+    exchangeCode(code: string, verifier?: string): Promise<TokenSet>;
+    refresh(tokenSet: TokenSet): Promise<TokenSet>;
+    /**
+     * VERY IMPORTANT ! Always call this to process token responses.
+     *
+     * Whenever an OAuth token response is received, we **MUST** verify that the
+     * "sub" is a DID, whose issuer authority is indeed the server we just
+     * obtained credentials from. This check is a critical step to actually be
+     * able to use the "sub" (DID) as being the actual user's identifier.
+     */
+    private processTokenResponse;
+    request(endpoint: 'token', payload: Record<string, unknown>): Promise<OAuthTokenResponse>;
+    request(endpoint: 'pushed_authorization_request', payload: Record<string, unknown>): Promise<OAuthParResponse>;
+    request(endpoint: OAuthEndpointName, payload: Record<string, unknown>): Promise<Json>;
+    buildClientAuth(endpoint: OAuthEndpointName): Promise<{
+        headers?: Record<string, string>;
+        payload: OAuthClientIdentification;
+    }>;
+}
+//# sourceMappingURL=oauth-server-agent.d.ts.map

package/dist/oauth-server-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server-agent.d.ts","sourceRoot":"","sources":["../src/oauth-server-agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAiC,MAAM,qBAAqB,CAAA;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACxD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAEL,gCAAgC,EAChC,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EAGf,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAGnD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAG3C,MAAM,MAAM,QAAQ,GAAG;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,QAAQ,CAAC,EAAE,SAAS,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,cAAc,CAAA;IAC1B,eAAe;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAExD,qBAAa,gBAAgB;IAIzB,QAAQ,CAAC,OAAO,EAAE,GAAG;IACrB,QAAQ,CAAC,cAAc,EAAE,gCAAgC;IACzD,QAAQ,CAAC,cAAc,EAAE,cAAc;IACvC,QAAQ,CAAC,UAAU,EAAE,cAAc;IACnC,QAAQ,CAAC,aAAa,EAAE,aAAa;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO;IACzB,QAAQ,CAAC,MAAM,CAAC;IATlB,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;gBAGxB,OAAO,EAAE,GAAG,EACZ,cAAc,EAAE,gCAAgC,EAChD,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,cAAc,EAC1B,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,yBAAQ,EACxB,KAAK,CAAC,EAAE,KAAK;IAaT,MAAM,CAAC,KAAK,EAAE,MAAM;IAQpB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAiBhE,OAAO,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IA6BpD;;;;;;;OAOG;YACW,oBAAoB;IAoC5B,OAAO,CACX,QAAQ,EAAE,OAAO,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IACxB,OAAO,CACX,QAAQ,EAAE,8BAA8B,EACxC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IACtB,OAAO,CACX,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC;IA4BV,eAAe,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAChC,OAAO,EAAE,yBAAyB,CAAA;KACnC,CAAC;CAsEH"}

package/dist/oauth-server-agent.js

@@ -0,0 +1,228 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthServerAgent = void 0;
+const fetch_1 = require("@atproto-labs/fetch");
+const oauth_types_1 = require("@atproto/oauth-types");
+const constants_js_1 = require("./constants.js");
+const fetch_dpop_js_1 = require("./fetch-dpop.js");
+const oauth_response_error_js_1 = require("./oauth-response-error.js");
+const refresh_error_js_1 = require("./refresh-error.js");
+const util_js_1 = require("./util.js");
+class OAuthServerAgent {
+    constructor(dpopKey, serverMetadata, clientMetadata, dpopNonces, oauthResolver, runtime, keyset, fetch) {
+        Object.defineProperty(this, "dpopKey", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: dpopKey
+        });
+        Object.defineProperty(this, "serverMetadata", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: serverMetadata
+        });
+        Object.defineProperty(this, "clientMetadata", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: clientMetadata
+        });
+        Object.defineProperty(this, "dpopNonces", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: dpopNonces
+        });
+        Object.defineProperty(this, "oauthResolver", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: oauthResolver
+        });
+        Object.defineProperty(this, "runtime", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: runtime
+        });
+        Object.defineProperty(this, "keyset", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: keyset
+        });
+        Object.defineProperty(this, "dpopFetch", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.dpopFetch = (0, fetch_dpop_js_1.dpopFetchWrapper)({
+            fetch: (0, fetch_1.bindFetch)(fetch),
+            iss: clientMetadata.client_id,
+            key: dpopKey,
+            supportedAlgs: serverMetadata.dpop_signing_alg_values_supported,
+            sha256: async (v) => runtime.sha256(v),
+            nonces: dpopNonces,
+            isAuthServer: true,
+        });
+    }
+    async revoke(token) {
+        try {
+            await this.request('revocation', { token });
+        }
+        catch {
+            // Don't care
+        }
+    }
+    async exchangeCode(code, verifier) {
+        const tokenResponse = await this.request('token', {
+            grant_type: 'authorization_code',
+            redirect_uri: this.clientMetadata.redirect_uris[0],
+            code,
+            code_verifier: verifier,
+        });
+        try {
+            return this.processTokenResponse(tokenResponse);
+        }
+        catch (err) {
+            await this.revoke(tokenResponse.access_token);
+            throw err;
+        }
+    }
+    async refresh(tokenSet) {
+        if (!tokenSet.refresh_token) {
+            throw new refresh_error_js_1.RefreshError(tokenSet.sub, 'No refresh token available');
+        }
+        const tokenResponse = await this.request('token', {
+            grant_type: 'refresh_token',
+            refresh_token: tokenSet.refresh_token,
+        });
+        try {
+            if (tokenSet.sub !== tokenResponse.sub) {
+                throw new refresh_error_js_1.RefreshError(tokenSet.sub, `Unexpected "sub" in token response (${tokenResponse.sub})`);
+            }
+            if (tokenSet.iss !== this.serverMetadata.issuer) {
+                throw new refresh_error_js_1.RefreshError(tokenSet.sub, 'Issuer mismatch');
+            }
+            return this.processTokenResponse(tokenResponse);
+        }
+        catch (err) {
+            await this.revoke(tokenResponse.access_token);
+            throw err;
+        }
+    }
+    /**
+     * VERY IMPORTANT ! Always call this to process token responses.
+     *
+     * Whenever an OAuth token response is received, we **MUST** verify that the
+     * "sub" is a DID, whose issuer authority is indeed the server we just
+     * obtained credentials from. This check is a critical step to actually be
+     * able to use the "sub" (DID) as being the actual user's identifier.
+     */
+    async processTokenResponse(tokenResponse) {
+        const { sub } = tokenResponse;
+        // ATPROTO requires that the "sub" is always present in the token response.
+        if (!sub)
+            throw new TypeError(`Missing "sub" in token response`);
+        // @TODO (?) make timeout configurable
+        const resolved = await (0, util_js_1.withSignal)({ timeout: 10e3 }, (signal) => this.oauthResolver.resolve(sub, { signal }));
+        if (resolved.metadata.issuer !== this.serverMetadata.issuer) {
+            // Best case scenario; the user switched PDS. Worst case scenario; a bad
+            // actor is trying to impersonate a user. In any case, we must not allow
+            // this token to be used.
+            throw new TypeError('Issuer mismatch');
+        }
+        return {
+            sub,
+            aud: resolved.identity.pds.href,
+            iss: resolved.metadata.issuer,
+            scope: tokenResponse.scope,
+            id_token: tokenResponse.id_token,
+            refresh_token: tokenResponse.refresh_token,
+            access_token: tokenResponse.access_token,
+            token_type: tokenResponse.token_type ?? 'Bearer',
+            expires_at: typeof tokenResponse.expires_in === 'number'
+                ? new Date(Date.now() + tokenResponse.expires_in * 1000).toISOString()
+                : undefined,
+        };
+    }
+    async request(endpoint, payload) {
+        const url = this.serverMetadata[`${endpoint}_endpoint`];
+        if (!url)
+            throw new Error(`No ${endpoint} endpoint available`);
+        const auth = await this.buildClientAuth(endpoint);
+        const { response, json } = await this.dpopFetch(url, {
+            method: 'POST',
+            headers: { ...auth.headers, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ ...payload, ...auth.payload }),
+        }).then((0, fetch_1.fetchJsonProcessor)());
+        if (response.ok) {
+            switch (endpoint) {
+                case 'token':
+                    return oauth_types_1.oauthTokenResponseSchema.parse(json);
+                case 'pushed_authorization_request':
+                    return oauth_types_1.oauthParResponseSchema.parse(json);
+                default:
+                    return json;
+            }
+        }
+        else {
+            throw new oauth_response_error_js_1.OAuthResponseError(response, json);
+        }
+    }
+    async buildClientAuth(endpoint) {
+        const methodSupported = this.serverMetadata[`${endpoint}_endpoint_auth_methods_supported`] ||
+            this.serverMetadata[`token_endpoint_auth_methods_supported`];
+        const method = this.clientMetadata[`${endpoint}_endpoint_auth_method`] ||
+            this.clientMetadata[`token_endpoint_auth_method`];
+        if (method === 'private_key_jwt' ||
+            (this.keyset &&
+                !method &&
+                (methodSupported?.includes('private_key_jwt') ?? false))) {
+            if (!this.keyset)
+                throw new Error('No keyset available');
+            try {
+                const alg = this.serverMetadata[`${endpoint}_endpoint_auth_signing_alg_values_supported`] ??
+                    this.serverMetadata[`token_endpoint_auth_signing_alg_values_supported`] ??
+                    constants_js_1.FALLBACK_ALG;
+                // If jwks is defined, make sure to only sign using a key that exists in
+                // the jwks. If jwks_uri is defined, we can't be sure that the key we're
+                // looking for is in there so we will just assume it is.
+                const kid = this.clientMetadata.jwks?.keys
+                    .map(({ kid }) => kid)
+                    .filter((v) => typeof v === 'string');
+                return {
+                    payload: {
+                        client_id: this.clientMetadata.client_id,
+                        client_assertion_type: oauth_types_1.CLIENT_ASSERTION_TYPE_JWT_BEARER,
+                        client_assertion: await this.keyset.createJwt({ alg, kid }, {
+                            iss: this.clientMetadata.client_id,
+                            sub: this.clientMetadata.client_id,
+                            aud: this.serverMetadata.issuer,
+                            jti: await this.runtime.generateNonce(),
+                            iat: Math.floor(Date.now() / 1000),
+                        }),
+                    },
+                };
+            }
+            catch (err) {
+                if (method === 'private_key_jwt')
+                    throw err;
+                // Else try next method
+            }
+        }
+        if (method === 'none' ||
+            (!method && (methodSupported?.includes('none') ?? true))) {
+            return {
+                payload: {
+                    client_id: this.clientMetadata.client_id,
+                },
+            };
+        }
+        throw new Error(`Unsupported ${endpoint} authentication method`);
+    }
+}
+exports.OAuthServerAgent = OAuthServerAgent;
+//# sourceMappingURL=oauth-server-agent.js.map

package/dist/oauth-server-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server-agent.js","sourceRoot":"","sources":["../src/oauth-server-agent.ts"],"names":[],"mappings":";;;AAAA,+CAAgF;AAGhF,sDAU6B;AAE7B,iDAA6C;AAC7C,mDAAkD;AAElD,uEAA8D;AAC9D,yDAAiD;AAGjD,uCAAsC;AAkBtC,MAAa,gBAAgB;IAG3B,YACW,OAAY,EACZ,cAAgD,EAChD,cAA8B,EAC9B,UAA0B,EAC1B,aAA4B,EAC5B,OAAgB,EAChB,MAAe,EACxB,KAAa;QAPb;;;;mBAAS,OAAO;WAAK;QACrB;;;;mBAAS,cAAc;WAAkC;QACzD;;;;mBAAS,cAAc;WAAgB;QACvC;;;;mBAAS,UAAU;WAAgB;QACnC;;;;mBAAS,aAAa;WAAe;QACrC;;;;mBAAS,OAAO;WAAS;QACzB;;;;mBAAS,MAAM;WAAS;QAThB;;;;;WAAyB;QAYjC,IAAI,CAAC,SAAS,GAAG,IAAA,gCAAgB,EAAO;YACtC,KAAK,EAAE,IAAA,iBAAS,EAAC,KAAK,CAAC;YACvB,GAAG,EAAE,cAAc,CAAC,SAAS;YAC7B,GAAG,EAAE,OAAO;YACZ,aAAa,EAAE,cAAc,CAAC,iCAAiC;YAC/D,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACtC,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,QAAiB;QAChD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;YAChD,UAAU,EAAE,oBAAoB;YAChC,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAE;YACnD,IAAI;YACJ,aAAa,EAAE,QAAQ;SACxB,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAA;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAA;YAE7C,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAkB;QAC9B,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC5B,MAAM,IAAI,+BAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;YAChD,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,QAAQ,CAAC,aAAa;SACtC,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,GAAG,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC;gBACvC,MAAM,IAAI,+BAAY,CACpB,QAAQ,CAAC,GAAG,EACZ,uCAAuC,aAAa,CAAC,GAAG,GAAG,CAC5D,CAAA;YACH,CAAC;YACD,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;gBAChD,MAAM,IAAI,+BAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;YACzD,CAAC;YAED,OAAO,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAA;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAA;YAE7C,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,oBAAoB,CAChC,aAAiC;QAEjC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAA;QAC7B,2EAA2E;QAC3E,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAA;QAEhE,sCAAsC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAU,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAC9D,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAC5C,CAAA;QAED,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;YAC5D,wEAAwE;YACxE,wEAAwE;YACxE,yBAAyB;YACzB,MAAM,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAA;QACxC,CAAC;QAED,OAAO;YACL,GAAG;YACH,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI;YAC/B,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM;YAE7B,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,UAAU,EAAE,aAAa,CAAC,UAAU,IAAI,QAAQ;YAChD,UAAU,EACR,OAAO,aAAa,CAAC,UAAU,KAAK,QAAQ;gBAC1C,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;gBACtE,CAAC,CAAC,SAAS;SAChB,CAAA;IACH,CAAC;IAeD,KAAK,CAAC,OAAO,CAAC,QAA2B,EAAE,OAAgC;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,QAAQ,WAAW,CAAC,CAAA;QACvD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,QAAQ,qBAAqB,CAAC,CAAA;QAE9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;QAEjD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;SACtD,CAAC,CAAC,IAAI,CAAC,IAAA,0BAAkB,GAAE,CAAC,CAAA;QAE7B,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,QAAQ,QAAQ,EAAE,CAAC;gBACjB,KAAK,OAAO;oBACV,OAAO,sCAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC7C,KAAK,8BAA8B;oBACjC,OAAO,oCAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC3C;oBACE,OAAO,IAAI,CAAA;YACf,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,4CAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAA2B;QAI/C,MAAM,eAAe,GACnB,IAAI,CAAC,cAAc,CAAC,GAAG,QAAQ,kCAAkC,CAAC;YAClE,IAAI,CAAC,cAAc,CAAC,uCAAuC,CAAC,CAAA;QAE9D,MAAM,MAAM,GACV,IAAI,CAAC,cAAc,CAAC,GAAG,QAAQ,uBAAuB,CAAC;YACvD,IAAI,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAAA;QAEnD,IACE,MAAM,KAAK,iBAAiB;YAC5B,CAAC,IAAI,CAAC,MAAM;gBACV,CAAC,MAAM;gBACP,CAAC,eAAe,EAAE,QAAQ,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,CAAC,EAC1D,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;YAExD,IAAI,CAAC;gBACH,MAAM,GAAG,GACP,IAAI,CAAC,cAAc,CACjB,GAAG,QAAQ,6CAA6C,CACzD;oBACD,IAAI,CAAC,cAAc,CACjB,kDAAkD,CACnD;oBACD,2BAAY,CAAA;gBAEd,wEAAwE;gBACxE,wEAAwE;gBACxE,wDAAwD;gBACxD,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI;qBACvC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC;qBACrB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAA;gBAEpD,OAAO;oBACL,OAAO,EAAE;wBACP,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,SAAS;wBACxC,qBAAqB,EAAE,8CAAgC;wBACvD,gBAAgB,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAC3C,EAAE,GAAG,EAAE,GAAG,EAAE,EACZ;4BACE,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,SAAS;4BAClC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,SAAS;4BAClC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM;4BAC/B,GAAG,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE;4BACvC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;yBACnC,CACF;qBACF;iBACF,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,MAAM,KAAK,iBAAiB;oBAAE,MAAM,GAAG,CAAA;gBAE3C,uBAAuB;YACzB,CAAC;QACH,CAAC;QAED,IACE,MAAM,KAAK,MAAM;YACjB,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,EACxD,CAAC;YACD,OAAO;gBACL,OAAO,EAAE;oBACP,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,SAAS;iBACzC;aACF,CAAA;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,wBAAwB,CAAC,CAAA;IAClE,CAAC;CACF;AA1OD,4CA0OC"}

package/dist/oauth-server-factory.d.ts

@@ -0,0 +1,20 @@
+import { Fetch } from '@atproto-labs/fetch';
+import { Key, Keyset } from '@atproto/jwk';
+import { OAuthAuthorizationServerMetadata } from '@atproto/oauth-types';
+import { GetCachedOptions } from './oauth-authorization-server-metadata-resolver.js';
+import { OAuthResolver } from './oauth-resolver.js';
+import { DpopNonceCache, OAuthServerAgent } from './oauth-server-agent.js';
+import { Runtime } from './runtime.js';
+import { ClientMetadata } from './types.js';
+export declare class OAuthServerFactory {
+    readonly clientMetadata: ClientMetadata;
+    readonly runtime: Runtime;
+    readonly resolver: OAuthResolver;
+    readonly fetch: Fetch;
+    readonly keyset: Keyset | undefined;
+    readonly dpopNonceCache: DpopNonceCache;
+    constructor(clientMetadata: ClientMetadata, runtime: Runtime, resolver: OAuthResolver, fetch: Fetch, keyset: Keyset | undefined, dpopNonceCache: DpopNonceCache);
+    fromIssuer(issuer: string, dpopKey: Key, options?: GetCachedOptions): Promise<OAuthServerAgent>;
+    fromMetadata(serverMetadata: OAuthAuthorizationServerMetadata, dpopKey: Key): Promise<OAuthServerAgent>;
+}
+//# sourceMappingURL=oauth-server-factory.d.ts.map

package/dist/oauth-server-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server-factory.d.ts","sourceRoot":"","sources":["../src/oauth-server-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mDAAmD,CAAA;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,qBAAa,kBAAkB;IAE3B,QAAQ,CAAC,cAAc,EAAE,cAAc;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO;IACzB,QAAQ,CAAC,QAAQ,EAAE,aAAa;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS;IACnC,QAAQ,CAAC,cAAc,EAAE,cAAc;gBAL9B,cAAc,EAAE,cAAc,EAC9B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,cAAc,EAAE,cAAc;IAGnC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,gBAAgB;IAKnE,YAAY,CAChB,cAAc,EAAE,gCAAgC,EAChD,OAAO,EAAE,GAAG;CAaf"}

package/dist/oauth-server-factory.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthServerFactory = void 0;
+const oauth_server_agent_js_1 = require("./oauth-server-agent.js");
+class OAuthServerFactory {
+    constructor(clientMetadata, runtime, resolver, fetch, keyset, dpopNonceCache) {
+        Object.defineProperty(this, "clientMetadata", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: clientMetadata
+        });
+        Object.defineProperty(this, "runtime", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: runtime
+        });
+        Object.defineProperty(this, "resolver", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: resolver
+        });
+        Object.defineProperty(this, "fetch", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: fetch
+        });
+        Object.defineProperty(this, "keyset", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: keyset
+        });
+        Object.defineProperty(this, "dpopNonceCache", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: dpopNonceCache
+        });
+    }
+    async fromIssuer(issuer, dpopKey, options) {
+        const serverMetadata = await this.resolver.resolveMetadata(issuer, options);
+        return this.fromMetadata(serverMetadata, dpopKey);
+    }
+    async fromMetadata(serverMetadata, dpopKey) {
+        return new oauth_server_agent_js_1.OAuthServerAgent(dpopKey, serverMetadata, this.clientMetadata, this.dpopNonceCache, this.resolver, this.runtime, this.keyset, this.fetch);
+    }
+}
+exports.OAuthServerFactory = OAuthServerFactory;
+//# sourceMappingURL=oauth-server-factory.js.map

package/dist/oauth-server-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server-factory.js","sourceRoot":"","sources":["../src/oauth-server-factory.ts"],"names":[],"mappings":";;;AAMA,mEAA0E;AAI1E,MAAa,kBAAkB;IAC7B,YACW,cAA8B,EAC9B,OAAgB,EAChB,QAAuB,EACvB,KAAY,EACZ,MAA0B,EAC1B,cAA8B;QALvC;;;;mBAAS,cAAc;WAAgB;QACvC;;;;mBAAS,OAAO;WAAS;QACzB;;;;mBAAS,QAAQ;WAAe;QAChC;;;;mBAAS,KAAK;WAAO;QACrB;;;;mBAAS,MAAM;WAAoB;QACnC;;;;mBAAS,cAAc;WAAgB;IACtC,CAAC;IAEJ,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAY,EAAE,OAA0B;QACvE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC3E,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,cAAgD,EAChD,OAAY;QAEZ,OAAO,IAAI,wCAAgB,CACzB,OAAO,EACP,cAAc,EACd,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;CACF;AA9BD,gDA8BC"}

package/dist/refresh-error.d.ts

@@ -0,0 +1,7 @@
+export declare class RefreshError extends Error {
+    readonly sub: string;
+    constructor(sub: string, message: string, options?: {
+        cause?: unknown;
+    });
+}
+//# sourceMappingURL=refresh-error.d.ts.map

package/dist/refresh-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-error.d.ts","sourceRoot":"","sources":["../src/refresh-error.ts"],"names":[],"mappings":"AAAA,qBAAa,YAAa,SAAQ,KAAK;aAEnB,GAAG,EAAE,MAAM;gBAAX,GAAG,EAAE,MAAM,EAC3B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAIhC"}

package/dist/refresh-error.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefreshError = void 0;
+class RefreshError extends Error {
+    constructor(sub, message, options) {
+        super(message, options);
+        Object.defineProperty(this, "sub", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: sub
+        });
+    }
+}
+exports.RefreshError = RefreshError;
+//# sourceMappingURL=refresh-error.js.map

package/dist/refresh-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-error.js","sourceRoot":"","sources":["../src/refresh-error.ts"],"names":[],"mappings":";;;AAAA,MAAa,YAAa,SAAQ,KAAK;IACrC,YACkB,GAAW,EAC3B,OAAe,EACf,OAA6B;QAE7B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAJvB;;;;mBAAgB,GAAG;WAAQ;IAK7B,CAAC;CACF;AARD,oCAQC"}

package/dist/runtime-implementation.d.ts

@@ -0,0 +1,12 @@
+import { Key } from '@atproto/jwk';
+export type DigestAlgorithm = {
+    name: 'sha256' | 'sha384' | 'sha512';
+};
+export type { Key };
+export interface RuntimeImplementation {
+    createKey(algs: string[]): Key | PromiseLike<Key>;
+    getRandomValues: (length: number) => Uint8Array | PromiseLike<Uint8Array>;
+    digest: (bytes: Uint8Array, algorithm: DigestAlgorithm) => Uint8Array | PromiseLike<Uint8Array>;
+    requestLock?: <T>(name: string, fn: () => T | PromiseLike<T>) => Promise<T>;
+}
+//# sourceMappingURL=runtime-implementation.d.ts.map