@atproto/oauth-client 0.1.7 → 0.2.0

package/src/oauth-server-agent.ts

@@ -1,6 +1,6 @@
 import { Fetch, Json, bindFetch, fetchJsonProcessor } from '@atproto-labs/fetch'
 import { SimpleStore } from '@atproto-labs/simple-store'
-import { Key, Keyset, SignedJwt } from '@atproto/jwk'
+import { Key, Keyset } from '@atproto/jwk'
 import {
   CLIENT_ASSERTION_TYPE_JWT_BEARER,
   OAuthAuthorizationServerMetadata,
@@ -26,9 +26,8 @@ export type TokenSet = {
   iss: string
   sub: string
   aud: string
-  scope?: string
+  scope: string
 
-  id_token?: SignedJwt
   refresh_token?: string
   access_token: string
   token_type: OAuthTokenType
@@ -128,8 +127,17 @@ export class OAuthServerAgent {
     tokenResponse: OAuthTokenResponse,
   ): Promise<TokenSet> {
     const { sub } = tokenResponse
-    // ATPROTO requires that the "sub" is always present in the token response.
-    if (!sub) throw new TypeError(`Missing "sub" in token response`)
+
+    if (!sub || typeof sub !== 'string') {
+      throw new TypeError(`Unexpected ${typeof sub} "sub" in token response`)
+    }
+
+    // Using an array to check for the presence of the "atproto" scope (we don't
+    // want atproto to be a substring of another scope)
+    const scopes = tokenResponse.scope?.split(' ')
+    if (!scopes?.includes('atproto')) {
+      throw new TypeError('Missing "atproto" scope in token response')
+    }
 
     // @TODO (?) make timeout configurable
     using signal = timeoutSignal(10e3)
@@ -138,7 +146,7 @@ export class OAuthServerAgent {
       signal,
     })
 
-    if (resolved.metadata.issuer !== this.serverMetadata.issuer) {
+    if (this.serverMetadata.issuer !== resolved.metadata.issuer) {
       // Best case scenario; the user switched PDS. Worst case scenario; a bad
       // actor is trying to impersonate a user. In any case, we must not allow
       // this token to be used.
@@ -146,12 +154,12 @@ export class OAuthServerAgent {
     }
 
     return {
-      sub,
       aud: resolved.identity.pds.href,
       iss: resolved.metadata.issuer,
 
-      scope: tokenResponse.scope,
-      id_token: tokenResponse.id_token,
+      sub,
+
+      scope: tokenResponse.scope!,
       refresh_token: tokenResponse.refresh_token,
       access_token: tokenResponse.access_token,
       token_type: tokenResponse.token_type ?? 'Bearer',

package/src/{oauth-agent.ts → oauth-session.ts}

@@ -1,5 +1,5 @@
+import { asDid } from '@atproto/did'
 import { Fetch, bindFetch } from '@atproto-labs/fetch'
-import { JwtPayload, unsafeDecodeJwt } from '@atproto/jwk'
 import { OAuthAuthorizationServerMetadata } from '@atproto/oauth-types'
 
 import { TokenInvalidError } from './errors/token-invalid-error.js'
@@ -12,7 +12,16 @@ const ReadableStream = globalThis.ReadableStream as
   | typeof globalThis.ReadableStream
   | undefined
 
-export class OAuthAgent {
+export type TokenInfo = {
+  expiresAt?: Date
+  expired?: boolean
+  scope?: string
+  iss: string
+  aud: string
+  sub: string
+}
+
+export class OAuthSession {
   protected dpopFetch: Fetch<unknown>
 
   constructor(
@@ -32,40 +41,34 @@ export class OAuthAgent {
     })
   }
 
-  get serverMetadata(): Readonly<OAuthAuthorizationServerMetadata> {
-    return this.server.serverMetadata
+  get did() {
+    return asDid(this.sub)
   }
 
-  public async refreshIfNeeded(): Promise<void> {
-    await this.getTokenSet(undefined)
+  get serverMetadata(): Readonly<OAuthAuthorizationServerMetadata> {
+    return this.server.serverMetadata
   }
 
   /**
    * @param refresh See {@link SessionGetter.getSession}
    */
-  protected async getTokenSet(refresh?: boolean): Promise<TokenSet> {
+  public async getTokenSet(refresh?: boolean): Promise<TokenSet> {
     const { tokenSet } = await this.sessionGetter.getSession(this.sub, refresh)
     return tokenSet
   }
 
-  async getInfo(): Promise<{
-    userinfo?: JwtPayload
-    expired?: boolean
-    scope?: string
-    iss: string
-    aud: string
-    sub: string
-  }> {
-    const tokenSet = await this.getTokenSet()
+  async getTokenInfo(refresh?: boolean): Promise<TokenInfo> {
+    const tokenSet = await this.getTokenSet(refresh)
+    const expiresAt =
+      tokenSet.expires_at == null ? undefined : new Date(tokenSet.expires_at)
 
     return {
-      userinfo: tokenSet.id_token
-        ? unsafeDecodeJwt(tokenSet.id_token).payload
-        : undefined,
-      expired:
-        tokenSet.expires_at == null
+      expiresAt,
+      get expired() {
+        return expiresAt == null
           ? undefined
-          : new Date(tokenSet.expires_at).getTime() < Date.now() - 5e3,
+          : expiresAt.getTime() < Date.now() - 5e3
+      },
       scope: tokenSet.scope,
       iss: tokenSet.iss,
       aud: tokenSet.aud,
@@ -85,7 +88,7 @@ export class OAuthAgent {
     }
   }
 
-  async request(pathname: string, init?: RequestInit): Promise<Response> {
+  async fetchHandler(pathname: string, init?: RequestInit): Promise<Response> {
     // This will try and refresh the token if it is known to be expired
     const tokenSet = await this.getTokenSet(undefined)
 
@@ -135,7 +138,7 @@ export class OAuthAgent {
     if (isInvalidTokenResponse(finalResponse)) {
       // TODO: Is there a "softer" way to handle this, e.g. by marking the
       // session as "expired" in the session store, allowing the user to trigger
-      // a new login (using login_hint/id_token_hint)?
+      // a new login (using login_hint)?
       await this.sessionGetter.delStored(
         this.sub,
         new TokenInvalidError(this.sub),

package/src/runtime.ts

@@ -1,12 +1,8 @@
-import { JwtHeader, JwtPayload, Key, unsafeDecodeJwt } from '@atproto/jwk'
+import { Key } from '@atproto/jwk'
 import { base64url } from 'multiformats/bases/base64'
 
 import { requestLocalLock } from './lock.js'
-import {
-  DigestAlgorithm,
-  RuntimeImplementation,
-  RuntimeLock,
-} from './runtime-implementation.js'
+import { RuntimeImplementation, RuntimeLock } from './runtime-implementation.js'
 
 export class Runtime {
   readonly hasImplementationLock: boolean
@@ -38,64 +34,6 @@ export class Runtime {
     return base64url.baseEncode(bytes)
   }
 
-  public async validateIdTokenClaims(
-    token: string,
-    state: string,
-    nonce: string,
-    code?: string,
-    accessToken?: string,
-  ): Promise<{
-    header: JwtHeader
-    payload: JwtPayload
-  }> {
-    // It's fine to use unsafeDecodeJwt here because the token was received from
-    // the server's token endpoint. The following checks are to ensure that the
-    // oauth flow was indeed initiated by the client.
-    const { header, payload } = unsafeDecodeJwt(token)
-    if (!payload.nonce || payload.nonce !== nonce) {
-      throw new TypeError('Nonce mismatch')
-    }
-    if (payload.c_hash) {
-      await this.validateHashClaim(payload.c_hash, code, header)
-    }
-    if (payload.s_hash) {
-      await this.validateHashClaim(payload.s_hash, state, header)
-    }
-    if (payload.at_hash) {
-      await this.validateHashClaim(payload.at_hash, accessToken, header)
-    }
-    return { header, payload }
-  }
-
-  private async validateHashClaim(
-    claim: unknown,
-    source: unknown,
-    header: { alg: string; crv?: string },
-  ): Promise<void> {
-    if (typeof claim !== 'string' || !claim) {
-      throw new TypeError(`string "_hash" claim expected`)
-    }
-    if (typeof source !== 'string' || !source) {
-      throw new TypeError(`string value expected`)
-    }
-    const expected = await this.generateHashClaim(source, header)
-    if (expected !== claim) {
-      throw new TypeError(`"_hash" does not match`)
-    }
-  }
-
-  protected async generateHashClaim(
-    source: string,
-    header: { alg: string; crv?: string },
-  ) {
-    const algo = getHashAlgo(header)
-    const bytes = new TextEncoder().encode(source)
-    const digest = await this.implementation.digest(bytes, algo)
-    if (digest.length % 2 !== 0) throw new TypeError('Invalid digest length')
-    const digestHalf = digest.slice(0, digest.length / 2)
-    return base64url.baseEncode(digestHalf)
-  }
-
   public async generatePKCE(byteLength?: number) {
     const verifier = await this.generateVerifier(byteLength)
     return {
@@ -127,36 +65,6 @@ export class Runtime {
   }
 }
 
-function getHashAlgo(header: { alg: string; crv?: string }): DigestAlgorithm {
-  switch (header.alg) {
-    case 'HS256':
-    case 'RS256':
-    case 'PS256':
-    case 'ES256':
-    case 'ES256K':
-      return { name: 'sha256' }
-    case 'HS384':
-    case 'RS384':
-    case 'PS384':
-    case 'ES384':
-      return { name: 'sha384' }
-    case 'HS512':
-    case 'RS512':
-    case 'PS512':
-    case 'ES512':
-      return { name: 'sha512' }
-    case 'EdDSA':
-      switch (header.crv) {
-        case 'Ed25519':
-          return { name: 'sha512' }
-        default:
-          throw new TypeError('unrecognized or invalid EdDSA curve provided')
-      }
-    default:
-      throw new TypeError('unrecognized or invalid JWS algorithm provided')
-  }
-}
-
 function extractJktComponents(jwk) {
   const get = (field) => {
     const value = jwk[field]

package/src/state-store.ts

@@ -3,7 +3,6 @@ import { Key } from '@atproto/jwk'
 
 export type InternalStateData = {
   iss: string
-  nonce: string
   dpopKey: Key
   verifier?: string
   appState?: string

package/src/types.ts

@@ -16,10 +16,8 @@ export type AuthorizeOptions = {
   state?: string
   signal?: AbortSignal
 
-  // Only for OIDC compatible
+  // Borrowed from OIDC
   ui_locales?: string
-  id_token_hint?: string
-  max_age?: number
 }
 
 export const clientMetadataSchema = oauthClientMetadataSchema.extend({

package/dist/oauth-agent.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-agent.d.ts","sourceRoot":"","sources":["../src/oauth-agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAa,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAA;AAC1D,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAA;AAKvE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAMnD,qBAAa,UAAU;aAIH,MAAM,EAAE,gBAAgB;aACxB,GAAG,EAAE,MAAM;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IALhC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;gBAGjB,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,EACV,aAAa,EAAE,aAAa,EAC7C,KAAK,GAAE,KAAwB;IAajC,IAAI,cAAc,IAAI,QAAQ,CAAC,gCAAgC,CAAC,CAE/D;IAEY,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7C;;OAEG;cACa,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAK3D,OAAO,IAAI,OAAO,CAAC;QACvB,QAAQ,CAAC,EAAE,UAAU,CAAA;QACrB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,CAAC;IAkBI,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAYxB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CA2DvE"}

package/dist/oauth-agent.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-agent.js","sourceRoot":"","sources":["../src/oauth-agent.ts"],"names":[],"mappings":";;;AAAA,+CAAsD;AACtD,sCAA0D;AAG1D,4EAAmE;AACnE,4EAAmE;AACnE,mDAAkD;AAIlD,MAAM,cAAc,GAAG,UAAU,CAAC,cAErB,CAAA;AAEb,MAAa,UAAU;IAGrB,YACkB,MAAwB,EACxB,GAAW,EACV,aAA4B,EAC7C,QAAe,UAAU,CAAC,KAAK;QAH/B;;;;mBAAgB,MAAM;WAAkB;QACxC;;;;mBAAgB,GAAG;WAAQ;QAC3B;;;;mBAAiB,aAAa;WAAe;QALrC;;;;;WAAyB;QAQjC,IAAI,CAAC,SAAS,GAAG,IAAA,gCAAgB,EAAO;YACtC,KAAK,EAAE,IAAA,iBAAS,EAAC,KAAK,CAAC;YACvB,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS;YACpC,GAAG,EAAE,MAAM,CAAC,OAAO;YACnB,aAAa,EAAE,MAAM,CAAC,cAAc,CAAC,iCAAiC;YACtE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7C,MAAM,EAAE,MAAM,CAAC,UAAU;YACzB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAA;IACnC,CAAC;IAEM,KAAK,CAAC,eAAe;QAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,WAAW,CAAC,OAAiB;QAC3C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC3E,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,OAAO;QAQX,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QAEzC,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBACzB,CAAC,CAAC,IAAA,qBAAe,EAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO;gBAC5C,CAAC,CAAC,SAAS;YACb,OAAO,EACL,QAAQ,CAAC,UAAU,IAAI,IAAI;gBACzB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG;YAChE,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACzE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QACjD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAChC,IAAI,CAAC,GAAG,EACR,IAAI,0CAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAChC,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,IAAkB;QAChD,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;QAElD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAA;QAClD,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAA;QAErE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAA;QAEzC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE;YACvD,GAAG,IAAI;YACP,OAAO;SACR,CAAC,CAAA;QAEF,2DAA2D;QAC3D,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,CAAC;YAC7C,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,IAAI,aAAuB,CAAA;QAC3B,IAAI,CAAC;YACH,kBAAkB;YAClB,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,cAAc,IAAI,IAAI,EAAE,IAAI,YAAY,cAAc,EAAE,CAAC;YAC3D,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,aAAa,CAAC,UAAU,IAAI,aAAa,CAAC,YAAY,EAAE,CAAA;QAC7E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAA;QAErD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;QAEvC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAE1E,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1C,oEAAoE;YACpE,0EAA0E;YAC1E,gDAAgD;YAChD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAChC,IAAI,CAAC,GAAG,EACR,IAAI,0CAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAChC,CAAA;QACH,CAAC;QAED,OAAO,aAAa,CAAA;IACtB,CAAC;CACF;AApID,gCAoIC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,QAAkB;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IACxD,OAAO,CACL,OAAO,IAAI,IAAI;QACf,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAC1C,CAAA;AACH,CAAC"}

package/dist/oauth-atp-agent.d.ts

@@ -1,11 +0,0 @@
-import { Agent } from '@atproto/api';
-import { OAuthAgent } from './oauth-agent.js';
-export declare class OAuthAtpAgent extends Agent {
-    readonly oauthAgent: OAuthAgent;
-    constructor(oauthAgent: OAuthAgent);
-    clone(): OAuthAtpAgent;
-    get did(): string;
-    signOut(): Promise<void>;
-    refreshIfNeeded(): Promise<void>;
-}
-//# sourceMappingURL=oauth-atp-agent.d.ts.map

package/dist/oauth-atp-agent.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-atp-agent.d.ts","sourceRoot":"","sources":["../src/oauth-atp-agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAIpC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,qBAAa,aAAc,SAAQ,KAAK;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU;gBAAtB,UAAU,EAAE,UAAU;IAyB3C,KAAK,IAAI,aAAa;IAItB,IAAI,GAAG,IAAI,MAAM,CAEhB;IAEK,OAAO;IAIA,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;CAG9C"}

package/dist/oauth-atp-agent.js

@@ -1,51 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAuthAtpAgent = void 0;
-const api_1 = require("@atproto/api");
-const xrpc_1 = require("@atproto/xrpc");
-const fetch_1 = require("@atproto-labs/fetch");
-class OAuthAtpAgent extends api_1.Agent {
-    constructor(oauthAgent) {
-        super(async (url, init) => {
-            try {
-                return await this.oauthAgent.request(url, init);
-            }
-            catch (cause) {
-                if (cause instanceof fetch_1.FetchError) {
-                    const { statusCode, message } = cause;
-                    throw new xrpc_1.XRPCError(statusCode, undefined, message, undefined, {
-                        cause,
-                    });
-                }
-                if (cause instanceof fetch_1.FetchResponseError) {
-                    const { statusCode, message, response } = cause;
-                    const headers = Object.fromEntries(response.headers.entries());
-                    throw new xrpc_1.XRPCError(statusCode, undefined, message, headers, {
-                        cause,
-                    });
-                }
-                throw cause;
-            }
-        });
-        Object.defineProperty(this, "oauthAgent", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: oauthAgent
-        });
-    }
-    clone() {
-        return this.copyInto(new OAuthAtpAgent(this.oauthAgent));
-    }
-    get did() {
-        return this.oauthAgent.sub;
-    }
-    async signOut() {
-        await this.oauthAgent.signOut();
-    }
-    async refreshIfNeeded() {
-        await this.oauthAgent.refreshIfNeeded();
-    }
-}
-exports.OAuthAtpAgent = OAuthAtpAgent;
-//# sourceMappingURL=oauth-atp-agent.js.map

package/dist/oauth-atp-agent.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-atp-agent.js","sourceRoot":"","sources":["../src/oauth-atp-agent.ts"],"names":[],"mappings":";;;AAAA,sCAAoC;AACpC,wCAAyC;AACzC,+CAAoE;AAIpE,MAAa,aAAc,SAAQ,WAAK;IACtC,YAAqB,UAAsB;QACzC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACxB,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,kBAAU,EAAE,CAAC;oBAChC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;oBACrC,MAAM,IAAI,gBAAS,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;wBAC7D,KAAK;qBACN,CAAC,CAAA;gBACJ,CAAC;gBAED,IAAI,KAAK,YAAY,0BAAkB,EAAE,CAAC;oBACxC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;oBAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;oBAC9D,MAAM,IAAI,gBAAS,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE;wBAC3D,KAAK;qBACN,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CAAA;QAtBQ;;;;mBAAS,UAAU;WAAY;IAuB3C,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;IAC1D,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAA;IAC5B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAA;IACjC,CAAC;IAEM,KAAK,CAAC,eAAe;QAC1B,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAA;IACzC,CAAC;CACF;AAzCD,sCAyCC"}

package/src/oauth-atp-agent.ts

@@ -1,48 +0,0 @@
-import { Agent } from '@atproto/api'
-import { XRPCError } from '@atproto/xrpc'
-import { FetchError, FetchResponseError } from '@atproto-labs/fetch'
-
-import { OAuthAgent } from './oauth-agent.js'
-
-export class OAuthAtpAgent extends Agent {
-  constructor(readonly oauthAgent: OAuthAgent) {
-    super(async (url, init) => {
-      try {
-        return await this.oauthAgent.request(url, init)
-      } catch (cause) {
-        if (cause instanceof FetchError) {
-          const { statusCode, message } = cause
-          throw new XRPCError(statusCode, undefined, message, undefined, {
-            cause,
-          })
-        }
-
-        if (cause instanceof FetchResponseError) {
-          const { statusCode, message, response } = cause
-          const headers = Object.fromEntries(response.headers.entries())
-          throw new XRPCError(statusCode, undefined, message, headers, {
-            cause,
-          })
-        }
-
-        throw cause
-      }
-    })
-  }
-
-  clone(): OAuthAtpAgent {
-    return this.copyInto(new OAuthAtpAgent(this.oauthAgent))
-  }
-
-  get did(): string {
-    return this.oauthAgent.sub
-  }
-
-  async signOut() {
-    await this.oauthAgent.signOut()
-  }
-
-  public async refreshIfNeeded(): Promise<void> {
-    await this.oauthAgent.refreshIfNeeded()
-  }
-}